_ZNK5Botan7AES_1284nameEv: 28| 86| std::string name() const override { return "AES-128"; } _ZNK5Botan7AES_2564nameEv: 119| 157| std::string name() const override { return "AES-256"; } _ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EED2Ev: 64| 20.6k| ~AlignmentBuffer() { secure_zeroize_buffer(m_buffer.data(), sizeof(T) * m_buffer.size()); } _ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EEC2Ev: 62| 20.6k| AlignmentBuffer() = default; _ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE5clearEv: 71| 101k| void clear() { 72| 101k| zeroize_buffer(m_buffer.data(), m_buffer.size()); 73| 101k| m_position = 0; 74| 101k| } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EEC2Ev: 62| 970| AlignmentBuffer() = default; _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE5clearEv: 71| 8.60k| void clear() { 72| 8.60k| zeroize_buffer(m_buffer.data(), m_buffer.size()); 73| 8.60k| m_position = 0; 74| 8.60k| } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EED2Ev: 64| 970| ~AlignmentBuffer() { secure_zeroize_buffer(m_buffer.data(), sizeof(T) * m_buffer.size()); } _ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE21handle_unaligned_dataERNS_12BufferSlicerE: 166| 146k| [[nodiscard]] std::optional> handle_unaligned_data(BufferSlicer& slicer) { 167| | // When the final block is to be deferred, we would need to store and 168| | // hold a buffer that contains exactly one block until more data is 169| | // passed or it is explicitly consumed. 170| 146k| const size_t defer = (defers_final_block()) ? 1 : 0; ------------------ | Branch (170:31): [True: 0, False: 146k] ------------------ 171| | 172| 146k| if(in_alignment() && slicer.remaining() >= m_buffer.size() + defer) { ------------------ | Branch (172:13): [True: 135k, False: 10.8k] | Branch (172:31): [True: 51.2k, False: 84.0k] ------------------ 173| | // We are currently in alignment and the passed-in data source 174| | // contains enough data to benefit from aligned processing. 175| | // Therefore, we don't copy anything into the intermittent buffer. 176| 51.2k| return std::nullopt; 177| 51.2k| } 178| | 179| | // Fill the buffer with as much input data as needed to reach alignment 180| | // or until the input source is depleted. 181| 94.8k| const auto elements_to_consume = std::min(m_buffer.size() - m_position, slicer.remaining()); 182| 94.8k| append(slicer.take(elements_to_consume)); 183| | 184| | // If we collected enough data, we push out one full block. When 185| | // deferring the final block is enabled, we additionally check that 186| | // more input data is available to continue processing a consecutive 187| | // block. 188| 94.8k| if(ready_to_consume() && (!defers_final_block() || !slicer.empty())) { ------------------ | Branch (188:13): [True: 5.36k, False: 89.4k] | Branch (188:36): [True: 5.36k, False: 0] | Branch (188:61): [True: 0, False: 0] ------------------ 189| 5.36k| return consume(); 190| 89.4k| } else { 191| 89.4k| return std::nullopt; 192| 89.4k| } 193| 94.8k| } _ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE18defers_final_blockEv: 233| 208k| constexpr bool defers_final_block() const { 234| 208k| return FINAL_BLOCK_STRATEGY == AlignmentBufferFinalBlock::must_be_deferred; 235| 208k| } _ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE6appendENSt3__14spanIKhLm18446744073709551615EEE: 90| 173k| void append(std::span elements) { 91| 173k| BOTAN_ASSERT_NOMSG(elements.size() <= elements_until_alignment()); ------------------ | | 77| 173k| do { \ | | 78| 173k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 173k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 173k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 173k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 173k] | | ------------------ ------------------ 92| 173k| std::copy(elements.begin(), elements.end(), m_buffer.begin() + m_position); 93| 173k| m_position += elements.size(); 94| 173k| } _ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE24elements_until_alignmentEv: 221| 434k| size_t elements_until_alignment() const { return m_buffer.size() - m_position; } _ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE16ready_to_consumeEv: 231| 386k| bool ready_to_consume() const { return m_position == m_buffer.size(); } _ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE7consumeEv: 200| 109k| [[nodiscard]] std::span consume() { 201| 109k| BOTAN_ASSERT_NOMSG(ready_to_consume()); ------------------ | | 77| 109k| do { \ | | 78| 109k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 109k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 109k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 109k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 109k] | | ------------------ ------------------ 202| 109k| m_position = 0; 203| 109k| return m_buffer; 204| 109k| } _ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE12in_alignmentEv: 226| 348k| bool in_alignment() const { return m_position == 0; } _ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE23aligned_data_to_processERNS_12BufferSlicerE: 126| 56.6k| [[nodiscard]] std::tuple, size_t> aligned_data_to_process(BufferSlicer& slicer) const { 127| 56.6k| BOTAN_ASSERT_NOMSG(in_alignment()); ------------------ | | 77| 56.6k| do { \ | | 78| 56.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 56.6k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 56.6k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 56.6k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 56.6k] | | ------------------ ------------------ 128| | 129| | // When the final block is to be deferred, the last block must not be 130| | // selected for processing if there is no (unaligned) extra input data. 131| 56.6k| const size_t defer = (defers_final_block()) ? 1 : 0; ------------------ | Branch (131:31): [True: 0, False: 56.6k] ------------------ 132| 56.6k| const size_t full_blocks_to_process = (slicer.remaining() - defer) / m_buffer.size(); 133| 56.6k| return {slicer.take(full_blocks_to_process * m_buffer.size()), full_blocks_to_process}; 134| 56.6k| } _ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE18fill_up_with_zerosEv: 79| 103k| void fill_up_with_zeros() { 80| 103k| if(!ready_to_consume()) { ------------------ | Branch (80:13): [True: 103k, False: 6] ------------------ 81| 103k| zeroize_buffer(&m_buffer[m_position], elements_until_alignment()); 82| 103k| m_position = m_buffer.size(); 83| 103k| } 84| 103k| } _ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE20directly_modify_lastEm: 113| 78.5k| std::span directly_modify_last(size_t elements) { 114| 78.5k| BOTAN_ASSERT_NOMSG(size() >= elements); ------------------ | | 77| 78.5k| do { \ | | 78| 78.5k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 78.5k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 78.5k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 78.5k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 78.5k] | | ------------------ ------------------ 115| 78.5k| return std::span(m_buffer).last(elements); 116| 78.5k| } _ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE4sizeEv: 217| 78.5k| constexpr size_t size() const { return m_buffer.size(); } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE21handle_unaligned_dataERNS_12BufferSlicerE: 166| 17.5k| [[nodiscard]] std::optional> handle_unaligned_data(BufferSlicer& slicer) { 167| | // When the final block is to be deferred, we would need to store and 168| | // hold a buffer that contains exactly one block until more data is 169| | // passed or it is explicitly consumed. 170| 17.5k| const size_t defer = (defers_final_block()) ? 1 : 0; ------------------ | Branch (170:31): [True: 0, False: 17.5k] ------------------ 171| | 172| 17.5k| if(in_alignment() && slicer.remaining() >= m_buffer.size() + defer) { ------------------ | Branch (172:13): [True: 14.4k, False: 3.14k] | Branch (172:31): [True: 7.63k, False: 6.80k] ------------------ 173| | // We are currently in alignment and the passed-in data source 174| | // contains enough data to benefit from aligned processing. 175| | // Therefore, we don't copy anything into the intermittent buffer. 176| 7.63k| return std::nullopt; 177| 7.63k| } 178| | 179| | // Fill the buffer with as much input data as needed to reach alignment 180| | // or until the input source is depleted. 181| 9.94k| const auto elements_to_consume = std::min(m_buffer.size() - m_position, slicer.remaining()); 182| 9.94k| append(slicer.take(elements_to_consume)); 183| | 184| | // If we collected enough data, we push out one full block. When 185| | // deferring the final block is enabled, we additionally check that 186| | // more input data is available to continue processing a consecutive 187| | // block. 188| 9.94k| if(ready_to_consume() && (!defers_final_block() || !slicer.empty())) { ------------------ | Branch (188:13): [True: 31, False: 9.91k] | Branch (188:36): [True: 31, False: 0] | Branch (188:61): [True: 0, False: 0] ------------------ 189| 31| return consume(); 190| 9.91k| } else { 191| 9.91k| return std::nullopt; 192| 9.91k| } 193| 9.94k| } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE18defers_final_blockEv: 233| 25.2k| constexpr bool defers_final_block() const { 234| 25.2k| return FINAL_BLOCK_STRATEGY == AlignmentBufferFinalBlock::must_be_deferred; 235| 25.2k| } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE6appendENSt3__14spanIKhLm18446744073709551615EEE: 90| 16.6k| void append(std::span elements) { 91| 16.6k| BOTAN_ASSERT_NOMSG(elements.size() <= elements_until_alignment()); ------------------ | | 77| 16.6k| do { \ | | 78| 16.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 16.6k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 16.6k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 16.6k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 16.6k] | | ------------------ ------------------ 92| 16.6k| std::copy(elements.begin(), elements.end(), m_buffer.begin() + m_position); 93| 16.6k| m_position += elements.size(); 94| 16.6k| } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE24elements_until_alignmentEv: 221| 38.4k| size_t elements_until_alignment() const { return m_buffer.size() - m_position; } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE16ready_to_consumeEv: 231| 33.2k| bool ready_to_consume() const { return m_position == m_buffer.size(); } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE7consumeEv: 200| 8.30k| [[nodiscard]] std::span consume() { 201| 8.30k| BOTAN_ASSERT_NOMSG(ready_to_consume()); ------------------ | | 77| 8.30k| do { \ | | 78| 8.30k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 8.30k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 8.30k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 8.30k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 8.30k] | | ------------------ ------------------ 202| 8.30k| m_position = 0; 203| 8.30k| return m_buffer; 204| 8.30k| } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE12in_alignmentEv: 226| 42.8k| bool in_alignment() const { return m_position == 0; } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE23aligned_data_to_processERNS_12BufferSlicerE: 126| 7.67k| [[nodiscard]] std::tuple, size_t> aligned_data_to_process(BufferSlicer& slicer) const { 127| 7.67k| BOTAN_ASSERT_NOMSG(in_alignment()); ------------------ | | 77| 7.67k| do { \ | | 78| 7.67k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 7.67k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 7.67k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 7.67k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 7.67k] | | ------------------ ------------------ 128| | 129| | // When the final block is to be deferred, the last block must not be 130| | // selected for processing if there is no (unaligned) extra input data. 131| 7.67k| const size_t defer = (defers_final_block()) ? 1 : 0; ------------------ | Branch (131:31): [True: 0, False: 7.67k] ------------------ 132| 7.67k| const size_t full_blocks_to_process = (slicer.remaining() - defer) / m_buffer.size(); 133| 7.67k| return {slicer.take(full_blocks_to_process * m_buffer.size()), full_blocks_to_process}; 134| 7.67k| } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE18fill_up_with_zerosEv: 79| 8.27k| void fill_up_with_zeros() { 80| 8.27k| if(!ready_to_consume()) { ------------------ | Branch (80:13): [True: 8.27k, False: 0] ------------------ 81| 8.27k| zeroize_buffer(&m_buffer[m_position], elements_until_alignment()); 82| 8.27k| m_position = m_buffer.size(); 83| 8.27k| } 84| 8.27k| } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE20directly_modify_lastEm: 113| 6.73k| std::span directly_modify_last(size_t elements) { 114| 6.73k| BOTAN_ASSERT_NOMSG(size() >= elements); ------------------ | | 77| 6.73k| do { \ | | 78| 6.73k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 6.73k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 6.73k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 6.73k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 6.73k] | | ------------------ ------------------ 115| 6.73k| return std::span(m_buffer).last(elements); 116| 6.73k| } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE4sizeEv: 217| 6.73k| constexpr size_t size() const { return m_buffer.size(); } _ZN5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EEC2Ev: 62| 114| AlignmentBuffer() = default; _ZN5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EED2Ev: 64| 114| ~AlignmentBuffer() { secure_zeroize_buffer(m_buffer.data(), sizeof(T) * m_buffer.size()); } _ZN5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE5clearEv: 71| 223| void clear() { 72| 223| zeroize_buffer(m_buffer.data(), m_buffer.size()); 73| 223| m_position = 0; 74| 223| } _ZN5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE21handle_unaligned_dataERNS_12BufferSlicerE: 166| 274| [[nodiscard]] std::optional> handle_unaligned_data(BufferSlicer& slicer) { 167| | // When the final block is to be deferred, we would need to store and 168| | // hold a buffer that contains exactly one block until more data is 169| | // passed or it is explicitly consumed. 170| 274| const size_t defer = (defers_final_block()) ? 1 : 0; ------------------ | Branch (170:31): [True: 0, False: 274] ------------------ 171| | 172| 274| if(in_alignment() && slicer.remaining() >= m_buffer.size() + defer) { ------------------ | Branch (172:13): [True: 274, False: 0] | Branch (172:31): [True: 86, False: 188] ------------------ 173| | // We are currently in alignment and the passed-in data source 174| | // contains enough data to benefit from aligned processing. 175| | // Therefore, we don't copy anything into the intermittent buffer. 176| 86| return std::nullopt; 177| 86| } 178| | 179| | // Fill the buffer with as much input data as needed to reach alignment 180| | // or until the input source is depleted. 181| 188| const auto elements_to_consume = std::min(m_buffer.size() - m_position, slicer.remaining()); 182| 188| append(slicer.take(elements_to_consume)); 183| | 184| | // If we collected enough data, we push out one full block. When 185| | // deferring the final block is enabled, we additionally check that 186| | // more input data is available to continue processing a consecutive 187| | // block. 188| 188| if(ready_to_consume() && (!defers_final_block() || !slicer.empty())) { ------------------ | Branch (188:13): [True: 0, False: 188] | Branch (188:36): [True: 0, False: 0] | Branch (188:61): [True: 0, False: 0] ------------------ 189| 0| return consume(); 190| 188| } else { 191| 188| return std::nullopt; 192| 188| } 193| 188| } _ZNK5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE18defers_final_blockEv: 233| 360| constexpr bool defers_final_block() const { 234| 360| return FINAL_BLOCK_STRATEGY == AlignmentBufferFinalBlock::must_be_deferred; 235| 360| } _ZNK5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE16ready_to_consumeEv: 231| 564| bool ready_to_consume() const { return m_position == m_buffer.size(); } _ZNK5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE12in_alignmentEv: 226| 961| bool in_alignment() const { return m_position == 0; } _ZNK5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE23aligned_data_to_processERNS_12BufferSlicerE: 126| 86| [[nodiscard]] std::tuple, size_t> aligned_data_to_process(BufferSlicer& slicer) const { 127| 86| BOTAN_ASSERT_NOMSG(in_alignment()); ------------------ | | 77| 86| do { \ | | 78| 86| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 86| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 86] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 86| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 86] | | ------------------ ------------------ 128| | 129| | // When the final block is to be deferred, the last block must not be 130| | // selected for processing if there is no (unaligned) extra input data. 131| 86| const size_t defer = (defers_final_block()) ? 1 : 0; ------------------ | Branch (131:31): [True: 0, False: 86] ------------------ 132| 86| const size_t full_blocks_to_process = (slicer.remaining() - defer) / m_buffer.size(); 133| 86| return {slicer.take(full_blocks_to_process * m_buffer.size()), full_blocks_to_process}; 134| 86| } _ZN5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE6appendENSt3__14spanIKhLm18446744073709551615EEE: 90| 188| void append(std::span elements) { 91| 188| BOTAN_ASSERT_NOMSG(elements.size() <= elements_until_alignment()); ------------------ | | 77| 188| do { \ | | 78| 188| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 188| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 188] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 188| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 188] | | ------------------ ------------------ 92| 188| std::copy(elements.begin(), elements.end(), m_buffer.begin() + m_position); 93| 188| m_position += elements.size(); 94| 188| } _ZNK5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE24elements_until_alignmentEv: 221| 376| size_t elements_until_alignment() const { return m_buffer.size() - m_position; } _ZN5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE18fill_up_with_zerosEv: 79| 188| void fill_up_with_zeros() { 80| 188| if(!ready_to_consume()) { ------------------ | Branch (80:13): [True: 188, False: 0] ------------------ 81| 188| zeroize_buffer(&m_buffer[m_position], elements_until_alignment()); 82| 188| m_position = m_buffer.size(); 83| 188| } 84| 188| } _ZN5Botan15AlignmentBufferIhLm16ELNS_25AlignmentBufferFinalBlockE0EE7consumeEv: 200| 188| [[nodiscard]] std::span consume() { 201| 188| BOTAN_ASSERT_NOMSG(ready_to_consume()); ------------------ | | 77| 188| do { \ | | 78| 188| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 188| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 188] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 188| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 188] | | ------------------ ------------------ 202| 188| m_position = 0; 203| 188| return m_buffer; 204| 188| } _ZNK5Botan8ARIA_1284nameEv: 34| 2| std::string name() const override { return "ARIA-128"; } _ZNK5Botan8ARIA_2564nameEv: 104| 2| std::string name() const override { return "ARIA-256"; } _ZNK5Botan17Barrett_Reduction4cubeERKNS_6BigIntE: 66| 6| BigInt cube(const BigInt& x) const { return this->multiply(x, this->square(x)); } _ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEhEET_S2_: 37| 2.62k|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) { 38| 2.62k| return ct_expand_top_bit(~x & (x - 1)); 39| 2.62k|} _ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEhEET_S2_: 28| 2.62k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) { 29| 2.62k| const T top = CT::value_barrier(a >> (sizeof(T) * 8 - 1)); 30| 2.62k| return static_cast(0) - top; 31| 2.62k|} _ZN5Botan9var_ctz64Em: 180| 787|BOTAN_FORCE_INLINE constexpr size_t var_ctz64(uint64_t n) { 181| 787|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_ctzll) 182| 787| if(n == 0) { ------------------ | Branch (182:7): [True: 0, False: 787] ------------------ 183| 0| return 64; 184| 0| } 185| 787| return __builtin_ctzll(n); 186| |#else 187| | return ctz(n); 188| |#endif 189| 787|} _ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEmEET_S2_: 28| 33.8M|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) { 29| 33.8M| const T top = CT::value_barrier(a >> (sizeof(T) * 8 - 1)); 30| 33.8M| return static_cast(0) - top; 31| 33.8M|} _ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEmEET_S2_: 37| 33.4M|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) { 38| 33.4M| return ct_expand_top_bit(~x & (x - 1)); 39| 33.4M|} _ZN5Botan6chooseITkNSt3__117unsigned_integralEmEET_S2_S2_S2_: 216| 191M|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) { 217| | //return (mask & a) | (~mask & b); 218| 191M| return (b ^ (mask & (a ^ b))); 219| 191M|} _ZN5Botan8high_bitITkNSt3__117unsigned_integralEjEEmT_: 73| 54.2k|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) { 74| 54.2k| size_t hb = 0; 75| | 76| 325k| for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) { ------------------ | Branch (76:38): [True: 271k, False: 54.2k] ------------------ 77| | // Equivalent to: ((n >> s) == 0) ? 0 : s; 78| 271k| const size_t z = s - ct_if_is_zero_ret(n >> s, s); 79| 271k| hb += z; 80| 271k| n >>= z; 81| 271k| } 82| | 83| 54.2k| hb += n; 84| | 85| 54.2k| return hb; 86| 54.2k|} _ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEjEEmT_m: 45| 271k|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) { 46| | /* 47| | Similar to `return ct_is_zero(x) & s` but has to account for possibility that 48| | sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking 49| | */ 50| 271k| const T a = ~x & (x - 1); 51| 271k| const size_t a_top = static_cast(CT::value_barrier(a >> (sizeof(T) * 8 - 1))); 52| 271k| const size_t mask = static_cast(0) - a_top; 53| 271k| return mask & s; 54| 271k|} _ZN5Botan17significant_bytesITkNSt3__117unsigned_integralEmEEmT_: 94| 12.5k|BOTAN_FORCE_INLINE constexpr size_t significant_bytes(T n) { 95| 12.5k| size_t b = 0; 96| | 97| 50.0k| for(size_t s = 8 * sizeof(T) / 2; s >= 8; s /= 2) { ------------------ | Branch (97:38): [True: 37.5k, False: 12.5k] ------------------ 98| | // Equivalent to: ((n >> s) == 0) ? 0 : s; 99| 37.5k| const size_t z = s - ct_if_is_zero_ret(n >> s, s); 100| 37.5k| b += z / 8; 101| 37.5k| n >>= z; 102| 37.5k| } 103| | 104| 12.5k| b += (n != 0); 105| | 106| 12.5k| return b; 107| 12.5k|} _ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEmEEmT_m: 45| 312k|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) { 46| | /* 47| | Similar to `return ct_is_zero(x) & s` but has to account for possibility that 48| | sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking 49| | */ 50| 312k| const T a = ~x & (x - 1); 51| 312k| const size_t a_top = static_cast(CT::value_barrier(a >> (sizeof(T) * 8 - 1))); 52| 312k| const size_t mask = static_cast(0) - a_top; 53| 312k| return mask & s; 54| 312k|} _ZN5Botan9swap_bitsITkNSt3__117unsigned_integralEmEEvRT_S3_S2_m: 202| 121k|BOTAN_FORCE_INLINE constexpr void swap_bits(T& x, T& y, T mask, size_t shift) { 203| 121k| const T swap = ((x >> shift) ^ y) & mask; 204| 121k| x ^= swap << shift; 205| 121k| y ^= swap; 206| 121k|} _ZN5Botan6chooseITkNSt3__117unsigned_integralEjEET_S2_S2_S2_: 216| 23.2M|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) { 217| | //return (mask & a) | (~mask & b); 218| 23.2M| return (b ^ (mask & (a ^ b))); 219| 23.2M|} _ZN5Botan8majorityITkNSt3__117unsigned_integralEjEET_S2_S2_S2_: 222| 11.6M|BOTAN_FORCE_INLINE constexpr T majority(T a, T b, T c) { 223| | /* 224| | Considering each bit of a, b, c individually 225| | 226| | If a xor b is set, then c is the deciding vote. 227| | 228| | If a xor b is not set then either a and b are both set or both unset. 229| | In either case the value of c doesn't matter, and examining b (or a) 230| | allows us to determine which case we are in. 231| | */ 232| 11.6M| return choose(a ^ b, c, b); 233| 11.6M|} _ZN5Botan13is_power_of_2ITkNSt3__117unsigned_integralEmEEbT_: 62| 337|BOTAN_FORCE_INLINE constexpr bool is_power_of_2(T arg) { 63| 337| return (arg != 0) && (arg != 1) && ((arg & static_cast(arg - 1)) == 0); ------------------ | Branch (63:11): [True: 337, False: 0] | Branch (63:25): [True: 337, False: 0] | Branch (63:39): [True: 337, False: 0] ------------------ 64| 337|} _ZN5Botan8majorityITkNSt3__117unsigned_integralEmEET_S2_S2_S2_: 222| 1.36M|BOTAN_FORCE_INLINE constexpr T majority(T a, T b, T c) { 223| | /* 224| | Considering each bit of a, b, c individually 225| | 226| | If a xor b is set, then c is the deciding vote. 227| | 228| | If a xor b is not set then either a and b are both set or both unset. 229| | In either case the value of c doesn't matter, and examining b (or a) 230| | allows us to determine which case we are in. 231| | */ 232| 1.36M| return choose(a ^ b, c, b); 233| 1.36M|} _ZN5Botan8high_bitITkNSt3__117unsigned_integralEmEEmT_: 73| 45.8k|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) { 74| 45.8k| size_t hb = 0; 75| | 76| 320k| for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) { ------------------ | Branch (76:38): [True: 275k, False: 45.8k] ------------------ 77| | // Equivalent to: ((n >> s) == 0) ? 0 : s; 78| 275k| const size_t z = s - ct_if_is_zero_ret(n >> s, s); 79| 275k| hb += z; 80| 275k| n >>= z; 81| 275k| } 82| | 83| 45.8k| hb += n; 84| | 85| 45.8k| return hb; 86| 45.8k|} _ZN5Botan6chooseITkNSt3__117unsigned_integralEhEET_S2_S2_S2_: 216| 1.41k|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) { 217| | //return (mask & a) | (~mask & b); 218| 1.41k| return (b ^ (mask & (a ^ b))); 219| 1.41k|} _ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEtEET_S2_: 28| 58.0k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) { 29| 58.0k| const T top = CT::value_barrier(a >> (sizeof(T) * 8 - 1)); 30| 58.0k| return static_cast(0) - top; 31| 58.0k|} _ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEtEET_S2_: 37| 29.0k|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) { 38| 29.0k| return ct_expand_top_bit(~x & (x - 1)); 39| 29.0k|} _ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEmQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_: 27| 876k|inline constexpr T reverse_bytes(T x) { 28| | if constexpr(sizeof(T) == 1) { 29| | return x; 30| | } else if constexpr(sizeof(T) == 2) { 31| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16) 32| | return static_cast(__builtin_bswap16(x)); 33| |#else 34| | return static_cast((x << 8) | (x >> 8)); 35| |#endif 36| | } else if constexpr(sizeof(T) == 4) { 37| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32) 38| | return static_cast(__builtin_bswap32(x)); 39| |#else 40| | // MSVC at least recognizes this as a bswap 41| | return static_cast(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) | 42| | ((x & 0xFF000000) >> 24)); 43| |#endif 44| 876k| } else if constexpr(sizeof(T) == 8) { 45| 876k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64) 46| 876k| return static_cast(__builtin_bswap64(x)); 47| |#else 48| | uint32_t hi = static_cast(x >> 32); 49| | uint32_t lo = static_cast(x); 50| | 51| | hi = reverse_bytes(hi); 52| | lo = reverse_bytes(lo); 53| | 54| | return (static_cast(lo) << 32) | hi; 55| |#endif 56| 876k| } 57| 876k|} _ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEtQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_: 27| 29.7k|inline constexpr T reverse_bytes(T x) { 28| | if constexpr(sizeof(T) == 1) { 29| | return x; 30| 29.7k| } else if constexpr(sizeof(T) == 2) { 31| 29.7k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16) 32| 29.7k| return static_cast(__builtin_bswap16(x)); 33| |#else 34| | return static_cast((x << 8) | (x >> 8)); 35| |#endif 36| | } else if constexpr(sizeof(T) == 4) { 37| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32) 38| | return static_cast(__builtin_bswap32(x)); 39| |#else 40| | // MSVC at least recognizes this as a bswap 41| | return static_cast(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) | 42| | ((x & 0xFF000000) >> 24)); 43| |#endif 44| | } else if constexpr(sizeof(T) == 8) { 45| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64) 46| | return static_cast(__builtin_bswap64(x)); 47| |#else 48| | uint32_t hi = static_cast(x >> 32); 49| | uint32_t lo = static_cast(x); 50| | 51| | hi = reverse_bytes(hi); 52| | lo = reverse_bytes(lo); 53| | 54| | return (static_cast(lo) << 32) | hi; 55| |#endif 56| | } 57| 29.7k|} _ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEjQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_: 27| 564k|inline constexpr T reverse_bytes(T x) { 28| | if constexpr(sizeof(T) == 1) { 29| | return x; 30| | } else if constexpr(sizeof(T) == 2) { 31| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16) 32| | return static_cast(__builtin_bswap16(x)); 33| |#else 34| | return static_cast((x << 8) | (x >> 8)); 35| |#endif 36| 564k| } else if constexpr(sizeof(T) == 4) { 37| 564k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32) 38| 564k| return static_cast(__builtin_bswap32(x)); 39| |#else 40| | // MSVC at least recognizes this as a bswap 41| | return static_cast(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) | 42| | ((x & 0xFF000000) >> 24)); 43| |#endif 44| | } else if constexpr(sizeof(T) == 8) { 45| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64) 46| | return static_cast(__builtin_bswap64(x)); 47| |#else 48| | uint32_t hi = static_cast(x >> 32); 49| | uint32_t lo = static_cast(x); 50| | 51| | hi = reverse_bytes(hi); 52| | lo = reverse_bytes(lo); 53| | 54| | return (static_cast(lo) << 32) | hi; 55| |#endif 56| | } 57| 564k|} _ZN5Botan12BufferSlicerC2ENSt3__14spanIKhLm18446744073709551615EEE: 25| 275k| explicit BufferSlicer(std::span buffer) : m_remaining(buffer) {} _ZN5Botan12BufferSlicer4takeEm: 37| 670k| std::span take(const size_t count) { 38| 670k| BOTAN_STATE_CHECK(remaining() >= count); ------------------ | | 51| 670k| do { \ | | 52| 670k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 670k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 670k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 670k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 670k] | | ------------------ ------------------ 39| 670k| auto result = m_remaining.first(count); 40| 670k| m_remaining = m_remaining.subspan(count); 41| 670k| return result; 42| 670k| } _ZNK5Botan12BufferSlicer9remainingEv: 66| 989k| size_t remaining() const { return m_remaining.size(); } _ZN5Botan12BufferSlicer9take_byteEv: 57| 430k| uint8_t take_byte() { return take(1)[0]; } _ZNK5Botan12BufferSlicer5emptyEv: 68| 1.18M| bool empty() const { return m_remaining.empty(); } _ZN5Botan13BufferStufferC2ENSt3__14spanIhLm18446744073709551615EEE: 26| 18.4k| constexpr explicit BufferStuffer(std::span buffer) : m_buffer(buffer) {} _ZN5Botan13BufferStuffer4nextEm: 32| 22.3k| constexpr std::span next(size_t bytes) { 33| 22.3k| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 22.3k| do { \ | | 52| 22.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 22.3k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 22.3k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 22.3k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 22.3k] | | ------------------ ------------------ 34| | 35| 22.3k| auto result = m_buffer.first(bytes); 36| 22.3k| m_buffer = m_buffer.subspan(bytes); 37| 22.3k| return result; 38| 22.3k| } _ZN5Botan13BufferStuffer6appendENSt3__14spanIKhLm18446744073709551615EEE: 59| 6.79k| constexpr void append(std::span buffer) { 60| 6.79k| auto sink = next(buffer.size()); 61| 6.79k| std::copy(buffer.begin(), buffer.end(), sink.begin()); 62| 6.79k| } _ZN5Botan13BufferStuffer6appendEhm: 64| 15.4k| constexpr void append(uint8_t b, size_t repeat = 1) { 65| 15.4k| auto sink = next(repeat); 66| 15.4k| std::fill(sink.begin(), sink.end(), b); 67| 15.4k| } _ZNK5Botan13BufferStuffer4fullEv: 69| 9.79k| constexpr bool full() const { return m_buffer.empty(); } _ZNK5Botan13BufferStuffer18remaining_capacityEv: 71| 6.79k| constexpr size_t remaining_capacity() const { return m_buffer.size(); } _ZN5Botan13BufferStuffer4nextILm32EEENSt3__14spanIhXT_EEEv: 41| 20.6k| constexpr std::span next() { 42| 20.6k| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 20.6k| do { \ | | 52| 20.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 20.6k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 20.6k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 20.6k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 20.6k] | | ------------------ ------------------ 43| | 44| 20.6k| auto result = m_buffer.first(); 45| 20.6k| m_buffer = m_buffer.subspan(bytes); 46| 20.6k| return result; 47| 20.6k| } _ZN5Botan13BufferStuffer4nextILm48EEENSt3__14spanIhXT_EEEv: 41| 3.99k| constexpr std::span next() { 42| 3.99k| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 3.99k| do { \ | | 52| 3.99k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 3.99k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 3.99k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 3.99k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 3.99k] | | ------------------ ------------------ 43| | 44| 3.99k| auto result = m_buffer.first(); 45| 3.99k| m_buffer = m_buffer.subspan(bytes); 46| 3.99k| return result; 47| 3.99k| } _ZN5Botan13BufferStuffer4nextILm64EEENSt3__14spanIhXT_EEEv: 41| 2.68k| constexpr std::span next() { 42| 2.68k| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 2.68k| do { \ | | 52| 2.68k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 2.68k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 2.68k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 2.68k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 2.68k] | | ------------------ ------------------ 43| | 44| 2.68k| auto result = m_buffer.first(); 45| 2.68k| m_buffer = m_buffer.subspan(bytes); 46| 2.68k| return result; 47| 2.68k| } _ZN5Botan13BufferStuffer4nextILm66EEENSt3__14spanIhXT_EEEv: 41| 3.49k| constexpr std::span next() { 42| 3.49k| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 3.49k| do { \ | | 52| 3.49k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 3.49k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 3.49k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 3.49k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 3.49k] | | ------------------ ------------------ 43| | 44| 3.49k| auto result = m_buffer.first(); 45| 3.49k| m_buffer = m_buffer.subspan(bytes); 46| 3.49k| return result; 47| 3.49k| } _ZNK5Botan12Camellia_1284nameEv: 26| 1| std::string name() const override { return "Camellia-128"; } _ZNK5Botan12Camellia_2564nameEv: 106| 3| std::string name() const override { return "Camellia-256"; } _ZN5Botan14CBC_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEENS2_INS_28BlockCipherModePaddingMethodENS4_IS7_EEEE: 79| 63| CBC_Mode(std::move(cipher), std::move(padding)) {} _ZN5Botan14CBC_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEENS2_INS_28BlockCipherModePaddingMethodENS4_IS7_EEEE: 120| 179| CBC_Mode(std::move(cipher), std::move(padding)), m_tempbuf(ideal_granularity()) {} _ZNK5Botan8CBC_Mode6cipherEv: 45| 1.41k| const BlockCipher& cipher() const { return *m_cipher; } _ZNK5Botan8CBC_Mode10block_sizeEv: 52| 480| size_t block_size() const { return m_block_size; } _ZN5Botan8CBC_Mode5stateEv: 54| 353| secure_vector& state() { return m_state; } _ZN5Botan8CBC_Mode9state_ptrEv: 56| 1.22k| uint8_t* state_ptr() { return m_state.data(); } _ZN5Botan14CCM_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEmm: 95| 3| CCM_Mode(std::move(cipher), tag_size, L) {} _ZN5Botan14CCM_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEmm: 118| 44| CCM_Mode(std::move(cipher), tag_size, L) {} _ZNK5Botan8CCM_Mode8tag_sizeEv: 47| 313| size_t tag_size() const final { return m_tag_size; } _ZNK5Botan8CCM_Mode1LEv: 54| 228| size_t L() const { return m_L; } _ZNK5Botan8CCM_Mode6cipherEv: 56| 38| const BlockCipher& cipher() const { return *m_cipher; } _ZNK5Botan8CCM_Mode6ad_bufEv: 62| 38| const secure_vector& ad_buf() const { return m_ad_buf; } _ZN5Botan8CCM_Mode7msg_bufEv: 64| 76| secure_vector& msg_buf() { return m_msg_buf; } _ZNK5Botan14CCM_Decryption18minimum_final_sizeEv: 122| 34| size_t minimum_final_size() const override { return tag_size(); } base64.cpp:_ZN5Botan11base_decodeINS_12_GLOBAL__N_16Base64EEEmRKT_PhPKcmRmbb: 124| 12.4k| bool ignore_ws = true) { 125| | // TODO(Botan4) Check if we can use just base. or Base:: here instead 126| 12.4k| constexpr size_t decoding_bytes_in = std::remove_reference_t::decoding_bytes_in(); 127| 12.4k| constexpr size_t decoding_bytes_out = std::remove_reference_t::decoding_bytes_out(); 128| | 129| 12.4k| input_consumed = 0; 130| | 131| 12.4k| uint8_t* out_ptr = output; 132| 12.4k| std::array decode_buf{}; 133| 12.4k| size_t decode_buf_pos = 0; 134| 12.4k| size_t final_truncate = 0; 135| 12.4k| bool seen_padding = false; 136| | 137| 12.4k| clear_mem(output, base.decode_max_output(input_length)); 138| | 139| 5.18M| for(size_t i = 0; i != input_length; ++i) { ------------------ | Branch (139:22): [True: 5.17M, False: 12.4k] ------------------ 140| 5.17M| const uint8_t bin = base.lookup_binary_value(input[i]); 141| | 142| | // This call might throw Invalid_Argument 143| 5.17M| if(base.check_bad_char(bin, input[i], ignore_ws)) { ------------------ | Branch (143:10): [True: 5.17M, False: 0] ------------------ 144| | // Padding may only appear at the end, so a data symbol must never 145| | // follow one (0x81 marks a padding character) 146| 5.17M| if(seen_padding) { ------------------ | Branch (146:13): [True: 0, False: 5.17M] ------------------ 147| 0| throw Invalid_Argument(base.name() + " decoding failed, data follows padding"); 148| 0| } 149| 5.17M| decode_buf[decode_buf_pos] = bin; 150| 5.17M| ++decode_buf_pos; 151| 5.17M| } else if(bin == 0x81) { ------------------ | Branch (151:17): [True: 0, False: 0] ------------------ 152| 0| seen_padding = true; 153| 0| } 154| | 155| | /* 156| | * If we're at the end of the input, pad with 0s and truncate 157| | */ 158| 5.17M| if(final_inputs && (i == input_length - 1)) { ------------------ | Branch (158:10): [True: 5.17M, False: 0] | Branch (158:26): [True: 12.4k, False: 5.16M] ------------------ 159| 12.4k| if(decode_buf_pos) { ------------------ | Branch (159:13): [True: 12.4k, False: 0] ------------------ 160| 12.4k| const size_t bits_per_symbol = base.bits_consumed(); 161| 12.4k| const size_t pad_bits = (decode_buf_pos * bits_per_symbol) % 8; 162| | 163| | // A trailing symbol contributing only pad bits cannot occur in a 164| | // valid encoding; RFC 4648 4 and 6 enumerate the reachable cases 165| 12.4k| if(pad_bits >= bits_per_symbol) { ------------------ | Branch (165:16): [True: 0, False: 12.4k] ------------------ 166| 0| throw Invalid_Argument(base.name() + " decoding failed, invalid length"); 167| 0| } 168| | 169| | // RFC 4648 3.5: "decoders MAY chose to reject an encoding if the 170| | // pad bits have not been set to zero" 171| 12.4k| const uint8_t pad_mask = static_cast((1U << pad_bits) - 1); 172| 12.4k| if(decode_buf[decode_buf_pos - 1] & pad_mask) { ------------------ | Branch (172:16): [True: 0, False: 12.4k] ------------------ 173| 0| throw Invalid_Argument(base.name() + " decoding failed, nonzero padding bits"); 174| 0| } 175| | 176| 12.4k| for(size_t j = decode_buf_pos; j < decoding_bytes_in; ++j) { ------------------ | Branch (176:44): [True: 0, False: 12.4k] ------------------ 177| 0| decode_buf[j] = 0; 178| 0| } 179| | 180| 12.4k| final_truncate = decoding_bytes_in - decode_buf_pos; 181| 12.4k| decode_buf_pos = decoding_bytes_in; 182| 12.4k| } 183| 12.4k| } 184| | 185| 5.17M| if(decode_buf_pos == decoding_bytes_in) { ------------------ | Branch (185:10): [True: 1.29M, False: 3.88M] ------------------ 186| 1.29M| base.decode(out_ptr, decode_buf.data()); 187| | 188| 1.29M| out_ptr += decoding_bytes_out; 189| 1.29M| decode_buf_pos = 0; 190| 1.29M| input_consumed = i + 1; 191| 1.29M| } 192| 5.17M| } 193| | 194| 12.4k| while(input_consumed < input_length && base.lookup_binary_value(input[input_consumed]) == 0x80) { ------------------ | Branch (194:10): [True: 0, False: 12.4k] | Branch (194:43): [True: 0, False: 0] ------------------ 195| 0| ++input_consumed; 196| 0| } 197| | 198| 12.4k| const size_t written = (out_ptr - output) - base.bytes_to_remove(final_truncate); 199| | 200| 12.4k| return written; 201| 12.4k|} base64.cpp:_ZN5Botan16base_decode_fullINS_12_GLOBAL__N_16Base64EEEmRKT_PhPKcmb: 204| 12.4k|size_t base_decode_full(const Base& base, uint8_t output[], const char input[], size_t input_length, bool ignore_ws) { 205| 12.4k| size_t consumed = 0; 206| 12.4k| const size_t written = base_decode(base, output, input, input_length, consumed, true, ignore_ws); 207| | 208| 12.4k| if(consumed != input_length) { ------------------ | Branch (208:7): [True: 0, False: 12.4k] ------------------ 209| 0| throw Invalid_Argument(base.name() + " decoding failed, input did not have full bytes"); 210| 0| } 211| | 212| 12.4k| return written; 213| 12.4k|} base64.cpp:_ZN5Botan18base_decode_to_vecINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_12_GLOBAL__N_16Base64EEET_RKT0_PKcmb: 216| 12.4k|Vector base_decode_to_vec(const Base& base, const char input[], size_t input_length, bool ignore_ws) { 217| 12.4k| const size_t output_length = base.decode_max_output(input_length); 218| 12.4k| Vector bin(output_length); 219| | 220| 12.4k| const size_t written = base_decode_full(base, bin.data(), input, input_length, ignore_ws); 221| | 222| 12.4k| bin.resize(written); 223| 12.4k| return bin; 224| 12.4k|} _ZN5Botan6concatINSt3__16vectorIhNS_16secure_allocatorIhEEEETpTkNS_6ranges14spanable_rangeEJRNS1_4spanIKhLm18446744073709551615EEESA_EEEDaDpOT0_Q10all_same_vIDpNS1_11conditionalIXsr21__is_primary_templateINS1_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS1_6ranges5__cpo5beginEEclsr3stdE7declvalIRSB_EEEEEEEEE5valueENS1_26indirectly_readable_traitsISK_EESL_E4type10value_typeEE: 92| 3.00k|{ 93| | if constexpr(std::same_as) { 94| | // Try to auto-detect a reasonable output type given the input ranges 95| | static_assert(sizeof...(Rs) > 0, "Cannot auto-detect the output type if not a single input range is provided."); 96| | using candidate_result_t = std::remove_cvref_t>>; 97| | using result_range_value_t = std::remove_cvref_t>; 98| | 99| | if constexpr((ranges::statically_spanable_range && ...)) { 100| | // If all input ranges have a static extent, we can calculate the total size at compile time 101| | // and therefore can use a statically sized output container. This is constexpr. 102| | constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 103| | using out_array_t = std::array; 104| | return detail::concatenate(std::forward(ranges)...); 105| | } else { 106| | // If at least one input range has a dynamic extent, we must use a dynamically allocated output container. 107| | // We assume that the user wants to use the first input range's container type as output type. 108| | static_assert( 109| | concepts::reservable_container, 110| | "First input range has static extent, but a dynamically allocated output range is required. Please explicitly specify a dynamically allocatable output type."); 111| | return detail::concatenate(std::forward(ranges)...); 112| | } 113| 3.00k| } else { 114| | // The caller has explicitly specified the output type 115| 3.00k| return detail::concatenate(std::forward(ranges)...); 116| 3.00k| } 117| 3.00k|} _ZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEETpTkNS2_14spanable_rangeEJRNS3_4spanIKhLm18446744073709551615EEESB_EEET_DpOT0_Qoosr8conceptsE20reservable_containerISC_Esr6rangesE25statically_spanable_rangeISC_E: 33| 3.00k|{ 34| 3.00k| OutR result{}; 35| | 36| | // Prepare and validate the output range and construct a lambda that does the 37| | // actual filling of the result buffer. 38| | // (if no input ranges are given, GCC claims that fill_fn is unused) 39| 3.00k| [[maybe_unused]] auto fill_fn = [&] { 40| 3.00k| if constexpr(concepts::reservable_container) { 41| | // dynamically allocate the correct result byte length 42| 3.00k| const size_t total_size = (ranges.size() + ... + 0); 43| 3.00k| result.reserve(total_size); 44| | 45| | // fill the result buffer using a back-inserter 46| 3.00k| return [&result](auto&& range) { 47| 3.00k| std::copy( 48| 3.00k| std::ranges::begin(range), std::ranges::end(range), std::back_inserter(unwrap_strong_type(result))); 49| 3.00k| }; 50| 3.00k| } else { 51| 3.00k| if constexpr((ranges::statically_spanable_range && ... && true)) { 52| | // all input ranges have a static extent, so check the total size at compile time 53| | // (work around an issue in MSVC that warns `total_size` is unused) 54| 3.00k| [[maybe_unused]] constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 55| 3.00k| static_assert(result.size() == total_size, "size of result buffer does not match the sum of input buffers"); 56| 3.00k| } else { 57| | // at least one input range has a dynamic extent, so check the total size at runtime 58| 3.00k| const size_t total_size = (ranges.size() + ... + 0); 59| 3.00k| BOTAN_ARG_CHECK(result.size() == total_size, 60| 3.00k| "result buffer has static extent that does not match the sum of input buffers"); 61| 3.00k| } 62| | 63| | // fill the result buffer and hold the current output-iterator position 64| 3.00k| return [itr = std::ranges::begin(result)](auto&& range) mutable { 65| 3.00k| std::copy(std::ranges::begin(range), std::ranges::end(range), itr); 66| 3.00k| std::advance(itr, std::ranges::size(range)); 67| 3.00k| }; 68| 3.00k| } 69| 3.00k| }(); 70| | 71| | // perform the actual concatenation 72| 3.00k| (fill_fn(std::forward(ranges)), ...); 73| | 74| 3.00k| return result; 75| 3.00k|} _ZZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEETpTkNS2_14spanable_rangeEJRNS3_4spanIKhLm18446744073709551615EEESB_EEET_DpOT0_Qoosr8conceptsE20reservable_containerISC_Esr6rangesE25statically_spanable_rangeISC_EENKUlvE_clEv: 39| 3.00k| [[maybe_unused]] auto fill_fn = [&] { 40| 3.00k| if constexpr(concepts::reservable_container) { 41| | // dynamically allocate the correct result byte length 42| 3.00k| const size_t total_size = (ranges.size() + ... + 0); 43| 3.00k| result.reserve(total_size); 44| | 45| | // fill the result buffer using a back-inserter 46| 3.00k| return [&result](auto&& range) { 47| 3.00k| std::copy( 48| 3.00k| std::ranges::begin(range), std::ranges::end(range), std::back_inserter(unwrap_strong_type(result))); 49| 3.00k| }; 50| | } else { 51| | if constexpr((ranges::statically_spanable_range && ... && true)) { 52| | // all input ranges have a static extent, so check the total size at compile time 53| | // (work around an issue in MSVC that warns `total_size` is unused) 54| | [[maybe_unused]] constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 55| | static_assert(result.size() == total_size, "size of result buffer does not match the sum of input buffers"); 56| | } else { 57| | // at least one input range has a dynamic extent, so check the total size at runtime 58| | const size_t total_size = (ranges.size() + ... + 0); 59| | BOTAN_ARG_CHECK(result.size() == total_size, 60| | "result buffer has static extent that does not match the sum of input buffers"); 61| | } 62| | 63| | // fill the result buffer and hold the current output-iterator position 64| | return [itr = std::ranges::begin(result)](auto&& range) mutable { 65| | std::copy(std::ranges::begin(range), std::ranges::end(range), itr); 66| | std::advance(itr, std::ranges::size(range)); 67| | }; 68| | } 69| 3.00k| }(); _ZZZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEETpTkNS2_14spanable_rangeEJRNS3_4spanIKhLm18446744073709551615EEESB_EEET_DpOT0_Qoosr8conceptsE20reservable_containerISC_Esr6rangesE25statically_spanable_rangeISC_EENKUlvE_clEvENKUlOSC_E_clISB_EEDaSH_: 46| 6.00k| return [&result](auto&& range) { 47| 6.00k| std::copy( 48| 6.00k| std::ranges::begin(range), std::ranges::end(range), std::back_inserter(unwrap_strong_type(result))); 49| 6.00k| }; _ZN5Botan5CPUID3hasENS_10CPUFeatureE: 94| 198k| static bool has(CPUID::Feature feat) { return state().has_bit(feat.as_u32()); } _ZN5Botan5CPUID3hasENS_10CPUFeatureES1_: 99| 192k| static bool has(CPUID::Feature feat1, CPUID::Feature feat2) { 100| 192k| return state().has_bit(feat1.as_u32() | feat2.as_u32()); 101| 192k| } _ZN5Botan5CPUID6is_setEjNS_10CPUFeatureE: 127| 4| static inline bool is_set(uint32_t allowed, CPUID::Feature bit) { 128| 4| const uint32_t feat_bit = bit.as_u32(); 129| 4| return ((allowed & feat_bit) == feat_bit); 130| 4| } _ZNK5Botan5CPUID10CPUID_Data7has_bitEj: 144| 391k| bool has_bit(uint32_t bit) const { return (m_processor_features & bit) == bit; } _ZN5Botan5CPUID5stateEv: 156| 391k| static CPUID_Data& state() { 157| 391k| static CPUID::CPUID_Data g_cpuid; 158| 391k| return g_cpuid; 159| 391k| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_1_bitsEEjmT_NS_10CPUFeatureEj: 117| 6| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 118| 6| const uint64_t flag64 = static_cast(flag); 119| 6| if((cpuid & flag64) == flag64) { ------------------ | Branch (119:13): [True: 6, False: 0] ------------------ 120| 6| return (bit.as_u32() & allowed); 121| 6| } else { 122| 0| return 0; 123| 0| } 124| 6| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_7_bitsEEjmT_NS_10CPUFeatureEj: 117| 8| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 118| 8| const uint64_t flag64 = static_cast(flag); 119| 8| if((cpuid & flag64) == flag64) { ------------------ | Branch (119:13): [True: 4, False: 4] ------------------ 120| 4| return (bit.as_u32() & allowed); 121| 4| } else { 122| 4| return 0; 123| 4| } 124| 8| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE18x86_CPUID_7_1_bitsEEjmT_NS_10CPUFeatureEj: 117| 3| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 118| 3| const uint64_t flag64 = static_cast(flag); 119| 3| if((cpuid & flag64) == flag64) { ------------------ | Branch (119:13): [True: 0, False: 3] ------------------ 120| 0| return (bit.as_u32() & allowed); 121| 3| } else { 122| 3| return 0; 123| 3| } 124| 3| } _ZN5Botan10CPUFeatureC2ENS0_3BitE: 51| 583k| CPUFeature(Bit b) : m_bit(b) {} // NOLINT(*-explicit-conversions) _ZNK5Botan10CPUFeature6as_u32Ev: 53| 583k| uint32_t as_u32() const { return static_cast(m_bit); } _ZN5Botan2CT8is_equalIhEENS0_4MaskIT_EEPKS3_S6_m: 798| 783|constexpr inline CT::Mask is_equal(const T x[], const T y[], size_t len) { 799| 783| if(std::is_constant_evaluated()) { ------------------ | Branch (799:7): [Folded, False: 783] ------------------ 800| 0| T difference = 0; 801| | 802| 0| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (802:25): [True: 0, False: 0] ------------------ 803| 0| difference = difference | (x[i] ^ y[i]); 804| 0| } 805| | 806| 0| return CT::Mask::is_zero(difference); 807| 783| } else { 808| 783| volatile T difference = 0; 809| | 810| 10.7k| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (810:25): [True: 10.0k, False: 783] ------------------ 811| 10.0k| difference = difference | (x[i] ^ y[i]); 812| 10.0k| } 813| | 814| 783| return CT::Mask::is_zero(difference); 815| 783| } 816| 783|} _ZN5Botan2CT4MaskIhE7is_zeroEh: 437| 2.62k| static constexpr Mask is_zero(T x) { return Mask(ct_is_zero(value_barrier(x))); } _ZN5Botan2CT4MaskIhEC2Eh: 637| 2.62k| constexpr explicit Mask(T m) : m_mask(m) {} _ZNK5Botan2CT4MaskIhE7as_boolEv: 614| 662| constexpr bool as_bool() const { return unpoisoned_value() != 0; } _ZNK5Botan2CT4MaskIhE16unpoisoned_valueEv: 598| 2.49k| constexpr T unpoisoned_value() const { 599| 2.49k| T r = value(); 600| 2.49k| CT::unpoison(r); 601| 2.49k| return r; 602| 2.49k| } _ZNK5Botan2CT4MaskIhE5valueEv: 630| 4.04k| constexpr T value() const { return value_barrier(m_mask); } _ZN5Botan2CT8unpoisonITkNSt3__18integralEhEEvRKT_: 112| 2.61k|constexpr void unpoison(const T& p) { 113| 2.61k| unpoison(&p, 1); 114| 2.61k|} _ZN5Botan2CT8unpoisonIhEEvPKT_m: 67| 7.18k|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 7.18k| BOTAN_UNUSED(p, n); ------------------ | | 144| 7.18k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 7.18k|} _ZN5Botan2CT6Choice9from_maskEm: 303| 10.2M| constexpr static Choice from_mask(underlying_type v) { return Choice(v); } _ZN5Botan2CT6Choice2noEv: 307| 1.64k| constexpr static Choice no() { return Choice(0); } _ZNK5Botan2CT6ChoicentEv: 309| 362k| constexpr Choice operator!() const { return Choice(~value()); } _ZNK5Botan2CT6ChoiceaaERKS1_: 311| 1.37M| constexpr Choice operator&&(const Choice& other) const { return Choice(value() & other.value()); } _ZNK5Botan2CT6ChoiceooERKS1_: 313| 42.8k| constexpr Choice operator||(const Choice& other) const { return Choice(value() | other.value()); } _ZNK5Botan2CT6ChoiceneERKS1_: 315| 1.63k| constexpr Choice operator!=(const Choice& other) const { return Choice(value() ^ other.value()); } _ZNK5Botan2CT6Choice7as_boolEv: 329| 417k| constexpr bool as_bool() const { return m_value != 0; } _ZNK5Botan2CT6Choice5valueEv: 332| 12.3M| constexpr underlying_type value() const { return value_barrier(m_value); } _ZN5Botan2CT6ChoiceC2Em: 341| 12.0M| constexpr explicit Choice(underlying_type v) : m_value(CT::value_barrier(v)) {} _ZN5Botan2CT4MaskImE7is_zeroEm: 437| 32.9M| static constexpr Mask is_zero(T x) { return Mask(ct_is_zero(value_barrier(x))); } _ZNK5Botan2CT4MaskImE5valueEv: 630| 49.8M| constexpr T value() const { return value_barrier(m_mask); } _ZNK5Botan2CT4MaskImEcoEv: 533| 15.5M| constexpr Mask operator~() const { return Mask(~value()); } _ZN5Botan2CT4MaskImE6expandEm: 392| 15.5M| static constexpr Mask expand(T v) { return ~Mask::is_zero(value_barrier(v)); } _ZNK5Botan2CT4MaskImE6selectEmm: 548| 1.15M| constexpr T select(T x, T y) const { return choose(value(), x, y); } _ZNK5Botan2CT4MaskImE16conditional_swapImEEvRT_S5_QlestTL0__stS4_: 587| 94.2k| { 588| 94.2k| auto cnd = Mask(*this); 589| 94.2k| U t0 = cnd.select(y, x); 590| 94.2k| U t1 = cnd.select(x, y); 591| 94.2k| x = t0; 592| 94.2k| y = t1; 593| 94.2k| } _ZN5Botan2CT6poisonIhEEvPKT_m: 56| 4.65k|constexpr inline void poison(const T* p, size_t n) { 57| |#if defined(BOTAN_HAS_VALGRIND) 58| | if(!std::is_constant_evaluated()) { 59| | VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T)); 60| | } 61| |#endif 62| | 63| 4.65k| BOTAN_UNUSED(p, n); ------------------ | | 144| 4.65k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 64| 4.65k|} _ZN5Botan2CT8unpoisonItEEvPKT_m: 67| 381|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 381| BOTAN_UNUSED(p, n); ------------------ | | 144| 381|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 381|} _ZN5Botan2CT4MaskIhE8is_equalEhh: 442| 1.83k| static constexpr Mask is_equal(T x, T y) { 443| 1.83k| const T diff = value_barrier(x) ^ value_barrier(y); 444| 1.83k| return Mask::is_zero(diff); 445| 1.83k| } _ZN5Botan2CT4MaskImE14expand_top_bitEm: 415| 459k| static constexpr Mask expand_top_bit(T v) { return Mask(ct_expand_top_bit(v)); } _ZN5Botan2CT4MaskImEC2Em: 637| 49.2M| constexpr explicit Mask(T m) : m_mask(m) {} _ZN5Botan2CT4MaskImE5is_ltEmm: 450| 454k| static constexpr Mask is_lt(T x, T y) { 451| 454k| T u = x ^ ((x ^ y) | ((x - y) ^ x)); 452| 454k| return Mask::expand_top_bit(u); 453| 454k| } _ZNK5Botan2CT4MaskImE13if_set_returnEm: 538| 49.4k| constexpr T if_set_return(T x) const { return value() & x; } _ZN5Botan2CT4MaskImE8is_equalEmm: 442| 8.58M| static constexpr Mask is_equal(T x, T y) { 443| 8.58M| const T diff = value_barrier(x) ^ value_barrier(y); 444| 8.58M| return Mask::is_zero(diff); 445| 8.58M| } _ZN5Botan2CT8unpoisonITkNSt3__18integralEmEEvRKT_: 112| 10.4M|constexpr void unpoison(const T& p) { 113| 10.4M| unpoison(&p, 1); 114| 10.4M|} _ZN5Botan2CT8unpoisonImEEvPKT_m: 67| 10.6M|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 10.6M| BOTAN_UNUSED(p, n); ------------------ | | 144| 10.6M|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 10.6M|} _ZNK5Botan2CT4MaskImE7as_boolEv: 614| 50.0k| constexpr bool as_bool() const { return unpoisoned_value() != 0; } _ZNK5Botan2CT4MaskImE16unpoisoned_valueEv: 598| 10.3M| constexpr T unpoisoned_value() const { 599| 10.3M| T r = value(); 600| 10.3M| CT::unpoison(r); 601| 10.3M| return r; 602| 10.3M| } _ZNK5Botan2CT4MaskImE11select_maskES2_S2_: 559| 260k| Mask select_mask(Mask x, Mask y) const { return Mask(select(x.value(), y.value())); } _ZN5Botan2CT4MaskImEaNES2_: 494| 49| Mask& operator&=(Mask o) { 495| 49| m_mask &= o.value(); 496| 49| return (*this); 497| 49| } _ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m: 565| 10.5M| constexpr void select_n(T output[], const T x[], const T y[], size_t len) const { 566| 10.5M| const T mask = value(); 567| 75.9M| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (567:28): [True: 65.3M, False: 10.5M] ------------------ 568| 65.3M| output[i] = choose(mask, x[i], y[i]); 569| 65.3M| } 570| 10.5M| } _ZNK5Botan2CT4MaskIhE6selectEhh: 548| 1.41k| constexpr T select(T x, T y) const { return choose(value(), x, y); } _ZNK5Botan2CT4MaskImE9as_choiceEv: 619| 10.2M| constexpr CT::Choice as_choice() const { 620| 10.2M| if constexpr(sizeof(T) >= sizeof(Choice::underlying_type)) { 621| 10.2M| return CT::Choice::from_mask(static_cast(unpoisoned_value())); 622| | } else { 623| | return CT::Choice::from_int(unpoisoned_value()); 624| | } 625| 10.2M| } _ZN5Botan2CT6poisonImEEvPKT_m: 56| 12.9k|constexpr inline void poison(const T* p, size_t n) { 57| |#if defined(BOTAN_HAS_VALGRIND) 58| | if(!std::is_constant_evaluated()) { 59| | VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T)); 60| | } 61| |#endif 62| | 63| 12.9k| BOTAN_UNUSED(p, n); ------------------ | | 144| 12.9k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 64| 12.9k|} _ZN5Botan2CT4MaskImE6is_gteEmm: 468| 1.41k| static constexpr Mask is_gte(T x, T y) { return ~Mask::is_lt(x, y); } _ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m: 738| 48|constexpr inline Mask conditional_copy_mem(T cnd, T* dest, const T* if_set, const T* if_unset, size_t elems) { 739| 48| const auto mask = CT::Mask::expand(cnd); 740| 48| return CT::conditional_copy_mem(mask, dest, if_set, if_unset, elems); 741| 48|} _ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES4_PS3_PKS3_S7_m: 732| 48|constexpr inline Mask conditional_copy_mem(Mask mask, T* dest, const T* if_set, const T* if_unset, size_t elems) { 733| 48| mask.select_n(dest, if_set, if_unset, elems); 734| 48| return mask; 735| 48|} _ZN5Botan2CTeoENS0_4MaskImEES2_: 523| 3.58k| friend Mask operator^(Mask x, Mask y) { return Mask(x.value() ^ y.value()); } _ZN5Botan2CT8is_equalIhEENS0_4MaskIT_EENSt3__14spanIKS3_Lm18446744073709551615EEES8_: 825| 489|constexpr inline CT::Mask is_equal(std::span x, std::span y) { 826| 489| if(x.size() != y.size()) { ------------------ | Branch (826:7): [True: 1, False: 488] ------------------ 827| 1| return CT::Mask::cleared(); 828| 1| } 829| | 830| 488| return is_equal(x.data(), y.data(), x.size()); 831| 489|} _ZN5Botan2CT4MaskIhE7clearedEv: 387| 1| static constexpr Mask cleared() { return Mask(0); } _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayIhLm56EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 13|constexpr void unpoison(const R& r) { 129| 13| const std::span s{r}; 130| 13| unpoison(s.data(), s.size()); 131| 13|} _ZN5Botan2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS7_EEEDaDpRKS7_: 222| 15|[[nodiscard]] constexpr auto scoped_poison(const Ts&... xs) { 223| 15| auto scope = scoped_cleanup([&] { unpoison_all(xs...); }); 224| 15| poison_all(xs...); 225| 15| return scope; 226| 15|} _ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQgtsZT_Li0EEEvDpRKT_: 201| 15|constexpr void poison_all(const Ts&... ts) { 202| 15| (poison(ts), ...); 203| 15|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt17custom_poisonableISC_EEEvRKSC_: 121| 15|constexpr void poison(const R& r) { 122| 15| const std::span s{r}; 123| 15| poison(s.data(), s.size()); 124| 15|} _ZZN5Botan2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS7_EEEDaDpRKS7_ENKUlvE_clEv: 223| 15| auto scope = scoped_cleanup([&] { unpoison_all(xs...); }); _ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQgtsZT_Li0EEEvDpRKT_: 207| 15|constexpr void unpoison_all(const Ts&... ts) { 208| 15| (unpoison(ts), ...); 209| 15|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt19custom_unpoisonableISC_EEEvRKSC_: 128| 17|constexpr void unpoison(const R& r) { 129| 17| const std::span s{r}; 130| 17| unpoison(s.data(), s.size()); 131| 17|} _ZN5Botan2CT9all_zerosIhEENS0_4MaskIT_EEPKS3_m: 785| 5|constexpr inline CT::Mask all_zeros(const T elem[], size_t len) { 786| 5| T sum = 0; 787| 213| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (787:22): [True: 208, False: 5] ------------------ 788| 208| sum |= elem[i]; 789| 208| } 790| 5| return CT::Mask::is_zero(sum); 791| 5|} _ZN5Botan2CT4MaskImE7clearedEv: 387| 15| static constexpr Mask cleared() { return Mask(0); } _ZN5Botan2CT4MaskImEeOES2_: 502| 6.72k| Mask& operator^=(Mask o) { 503| 6.72k| m_mask ^= o.value(); 504| 6.72k| return (*this); 505| 6.72k| } _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt19custom_unpoisonableISC_EEEvRKSC_: 128| 144|constexpr void unpoison(const R& r) { 129| 144| const std::span s{r}; 130| 144| unpoison(s.data(), s.size()); 131| 144|} _ZN5Botan2CT9all_zerosImEENS0_4MaskIT_EEPKS3_m: 785| 2.15M|constexpr inline CT::Mask all_zeros(const T elem[], size_t len) { 786| 2.15M| T sum = 0; 787| 16.1M| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (787:22): [True: 13.9M, False: 2.15M] ------------------ 788| 13.9M| sum |= elem[i]; 789| 13.9M| } 790| 2.15M| return CT::Mask::is_zero(sum); 791| 2.15M|} _ZN5Botan2CT4MaskItEC2Et: 637| 144k| constexpr explicit Mask(T m) : m_mask(m) {} _ZN5Botan2CT4MaskItE14expand_top_bitEt: 415| 28.9k| static constexpr Mask expand_top_bit(T v) { return Mask(ct_expand_top_bit(v)); } _ZNK5Botan2CT4MaskItEcoEv: 533| 57.8k| constexpr Mask operator~() const { return Mask(~value()); } _ZNK5Botan2CT4MaskItE5valueEv: 630| 144k| constexpr T value() const { return value_barrier(m_mask); } _ZNK5Botan2CT4MaskItE7as_boolEv: 614| 127| constexpr bool as_bool() const { return unpoisoned_value() != 0; } _ZNK5Botan2CT4MaskItE16unpoisoned_valueEv: 598| 127| constexpr T unpoisoned_value() const { 599| 127| T r = value(); 600| 127| CT::unpoison(r); 601| 127| return r; 602| 127| } _ZN5Botan2CT8unpoisonITkNSt3__18integralEtEEvRKT_: 112| 381|constexpr void unpoison(const T& p) { 113| 381| unpoison(&p, 1); 114| 381|} _ZN5Botan2CT4MaskIhEC2ImEENS1_IT_EE: 375| 1.41k| constexpr explicit Mask(Mask o) : m_mask(static_cast(o.value())) { 376| 1.41k| static_assert(sizeof(U) > sizeof(T), "sizes ok"); 377| 1.41k| } _ZN5Botan2CT6Choice8from_intIjQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_: 268| 54| constexpr static Choice from_int(T v) { 269| 54| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 270| 54| return !Choice(ct_is_zero(v)); 271| | } else { 272| | // Mask of T that is either |0| or |1| 273| | const T v_is_0 = ct_is_zero(value_barrier(v)); 274| | 275| | // We want the mask to be set if v != 0 so we must check that 276| | // v_is_0 is itself zero. 277| | // 278| | // Also sizeof(T) may not equal sizeof(underlying_type) so we must 279| | // use ct_is_zero. It's ok to either truncate or 280| | // zero extend v_is_0 to 32 bits since we know it is |0| or |1| 281| | // so even just the low bit is sufficient. 282| | return Choice(ct_is_zero(static_cast(v_is_0))); 283| | } 284| 54| } _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt17custom_poisonableISB_EEEvRKSB_: 121| 48|constexpr void poison(const R& r) { 122| 48| const std::span s{r}; 123| 48| poison(s.data(), s.size()); 124| 48|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt19custom_unpoisonableISB_EEEvRKSB_: 128| 48|constexpr void unpoison(const R& r) { 129| 48| const std::span s{r}; 130| 48| unpoison(s.data(), s.size()); 131| 48|} _ZN5Botan2CT22conditional_assign_memImEENS0_4MaskIT_EES3_PS3_PKS3_m: 749| 10.5M|constexpr inline Mask conditional_assign_mem(T cnd, T* dest, const T* src, size_t elems) { 750| 10.5M| const auto mask = CT::Mask::expand(cnd); 751| 10.5M| mask.select_n(dest, src, dest, elems); 752| 10.5M| return mask; 753| 10.5M|} _ZNK5Botan2CT6Choice12into_bitmaskImQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES3_v: 291| 9.13M| constexpr T into_bitmask() const { 292| 9.13M| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 293| | // The inner mask is already |0| or |1| so just truncate 294| 9.13M| return static_cast(value()); 295| | } else { 296| | return ~ct_is_zero(value()); 297| | } 298| 9.13M| } pcurves_brainpool256r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 1.18k|constexpr void poison(const T& x) { 139| 1.18k| x._const_time_poison(); 140| 1.18k|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 1.18k|constexpr void poison_all(const Ts&... ts) { 202| 1.18k| (poison(ts), ...); 203| 1.18k|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 138| 3.54k|constexpr void poison(const T& x) { 139| 3.54k| x._const_time_poison(); 140| 3.54k|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm4EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 5.59k|constexpr void poison(const R& r) { 122| 5.59k| const std::span s{r}; 123| 5.59k| poison(s.data(), s.size()); 124| 5.59k|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 1.18k|constexpr void unpoison(const T& x) { 144| 1.18k| x._const_time_unpoison(); 145| 1.18k|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 1.18k|constexpr void unpoison_all(const Ts&... ts) { 208| 1.18k| (unpoison(ts), ...); 209| 1.18k|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 143| 3.54k|constexpr void unpoison(const T& x) { 144| 3.54k| x._const_time_unpoison(); 145| 3.54k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm4EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 5.59k|constexpr void unpoison(const R& r) { 129| 5.59k| const std::span s{r}; 130| 5.59k| unpoison(s.data(), s.size()); 131| 5.59k|} _ZN5Botan2CT8is_equalImEENS0_4MaskIT_EEPKS3_S6_m: 798| 12.5k|constexpr inline CT::Mask is_equal(const T x[], const T y[], size_t len) { 799| 12.5k| if(std::is_constant_evaluated()) { ------------------ | Branch (799:7): [Folded, False: 12.5k] ------------------ 800| 0| T difference = 0; 801| | 802| 0| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (802:25): [True: 0, False: 0] ------------------ 803| 0| difference = difference | (x[i] ^ y[i]); 804| 0| } 805| | 806| 0| return CT::Mask::is_zero(difference); 807| 12.5k| } else { 808| 12.5k| volatile T difference = 0; 809| | 810| 75.3k| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (810:25): [True: 62.7k, False: 12.5k] ------------------ 811| 62.7k| difference = difference | (x[i] ^ y[i]); 812| 62.7k| } 813| | 814| 12.5k| return CT::Mask::is_zero(difference); 815| 12.5k| } 816| 12.5k|} _ZNK5Botan2CT4MaskIhE9as_choiceEv: 619| 1.83k| constexpr CT::Choice as_choice() const { 620| | if constexpr(sizeof(T) >= sizeof(Choice::underlying_type)) { 621| | return CT::Choice::from_mask(static_cast(unpoisoned_value())); 622| 1.83k| } else { 623| 1.83k| return CT::Choice::from_int(unpoisoned_value()); 624| 1.83k| } 625| 1.83k| } _ZN5Botan2CT6Choice8from_intIhQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_: 268| 1.83k| constexpr static Choice from_int(T v) { 269| 1.83k| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 270| 1.83k| return !Choice(ct_is_zero(v)); 271| | } else { 272| | // Mask of T that is either |0| or |1| 273| | const T v_is_0 = ct_is_zero(value_barrier(v)); 274| | 275| | // We want the mask to be set if v != 0 so we must check that 276| | // v_is_0 is itself zero. 277| | // 278| | // Also sizeof(T) may not equal sizeof(underlying_type) so we must 279| | // use ct_is_zero. It's ok to either truncate or 280| | // zero extend v_is_0 to 32 bits since we know it is |0| or |1| 281| | // so even just the low bit is sufficient. 282| | return Choice(ct_is_zero(static_cast(v_is_0))); 283| | } 284| 1.83k| } pcurves_brainpool256r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE: 653| 522| constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {} pcurves_brainpool256r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEEE19as_optional_vartimeEv: 710| 522| constexpr std::optional as_optional_vartime() const { 711| 522| if(m_has_value.as_bool()) { ------------------ | Branch (711:13): [True: 456, False: 66] ------------------ 712| 456| return {m_value}; 713| 456| } else { 714| 66| return {}; 715| 66| } 716| 522| } _ZN5Botan2CT6Choice8from_intImQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_: 268| 1.63k| constexpr static Choice from_int(T v) { 269| 1.63k| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 270| 1.63k| return !Choice(ct_is_zero(v)); 271| | } else { 272| | // Mask of T that is either |0| or |1| 273| | const T v_is_0 = ct_is_zero(value_barrier(v)); 274| | 275| | // We want the mask to be set if v != 0 so we must check that 276| | // v_is_0 is itself zero. 277| | // 278| | // Also sizeof(T) may not equal sizeof(underlying_type) so we must 279| | // use ct_is_zero. It's ok to either truncate or 280| | // zero extend v_is_0 to 32 bits since we know it is |0| or |1| 281| | // so even just the low bit is sufficient. 282| | return Choice(ct_is_zero(static_cast(v_is_0))); 283| | } 284| 1.63k| } pcurves_brainpool384r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 455|constexpr void poison(const T& x) { 139| 455| x._const_time_poison(); 140| 455|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 455|constexpr void poison_all(const Ts&... ts) { 202| 455| (poison(ts), ...); 203| 455|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 138| 1.36k|constexpr void poison(const T& x) { 139| 1.36k| x._const_time_poison(); 140| 1.36k|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm6EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 2.84k|constexpr void poison(const R& r) { 122| 2.84k| const std::span s{r}; 123| 2.84k| poison(s.data(), s.size()); 124| 2.84k|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 455|constexpr void unpoison(const T& x) { 144| 455| x._const_time_unpoison(); 145| 455|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 455|constexpr void unpoison_all(const Ts&... ts) { 208| 455| (unpoison(ts), ...); 209| 455|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 143| 1.36k|constexpr void unpoison(const T& x) { 144| 1.36k| x._const_time_unpoison(); 145| 1.36k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm6EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 2.84k|constexpr void unpoison(const R& r) { 129| 2.84k| const std::span s{r}; 130| 2.84k| unpoison(s.data(), s.size()); 131| 2.84k|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE: 653| 201| constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {} pcurves_brainpool384r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEEE19as_optional_vartimeEv: 710| 201| constexpr std::optional as_optional_vartime() const { 711| 201| if(m_has_value.as_bool()) { ------------------ | Branch (711:13): [True: 145, False: 56] ------------------ 712| 145| return {m_value}; 713| 145| } else { 714| 56| return {}; 715| 56| } 716| 201| } pcurves_brainpool512r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 663|constexpr void poison(const T& x) { 139| 663| x._const_time_poison(); 140| 663|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 663|constexpr void poison_all(const Ts&... ts) { 202| 663| (poison(ts), ...); 203| 663|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 138| 1.98k|constexpr void poison(const T& x) { 139| 1.98k| x._const_time_poison(); 140| 1.98k|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm8EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 1.98k|constexpr void poison(const R& r) { 122| 1.98k| const std::span s{r}; 123| 1.98k| poison(s.data(), s.size()); 124| 1.98k|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 663|constexpr void unpoison(const T& x) { 144| 663| x._const_time_unpoison(); 145| 663|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 663|constexpr void unpoison_all(const Ts&... ts) { 208| 663| (unpoison(ts), ...); 209| 663|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 143| 1.98k|constexpr void unpoison(const T& x) { 144| 1.98k| x._const_time_unpoison(); 145| 1.98k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm8EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 1.98k|constexpr void unpoison(const R& r) { 129| 1.98k| const std::span s{r}; 130| 1.98k| unpoison(s.data(), s.size()); 131| 1.98k|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE: 653| 280| constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {} pcurves_brainpool512r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEEE19as_optional_vartimeEv: 710| 280| constexpr std::optional as_optional_vartime() const { 711| 280| if(m_has_value.as_bool()) { ------------------ | Branch (711:13): [True: 227, False: 53] ------------------ 712| 227| return {m_value}; 713| 227| } else { 714| 53| return {}; 715| 53| } 716| 280| } _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm9EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 2.34k|constexpr void poison(const R& r) { 122| 2.34k| const std::span s{r}; 123| 2.34k| poison(s.data(), s.size()); 124| 2.34k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm9EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 2.34k|constexpr void unpoison(const R& r) { 129| 2.34k| const std::span s{r}; 130| 2.34k| unpoison(s.data(), s.size()); 131| 2.34k|} pcurves_secp256r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS5_9secp256r16ParamsES6_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 683|constexpr void poison(const T& x) { 139| 683| x._const_time_poison(); 140| 683|} pcurves_secp256r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 683|constexpr void poison_all(const Ts&... ts) { 202| 683| (poison(ts), ...); 203| 683|} pcurves_secp256r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEEEEvRKT_: 138| 2.04k|constexpr void poison(const T& x) { 139| 2.04k| x._const_time_poison(); 140| 2.04k|} pcurves_secp256r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS5_9secp256r16ParamsES6_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 683|constexpr void unpoison(const T& x) { 144| 683| x._const_time_unpoison(); 145| 683|} pcurves_secp256r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 683|constexpr void unpoison_all(const Ts&... ts) { 208| 683| (unpoison(ts), ...); 209| 683|} pcurves_secp256r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEEEEvRKT_: 143| 2.04k|constexpr void unpoison(const T& x) { 144| 2.04k| x._const_time_unpoison(); 145| 2.04k|} pcurves_secp256r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE: 653| 289| constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {} pcurves_secp256r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEEE19as_optional_vartimeEv: 710| 289| constexpr std::optional as_optional_vartime() const { 711| 289| if(m_has_value.as_bool()) { ------------------ | Branch (711:13): [True: 285, False: 4] ------------------ 712| 285| return {m_value}; 713| 285| } else { 714| 4| return {}; 715| 4| } 716| 289| } pcurves_secp384r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS5_9secp384r16ParamsES6_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 494|constexpr void poison(const T& x) { 139| 494| x._const_time_poison(); 140| 494|} pcurves_secp384r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 494|constexpr void poison_all(const Ts&... ts) { 202| 494| (poison(ts), ...); 203| 494|} pcurves_secp384r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEEEEvRKT_: 138| 1.48k|constexpr void poison(const T& x) { 139| 1.48k| x._const_time_poison(); 140| 1.48k|} pcurves_secp384r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS5_9secp384r16ParamsES6_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 494|constexpr void unpoison(const T& x) { 144| 494| x._const_time_unpoison(); 145| 494|} pcurves_secp384r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 494|constexpr void unpoison_all(const Ts&... ts) { 208| 494| (unpoison(ts), ...); 209| 494|} pcurves_secp384r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEEEEvRKT_: 143| 1.48k|constexpr void unpoison(const T& x) { 144| 1.48k| x._const_time_unpoison(); 145| 1.48k|} pcurves_secp384r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE: 653| 208| constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {} pcurves_secp384r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEEE19as_optional_vartimeEv: 710| 208| constexpr std::optional as_optional_vartime() const { 711| 208| if(m_has_value.as_bool()) { ------------------ | Branch (711:13): [True: 204, False: 4] ------------------ 712| 204| return {m_value}; 713| 204| } else { 714| 4| return {}; 715| 4| } 716| 208| } pcurves_secp521r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS6_6ParamsES7_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 780|constexpr void poison(const T& x) { 139| 780| x._const_time_poison(); 140| 780|} pcurves_secp521r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 780|constexpr void poison_all(const Ts&... ts) { 202| 780| (poison(ts), ...); 203| 780|} pcurves_secp521r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEEvRKT_: 138| 2.34k|constexpr void poison(const T& x) { 139| 2.34k| x._const_time_poison(); 140| 2.34k|} pcurves_secp521r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS6_6ParamsES7_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 780|constexpr void unpoison(const T& x) { 144| 780| x._const_time_unpoison(); 145| 780|} pcurves_secp521r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 780|constexpr void unpoison_all(const Ts&... ts) { 208| 780| (unpoison(ts), ...); 209| 780|} pcurves_secp521r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEEvRKT_: 143| 2.34k|constexpr void unpoison(const T& x) { 144| 2.34k| x._const_time_unpoison(); 145| 2.34k|} pcurves_secp521r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE: 653| 327| constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {} pcurves_secp521r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEE19as_optional_vartimeEv: 710| 327| constexpr std::optional as_optional_vartime() const { 711| 327| if(m_has_value.as_bool()) { ------------------ | Branch (711:13): [True: 322, False: 5] ------------------ 712| 322| return {m_value}; 713| 322| } else { 714| 5| return {}; 715| 5| } 716| 327| } _ZNK5Botan2CT4MaskItE13if_set_returnEt: 538| 254| constexpr T if_set_return(T x) const { return value() & x; } _ZN5Botan2CT4MaskItE7is_zeroEt: 437| 29.0k| static constexpr Mask is_zero(T x) { return Mask(ct_is_zero(value_barrier(x))); } _ZN5Botan2CT4MaskItE5is_ltEtt: 450| 28.9k| static constexpr Mask is_lt(T x, T y) { 451| 28.9k| T u = x ^ ((x ^ y) | ((x - y) ^ x)); 452| 28.9k| return Mask::expand_top_bit(u); 453| 28.9k| } _ZN5Botan2CT4MaskItE5is_gtEtt: 458| 28.8k| static constexpr Mask is_gt(T x, T y) { return Mask::is_lt(y, x); } _ZN5Botan2CT4MaskItE6is_lteEtt: 463| 28.8k| static constexpr Mask is_lte(T x, T y) { return ~Mask::is_gt(x, y); } _ZN5Botan2CT4MaskItE8is_equalEtt: 442| 28.8k| static constexpr Mask is_equal(T x, T y) { 443| 28.8k| const T diff = value_barrier(x) ^ value_barrier(y); 444| 28.8k| return Mask::is_zero(diff); 445| 28.8k| } _ZN5Botan2CT4MaskItE6expandEt: 392| 127| static constexpr Mask expand(T v) { return ~Mask::is_zero(value_barrier(v)); } _ZN5Botan2CT4MaskImE10expand_bitEmm: 421| 4.09k| static constexpr Mask expand_bit(T v, size_t bit) { 422| 4.09k| return CT::Mask::expand_top_bit(v << (sizeof(v) * 8 - 1 - bit)); 423| 4.09k| } _ZNK5Botan2CT4MaskItE17if_not_set_returnEt: 543| 127| constexpr T if_not_set_return(T x) const { return ~value() & x; } _ZN5Botan2CT4MaskItE6expandIhEES2_NS1_IT_EE: 429| 127| static constexpr Mask expand(Mask m) { 430| 127| static_assert(sizeof(U) < sizeof(T), "sizes ok"); 431| 127| return ~Mask::is_zero(m.value()); 432| 127| } _ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS0_4MaskItEEEEvRKT_: 143| 127|constexpr void unpoison(const T& x) { 144| 127| x._const_time_unpoison(); 145| 127|} _ZNK5Botan2CT4MaskItE20_const_time_unpoisonEv: 634| 127| constexpr void _const_time_unpoison() const { CT::unpoison(m_mask); } _ZN5Botan2CTanENS0_4MaskItEES2_: 518| 28.9k| friend Mask operator&(Mask x, Mask y) { return Mask(x.value() & y.value()); } _ZN5Botan2CT4MaskItEoRES2_: 510| 28.7k| Mask& operator|=(Mask o) { 511| 28.7k| m_mask |= o.value(); 512| 28.7k| return (*this); 513| 28.7k| } _ZN5Botan9Gf448Elem3oneEv: 64| 30| static Gf448Elem one() { return Gf448Elem(1); } _ZN5Botan9Gf448Elem4zeroEv: 59| 15| static Gf448Elem zero() { return Gf448Elem(0); } _ZN5Botan9Gf448Elem5wordsEv: 120| 33.6k| std::span words() { return m_x; } _ZNK5Botan9Gf448Elem5wordsEv: 128| 33.6k| std::span words() const { return m_x; } _ZNK5Botan9TripleDES4nameEv: 50| 105| std::string name() const override { return "TripleDES"; } _ZNK5Botan9TripleDES11parallelismEv: 54| 78| size_t parallelism() const override { return 32; } _ZN5Botan11carry_shiftEom: 139| 226k|inline uint64_t carry_shift(const uint128_t a, size_t shift) { 140| 226k| return static_cast(a >> shift); 141| 226k|} _ZN5Botan13combine_lowerEomom: 143| 64|inline uint64_t combine_lower(const uint128_t a, size_t s1, const uint128_t b, size_t s2) { 144| 64| return static_cast((a >> s1) | (b << s2)); 145| 64|} _ZNK5Botan13EC_Group_Data3oidEv: 166| 34.8k| const OID& oid() const { return m_oid; } _ZNK5Botan13EC_Group_Data1pEv: 170| 21.0k| const BigInt& p() const { return m_p; } _ZNK5Botan13EC_Group_Data5curveEv: 181| 10.5k| const CurveGFp& curve() const { return m_curve; } _ZNK5Botan13EC_Group_Data5montyEv: 185| 52.5k| const Montgomery_Params& monty() const { return m_monty; } _ZNK5Botan13EC_Group_Data12has_cofactorEv: 196| 3.27k| bool has_cofactor() const { return m_has_cofactor; } _ZNK5Botan13EC_Group_Data7p_wordsEv: 202| 10.5k| size_t p_words() const { return m_p_words; } _ZNK5Botan13EC_Group_Data6p_bitsEv: 204| 1.63k| size_t p_bits() const { return m_p_bits; } _ZNK5Botan13EC_Group_Data7p_bytesEv: 206| 12.0k| size_t p_bytes() const { return (m_p_bits + 7) / 8; } _ZNK5Botan13EC_Group_Data11order_bytesEv: 210| 23.9k| size_t order_bytes() const { return m_order_bytes; } _ZNK5Botan13EC_Group_Data6pcurveEv: 297| 69.2k| const PCurve::PrimeOrderCurve& pcurve() const { 298| 69.2k| BOTAN_ASSERT_NONNULL(m_pcurve); ------------------ | | 116| 69.2k| do { \ | | 117| 69.2k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 69.2k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 69.2k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 69.2k] | | ------------------ ------------------ 299| 69.2k| return *m_pcurve; 300| 69.2k| } _ZN5Botan19EC_AffinePoint_DataD2Ev: 74| 15.4k| virtual ~EC_AffinePoint_Data() = default; _ZN5Botan14EC_Scalar_DataD2Ev: 39| 16.7k| virtual ~EC_Scalar_Data() = default; _ZNK5Botan17EC_Scalar_Data_PC5valueEv: 53| 12.1k| const auto& value() const { return m_v; } _ZN5Botan17EC_Scalar_Data_PCC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEENS_6PCurve15PrimeOrderCurve6ScalarE: 19| 16.7k| m_group(std::move(group)), m_v(std::move(v)) {} _ZNK5Botan17EC_PublicKey_Data5groupEv: 30| 13.7k| const EC_Group& group() const { return m_group; } _ZNK5Botan17EC_PublicKey_Data10public_keyEv: 32| 4.25k| const EC_AffinePoint& public_key() const { return m_point; } _ZNK5Botan18EC_PrivateKey_Data11private_keyEv: 73| 1.63k| const EC_Scalar& private_key() const { return m_scalar; } _ZN5Botan3fmtIJNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEEES7_NS1_17basic_string_viewIcS4_EEDpRKT_: 53| 13.1k|std::string fmt(std::string_view format, const T&... args) { 54| 13.1k| std::ostringstream oss; 55| 13.1k| oss.imbue(std::locale::classic()); 56| 13.1k| fmt_detail::do_fmt(oss, format, args...); 57| 13.1k| return oss.str(); 58| 13.1k|} _ZN5Botan10fmt_detail6do_fmtINSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEJEEEvRNS2_19basic_ostringstreamIcS5_S7_EENS2_17basic_string_viewIcS5_EERKT_DpRKT0_: 25| 13.1k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 13.1k| size_t i = 0; 27| | 28| 129k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 129k, False: 0] ------------------ 29| 129k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 13.1k, False: 116k] | Branch (29:30): [True: 13.1k, False: 0] | Branch (29:59): [True: 13.1k, False: 0] ------------------ 30| 13.1k| oss << val; 31| 13.1k| return do_fmt(oss, format.substr(i + 2), rest...); 32| 116k| } else { 33| 116k| oss << format[i]; 34| 116k| } 35| | 36| 116k| i += 1; 37| 116k| } 38| 13.1k|} _ZN5Botan10fmt_detail6do_fmtERNSt3__119basic_ostringstreamIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE: 20| 18.8k|inline void do_fmt(std::ostringstream& oss, std::string_view format) { 21| 18.8k| oss << format; 22| 18.8k|} _ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_: 53| 3.90k|std::string fmt(std::string_view format, const T&... args) { 54| 3.90k| std::ostringstream oss; 55| 3.90k| oss.imbue(std::locale::classic()); 56| 3.90k| fmt_detail::do_fmt(oss, format, args...); 57| 3.90k| return oss.str(); 58| 3.90k|} _ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_: 25| 4.72k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 4.72k| size_t i = 0; 27| | 28| 35.5k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 35.5k, False: 0] ------------------ 29| 35.5k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 4.72k, False: 30.7k] | Branch (29:30): [True: 4.72k, False: 0] | Branch (29:59): [True: 4.72k, False: 0] ------------------ 30| 4.72k| oss << val; 31| 4.72k| return do_fmt(oss, format.substr(i + 2), rest...); 32| 30.7k| } else { 33| 30.7k| oss << format[i]; 34| 30.7k| } 35| | 36| 30.7k| i += 1; 37| 30.7k| } 38| 4.72k|} _ZN5Botan3fmtIJPKcS2_S2_EEENSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EEDpRKT_: 53| 1|std::string fmt(std::string_view format, const T&... args) { 54| 1| std::ostringstream oss; 55| 1| oss.imbue(std::locale::classic()); 56| 1| fmt_detail::do_fmt(oss, format, args...); 57| 1| return oss.str(); 58| 1|} _ZN5Botan10fmt_detail6do_fmtIPKcJS3_S3_EEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_: 25| 1|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 1| size_t i = 0; 27| | 28| 1| while(i < format.size()) { ------------------ | Branch (28:10): [True: 1, False: 0] ------------------ 29| 1| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 1, False: 0] | Branch (29:30): [True: 1, False: 0] | Branch (29:59): [True: 1, False: 0] ------------------ 30| 1| oss << val; 31| 1| return do_fmt(oss, format.substr(i + 2), rest...); 32| 1| } else { 33| 0| oss << format[i]; 34| 0| } 35| | 36| 0| i += 1; 37| 0| } 38| 1|} _ZN5Botan10fmt_detail6do_fmtIPKcJS3_EEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_: 25| 1|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 1| size_t i = 0; 27| | 28| 5| while(i < format.size()) { ------------------ | Branch (28:10): [True: 5, False: 0] ------------------ 29| 5| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 1, False: 4] | Branch (29:30): [True: 1, False: 0] | Branch (29:59): [True: 1, False: 0] ------------------ 30| 1| oss << val; 31| 1| return do_fmt(oss, format.substr(i + 2), rest...); 32| 4| } else { 33| 4| oss << format[i]; 34| 4| } 35| | 36| 4| i += 1; 37| 4| } 38| 1|} _ZN5Botan10fmt_detail6do_fmtIPKcJEEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_: 25| 493|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 493| size_t i = 0; 27| | 28| 6.88k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 6.88k, False: 0] ------------------ 29| 6.88k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 493, False: 6.39k] | Branch (29:30): [True: 493, False: 0] | Branch (29:59): [True: 493, False: 0] ------------------ 30| 493| oss << val; 31| 493| return do_fmt(oss, format.substr(i + 2), rest...); 32| 6.39k| } else { 33| 6.39k| oss << format[i]; 34| 6.39k| } 35| | 36| 6.39k| i += 1; 37| 6.39k| } 38| 493|} _ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEPKcEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_: 53| 489|std::string fmt(std::string_view format, const T&... args) { 54| 489| std::ostringstream oss; 55| 489| oss.imbue(std::locale::classic()); 56| 489| fmt_detail::do_fmt(oss, format, args...); 57| 489| return oss.str(); 58| 489|} _ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJPKcEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_: 25| 489|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 489| size_t i = 0; 27| | 28| 489| while(i < format.size()) { ------------------ | Branch (28:10): [True: 489, False: 0] ------------------ 29| 489| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 489, False: 0] | Branch (29:30): [True: 489, False: 0] | Branch (29:59): [True: 489, False: 0] ------------------ 30| 489| oss << val; 31| 489| return do_fmt(oss, format.substr(i + 2), rest...); 32| 489| } else { 33| 0| oss << format[i]; 34| 0| } 35| | 36| 0| i += 1; 37| 0| } 38| 489|} _ZN5Botan3fmtIJPKcNSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEEEENS3_12basic_stringIcS6_NS3_9allocatorIcEEEES7_DpRKT_: 53| 817|std::string fmt(std::string_view format, const T&... args) { 54| 817| std::ostringstream oss; 55| 817| oss.imbue(std::locale::classic()); 56| 817| fmt_detail::do_fmt(oss, format, args...); 57| 817| return oss.str(); 58| 817|} _ZN5Botan10fmt_detail6do_fmtIPKcJNSt3__117basic_string_viewIcNS4_11char_traitsIcEEEEEEEvRNS4_19basic_ostringstreamIcS7_NS4_9allocatorIcEEEES8_RKT_DpRKT0_: 25| 817|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 817| size_t i = 0; 27| | 28| 5.54k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 5.54k, False: 0] ------------------ 29| 5.54k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 817, False: 4.72k] | Branch (29:30): [True: 817, False: 0] | Branch (29:59): [True: 817, False: 0] ------------------ 30| 817| oss << val; 31| 817| return do_fmt(oss, format.substr(i + 2), rest...); 32| 4.72k| } else { 33| 4.72k| oss << format[i]; 34| 4.72k| } 35| | 36| 4.72k| i += 1; 37| 4.72k| } 38| 817|} _ZN5Botan10fmt_detail6do_fmtImJEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_: 25| 349|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 349| size_t i = 0; 27| | 28| 8.62k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 8.62k, False: 0] ------------------ 29| 8.62k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 349, False: 8.27k] | Branch (29:30): [True: 349, False: 0] | Branch (29:59): [True: 349, False: 0] ------------------ 30| 349| oss << val; 31| 349| return do_fmt(oss, format.substr(i + 2), rest...); 32| 8.27k| } else { 33| 8.27k| oss << format[i]; 34| 8.27k| } 35| | 36| 8.27k| i += 1; 37| 8.27k| } 38| 349|} _ZN5Botan3fmtIJmmEEENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EEDpRKT_: 53| 349|std::string fmt(std::string_view format, const T&... args) { 54| 349| std::ostringstream oss; 55| 349| oss.imbue(std::locale::classic()); 56| 349| fmt_detail::do_fmt(oss, format, args...); 57| 349| return oss.str(); 58| 349|} _ZN5Botan10fmt_detail6do_fmtImJmEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_: 25| 349|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 349| size_t i = 0; 27| | 28| 4.47k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 4.47k, False: 0] ------------------ 29| 4.47k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 349, False: 4.12k] | Branch (29:30): [True: 349, False: 0] | Branch (29:59): [True: 349, False: 0] ------------------ 30| 349| oss << val; 31| 349| return do_fmt(oss, format.substr(i + 2), rest...); 32| 4.12k| } else { 33| 4.12k| oss << format[i]; 34| 4.12k| } 35| | 36| 4.12k| i += 1; 37| 4.12k| } 38| 349|} _ZN5Botan10fmt_detail6do_fmtIjJEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_: 25| 79|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 79| size_t i = 0; 27| | 28| 194| while(i < format.size()) { ------------------ | Branch (28:10): [True: 194, False: 0] ------------------ 29| 194| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 79, False: 115] | Branch (29:30): [True: 79, False: 0] | Branch (29:59): [True: 79, False: 0] ------------------ 30| 79| oss << val; 31| 79| return do_fmt(oss, format.substr(i + 2), rest...); 32| 115| } else { 33| 115| oss << format[i]; 34| 115| } 35| | 36| 115| i += 1; 37| 115| } 38| 79|} _ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEjEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_: 53| 36|std::string fmt(std::string_view format, const T&... args) { 54| 36| std::ostringstream oss; 55| 36| oss.imbue(std::locale::classic()); 56| 36| fmt_detail::do_fmt(oss, format, args...); 57| 36| return oss.str(); 58| 36|} _ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJjEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_: 25| 36|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 36| size_t i = 0; 27| | 28| 36| while(i < format.size()) { ------------------ | Branch (28:10): [True: 36, False: 0] ------------------ 29| 36| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 36, False: 0] | Branch (29:30): [True: 36, False: 0] | Branch (29:59): [True: 36, False: 0] ------------------ 30| 36| oss << val; 31| 36| return do_fmt(oss, format.substr(i + 2), rest...); 32| 36| } else { 33| 0| oss << format[i]; 34| 0| } 35| | 36| 0| i += 1; 37| 0| } 38| 36|} _ZN5Botan3fmtIJjjEEENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EEDpRKT_: 53| 43|std::string fmt(std::string_view format, const T&... args) { 54| 43| std::ostringstream oss; 55| 43| oss.imbue(std::locale::classic()); 56| 43| fmt_detail::do_fmt(oss, format, args...); 57| 43| return oss.str(); 58| 43|} _ZN5Botan10fmt_detail6do_fmtIjJjEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_: 25| 43|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 43| size_t i = 0; 27| | 28| 1.46k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 1.46k, False: 0] ------------------ 29| 1.46k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 43, False: 1.41k] | Branch (29:30): [True: 43, False: 0] | Branch (29:59): [True: 43, False: 0] ------------------ 30| 43| oss << val; 31| 43| return do_fmt(oss, format.substr(i + 2), rest...); 32| 1.41k| } else { 33| 1.41k| oss << format[i]; 34| 1.41k| } 35| | 36| 1.41k| i += 1; 37| 1.41k| } 38| 43|} _ZN5Botan3fmtIJmPKcEEENSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EEDpRKT_: 53| 3|std::string fmt(std::string_view format, const T&... args) { 54| 3| std::ostringstream oss; 55| 3| oss.imbue(std::locale::classic()); 56| 3| fmt_detail::do_fmt(oss, format, args...); 57| 3| return oss.str(); 58| 3|} _ZN5Botan10fmt_detail6do_fmtImJPKcEEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_: 25| 3|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 3| size_t i = 0; 27| | 28| 42| while(i < format.size()) { ------------------ | Branch (28:10): [True: 42, False: 0] ------------------ 29| 42| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 3, False: 39] | Branch (29:30): [True: 3, False: 0] | Branch (29:59): [True: 3, False: 0] ------------------ 30| 3| oss << val; 31| 3| return do_fmt(oss, format.substr(i + 2), rest...); 32| 39| } else { 33| 39| oss << format[i]; 34| 39| } 35| | 36| 39| i += 1; 37| 39| } 38| 3|} _ZN5Botan14GCM_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm: 80| 18| GCM_Mode(std::move(cipher), tag_size) {} _ZN5Botan14GCM_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm: 101| 96| GCM_Mode(std::move(cipher), tag_size) {} _ZNK5Botan8GCM_Mode8tag_sizeEv: 40| 631| size_t tag_size() const final { return m_tag_size; } _ZNK5Botan14GCM_Decryption18minimum_final_sizeEv: 105| 76| size_t minimum_final_size() const override { return tag_size(); } _ZNK5Botan5GHASH8key_specEv: 42| 114| Key_Length_Specification key_spec() const override { return Key_Length_Specification(16); } _ZN5Botan7swar_ltITkNSt3__117unsigned_integralEtEET_S2_S2_: 121| 324k|constexpr T swar_lt(T a, T b) { 122| | // The constant 0x808080... as a T 123| 324k| constexpr T hi1 = (static_cast(-1) / 255) << 7; 124| | // The constant 0x7F7F7F... as a T 125| 324k| constexpr T lo7 = static_cast(~hi1); 126| 324k| T r = (lo7 - a + b) & hi1; 127| | // Currently the mask is 80 if lt, otherwise 00. Convert to FF/00 128| 324k| return (r << 1) - (r >> 7); 129| 324k|} _ZN5Botan12mul_or_throwITkNSt3__117unsigned_integralEmEET_S2_S2_NS1_17basic_string_viewIcNS1_11char_traitsIcEEEE: 81| 12.4k|constexpr T mul_or_throw(T a, T b, std::string_view msg) { 82| 12.4k| if(auto r = checked_mul(a, b)) { ------------------ | Branch (82:12): [True: 12.4k, False: 0] ------------------ 83| 12.4k| return r.value(); 84| 12.4k| } else { 85| 0| throw Invalid_Argument(msg); 86| 0| } 87| 12.4k|} _ZN5Botan11checked_mulITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_: 46| 608k|constexpr inline std::optional checked_mul(T a, T b) { 47| | // Multiplication by 1U is a hack to work around C's insane 48| | // integer promotion rules. 49| | // https://stackoverflow.com/questions/24795651 50| 608k| const T r = (1U * a) * b; 51| | // If a == 0 then the multiply certainly did not overflow 52| | // Otherwise r / a == b unless overflow occurred 53| 608k| if(a != 0 && r / a != b) { ------------------ | Branch (53:7): [True: 608k, False: 0] | Branch (53:17): [True: 0, False: 608k] ------------------ 54| 0| return {}; 55| 0| } 56| 608k| return r; 57| 608k|} _ZN5Botan13swar_in_rangeITkNSt3__117unsigned_integralEmEET_S2_S2_S2_: 144| 5.26M|constexpr T swar_in_range(T v, T lower, T upper) { 145| | // The constant 0x808080... as a T 146| 5.26M| constexpr T hi1 = (static_cast(-1) / 255) << 7; 147| | // The constant 0x7F7F7F... as a T 148| 5.26M| constexpr T lo7 = ~hi1; 149| | 150| 5.26M| const T sub = ((v | hi1) - (lower & lo7)) ^ ((v ^ (~lower)) & hi1); 151| 5.26M| const T a_lo = sub & lo7; 152| 5.26M| const T a_hi = sub & hi1; 153| 5.26M| return (lo7 - a_lo + upper) & hi1 & ~a_hi; 154| 5.26M|} _ZN5Botan23index_of_first_set_byteITkNSt3__117unsigned_integralEmEEmT_: 160| 93.7k|constexpr size_t index_of_first_set_byte(T v) { 161| | // The constant 0x010101... as a T 162| 93.7k| constexpr T lo1 = (static_cast(-1) / 255); 163| | // The constant 0x808080... as a T 164| 93.7k| constexpr T hi1 = lo1 << 7; 165| | // How many bits to shift in order to get the top byte 166| 93.7k| constexpr size_t bits = (sizeof(T) * 8) - 8; 167| | 168| 93.7k| return static_cast((((((v & hi1) - 1) & lo1) * lo1) >> bits) - 1); 169| 93.7k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEjEENS1_8optionalIT_EES3_S3_: 19| 75.1k|constexpr inline std::optional checked_add(T a, T b) { 20| 75.1k| const T r = a + b; 21| 75.1k| if(r < a || r < b) { ------------------ | Branch (21:7): [True: 0, False: 75.1k] | Branch (21:16): [True: 0, False: 75.1k] ------------------ 22| 0| return {}; 23| 0| } 24| 75.1k| return r; 25| 75.1k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmTpTkNS1_17unsigned_integralEJmmEQ10all_same_vIT_DpT0_EEENS1_8optionalIS2_EES2_S2_S4_: 37| 44.6k|constexpr inline std::optional checked_add(T a, T b, Ts... rest) { 38| 44.6k| if(auto r = checked_add(a, b)) { ------------------ | Branch (38:12): [True: 44.6k, False: 0] ------------------ 39| 44.6k| return checked_add(r.value(), rest...); 40| 44.6k| } else { 41| 0| return {}; 42| 0| } 43| 44.6k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_: 19| 159k|constexpr inline std::optional checked_add(T a, T b) { 20| 159k| const T r = a + b; 21| 159k| if(r < a || r < b) { ------------------ | Branch (21:7): [True: 0, False: 159k] | Branch (21:16): [True: 0, False: 159k] ------------------ 22| 0| return {}; 23| 0| } 24| 159k| return r; 25| 159k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmTpTkNS1_17unsigned_integralEJmEQ10all_same_vIT_DpT0_EEENS1_8optionalIS2_EES2_S2_S4_: 37| 44.6k|constexpr inline std::optional checked_add(T a, T b, Ts... rest) { 38| 44.6k| if(auto r = checked_add(a, b)) { ------------------ | Branch (38:12): [True: 44.6k, False: 0] ------------------ 39| 44.6k| return checked_add(r.value(), rest...); 40| 44.6k| } else { 41| 0| return {}; 42| 0| } 43| 44.6k|} _ZN5Botan12add_or_throwITkNSt3__117unsigned_integralEmEET_S2_S2_NS1_17basic_string_viewIcNS1_11char_traitsIcEEEE: 66| 852|constexpr T add_or_throw(T a, T b, std::string_view msg) { 67| 852| if(auto r = checked_add(a, b)) { ------------------ | Branch (67:12): [True: 852, False: 0] ------------------ 68| 852| return r.value(); 69| 852| } else { 70| 0| throw Invalid_Argument(msg); 71| 0| } 72| 852|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmTpTkNS1_17unsigned_integralEJmmmmmmEQ10all_same_vIT_DpT0_EEENS1_8optionalIS2_EES2_S2_S4_: 37| 6.24k|constexpr inline std::optional checked_add(T a, T b, Ts... rest) { 38| 6.24k| if(auto r = checked_add(a, b)) { ------------------ | Branch (38:12): [True: 6.24k, False: 0] ------------------ 39| 6.24k| return checked_add(r.value(), rest...); 40| 6.24k| } else { 41| 0| return {}; 42| 0| } 43| 6.24k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmTpTkNS1_17unsigned_integralEJmmmmmEQ10all_same_vIT_DpT0_EEENS1_8optionalIS2_EES2_S2_S4_: 37| 6.24k|constexpr inline std::optional checked_add(T a, T b, Ts... rest) { 38| 6.24k| if(auto r = checked_add(a, b)) { ------------------ | Branch (38:12): [True: 6.24k, False: 0] ------------------ 39| 6.24k| return checked_add(r.value(), rest...); 40| 6.24k| } else { 41| 0| return {}; 42| 0| } 43| 6.24k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmTpTkNS1_17unsigned_integralEJmmmmEQ10all_same_vIT_DpT0_EEENS1_8optionalIS2_EES2_S2_S4_: 37| 6.24k|constexpr inline std::optional checked_add(T a, T b, Ts... rest) { 38| 6.24k| if(auto r = checked_add(a, b)) { ------------------ | Branch (38:12): [True: 6.24k, False: 0] ------------------ 39| 6.24k| return checked_add(r.value(), rest...); 40| 6.24k| } else { 41| 0| return {}; 42| 0| } 43| 6.24k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmTpTkNS1_17unsigned_integralEJmmmEQ10all_same_vIT_DpT0_EEENS1_8optionalIS2_EES2_S2_S4_: 37| 6.24k|constexpr inline std::optional checked_add(T a, T b, Ts... rest) { 38| 6.24k| if(auto r = checked_add(a, b)) { ------------------ | Branch (38:12): [True: 6.24k, False: 0] ------------------ 39| 6.24k| return checked_add(r.value(), rest...); 40| 6.24k| } else { 41| 0| return {}; 42| 0| } 43| 6.24k|} _ZN5Botan8get_byteILm0EtEEhT0_QltT_stS1_: 81| 353k|{ 82| 353k| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 353k| return static_cast((input >> shift) & 0xFF); 84| 353k|} _ZN5Botan8get_byteILm1EtEEhT0_QltT_stS1_: 81| 353k|{ 82| 353k| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 353k| return static_cast((input >> shift) & 0xFF); 84| 353k|} _ZN5Botan11make_uint16Ehh: 92| 208k|inline constexpr uint16_t make_uint16(uint8_t i0, uint8_t i1) { 93| 208k| return static_cast((static_cast(i0) << 8) | i1); 94| 208k|} _ZN5Botan11make_uint32Ehhhh: 104| 24.1k|inline constexpr uint32_t make_uint32(uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3) { 105| 24.1k| return ((static_cast(i0) << 24) | (static_cast(i1) << 16) | (static_cast(i2) << 8) | 106| 24.1k| (static_cast(i3))); 107| 24.1k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJRKmPhEEEDaDpOT0_: 745| 97.8k|inline constexpr auto store_be(ParamTs&&... params) { 746| 97.8k| return detail::store_any(std::forward(params)...); 747| 97.8k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEmQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_EEEvS6_Ph: 711| 98.4k|inline constexpr void store_any(T in, uint8_t out[]) { 712| | // asserts that *out points to enough bytes to write into 713| 98.4k| store_any(in, std::span(out, sizeof(T))); 714| 98.4k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQsr3stdE7same_asIS4_T0_EEEvT1_OT2_: 646| 98.4k|inline constexpr void store_any(T in, OutR&& out_range) { 647| 98.4k| store_any(in, std::forward(out_range)); 648| 98.4k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 418k|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 418k| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 418k| using InT = decltype(in); 528| 418k| ranges::assert_exact_byte_length(out_range); 529| 418k| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 418k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 418k] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 418k| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| | } else if constexpr(endianness == std::endian::native) { 540| | typecast_copy(out, in); 541| 418k| } else { 542| 418k| static_assert(opposite(endianness) == std::endian::native); 543| 418k| typecast_copy(out, reverse_bytes(in)); 544| 418k| } 545| 418k| } 546| 418k|} _ZN5Botan6detail26unwrap_strong_type_or_enumITkNS0_20unsigned_integralishEmEEDaT_: 190| 421k|constexpr auto unwrap_strong_type_or_enum(InT t) { 191| | if constexpr(std::is_enum_v) { 192| | // TODO: C++23: use std::to_underlying(in) instead 193| | return static_cast>(t); 194| 421k| } else { 195| 421k| return Botan::unwrap_strong_type(t); 196| 421k| } 197| 421k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmEET0_PKhm: 454| 257k|inline constexpr OutT load_any(const uint8_t in[], size_t off) { 455| | // asserts that *in points to enough bytes to read at offset off 456| 257k| constexpr size_t out_size = sizeof(OutT); 457| 257k| return load_any(std::span(in + off * out_size, out_size)); 458| 257k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 428k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 428k| using OutT = detail::wrapped_type; 280| 428k| ranges::assert_exact_byte_length(in_range); 281| | 282| 428k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 428k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 428k| return fallback_load_any(std::forward(in_range)); 288| 428k| } else { 289| 428k| const std::span in{in_range}; 290| 428k| if constexpr(sizeof(OutT) == 1) { 291| 428k| return static_cast(in[0]); 292| 428k| } else if constexpr(endianness == std::endian::native) { 293| 428k| return typecast_copy(in); 294| 428k| } else { 295| 428k| static_assert(opposite(endianness) == std::endian::native); 296| 428k| return reverse_bytes(typecast_copy(in)); 297| 428k| } 298| 428k| } 299| 428k| }()); 300| 428k|} _ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEmTkNSt3__117unsigned_integralEmEEDaT0_: 200| 455k|constexpr auto wrap_strong_type_or_enum(T t) { 201| | if constexpr(std::is_enum_v) { 202| | return static_cast(t); 203| 455k| } else { 204| 455k| return Botan::wrap_strong_type(t); 205| 455k| } 206| 455k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 428k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 428k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 428k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 428k| } else { 289| 428k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| 428k| } else { 295| 428k| static_assert(opposite(endianness) == std::endian::native); 296| 428k| return reverse_bytes(typecast_copy(in)); 297| 428k| } 298| 428k| } 299| 428k| }()); _ZN5Botan8get_byteILm7EmEEhT0_QltT_stS1_: 81| 24|{ 82| 24| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 24| return static_cast((input >> shift) & 0xFF); 84| 24|} _ZN5Botan8get_byteILm6EmEEhT0_QltT_stS1_: 81| 24|{ 82| 24| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 24| return static_cast((input >> shift) & 0xFF); 84| 24|} _ZN5Botan8get_byteILm5EmEEhT0_QltT_stS1_: 81| 24|{ 82| 24| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 24| return static_cast((input >> shift) & 0xFF); 84| 24|} _ZN5Botan8get_byteILm4EmEEhT0_QltT_stS1_: 81| 24|{ 82| 24| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 24| return static_cast((input >> shift) & 0xFF); 84| 24|} _ZN5Botan8get_byteILm3EmEEhT0_QltT_stS1_: 81| 24|{ 82| 24| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 24| return static_cast((input >> shift) & 0xFF); 84| 24|} _ZN5Botan8get_byteILm2EmEEhT0_QltT_stS1_: 81| 24|{ 82| 24| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 24| return static_cast((input >> shift) & 0xFF); 84| 24|} _ZN5Botan8get_byteILm1EmEEhT0_QltT_stS1_: 81| 24|{ 82| 24| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 24| return static_cast((input >> shift) & 0xFF); 84| 24|} _ZN5Botan8get_byteILm0EmEEhT0_QltT_stS1_: 81| 194|{ 82| 194| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 194| return static_cast((input >> shift) & 0xFF); 84| 194|} _ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEtTkNSt3__117unsigned_integralEtEEDaT0_: 200| 29.7k|constexpr auto wrap_strong_type_or_enum(T t) { 201| | if constexpr(std::is_enum_v) { 202| | return static_cast(t); 203| 29.7k| } else { 204| 29.7k| return Botan::wrap_strong_type(t); 205| 29.7k| } 206| 29.7k|} _ZN5Botan7load_beItJPKhRmEEEDaDpOT0_: 504| 28.4k|inline constexpr auto load_be(ParamTs&&... params) { 505| 28.4k| return detail::load_any(std::forward(params)...); 506| 28.4k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEtEET0_PKhm: 454| 29.7k|inline constexpr OutT load_any(const uint8_t in[], size_t off) { 455| | // asserts that *in points to enough bytes to read at offset off 456| 29.7k| constexpr size_t out_size = sizeof(OutT); 457| 29.7k| return load_any(std::span(in + off * out_size, out_size)); 458| 29.7k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEtTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm2EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 29.7k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 29.7k| using OutT = detail::wrapped_type; 280| 29.7k| ranges::assert_exact_byte_length(in_range); 281| | 282| 29.7k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 29.7k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 29.7k| return fallback_load_any(std::forward(in_range)); 288| 29.7k| } else { 289| 29.7k| const std::span in{in_range}; 290| 29.7k| if constexpr(sizeof(OutT) == 1) { 291| 29.7k| return static_cast(in[0]); 292| 29.7k| } else if constexpr(endianness == std::endian::native) { 293| 29.7k| return typecast_copy(in); 294| 29.7k| } else { 295| 29.7k| static_assert(opposite(endianness) == std::endian::native); 296| 29.7k| return reverse_bytes(typecast_copy(in)); 297| 29.7k| } 298| 29.7k| } 299| 29.7k| }()); 300| 29.7k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEtTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm2EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 29.7k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 29.7k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 29.7k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 29.7k| } else { 289| 29.7k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| 29.7k| } else { 295| 29.7k| static_assert(opposite(endianness) == std::endian::native); 296| 29.7k| return reverse_bytes(typecast_copy(in)); 297| 29.7k| } 298| 29.7k| } 299| 29.7k| }()); _ZN5Botan7load_beIjJPKhRmEEEDaDpOT0_: 504| 140|inline constexpr auto load_be(ParamTs&&... params) { 505| 140| return detail::load_any(std::forward(params)...); 506| 140|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEjEET0_PKhm: 454| 547|inline constexpr OutT load_any(const uint8_t in[], size_t off) { 455| | // asserts that *in points to enough bytes to read at offset off 456| 547| constexpr size_t out_size = sizeof(OutT); 457| 547| return load_any(std::span(in + off * out_size, out_size)); 458| 547|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEjTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm4EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 547|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 547| using OutT = detail::wrapped_type; 280| 547| ranges::assert_exact_byte_length(in_range); 281| | 282| 547| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 547| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 547| return fallback_load_any(std::forward(in_range)); 288| 547| } else { 289| 547| const std::span in{in_range}; 290| 547| if constexpr(sizeof(OutT) == 1) { 291| 547| return static_cast(in[0]); 292| 547| } else if constexpr(endianness == std::endian::native) { 293| 547| return typecast_copy(in); 294| 547| } else { 295| 547| static_assert(opposite(endianness) == std::endian::native); 296| 547| return reverse_bytes(typecast_copy(in)); 297| 547| } 298| 547| } 299| 547| }()); 300| 547|} _ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEjTkNSt3__117unsigned_integralEjEEDaT0_: 200| 547|constexpr auto wrap_strong_type_or_enum(T t) { 201| | if constexpr(std::is_enum_v) { 202| | return static_cast(t); 203| 547| } else { 204| 547| return Botan::wrap_strong_type(t); 205| 547| } 206| 547|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEjTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm4EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 547| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 547| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 547] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 547| } else { 289| 547| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| 547| } else { 295| 547| static_assert(opposite(endianness) == std::endian::native); 296| 547| return reverse_bytes(typecast_copy(in)); 297| 547| } 298| 547| } 299| 547| }()); _ZN5Botan8get_byteILm0EjEEhT0_QltT_stS1_: 81| 48|{ 82| 48| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 48| return static_cast((input >> shift) & 0xFF); 84| 48|} _ZN5Botan8get_byteILm1EjEEhT0_QltT_stS1_: 81| 13.8k|{ 82| 13.8k| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 13.8k| return static_cast((input >> shift) & 0xFF); 84| 13.8k|} _ZN5Botan8get_byteILm2EjEEhT0_QltT_stS1_: 81| 13.8k|{ 82| 13.8k| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 13.8k| return static_cast((input >> shift) & 0xFF); 84| 13.8k|} _ZN5Botan8get_byteILm3EjEEhT0_QltT_stS1_: 81| 13.8k|{ 82| 13.8k| const size_t shift = ((~B) & (sizeof(T) - 1)) << 3; 83| 13.8k| return static_cast((input >> shift) & 0xFF); 84| 13.8k|} _ZN5Botan8store_leINS_6detail10AutoDetectEJmEEEDaDpOT0_: 736| 113k|inline constexpr auto store_le(ParamTs&&... params) { 737| 113k| return detail::store_any(std::forward(params)...); 738| 113k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETpTkNS0_20unsigned_integralishEJmEQ10all_same_vIDpT1_EEEDaS6_: 696| 113k|inline constexpr auto store_any(Ts... ins) { 697| 113k| return store_any(std::array{ins...}); 698| 113k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayImLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_: 663| 113k|inline constexpr auto store_any(InR&& in_range) { 664| 113k| auto out = []([[maybe_unused]] const auto& in) { 665| 113k| if constexpr(std::same_as) { 666| 113k| if constexpr(ranges::statically_spanable_range) { 667| 113k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 113k| return std::array(); 669| 113k| } else { 670| 113k| static_assert( 671| 113k| !std::same_as, 672| 113k| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 113k| } 674| 113k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 113k| return OutR(std::span{in}.size_bytes()); 676| 113k| } else { 677| 113k| return OutR{}; 678| 113k| } 679| 113k| }(in_range); 680| | 681| 113k| store_any>(out, std::forward(in_range)); 682| 113k| return out; 683| 113k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayImLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSD_: 664| 113k| auto out = []([[maybe_unused]] const auto& in) { 665| 113k| if constexpr(std::same_as) { 666| 113k| if constexpr(ranges::statically_spanable_range) { 667| 113k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 113k| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 113k| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE57005EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm8EEETkNS4_14spanable_rangeENS6_ImLm1EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 113k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 113k| ranges::assert_equal_byte_lengths(out, in); 605| 113k| using element_type = std::ranges::range_value_t; 606| | 607| 113k| auto store_elementwise = [&] { 608| 113k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 113k| std::span out_s(out); 610| 113k| for(auto in_elem : in) { 611| 113k| store_any(out_s.template first(), in_elem); 612| 113k| out_s = out_s.subspan(bytes_per_element); 613| 113k| } 614| 113k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 113k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 113k] ------------------ 620| 0| store_elementwise(); 621| 113k| } else { 622| 113k| if constexpr(endianness == std::endian::native && !custom_storable) { 623| 113k| typecast_copy(out, in); 624| | } else { 625| | store_elementwise(); 626| | } 627| 113k| } 628| 113k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 64|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 64| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 64| using InT = decltype(in); 528| 64| ranges::assert_exact_byte_length(out_range); 529| 64| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 64| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 64] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 64| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| 64| } else if constexpr(endianness == std::endian::native) { 540| 64| typecast_copy(out, in); 541| | } else { 542| | static_assert(opposite(endianness) == std::endian::native); 543| | typecast_copy(out, reverse_bytes(in)); 544| | } 545| 64| } 546| 64|} _ZN5Botan12get_byte_varImEEhmT_: 69| 147k|inline constexpr uint8_t get_byte_var(size_t byte_num, T input) { 70| 147k| return static_cast(input >> (((~byte_num) & (sizeof(T) - 1)) << 3)); 71| 147k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEtQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_EEEvS6_Ph: 711| 13|inline constexpr void store_any(T in, uint8_t out[]) { 712| | // asserts that *out points to enough bytes to write into 713| 13| store_any(in, std::span(out, sizeof(T))); 714| 13|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEtTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm2EEEQsr3stdE7same_asIS4_T0_EEEvT1_OT2_: 646| 13|inline constexpr void store_any(T in, OutR&& out_range) { 647| 13| store_any(in, std::forward(out_range)); 648| 13|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEtTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm2EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 13|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 13| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 13| using InT = decltype(in); 528| 13| ranges::assert_exact_byte_length(out_range); 529| 13| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 13| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 13] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 13| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| | } else if constexpr(endianness == std::endian::native) { 540| | typecast_copy(out, in); 541| 13| } else { 542| 13| static_assert(opposite(endianness) == std::endian::native); 543| 13| typecast_copy(out, reverse_bytes(in)); 544| 13| } 545| 13| } 546| 13|} _ZN5Botan6detail26unwrap_strong_type_or_enumITkNS0_20unsigned_integralishEtEEDaT_: 190| 13|constexpr auto unwrap_strong_type_or_enum(InT t) { 191| | if constexpr(std::is_enum_v) { 192| | // TODO: C++23: use std::to_underlying(in) instead 193| | return static_cast>(t); 194| 13| } else { 195| 13| return Botan::unwrap_strong_type(t); 196| 13| } 197| 13|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEjQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_EEEvS6_Ph: 711| 11.2k|inline constexpr void store_any(T in, uint8_t out[]) { 712| | // asserts that *out points to enough bytes to write into 713| 11.2k| store_any(in, std::span(out, sizeof(T))); 714| 11.2k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEjTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm4EEEQsr3stdE7same_asIS4_T0_EEEvT1_OT2_: 646| 11.2k|inline constexpr void store_any(T in, OutR&& out_range) { 647| 11.2k| store_any(in, std::forward(out_range)); 648| 11.2k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEjTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm4EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 564k|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 564k| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 564k| using InT = decltype(in); 528| 564k| ranges::assert_exact_byte_length(out_range); 529| 564k| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 564k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 564k] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 564k| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| | } else if constexpr(endianness == std::endian::native) { 540| | typecast_copy(out, in); 541| 564k| } else { 542| 564k| static_assert(opposite(endianness) == std::endian::native); 543| 564k| typecast_copy(out, reverse_bytes(in)); 544| 564k| } 545| 564k| } 546| 564k|} _ZN5Botan6detail26unwrap_strong_type_or_enumITkNS0_20unsigned_integralishEjEEDaT_: 190| 564k|constexpr auto unwrap_strong_type_or_enum(InT t) { 191| | if constexpr(std::is_enum_v) { 192| | // TODO: C++23: use std::to_underlying(in) instead 193| | return static_cast>(t); 194| 564k| } else { 195| 564k| return Botan::unwrap_strong_type(t); 196| 564k| } 197| 564k|} _ZN5Botan7load_beImJPKhiEEEDaDpOT0_: 504| 14|inline constexpr auto load_be(ParamTs&&... params) { 505| 14| return detail::load_any(std::forward(params)...); 506| 14|} _ZN5Botan7load_beImJRA32_mRPKhRmEEEDaDpOT0_: 504| 761|inline constexpr auto load_be(ParamTs&&... params) { 505| 761| return detail::load_any(std::forward(params)...); 506| 761|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206EmTkNS0_20unsigned_integralishEmQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asIT1_S5_EEEvPS6_PKhm: 483| 761|inline constexpr void load_any(T out[], const uint8_t in[], size_t count) { 484| | // asserts that *in and *out point to the correct amount of memory 485| 761| load_any(std::span(out, count), std::span(in, count * sizeof(T))); 486| 761|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeENS2_4spanImLm18446744073709551615EEETkNS4_16contiguous_rangeIhEENS5_IKhLm18446744073709551615EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISH_EESI_E4type10value_typeEEoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISP_SN_EEEvOSE_RKT2_: 355| 761|inline constexpr void load_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 356| 761| ranges::assert_equal_byte_lengths(out, in); 357| 761| using element_type = std::ranges::range_value_t; 358| | 359| 761| auto load_elementwise = [&] { 360| 761| constexpr size_t bytes_per_element = sizeof(element_type); 361| 761| std::span in_s(in); 362| 761| for(auto& out_elem : out) { 363| 761| out_elem = load_any(in_s.template first()); 364| 761| in_s = in_s.subspan(bytes_per_element); 365| 761| } 366| 761| }; 367| | 368| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 369| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 370| | // in a `constexpr` context. 371| 761| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (371:7): [Folded, False: 761] ------------------ 372| 0| load_elementwise(); 373| 761| } else { 374| | if constexpr(endianness == std::endian::native && !custom_loadable) { 375| | typecast_copy(out, in); 376| 761| } else { 377| 761| load_elementwise(); 378| 761| } 379| 761| } 380| 761|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeENS2_4spanImLm18446744073709551615EEETkNS4_16contiguous_rangeIhEENS5_IKhLm18446744073709551615EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISH_EESI_E4type10value_typeEEoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISP_SN_EEEvOSE_RKT2_ENKUlvE_clEv: 359| 761| auto load_elementwise = [&] { 360| 761| constexpr size_t bytes_per_element = sizeof(element_type); 361| 761| std::span in_s(in); 362| 17.1k| for(auto& out_elem : out) { ------------------ | Branch (362:26): [True: 17.1k, False: 761] ------------------ 363| 17.1k| out_elem = load_any(in_s.template first()); 364| 17.1k| in_s = in_s.subspan(bytes_per_element); 365| 17.1k| } 366| 761| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJPhRmEEEDaDpOT0_: 745| 17.1k|inline constexpr auto store_be(ParamTs&&... params) { 746| 17.1k| return detail::store_any(std::forward(params)...); 747| 17.1k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEmTpTkNS0_20unsigned_integralishEJEQaaoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_E10all_same_vIS6_DpT2_EEEvPhS6_S8_: 723| 17.1k|inline constexpr void store_any(uint8_t out[], T0 in0, Ts... ins) { 724| 17.1k| constexpr auto bytes = sizeof(in0) + (sizeof(ins) + ... + 0); 725| | // asserts that *out points to the correct amount of memory 726| 17.1k| store_any(std::span(out, bytes), in0, ins...); 727| 17.1k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEETpTkNS0_20unsigned_integralishEJmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_: 582| 320k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, Ts... ins) { 583| 320k| ranges::assert_exact_byte_length<(sizeof(Ts) + ...)>(out); 584| 320k| auto store_one = [off = 0](auto o, T i) mutable { 585| 320k| store_any(i, o.subspan(off).template first()); 586| 320k| off += sizeof(T); 587| 320k| }; 588| | 589| 320k| (store_one(std::span{out}, ins), ...); 590| 320k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEETpTkNS0_20unsigned_integralishEJmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_ENUlTyS9_T_E_clImS7_EEDaS9_SE_: 584| 320k| auto store_one = [off = 0](auto o, T i) mutable { 585| 320k| store_any(i, o.subspan(off).template first()); 586| 320k| off += sizeof(T); 587| 320k| }; _ZN5Botan7load_leImJPKhiEEEDaDpOT0_: 495| 64|inline constexpr auto load_le(ParamTs&&... params) { 496| 64| return detail::load_any(std::forward(params)...); 497| 64|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmEET0_PKhm: 454| 80|inline constexpr OutT load_any(const uint8_t in[], size_t off) { 455| | // asserts that *in points to enough bytes to read at offset off 456| 80| constexpr size_t out_size = sizeof(OutT); 457| 80| return load_any(std::span(in + off * out_size, out_size)); 458| 80|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 80|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 80| using OutT = detail::wrapped_type; 280| 80| ranges::assert_exact_byte_length(in_range); 281| | 282| 80| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 80| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 80| return fallback_load_any(std::forward(in_range)); 288| 80| } else { 289| 80| const std::span in{in_range}; 290| 80| if constexpr(sizeof(OutT) == 1) { 291| 80| return static_cast(in[0]); 292| 80| } else if constexpr(endianness == std::endian::native) { 293| 80| return typecast_copy(in); 294| 80| } else { 295| 80| static_assert(opposite(endianness) == std::endian::native); 296| 80| return reverse_bytes(typecast_copy(in)); 297| 80| } 298| 80| } 299| 80| }()); 300| 80|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 80| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 80| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 80] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 80| } else { 289| 80| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| 80| } else if constexpr(endianness == std::endian::native) { 293| 80| return typecast_copy(in); 294| | } else { 295| | static_assert(opposite(endianness) == std::endian::native); 296| | return reverse_bytes(typecast_copy(in)); 297| | } 298| 80| } 299| 80| }()); _ZN5Botan7load_leImJRPKhiEEEDaDpOT0_: 495| 16|inline constexpr auto load_le(ParamTs&&... params) { 496| 16| return detail::load_any(std::forward(params)...); 497| 16|} _ZN5Botan7load_beIjJPKhiEEEDaDpOT0_: 504| 24|inline constexpr auto load_be(ParamTs&&... params) { 505| 24| return detail::load_any(std::forward(params)...); 506| 24|} _ZN5Botan12get_byte_varIjEEhmT_: 69| 30|inline constexpr uint8_t get_byte_var(size_t byte_num, T input) { 70| 30| return static_cast(input >> (((~byte_num) & (sizeof(T) - 1)) << 3)); 71| 30|} _ZN5Botan11copy_out_beITkNS_6ranges14spanable_rangeENSt3__16vectorIjNS_16secure_allocatorIjEEEEEEvNS2_4spanIhLm18446744073709551615EEERKT_: 773| 78.5k|inline void copy_out_be(std::span out, const InR& in) { 774| 78.5k| using T = std::ranges::range_value_t; 775| 78.5k| std::span in_s{in}; 776| 78.5k| const auto remaining_bytes = detail::copy_out_any_word_aligned_portion(out, in_s); 777| | 778| | // copy remaining bytes as a partial word 779| 78.5k| for(size_t i = 0; i < remaining_bytes; ++i) { ------------------ | Branch (779:22): [True: 0, False: 78.5k] ------------------ 780| 0| out[i] = get_byte_var(i, in_s.front()); 781| 0| } 782| 78.5k|} _ZN5Botan6detail33copy_out_any_word_aligned_portionILNSt3__16endianE64206ETkNS0_20unsigned_integralishEjEEmRNS2_4spanIhLm18446744073709551615EEERNS4_IKT0_Lm18446744073709551615EEE: 752| 78.5k|inline size_t copy_out_any_word_aligned_portion(std::span& out, std::span& in) { 753| 78.5k| const size_t full_words = out.size() / sizeof(T); 754| 78.5k| const size_t full_word_bytes = full_words * sizeof(T); 755| 78.5k| const size_t remaining_bytes = out.size() - full_word_bytes; 756| 78.5k| BOTAN_ASSERT_NOMSG(in.size_bytes() >= full_word_bytes + remaining_bytes); ------------------ | | 77| 78.5k| do { \ | | 78| 78.5k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 78.5k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 78.5k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 78.5k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 78.5k] | | ------------------ ------------------ 757| | 758| | // copy full words 759| 78.5k| store_any(out.first(full_word_bytes), in.first(full_words)); 760| 78.5k| out = out.subspan(full_word_bytes); 761| 78.5k| in = in.subspan(full_words); 762| | 763| 78.5k| return remaining_bytes; 764| 78.5k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206EjTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm18446744073709551615EEETkNS4_14spanable_rangeENS6_IKjLm18446744073709551615EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 78.5k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 78.5k| ranges::assert_equal_byte_lengths(out, in); 605| 78.5k| using element_type = std::ranges::range_value_t; 606| | 607| 78.5k| auto store_elementwise = [&] { 608| 78.5k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 78.5k| std::span out_s(out); 610| 78.5k| for(auto in_elem : in) { 611| 78.5k| store_any(out_s.template first(), in_elem); 612| 78.5k| out_s = out_s.subspan(bytes_per_element); 613| 78.5k| } 614| 78.5k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 78.5k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 78.5k] ------------------ 620| 0| store_elementwise(); 621| 78.5k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 78.5k| } else { 625| 78.5k| store_elementwise(); 626| 78.5k| } 627| 78.5k| } 628| 78.5k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EjTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm18446744073709551615EEETkNS4_14spanable_rangeENS6_IKjLm18446744073709551615EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 78.5k| auto store_elementwise = [&] { 608| 78.5k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 78.5k| std::span out_s(out); 610| 552k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 552k, False: 78.5k] ------------------ 611| 552k| store_any(out_s.template first(), in_elem); 612| 552k| out_s = out_s.subspan(bytes_per_element); 613| 552k| } 614| 78.5k| }; _ZN5Botan6detail9store_anyILNSt3__16endianE64206EjTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm4EEETpTkNS0_20unsigned_integralishEJjEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_: 582| 552k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, Ts... ins) { 583| 552k| ranges::assert_exact_byte_length<(sizeof(Ts) + ...)>(out); 584| 552k| auto store_one = [off = 0](auto o, T i) mutable { 585| 552k| store_any(i, o.subspan(off).template first()); 586| 552k| off += sizeof(T); 587| 552k| }; 588| | 589| 552k| (store_one(std::span{out}, ins), ...); 590| 552k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EjTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm4EEETpTkNS0_20unsigned_integralishEJjEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_ENUlTyS9_T_E_clIjS7_EEDaS9_SE_: 584| 552k| auto store_one = [off = 0](auto o, T i) mutable { 585| 552k| store_any(i, o.subspan(off).template first()); 586| 552k| off += sizeof(T); 587| 552k| }; _ZN5Botan11copy_out_beITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEEEvNS2_4spanIhLm18446744073709551615EEERKT_: 773| 6.73k|inline void copy_out_be(std::span out, const InR& in) { 774| 6.73k| using T = std::ranges::range_value_t; 775| 6.73k| std::span in_s{in}; 776| 6.73k| const auto remaining_bytes = detail::copy_out_any_word_aligned_portion(out, in_s); 777| | 778| | // copy remaining bytes as a partial word 779| 6.73k| for(size_t i = 0; i < remaining_bytes; ++i) { ------------------ | Branch (779:22): [True: 0, False: 6.73k] ------------------ 780| 0| out[i] = get_byte_var(i, in_s.front()); 781| 0| } 782| 6.73k|} _ZN5Botan6detail33copy_out_any_word_aligned_portionILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmEEmRNS2_4spanIhLm18446744073709551615EEERNS4_IKT0_Lm18446744073709551615EEE: 752| 7.43k|inline size_t copy_out_any_word_aligned_portion(std::span& out, std::span& in) { 753| 7.43k| const size_t full_words = out.size() / sizeof(T); 754| 7.43k| const size_t full_word_bytes = full_words * sizeof(T); 755| 7.43k| const size_t remaining_bytes = out.size() - full_word_bytes; 756| 7.43k| BOTAN_ASSERT_NOMSG(in.size_bytes() >= full_word_bytes + remaining_bytes); ------------------ | | 77| 7.43k| do { \ | | 78| 7.43k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 7.43k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 7.43k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 7.43k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 7.43k] | | ------------------ ------------------ 757| | 758| | // copy full words 759| 7.43k| store_any(out.first(full_word_bytes), in.first(full_words)); 760| 7.43k| out = out.subspan(full_word_bytes); 761| 7.43k| in = in.subspan(full_words); 762| | 763| 7.43k| return remaining_bytes; 764| 7.43k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm18446744073709551615EEETkNS4_14spanable_rangeENS6_IKmLm18446744073709551615EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 7.43k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 7.43k| ranges::assert_equal_byte_lengths(out, in); 605| 7.43k| using element_type = std::ranges::range_value_t; 606| | 607| 7.43k| auto store_elementwise = [&] { 608| 7.43k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 7.43k| std::span out_s(out); 610| 7.43k| for(auto in_elem : in) { 611| 7.43k| store_any(out_s.template first(), in_elem); 612| 7.43k| out_s = out_s.subspan(bytes_per_element); 613| 7.43k| } 614| 7.43k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 7.43k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 7.43k] ------------------ 620| 0| store_elementwise(); 621| 7.43k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 7.43k| } else { 625| 7.43k| store_elementwise(); 626| 7.43k| } 627| 7.43k| } 628| 7.43k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm18446744073709551615EEETkNS4_14spanable_rangeENS6_IKmLm18446744073709551615EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 7.43k| auto store_elementwise = [&] { 608| 7.43k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 7.43k| std::span out_s(out); 610| 41.8k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 41.8k, False: 7.43k] ------------------ 611| 41.8k| store_any(out_s.template first(), in_elem); 612| 41.8k| out_s = out_s.subspan(bytes_per_element); 613| 41.8k| } 614| 7.43k| }; _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS0_20unsigned_integralishEmQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_EEEvPS6_PKhm: 483| 4.25k|inline constexpr void load_any(T out[], const uint8_t in[], size_t count) { 484| | // asserts that *in and *out point to the correct amount of memory 485| 4.25k| load_any(std::span(out, count), std::span(in, count * sizeof(T))); 486| 4.25k|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeENS2_4spanImLm18446744073709551615EEETkNS5_16contiguous_rangeIhEENS6_IKhLm18446744073709551615EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISP_SO_EEEvOSF_RKT2_: 355| 4.25k|inline constexpr void load_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 356| 4.25k| ranges::assert_equal_byte_lengths(out, in); 357| 4.25k| using element_type = std::ranges::range_value_t; 358| | 359| 4.25k| auto load_elementwise = [&] { 360| 4.25k| constexpr size_t bytes_per_element = sizeof(element_type); 361| 4.25k| std::span in_s(in); 362| 4.25k| for(auto& out_elem : out) { 363| 4.25k| out_elem = load_any(in_s.template first()); 364| 4.25k| in_s = in_s.subspan(bytes_per_element); 365| 4.25k| } 366| 4.25k| }; 367| | 368| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 369| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 370| | // in a `constexpr` context. 371| 4.25k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (371:7): [Folded, False: 4.25k] ------------------ 372| 0| load_elementwise(); 373| 4.25k| } else { 374| 4.25k| if constexpr(endianness == std::endian::native && !custom_loadable) { 375| 4.25k| typecast_copy(out, in); 376| | } else { 377| | load_elementwise(); 378| | } 379| 4.25k| } 380| 4.25k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEmQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_EEEvPS6_PKhm: 483| 704|inline constexpr void load_any(T out[], const uint8_t in[], size_t count) { 484| | // asserts that *in and *out point to the correct amount of memory 485| 704| load_any(std::span(out, count), std::span(in, count * sizeof(T))); 486| 704|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeENS2_4spanImLm18446744073709551615EEETkNS5_16contiguous_rangeIhEENS6_IKhLm18446744073709551615EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISP_SO_EEEvOSF_RKT2_: 355| 704|inline constexpr void load_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 356| 704| ranges::assert_equal_byte_lengths(out, in); 357| 704| using element_type = std::ranges::range_value_t; 358| | 359| 704| auto load_elementwise = [&] { 360| 704| constexpr size_t bytes_per_element = sizeof(element_type); 361| 704| std::span in_s(in); 362| 704| for(auto& out_elem : out) { 363| 704| out_elem = load_any(in_s.template first()); 364| 704| in_s = in_s.subspan(bytes_per_element); 365| 704| } 366| 704| }; 367| | 368| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 369| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 370| | // in a `constexpr` context. 371| 704| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (371:7): [Folded, False: 704] ------------------ 372| 0| load_elementwise(); 373| 704| } else { 374| | if constexpr(endianness == std::endian::native && !custom_loadable) { 375| | typecast_copy(out, in); 376| 704| } else { 377| 704| load_elementwise(); 378| 704| } 379| 704| } 380| 704|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeENS2_4spanImLm18446744073709551615EEETkNS5_16contiguous_rangeIhEENS6_IKhLm18446744073709551615EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISP_SO_EEEvOSF_RKT2_ENKUlvE_clEv: 359| 704| auto load_elementwise = [&] { 360| 704| constexpr size_t bytes_per_element = sizeof(element_type); 361| 704| std::span in_s(in); 362| 1.40k| for(auto& out_elem : out) { ------------------ | Branch (362:26): [True: 1.40k, False: 704] ------------------ 363| 1.40k| out_elem = load_any(in_s.template first()); 364| 1.40k| in_s = in_s.subspan(bytes_per_element); 365| 1.40k| } 366| 704| }; _ZN5Botan7load_beImJNSt3__14spanIKhLm8EEEEEEDaDpOT0_: 504| 152k|inline constexpr auto load_be(ParamTs&&... params) { 505| 152k| return detail::load_any(std::forward(params)...); 506| 152k|} _ZN5Botan7load_beImJRNSt3__15arrayIhLm8EEEEEEDaDpOT0_: 504| 27.0k|inline constexpr auto load_be(ParamTs&&... params) { 505| 27.0k| return detail::load_any(std::forward(params)...); 506| 27.0k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 27.0k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 27.0k| using OutT = detail::wrapped_type; 280| 27.0k| ranges::assert_exact_byte_length(in_range); 281| | 282| 27.0k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 27.0k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 27.0k| return fallback_load_any(std::forward(in_range)); 288| 27.0k| } else { 289| 27.0k| const std::span in{in_range}; 290| 27.0k| if constexpr(sizeof(OutT) == 1) { 291| 27.0k| return static_cast(in[0]); 292| 27.0k| } else if constexpr(endianness == std::endian::native) { 293| 27.0k| return typecast_copy(in); 294| 27.0k| } else { 295| 27.0k| static_assert(opposite(endianness) == std::endian::native); 296| 27.0k| return reverse_bytes(typecast_copy(in)); 297| 27.0k| } 298| 27.0k| } 299| 27.0k| }()); 300| 27.0k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 27.0k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 27.0k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 27.0k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 27.0k| } else { 289| 27.0k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| 27.0k| } else { 295| 27.0k| static_assert(opposite(endianness) == std::endian::native); 296| 27.0k| return reverse_bytes(typecast_copy(in)); 297| 27.0k| } 298| 27.0k| } 299| 27.0k| }()); _ZN5Botan8store_beINS_6detail10AutoDetectEJRmPhEEEDaDpOT0_: 745| 597|inline constexpr auto store_be(ParamTs&&... params) { 746| 597| return detail::store_any(std::forward(params)...); 747| 597|} _ZN5Botan8store_beINS_6detail10AutoDetectEJRKjPhEEEDaDpOT0_: 745| 10.5k|inline constexpr auto store_be(ParamTs&&... params) { 746| 10.5k| return detail::store_any(std::forward(params)...); 747| 10.5k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJjPhEEEDaDpOT0_: 745| 736|inline constexpr auto store_be(ParamTs&&... params) { 746| 736| return detail::store_any(std::forward(params)...); 747| 736|} _ZN5Botan7load_leIjJPjPKhmEEEDaDpOT0_: 495| 2|inline constexpr auto load_le(ParamTs&&... params) { 496| 2| return detail::load_any(std::forward(params)...); 497| 2|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005EjTkNS0_20unsigned_integralishEjQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asIT1_S5_EEEvPS6_PKhm: 483| 2|inline constexpr void load_any(T out[], const uint8_t in[], size_t count) { 484| | // asserts that *in and *out point to the correct amount of memory 485| 2| load_any(std::span(out, count), std::span(in, count * sizeof(T))); 486| 2|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005EjTkNS_6ranges23contiguous_output_rangeENS2_4spanIjLm18446744073709551615EEETkNS4_16contiguous_rangeIhEENS5_IKhLm18446744073709551615EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISH_EESI_E4type10value_typeEEoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISP_SN_EEEvOSE_RKT2_: 355| 2|inline constexpr void load_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 356| 2| ranges::assert_equal_byte_lengths(out, in); 357| 2| using element_type = std::ranges::range_value_t; 358| | 359| 2| auto load_elementwise = [&] { 360| 2| constexpr size_t bytes_per_element = sizeof(element_type); 361| 2| std::span in_s(in); 362| 2| for(auto& out_elem : out) { 363| 2| out_elem = load_any(in_s.template first()); 364| 2| in_s = in_s.subspan(bytes_per_element); 365| 2| } 366| 2| }; 367| | 368| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 369| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 370| | // in a `constexpr` context. 371| 2| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (371:7): [Folded, False: 2] ------------------ 372| 0| load_elementwise(); 373| 2| } else { 374| 2| if constexpr(endianness == std::endian::native && !custom_loadable) { 375| 2| typecast_copy(out, in); 376| | } else { 377| | load_elementwise(); 378| | } 379| 2| } 380| 2|} _ZN5Botan7load_beIjJPhiEEEDaDpOT0_: 504| 383|inline constexpr auto load_be(ParamTs&&... params) { 505| 383| return detail::load_any(std::forward(params)...); 506| 383|} _ZN5Botan7load_beImJPhiEEEDaDpOT0_: 504| 1.57k|inline constexpr auto load_be(ParamTs&&... params) { 505| 1.57k| return detail::load_any(std::forward(params)...); 506| 1.57k|} _ZN5Botan7load_beIhJPKhRmEEEDaDpOT0_: 504| 1.63M|inline constexpr auto load_be(ParamTs&&... params) { 505| 1.63M| return detail::load_any(std::forward(params)...); 506| 1.63M|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEhEET0_PKhm: 454| 1.63M|inline constexpr OutT load_any(const uint8_t in[], size_t off) { 455| | // asserts that *in points to enough bytes to read at offset off 456| 1.63M| constexpr size_t out_size = sizeof(OutT); 457| 1.63M| return load_any(std::span(in + off * out_size, out_size)); 458| 1.63M|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEhTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm1EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 1.63M|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 1.63M| using OutT = detail::wrapped_type; 280| 1.63M| ranges::assert_exact_byte_length(in_range); 281| | 282| 1.63M| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 1.63M| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 1.63M| return fallback_load_any(std::forward(in_range)); 288| 1.63M| } else { 289| 1.63M| const std::span in{in_range}; 290| 1.63M| if constexpr(sizeof(OutT) == 1) { 291| 1.63M| return static_cast(in[0]); 292| 1.63M| } else if constexpr(endianness == std::endian::native) { 293| 1.63M| return typecast_copy(in); 294| 1.63M| } else { 295| 1.63M| static_assert(opposite(endianness) == std::endian::native); 296| 1.63M| return reverse_bytes(typecast_copy(in)); 297| 1.63M| } 298| 1.63M| } 299| 1.63M| }()); 300| 1.63M|} _ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEhTkNSt3__117unsigned_integralEhEEDaT0_: 200| 1.63M|constexpr auto wrap_strong_type_or_enum(T t) { 201| | if constexpr(std::is_enum_v) { 202| | return static_cast(t); 203| 1.63M| } else { 204| 1.63M| return Botan::wrap_strong_type(t); 205| 1.63M| } 206| 1.63M|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEhTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm1EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 1.63M| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 1.63M| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 1.63M] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 1.63M| } else { 289| 1.63M| const std::span in{in_range}; 290| 1.63M| if constexpr(sizeof(OutT) == 1) { 291| 1.63M| return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| | } else { 295| | static_assert(opposite(endianness) == std::endian::native); 296| | return reverse_bytes(typecast_copy(in)); 297| | } 298| 1.63M| } 299| 1.63M| }()); _ZN5Botan12get_byte_varIhEEhmT_: 69| 462k|inline constexpr uint8_t get_byte_var(size_t byte_num, T input) { 70| 462k| return static_cast(input >> (((~byte_num) & (sizeof(T) - 1)) << 3)); 71| 462k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJRKmRKNSt3__14spanIhLm18446744073709551615EEEEEEDaDpOT0_: 745| 2.76k|inline constexpr auto store_be(ParamTs&&... params) { 746| 2.76k| return detail::store_any(std::forward(params)...); 747| 2.76k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEERKNS2_4spanIhLm18446744073709551615EEEQsr3stdE7same_asIS4_T0_EEEvT1_OT2_: 646| 2.76k|inline constexpr void store_any(T in, OutR&& out_range) { 647| 2.76k| store_any(in, std::forward(out_range)); 648| 2.76k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEERKNS2_4spanIhLm18446744073709551615EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvSB_OT1_: 525| 2.76k|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 2.76k| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 2.76k| using InT = decltype(in); 528| 2.76k| ranges::assert_exact_byte_length(out_range); 529| 2.76k| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 2.76k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 2.76k] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 2.76k| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| | } else if constexpr(endianness == std::endian::native) { 540| | typecast_copy(out, in); 541| 2.76k| } else { 542| 2.76k| static_assert(opposite(endianness) == std::endian::native); 543| 2.76k| typecast_copy(out, reverse_bytes(in)); 544| 2.76k| } 545| 2.76k| } 546| 2.76k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJmmEEEDaDpOT0_: 745| 109|inline constexpr auto store_be(ParamTs&&... params) { 746| 109| return detail::store_any(std::forward(params)...); 747| 109|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETpTkNS0_20unsigned_integralishEJmmEQ10all_same_vIDpT1_EEEDaS6_: 696| 109|inline constexpr auto store_any(Ts... ins) { 697| 109| return store_any(std::array{ins...}); 698| 109|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayImLm2EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_: 663| 109|inline constexpr auto store_any(InR&& in_range) { 664| 109| auto out = []([[maybe_unused]] const auto& in) { 665| 109| if constexpr(std::same_as) { 666| 109| if constexpr(ranges::statically_spanable_range) { 667| 109| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 109| return std::array(); 669| 109| } else { 670| 109| static_assert( 671| 109| !std::same_as, 672| 109| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 109| } 674| 109| } else if constexpr(concepts::resizable_byte_buffer) { 675| 109| return OutR(std::span{in}.size_bytes()); 676| 109| } else { 677| 109| return OutR{}; 678| 109| } 679| 109| }(in_range); 680| | 681| 109| store_any>(out, std::forward(in_range)); 682| 109| return out; 683| 109|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayImLm2EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSD_: 664| 109| auto out = []([[maybe_unused]] const auto& in) { 665| 109| if constexpr(std::same_as) { 666| 109| if constexpr(ranges::statically_spanable_range) { 667| 109| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 109| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 109| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm16EEETkNS4_14spanable_rangeENS6_ImLm2EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 109|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 109| ranges::assert_equal_byte_lengths(out, in); 605| 109| using element_type = std::ranges::range_value_t; 606| | 607| 109| auto store_elementwise = [&] { 608| 109| constexpr size_t bytes_per_element = sizeof(element_type); 609| 109| std::span out_s(out); 610| 109| for(auto in_elem : in) { 611| 109| store_any(out_s.template first(), in_elem); 612| 109| out_s = out_s.subspan(bytes_per_element); 613| 109| } 614| 109| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 109| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 109] ------------------ 620| 0| store_elementwise(); 621| 109| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 109| } else { 625| 109| store_elementwise(); 626| 109| } 627| 109| } 628| 109|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm16EEETkNS4_14spanable_rangeENS6_ImLm2EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 109| auto store_elementwise = [&] { 608| 109| constexpr size_t bytes_per_element = sizeof(element_type); 609| 109| std::span out_s(out); 610| 218| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 218, False: 109] ------------------ 611| 218| store_any(out_s.template first(), in_elem); 612| 218| out_s = out_s.subspan(bytes_per_element); 613| 218| } 614| 109| }; _ZN5Botan7load_beINS_6detail10AutoDetectEJRA2_mRPKhmEEEDaDpOT0_: 504| 704|inline constexpr auto load_be(ParamTs&&... params) { 505| 704| return detail::load_any(std::forward(params)...); 506| 704|} _ZN5Botan11copy_out_beITkNS_6ranges14spanable_rangeEA2_mEEvNSt3__14spanIhLm18446744073709551615EEERKT_: 773| 704|inline void copy_out_be(std::span out, const InR& in) { 774| 704| using T = std::ranges::range_value_t; 775| 704| std::span in_s{in}; 776| 704| const auto remaining_bytes = detail::copy_out_any_word_aligned_portion(out, in_s); 777| | 778| | // copy remaining bytes as a partial word 779| 704| for(size_t i = 0; i < remaining_bytes; ++i) { ------------------ | Branch (779:22): [True: 0, False: 704] ------------------ 780| 0| out[i] = get_byte_var(i, in_s.front()); 781| 0| } 782| 704|} _ZN5Botan7load_leINS_6detail10AutoDetectEJRA4_mRA8_hRKmEEEDaDpOT0_: 495| 1.86k|inline constexpr auto load_le(ParamTs&&... params) { 496| 1.86k| return detail::load_any(std::forward(params)...); 497| 1.86k|} _ZN5Botan8store_beINSt3__16vectorIhNS1_9allocatorIhEEEEJRA8_mEEEDaDpOT0_: 745| 1.86k|inline constexpr auto store_be(ParamTs&&... params) { 746| 1.86k| return detail::store_any(std::forward(params)...); 747| 1.86k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS2_6vectorIhNS2_9allocatorIhEEEETkNS_6ranges14spanable_rangeERA8_mQoooosr3stdE7same_asINS0_10AutoDetectET0_Eaasr6rangesE25statically_spanable_rangeISC_Esr3stdE21default_initializableISC_Esr8conceptsE21resizable_byte_bufferISC_EEEDaOT1_: 663| 1.86k|inline constexpr auto store_any(InR&& in_range) { 664| 1.86k| auto out = []([[maybe_unused]] const auto& in) { 665| 1.86k| if constexpr(std::same_as) { 666| 1.86k| if constexpr(ranges::statically_spanable_range) { 667| 1.86k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 1.86k| return std::array(); 669| 1.86k| } else { 670| 1.86k| static_assert( 671| 1.86k| !std::same_as, 672| 1.86k| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 1.86k| } 674| 1.86k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 1.86k| return OutR(std::span{in}.size_bytes()); 676| 1.86k| } else { 677| 1.86k| return OutR{}; 678| 1.86k| } 679| 1.86k| }(in_range); 680| | 681| 1.86k| store_any>(out, std::forward(in_range)); 682| 1.86k| return out; 683| 1.86k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS2_6vectorIhNS2_9allocatorIhEEEETkNS_6ranges14spanable_rangeERA8_mQoooosr3stdE7same_asINS0_10AutoDetectET0_Eaasr6rangesE25statically_spanable_rangeISC_Esr3stdE21default_initializableISC_Esr8conceptsE21resizable_byte_bufferISC_EEEDaOT1_ENKUlRKT_E_clIS9_EEDaSH_: 664| 1.86k| auto out = []([[maybe_unused]] const auto& in) { 665| | if constexpr(std::same_as) { 666| | if constexpr(ranges::statically_spanable_range) { 667| | constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| | return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| 1.86k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 1.86k| return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 1.86k| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_6vectorIhNS2_9allocatorIhEEEETkNS4_14spanable_rangeEA8_mQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISD_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISL_EESM_E4type10value_typeEEEEvOT1_RKSI_: 603| 1.86k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 1.86k| ranges::assert_equal_byte_lengths(out, in); 605| 1.86k| using element_type = std::ranges::range_value_t; 606| | 607| 1.86k| auto store_elementwise = [&] { 608| 1.86k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.86k| std::span out_s(out); 610| 1.86k| for(auto in_elem : in) { 611| 1.86k| store_any(out_s.template first(), in_elem); 612| 1.86k| out_s = out_s.subspan(bytes_per_element); 613| 1.86k| } 614| 1.86k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 1.86k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 1.86k] ------------------ 620| 0| store_elementwise(); 621| 1.86k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 1.86k| } else { 625| 1.86k| store_elementwise(); 626| 1.86k| } 627| 1.86k| } 628| 1.86k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_6vectorIhNS2_9allocatorIhEEEETkNS4_14spanable_rangeEA8_mQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISD_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISL_EESM_E4type10value_typeEEEEvOT1_RKSI_ENKUlvE_clEv: 607| 1.86k| auto store_elementwise = [&] { 608| 1.86k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.86k| std::span out_s(out); 610| 14.9k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 14.9k, False: 1.86k] ------------------ 611| 14.9k| store_any(out_s.template first(), in_elem); 612| 14.9k| out_s = out_s.subspan(bytes_per_element); 613| 14.9k| } 614| 1.86k| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm32EEERNS3_5arrayImLm4EEEEEEDaDpOT0_: 745| 28.7k|inline constexpr auto store_be(ParamTs&&... params) { 746| 28.7k| return detail::store_any(std::forward(params)...); 747| 28.7k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm32EEETkNS5_14spanable_rangeENS2_5arrayImLm4EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 28.7k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 28.7k| ranges::assert_equal_byte_lengths(out, in); 605| 28.7k| using element_type = std::ranges::range_value_t; 606| | 607| 28.7k| auto store_elementwise = [&] { 608| 28.7k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 28.7k| std::span out_s(out); 610| 28.7k| for(auto in_elem : in) { 611| 28.7k| store_any(out_s.template first(), in_elem); 612| 28.7k| out_s = out_s.subspan(bytes_per_element); 613| 28.7k| } 614| 28.7k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 28.7k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 28.7k] ------------------ 620| 0| store_elementwise(); 621| 28.7k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 28.7k| } else { 625| 28.7k| store_elementwise(); 626| 28.7k| } 627| 28.7k| } 628| 28.7k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm32EEETkNS5_14spanable_rangeENS2_5arrayImLm4EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 28.7k| auto store_elementwise = [&] { 608| 28.7k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 28.7k| std::span out_s(out); 610| 115k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 115k, False: 28.7k] ------------------ 611| 115k| store_any(out_s.template first(), in_elem); 612| 115k| out_s = out_s.subspan(bytes_per_element); 613| 115k| } 614| 28.7k| }; _ZN5Botan7load_beImJPKhmEEEDaDpOT0_: 504| 255k|inline constexpr auto load_be(ParamTs&&... params) { 505| 255k| return detail::load_any(std::forward(params)...); 506| 255k|} _ZN5Botan7load_leINS_6detail10AutoDetectEJRA6_mRA8_hRKmEEEDaDpOT0_: 495| 949|inline constexpr auto load_le(ParamTs&&... params) { 496| 949| return detail::load_any(std::forward(params)...); 497| 949|} _ZN5Botan8store_beINSt3__16vectorIhNS1_9allocatorIhEEEEJRA12_mEEEDaDpOT0_: 745| 949|inline constexpr auto store_be(ParamTs&&... params) { 746| 949| return detail::store_any(std::forward(params)...); 747| 949|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS2_6vectorIhNS2_9allocatorIhEEEETkNS_6ranges14spanable_rangeERA12_mQoooosr3stdE7same_asINS0_10AutoDetectET0_Eaasr6rangesE25statically_spanable_rangeISC_Esr3stdE21default_initializableISC_Esr8conceptsE21resizable_byte_bufferISC_EEEDaOT1_: 663| 949|inline constexpr auto store_any(InR&& in_range) { 664| 949| auto out = []([[maybe_unused]] const auto& in) { 665| 949| if constexpr(std::same_as) { 666| 949| if constexpr(ranges::statically_spanable_range) { 667| 949| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 949| return std::array(); 669| 949| } else { 670| 949| static_assert( 671| 949| !std::same_as, 672| 949| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 949| } 674| 949| } else if constexpr(concepts::resizable_byte_buffer) { 675| 949| return OutR(std::span{in}.size_bytes()); 676| 949| } else { 677| 949| return OutR{}; 678| 949| } 679| 949| }(in_range); 680| | 681| 949| store_any>(out, std::forward(in_range)); 682| 949| return out; 683| 949|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS2_6vectorIhNS2_9allocatorIhEEEETkNS_6ranges14spanable_rangeERA12_mQoooosr3stdE7same_asINS0_10AutoDetectET0_Eaasr6rangesE25statically_spanable_rangeISC_Esr3stdE21default_initializableISC_Esr8conceptsE21resizable_byte_bufferISC_EEEDaOT1_ENKUlRKT_E_clIS9_EEDaSH_: 664| 949| auto out = []([[maybe_unused]] const auto& in) { 665| | if constexpr(std::same_as) { 666| | if constexpr(ranges::statically_spanable_range) { 667| | constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| | return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| 949| } else if constexpr(concepts::resizable_byte_buffer) { 675| 949| return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 949| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_6vectorIhNS2_9allocatorIhEEEETkNS4_14spanable_rangeEA12_mQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISD_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISL_EESM_E4type10value_typeEEEEvOT1_RKSI_: 603| 949|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 949| ranges::assert_equal_byte_lengths(out, in); 605| 949| using element_type = std::ranges::range_value_t; 606| | 607| 949| auto store_elementwise = [&] { 608| 949| constexpr size_t bytes_per_element = sizeof(element_type); 609| 949| std::span out_s(out); 610| 949| for(auto in_elem : in) { 611| 949| store_any(out_s.template first(), in_elem); 612| 949| out_s = out_s.subspan(bytes_per_element); 613| 949| } 614| 949| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 949| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 949] ------------------ 620| 0| store_elementwise(); 621| 949| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 949| } else { 625| 949| store_elementwise(); 626| 949| } 627| 949| } 628| 949|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_6vectorIhNS2_9allocatorIhEEEETkNS4_14spanable_rangeEA12_mQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISD_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISL_EESM_E4type10value_typeEEEEvOT1_RKSI_ENKUlvE_clEv: 607| 949| auto store_elementwise = [&] { 608| 949| constexpr size_t bytes_per_element = sizeof(element_type); 609| 949| std::span out_s(out); 610| 11.3k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 11.3k, False: 949] ------------------ 611| 11.3k| store_any(out_s.template first(), in_elem); 612| 11.3k| out_s = out_s.subspan(bytes_per_element); 613| 11.3k| } 614| 949| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm48EEERNS3_5arrayImLm6EEEEEEDaDpOT0_: 745| 4.94k|inline constexpr auto store_be(ParamTs&&... params) { 746| 4.94k| return detail::store_any(std::forward(params)...); 747| 4.94k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm48EEETkNS5_14spanable_rangeENS2_5arrayImLm6EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 4.94k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 4.94k| ranges::assert_equal_byte_lengths(out, in); 605| 4.94k| using element_type = std::ranges::range_value_t; 606| | 607| 4.94k| auto store_elementwise = [&] { 608| 4.94k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 4.94k| std::span out_s(out); 610| 4.94k| for(auto in_elem : in) { 611| 4.94k| store_any(out_s.template first(), in_elem); 612| 4.94k| out_s = out_s.subspan(bytes_per_element); 613| 4.94k| } 614| 4.94k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 4.94k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 4.94k] ------------------ 620| 0| store_elementwise(); 621| 4.94k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 4.94k| } else { 625| 4.94k| store_elementwise(); 626| 4.94k| } 627| 4.94k| } 628| 4.94k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm48EEETkNS5_14spanable_rangeENS2_5arrayImLm6EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 4.94k| auto store_elementwise = [&] { 608| 4.94k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 4.94k| std::span out_s(out); 610| 29.6k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 29.6k, False: 4.94k] ------------------ 611| 29.6k| store_any(out_s.template first(), in_elem); 612| 29.6k| out_s = out_s.subspan(bytes_per_element); 613| 29.6k| } 614| 4.94k| }; _ZN5Botan7load_leINS_6detail10AutoDetectEJRA8_mRA8_hRKmEEEDaDpOT0_: 495| 663|inline constexpr auto load_le(ParamTs&&... params) { 496| 663| return detail::load_any(std::forward(params)...); 497| 663|} _ZN5Botan8store_beINSt3__16vectorIhNS1_9allocatorIhEEEEJRA16_mEEEDaDpOT0_: 745| 663|inline constexpr auto store_be(ParamTs&&... params) { 746| 663| return detail::store_any(std::forward(params)...); 747| 663|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS2_6vectorIhNS2_9allocatorIhEEEETkNS_6ranges14spanable_rangeERA16_mQoooosr3stdE7same_asINS0_10AutoDetectET0_Eaasr6rangesE25statically_spanable_rangeISC_Esr3stdE21default_initializableISC_Esr8conceptsE21resizable_byte_bufferISC_EEEDaOT1_: 663| 663|inline constexpr auto store_any(InR&& in_range) { 664| 663| auto out = []([[maybe_unused]] const auto& in) { 665| 663| if constexpr(std::same_as) { 666| 663| if constexpr(ranges::statically_spanable_range) { 667| 663| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 663| return std::array(); 669| 663| } else { 670| 663| static_assert( 671| 663| !std::same_as, 672| 663| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 663| } 674| 663| } else if constexpr(concepts::resizable_byte_buffer) { 675| 663| return OutR(std::span{in}.size_bytes()); 676| 663| } else { 677| 663| return OutR{}; 678| 663| } 679| 663| }(in_range); 680| | 681| 663| store_any>(out, std::forward(in_range)); 682| 663| return out; 683| 663|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS2_6vectorIhNS2_9allocatorIhEEEETkNS_6ranges14spanable_rangeERA16_mQoooosr3stdE7same_asINS0_10AutoDetectET0_Eaasr6rangesE25statically_spanable_rangeISC_Esr3stdE21default_initializableISC_Esr8conceptsE21resizable_byte_bufferISC_EEEDaOT1_ENKUlRKT_E_clIS9_EEDaSH_: 664| 663| auto out = []([[maybe_unused]] const auto& in) { 665| | if constexpr(std::same_as) { 666| | if constexpr(ranges::statically_spanable_range) { 667| | constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| | return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| 663| } else if constexpr(concepts::resizable_byte_buffer) { 675| 663| return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 663| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_6vectorIhNS2_9allocatorIhEEEETkNS4_14spanable_rangeEA16_mQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISD_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISL_EESM_E4type10value_typeEEEEvOT1_RKSI_: 603| 663|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 663| ranges::assert_equal_byte_lengths(out, in); 605| 663| using element_type = std::ranges::range_value_t; 606| | 607| 663| auto store_elementwise = [&] { 608| 663| constexpr size_t bytes_per_element = sizeof(element_type); 609| 663| std::span out_s(out); 610| 663| for(auto in_elem : in) { 611| 663| store_any(out_s.template first(), in_elem); 612| 663| out_s = out_s.subspan(bytes_per_element); 613| 663| } 614| 663| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 663| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 663] ------------------ 620| 0| store_elementwise(); 621| 663| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 663| } else { 625| 663| store_elementwise(); 626| 663| } 627| 663| } 628| 663|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_6vectorIhNS2_9allocatorIhEEEETkNS4_14spanable_rangeEA16_mQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISD_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISL_EESM_E4type10value_typeEEEEvOT1_RKSI_ENKUlvE_clEv: 607| 663| auto store_elementwise = [&] { 608| 663| constexpr size_t bytes_per_element = sizeof(element_type); 609| 663| std::span out_s(out); 610| 10.6k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 10.6k, False: 663] ------------------ 611| 10.6k| store_any(out_s.template first(), in_elem); 612| 10.6k| out_s = out_s.subspan(bytes_per_element); 613| 10.6k| } 614| 663| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm64EEERNS3_5arrayImLm8EEEEEEDaDpOT0_: 745| 3.35k|inline constexpr auto store_be(ParamTs&&... params) { 746| 3.35k| return detail::store_any(std::forward(params)...); 747| 3.35k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm64EEETkNS5_14spanable_rangeENS2_5arrayImLm8EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 3.35k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 3.35k| ranges::assert_equal_byte_lengths(out, in); 605| 3.35k| using element_type = std::ranges::range_value_t; 606| | 607| 3.35k| auto store_elementwise = [&] { 608| 3.35k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 3.35k| std::span out_s(out); 610| 3.35k| for(auto in_elem : in) { 611| 3.35k| store_any(out_s.template first(), in_elem); 612| 3.35k| out_s = out_s.subspan(bytes_per_element); 613| 3.35k| } 614| 3.35k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 3.35k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 3.35k] ------------------ 620| 0| store_elementwise(); 621| 3.35k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 3.35k| } else { 625| 3.35k| store_elementwise(); 626| 3.35k| } 627| 3.35k| } 628| 3.35k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm64EEETkNS5_14spanable_rangeENS2_5arrayImLm8EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 3.35k| auto store_elementwise = [&] { 608| 3.35k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 3.35k| std::span out_s(out); 610| 26.8k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 26.8k, False: 3.35k] ------------------ 611| 26.8k| store_any(out_s.template first(), in_elem); 612| 26.8k| out_s = out_s.subspan(bytes_per_element); 613| 26.8k| } 614| 3.35k| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__15arrayImLm9EEEEEEDaDpOT0_: 745| 4.27k|inline constexpr auto store_be(ParamTs&&... params) { 746| 4.27k| return detail::store_any(std::forward(params)...); 747| 4.27k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm9EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_: 663| 4.27k|inline constexpr auto store_any(InR&& in_range) { 664| 4.27k| auto out = []([[maybe_unused]] const auto& in) { 665| 4.27k| if constexpr(std::same_as) { 666| 4.27k| if constexpr(ranges::statically_spanable_range) { 667| 4.27k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 4.27k| return std::array(); 669| 4.27k| } else { 670| 4.27k| static_assert( 671| 4.27k| !std::same_as, 672| 4.27k| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 4.27k| } 674| 4.27k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 4.27k| return OutR(std::span{in}.size_bytes()); 676| 4.27k| } else { 677| 4.27k| return OutR{}; 678| 4.27k| } 679| 4.27k| }(in_range); 680| | 681| 4.27k| store_any>(out, std::forward(in_range)); 682| 4.27k| return out; 683| 4.27k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm9EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSE_: 664| 4.27k| auto out = []([[maybe_unused]] const auto& in) { 665| 4.27k| if constexpr(std::same_as) { 666| 4.27k| if constexpr(ranges::statically_spanable_range) { 667| 4.27k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 4.27k| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 4.27k| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm72EEETkNS4_14spanable_rangeENS6_ImLm9EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 4.27k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 4.27k| ranges::assert_equal_byte_lengths(out, in); 605| 4.27k| using element_type = std::ranges::range_value_t; 606| | 607| 4.27k| auto store_elementwise = [&] { 608| 4.27k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 4.27k| std::span out_s(out); 610| 4.27k| for(auto in_elem : in) { 611| 4.27k| store_any(out_s.template first(), in_elem); 612| 4.27k| out_s = out_s.subspan(bytes_per_element); 613| 4.27k| } 614| 4.27k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 4.27k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 4.27k] ------------------ 620| 0| store_elementwise(); 621| 4.27k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 4.27k| } else { 625| 4.27k| store_elementwise(); 626| 4.27k| } 627| 4.27k| } 628| 4.27k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm72EEETkNS4_14spanable_rangeENS6_ImLm9EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 4.27k| auto store_elementwise = [&] { 608| 4.27k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 4.27k| std::span out_s(out); 610| 38.4k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 38.4k, False: 4.27k] ------------------ 611| 38.4k| store_any(out_s.template first(), in_elem); 612| 38.4k| out_s = out_s.subspan(bytes_per_element); 613| 38.4k| } 614| 4.27k| }; _ZN5Botan7load_leINS_6detail10AutoDetectEJRA9_mRA8_hRKmEEEDaDpOT0_: 495| 780|inline constexpr auto load_le(ParamTs&&... params) { 496| 780| return detail::load_any(std::forward(params)...); 497| 780|} _ZN5Botan8store_beINSt3__16vectorIhNS1_9allocatorIhEEEEJRA18_mEEEDaDpOT0_: 745| 780|inline constexpr auto store_be(ParamTs&&... params) { 746| 780| return detail::store_any(std::forward(params)...); 747| 780|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS2_6vectorIhNS2_9allocatorIhEEEETkNS_6ranges14spanable_rangeERA18_mQoooosr3stdE7same_asINS0_10AutoDetectET0_Eaasr6rangesE25statically_spanable_rangeISC_Esr3stdE21default_initializableISC_Esr8conceptsE21resizable_byte_bufferISC_EEEDaOT1_: 663| 780|inline constexpr auto store_any(InR&& in_range) { 664| 780| auto out = []([[maybe_unused]] const auto& in) { 665| 780| if constexpr(std::same_as) { 666| 780| if constexpr(ranges::statically_spanable_range) { 667| 780| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 780| return std::array(); 669| 780| } else { 670| 780| static_assert( 671| 780| !std::same_as, 672| 780| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 780| } 674| 780| } else if constexpr(concepts::resizable_byte_buffer) { 675| 780| return OutR(std::span{in}.size_bytes()); 676| 780| } else { 677| 780| return OutR{}; 678| 780| } 679| 780| }(in_range); 680| | 681| 780| store_any>(out, std::forward(in_range)); 682| 780| return out; 683| 780|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS2_6vectorIhNS2_9allocatorIhEEEETkNS_6ranges14spanable_rangeERA18_mQoooosr3stdE7same_asINS0_10AutoDetectET0_Eaasr6rangesE25statically_spanable_rangeISC_Esr3stdE21default_initializableISC_Esr8conceptsE21resizable_byte_bufferISC_EEEDaOT1_ENKUlRKT_E_clIS9_EEDaSH_: 664| 780| auto out = []([[maybe_unused]] const auto& in) { 665| | if constexpr(std::same_as) { 666| | if constexpr(ranges::statically_spanable_range) { 667| | constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| | return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| 780| } else if constexpr(concepts::resizable_byte_buffer) { 675| 780| return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 780| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_6vectorIhNS2_9allocatorIhEEEETkNS4_14spanable_rangeEA18_mQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISD_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISL_EESM_E4type10value_typeEEEEvOT1_RKSI_: 603| 780|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 780| ranges::assert_equal_byte_lengths(out, in); 605| 780| using element_type = std::ranges::range_value_t; 606| | 607| 780| auto store_elementwise = [&] { 608| 780| constexpr size_t bytes_per_element = sizeof(element_type); 609| 780| std::span out_s(out); 610| 780| for(auto in_elem : in) { 611| 780| store_any(out_s.template first(), in_elem); 612| 780| out_s = out_s.subspan(bytes_per_element); 613| 780| } 614| 780| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 780| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 780] ------------------ 620| 0| store_elementwise(); 621| 780| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 780| } else { 625| 780| store_elementwise(); 626| 780| } 627| 780| } 628| 780|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_6vectorIhNS2_9allocatorIhEEEETkNS4_14spanable_rangeEA18_mQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISD_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISL_EESM_E4type10value_typeEEEEvOT1_RKSI_ENKUlvE_clEv: 607| 780| auto store_elementwise = [&] { 608| 780| constexpr size_t bytes_per_element = sizeof(element_type); 609| 780| std::span out_s(out); 610| 14.0k| for(auto in_elem : in) { ------------------ | Branch (610:24): [True: 14.0k, False: 780] ------------------ 611| 14.0k| store_any(out_s.template first(), in_elem); 612| 14.0k| out_s = out_s.subspan(bytes_per_element); 613| 14.0k| } 614| 780| }; _ZN5Botan7load_leINS_6detail10AutoDetectEJRNSt3__15arrayImLm7EEERNS3_4spanIKhLm56EEEEEEDaDpOT0_: 495| 30|inline constexpr auto load_le(ParamTs&&... params) { 496| 30| return detail::load_any(std::forward(params)...); 497| 30|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeERNS2_5arrayImLm7EEETkNS5_16contiguous_rangeIhEENS2_4spanIKhLm56EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISR_SQ_EEEvOSH_RKT2_: 355| 30|inline constexpr void load_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 356| 30| ranges::assert_equal_byte_lengths(out, in); 357| 30| using element_type = std::ranges::range_value_t; 358| | 359| 30| auto load_elementwise = [&] { 360| 30| constexpr size_t bytes_per_element = sizeof(element_type); 361| 30| std::span in_s(in); 362| 30| for(auto& out_elem : out) { 363| 30| out_elem = load_any(in_s.template first()); 364| 30| in_s = in_s.subspan(bytes_per_element); 365| 30| } 366| 30| }; 367| | 368| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 369| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 370| | // in a `constexpr` context. 371| 30| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (371:7): [Folded, False: 30] ------------------ 372| 0| load_elementwise(); 373| 30| } else { 374| 30| if constexpr(endianness == std::endian::native && !custom_loadable) { 375| 30| typecast_copy(out, in); 376| | } else { 377| | load_elementwise(); 378| | } 379| 30| } 380| 30|} _ZN5Botan8store_leINS_6detail10AutoDetectEJRNSt3__14spanIhLm56EEENS3_5arrayImLm7EEEEEEDaDpOT0_: 736| 15|inline constexpr auto store_le(ParamTs&&... params) { 737| 15| return detail::store_any(std::forward(params)...); 738| 15|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm56EEETkNS5_14spanable_rangeENS2_5arrayImLm7EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 15|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 15| ranges::assert_equal_byte_lengths(out, in); 605| 15| using element_type = std::ranges::range_value_t; 606| | 607| 15| auto store_elementwise = [&] { 608| 15| constexpr size_t bytes_per_element = sizeof(element_type); 609| 15| std::span out_s(out); 610| 15| for(auto in_elem : in) { 611| 15| store_any(out_s.template first(), in_elem); 612| 15| out_s = out_s.subspan(bytes_per_element); 613| 15| } 614| 15| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 15| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 15] ------------------ 620| 0| store_elementwise(); 621| 15| } else { 622| 15| if constexpr(endianness == std::endian::native && !custom_storable) { 623| 15| typecast_copy(out, in); 624| | } else { 625| | store_elementwise(); 626| | } 627| 15| } 628| 15|} _ZN5Botan8store_leINS_6detail10AutoDetectEJRPhmmmmEEEDaDpOT0_: 736| 16|inline constexpr auto store_le(ParamTs&&... params) { 737| 16| return detail::store_any(std::forward(params)...); 738| 16|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS0_20unsigned_integralishEmTpTkNS0_20unsigned_integralishEJmmmEQaaoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_E10all_same_vIS6_DpT2_EEEvPhS6_S8_: 723| 16|inline constexpr void store_any(uint8_t out[], T0 in0, Ts... ins) { 724| 16| constexpr auto bytes = sizeof(in0) + (sizeof(ins) + ... + 0); 725| | // asserts that *out points to the correct amount of memory 726| 16| store_any(std::span(out, bytes), in0, ins...); 727| 16|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm32EEETpTkNS0_20unsigned_integralishEJmmmmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_: 582| 16|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, Ts... ins) { 583| 16| ranges::assert_exact_byte_length<(sizeof(Ts) + ...)>(out); 584| 16| auto store_one = [off = 0](auto o, T i) mutable { 585| 16| store_any(i, o.subspan(off).template first()); 586| 16| off += sizeof(T); 587| 16| }; 588| | 589| 16| (store_one(std::span{out}, ins), ...); 590| 16|} _ZZN5Botan6detail9store_anyILNSt3__16endianE57005EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm32EEETpTkNS0_20unsigned_integralishEJmmmmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_ENUlTyS9_T_E_clImS7_EEDaS9_SE_: 584| 64| auto store_one = [off = 0](auto o, T i) mutable { 585| 64| store_any(i, o.subspan(off).template first()); 586| 64| off += sizeof(T); 587| 64| }; _ZN5Botan7load_beItJPKhiEEEDaDpOT0_: 504| 1.33k|inline constexpr auto load_be(ParamTs&&... params) { 505| 1.33k| return detail::load_any(std::forward(params)...); 506| 1.33k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJRtPhEEEDaDpOT0_: 745| 13|inline constexpr auto store_be(ParamTs&&... params) { 746| 13| return detail::store_any(std::forward(params)...); 747| 13|} _ZN5Botan18MerkleDamgard_HashINS_5SHA_1EEC2Ev: 42| 6.38k| MerkleDamgard_Hash() { clear(); } _ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE5clearEv: 70| 31.7k| void clear() { 71| 31.7k| MD::init(m_digest); 72| 31.7k| m_buffer.clear(); 73| 31.7k| m_count = 0; 74| 31.7k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_256EEC2Ev: 42| 14.2k| MerkleDamgard_Hash() { clear(); } _ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE5clearEv: 70| 69.7k| void clear() { 71| 69.7k| MD::init(m_digest); 72| 69.7k| m_buffer.clear(); 73| 69.7k| m_count = 0; 74| 69.7k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_384EEC2Ev: 42| 970| MerkleDamgard_Hash() { clear(); } _ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE5clearEv: 70| 8.60k| void clear() { 71| 8.60k| MD::init(m_digest); 72| 8.60k| m_buffer.clear(); 73| 8.60k| m_count = 0; 74| 8.60k| } _ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE6updateENSt3__14spanIKhLm18446744073709551615EEE: 44| 25.8k| void update(std::span input) { 45| 25.8k| BufferSlicer in(input); 46| | 47| 64.3k| while(!in.empty()) { ------------------ | Branch (47:16): [True: 38.4k, False: 25.8k] ------------------ 48| 38.4k| if(const auto one_block = m_buffer.handle_unaligned_data(in)) { ------------------ | Branch (48:27): [True: 65, False: 38.3k] ------------------ 49| 65| MD::compress_n(m_digest, one_block.value(), 1); 50| 65| } 51| | 52| 38.4k| if(m_buffer.in_alignment()) { ------------------ | Branch (52:16): [True: 12.9k, False: 25.4k] ------------------ 53| 12.9k| const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in); 54| 12.9k| if(full_blocks > 0) { ------------------ | Branch (54:19): [True: 12.9k, False: 4] ------------------ 55| 12.9k| MD::compress_n(m_digest, aligned_data, full_blocks); 56| 12.9k| } 57| 12.9k| } 58| 38.4k| } 59| | 60| 25.8k| m_count += input.size(); 61| 25.8k| } _ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE5finalENSt3__14spanIhLm18446744073709551615EEE: 63| 25.2k| void final(std::span output) { 64| 25.2k| append_padding_bit(); 65| 25.2k| append_counter_and_finalize(); 66| 25.2k| copy_output(output); 67| 25.2k| clear(); 68| 25.2k| } _ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE18append_padding_bitEv: 77| 25.2k| void append_padding_bit() { 78| 25.2k| BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume()); ------------------ | | 77| 25.2k| do { \ | | 78| 25.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 25.2k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 25.2k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 25.2k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 25.2k] | | ------------------ ------------------ 79| 25.2k| if constexpr(MD::bit_endianness == MD_Endian::Big) { 80| 25.2k| const uint8_t final_byte = 0x80; 81| 25.2k| m_buffer.append({&final_byte, 1}); 82| | } else { 83| | const uint8_t final_byte = 0x01; 84| | m_buffer.append({&final_byte, 1}); 85| | } 86| 25.2k| } _ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE27append_counter_and_finalizeEv: 88| 25.2k| void append_counter_and_finalize() { 89| | // Compress the remaining data if the final data block does not provide 90| | // enough space for the counter bytes. 91| 25.2k| if(m_buffer.elements_until_alignment() < MD::ctr_bytes) { ------------------ | Branch (91:13): [True: 12.5k, False: 12.7k] ------------------ 92| 12.5k| m_buffer.fill_up_with_zeros(); 93| 12.5k| MD::compress_n(m_digest, m_buffer.consume(), 1); 94| 12.5k| } 95| | 96| | // Make sure that any remaining bytes in the very last block are zero. 97| 25.2k| BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes); ------------------ | | 77| 25.2k| do { \ | | 78| 25.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 25.2k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 25.2k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 25.2k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 25.2k] | | ------------------ ------------------ 98| 25.2k| m_buffer.fill_up_with_zeros(); 99| | 100| | // Replace a bunch of the right-most zero-padding with the counter bytes. 101| 25.2k| const uint64_t bit_count = m_count * 8; 102| 25.2k| auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count)); 103| 25.2k| if constexpr(MD::byte_endianness == MD_Endian::Big) { 104| 25.2k| store_be(bit_count, last_bytes.data()); 105| | } else { 106| | store_le(bit_count, last_bytes.data()); 107| | } 108| | 109| | // Compress the very last block. 110| 25.2k| MD::compress_n(m_digest, m_buffer.consume(), 1); 111| 25.2k| } _ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE: 113| 25.2k| void copy_output(std::span output) { 114| 25.2k| BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes); ------------------ | | 77| 25.2k| do { \ | | 78| 25.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 25.2k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 25.2k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 25.2k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 25.2k] | | ------------------ ------------------ 115| | 116| 25.2k| if constexpr(MD::byte_endianness == MD_Endian::Big) { 117| 25.2k| copy_out_be(output.first(MD::output_bytes), m_digest); 118| | } else { 119| | copy_out_le(output.first(MD::output_bytes), m_digest); 120| | } 121| 25.2k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE6updateENSt3__14spanIKhLm18446744073709551615EEE: 44| 87.3k| void update(std::span input) { 45| 87.3k| BufferSlicer in(input); 46| | 47| 195k| while(!in.empty()) { ------------------ | Branch (47:16): [True: 107k, False: 87.3k] ------------------ 48| 107k| if(const auto one_block = m_buffer.handle_unaligned_data(in)) { ------------------ | Branch (48:27): [True: 5.30k, False: 102k] ------------------ 49| 5.30k| MD::compress_n(m_digest, one_block.value(), 1); 50| 5.30k| } 51| | 52| 107k| if(m_buffer.in_alignment()) { ------------------ | Branch (52:16): [True: 43.6k, False: 64.0k] ------------------ 53| 43.6k| const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in); 54| 43.6k| if(full_blocks > 0) { ------------------ | Branch (54:19): [True: 38.4k, False: 5.26k] ------------------ 55| 38.4k| MD::compress_n(m_digest, aligned_data, full_blocks); 56| 38.4k| } 57| 43.6k| } 58| 107k| } 59| | 60| 87.3k| m_count += input.size(); 61| 87.3k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE5finalENSt3__14spanIhLm18446744073709551615EEE: 63| 53.3k| void final(std::span output) { 64| 53.3k| append_padding_bit(); 65| 53.3k| append_counter_and_finalize(); 66| 53.3k| copy_output(output); 67| 53.3k| clear(); 68| 53.3k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE18append_padding_bitEv: 77| 53.3k| void append_padding_bit() { 78| 53.3k| BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume()); ------------------ | | 77| 53.3k| do { \ | | 78| 53.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 53.3k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 53.3k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 53.3k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 53.3k] | | ------------------ ------------------ 79| 53.3k| if constexpr(MD::bit_endianness == MD_Endian::Big) { 80| 53.3k| const uint8_t final_byte = 0x80; 81| 53.3k| m_buffer.append({&final_byte, 1}); 82| | } else { 83| | const uint8_t final_byte = 0x01; 84| | m_buffer.append({&final_byte, 1}); 85| | } 86| 53.3k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE27append_counter_and_finalizeEv: 88| 53.3k| void append_counter_and_finalize() { 89| | // Compress the remaining data if the final data block does not provide 90| | // enough space for the counter bytes. 91| 53.3k| if(m_buffer.elements_until_alignment() < MD::ctr_bytes) { ------------------ | Branch (91:13): [True: 12.8k, False: 40.4k] ------------------ 92| 12.8k| m_buffer.fill_up_with_zeros(); 93| 12.8k| MD::compress_n(m_digest, m_buffer.consume(), 1); 94| 12.8k| } 95| | 96| | // Make sure that any remaining bytes in the very last block are zero. 97| 53.3k| BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes); ------------------ | | 77| 53.3k| do { \ | | 78| 53.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 53.3k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 53.3k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 53.3k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 53.3k] | | ------------------ ------------------ 98| 53.3k| m_buffer.fill_up_with_zeros(); 99| | 100| | // Replace a bunch of the right-most zero-padding with the counter bytes. 101| 53.3k| const uint64_t bit_count = m_count * 8; 102| 53.3k| auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count)); 103| 53.3k| if constexpr(MD::byte_endianness == MD_Endian::Big) { 104| 53.3k| store_be(bit_count, last_bytes.data()); 105| | } else { 106| | store_le(bit_count, last_bytes.data()); 107| | } 108| | 109| | // Compress the very last block. 110| 53.3k| MD::compress_n(m_digest, m_buffer.consume(), 1); 111| 53.3k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE: 113| 53.3k| void copy_output(std::span output) { 114| 53.3k| BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes); ------------------ | | 77| 53.3k| do { \ | | 78| 53.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 53.3k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 53.3k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 53.3k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 53.3k] | | ------------------ ------------------ 115| | 116| 53.3k| if constexpr(MD::byte_endianness == MD_Endian::Big) { 117| 53.3k| copy_out_be(output.first(MD::output_bytes), m_digest); 118| | } else { 119| | copy_out_le(output.first(MD::output_bytes), m_digest); 120| | } 121| 53.3k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE6updateENSt3__14spanIKhLm18446744073709551615EEE: 44| 17.1k| void update(std::span input) { 45| 17.1k| BufferSlicer in(input); 46| | 47| 34.6k| while(!in.empty()) { ------------------ | Branch (47:16): [True: 17.5k, False: 17.1k] ------------------ 48| 17.5k| if(const auto one_block = m_buffer.handle_unaligned_data(in)) { ------------------ | Branch (48:27): [True: 31, False: 17.5k] ------------------ 49| 31| MD::compress_n(m_digest, one_block.value(), 1); 50| 31| } 51| | 52| 17.5k| if(m_buffer.in_alignment()) { ------------------ | Branch (52:16): [True: 7.67k, False: 9.91k] ------------------ 53| 7.67k| const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in); 54| 7.67k| if(full_blocks > 0) { ------------------ | Branch (54:19): [True: 7.66k, False: 7] ------------------ 55| 7.66k| MD::compress_n(m_digest, aligned_data, full_blocks); 56| 7.66k| } 57| 7.67k| } 58| 17.5k| } 59| | 60| 17.1k| m_count += input.size(); 61| 17.1k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE5finalENSt3__14spanIhLm18446744073709551615EEE: 63| 6.73k| void final(std::span output) { 64| 6.73k| append_padding_bit(); 65| 6.73k| append_counter_and_finalize(); 66| 6.73k| copy_output(output); 67| 6.73k| clear(); 68| 6.73k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE18append_padding_bitEv: 77| 6.73k| void append_padding_bit() { 78| 6.73k| BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume()); ------------------ | | 77| 6.73k| do { \ | | 78| 6.73k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 6.73k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 6.73k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 6.73k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 6.73k] | | ------------------ ------------------ 79| 6.73k| if constexpr(MD::bit_endianness == MD_Endian::Big) { 80| 6.73k| const uint8_t final_byte = 0x80; 81| 6.73k| m_buffer.append({&final_byte, 1}); 82| | } else { 83| | const uint8_t final_byte = 0x01; 84| | m_buffer.append({&final_byte, 1}); 85| | } 86| 6.73k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE27append_counter_and_finalizeEv: 88| 6.73k| void append_counter_and_finalize() { 89| | // Compress the remaining data if the final data block does not provide 90| | // enough space for the counter bytes. 91| 6.73k| if(m_buffer.elements_until_alignment() < MD::ctr_bytes) { ------------------ | Branch (91:13): [True: 1.53k, False: 5.19k] ------------------ 92| 1.53k| m_buffer.fill_up_with_zeros(); 93| 1.53k| MD::compress_n(m_digest, m_buffer.consume(), 1); 94| 1.53k| } 95| | 96| | // Make sure that any remaining bytes in the very last block are zero. 97| 6.73k| BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes); ------------------ | | 77| 6.73k| do { \ | | 78| 6.73k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 6.73k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 6.73k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 6.73k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 6.73k] | | ------------------ ------------------ 98| 6.73k| m_buffer.fill_up_with_zeros(); 99| | 100| | // Replace a bunch of the right-most zero-padding with the counter bytes. 101| 6.73k| const uint64_t bit_count = m_count * 8; 102| 6.73k| auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count)); 103| 6.73k| if constexpr(MD::byte_endianness == MD_Endian::Big) { 104| 6.73k| store_be(bit_count, last_bytes.data()); 105| | } else { 106| | store_le(bit_count, last_bytes.data()); 107| | } 108| | 109| | // Compress the very last block. 110| 6.73k| MD::compress_n(m_digest, m_buffer.consume(), 1); 111| 6.73k| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE: 113| 6.73k| void copy_output(std::span output) { 114| 6.73k| BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes); ------------------ | | 77| 6.73k| do { \ | | 78| 6.73k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 6.73k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 6.73k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 6.73k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 6.73k] | | ------------------ ------------------ 115| | 116| 6.73k| if constexpr(MD::byte_endianness == MD_Endian::Big) { 117| 6.73k| copy_out_be(output.first(MD::output_bytes), m_digest); 118| | } else { 119| | copy_out_le(output.first(MD::output_bytes), m_digest); 120| | } 121| 6.73k| } _ZN5Botan16as_span_of_bytesENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE: 68| 16.9k|inline std::span as_span_of_bytes(std::string_view s) { 69| 16.9k| return as_span_of_bytes(s.data(), s.size()); 70| 16.9k|} _ZN5Botan16as_span_of_bytesEPKcm: 59| 16.9k|inline std::span as_span_of_bytes(const char* s, size_t len) { 60| 16.9k| const uint8_t* b = reinterpret_cast(s); 61| 16.9k| return std::span{b, len}; 62| 16.9k|} _ZN5Botan15bytes_to_stringENSt3__14spanIKhLm18446744073709551615EEE: 76| 60.8k|inline std::string bytes_to_string(std::span bytes) { 77| 60.8k| return std::string(reinterpret_cast(bytes.data()), bytes.size()); 78| 60.8k|} _ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEhEEvPT_m: 37| 222k|inline void zeroize_buffer(T buf[], size_t n) { 38| 222k| if(n > 0) { ------------------ | Branch (38:7): [True: 222k, False: 0] ------------------ 39| 222k| std::memset(buf, 0, sizeof(T) * n); 40| 222k| } 41| 222k|} _ZN5Botan21unchecked_copy_memoryITkNSt3__117unsigned_integralEmEEvPT_PKS2_m: 44| 150|inline void unchecked_copy_memory(T* out, const T* in, size_t n) { 45| 150| if(in != nullptr && out != nullptr && n > 0) { ------------------ | Branch (45:7): [True: 150, False: 0] | Branch (45:24): [True: 150, False: 0] | Branch (45:42): [True: 150, False: 0] ------------------ 46| 150| std::memmove(out, in, sizeof(T) * n); 47| 150| } 48| 150|} _ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEmEEvPT_m: 37| 42.3k|inline void zeroize_buffer(T buf[], size_t n) { 38| 42.3k| if(n > 0) { ------------------ | Branch (38:7): [True: 42.3k, False: 3] ------------------ 39| 42.3k| std::memset(buf, 0, sizeof(T) * n); 40| 42.3k| } 41| 42.3k|} _ZNK5Botan12Null_Padding15valid_blocksizeEm: 170| 242| bool valid_blocksize(size_t /*block_size*/) const override { return true; } _ZN5Botan28BlockCipherModePaddingMethodD2Ev: 76| 242| virtual ~BlockCipherModePaddingMethod() = default; _ZNK5Botan17Montgomery_Params1pEv: 41| 21.0k| const BigInt& p() const { return m_data->p(); } _ZNK5Botan17Montgomery_Params2R1Ev: 43| 10.5k| const BigInt& R1() const { return m_data->r1(); } _ZNK5Botan17Montgomery_Params2R2Ev: 45| 21.0k| const BigInt& R2() const { return m_data->r2(); } _ZNK5Botan17Montgomery_Params6p_dashEv: 49| 21.0k| word p_dash() const { return m_data->p_dash(); } _ZNK5Botan17Montgomery_Params7p_wordsEv: 51| 21.0k| size_t p_words() const { return m_data->p_size(); } _ZNK5Botan17Montgomery_Params4Data1pEv: 76| 21.0k| const BigInt& p() const { return m_p; } _ZNK5Botan17Montgomery_Params4Data2r1Ev: 78| 10.5k| const BigInt& r1() const { return m_r1; } _ZNK5Botan17Montgomery_Params4Data2r2Ev: 80| 21.0k| const BigInt& r2() const { return m_r2; } _ZNK5Botan17Montgomery_Params4Data6p_dashEv: 84| 21.0k| word p_dash() const { return m_p_dash; } _ZNK5Botan17Montgomery_Params4Data6p_sizeEv: 86| 21.0k| size_t p_size() const { return m_p_words; } _ZN5Botan10word8_add3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_: 294| 4|inline constexpr auto word8_add3(W z[8], const W x[8], const W y[8], W carry) -> W { 295| 4|#if defined(BOTAN_MP_USE_X86_64_ASM) 296| 4| if(std::same_as && !std::is_constant_evaluated()) { ------------------ | Branch (296:7): [True: 0, Folded] | Branch (296:36): [True: 0, Folded] ------------------ 297| 4| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq")) 298| 4| : [carry] "=r"(carry) 299| 4| : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry) 300| 4| : "cc", "memory"); 301| 4| return carry; 302| 4| } 303| 0|#endif 304| | 305| 0| z[0] = word_add(x[0], y[0], &carry); 306| 0| z[1] = word_add(x[1], y[1], &carry); 307| 0| z[2] = word_add(x[2], y[2], &carry); 308| 0| z[3] = word_add(x[3], y[3], &carry); 309| 0| z[4] = word_add(x[4], y[4], &carry); 310| 0| z[5] = word_add(x[5], y[5], &carry); 311| 0| z[6] = word_add(x[6], y[6], &carry); 312| 0| z[7] = word_add(x[7], y[7], &carry); 313| 0| return carry; 314| 4|} _ZN5Botan8word_addITkNS_8WordTypeEmEET_S1_S1_PS1_: 231| 84.2M|inline constexpr auto word_add(W x, W y, W* carry) -> W { 232| 84.2M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc) 233| 84.2M| if(!std::is_constant_evaluated()) { ------------------ | Branch (233:7): [True: 84.2M, Folded] ------------------ 234| | if constexpr(std::same_as) { 235| | return __builtin_addc(x, y, *carry & 1, carry); 236| 84.2M| } else if constexpr(std::same_as) { 237| 84.2M| return __builtin_addcl(x, y, *carry & 1, carry); 238| | } else if constexpr(std::same_as) { 239| | return __builtin_addcll(x, y, *carry & 1, carry); 240| | } 241| 84.2M| } 242| 0|#endif 243| | 244| | if constexpr(WordInfo::dword_is_native && use_dword_for_word_add) { 245| | /* 246| | TODO(Botan4) this is largely a performance hack for GCCs that don't 247| | support __builtin_addc, if we increase the minimum supported version of 248| | GCC to GCC 14 then we can remove this and not worry about it 249| | */ 250| | const W cb = *carry & 1; 251| | const auto s = typename WordInfo::dword(x) + y + cb; 252| | *carry = static_cast(s >> WordInfo::bits); 253| | return static_cast(s); 254| 84.2M| } else { 255| 84.2M| const W cb = *carry & 1; 256| 84.2M| W z = x + y; 257| 84.2M| W c1 = (z < x); 258| 84.2M| z += cb; 259| 84.2M| *carry = c1 | (z < cb); 260| 84.2M| return z; 261| 84.2M| } 262| 84.2M|} _ZN5Botan10word8_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_: 371| 2.73k|inline constexpr auto word8_sub3(W z[8], const W x[8], const W y[8], W carry) -> W { 372| 2.73k|#if defined(BOTAN_MP_USE_X86_64_ASM) 373| 2.73k| if(std::same_as && !std::is_constant_evaluated()) { ------------------ | Branch (373:7): [True: 0, Folded] | Branch (373:36): [True: 0, Folded] ------------------ 374| 2.73k| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq")) 375| 2.73k| : [carry] "=r"(carry) 376| 2.73k| : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry) 377| 2.73k| : "cc", "memory"); 378| 2.73k| return carry; 379| 2.73k| } 380| 0|#endif 381| | 382| 0| z[0] = word_sub(x[0], y[0], &carry); 383| 0| z[1] = word_sub(x[1], y[1], &carry); 384| 0| z[2] = word_sub(x[2], y[2], &carry); 385| 0| z[3] = word_sub(x[3], y[3], &carry); 386| 0| z[4] = word_sub(x[4], y[4], &carry); 387| 0| z[5] = word_sub(x[5], y[5], &carry); 388| 0| z[6] = word_sub(x[6], y[6], &carry); 389| 0| z[7] = word_sub(x[7], y[7], &carry); 390| 0| return carry; 391| 2.73k|} _ZN5Botan8word_subITkNS_8WordTypeEmEET_S1_S1_PS1_: 320| 143M|inline constexpr auto word_sub(W x, W y, W* carry) -> W { 321| 143M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc) 322| 143M| if(!std::is_constant_evaluated()) { ------------------ | Branch (322:7): [True: 143M, Folded] ------------------ 323| | if constexpr(std::same_as) { 324| | return __builtin_subc(x, y, *carry & 1, carry); 325| 143M| } else if constexpr(std::same_as) { 326| 143M| return __builtin_subcl(x, y, *carry & 1, carry); 327| | } else if constexpr(std::same_as) { 328| | return __builtin_subcll(x, y, *carry & 1, carry); 329| | } 330| 143M| } 331| 0|#endif 332| | 333| 0| const W cb = *carry & 1; 334| 143M| W t0 = x - y; 335| 143M| W c1 = (t0 > x); 336| 143M| W z = t0 - cb; 337| 143M| *carry = c1 | (z > t0); 338| 143M| return z; 339| 143M|} _ZN5Botan13word8_linmul3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_: 397| 51|inline constexpr auto word8_linmul3(W z[8], const W x[8], W y, W carry) -> W { 398| 51|#if defined(BOTAN_MP_USE_X86_64_ASM) 399| 51| if(std::same_as && !std::is_constant_evaluated()) { ------------------ | Branch (399:7): [True: 0, Folded] | Branch (399:36): [True: 0, Folded] ------------------ 400| 51| asm volatile(DO_8_TIMES(LINMUL_OP, "z") 401| 51| : [carry] "=r"(carry) 402| 51| : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry) 403| 51| : "cc", "%rax", "%rdx", "memory"); 404| 51| return carry; 405| 51| } 406| 0|#endif 407| | 408| 0| z[0] = word_madd2(x[0], y, &carry); 409| 0| z[1] = word_madd2(x[1], y, &carry); 410| 0| z[2] = word_madd2(x[2], y, &carry); 411| 0| z[3] = word_madd2(x[3], y, &carry); 412| 0| z[4] = word_madd2(x[4], y, &carry); 413| 0| z[5] = word_madd2(x[5], y, &carry); 414| 0| z[6] = word_madd2(x[6], y, &carry); 415| 0| z[7] = word_madd2(x[7], y, &carry); 416| 0| return carry; 417| 51|} _ZN5Botan10word_madd2ITkNS_8WordTypeEmEET_S1_S1_PS1_: 90| 47.6k|inline constexpr auto word_madd2(W a, W b, W* c) -> W { 91| 47.6k|#if defined(BOTAN_MP_USE_X86_64_ASM) 92| 47.6k| if(std::same_as && !std::is_constant_evaluated()) { ------------------ | Branch (92:7): [True: 0, Folded] | Branch (92:36): [True: 0, Folded] ------------------ 93| 47.6k| asm(R"( 94| 47.6k| mulq %[b] 95| 47.6k| addq %[c],%[a] 96| 47.6k| adcq $0,%[carry] 97| 47.6k| )" 98| 47.6k| : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c) 99| 47.6k| : "0"(a), "1"(b), [c] "g"(*c) 100| 47.6k| : "cc"); 101| | 102| 47.6k| return a; 103| 47.6k| } 104| |#elif defined(BOTAN_MP_USE_AARCH64_ASM) 105| | if(std::same_as && !std::is_constant_evaluated()) { 106| | W lo = 0; 107| | W hi = 0; 108| | asm(R"( 109| | mul %[lo], %[a], %[b] 110| | umulh %[hi], %[a], %[b] 111| | adds %[lo], %[lo], %[c] 112| | adc %[hi], %[hi], xzr 113| | )" 114| | : [lo] "=&r"(lo), [hi] "=&r"(hi) 115| | : [a] "r"(a), [b] "r"(b), [c] "r"(*c) 116| | : "cc"); 117| | 118| | *c = hi; 119| | return lo; 120| | } 121| |#endif 122| | 123| 0| typedef typename WordInfo::dword dword; 124| 0| const dword s = dword(a) * b + *c; 125| 0| *c = static_cast(s >> WordInfo::bits); 126| 0| return static_cast(s); 127| 47.6k|} _ZN5Botan11word8_madd3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_: 423| 152|inline constexpr auto word8_madd3(W z[8], const W x[8], W y, W carry) -> W { 424| 152|#if defined(BOTAN_MP_USE_X86_64_ASM) 425| 152| if(std::same_as && !std::is_constant_evaluated()) { ------------------ | Branch (425:7): [True: 0, Folded] | Branch (425:36): [True: 0, Folded] ------------------ 426| 152| asm volatile(DO_8_TIMES(MULADD_OP, "") 427| 152| : [carry] "=r"(carry) 428| 152| : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry) 429| 152| : "cc", "%rax", "%rdx", "memory"); 430| 152| return carry; 431| 152| } 432| 0|#endif 433| | 434| 0| z[0] = word_madd3(x[0], y, z[0], &carry); 435| 0| z[1] = word_madd3(x[1], y, z[1], &carry); 436| 0| z[2] = word_madd3(x[2], y, z[2], &carry); 437| 0| z[3] = word_madd3(x[3], y, z[3], &carry); 438| 0| z[4] = word_madd3(x[4], y, z[4], &carry); 439| 0| z[5] = word_madd3(x[5], y, z[5], &carry); 440| 0| z[6] = word_madd3(x[6], y, z[6], &carry); 441| 0| z[7] = word_madd3(x[7], y, z[7], &carry); 442| 0| return carry; 443| 152|} _ZN5Botan10word_madd3ITkNS_8WordTypeEmEET_S1_S1_S1_PS1_: 133| 304|inline constexpr auto word_madd3(W a, W b, W c, W* d) -> W { 134| 304|#if defined(BOTAN_MP_USE_X86_64_ASM) 135| 304| if(std::same_as && !std::is_constant_evaluated()) { ------------------ | Branch (135:7): [True: 0, Folded] | Branch (135:36): [True: 0, Folded] ------------------ 136| 304| asm(R"( 137| 304| mulq %[b] 138| 304| 139| 304| addq %[c],%[a] 140| 304| adcq $0,%[carry] 141| 304| 142| 304| addq %[d],%[a] 143| 304| adcq $0,%[carry] 144| 304| )" 145| 304| : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d) 146| 304| : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d) 147| 304| : "cc"); 148| | 149| 304| return a; 150| 304| } 151| |#elif defined(BOTAN_MP_USE_AARCH64_ASM) 152| | if(std::same_as && !std::is_constant_evaluated()) { 153| | W lo = 0; 154| | W hi = 0; 155| | asm(R"( 156| | mul %[lo], %[a], %[b] 157| | umulh %[hi], %[a], %[b] 158| | adds %[lo], %[lo], %[c] 159| | adc %[hi], %[hi], xzr 160| | adds %[lo], %[lo], %[d] 161| | adc %[hi], %[hi], xzr 162| | )" 163| | : [lo] "=&r"(lo), [hi] "=&r"(hi) 164| | : [a] "r"(a), [b] "r"(b), [c] "r"(c), [d] "r"(*d) 165| | : "cc"); 166| | 167| | *d = hi; 168| | return lo; 169| | } 170| |#endif 171| | 172| 0| typedef typename WordInfo::dword dword; 173| 0| const dword s = dword(a) * b + c + *d; 174| 0| *d = static_cast(s >> WordInfo::bits); 175| 0| return static_cast(s); 176| 304|} _ZN5Botan10word8_add2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_: 268| 1.91k|inline constexpr auto word8_add2(W x[8], const W y[8], W carry) -> W { 269| 1.91k|#if defined(BOTAN_MP_USE_X86_64_ASM) 270| 1.91k| if(std::same_as && !std::is_constant_evaluated()) { ------------------ | Branch (270:7): [True: 0, Folded] | Branch (270:36): [True: 0, Folded] ------------------ 271| 1.91k| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq")) 272| 1.91k| : [carry] "=r"(carry) 273| 1.91k| : [x] "r"(x), [y] "r"(y), "0"(carry) 274| 1.91k| : "cc", "memory"); 275| 1.91k| return carry; 276| 1.91k| } 277| 0|#endif 278| | 279| 0| x[0] = word_add(x[0], y[0], &carry); 280| 0| x[1] = word_add(x[1], y[1], &carry); 281| 0| x[2] = word_add(x[2], y[2], &carry); 282| 0| x[3] = word_add(x[3], y[3], &carry); 283| 0| x[4] = word_add(x[4], y[4], &carry); 284| 0| x[5] = word_add(x[5], y[5], &carry); 285| 0| x[6] = word_add(x[6], y[6], &carry); 286| 0| x[7] = word_add(x[7], y[7], &carry); 287| 0| return carry; 288| 1.91k|} _ZN5Botan10word8_sub2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_: 345| 118|inline constexpr auto word8_sub2(W x[8], const W y[8], W carry) -> W { 346| 118|#if defined(BOTAN_MP_USE_X86_64_ASM) 347| 118| if(std::same_as && !std::is_constant_evaluated()) { ------------------ | Branch (347:7): [True: 0, Folded] | Branch (347:36): [True: 0, Folded] ------------------ 348| 118| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq")) 349| 118| : [carry] "=r"(carry) 350| 118| : [x] "r"(x), [y] "r"(y), "0"(carry) 351| 118| : "cc", "memory"); 352| 118| return carry; 353| 118| } 354| 0|#endif 355| | 356| 0| x[0] = word_sub(x[0], y[0], &carry); 357| 0| x[1] = word_sub(x[1], y[1], &carry); 358| 0| x[2] = word_sub(x[2], y[2], &carry); 359| 0| x[3] = word_sub(x[3], y[3], &carry); 360| 0| x[4] = word_sub(x[4], y[4], &carry); 361| 0| x[5] = word_sub(x[5], y[5], &carry); 362| 0| x[6] = word_sub(x[6], y[6], &carry); 363| 0| x[7] = word_sub(x[7], y[7], &carry); 364| 0| return carry; 365| 118|} _ZN5Botan5word3ImEC2Ev: 458| 20.1M| constexpr word3() : m_w(0) {} _ZN5Botan5word3ImE3mulEmm: 460| 603M| inline constexpr void mul(W x, W y) { m_w += static_cast(x) * y; } _ZN5Botan5word3ImE7extractEv: 466| 222M| inline constexpr W extract() { 467| 222M| W r = static_cast(m_w); 468| 222M| m_w >>= WordInfo::bits; 469| 222M| return r; 470| 222M| } _ZN5Botan5word3ImE6mul_x2Emm: 462| 144M| inline constexpr void mul_x2(W x, W y) { m_w += static_cast(x) * y * 2; } _ZN5Botan5word3ImE3addEm: 464| 82.2M| inline constexpr void add(W x) { m_w += x; } _ZN5Botan5word3ImE10monty_stepEmm: 472| 41.1M| inline constexpr W monty_step(W p0, W p_dash) { 473| 41.1M| const W w0 = static_cast(m_w); 474| 41.1M| const W r = w0 * p_dash; 475| 41.1M| mul(r, p0); 476| 41.1M| m_w >>= WordInfo::bits; 477| 41.1M| return r; 478| 41.1M| } _ZN5Botan11bigint_add3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m: 120| 12|inline constexpr auto bigint_add3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W { 121| 12| if(x_size < y_size) { ------------------ | Branch (121:7): [True: 0, False: 12] ------------------ 122| 0| return bigint_add3(z, y, y_size, x, x_size); 123| 0| } 124| | 125| 12| W carry = 0; 126| | 127| 12| const size_t blocks = y_size - (y_size % 8); 128| | 129| 16| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (129:22): [True: 4, False: 12] ------------------ 130| 4| carry = word8_add3(z + i, x + i, y + i, carry); 131| 4| } 132| | 133| 54| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (133:27): [True: 42, False: 12] ------------------ 134| 42| z[i] = word_add(x[i], y[i], &carry); 135| 42| } 136| | 137| 12| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (137:27): [True: 0, False: 12] ------------------ 138| 0| z[i] = word_add(x[i], static_cast(0), &carry); 139| 0| } 140| | 141| 12| return carry; 142| 12|} _ZN5Botan10bigint_cmpITkNS_8WordTypeEmEEiPKT_mS3_m: 439| 31.6k|inline constexpr int32_t bigint_cmp(const W x[], size_t x_size, const W y[], size_t y_size) { 440| 31.6k| static_assert(sizeof(W) >= sizeof(uint32_t), "Size assumption"); 441| | 442| 31.6k| const W LT = static_cast(-1); 443| 31.6k| const W EQ = 0; 444| 31.6k| const W GT = 1; 445| | 446| 31.6k| const size_t common_elems = std::min(x_size, y_size); 447| | 448| 31.6k| W result = EQ; // until found otherwise 449| | 450| 224k| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (450:22): [True: 192k, False: 31.6k] ------------------ 451| 192k| const auto is_eq = CT::Mask::is_equal(x[i], y[i]); 452| 192k| const auto is_lt = CT::Mask::is_lt(x[i], y[i]); 453| | 454| 192k| result = is_eq.select(result, is_lt.select(LT, GT)); 455| 192k| } 456| | 457| 31.6k| if(x_size < y_size) { ------------------ | Branch (457:7): [True: 4, False: 31.6k] ------------------ 458| 4| W mask = 0; 459| 8| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (459:30): [True: 4, False: 4] ------------------ 460| 4| mask |= y[i]; 461| 4| } 462| | 463| | // If any bits were set in high part of y, then x < y 464| 4| result = CT::Mask::is_zero(mask).select(result, LT); 465| 31.6k| } else if(y_size < x_size) { ------------------ | Branch (465:14): [True: 23, False: 31.5k] ------------------ 466| 23| W mask = 0; 467| 71| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (467:30): [True: 48, False: 23] ------------------ 468| 48| mask |= x[i]; 469| 48| } 470| | 471| | // If any bits were set in high part of x, then x > y 472| 23| result = CT::Mask::is_zero(mask).select(result, GT); 473| 23| } 474| | 475| 31.6k| CT::unpoison(result); 476| 31.6k| BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ); ------------------ | | 130| 31.6k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 31.6k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 31.6k] | | ------------------ ------------------ 477| 31.6k| return static_cast(result); 478| 31.6k|} _ZN5Botan11bigint_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m: 192| 2.50k|inline constexpr auto bigint_sub3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W { 193| 2.50k| W borrow = 0; 194| | 195| 2.50k| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 64| 2.50k| do { \ | | 65| 2.50k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 2.50k| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 2.50k] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 2.50k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 2.50k] | | ------------------ ------------------ 196| | 197| 2.50k| const size_t blocks = y_size - (y_size % 8); 198| | 199| 3.64k| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (199:22): [True: 1.13k, False: 2.50k] ------------------ 200| 1.13k| borrow = word8_sub3(z + i, x + i, y + i, borrow); 201| 1.13k| } 202| | 203| 10.1k| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (203:27): [True: 7.67k, False: 2.50k] ------------------ 204| 7.67k| z[i] = word_sub(x[i], y[i], &borrow); 205| 7.67k| } 206| | 207| 2.64k| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (207:27): [True: 145, False: 2.50k] ------------------ 208| 145| z[i] = word_sub(x[i], static_cast(0), &borrow); 209| 145| } 210| | 211| 2.50k| return borrow; 212| 2.50k|} _ZN5Botan14bigint_linmul3ITkNS_8WordTypeEmEEvPT_PKS1_mS1_: 416| 84|inline constexpr void bigint_linmul3(W z[], const W x[], size_t x_size, W y) { 417| 84| const size_t blocks = x_size - (x_size % 8); 418| | 419| 84| W carry = 0; 420| | 421| 135| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (421:22): [True: 51, False: 84] ------------------ 422| 51| carry = word8_linmul3(z + i, x + i, y, carry); 423| 51| } 424| | 425| 427| for(size_t i = blocks; i != x_size; ++i) { ------------------ | Branch (425:27): [True: 343, False: 84] ------------------ 426| 343| z[i] = word_madd2(x[i], y, &carry); 427| 343| } 428| | 429| 84| z[x_size] = carry; 430| 84|} _ZN5Botan14divide_precompImEC2Em: 574| 18| explicit constexpr divide_precomp(W divisor) : m_divisor(divisor) { 575| 18| BOTAN_ARG_CHECK(m_divisor != 0, "Division by zero"); ------------------ | | 35| 18| do { \ | | 36| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18] | | ------------------ ------------------ 576| 18| } _ZNK5Botan14divide_precompImE16vartime_div_2to1Emm: 581| 129| inline constexpr W vartime_div_2to1(W n1, W n0) const { 582| 129| BOTAN_ASSERT_NOMSG(n1 < m_divisor); ------------------ | | 77| 129| do { \ | | 78| 129| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 129| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 129] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 129| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 129] | | ------------------ ------------------ 583| | 584| 129| if(m_divisor == WordInfo::max) { ------------------ | Branch (584:13): [True: 51, False: 78] ------------------ 585| 51| return vartime_div_2to1_max_d(n1, n0); 586| 51| } 587| | 588| 78| if(m_divisor == WordInfo::top_bit) { ------------------ | Branch (588:13): [True: 0, False: 78] ------------------ 589| | // Simply a shift by N-1 bits 590| 0| return (n1 << 1) | (n0 >> (WordInfo::bits - 1)); 591| 0| } 592| | 593| 78| if(!std::is_constant_evaluated()) { ------------------ | Branch (593:13): [True: 78, Folded] ------------------ 594| 78|#if defined(BOTAN_MP_USE_X86_64_ASM) 595| 78| if constexpr(std::same_as) { 596| 78| W quotient = 0; 597| 78| W remainder = 0; 598| | // NOLINTNEXTLINE(*-no-assembler) 599| 78| asm("divq %[v]" : "=a"(quotient), "=d"(remainder) : [v] "r"(m_divisor), "a"(n0), "d"(n1) : "cc"); 600| 78| return quotient; 601| 78| } 602| 0|#endif 603| | 604| 0|#if !defined(BOTAN_BUILD_COMPILER_IS_CLANGCL) 605| | 606| | /* clang-cl has a bug where on encountering a 128/64 division it emits 607| | * a call to __udivti3() but then fails to link the relevant builtin into 608| | * the binary, causing a link failure. Work around this by simply omitting 609| | * such code for clang-cl 610| | * 611| | * See https://github.com/llvm/llvm-project/issues/25679 612| | */ 613| 78| if constexpr(WordInfo::dword_is_native) { 614| 78| typename WordInfo::dword n = n1; 615| 78| n <<= WordInfo::bits; 616| 78| n |= n0; 617| 78| return static_cast(n / m_divisor); 618| 78| } 619| 78|#endif 620| 78| } 621| | 622| 0| W high = n1; 623| 78| W quotient = 0; 624| | 625| 78| for(size_t i = 0; i != WordInfo::bits; ++i) { ------------------ | Branch (625:28): [True: 0, False: 78] ------------------ 626| 0| const W high_top_bit = high >> (WordInfo::bits - 1); 627| | 628| 0| high <<= 1; 629| 0| high |= (n0 >> (WordInfo::bits - 1 - i)) & 1; 630| 0| quotient <<= 1; 631| | 632| 0| if(high_top_bit || high >= m_divisor) { ------------------ | Branch (632:16): [True: 0, False: 0] | Branch (632:32): [True: 0, False: 0] ------------------ 633| 0| high -= m_divisor; 634| 0| quotient |= 1; 635| 0| } 636| 0| } 637| | 638| 78| return quotient; 639| 78| } _ZN5Botan14divide_precompImE22vartime_div_2to1_max_dEmm: 657| 51| static inline constexpr W vartime_div_2to1_max_d(W n1, W n0) { 658| | /* 659| | Use k to refer to WordInfo::bits 660| | 661| | We are dividing n = (n1 * 2^k) + n0 by 2^k - 1 662| | 663| | Recall that 2^k = 1 (mod 2^k - 1) 664| | 665| | Rewrite n = n1*2^k + n0 as n1*(2^k - 1) + n1 + n0 666| | 667| | The result of dividing n by (2^k - 1) will be equal to 668| | (n1*(2^k-1) + n1 + n0) / (2^k-1) = 669| | n1 + ((n1 + n0) / (2^k-1) 670| | 671| | Use c to refer to ((n1 + n0) / (2^k-1)) 672| | 673| | If (n1 + n0) < (2^k - 1) then c is 0 674| | If (n1 + n0) >= (2^k - 1) then c is 1 675| | 676| | Since n1 < 2^k - 1 [*] and n0 <= 2^k - 1 it is impossible for (n1 + n0) / (2^k -1) 677| | to be greater than 1. 678| | 679| | [*] We require n1 be strictly less than the divisor to ensure that the 680| | output fits in a single word; this is checked at the start of vartime_div_2to1. 681| | */ 682| | 683| 51| const W s = n0 + n1; 684| | // did n0 + n1 overflow? or does (n0 + n1) == 2^k - 1? if either, c == 1 685| 51| if(s < n0 || s == WordInfo::max) { ------------------ | Branch (685:13): [True: 5, False: 46] | Branch (685:23): [True: 0, False: 46] ------------------ 686| 5| n1 += 1; 687| 5| } 688| | 689| 51| return n1; 690| 51| } _ZN5Botan11bigint_shl2ITkNS_8WordTypeEmEEvPT_mPKS1_mm: 355| 18|inline constexpr void bigint_shl2(W y[], size_t y_size, const W x[], size_t x_size, size_t shift) { 356| 18| const size_t word_shift = shift / WordInfo::bits; 357| 18| const size_t bit_shift = shift % WordInfo::bits; 358| | 359| 18| BOTAN_ASSERT_NOMSG(word_shift <= y_size); ------------------ | | 77| 18| do { \ | | 78| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 18| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 18] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 18| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 18] | | ------------------ ------------------ 360| 18| BOTAN_ASSERT_NOMSG(x_size < y_size - word_shift); ------------------ | | 77| 18| do { \ | | 78| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 18| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 18] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 18| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 18] | | ------------------ ------------------ 361| | 362| 18| unchecked_copy_memory(y + word_shift, x, x_size); 363| 18| zeroize_buffer(y, word_shift); 364| 18| zeroize_buffer(y + word_shift + x_size, y_size - word_shift - x_size); 365| | 366| 18| const auto carry_mask = CT::Mask::expand(bit_shift); 367| 18| const W carry_shift = carry_mask.if_set_return(WordInfo::bits - bit_shift); 368| | 369| 18| W carry = 0; 370| 147| for(size_t i = word_shift; i != x_size + word_shift + 1; ++i) { ------------------ | Branch (370:31): [True: 129, False: 18] ------------------ 371| 129| const W w = y[i]; 372| 129| y[i] = (w << bit_shift) | carry; 373| 129| carry = carry_mask.if_set_return(w >> carry_shift); 374| 129| } 375| 18|} _ZN5Botan17bigint_monty_redcEPmPKmS2_mmS0_m: 924| 21.0k| word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) { 925| 21.0k| const size_t z_size = 2 * p_size; 926| | 927| 21.0k| BOTAN_ARG_CHECK(ws_size >= p_size, "Montgomery reduction workspace too small"); ------------------ | | 35| 21.0k| do { \ | | 36| 21.0k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 21.0k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 21.0k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 21.0k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 21.0k] | | ------------------ ------------------ 928| | 929| 21.0k| if(p_size == 4) { ------------------ | Branch (929:7): [True: 16.2k, False: 4.80k] ------------------ 930| 16.2k| bigint_monty_redc_4(r, z, p, p_dash, ws); 931| 16.2k| } else if(p_size == 6) { ------------------ | Branch (931:14): [True: 1.90k, False: 2.89k] ------------------ 932| 1.90k| bigint_monty_redc_6(r, z, p, p_dash, ws); 933| 2.89k| } else if(p_size == 8) { ------------------ | Branch (933:14): [True: 1.33k, False: 1.56k] ------------------ 934| 1.33k| bigint_monty_redc_8(r, z, p, p_dash, ws); 935| 1.56k| } else if(p_size == 12) { ------------------ | Branch (935:14): [True: 0, False: 1.56k] ------------------ 936| 0| bigint_monty_redc_12(r, z, p, p_dash, ws); 937| 1.56k| } else if(p_size == 16) { ------------------ | Branch (937:14): [True: 0, False: 1.56k] ------------------ 938| 0| bigint_monty_redc_16(r, z, p, p_dash, ws); 939| 1.56k| } else if(p_size == 24) { ------------------ | Branch (939:14): [True: 0, False: 1.56k] ------------------ 940| 0| bigint_monty_redc_24(r, z, p, p_dash, ws); 941| 1.56k| } else if(p_size == 32) { ------------------ | Branch (941:14): [True: 0, False: 1.56k] ------------------ 942| 0| bigint_monty_redc_32(r, z, p, p_dash, ws); 943| 1.56k| } else { 944| 1.56k| bigint_monty_redc_generic(r, z, z_size, p, p_size, p_dash, ws); 945| 1.56k| } 946| 21.0k|} _ZN5Botan25bigint_monty_redc_inplaceEPmPKmmmS0_m: 948| 21.0k|inline void bigint_monty_redc_inplace(word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) { 949| 21.0k| bigint_monty_redc(z, z, p, p_size, p_dash, ws, ws_size); 950| 21.0k| zeroize_buffer(z + p_size, p_size); 951| 21.0k|} _ZN5Botan15bigint_ct_is_eqITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_m: 519| 12|inline constexpr auto bigint_ct_is_eq(const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask { 520| 12| const size_t common_elems = std::min(x_size, y_size); 521| | 522| 12| W diff = 0; 523| | 524| 166| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (524:22): [True: 154, False: 12] ------------------ 525| 154| diff |= (x[i] ^ y[i]); 526| 154| } 527| | 528| | // If any bits were set in high part of x/y, then they are not equal 529| 12| if(x_size < y_size) { ------------------ | Branch (529:7): [True: 1, False: 11] ------------------ 530| 9| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (530:30): [True: 8, False: 1] ------------------ 531| 8| diff |= y[i]; 532| 8| } 533| 11| } else if(y_size < x_size) { ------------------ | Branch (533:14): [True: 0, False: 11] ------------------ 534| 0| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (534:30): [True: 0, False: 0] ------------------ 535| 0| diff |= x[i]; 536| 0| } 537| 0| } 538| | 539| 12| return CT::Mask::is_zero(diff); 540| 12|} _ZN5Botan15bigint_ct_is_ltITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_mb: 487| 50.1k| -> CT::Mask { 488| 50.1k| const size_t common_elems = std::min(x_size, y_size); 489| | 490| 50.1k| auto is_lt = CT::Mask::expand(lt_or_equal); 491| | 492| 311k| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (492:22): [True: 260k, False: 50.1k] ------------------ 493| 260k| const auto eq = CT::Mask::is_equal(x[i], y[i]); 494| 260k| const auto lt = CT::Mask::is_lt(x[i], y[i]); 495| 260k| is_lt = eq.select_mask(is_lt, lt); 496| 260k| } 497| | 498| 50.1k| if(x_size < y_size) { ------------------ | Branch (498:7): [True: 0, False: 50.1k] ------------------ 499| 0| W mask = 0; 500| 0| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (500:30): [True: 0, False: 0] ------------------ 501| 0| mask |= y[i]; 502| 0| } 503| | // If any bits were set in high part of y, then is_lt should be forced true 504| 0| is_lt |= CT::Mask::expand(mask); 505| 50.1k| } else if(y_size < x_size) { ------------------ | Branch (505:14): [True: 49, False: 50.0k] ------------------ 506| 49| W mask = 0; 507| 388| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (507:30): [True: 339, False: 49] ------------------ 508| 339| mask |= x[i]; 509| 339| } 510| | 511| | // If any bits were set in high part of x, then is_lt should be false 512| 49| is_lt &= CT::Mask::is_zero(mask); 513| 49| } 514| | 515| 50.1k| return is_lt; 516| 50.1k|} _ZN5Botan11bigint_shl1ITkNS_8WordTypeEmEEvPT_mmm: 309| 3|inline constexpr void bigint_shl1(W x[], size_t x_size, size_t x_words, size_t shift) { 310| 3| const size_t word_shift = shift / WordInfo::bits; 311| 3| const size_t bit_shift = shift % WordInfo::bits; 312| | 313| 3| BOTAN_ASSERT_NOMSG(word_shift <= x_size); ------------------ | | 77| 3| do { \ | | 78| 3| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 3| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 3] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 3| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 3] | | ------------------ ------------------ 314| 3| BOTAN_ASSERT_NOMSG(x_words <= x_size - word_shift); ------------------ | | 77| 3| do { \ | | 78| 3| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 3| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 3] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 3| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 3] | | ------------------ ------------------ 315| | 316| 3| unchecked_copy_memory(x + word_shift, x, x_words); 317| 3| zeroize_buffer(x, word_shift); 318| | 319| 3| const auto carry_mask = CT::Mask::expand(bit_shift); 320| 3| const W carry_shift = carry_mask.if_set_return(WordInfo::bits - bit_shift); 321| | 322| 3| W carry = 0; 323| 33| for(size_t i = word_shift; i != x_size; ++i) { ------------------ | Branch (323:31): [True: 30, False: 3] ------------------ 324| 30| const W w = x[i]; 325| 30| x[i] = (w << bit_shift) | carry; 326| 30| carry = carry_mask.if_set_return(w >> carry_shift); 327| 30| } 328| 3|} _ZN5Botan14bigint_sub_absITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPS3_PKS3_S7_mS5_: 279| 48|inline constexpr auto bigint_sub_abs(W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask { 280| | // Subtract in both direction then conditional copy out the result 281| | 282| 48| W* ws0 = ws; 283| 48| W* ws1 = ws + N; 284| | 285| 48| W borrow0 = 0; 286| 48| W borrow1 = 0; 287| | 288| 48| const size_t blocks = N - (N % 8); 289| | 290| 64| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (290:22): [True: 16, False: 48] ------------------ 291| 16| borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0); 292| 16| borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1); 293| 16| } 294| | 295| 264| for(size_t i = blocks; i != N; ++i) { ------------------ | Branch (295:27): [True: 216, False: 48] ------------------ 296| 216| ws0[i] = word_sub(x[i], y[i], &borrow0); 297| 216| ws1[i] = word_sub(y[i], x[i], &borrow1); 298| 216| } 299| | 300| 48| return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N); 301| 48|} _ZN5Botan11bigint_add2ITkNS_8WordTypeEmEET_PS1_mPKS1_m: 94| 5.58k|inline constexpr auto bigint_add2(W x[], size_t x_size, const W y[], size_t y_size) -> W { 95| 5.58k| W carry = 0; 96| | 97| 5.58k| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 64| 5.58k| do { \ | | 65| 5.58k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 5.58k| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 5.58k] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 5.58k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 5.58k] | | ------------------ ------------------ 98| | 99| 5.58k| const size_t blocks = y_size - (y_size % 8); 100| | 101| 7.50k| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (101:22): [True: 1.91k, False: 5.58k] ------------------ 102| 1.91k| carry = word8_add2(x + i, y + i, carry); 103| 1.91k| } 104| | 105| 24.1k| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (105:27): [True: 18.5k, False: 5.58k] ------------------ 106| 18.5k| x[i] = word_add(x[i], y[i], &carry); 107| 18.5k| } 108| | 109| 31.0k| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (109:27): [True: 25.4k, False: 5.58k] ------------------ 110| 25.4k| x[i] = word_add(x[i], static_cast(0), &carry); 111| 25.4k| } 112| | 113| 5.58k| return carry; 114| 5.58k|} _ZN5Botan11bigint_sub2ITkNS_8WordTypeEmEET_PS1_mPKS1_m: 148| 149|inline constexpr auto bigint_sub2(W x[], size_t x_size, const W y[], size_t y_size) -> W { 149| 149| W borrow = 0; 150| | 151| 149| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 64| 149| do { \ | | 65| 149| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 149| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 149] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 149| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 149] | | ------------------ ------------------ 152| | 153| 149| const size_t blocks = y_size - (y_size % 8); 154| | 155| 267| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (155:22): [True: 118, False: 149] ------------------ 156| 118| borrow = word8_sub2(x + i, y + i, borrow); 157| 118| } 158| | 159| 616| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (159:27): [True: 467, False: 149] ------------------ 160| 467| x[i] = word_sub(x[i], y[i], &borrow); 161| 467| } 162| | 163| 166| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (163:27): [True: 17, False: 149] ------------------ 164| 17| x[i] = word_sub(x[i], static_cast(0), &borrow); 165| 17| } 166| | 167| 149| return borrow; 168| 149|} _ZN5Botan11bigint_shr1ITkNS_8WordTypeEmEEvPT_mm: 331| 129|inline constexpr void bigint_shr1(W x[], size_t x_size, size_t shift) { 332| 129| const size_t word_shift = shift / WordInfo::bits; 333| 129| const size_t bit_shift = shift % WordInfo::bits; 334| | 335| 129| const size_t top = x_size >= word_shift ? (x_size - word_shift) : 0; ------------------ | Branch (335:23): [True: 129, False: 0] ------------------ 336| | 337| 129| if(top > 0) { ------------------ | Branch (337:7): [True: 129, False: 0] ------------------ 338| 129| unchecked_copy_memory(x, x + word_shift, top); 339| 129| } 340| 129| zeroize_buffer(x + top, std::min(word_shift, x_size)); 341| | 342| 129| const auto carry_mask = CT::Mask::expand(bit_shift); 343| 129| const W carry_shift = carry_mask.if_set_return(WordInfo::bits - bit_shift); 344| | 345| 129| W carry = 0; 346| | 347| 2.52k| for(size_t i = 0; i != top; ++i) { ------------------ | Branch (347:22): [True: 2.39k, False: 129] ------------------ 348| 2.39k| const W w = x[top - i - 1]; 349| 2.39k| x[top - i - 1] = (w >> bit_shift) | carry; 350| 2.39k| carry = carry_mask.if_set_return(w << carry_shift); 351| 2.39k| } 352| 129|} _ZN5Botan13monty_inverseITkNS_8WordTypeEmEET_S1_: 703| 6|inline constexpr auto monty_inverse(W a) -> W { 704| 6| BOTAN_ARG_CHECK(a % 2 == 1, "Cannot compute Montgomery inverse of an even integer"); ------------------ | | 35| 6| do { \ | | 36| 6| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 6| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 6] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 6| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 6] | | ------------------ ------------------ 705| | 706| | // Newton's Method, following https://lemire.me/blog/2017/09/18/computing-the-inverse-of-odd-integers/ 707| | 708| 6| constexpr size_t iter = WordInfo::bits == 64 ? 4 : 3; ------------------ | Branch (708:28): [True: 0, Folded] ------------------ 709| | 710| | // Initial guess provides 5 bits of accuracy 711| 6| W r = (3 * a) ^ 2; 712| | 713| | // Each iteration doubles the accuracy 714| 30| for(size_t i = 0; i != iter; ++i) { ------------------ | Branch (714:22): [True: 24, False: 6] ------------------ 715| 24| r = r * (2 - r * a); 716| 24| } 717| | 718| | // Now invert in addition space 719| 6| r = (WordInfo::max - r) + 1; 720| | 721| 6| return r; 722| 6|} _ZN5Botan22bigint_monty_maybe_subITkNS_8WordTypeEmEEvmPT_S1_PKS1_S4_: 225| 1.56k|inline constexpr void bigint_monty_maybe_sub(size_t N, W z[], W x0, const W x[], const W p[]) { 226| 1.56k| W borrow = 0; 227| | 228| 1.56k| const size_t blocks = N - (N % 8); 229| | 230| 3.12k| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (230:22): [True: 1.56k, False: 1.56k] ------------------ 231| 1.56k| borrow = word8_sub3(z + i, x + i, p + i, borrow); 232| 1.56k| } 233| | 234| 3.12k| for(size_t i = blocks; i != N; ++i) { ------------------ | Branch (234:27): [True: 1.56k, False: 1.56k] ------------------ 235| 1.56k| z[i] = word_sub(x[i], p[i], &borrow); 236| 1.56k| } 237| | 238| 1.56k| borrow = (x0 - borrow) > x0; 239| | 240| 1.56k| CT::conditional_assign_mem(borrow, z, x, N); 241| 1.56k|} _ZN5Botan9comba_sqrILm4ETkNS_8WordTypeEmEEvPT0_PKS1_: 854| 2.19M|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 855| 2.19M| if(!std::is_constant_evaluated()) { ------------------ | Branch (855:7): [True: 2.19M, Folded] ------------------ 856| 2.19M| if constexpr(std::same_as && N == 4) { 857| 2.19M| return bigint_comba_sqr4(z, x); 858| 2.19M| } 859| | if constexpr(std::same_as && N == 6) { 860| | return bigint_comba_sqr6(z, x); 861| | } 862| | if constexpr(std::same_as && N == 7) { 863| | return bigint_comba_sqr7(z, x); 864| | } 865| | if constexpr(std::same_as && N == 8) { 866| | return bigint_comba_sqr8(z, x); 867| | } 868| | if constexpr(std::same_as && N == 9) { 869| | return bigint_comba_sqr9(z, x); 870| | } 871| | if constexpr(std::same_as && N == 16) { 872| | return bigint_comba_sqr16(z, x); 873| | } 874| 2.19M| } 875| | 876| 0| word3 accum; 877| | 878| 2.19M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (878:22): [True: 0, False: 2.19M] ------------------ 879| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (879:28): [True: 0, False: 0] ------------------ 880| 0| const size_t end = std::min(N, i + 1); 881| | 882| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (882:29): [True: 0, False: 0] ------------------ 883| 0| accum.mul(x[j], x[i - j]); 884| 0| } 885| 0| z[i] = accum.extract(); 886| 0| } 887| 2.19M|} _ZN5Botan22bigint_monty_maybe_subILm4ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 254| 3.90M|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 255| 3.90M| W borrow = 0; 256| | 257| 19.5M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (257:22): [True: 15.6M, False: 3.90M] ------------------ 258| 15.6M| z[i] = word_sub(x[i], y[i], &borrow); 259| 15.6M| } 260| | 261| 3.90M| borrow = (x0 - borrow) > x0; 262| | 263| 3.90M| CT::conditional_assign_mem(borrow, z, x, N); 264| 3.90M|} _ZN5Botan9comba_mulILm4ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 818| 1.98M|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 819| 1.98M| if(!std::is_constant_evaluated()) { ------------------ | Branch (819:7): [True: 1.98M, Folded] ------------------ 820| 1.98M| if constexpr(std::same_as && N == 4) { 821| 1.98M| return bigint_comba_mul4(z, x, y); 822| 1.98M| } 823| | if constexpr(std::same_as && N == 6) { 824| | return bigint_comba_mul6(z, x, y); 825| | } 826| | if constexpr(std::same_as && N == 7) { 827| | return bigint_comba_mul7(z, x, y); 828| | } 829| | if constexpr(std::same_as && N == 8) { 830| | return bigint_comba_mul8(z, x, y); 831| | } 832| | if constexpr(std::same_as && N == 9) { 833| | return bigint_comba_mul9(z, x, y); 834| | } 835| | if constexpr(std::same_as && N == 16) { 836| | return bigint_comba_mul16(z, x, y); 837| | } 838| 1.98M| } 839| | 840| 0| word3 accum; 841| | 842| 1.98M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (842:22): [True: 0, False: 1.98M] ------------------ 843| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (843:28): [True: 0, False: 0] ------------------ 844| 0| const size_t end = std::min(N, i + 1); 845| | 846| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (846:29): [True: 0, False: 0] ------------------ 847| 0| accum.mul(x[j], y[i - j]); 848| 0| } 849| 0| z[i] = accum.extract(); 850| 0| } 851| 1.98M|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE: 725| 736k|inline constexpr W shift_left(std::array& x) { 726| 736k| static_assert(N >= 1, "Invalid input size"); 727| 736k| static_assert(S > 0, "Zero shift not supported"); 728| 736k| static_assert(S < WordInfo::bits, "Shift too large"); 729| | 730| 736k| const W carry = x[N - 1] >> (WordInfo::bits - S); 731| | 732| 2.94M| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (732:26): [True: 2.20M, False: 736k] ------------------ 733| 2.20M| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 734| 2.20M| } 735| 736k| x[0] <<= S; 736| | 737| 736k| return carry; 738| 736k|} _ZN5Botan16read_window_bitsILm4EmLm4EEEmNSt3__14spanIKT0_XT1_EEEm: 1071| 138k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1072| 138k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1073| | 1074| 138k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1075| | 1076| 138k| constexpr size_t W_bits = sizeof(W) * 8; 1077| 138k| const auto bit_shift = offset % W_bits; 1078| 138k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1079| | 1080| 138k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1080:36): [True: 138k, False: 0] | Branch (1080:74): [True: 0, False: 0] ------------------ 1081| | 1082| 138k| const auto w0 = words[word_offset]; 1083| | 1084| 138k| if(single_byte_window) { ------------------ | Branch (1084:7): [True: 138k, False: 0] ------------------ 1085| 138k| return (w0 >> bit_shift) & WindowMask; 1086| 138k| } else { 1087| | // Otherwise we must join two words and extract the result 1088| 0| const auto w1 = words[word_offset - 1]; 1089| 0| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1090| 0| return combined & WindowMask; 1091| 0| } 1092| 138k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE: 741| 43.7k|inline constexpr W shift_right(std::array& x) { 742| 43.7k| static_assert(N >= 1, "Invalid input size"); 743| 43.7k| static_assert(S > 0, "Zero shift not supported"); 744| 43.7k| static_assert(S < WordInfo::bits, "Shift too large"); 745| | 746| 43.7k| const W carry = x[0] << (WordInfo::bits - S); 747| | 748| 174k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (748:22): [True: 131k, False: 43.7k] ------------------ 749| 131k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 750| 131k| } 751| 43.7k| x[N - 1] >>= S; 752| | 753| 43.7k| return carry; 754| 43.7k|} _ZN5Botan16read_window_bitsILm7EhLm18446744073709551615EEEmNSt3__14spanIKT0_XT1_EEEm: 1071| 185k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1072| 185k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1073| | 1074| 185k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1075| | 1076| 185k| constexpr size_t W_bits = sizeof(W) * 8; 1077| 185k| const auto bit_shift = offset % W_bits; 1078| 185k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1079| | 1080| 185k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1080:36): [True: 48.3k, False: 137k] | Branch (1080:74): [True: 0, False: 137k] ------------------ 1081| | 1082| 185k| const auto w0 = words[word_offset]; 1083| | 1084| 185k| if(single_byte_window) { ------------------ | Branch (1084:7): [True: 48.3k, False: 137k] ------------------ 1085| 48.3k| return (w0 >> bit_shift) & WindowMask; 1086| 137k| } else { 1087| | // Otherwise we must join two words and extract the result 1088| 137k| const auto w1 = words[word_offset - 1]; 1089| 137k| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1090| 137k| return combined & WindowMask; 1091| 137k| } 1092| 185k|} _ZN5Botan16read_window_bitsILm6EhLm18446744073709551615EEEmNSt3__14spanIKT0_XT1_EEEm: 1071| 137k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1072| 137k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1073| | 1074| 137k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1075| | 1076| 137k| constexpr size_t W_bits = sizeof(W) * 8; 1077| 137k| const auto bit_shift = offset % W_bits; 1078| 137k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1079| | 1080| 137k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1080:36): [True: 51.9k, False: 85.0k] | Branch (1080:74): [True: 0, False: 85.0k] ------------------ 1081| | 1082| 137k| const auto w0 = words[word_offset]; 1083| | 1084| 137k| if(single_byte_window) { ------------------ | Branch (1084:7): [True: 51.9k, False: 85.0k] ------------------ 1085| 51.9k| return (w0 >> bit_shift) & WindowMask; 1086| 85.0k| } else { 1087| | // Otherwise we must join two words and extract the result 1088| 85.0k| const auto w1 = words[word_offset - 1]; 1089| 85.0k| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1090| 85.0k| return combined & WindowMask; 1091| 85.0k| } 1092| 137k|} _ZN5Botan9comba_sqrILm6ETkNS_8WordTypeEmEEvPT0_PKS1_: 854| 1.60M|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 855| 1.60M| if(!std::is_constant_evaluated()) { ------------------ | Branch (855:7): [True: 1.60M, Folded] ------------------ 856| | if constexpr(std::same_as && N == 4) { 857| | return bigint_comba_sqr4(z, x); 858| | } 859| 1.60M| if constexpr(std::same_as && N == 6) { 860| 1.60M| return bigint_comba_sqr6(z, x); 861| 1.60M| } 862| | if constexpr(std::same_as && N == 7) { 863| | return bigint_comba_sqr7(z, x); 864| | } 865| | if constexpr(std::same_as && N == 8) { 866| | return bigint_comba_sqr8(z, x); 867| | } 868| | if constexpr(std::same_as && N == 9) { 869| | return bigint_comba_sqr9(z, x); 870| | } 871| | if constexpr(std::same_as && N == 16) { 872| | return bigint_comba_sqr16(z, x); 873| | } 874| 1.60M| } 875| | 876| 0| word3 accum; 877| | 878| 1.60M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (878:22): [True: 0, False: 1.60M] ------------------ 879| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (879:28): [True: 0, False: 0] ------------------ 880| 0| const size_t end = std::min(N, i + 1); 881| | 882| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (882:29): [True: 0, False: 0] ------------------ 883| 0| accum.mul(x[j], x[i - j]); 884| 0| } 885| 0| z[i] = accum.extract(); 886| 0| } 887| 1.60M|} _ZN5Botan22bigint_monty_maybe_subILm6ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 254| 2.22M|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 255| 2.22M| W borrow = 0; 256| | 257| 15.5M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (257:22): [True: 13.3M, False: 2.22M] ------------------ 258| 13.3M| z[i] = word_sub(x[i], y[i], &borrow); 259| 13.3M| } 260| | 261| 2.22M| borrow = (x0 - borrow) > x0; 262| | 263| 2.22M| CT::conditional_assign_mem(borrow, z, x, N); 264| 2.22M|} _ZN5Botan9comba_mulILm6ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 818| 1.40M|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 819| 1.40M| if(!std::is_constant_evaluated()) { ------------------ | Branch (819:7): [True: 1.40M, Folded] ------------------ 820| | if constexpr(std::same_as && N == 4) { 821| | return bigint_comba_mul4(z, x, y); 822| | } 823| 1.40M| if constexpr(std::same_as && N == 6) { 824| 1.40M| return bigint_comba_mul6(z, x, y); 825| 1.40M| } 826| | if constexpr(std::same_as && N == 7) { 827| | return bigint_comba_mul7(z, x, y); 828| | } 829| | if constexpr(std::same_as && N == 8) { 830| | return bigint_comba_mul8(z, x, y); 831| | } 832| | if constexpr(std::same_as && N == 9) { 833| | return bigint_comba_mul9(z, x, y); 834| | } 835| | if constexpr(std::same_as && N == 16) { 836| | return bigint_comba_mul16(z, x, y); 837| | } 838| 1.40M| } 839| | 840| 0| word3 accum; 841| | 842| 1.40M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (842:22): [True: 0, False: 1.40M] ------------------ 843| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (843:28): [True: 0, False: 0] ------------------ 844| 0| const size_t end = std::min(N, i + 1); 845| | 846| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (846:29): [True: 0, False: 0] ------------------ 847| 0| accum.mul(x[j], y[i - j]); 848| 0| } 849| 0| z[i] = accum.extract(); 850| 0| } 851| 1.40M|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm6EEET0_RNSt3__15arrayIS1_XT1_EEE: 725| 522k|inline constexpr W shift_left(std::array& x) { 726| 522k| static_assert(N >= 1, "Invalid input size"); 727| 522k| static_assert(S > 0, "Zero shift not supported"); 728| 522k| static_assert(S < WordInfo::bits, "Shift too large"); 729| | 730| 522k| const W carry = x[N - 1] >> (WordInfo::bits - S); 731| | 732| 3.13M| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (732:26): [True: 2.61M, False: 522k] ------------------ 733| 2.61M| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 734| 2.61M| } 735| 522k| x[0] <<= S; 736| | 737| 522k| return carry; 738| 522k|} _ZN5Botan16read_window_bitsILm5EmLm6EEEmNSt3__14spanIKT0_XT1_EEEm: 1071| 61.6k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1072| 61.6k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1073| | 1074| 61.6k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1075| | 1076| 61.6k| constexpr size_t W_bits = sizeof(W) * 8; 1077| 61.6k| const auto bit_shift = offset % W_bits; 1078| 61.6k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1079| | 1080| 61.6k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1080:36): [True: 57.6k, False: 4.00k] | Branch (1080:74): [True: 801, False: 3.20k] ------------------ 1081| | 1082| 61.6k| const auto w0 = words[word_offset]; 1083| | 1084| 61.6k| if(single_byte_window) { ------------------ | Branch (1084:7): [True: 58.4k, False: 3.20k] ------------------ 1085| 58.4k| return (w0 >> bit_shift) & WindowMask; 1086| 58.4k| } else { 1087| | // Otherwise we must join two words and extract the result 1088| 3.20k| const auto w1 = words[word_offset - 1]; 1089| 3.20k| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1090| 3.20k| return combined & WindowMask; 1091| 3.20k| } 1092| 61.6k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm6EEET0_RNSt3__15arrayIS1_XT1_EEE: 741| 32.2k|inline constexpr W shift_right(std::array& x) { 742| 32.2k| static_assert(N >= 1, "Invalid input size"); 743| 32.2k| static_assert(S > 0, "Zero shift not supported"); 744| 32.2k| static_assert(S < WordInfo::bits, "Shift too large"); 745| | 746| 32.2k| const W carry = x[0] << (WordInfo::bits - S); 747| | 748| 193k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (748:22): [True: 161k, False: 32.2k] ------------------ 749| 161k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 750| 161k| } 751| 32.2k| x[N - 1] >>= S; 752| | 753| 32.2k| return carry; 754| 32.2k|} _ZN5Botan9comba_sqrILm8ETkNS_8WordTypeEmEEvPT0_PKS1_: 854| 1.43M|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 855| 1.43M| if(!std::is_constant_evaluated()) { ------------------ | Branch (855:7): [True: 1.43M, Folded] ------------------ 856| | if constexpr(std::same_as && N == 4) { 857| | return bigint_comba_sqr4(z, x); 858| | } 859| | if constexpr(std::same_as && N == 6) { 860| | return bigint_comba_sqr6(z, x); 861| | } 862| | if constexpr(std::same_as && N == 7) { 863| | return bigint_comba_sqr7(z, x); 864| | } 865| 1.43M| if constexpr(std::same_as && N == 8) { 866| 1.43M| return bigint_comba_sqr8(z, x); 867| 1.43M| } 868| | if constexpr(std::same_as && N == 9) { 869| | return bigint_comba_sqr9(z, x); 870| | } 871| | if constexpr(std::same_as && N == 16) { 872| | return bigint_comba_sqr16(z, x); 873| | } 874| 1.43M| } 875| | 876| 0| word3 accum; 877| | 878| 1.43M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (878:22): [True: 0, False: 1.43M] ------------------ 879| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (879:28): [True: 0, False: 0] ------------------ 880| 0| const size_t end = std::min(N, i + 1); 881| | 882| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (882:29): [True: 0, False: 0] ------------------ 883| 0| accum.mul(x[j], x[i - j]); 884| 0| } 885| 0| z[i] = accum.extract(); 886| 0| } 887| 1.43M|} _ZN5Botan22bigint_monty_maybe_subILm8ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 254| 3.52M|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 255| 3.52M| W borrow = 0; 256| | 257| 31.7M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (257:22): [True: 28.2M, False: 3.52M] ------------------ 258| 28.2M| z[i] = word_sub(x[i], y[i], &borrow); 259| 28.2M| } 260| | 261| 3.52M| borrow = (x0 - borrow) > x0; 262| | 263| 3.52M| CT::conditional_assign_mem(borrow, z, x, N); 264| 3.52M|} _ZN5Botan9comba_mulILm8ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 818| 1.30M|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 819| 1.30M| if(!std::is_constant_evaluated()) { ------------------ | Branch (819:7): [True: 1.30M, Folded] ------------------ 820| | if constexpr(std::same_as && N == 4) { 821| | return bigint_comba_mul4(z, x, y); 822| | } 823| | if constexpr(std::same_as && N == 6) { 824| | return bigint_comba_mul6(z, x, y); 825| | } 826| | if constexpr(std::same_as && N == 7) { 827| | return bigint_comba_mul7(z, x, y); 828| | } 829| 1.30M| if constexpr(std::same_as && N == 8) { 830| 1.30M| return bigint_comba_mul8(z, x, y); 831| 1.30M| } 832| | if constexpr(std::same_as && N == 9) { 833| | return bigint_comba_mul9(z, x, y); 834| | } 835| | if constexpr(std::same_as && N == 16) { 836| | return bigint_comba_mul16(z, x, y); 837| | } 838| 1.30M| } 839| | 840| 0| word3 accum; 841| | 842| 1.30M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (842:22): [True: 0, False: 1.30M] ------------------ 843| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (843:28): [True: 0, False: 0] ------------------ 844| 0| const size_t end = std::min(N, i + 1); 845| | 846| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (846:29): [True: 0, False: 0] ------------------ 847| 0| accum.mul(x[j], y[i - j]); 848| 0| } 849| 0| z[i] = accum.extract(); 850| 0| } 851| 1.30M|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm8EEET0_RNSt3__15arrayIS1_XT1_EEE: 725| 445k|inline constexpr W shift_left(std::array& x) { 726| 445k| static_assert(N >= 1, "Invalid input size"); 727| 445k| static_assert(S > 0, "Zero shift not supported"); 728| 445k| static_assert(S < WordInfo::bits, "Shift too large"); 729| | 730| 445k| const W carry = x[N - 1] >> (WordInfo::bits - S); 731| | 732| 3.56M| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (732:26): [True: 3.11M, False: 445k] ------------------ 733| 3.11M| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 734| 3.11M| } 735| 445k| x[0] <<= S; 736| | 737| 445k| return carry; 738| 445k|} _ZN5Botan16read_window_bitsILm5EmLm8EEEmNSt3__14spanIKT0_XT1_EEEm: 1071| 120k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1072| 120k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1073| | 1074| 120k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1075| | 1076| 120k| constexpr size_t W_bits = sizeof(W) * 8; 1077| 120k| const auto bit_shift = offset % W_bits; 1078| 120k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1079| | 1080| 120k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1080:36): [True: 112k, False: 8.19k] | Branch (1080:74): [True: 1.17k, False: 7.02k] ------------------ 1081| | 1082| 120k| const auto w0 = words[word_offset]; 1083| | 1084| 120k| if(single_byte_window) { ------------------ | Branch (1084:7): [True: 113k, False: 7.02k] ------------------ 1085| 113k| return (w0 >> bit_shift) & WindowMask; 1086| 113k| } else { 1087| | // Otherwise we must join two words and extract the result 1088| 7.02k| const auto w1 = words[word_offset - 1]; 1089| 7.02k| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1090| 7.02k| return combined & WindowMask; 1091| 7.02k| } 1092| 120k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm8EEET0_RNSt3__15arrayIS1_XT1_EEE: 741| 27.5k|inline constexpr W shift_right(std::array& x) { 742| 27.5k| static_assert(N >= 1, "Invalid input size"); 743| 27.5k| static_assert(S > 0, "Zero shift not supported"); 744| 27.5k| static_assert(S < WordInfo::bits, "Shift too large"); 745| | 746| 27.5k| const W carry = x[0] << (WordInfo::bits - S); 747| | 748| 220k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (748:22): [True: 192k, False: 27.5k] ------------------ 749| 192k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 750| 192k| } 751| 27.5k| x[N - 1] >>= S; 752| | 753| 27.5k| return carry; 754| 27.5k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 725| 626k|inline constexpr W shift_left(std::array& x) { 726| 626k| static_assert(N >= 1, "Invalid input size"); 727| 626k| static_assert(S > 0, "Zero shift not supported"); 728| 626k| static_assert(S < WordInfo::bits, "Shift too large"); 729| | 730| 626k| const W carry = x[N - 1] >> (WordInfo::bits - S); 731| | 732| 5.63M| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (732:26): [True: 5.01M, False: 626k] ------------------ 733| 5.01M| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 734| 5.01M| } 735| 626k| x[0] <<= S; 736| | 737| 626k| return carry; 738| 626k|} _ZN5Botan22bigint_monty_maybe_subILm9ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 254| 908k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 255| 908k| W borrow = 0; 256| | 257| 9.08M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (257:22): [True: 8.18M, False: 908k] ------------------ 258| 8.18M| z[i] = word_sub(x[i], y[i], &borrow); 259| 8.18M| } 260| | 261| 908k| borrow = (x0 - borrow) > x0; 262| | 263| 908k| CT::conditional_assign_mem(borrow, z, x, N); 264| 908k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 741| 38.5k|inline constexpr W shift_right(std::array& x) { 742| 38.5k| static_assert(N >= 1, "Invalid input size"); 743| 38.5k| static_assert(S > 0, "Zero shift not supported"); 744| 38.5k| static_assert(S < WordInfo::bits, "Shift too large"); 745| | 746| 38.5k| const W carry = x[0] << (WordInfo::bits - S); 747| | 748| 346k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (748:22): [True: 308k, False: 38.5k] ------------------ 749| 308k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 750| 308k| } 751| 38.5k| x[N - 1] >>= S; 752| | 753| 38.5k| return carry; 754| 38.5k|} _ZN5Botan9comba_sqrILm9ETkNS_8WordTypeEmEEvPT0_PKS1_: 854| 1.84M|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 855| 1.84M| if(!std::is_constant_evaluated()) { ------------------ | Branch (855:7): [True: 1.84M, Folded] ------------------ 856| | if constexpr(std::same_as && N == 4) { 857| | return bigint_comba_sqr4(z, x); 858| | } 859| | if constexpr(std::same_as && N == 6) { 860| | return bigint_comba_sqr6(z, x); 861| | } 862| | if constexpr(std::same_as && N == 7) { 863| | return bigint_comba_sqr7(z, x); 864| | } 865| | if constexpr(std::same_as && N == 8) { 866| | return bigint_comba_sqr8(z, x); 867| | } 868| 1.84M| if constexpr(std::same_as && N == 9) { 869| 1.84M| return bigint_comba_sqr9(z, x); 870| 1.84M| } 871| | if constexpr(std::same_as && N == 16) { 872| | return bigint_comba_sqr16(z, x); 873| | } 874| 1.84M| } 875| | 876| 0| word3 accum; 877| | 878| 1.84M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (878:22): [True: 0, False: 1.84M] ------------------ 879| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (879:28): [True: 0, False: 0] ------------------ 880| 0| const size_t end = std::min(N, i + 1); 881| | 882| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (882:29): [True: 0, False: 0] ------------------ 883| 0| accum.mul(x[j], x[i - j]); 884| 0| } 885| 0| z[i] = accum.extract(); 886| 0| } 887| 1.84M|} _ZN5Botan9comba_mulILm9ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 818| 1.48M|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 819| 1.48M| if(!std::is_constant_evaluated()) { ------------------ | Branch (819:7): [True: 1.48M, Folded] ------------------ 820| | if constexpr(std::same_as && N == 4) { 821| | return bigint_comba_mul4(z, x, y); 822| | } 823| | if constexpr(std::same_as && N == 6) { 824| | return bigint_comba_mul6(z, x, y); 825| | } 826| | if constexpr(std::same_as && N == 7) { 827| | return bigint_comba_mul7(z, x, y); 828| | } 829| | if constexpr(std::same_as && N == 8) { 830| | return bigint_comba_mul8(z, x, y); 831| | } 832| 1.48M| if constexpr(std::same_as && N == 9) { 833| 1.48M| return bigint_comba_mul9(z, x, y); 834| 1.48M| } 835| | if constexpr(std::same_as && N == 16) { 836| | return bigint_comba_mul16(z, x, y); 837| | } 838| 1.48M| } 839| | 840| 0| word3 accum; 841| | 842| 1.48M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (842:22): [True: 0, False: 1.48M] ------------------ 843| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (843:28): [True: 0, False: 0] ------------------ 844| 0| const size_t end = std::min(N, i + 1); 845| | 846| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (846:29): [True: 0, False: 0] ------------------ 847| 0| accum.mul(x[j], y[i - j]); 848| 0| } 849| 0| z[i] = accum.extract(); 850| 0| } 851| 1.48M|} _ZN5Botan10shift_leftILm16ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 725| 4.66k|inline constexpr W shift_left(std::array& x) { 726| 4.66k| static_assert(N >= 1, "Invalid input size"); 727| 4.66k| static_assert(S > 0, "Zero shift not supported"); 728| 4.66k| static_assert(S < WordInfo::bits, "Shift too large"); 729| | 730| 4.66k| const W carry = x[N - 1] >> (WordInfo::bits - S); 731| | 732| 42.0k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (732:26): [True: 37.3k, False: 4.66k] ------------------ 733| 37.3k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 734| 37.3k| } 735| 4.66k| x[0] <<= S; 736| | 737| 4.66k| return carry; 738| 4.66k|} _ZN5Botan9comba_mulILm7ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 818| 33.8k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 819| 33.8k| if(!std::is_constant_evaluated()) { ------------------ | Branch (819:7): [True: 33.8k, Folded] ------------------ 820| | if constexpr(std::same_as && N == 4) { 821| | return bigint_comba_mul4(z, x, y); 822| | } 823| | if constexpr(std::same_as && N == 6) { 824| | return bigint_comba_mul6(z, x, y); 825| | } 826| 33.8k| if constexpr(std::same_as && N == 7) { 827| 33.8k| return bigint_comba_mul7(z, x, y); 828| 33.8k| } 829| | if constexpr(std::same_as && N == 8) { 830| | return bigint_comba_mul8(z, x, y); 831| | } 832| | if constexpr(std::same_as && N == 9) { 833| | return bigint_comba_mul9(z, x, y); 834| | } 835| | if constexpr(std::same_as && N == 16) { 836| | return bigint_comba_mul16(z, x, y); 837| | } 838| 33.8k| } 839| | 840| 0| word3 accum; 841| | 842| 33.8k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (842:22): [True: 0, False: 33.8k] ------------------ 843| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (843:28): [True: 0, False: 0] ------------------ 844| 0| const size_t end = std::min(N, i + 1); 845| | 846| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (846:29): [True: 0, False: 0] ------------------ 847| 0| accum.mul(x[j], y[i - j]); 848| 0| } 849| 0| z[i] = accum.extract(); 850| 0| } 851| 33.8k|} _ZN5Botan9comba_sqrILm7ETkNS_8WordTypeEmEEvPT0_PKS1_: 854| 33.5k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 855| 33.5k| if(!std::is_constant_evaluated()) { ------------------ | Branch (855:7): [True: 33.5k, Folded] ------------------ 856| | if constexpr(std::same_as && N == 4) { 857| | return bigint_comba_sqr4(z, x); 858| | } 859| | if constexpr(std::same_as && N == 6) { 860| | return bigint_comba_sqr6(z, x); 861| | } 862| 33.5k| if constexpr(std::same_as && N == 7) { 863| 33.5k| return bigint_comba_sqr7(z, x); 864| 33.5k| } 865| | if constexpr(std::same_as && N == 8) { 866| | return bigint_comba_sqr8(z, x); 867| | } 868| | if constexpr(std::same_as && N == 9) { 869| | return bigint_comba_sqr9(z, x); 870| | } 871| | if constexpr(std::same_as && N == 16) { 872| | return bigint_comba_sqr16(z, x); 873| | } 874| 33.5k| } 875| | 876| 0| word3 accum; 877| | 878| 33.5k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (878:22): [True: 0, False: 33.5k] ------------------ 879| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (879:28): [True: 0, False: 0] ------------------ 880| 0| const size_t end = std::min(N, i + 1); 881| | 882| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (882:29): [True: 0, False: 0] ------------------ 883| 0| accum.mul(x[j], x[i - j]); 884| 0| } 885| 0| z[i] = accum.extract(); 886| 0| } 887| 33.5k|} _ZN5Botan14OCB_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm: 102| 12| OCB_Mode(std::move(cipher), tag_size) {} _ZN5Botan14OCB_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm: 121| 66| OCB_Mode(std::move(cipher), tag_size) {} _ZNK5Botan8OCB_Mode8tag_sizeEv: 47| 455| size_t tag_size() const final { return m_tag_size; } _ZNK5Botan8OCB_Mode10block_sizeEv: 64| 388| size_t block_size() const { return m_block_size; } _ZNK5Botan8OCB_Mode10par_blocksEv: 66| 215| size_t par_blocks() const { return m_par_blocks; } _ZNK5Botan14OCB_Decryption18minimum_final_sizeEv: 125| 56| size_t minimum_final_size() const override { return tag_size(); } _ZN5Botan6PCurve15PrimeOrderCurve6ScalarD2Ev: 74| 48.6k| ~Scalar() { _zeroize(); } _ZN5Botan6PCurve15PrimeOrderCurve11AffinePointD2Ev: 102| 52.5k| ~AffinePoint() = default; _ZN5Botan6PCurve15PrimeOrderCurve15ProjectivePointD2Ev: 136| 2.61k| ~ProjectivePoint() = default; _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2EOS2_: 69| 25.6k| Scalar(Scalar&& other) = default; _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2ERKS2_: 68| 14.1k| Scalar(const Scalar& other) = default; _ZN5Botan6PCurve15PrimeOrderCurve11AffinePointC2EOS2_: 99| 37.0k| AffinePoint(AffinePoint&& other) = default; _ZN5Botan6PCurve15PrimeOrderCurve11AffinePointC2ERKS2_: 98| 3.27k| AffinePoint(const AffinePoint& other) = default; _ZNK5Botan6PCurve15PrimeOrderCurve6Scalar6_curveEv: 78| 21.9k| const auto& _curve() const { return m_curve; } _ZNK5Botan6PCurve15PrimeOrderCurve6Scalar6_valueEv: 80| 21.9k| const auto& _value() const { return m_value; } _ZN5Botan6PCurve15PrimeOrderCurve6Scalar7_createENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEE: 82| 8.86k| static Scalar _create(CurvePtr curve, StorageUnit v) { return Scalar(std::move(curve), v); } _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2ENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEE: 85| 8.86k| Scalar(CurvePtr curve, StorageUnit v) : m_curve(std::move(curve)), m_value(v) {} _ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint6_curveEv: 106| 32.4k| const auto& _curve() const { return m_curve; } _ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint2_xEv: 108| 32.4k| const auto& _x() const { return m_x; } _ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint2_yEv: 110| 32.4k| const auto& _y() const { return m_y; } _ZN5Botan6PCurve15PrimeOrderCurve11AffinePoint7_createENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_: 112| 12.1k| static AffinePoint _create(CurvePtr curve, StorageUnit x, StorageUnit y) { 113| 12.1k| return AffinePoint(std::move(curve), x, y); 114| 12.1k| } _ZN5Botan6PCurve15PrimeOrderCurve11AffinePointC2ENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_: 117| 12.1k| AffinePoint(CurvePtr curve, StorageUnit x, StorageUnit y) : m_curve(std::move(curve)), m_x(x), m_y(y) {} _ZNK5Botan6PCurve15PrimeOrderCurve15ProjectivePoint6_curveEv: 138| 2.61k| const auto& _curve() const { return m_curve; } _ZNK5Botan6PCurve15PrimeOrderCurve15ProjectivePoint2_xEv: 140| 2.61k| const auto& _x() const { return m_x; } _ZNK5Botan6PCurve15PrimeOrderCurve15ProjectivePoint2_yEv: 142| 2.61k| const auto& _y() const { return m_y; } _ZNK5Botan6PCurve15PrimeOrderCurve15ProjectivePoint2_zEv: 144| 2.61k| const auto& _z() const { return m_z; } _ZN5Botan6PCurve15PrimeOrderCurve15ProjectivePoint7_createENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_S8_: 146| 2.61k| static ProjectivePoint _create(CurvePtr curve, StorageUnit x, StorageUnit y, StorageUnit z) { 147| 2.61k| return ProjectivePoint(std::move(curve), x, y, z); 148| 2.61k| } _ZN5Botan6PCurve15PrimeOrderCurve15ProjectivePointC2ENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_S8_: 152| 2.61k| m_curve(std::move(curve)), m_x(x), m_y(y), m_z(z) {} _ZN5Botan6PCurve15PrimeOrderCurveD2Ev: 165| 6| virtual ~PrimeOrderCurve() = default; pcurves_brainpool256r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 397| 4.48k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 398| | // Cost: 1M + 3S + 1A + 1*3 399| 4.48k| const auto z2 = pt.z().square(); 400| 4.48k| const auto m = pt.x().square().mul3() + A * z2.square(); 401| | 402| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 403| 4.48k| const auto y2 = pt.y().square(); 404| 4.48k| const auto s = pt.x().mul4() * y2; 405| 4.48k| const auto nx = m.square() - s.mul2(); 406| 4.48k| const auto ny = m * (s - nx) - y2.square().mul8(); 407| 4.48k| const auto nz = pt.y().mul2() * pt.z(); 408| | 409| 4.48k| return ProjectivePoint(nx, ny, nz); 410| 4.48k|} pcurves_brainpool256r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 187| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 188| 735| const auto a_is_identity = a.is_identity(); 189| 735| const auto b_is_identity = b.is_identity(); 190| | 191| 735| const auto Z1Z1 = a.z().square(); 192| 735| const auto Z2Z2 = b.z().square(); 193| 735| const auto U1 = a.x() * Z2Z2; 194| 735| const auto U2 = b.x() * Z1Z1; 195| 735| const auto S1 = a.y() * b.z() * Z2Z2; 196| 735| const auto S2 = b.y() * a.z() * Z1Z1; 197| 735| const auto H = U2 - U1; 198| 735| const auto r = S2 - S1; 199| | 200| | /* Risky conditional 201| | * 202| | * This implementation uses projective coordinates, which do not have an efficient complete 203| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 204| | * 205| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 206| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 207| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 208| | * output (the identity element) 209| | */ 210| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (210:7): [True: 0, False: 735] ------------------ 211| 0| return a.dbl(); 212| 0| } 213| | 214| 735| const auto HH = H.square(); 215| 735| const auto HHH = H * HH; 216| 735| const auto V = U1 * HH; 217| 735| const auto t2 = r.square(); 218| 735| const auto t3 = V + V; 219| 735| const auto t4 = t2 - HHH; 220| 735| auto X3 = t4 - t3; 221| 735| const auto t5 = V - X3; 222| 735| const auto t6 = S1 * HHH; 223| 735| const auto t7 = r * t5; 224| 735| auto Y3 = t7 - t6; 225| 735| const auto t8 = b.z() * H; 226| 735| auto Z3 = a.z() * t8; 227| | 228| | // if a is identity then return b 229| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 230| | 231| | // if b is identity then return a 232| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 233| | 234| 735| return ProjectivePoint(X3, Y3, Z3); 235| 735|} pcurves_brainpool256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 1|auto to_affine_batch(std::span projective) { 108| 1| using AffinePoint = typename C::AffinePoint; 109| | 110| 1| const size_t N = projective.size(); 111| 1| std::vector affine; 112| 1| affine.reserve(N); 113| | 114| 1| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 1.56k, False: 1] ------------------ 117| 1.56k| any_identity = any_identity || pt.is_identity(); 118| 1.56k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 1] | Branch (126:17): [True: 0, False: 1] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 1| } else { 134| 1| std::vector c; 135| 1| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 1| c.push_back(projective[0].z()); 145| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 1.56k, False: 1] ------------------ 146| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 147| 1.56k| } 148| | 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| 1| } else { 153| 1| return invert_field_element(c[N - 1]); 154| 1| } 155| 1| }(); 156| | 157| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 1.56k, False: 1] ------------------ 158| 1.56k| const auto& p = projective[i]; 159| | 160| 1.56k| const auto z_inv = s_inv * c[i - 1]; 161| 1.56k| const auto z2_inv = z_inv.square(); 162| 1.56k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 1.56k| s_inv = s_inv * p.z(); 165| | 166| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 1.56k| } 168| | 169| 1| const auto z2_inv = s_inv.square(); 170| 1| const auto z3_inv = s_inv * z2_inv; 171| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 1| std::reverse(affine.begin(), affine.end()); 173| 1| return affine; 174| 1| } 175| | 176| 0| return affine; 177| 1|} pcurves_brainpool256r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveEEEDaRKNT_15ProjectivePointE: 76| 725|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 77| | // Not strictly required right? - default should work as long 78| | // as (0,0) is identity and invert returns 0 on 0 79| | 80| | if constexpr(curve_supports_fe_invert2) { 81| | const auto z2_inv = C::fe_invert2(pt.z()); 82| | const auto z3_inv = z2_inv.square() * pt.z(); 83| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 84| 725| } else { 85| 725| const auto z_inv = invert_field_element(pt.z()); 86| 725| const auto z2_inv = z_inv.square(); 87| 725| const auto z3_inv = z_inv * z2_inv; 88| 725| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 89| 725| } 90| 725|} pcurves_brainpool256r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveEEEDaRKNT_12FieldElementE: 35| 1.63k|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 36| | if constexpr(curve_supports_fe_invert2) { 37| | return C::fe_invert2(fe) * fe; 38| 1.63k| } else { 39| 1.63k| return fe.invert(); 40| 1.63k| } 41| 1.63k|} pcurves_brainpool256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| | } else { 153| | return invert_field_element(c[N - 1]); 154| | } 155| 1| }(); pcurves_brainpool256r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_: 296| 60.7k| const FieldElement& one) { 297| 60.7k| const auto a_is_identity = a.is_identity(); 298| 60.7k| const auto b_is_identity = b.is_identity(); 299| | 300| | /* 301| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 302| | 303| | Cost: 8M + 3S + 6add + 1*2 304| | */ 305| | 306| 60.7k| auto by = b.y(); 307| 60.7k| by.conditional_assign(sub, by.negate()); 308| | 309| 60.7k| const auto Z1Z1 = a.z().square(); 310| 60.7k| const auto U2 = b.x() * Z1Z1; 311| 60.7k| const auto S2 = by * a.z() * Z1Z1; 312| 60.7k| const auto H = U2 - a.x(); 313| 60.7k| const auto r = S2 - a.y(); 314| | 315| | /* Risky conditional 316| | * 317| | * This implementation uses projective coordinates, which do not have an efficient complete 318| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 319| | * 320| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 321| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 322| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 323| | * (the identity element) 324| | */ 325| 60.7k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (325:7): [True: 0, False: 60.7k] ------------------ 326| 0| return a.dbl(); 327| 0| } 328| | 329| 60.7k| const auto HH = H.square(); 330| 60.7k| const auto HHH = H * HH; 331| 60.7k| const auto V = a.x() * HH; 332| 60.7k| const auto t2 = r.square(); 333| 60.7k| const auto t3 = V + V; 334| 60.7k| const auto t4 = t2 - HHH; 335| 60.7k| auto X3 = t4 - t3; 336| 60.7k| const auto t5 = V - X3; 337| 60.7k| const auto t6 = a.y() * HHH; 338| 60.7k| const auto t7 = r * t5; 339| 60.7k| auto Y3 = t7 - t6; 340| 60.7k| auto Z3 = a.z() * H; 341| | 342| | // if a is identity then return b 343| 60.7k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 344| | 345| | // if b is identity then return a 346| 60.7k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 347| | 348| 60.7k| return ProjectivePoint(X3, Y3, Z3); 349| 60.7k|} pcurves_brainpool256r1.cpp:_ZN5Botan11to_affine_xINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveEEEDaRKNT_15ProjectivePointE: 96| 456|auto to_affine_x(const typename C::ProjectivePoint& pt) { 97| | if constexpr(curve_supports_fe_invert2) { 98| | return pt.x() * C::fe_invert2(pt.z()); 99| 456| } else { 100| 456| const auto z_inv = invert_field_element(pt.z()); 101| 456| const auto z2_inv = z_inv.square(); 102| 456| return pt.x() * z2_inv; 103| 456| } 104| 456|} pcurves_brainpool256r1.cpp:_ZN5Botan15point_add_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_RKT1_: 240| 3.19k| const FieldElement& one) { 241| 3.19k| const auto a_is_identity = a.is_identity(); 242| 3.19k| const auto b_is_identity = b.is_identity(); 243| | 244| | /* 245| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 246| | 247| | Cost: 8M + 3S + 6add + 1*2 248| | */ 249| | 250| 3.19k| const auto Z1Z1 = a.z().square(); 251| 3.19k| const auto U2 = b.x() * Z1Z1; 252| 3.19k| const auto S2 = b.y() * a.z() * Z1Z1; 253| 3.19k| const auto H = U2 - a.x(); 254| 3.19k| const auto r = S2 - a.y(); 255| | 256| | /* Risky conditional 257| | * 258| | * This implementation uses projective coordinates, which do not have an efficient complete 259| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 260| | * 261| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 262| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 263| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 264| | * (the identity element) 265| | */ 266| 3.19k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (266:7): [True: 0, False: 3.19k] ------------------ 267| 0| return a.dbl(); 268| 0| } 269| | 270| 3.19k| const auto HH = H.square(); 271| 3.19k| const auto HHH = H * HH; 272| 3.19k| const auto V = a.x() * HH; 273| 3.19k| const auto t2 = r.square(); 274| 3.19k| const auto t3 = V + V; 275| 3.19k| const auto t4 = t2 - HHH; 276| 3.19k| auto X3 = t4 - t3; 277| 3.19k| const auto t5 = V - X3; 278| 3.19k| const auto t6 = a.y() * HHH; 279| 3.19k| const auto t7 = r * t5; 280| 3.19k| auto Y3 = t7 - t6; 281| 3.19k| auto Z3 = a.z() * H; 282| | 283| | // if a is identity then return b 284| 3.19k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), one); 285| | 286| | // if b is identity then return a 287| 3.19k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 288| | 289| 3.19k| return ProjectivePoint(X3, Y3, Z3); 290| 3.19k|} pcurves_brainpool256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 456|auto to_affine_batch(std::span projective) { 108| 456| using AffinePoint = typename C::AffinePoint; 109| | 110| 456| const size_t N = projective.size(); 111| 456| std::vector affine; 112| 456| affine.reserve(N); 113| | 114| 456| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 7.29k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 7.29k, False: 456] ------------------ 117| 7.29k| any_identity = any_identity || pt.is_identity(); 118| 7.29k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 456| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 456] | Branch (126:17): [True: 0, False: 456] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 456| } else { 134| 456| std::vector c; 135| 456| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 456| c.push_back(projective[0].z()); 145| 7.29k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 6.84k, False: 456] ------------------ 146| 6.84k| c.push_back(c[i - 1] * projective[i].z()); 147| 6.84k| } 148| | 149| 456| auto s_inv = [&]() { 150| 456| if constexpr(VariableTime) { 151| 456| return c[N - 1].invert_vartime(); 152| 456| } else { 153| 456| return invert_field_element(c[N - 1]); 154| 456| } 155| 456| }(); 156| | 157| 7.29k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 6.84k, False: 456] ------------------ 158| 6.84k| const auto& p = projective[i]; 159| | 160| 6.84k| const auto z_inv = s_inv * c[i - 1]; 161| 6.84k| const auto z2_inv = z_inv.square(); 162| 6.84k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 6.84k| s_inv = s_inv * p.z(); 165| | 166| 6.84k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 6.84k| } 168| | 169| 456| const auto z2_inv = s_inv.square(); 170| 456| const auto z3_inv = s_inv * z2_inv; 171| 456| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 456| std::reverse(affine.begin(), affine.end()); 173| 456| return affine; 174| 456| } 175| | 176| 0| return affine; 177| 456|} pcurves_brainpool256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 456| auto s_inv = [&]() { 150| | if constexpr(VariableTime) { 151| | return c[N - 1].invert_vartime(); 152| 456| } else { 153| 456| return invert_field_element(c[N - 1]); 154| 456| } 155| 456| }(); pcurves_brainpool256r1.cpp:_ZN5Botan13dbl_n_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_m: 477| 25.9k|inline constexpr ProjectivePoint dbl_n_generic(const ProjectivePoint& pt, const FieldElement& A, size_t n) { 478| 25.9k| auto nx = pt.x(); 479| 25.9k| auto ny = pt.y().mul2(); 480| 25.9k| auto nz = pt.z(); 481| 25.9k| auto w = nz.square().square() * A; 482| | 483| | // Conditional ok: loop iteration count is public 484| 155k| while(n > 0) { ------------------ | Branch (484:10): [True: 129k, False: 25.9k] ------------------ 485| 129k| const auto ny2 = ny.square(); 486| 129k| const auto ny4 = ny2.square(); 487| 129k| const auto t1 = nx.square().mul3() + w; 488| 129k| const auto t2 = nx * ny2; 489| 129k| nx = t1.square() - t2.mul2(); 490| 129k| nz *= ny; 491| 129k| ny = t1 * (t2 - nx).mul2() - ny4; 492| 129k| n--; 493| | // Conditional ok: loop iteration count is public 494| 129k| if(n > 0) { ------------------ | Branch (494:10): [True: 103k, False: 25.9k] ------------------ 495| 103k| w *= ny4; 496| 103k| } 497| 129k| } 498| 25.9k| return ProjectivePoint(nx, ny.div2(), nz); 499| 25.9k|} pcurves_brainpool256r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_: 60| 522|inline constexpr CT::Option sqrt_field_element(const typename C::FieldElement& fe) { 61| | if constexpr(curve_supports_fe_sqrt) { 62| | auto z = C::fe_sqrt(fe); 63| | // Zero out the return value if it would otherwise be incorrect 64| | const CT::Choice correct = (z.square() == fe); 65| | z.conditional_assign(!correct, C::FieldElement::zero()); 66| | return CT::Option(z, correct); 67| 522| } else { 68| 522| return fe.sqrt(); 69| 522| } 70| 522|} pcurves_brainpool384r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 397| 2.40k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 398| | // Cost: 1M + 3S + 1A + 1*3 399| 2.40k| const auto z2 = pt.z().square(); 400| 2.40k| const auto m = pt.x().square().mul3() + A * z2.square(); 401| | 402| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 403| 2.40k| const auto y2 = pt.y().square(); 404| 2.40k| const auto s = pt.x().mul4() * y2; 405| 2.40k| const auto nx = m.square() - s.mul2(); 406| 2.40k| const auto ny = m * (s - nx) - y2.square().mul8(); 407| 2.40k| const auto nz = pt.y().mul2() * pt.z(); 408| | 409| 2.40k| return ProjectivePoint(nx, ny, nz); 410| 2.40k|} pcurves_brainpool384r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 187| 1.09k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 188| 1.09k| const auto a_is_identity = a.is_identity(); 189| 1.09k| const auto b_is_identity = b.is_identity(); 190| | 191| 1.09k| const auto Z1Z1 = a.z().square(); 192| 1.09k| const auto Z2Z2 = b.z().square(); 193| 1.09k| const auto U1 = a.x() * Z2Z2; 194| 1.09k| const auto U2 = b.x() * Z1Z1; 195| 1.09k| const auto S1 = a.y() * b.z() * Z2Z2; 196| 1.09k| const auto S2 = b.y() * a.z() * Z1Z1; 197| 1.09k| const auto H = U2 - U1; 198| 1.09k| const auto r = S2 - S1; 199| | 200| | /* Risky conditional 201| | * 202| | * This implementation uses projective coordinates, which do not have an efficient complete 203| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 204| | * 205| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 206| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 207| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 208| | * output (the identity element) 209| | */ 210| 1.09k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (210:7): [True: 0, False: 1.09k] ------------------ 211| 0| return a.dbl(); 212| 0| } 213| | 214| 1.09k| const auto HH = H.square(); 215| 1.09k| const auto HHH = H * HH; 216| 1.09k| const auto V = U1 * HH; 217| 1.09k| const auto t2 = r.square(); 218| 1.09k| const auto t3 = V + V; 219| 1.09k| const auto t4 = t2 - HHH; 220| 1.09k| auto X3 = t4 - t3; 221| 1.09k| const auto t5 = V - X3; 222| 1.09k| const auto t6 = S1 * HHH; 223| 1.09k| const auto t7 = r * t5; 224| 1.09k| auto Y3 = t7 - t6; 225| 1.09k| const auto t8 = b.z() * H; 226| 1.09k| auto Z3 = a.z() * t8; 227| | 228| | // if a is identity then return b 229| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 230| | 231| | // if b is identity then return a 232| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 233| | 234| 1.09k| return ProjectivePoint(X3, Y3, Z3); 235| 1.09k|} pcurves_brainpool384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 1|auto to_affine_batch(std::span projective) { 108| 1| using AffinePoint = typename C::AffinePoint; 109| | 110| 1| const size_t N = projective.size(); 111| 1| std::vector affine; 112| 1| affine.reserve(N); 113| | 114| 1| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 2.33k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 2.33k, False: 1] ------------------ 117| 2.33k| any_identity = any_identity || pt.is_identity(); 118| 2.33k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 1] | Branch (126:17): [True: 0, False: 1] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 1| } else { 134| 1| std::vector c; 135| 1| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 1| c.push_back(projective[0].z()); 145| 2.33k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 2.33k, False: 1] ------------------ 146| 2.33k| c.push_back(c[i - 1] * projective[i].z()); 147| 2.33k| } 148| | 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| 1| } else { 153| 1| return invert_field_element(c[N - 1]); 154| 1| } 155| 1| }(); 156| | 157| 2.33k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 2.33k, False: 1] ------------------ 158| 2.33k| const auto& p = projective[i]; 159| | 160| 2.33k| const auto z_inv = s_inv * c[i - 1]; 161| 2.33k| const auto z2_inv = z_inv.square(); 162| 2.33k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 2.33k| s_inv = s_inv * p.z(); 165| | 166| 2.33k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 2.33k| } 168| | 169| 1| const auto z2_inv = s_inv.square(); 170| 1| const auto z3_inv = s_inv * z2_inv; 171| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 1| std::reverse(affine.begin(), affine.end()); 173| 1| return affine; 174| 1| } 175| | 176| 0| return affine; 177| 1|} pcurves_brainpool384r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveEEEDaRKNT_15ProjectivePointE: 76| 310|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 77| | // Not strictly required right? - default should work as long 78| | // as (0,0) is identity and invert returns 0 on 0 79| | 80| | if constexpr(curve_supports_fe_invert2) { 81| | const auto z2_inv = C::fe_invert2(pt.z()); 82| | const auto z3_inv = z2_inv.square() * pt.z(); 83| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 84| 310| } else { 85| 310| const auto z_inv = invert_field_element(pt.z()); 86| 310| const auto z2_inv = z_inv.square(); 87| 310| const auto z3_inv = z_inv * z2_inv; 88| 310| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 89| 310| } 90| 310|} pcurves_brainpool384r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveEEEDaRKNT_12FieldElementE: 35| 600|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 36| | if constexpr(curve_supports_fe_invert2) { 37| | return C::fe_invert2(fe) * fe; 38| 600| } else { 39| 600| return fe.invert(); 40| 600| } 41| 600|} pcurves_brainpool384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| | } else { 153| | return invert_field_element(c[N - 1]); 154| | } 155| 1| }(); pcurves_brainpool384r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_: 296| 34.7k| const FieldElement& one) { 297| 34.7k| const auto a_is_identity = a.is_identity(); 298| 34.7k| const auto b_is_identity = b.is_identity(); 299| | 300| | /* 301| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 302| | 303| | Cost: 8M + 3S + 6add + 1*2 304| | */ 305| | 306| 34.7k| auto by = b.y(); 307| 34.7k| by.conditional_assign(sub, by.negate()); 308| | 309| 34.7k| const auto Z1Z1 = a.z().square(); 310| 34.7k| const auto U2 = b.x() * Z1Z1; 311| 34.7k| const auto S2 = by * a.z() * Z1Z1; 312| 34.7k| const auto H = U2 - a.x(); 313| 34.7k| const auto r = S2 - a.y(); 314| | 315| | /* Risky conditional 316| | * 317| | * This implementation uses projective coordinates, which do not have an efficient complete 318| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 319| | * 320| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 321| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 322| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 323| | * (the identity element) 324| | */ 325| 34.7k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (325:7): [True: 0, False: 34.7k] ------------------ 326| 0| return a.dbl(); 327| 0| } 328| | 329| 34.7k| const auto HH = H.square(); 330| 34.7k| const auto HHH = H * HH; 331| 34.7k| const auto V = a.x() * HH; 332| 34.7k| const auto t2 = r.square(); 333| 34.7k| const auto t3 = V + V; 334| 34.7k| const auto t4 = t2 - HHH; 335| 34.7k| auto X3 = t4 - t3; 336| 34.7k| const auto t5 = V - X3; 337| 34.7k| const auto t6 = a.y() * HHH; 338| 34.7k| const auto t7 = r * t5; 339| 34.7k| auto Y3 = t7 - t6; 340| 34.7k| auto Z3 = a.z() * H; 341| | 342| | // if a is identity then return b 343| 34.7k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 344| | 345| | // if b is identity then return a 346| 34.7k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 347| | 348| 34.7k| return ProjectivePoint(X3, Y3, Z3); 349| 34.7k|} pcurves_brainpool384r1.cpp:_ZN5Botan11to_affine_xINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveEEEDaRKNT_15ProjectivePointE: 96| 145|auto to_affine_x(const typename C::ProjectivePoint& pt) { 97| | if constexpr(curve_supports_fe_invert2) { 98| | return pt.x() * C::fe_invert2(pt.z()); 99| 145| } else { 100| 145| const auto z_inv = invert_field_element(pt.z()); 101| 145| const auto z2_inv = z_inv.square(); 102| 145| return pt.x() * z2_inv; 103| 145| } 104| 145|} pcurves_brainpool384r1.cpp:_ZN5Botan15point_add_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_RKT1_: 240| 1.01k| const FieldElement& one) { 241| 1.01k| const auto a_is_identity = a.is_identity(); 242| 1.01k| const auto b_is_identity = b.is_identity(); 243| | 244| | /* 245| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 246| | 247| | Cost: 8M + 3S + 6add + 1*2 248| | */ 249| | 250| 1.01k| const auto Z1Z1 = a.z().square(); 251| 1.01k| const auto U2 = b.x() * Z1Z1; 252| 1.01k| const auto S2 = b.y() * a.z() * Z1Z1; 253| 1.01k| const auto H = U2 - a.x(); 254| 1.01k| const auto r = S2 - a.y(); 255| | 256| | /* Risky conditional 257| | * 258| | * This implementation uses projective coordinates, which do not have an efficient complete 259| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 260| | * 261| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 262| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 263| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 264| | * (the identity element) 265| | */ 266| 1.01k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (266:7): [True: 0, False: 1.01k] ------------------ 267| 0| return a.dbl(); 268| 0| } 269| | 270| 1.01k| const auto HH = H.square(); 271| 1.01k| const auto HHH = H * HH; 272| 1.01k| const auto V = a.x() * HH; 273| 1.01k| const auto t2 = r.square(); 274| 1.01k| const auto t3 = V + V; 275| 1.01k| const auto t4 = t2 - HHH; 276| 1.01k| auto X3 = t4 - t3; 277| 1.01k| const auto t5 = V - X3; 278| 1.01k| const auto t6 = a.y() * HHH; 279| 1.01k| const auto t7 = r * t5; 280| 1.01k| auto Y3 = t7 - t6; 281| 1.01k| auto Z3 = a.z() * H; 282| | 283| | // if a is identity then return b 284| 1.01k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), one); 285| | 286| | // if b is identity then return a 287| 1.01k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 288| | 289| 1.01k| return ProjectivePoint(X3, Y3, Z3); 290| 1.01k|} pcurves_brainpool384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 145|auto to_affine_batch(std::span projective) { 108| 145| using AffinePoint = typename C::AffinePoint; 109| | 110| 145| const size_t N = projective.size(); 111| 145| std::vector affine; 112| 145| affine.reserve(N); 113| | 114| 145| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 2.32k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 2.32k, False: 145] ------------------ 117| 2.32k| any_identity = any_identity || pt.is_identity(); 118| 2.32k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 145| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 145] | Branch (126:17): [True: 0, False: 145] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 145| } else { 134| 145| std::vector c; 135| 145| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 145| c.push_back(projective[0].z()); 145| 2.32k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 2.17k, False: 145] ------------------ 146| 2.17k| c.push_back(c[i - 1] * projective[i].z()); 147| 2.17k| } 148| | 149| 145| auto s_inv = [&]() { 150| 145| if constexpr(VariableTime) { 151| 145| return c[N - 1].invert_vartime(); 152| 145| } else { 153| 145| return invert_field_element(c[N - 1]); 154| 145| } 155| 145| }(); 156| | 157| 2.32k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 2.17k, False: 145] ------------------ 158| 2.17k| const auto& p = projective[i]; 159| | 160| 2.17k| const auto z_inv = s_inv * c[i - 1]; 161| 2.17k| const auto z2_inv = z_inv.square(); 162| 2.17k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 2.17k| s_inv = s_inv * p.z(); 165| | 166| 2.17k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 2.17k| } 168| | 169| 145| const auto z2_inv = s_inv.square(); 170| 145| const auto z3_inv = s_inv * z2_inv; 171| 145| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 145| std::reverse(affine.begin(), affine.end()); 173| 145| return affine; 174| 145| } 175| | 176| 0| return affine; 177| 145|} pcurves_brainpool384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 145| auto s_inv = [&]() { 150| | if constexpr(VariableTime) { 151| | return c[N - 1].invert_vartime(); 152| 145| } else { 153| 145| return invert_field_element(c[N - 1]); 154| 145| } 155| 145| }(); pcurves_brainpool384r1.cpp:_ZN5Botan13dbl_n_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_m: 477| 12.4k|inline constexpr ProjectivePoint dbl_n_generic(const ProjectivePoint& pt, const FieldElement& A, size_t n) { 478| 12.4k| auto nx = pt.x(); 479| 12.4k| auto ny = pt.y().mul2(); 480| 12.4k| auto nz = pt.z(); 481| 12.4k| auto w = nz.square().square() * A; 482| | 483| | // Conditional ok: loop iteration count is public 484| 74.8k| while(n > 0) { ------------------ | Branch (484:10): [True: 62.3k, False: 12.4k] ------------------ 485| 62.3k| const auto ny2 = ny.square(); 486| 62.3k| const auto ny4 = ny2.square(); 487| 62.3k| const auto t1 = nx.square().mul3() + w; 488| 62.3k| const auto t2 = nx * ny2; 489| 62.3k| nx = t1.square() - t2.mul2(); 490| 62.3k| nz *= ny; 491| 62.3k| ny = t1 * (t2 - nx).mul2() - ny4; 492| 62.3k| n--; 493| | // Conditional ok: loop iteration count is public 494| 62.3k| if(n > 0) { ------------------ | Branch (494:10): [True: 49.8k, False: 12.4k] ------------------ 495| 49.8k| w *= ny4; 496| 49.8k| } 497| 62.3k| } 498| 12.4k| return ProjectivePoint(nx, ny.div2(), nz); 499| 12.4k|} pcurves_brainpool384r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_: 60| 201|inline constexpr CT::Option sqrt_field_element(const typename C::FieldElement& fe) { 61| | if constexpr(curve_supports_fe_sqrt) { 62| | auto z = C::fe_sqrt(fe); 63| | // Zero out the return value if it would otherwise be incorrect 64| | const CT::Choice correct = (z.square() == fe); 65| | z.conditional_assign(!correct, C::FieldElement::zero()); 66| | return CT::Option(z, correct); 67| 201| } else { 68| 201| return fe.sqrt(); 69| 201| } 70| 201|} pcurves_brainpool512r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 397| 3.46k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 398| | // Cost: 1M + 3S + 1A + 1*3 399| 3.46k| const auto z2 = pt.z().square(); 400| 3.46k| const auto m = pt.x().square().mul3() + A * z2.square(); 401| | 402| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 403| 3.46k| const auto y2 = pt.y().square(); 404| 3.46k| const auto s = pt.x().mul4() * y2; 405| 3.46k| const auto nx = m.square() - s.mul2(); 406| 3.46k| const auto ny = m * (s - nx) - y2.square().mul8(); 407| 3.46k| const auto nz = pt.y().mul2() * pt.z(); 408| | 409| 3.46k| return ProjectivePoint(nx, ny, nz); 410| 3.46k|} pcurves_brainpool512r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 187| 1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 188| 1.45k| const auto a_is_identity = a.is_identity(); 189| 1.45k| const auto b_is_identity = b.is_identity(); 190| | 191| 1.45k| const auto Z1Z1 = a.z().square(); 192| 1.45k| const auto Z2Z2 = b.z().square(); 193| 1.45k| const auto U1 = a.x() * Z2Z2; 194| 1.45k| const auto U2 = b.x() * Z1Z1; 195| 1.45k| const auto S1 = a.y() * b.z() * Z2Z2; 196| 1.45k| const auto S2 = b.y() * a.z() * Z1Z1; 197| 1.45k| const auto H = U2 - U1; 198| 1.45k| const auto r = S2 - S1; 199| | 200| | /* Risky conditional 201| | * 202| | * This implementation uses projective coordinates, which do not have an efficient complete 203| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 204| | * 205| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 206| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 207| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 208| | * output (the identity element) 209| | */ 210| 1.45k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (210:7): [True: 0, False: 1.45k] ------------------ 211| 0| return a.dbl(); 212| 0| } 213| | 214| 1.45k| const auto HH = H.square(); 215| 1.45k| const auto HHH = H * HH; 216| 1.45k| const auto V = U1 * HH; 217| 1.45k| const auto t2 = r.square(); 218| 1.45k| const auto t3 = V + V; 219| 1.45k| const auto t4 = t2 - HHH; 220| 1.45k| auto X3 = t4 - t3; 221| 1.45k| const auto t5 = V - X3; 222| 1.45k| const auto t6 = S1 * HHH; 223| 1.45k| const auto t7 = r * t5; 224| 1.45k| auto Y3 = t7 - t6; 225| 1.45k| const auto t8 = b.z() * H; 226| 1.45k| auto Z3 = a.z() * t8; 227| | 228| | // if a is identity then return b 229| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 230| | 231| | // if b is identity then return a 232| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 233| | 234| 1.45k| return ProjectivePoint(X3, Y3, Z3); 235| 1.45k|} pcurves_brainpool512r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 1|auto to_affine_batch(std::span projective) { 108| 1| using AffinePoint = typename C::AffinePoint; 109| | 110| 1| const size_t N = projective.size(); 111| 1| std::vector affine; 112| 1| affine.reserve(N); 113| | 114| 1| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 3.10k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 3.10k, False: 1] ------------------ 117| 3.10k| any_identity = any_identity || pt.is_identity(); 118| 3.10k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 1] | Branch (126:17): [True: 0, False: 1] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 1| } else { 134| 1| std::vector c; 135| 1| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 1| c.push_back(projective[0].z()); 145| 3.10k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 3.10k, False: 1] ------------------ 146| 3.10k| c.push_back(c[i - 1] * projective[i].z()); 147| 3.10k| } 148| | 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| 1| } else { 153| 1| return invert_field_element(c[N - 1]); 154| 1| } 155| 1| }(); 156| | 157| 3.10k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 3.10k, False: 1] ------------------ 158| 3.10k| const auto& p = projective[i]; 159| | 160| 3.10k| const auto z_inv = s_inv * c[i - 1]; 161| 3.10k| const auto z2_inv = z_inv.square(); 162| 3.10k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 3.10k| s_inv = s_inv * p.z(); 165| | 166| 3.10k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 3.10k| } 168| | 169| 1| const auto z2_inv = s_inv.square(); 170| 1| const auto z3_inv = s_inv * z2_inv; 171| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 1| std::reverse(affine.begin(), affine.end()); 173| 1| return affine; 174| 1| } 175| | 176| 0| return affine; 177| 1|} pcurves_brainpool512r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveEEEDaRKNT_15ProjectivePointE: 76| 436|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 77| | // Not strictly required right? - default should work as long 78| | // as (0,0) is identity and invert returns 0 on 0 79| | 80| | if constexpr(curve_supports_fe_invert2) { 81| | const auto z2_inv = C::fe_invert2(pt.z()); 82| | const auto z3_inv = z2_inv.square() * pt.z(); 83| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 84| 436| } else { 85| 436| const auto z_inv = invert_field_element(pt.z()); 86| 436| const auto z2_inv = z_inv.square(); 87| 436| const auto z3_inv = z_inv * z2_inv; 88| 436| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 89| 436| } 90| 436|} pcurves_brainpool512r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveEEEDaRKNT_12FieldElementE: 35| 890|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 36| | if constexpr(curve_supports_fe_invert2) { 37| | return C::fe_invert2(fe) * fe; 38| 890| } else { 39| 890| return fe.invert(); 40| 890| } 41| 890|} pcurves_brainpool512r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| | } else { 153| | return invert_field_element(c[N - 1]); 154| | } 155| 1| }(); pcurves_brainpool512r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_: 296| 67.9k| const FieldElement& one) { 297| 67.9k| const auto a_is_identity = a.is_identity(); 298| 67.9k| const auto b_is_identity = b.is_identity(); 299| | 300| | /* 301| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 302| | 303| | Cost: 8M + 3S + 6add + 1*2 304| | */ 305| | 306| 67.9k| auto by = b.y(); 307| 67.9k| by.conditional_assign(sub, by.negate()); 308| | 309| 67.9k| const auto Z1Z1 = a.z().square(); 310| 67.9k| const auto U2 = b.x() * Z1Z1; 311| 67.9k| const auto S2 = by * a.z() * Z1Z1; 312| 67.9k| const auto H = U2 - a.x(); 313| 67.9k| const auto r = S2 - a.y(); 314| | 315| | /* Risky conditional 316| | * 317| | * This implementation uses projective coordinates, which do not have an efficient complete 318| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 319| | * 320| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 321| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 322| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 323| | * (the identity element) 324| | */ 325| 67.9k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (325:7): [True: 0, False: 67.9k] ------------------ 326| 0| return a.dbl(); 327| 0| } 328| | 329| 67.9k| const auto HH = H.square(); 330| 67.9k| const auto HHH = H * HH; 331| 67.9k| const auto V = a.x() * HH; 332| 67.9k| const auto t2 = r.square(); 333| 67.9k| const auto t3 = V + V; 334| 67.9k| const auto t4 = t2 - HHH; 335| 67.9k| auto X3 = t4 - t3; 336| 67.9k| const auto t5 = V - X3; 337| 67.9k| const auto t6 = a.y() * HHH; 338| 67.9k| const auto t7 = r * t5; 339| 67.9k| auto Y3 = t7 - t6; 340| 67.9k| auto Z3 = a.z() * H; 341| | 342| | // if a is identity then return b 343| 67.9k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 344| | 345| | // if b is identity then return a 346| 67.9k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 347| | 348| 67.9k| return ProjectivePoint(X3, Y3, Z3); 349| 67.9k|} pcurves_brainpool512r1.cpp:_ZN5Botan11to_affine_xINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveEEEDaRKNT_15ProjectivePointE: 96| 227|auto to_affine_x(const typename C::ProjectivePoint& pt) { 97| | if constexpr(curve_supports_fe_invert2) { 98| | return pt.x() * C::fe_invert2(pt.z()); 99| 227| } else { 100| 227| const auto z_inv = invert_field_element(pt.z()); 101| 227| const auto z2_inv = z_inv.square(); 102| 227| return pt.x() * z2_inv; 103| 227| } 104| 227|} pcurves_brainpool512r1.cpp:_ZN5Botan15point_add_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_RKT1_: 240| 1.58k| const FieldElement& one) { 241| 1.58k| const auto a_is_identity = a.is_identity(); 242| 1.58k| const auto b_is_identity = b.is_identity(); 243| | 244| | /* 245| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 246| | 247| | Cost: 8M + 3S + 6add + 1*2 248| | */ 249| | 250| 1.58k| const auto Z1Z1 = a.z().square(); 251| 1.58k| const auto U2 = b.x() * Z1Z1; 252| 1.58k| const auto S2 = b.y() * a.z() * Z1Z1; 253| 1.58k| const auto H = U2 - a.x(); 254| 1.58k| const auto r = S2 - a.y(); 255| | 256| | /* Risky conditional 257| | * 258| | * This implementation uses projective coordinates, which do not have an efficient complete 259| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 260| | * 261| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 262| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 263| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 264| | * (the identity element) 265| | */ 266| 1.58k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (266:7): [True: 0, False: 1.58k] ------------------ 267| 0| return a.dbl(); 268| 0| } 269| | 270| 1.58k| const auto HH = H.square(); 271| 1.58k| const auto HHH = H * HH; 272| 1.58k| const auto V = a.x() * HH; 273| 1.58k| const auto t2 = r.square(); 274| 1.58k| const auto t3 = V + V; 275| 1.58k| const auto t4 = t2 - HHH; 276| 1.58k| auto X3 = t4 - t3; 277| 1.58k| const auto t5 = V - X3; 278| 1.58k| const auto t6 = a.y() * HHH; 279| 1.58k| const auto t7 = r * t5; 280| 1.58k| auto Y3 = t7 - t6; 281| 1.58k| auto Z3 = a.z() * H; 282| | 283| | // if a is identity then return b 284| 1.58k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), one); 285| | 286| | // if b is identity then return a 287| 1.58k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 288| | 289| 1.58k| return ProjectivePoint(X3, Y3, Z3); 290| 1.58k|} pcurves_brainpool512r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 227|auto to_affine_batch(std::span projective) { 108| 227| using AffinePoint = typename C::AffinePoint; 109| | 110| 227| const size_t N = projective.size(); 111| 227| std::vector affine; 112| 227| affine.reserve(N); 113| | 114| 227| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 3.63k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 3.63k, False: 227] ------------------ 117| 3.63k| any_identity = any_identity || pt.is_identity(); 118| 3.63k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 227| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 227] | Branch (126:17): [True: 0, False: 227] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 227| } else { 134| 227| std::vector c; 135| 227| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 227| c.push_back(projective[0].z()); 145| 3.63k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 3.40k, False: 227] ------------------ 146| 3.40k| c.push_back(c[i - 1] * projective[i].z()); 147| 3.40k| } 148| | 149| 227| auto s_inv = [&]() { 150| 227| if constexpr(VariableTime) { 151| 227| return c[N - 1].invert_vartime(); 152| 227| } else { 153| 227| return invert_field_element(c[N - 1]); 154| 227| } 155| 227| }(); 156| | 157| 3.63k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 3.40k, False: 227] ------------------ 158| 3.40k| const auto& p = projective[i]; 159| | 160| 3.40k| const auto z_inv = s_inv * c[i - 1]; 161| 3.40k| const auto z2_inv = z_inv.square(); 162| 3.40k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 3.40k| s_inv = s_inv * p.z(); 165| | 166| 3.40k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 3.40k| } 168| | 169| 227| const auto z2_inv = s_inv.square(); 170| 227| const auto z3_inv = s_inv * z2_inv; 171| 227| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 227| std::reverse(affine.begin(), affine.end()); 173| 227| return affine; 174| 227| } 175| | 176| 0| return affine; 177| 227|} pcurves_brainpool512r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 227| auto s_inv = [&]() { 150| | if constexpr(VariableTime) { 151| | return c[N - 1].invert_vartime(); 152| 227| } else { 153| 227| return invert_field_element(c[N - 1]); 154| 227| } 155| 227| }(); pcurves_brainpool512r1.cpp:_ZN5Botan13dbl_n_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_m: 477| 26.1k|inline constexpr ProjectivePoint dbl_n_generic(const ProjectivePoint& pt, const FieldElement& A, size_t n) { 478| 26.1k| auto nx = pt.x(); 479| 26.1k| auto ny = pt.y().mul2(); 480| 26.1k| auto nz = pt.z(); 481| 26.1k| auto w = nz.square().square() * A; 482| | 483| | // Conditional ok: loop iteration count is public 484| 156k| while(n > 0) { ------------------ | Branch (484:10): [True: 130k, False: 26.1k] ------------------ 485| 130k| const auto ny2 = ny.square(); 486| 130k| const auto ny4 = ny2.square(); 487| 130k| const auto t1 = nx.square().mul3() + w; 488| 130k| const auto t2 = nx * ny2; 489| 130k| nx = t1.square() - t2.mul2(); 490| 130k| nz *= ny; 491| 130k| ny = t1 * (t2 - nx).mul2() - ny4; 492| 130k| n--; 493| | // Conditional ok: loop iteration count is public 494| 130k| if(n > 0) { ------------------ | Branch (494:10): [True: 104k, False: 26.1k] ------------------ 495| 104k| w *= ny4; 496| 104k| } 497| 130k| } 498| 26.1k| return ProjectivePoint(nx, ny.div2(), nz); 499| 26.1k|} pcurves_brainpool512r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_: 60| 280|inline constexpr CT::Option sqrt_field_element(const typename C::FieldElement& fe) { 61| | if constexpr(curve_supports_fe_sqrt) { 62| | auto z = C::fe_sqrt(fe); 63| | // Zero out the return value if it would otherwise be incorrect 64| | const CT::Choice correct = (z.square() == fe); 65| | z.conditional_assign(!correct, C::FieldElement::zero()); 66| | return CT::Option(z, correct); 67| 280| } else { 68| 280| return fe.sqrt(); 69| 280| } 70| 280|} pcurves_secp256r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_: 362| 3.11k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 363| | /* 364| | if a == -3 then 365| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 366| | */ 367| 3.11k| const auto z2 = pt.z().square(); 368| 3.11k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 369| | 370| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 371| 3.11k| const auto y2 = pt.y().square(); 372| 3.11k| const auto s = pt.x().mul4() * y2; 373| 3.11k| const auto nx = m.square() - s.mul2(); 374| 3.11k| const auto ny = m * (s - nx) - y2.square().mul8(); 375| 3.11k| const auto nz = pt.y().mul2() * pt.z(); 376| | 377| 3.11k| return ProjectivePoint(nx, ny, nz); 378| 3.11k|} pcurves_secp256r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 187| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 188| 735| const auto a_is_identity = a.is_identity(); 189| 735| const auto b_is_identity = b.is_identity(); 190| | 191| 735| const auto Z1Z1 = a.z().square(); 192| 735| const auto Z2Z2 = b.z().square(); 193| 735| const auto U1 = a.x() * Z2Z2; 194| 735| const auto U2 = b.x() * Z1Z1; 195| 735| const auto S1 = a.y() * b.z() * Z2Z2; 196| 735| const auto S2 = b.y() * a.z() * Z1Z1; 197| 735| const auto H = U2 - U1; 198| 735| const auto r = S2 - S1; 199| | 200| | /* Risky conditional 201| | * 202| | * This implementation uses projective coordinates, which do not have an efficient complete 203| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 204| | * 205| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 206| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 207| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 208| | * output (the identity element) 209| | */ 210| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (210:7): [True: 0, False: 735] ------------------ 211| 0| return a.dbl(); 212| 0| } 213| | 214| 735| const auto HH = H.square(); 215| 735| const auto HHH = H * HH; 216| 735| const auto V = U1 * HH; 217| 735| const auto t2 = r.square(); 218| 735| const auto t3 = V + V; 219| 735| const auto t4 = t2 - HHH; 220| 735| auto X3 = t4 - t3; 221| 735| const auto t5 = V - X3; 222| 735| const auto t6 = S1 * HHH; 223| 735| const auto t7 = r * t5; 224| 735| auto Y3 = t7 - t6; 225| 735| const auto t8 = b.z() * H; 226| 735| auto Z3 = a.z() * t8; 227| | 228| | // if a is identity then return b 229| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 230| | 231| | // if b is identity then return a 232| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 233| | 234| 735| return ProjectivePoint(X3, Y3, Z3); 235| 735|} pcurves_secp256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 1|auto to_affine_batch(std::span projective) { 108| 1| using AffinePoint = typename C::AffinePoint; 109| | 110| 1| const size_t N = projective.size(); 111| 1| std::vector affine; 112| 1| affine.reserve(N); 113| | 114| 1| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 1.56k, False: 1] ------------------ 117| 1.56k| any_identity = any_identity || pt.is_identity(); 118| 1.56k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 1] | Branch (126:17): [True: 0, False: 1] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 1| } else { 134| 1| std::vector c; 135| 1| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 1| c.push_back(projective[0].z()); 145| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 1.56k, False: 1] ------------------ 146| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 147| 1.56k| } 148| | 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| 1| } else { 153| 1| return invert_field_element(c[N - 1]); 154| 1| } 155| 1| }(); 156| | 157| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 1.56k, False: 1] ------------------ 158| 1.56k| const auto& p = projective[i]; 159| | 160| 1.56k| const auto z_inv = s_inv * c[i - 1]; 161| 1.56k| const auto z2_inv = z_inv.square(); 162| 1.56k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 1.56k| s_inv = s_inv * p.z(); 165| | 166| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 1.56k| } 168| | 169| 1| const auto z2_inv = s_inv.square(); 170| 1| const auto z3_inv = s_inv * z2_inv; 171| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 1| std::reverse(affine.begin(), affine.end()); 173| 1| return affine; 174| 1| } 175| | 176| 0| return affine; 177| 1|} pcurves_secp256r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_19secp256r15CurveEEEDaRKNT_15ProjectivePointE: 76| 398|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 77| | // Not strictly required right? - default should work as long 78| | // as (0,0) is identity and invert returns 0 on 0 79| | 80| 398| if constexpr(curve_supports_fe_invert2) { 81| 398| const auto z2_inv = C::fe_invert2(pt.z()); 82| 398| const auto z3_inv = z2_inv.square() * pt.z(); 83| 398| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 84| | } else { 85| | const auto z_inv = invert_field_element(pt.z()); 86| | const auto z2_inv = z_inv.square(); 87| | const auto z3_inv = z_inv * z2_inv; 88| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 89| | } 90| 398|} pcurves_secp256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| | } else { 153| | return invert_field_element(c[N - 1]); 154| | } 155| 1| }(); pcurves_secp256r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_: 296| 35.3k| const FieldElement& one) { 297| 35.3k| const auto a_is_identity = a.is_identity(); 298| 35.3k| const auto b_is_identity = b.is_identity(); 299| | 300| | /* 301| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 302| | 303| | Cost: 8M + 3S + 6add + 1*2 304| | */ 305| | 306| 35.3k| auto by = b.y(); 307| 35.3k| by.conditional_assign(sub, by.negate()); 308| | 309| 35.3k| const auto Z1Z1 = a.z().square(); 310| 35.3k| const auto U2 = b.x() * Z1Z1; 311| 35.3k| const auto S2 = by * a.z() * Z1Z1; 312| 35.3k| const auto H = U2 - a.x(); 313| 35.3k| const auto r = S2 - a.y(); 314| | 315| | /* Risky conditional 316| | * 317| | * This implementation uses projective coordinates, which do not have an efficient complete 318| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 319| | * 320| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 321| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 322| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 323| | * (the identity element) 324| | */ 325| 35.3k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (325:7): [True: 0, False: 35.3k] ------------------ 326| 0| return a.dbl(); 327| 0| } 328| | 329| 35.3k| const auto HH = H.square(); 330| 35.3k| const auto HHH = H * HH; 331| 35.3k| const auto V = a.x() * HH; 332| 35.3k| const auto t2 = r.square(); 333| 35.3k| const auto t3 = V + V; 334| 35.3k| const auto t4 = t2 - HHH; 335| 35.3k| auto X3 = t4 - t3; 336| 35.3k| const auto t5 = V - X3; 337| 35.3k| const auto t6 = a.y() * HHH; 338| 35.3k| const auto t7 = r * t5; 339| 35.3k| auto Y3 = t7 - t6; 340| 35.3k| auto Z3 = a.z() * H; 341| | 342| | // if a is identity then return b 343| 35.3k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 344| | 345| | // if b is identity then return a 346| 35.3k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 347| | 348| 35.3k| return ProjectivePoint(X3, Y3, Z3); 349| 35.3k|} pcurves_secp256r1.cpp:_ZN5Botan11to_affine_xINS_6PCurve12_GLOBAL__N_19secp256r15CurveEEEDaRKNT_15ProjectivePointE: 96| 285|auto to_affine_x(const typename C::ProjectivePoint& pt) { 97| 285| if constexpr(curve_supports_fe_invert2) { 98| 285| return pt.x() * C::fe_invert2(pt.z()); 99| | } else { 100| | const auto z_inv = invert_field_element(pt.z()); 101| | const auto z2_inv = z_inv.square(); 102| | return pt.x() * z2_inv; 103| | } 104| 285|} pcurves_secp256r1.cpp:_ZN5Botan15point_add_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_RKT1_: 240| 1.99k| const FieldElement& one) { 241| 1.99k| const auto a_is_identity = a.is_identity(); 242| 1.99k| const auto b_is_identity = b.is_identity(); 243| | 244| | /* 245| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 246| | 247| | Cost: 8M + 3S + 6add + 1*2 248| | */ 249| | 250| 1.99k| const auto Z1Z1 = a.z().square(); 251| 1.99k| const auto U2 = b.x() * Z1Z1; 252| 1.99k| const auto S2 = b.y() * a.z() * Z1Z1; 253| 1.99k| const auto H = U2 - a.x(); 254| 1.99k| const auto r = S2 - a.y(); 255| | 256| | /* Risky conditional 257| | * 258| | * This implementation uses projective coordinates, which do not have an efficient complete 259| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 260| | * 261| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 262| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 263| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 264| | * (the identity element) 265| | */ 266| 1.99k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (266:7): [True: 0, False: 1.99k] ------------------ 267| 0| return a.dbl(); 268| 0| } 269| | 270| 1.99k| const auto HH = H.square(); 271| 1.99k| const auto HHH = H * HH; 272| 1.99k| const auto V = a.x() * HH; 273| 1.99k| const auto t2 = r.square(); 274| 1.99k| const auto t3 = V + V; 275| 1.99k| const auto t4 = t2 - HHH; 276| 1.99k| auto X3 = t4 - t3; 277| 1.99k| const auto t5 = V - X3; 278| 1.99k| const auto t6 = a.y() * HHH; 279| 1.99k| const auto t7 = r * t5; 280| 1.99k| auto Y3 = t7 - t6; 281| 1.99k| auto Z3 = a.z() * H; 282| | 283| | // if a is identity then return b 284| 1.99k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), one); 285| | 286| | // if b is identity then return a 287| 1.99k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 288| | 289| 1.99k| return ProjectivePoint(X3, Y3, Z3); 290| 1.99k|} pcurves_secp256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 285|auto to_affine_batch(std::span projective) { 108| 285| using AffinePoint = typename C::AffinePoint; 109| | 110| 285| const size_t N = projective.size(); 111| 285| std::vector affine; 112| 285| affine.reserve(N); 113| | 114| 285| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 4.56k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 4.56k, False: 285] ------------------ 117| 4.56k| any_identity = any_identity || pt.is_identity(); 118| 4.56k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 285| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 285] | Branch (126:17): [True: 0, False: 285] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 285| } else { 134| 285| std::vector c; 135| 285| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 285| c.push_back(projective[0].z()); 145| 4.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 4.27k, False: 285] ------------------ 146| 4.27k| c.push_back(c[i - 1] * projective[i].z()); 147| 4.27k| } 148| | 149| 285| auto s_inv = [&]() { 150| 285| if constexpr(VariableTime) { 151| 285| return c[N - 1].invert_vartime(); 152| 285| } else { 153| 285| return invert_field_element(c[N - 1]); 154| 285| } 155| 285| }(); 156| | 157| 4.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 4.27k, False: 285] ------------------ 158| 4.27k| const auto& p = projective[i]; 159| | 160| 4.27k| const auto z_inv = s_inv * c[i - 1]; 161| 4.27k| const auto z2_inv = z_inv.square(); 162| 4.27k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 4.27k| s_inv = s_inv * p.z(); 165| | 166| 4.27k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 4.27k| } 168| | 169| 285| const auto z2_inv = s_inv.square(); 170| 285| const auto z3_inv = s_inv * z2_inv; 171| 285| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 285| std::reverse(affine.begin(), affine.end()); 173| 285| return affine; 174| 285| } 175| | 176| 0| return affine; 177| 285|} pcurves_secp256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 285| auto s_inv = [&]() { 150| | if constexpr(VariableTime) { 151| | return c[N - 1].invert_vartime(); 152| 285| } else { 153| 285| return invert_field_element(c[N - 1]); 154| 285| } 155| 285| }(); pcurves_secp256r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_19secp256r15CurveEEEDaRKNT_12FieldElementE: 35| 285|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 36| 285| if constexpr(curve_supports_fe_invert2) { 37| 285| return C::fe_invert2(fe) * fe; 38| | } else { 39| | return fe.invert(); 40| | } 41| 285|} pcurves_secp256r1.cpp:_ZN5Botan15dbl_n_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_m: 432| 16.2k|inline constexpr ProjectivePoint dbl_n_a_minus_3(const ProjectivePoint& pt, size_t n) { 433| 16.2k| auto nx = pt.x(); 434| 16.2k| auto ny = pt.y().mul2(); 435| 16.2k| auto nz = pt.z(); 436| 16.2k| auto w = nz.square().square(); 437| | 438| | // Conditional ok: loop iteration count is public 439| 97.4k| while(n > 0) { ------------------ | Branch (439:10): [True: 81.2k, False: 16.2k] ------------------ 440| 81.2k| const auto ny2 = ny.square(); 441| 81.2k| const auto ny4 = ny2.square(); 442| 81.2k| const auto t1 = (nx.square() - w).mul3(); 443| 81.2k| const auto t2 = nx * ny2; 444| 81.2k| nx = t1.square() - t2.mul2(); 445| 81.2k| nz *= ny; 446| 81.2k| ny = t1 * (t2 - nx).mul2() - ny4; 447| 81.2k| n--; 448| | // Conditional ok: loop iteration count is public 449| 81.2k| if(n > 0) { ------------------ | Branch (449:10): [True: 64.9k, False: 16.2k] ------------------ 450| 64.9k| w *= ny4; 451| 64.9k| } 452| 81.2k| } 453| 16.2k| return ProjectivePoint(nx, ny.div2(), nz); 454| 16.2k|} pcurves_secp256r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp256r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_: 60| 289|inline constexpr CT::Option sqrt_field_element(const typename C::FieldElement& fe) { 61| 289| if constexpr(curve_supports_fe_sqrt) { 62| 289| auto z = C::fe_sqrt(fe); 63| | // Zero out the return value if it would otherwise be incorrect 64| 289| const CT::Choice correct = (z.square() == fe); 65| 289| z.conditional_assign(!correct, C::FieldElement::zero()); 66| 289| return CT::Option(z, correct); 67| | } else { 68| | return fe.sqrt(); 69| | } 70| 289|} pcurves_secp384r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_: 362| 2.87k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 363| | /* 364| | if a == -3 then 365| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 366| | */ 367| 2.87k| const auto z2 = pt.z().square(); 368| 2.87k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 369| | 370| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 371| 2.87k| const auto y2 = pt.y().square(); 372| 2.87k| const auto s = pt.x().mul4() * y2; 373| 2.87k| const auto nx = m.square() - s.mul2(); 374| 2.87k| const auto ny = m * (s - nx) - y2.square().mul8(); 375| 2.87k| const auto nz = pt.y().mul2() * pt.z(); 376| | 377| 2.87k| return ProjectivePoint(nx, ny, nz); 378| 2.87k|} pcurves_secp384r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 187| 1.09k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 188| 1.09k| const auto a_is_identity = a.is_identity(); 189| 1.09k| const auto b_is_identity = b.is_identity(); 190| | 191| 1.09k| const auto Z1Z1 = a.z().square(); 192| 1.09k| const auto Z2Z2 = b.z().square(); 193| 1.09k| const auto U1 = a.x() * Z2Z2; 194| 1.09k| const auto U2 = b.x() * Z1Z1; 195| 1.09k| const auto S1 = a.y() * b.z() * Z2Z2; 196| 1.09k| const auto S2 = b.y() * a.z() * Z1Z1; 197| 1.09k| const auto H = U2 - U1; 198| 1.09k| const auto r = S2 - S1; 199| | 200| | /* Risky conditional 201| | * 202| | * This implementation uses projective coordinates, which do not have an efficient complete 203| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 204| | * 205| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 206| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 207| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 208| | * output (the identity element) 209| | */ 210| 1.09k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (210:7): [True: 0, False: 1.09k] ------------------ 211| 0| return a.dbl(); 212| 0| } 213| | 214| 1.09k| const auto HH = H.square(); 215| 1.09k| const auto HHH = H * HH; 216| 1.09k| const auto V = U1 * HH; 217| 1.09k| const auto t2 = r.square(); 218| 1.09k| const auto t3 = V + V; 219| 1.09k| const auto t4 = t2 - HHH; 220| 1.09k| auto X3 = t4 - t3; 221| 1.09k| const auto t5 = V - X3; 222| 1.09k| const auto t6 = S1 * HHH; 223| 1.09k| const auto t7 = r * t5; 224| 1.09k| auto Y3 = t7 - t6; 225| 1.09k| const auto t8 = b.z() * H; 226| 1.09k| auto Z3 = a.z() * t8; 227| | 228| | // if a is identity then return b 229| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 230| | 231| | // if b is identity then return a 232| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 233| | 234| 1.09k| return ProjectivePoint(X3, Y3, Z3); 235| 1.09k|} pcurves_secp384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 1|auto to_affine_batch(std::span projective) { 108| 1| using AffinePoint = typename C::AffinePoint; 109| | 110| 1| const size_t N = projective.size(); 111| 1| std::vector affine; 112| 1| affine.reserve(N); 113| | 114| 1| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 2.33k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 2.33k, False: 1] ------------------ 117| 2.33k| any_identity = any_identity || pt.is_identity(); 118| 2.33k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 1] | Branch (126:17): [True: 0, False: 1] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 1| } else { 134| 1| std::vector c; 135| 1| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 1| c.push_back(projective[0].z()); 145| 2.33k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 2.33k, False: 1] ------------------ 146| 2.33k| c.push_back(c[i - 1] * projective[i].z()); 147| 2.33k| } 148| | 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| 1| } else { 153| 1| return invert_field_element(c[N - 1]); 154| 1| } 155| 1| }(); 156| | 157| 2.33k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 2.33k, False: 1] ------------------ 158| 2.33k| const auto& p = projective[i]; 159| | 160| 2.33k| const auto z_inv = s_inv * c[i - 1]; 161| 2.33k| const auto z2_inv = z_inv.square(); 162| 2.33k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 2.33k| s_inv = s_inv * p.z(); 165| | 166| 2.33k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 2.33k| } 168| | 169| 1| const auto z2_inv = s_inv.square(); 170| 1| const auto z3_inv = s_inv * z2_inv; 171| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 1| std::reverse(affine.begin(), affine.end()); 173| 1| return affine; 174| 1| } 175| | 176| 0| return affine; 177| 1|} pcurves_secp384r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_19secp384r15CurveEEEDaRKNT_15ProjectivePointE: 76| 290|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 77| | // Not strictly required right? - default should work as long 78| | // as (0,0) is identity and invert returns 0 on 0 79| | 80| 290| if constexpr(curve_supports_fe_invert2) { 81| 290| const auto z2_inv = C::fe_invert2(pt.z()); 82| 290| const auto z3_inv = z2_inv.square() * pt.z(); 83| 290| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 84| | } else { 85| | const auto z_inv = invert_field_element(pt.z()); 86| | const auto z2_inv = z_inv.square(); 87| | const auto z3_inv = z_inv * z2_inv; 88| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 89| | } 90| 290|} pcurves_secp384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| | } else { 153| | return invert_field_element(c[N - 1]); 154| | } 155| 1| }(); pcurves_secp384r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_: 296| 38.4k| const FieldElement& one) { 297| 38.4k| const auto a_is_identity = a.is_identity(); 298| 38.4k| const auto b_is_identity = b.is_identity(); 299| | 300| | /* 301| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 302| | 303| | Cost: 8M + 3S + 6add + 1*2 304| | */ 305| | 306| 38.4k| auto by = b.y(); 307| 38.4k| by.conditional_assign(sub, by.negate()); 308| | 309| 38.4k| const auto Z1Z1 = a.z().square(); 310| 38.4k| const auto U2 = b.x() * Z1Z1; 311| 38.4k| const auto S2 = by * a.z() * Z1Z1; 312| 38.4k| const auto H = U2 - a.x(); 313| 38.4k| const auto r = S2 - a.y(); 314| | 315| | /* Risky conditional 316| | * 317| | * This implementation uses projective coordinates, which do not have an efficient complete 318| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 319| | * 320| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 321| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 322| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 323| | * (the identity element) 324| | */ 325| 38.4k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (325:7): [True: 0, False: 38.4k] ------------------ 326| 0| return a.dbl(); 327| 0| } 328| | 329| 38.4k| const auto HH = H.square(); 330| 38.4k| const auto HHH = H * HH; 331| 38.4k| const auto V = a.x() * HH; 332| 38.4k| const auto t2 = r.square(); 333| 38.4k| const auto t3 = V + V; 334| 38.4k| const auto t4 = t2 - HHH; 335| 38.4k| auto X3 = t4 - t3; 336| 38.4k| const auto t5 = V - X3; 337| 38.4k| const auto t6 = a.y() * HHH; 338| 38.4k| const auto t7 = r * t5; 339| 38.4k| auto Y3 = t7 - t6; 340| 38.4k| auto Z3 = a.z() * H; 341| | 342| | // if a is identity then return b 343| 38.4k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 344| | 345| | // if b is identity then return a 346| 38.4k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 347| | 348| 38.4k| return ProjectivePoint(X3, Y3, Z3); 349| 38.4k|} pcurves_secp384r1.cpp:_ZN5Botan11to_affine_xINS_6PCurve12_GLOBAL__N_19secp384r15CurveEEEDaRKNT_15ProjectivePointE: 96| 204|auto to_affine_x(const typename C::ProjectivePoint& pt) { 97| 204| if constexpr(curve_supports_fe_invert2) { 98| 204| return pt.x() * C::fe_invert2(pt.z()); 99| | } else { 100| | const auto z_inv = invert_field_element(pt.z()); 101| | const auto z2_inv = z_inv.square(); 102| | return pt.x() * z2_inv; 103| | } 104| 204|} pcurves_secp384r1.cpp:_ZN5Botan15point_add_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_RKT1_: 240| 1.42k| const FieldElement& one) { 241| 1.42k| const auto a_is_identity = a.is_identity(); 242| 1.42k| const auto b_is_identity = b.is_identity(); 243| | 244| | /* 245| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 246| | 247| | Cost: 8M + 3S + 6add + 1*2 248| | */ 249| | 250| 1.42k| const auto Z1Z1 = a.z().square(); 251| 1.42k| const auto U2 = b.x() * Z1Z1; 252| 1.42k| const auto S2 = b.y() * a.z() * Z1Z1; 253| 1.42k| const auto H = U2 - a.x(); 254| 1.42k| const auto r = S2 - a.y(); 255| | 256| | /* Risky conditional 257| | * 258| | * This implementation uses projective coordinates, which do not have an efficient complete 259| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 260| | * 261| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 262| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 263| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 264| | * (the identity element) 265| | */ 266| 1.42k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (266:7): [True: 0, False: 1.42k] ------------------ 267| 0| return a.dbl(); 268| 0| } 269| | 270| 1.42k| const auto HH = H.square(); 271| 1.42k| const auto HHH = H * HH; 272| 1.42k| const auto V = a.x() * HH; 273| 1.42k| const auto t2 = r.square(); 274| 1.42k| const auto t3 = V + V; 275| 1.42k| const auto t4 = t2 - HHH; 276| 1.42k| auto X3 = t4 - t3; 277| 1.42k| const auto t5 = V - X3; 278| 1.42k| const auto t6 = a.y() * HHH; 279| 1.42k| const auto t7 = r * t5; 280| 1.42k| auto Y3 = t7 - t6; 281| 1.42k| auto Z3 = a.z() * H; 282| | 283| | // if a is identity then return b 284| 1.42k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), one); 285| | 286| | // if b is identity then return a 287| 1.42k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 288| | 289| 1.42k| return ProjectivePoint(X3, Y3, Z3); 290| 1.42k|} pcurves_secp384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 204|auto to_affine_batch(std::span projective) { 108| 204| using AffinePoint = typename C::AffinePoint; 109| | 110| 204| const size_t N = projective.size(); 111| 204| std::vector affine; 112| 204| affine.reserve(N); 113| | 114| 204| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 3.26k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 3.26k, False: 204] ------------------ 117| 3.26k| any_identity = any_identity || pt.is_identity(); 118| 3.26k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 204| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 204] | Branch (126:17): [True: 0, False: 204] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 204| } else { 134| 204| std::vector c; 135| 204| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 204| c.push_back(projective[0].z()); 145| 3.26k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 3.06k, False: 204] ------------------ 146| 3.06k| c.push_back(c[i - 1] * projective[i].z()); 147| 3.06k| } 148| | 149| 204| auto s_inv = [&]() { 150| 204| if constexpr(VariableTime) { 151| 204| return c[N - 1].invert_vartime(); 152| 204| } else { 153| 204| return invert_field_element(c[N - 1]); 154| 204| } 155| 204| }(); 156| | 157| 3.26k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 3.06k, False: 204] ------------------ 158| 3.06k| const auto& p = projective[i]; 159| | 160| 3.06k| const auto z_inv = s_inv * c[i - 1]; 161| 3.06k| const auto z2_inv = z_inv.square(); 162| 3.06k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 3.06k| s_inv = s_inv * p.z(); 165| | 166| 3.06k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 3.06k| } 168| | 169| 204| const auto z2_inv = s_inv.square(); 170| 204| const auto z3_inv = s_inv * z2_inv; 171| 204| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 204| std::reverse(affine.begin(), affine.end()); 173| 204| return affine; 174| 204| } 175| | 176| 0| return affine; 177| 204|} pcurves_secp384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 204| auto s_inv = [&]() { 150| | if constexpr(VariableTime) { 151| | return c[N - 1].invert_vartime(); 152| 204| } else { 153| 204| return invert_field_element(c[N - 1]); 154| 204| } 155| 204| }(); pcurves_secp384r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_19secp384r15CurveEEEDaRKNT_12FieldElementE: 35| 204|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 36| 204| if constexpr(curve_supports_fe_invert2) { 37| 204| return C::fe_invert2(fe) * fe; 38| | } else { 39| | return fe.invert(); 40| | } 41| 204|} pcurves_secp384r1.cpp:_ZN5Botan15dbl_n_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_m: 432| 17.5k|inline constexpr ProjectivePoint dbl_n_a_minus_3(const ProjectivePoint& pt, size_t n) { 433| 17.5k| auto nx = pt.x(); 434| 17.5k| auto ny = pt.y().mul2(); 435| 17.5k| auto nz = pt.z(); 436| 17.5k| auto w = nz.square().square(); 437| | 438| | // Conditional ok: loop iteration count is public 439| 105k| while(n > 0) { ------------------ | Branch (439:10): [True: 87.7k, False: 17.5k] ------------------ 440| 87.7k| const auto ny2 = ny.square(); 441| 87.7k| const auto ny4 = ny2.square(); 442| 87.7k| const auto t1 = (nx.square() - w).mul3(); 443| 87.7k| const auto t2 = nx * ny2; 444| 87.7k| nx = t1.square() - t2.mul2(); 445| 87.7k| nz *= ny; 446| 87.7k| ny = t1 * (t2 - nx).mul2() - ny4; 447| 87.7k| n--; 448| | // Conditional ok: loop iteration count is public 449| 87.7k| if(n > 0) { ------------------ | Branch (449:10): [True: 70.1k, False: 17.5k] ------------------ 450| 70.1k| w *= ny4; 451| 70.1k| } 452| 87.7k| } 453| 17.5k| return ProjectivePoint(nx, ny.div2(), nz); 454| 17.5k|} pcurves_secp384r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp384r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_: 60| 208|inline constexpr CT::Option sqrt_field_element(const typename C::FieldElement& fe) { 61| 208| if constexpr(curve_supports_fe_sqrt) { 62| 208| auto z = C::fe_sqrt(fe); 63| | // Zero out the return value if it would otherwise be incorrect 64| 208| const CT::Choice correct = (z.square() == fe); 65| 208| z.conditional_assign(!correct, C::FieldElement::zero()); 66| 208| return CT::Option(z, correct); 67| | } else { 68| | return fe.sqrt(); 69| | } 70| 208|} pcurves_secp521r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 362| 4.22k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 363| | /* 364| | if a == -3 then 365| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 366| | */ 367| 4.22k| const auto z2 = pt.z().square(); 368| 4.22k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 369| | 370| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 371| 4.22k| const auto y2 = pt.y().square(); 372| 4.22k| const auto s = pt.x().mul4() * y2; 373| 4.22k| const auto nx = m.square() - s.mul2(); 374| 4.22k| const auto ny = m * (s - nx) - y2.square().mul8(); 375| 4.22k| const auto nz = pt.y().mul2() * pt.z(); 376| | 377| 4.22k| return ProjectivePoint(nx, ny, nz); 378| 4.22k|} pcurves_secp521r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 187| 1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 188| 1.45k| const auto a_is_identity = a.is_identity(); 189| 1.45k| const auto b_is_identity = b.is_identity(); 190| | 191| 1.45k| const auto Z1Z1 = a.z().square(); 192| 1.45k| const auto Z2Z2 = b.z().square(); 193| 1.45k| const auto U1 = a.x() * Z2Z2; 194| 1.45k| const auto U2 = b.x() * Z1Z1; 195| 1.45k| const auto S1 = a.y() * b.z() * Z2Z2; 196| 1.45k| const auto S2 = b.y() * a.z() * Z1Z1; 197| 1.45k| const auto H = U2 - U1; 198| 1.45k| const auto r = S2 - S1; 199| | 200| | /* Risky conditional 201| | * 202| | * This implementation uses projective coordinates, which do not have an efficient complete 203| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 204| | * 205| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 206| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 207| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 208| | * output (the identity element) 209| | */ 210| 1.45k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (210:7): [True: 0, False: 1.45k] ------------------ 211| 0| return a.dbl(); 212| 0| } 213| | 214| 1.45k| const auto HH = H.square(); 215| 1.45k| const auto HHH = H * HH; 216| 1.45k| const auto V = U1 * HH; 217| 1.45k| const auto t2 = r.square(); 218| 1.45k| const auto t3 = V + V; 219| 1.45k| const auto t4 = t2 - HHH; 220| 1.45k| auto X3 = t4 - t3; 221| 1.45k| const auto t5 = V - X3; 222| 1.45k| const auto t6 = S1 * HHH; 223| 1.45k| const auto t7 = r * t5; 224| 1.45k| auto Y3 = t7 - t6; 225| 1.45k| const auto t8 = b.z() * H; 226| 1.45k| auto Z3 = a.z() * t8; 227| | 228| | // if a is identity then return b 229| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 230| | 231| | // if b is identity then return a 232| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 233| | 234| 1.45k| return ProjectivePoint(X3, Y3, Z3); 235| 1.45k|} pcurves_secp521r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 1|auto to_affine_batch(std::span projective) { 108| 1| using AffinePoint = typename C::AffinePoint; 109| | 110| 1| const size_t N = projective.size(); 111| 1| std::vector affine; 112| 1| affine.reserve(N); 113| | 114| 1| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 3.10k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 3.10k, False: 1] ------------------ 117| 3.10k| any_identity = any_identity || pt.is_identity(); 118| 3.10k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 1] | Branch (126:17): [True: 0, False: 1] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 1| } else { 134| 1| std::vector c; 135| 1| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 1| c.push_back(projective[0].z()); 145| 3.10k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 3.10k, False: 1] ------------------ 146| 3.10k| c.push_back(c[i - 1] * projective[i].z()); 147| 3.10k| } 148| | 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| 1| } else { 153| 1| return invert_field_element(c[N - 1]); 154| 1| } 155| 1| }(); 156| | 157| 3.10k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 3.10k, False: 1] ------------------ 158| 3.10k| const auto& p = projective[i]; 159| | 160| 3.10k| const auto z_inv = s_inv * c[i - 1]; 161| 3.10k| const auto z2_inv = z_inv.square(); 162| 3.10k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 3.10k| s_inv = s_inv * p.z(); 165| | 166| 3.10k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 3.10k| } 168| | 169| 1| const auto z2_inv = s_inv.square(); 170| 1| const auto z3_inv = s_inv * z2_inv; 171| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 1| std::reverse(affine.begin(), affine.end()); 173| 1| return affine; 174| 1| } 175| | 176| 0| return affine; 177| 1|} pcurves_secp521r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_19secp521r15CurveEEEDaRKNT_15ProjectivePointE: 76| 458|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 77| | // Not strictly required right? - default should work as long 78| | // as (0,0) is identity and invert returns 0 on 0 79| | 80| 458| if constexpr(curve_supports_fe_invert2) { 81| 458| const auto z2_inv = C::fe_invert2(pt.z()); 82| 458| const auto z3_inv = z2_inv.square() * pt.z(); 83| 458| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 84| | } else { 85| | const auto z_inv = invert_field_element(pt.z()); 86| | const auto z2_inv = z_inv.square(); 87| | const auto z3_inv = z_inv * z2_inv; 88| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 89| | } 90| 458|} pcurves_secp521r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 1| auto s_inv = [&]() { 150| 1| if constexpr(VariableTime) { 151| 1| return c[N - 1].invert_vartime(); 152| | } else { 153| | return invert_field_element(c[N - 1]); 154| | } 155| 1| }(); pcurves_secp521r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_: 296| 80.9k| const FieldElement& one) { 297| 80.9k| const auto a_is_identity = a.is_identity(); 298| 80.9k| const auto b_is_identity = b.is_identity(); 299| | 300| | /* 301| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 302| | 303| | Cost: 8M + 3S + 6add + 1*2 304| | */ 305| | 306| 80.9k| auto by = b.y(); 307| 80.9k| by.conditional_assign(sub, by.negate()); 308| | 309| 80.9k| const auto Z1Z1 = a.z().square(); 310| 80.9k| const auto U2 = b.x() * Z1Z1; 311| 80.9k| const auto S2 = by * a.z() * Z1Z1; 312| 80.9k| const auto H = U2 - a.x(); 313| 80.9k| const auto r = S2 - a.y(); 314| | 315| | /* Risky conditional 316| | * 317| | * This implementation uses projective coordinates, which do not have an efficient complete 318| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 319| | * 320| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 321| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 322| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 323| | * (the identity element) 324| | */ 325| 80.9k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (325:7): [True: 0, False: 80.9k] ------------------ 326| 0| return a.dbl(); 327| 0| } 328| | 329| 80.9k| const auto HH = H.square(); 330| 80.9k| const auto HHH = H * HH; 331| 80.9k| const auto V = a.x() * HH; 332| 80.9k| const auto t2 = r.square(); 333| 80.9k| const auto t3 = V + V; 334| 80.9k| const auto t4 = t2 - HHH; 335| 80.9k| auto X3 = t4 - t3; 336| 80.9k| const auto t5 = V - X3; 337| 80.9k| const auto t6 = a.y() * HHH; 338| 80.9k| const auto t7 = r * t5; 339| 80.9k| auto Y3 = t7 - t6; 340| 80.9k| auto Z3 = a.z() * H; 341| | 342| | // if a is identity then return b 343| 80.9k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 344| | 345| | // if b is identity then return a 346| 80.9k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 347| | 348| 80.9k| return ProjectivePoint(X3, Y3, Z3); 349| 80.9k|} pcurves_secp521r1.cpp:_ZN5Botan11to_affine_xINS_6PCurve12_GLOBAL__N_19secp521r15CurveEEEDaRKNT_15ProjectivePointE: 96| 322|auto to_affine_x(const typename C::ProjectivePoint& pt) { 97| 322| if constexpr(curve_supports_fe_invert2) { 98| 322| return pt.x() * C::fe_invert2(pt.z()); 99| | } else { 100| | const auto z_inv = invert_field_element(pt.z()); 101| | const auto z2_inv = z_inv.square(); 102| | return pt.x() * z2_inv; 103| | } 104| 322|} pcurves_secp521r1.cpp:_ZN5Botan15point_add_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_RKT1_: 240| 2.25k| const FieldElement& one) { 241| 2.25k| const auto a_is_identity = a.is_identity(); 242| 2.25k| const auto b_is_identity = b.is_identity(); 243| | 244| | /* 245| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 246| | 247| | Cost: 8M + 3S + 6add + 1*2 248| | */ 249| | 250| 2.25k| const auto Z1Z1 = a.z().square(); 251| 2.25k| const auto U2 = b.x() * Z1Z1; 252| 2.25k| const auto S2 = b.y() * a.z() * Z1Z1; 253| 2.25k| const auto H = U2 - a.x(); 254| 2.25k| const auto r = S2 - a.y(); 255| | 256| | /* Risky conditional 257| | * 258| | * This implementation uses projective coordinates, which do not have an efficient complete 259| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 260| | * 261| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 262| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 263| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 264| | * (the identity element) 265| | */ 266| 2.25k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (266:7): [True: 0, False: 2.25k] ------------------ 267| 0| return a.dbl(); 268| 0| } 269| | 270| 2.25k| const auto HH = H.square(); 271| 2.25k| const auto HHH = H * HH; 272| 2.25k| const auto V = a.x() * HH; 273| 2.25k| const auto t2 = r.square(); 274| 2.25k| const auto t3 = V + V; 275| 2.25k| const auto t4 = t2 - HHH; 276| 2.25k| auto X3 = t4 - t3; 277| 2.25k| const auto t5 = V - X3; 278| 2.25k| const auto t6 = a.y() * HHH; 279| 2.25k| const auto t7 = r * t5; 280| 2.25k| auto Y3 = t7 - t6; 281| 2.25k| auto Z3 = a.z() * H; 282| | 283| | // if a is identity then return b 284| 2.25k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), one); 285| | 286| | // if b is identity then return a 287| 2.25k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 288| | 289| 2.25k| return ProjectivePoint(X3, Y3, Z3); 290| 2.25k|} pcurves_secp521r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 107| 322|auto to_affine_batch(std::span projective) { 108| 322| using AffinePoint = typename C::AffinePoint; 109| | 110| 322| const size_t N = projective.size(); 111| 322| std::vector affine; 112| 322| affine.reserve(N); 113| | 114| 322| CT::Choice any_identity = CT::Choice::no(); 115| | 116| 5.15k| for(const auto& pt : projective) { ------------------ | Branch (116:23): [True: 5.15k, False: 322] ------------------ 117| 5.15k| any_identity = any_identity || pt.is_identity(); 118| 5.15k| } 119| | 120| | // Conditional acceptable: N is public. State of points is not necessarily 121| | // public, but we don't leak which point was the identity. In practice with 122| | // the algorithms currently in use, the only time an identity can occur is 123| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 124| | // some k < 16) 125| | 126| 322| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (126:7): [True: 0, False: 322] | Branch (126:17): [True: 0, False: 322] ------------------ 127| | // If there are identity elements, using the batch inversion gets 128| | // tricky. It can be done, but this should be a rare situation so 129| | // just punt to the serial conversion if it occurs 130| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (130:25): [True: 0, False: 0] ------------------ 131| 0| affine.push_back(to_affine(projective[i])); 132| 0| } 133| 322| } else { 134| 322| std::vector c; 135| 322| c.reserve(N); 136| | 137| | /* 138| | Batch projective->affine using Montgomery's trick 139| | 140| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 141| | (Hankerson, Menezes, Vanstone) 142| | */ 143| | 144| 322| c.push_back(projective[0].z()); 145| 5.15k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (145:25): [True: 4.83k, False: 322] ------------------ 146| 4.83k| c.push_back(c[i - 1] * projective[i].z()); 147| 4.83k| } 148| | 149| 322| auto s_inv = [&]() { 150| 322| if constexpr(VariableTime) { 151| 322| return c[N - 1].invert_vartime(); 152| 322| } else { 153| 322| return invert_field_element(c[N - 1]); 154| 322| } 155| 322| }(); 156| | 157| 5.15k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (157:29): [True: 4.83k, False: 322] ------------------ 158| 4.83k| const auto& p = projective[i]; 159| | 160| 4.83k| const auto z_inv = s_inv * c[i - 1]; 161| 4.83k| const auto z2_inv = z_inv.square(); 162| 4.83k| const auto z3_inv = z_inv * z2_inv; 163| | 164| 4.83k| s_inv = s_inv * p.z(); 165| | 166| 4.83k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 167| 4.83k| } 168| | 169| 322| const auto z2_inv = s_inv.square(); 170| 322| const auto z3_inv = s_inv * z2_inv; 171| 322| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 172| 322| std::reverse(affine.begin(), affine.end()); 173| 322| return affine; 174| 322| } 175| | 176| 0| return affine; 177| 322|} pcurves_secp521r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb0EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 149| 322| auto s_inv = [&]() { 150| | if constexpr(VariableTime) { 151| | return c[N - 1].invert_vartime(); 152| 322| } else { 153| 322| return invert_field_element(c[N - 1]); 154| 322| } 155| 322| }(); pcurves_secp521r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_19secp521r15CurveEEEDaRKNT_12FieldElementE: 35| 322|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 36| 322| if constexpr(curve_supports_fe_invert2) { 37| 322| return C::fe_invert2(fe) * fe; 38| | } else { 39| | return fe.invert(); 40| | } 41| 322|} pcurves_secp521r1.cpp:_ZN5Botan15dbl_n_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_m: 432| 37.0k|inline constexpr ProjectivePoint dbl_n_a_minus_3(const ProjectivePoint& pt, size_t n) { 433| 37.0k| auto nx = pt.x(); 434| 37.0k| auto ny = pt.y().mul2(); 435| 37.0k| auto nz = pt.z(); 436| 37.0k| auto w = nz.square().square(); 437| | 438| | // Conditional ok: loop iteration count is public 439| 222k| while(n > 0) { ------------------ | Branch (439:10): [True: 185k, False: 37.0k] ------------------ 440| 185k| const auto ny2 = ny.square(); 441| 185k| const auto ny4 = ny2.square(); 442| 185k| const auto t1 = (nx.square() - w).mul3(); 443| 185k| const auto t2 = nx * ny2; 444| 185k| nx = t1.square() - t2.mul2(); 445| 185k| nz *= ny; 446| 185k| ny = t1 * (t2 - nx).mul2() - ny4; 447| 185k| n--; 448| | // Conditional ok: loop iteration count is public 449| 185k| if(n > 0) { ------------------ | Branch (449:10): [True: 148k, False: 37.0k] ------------------ 450| 148k| w *= ny4; 451| 148k| } 452| 185k| } 453| 37.0k| return ProjectivePoint(nx, ny.div2(), nz); 454| 37.0k|} pcurves_secp521r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp521r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_: 60| 327|inline constexpr CT::Option sqrt_field_element(const typename C::FieldElement& fe) { 61| 327| if constexpr(curve_supports_fe_sqrt) { 62| 327| auto z = C::fe_sqrt(fe); 63| | // Zero out the return value if it would otherwise be incorrect 64| 327| const CT::Choice correct = (z.square() == fe); 65| 327| z.conditional_assign(!correct, C::FieldElement::zero()); 66| 327| return CT::Option(z, correct); 67| | } else { 68| | return fe.sqrt(); 69| | } 70| 327|} pcurves_brainpool256r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1405| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1016| 1.63k| static constexpr Self from_affine(const AffinePoint& pt) { 1017| | /* 1018| | * If the point is the identity element (x=0, y=0) then instead of 1019| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1020| | * encoding of (0, 1, 0) 1021| | * 1022| | * Which we can achieve by a conditional swap of y and z if the 1023| | * affine point is the identity. 1024| | */ 1025| | 1026| 1.63k| auto x = pt.x(); 1027| 1.63k| auto y = pt.y(); 1028| 1.63k| auto z = FieldElement::one(); 1029| | 1030| 1.63k| FieldElement::conditional_swap(pt.is_identity(), y, z); 1031| | 1032| 1.63k| return ProjectiveCurvePoint(x, y, z); 1033| 1.63k| } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE1xEv: 971| 1.76M| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE1yEv: 976| 1.70M| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE3oneEv: 200| 68.2k| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE3oneEv: 99| 68.2k| constexpr static std::array one() { return R1; } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 898| 3.60M| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 410| 1.63k| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 411| 1.63k| const W mask = cond.into_bitmask(); 412| | 413| 8.19k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (413:28): [True: 6.55k, False: 1.63k] ------------------ 414| 6.55k| auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 415| 6.55k| auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 416| 6.55k| x.m_val[i] = nx; 417| 6.55k| y.m_val[i] = ny; 418| 6.55k| } 419| 1.63k| } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 928| 71.4k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 225| 351k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1056| 99.1k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1121| 4.48k| constexpr Self dbl() const { 1122| | if constexpr(Self::A_is_minus_3) { 1123| | return dbl_a_minus_3(*this); 1124| | } else if constexpr(Self::A_is_zero) { 1125| | return dbl_a_zero(*this); 1126| 4.48k| } else { 1127| 4.48k| return dbl_generic(*this, A); 1128| 4.48k| } 1129| 4.48k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1172| 393k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6squareEv: 426| 827k| constexpr BOTAN_FORCE_INLINE Self square() const { 427| 827k| std::array z; // NOLINT(*-member-init) 428| 827k| comba_sqr(z.data(), this->data()); 429| 827k| return Self(Rep::redc(z)); 430| 827k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4dataEv: 896| 3.98M| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 104| 2.65M| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 2.65M| } else { 108| 2.65M| return monty_redc(z, P, P_dash); 109| 2.65M| } 110| 2.65M| } pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 265| 337k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 266| 337k| std::array t; // NOLINT(*-member-init) 267| | 268| 337k| W carry = 0; 269| 1.68M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (269:28): [True: 1.34M, False: 337k] ------------------ 270| 1.34M| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 271| 1.34M| } 272| | 273| 337k| std::array r; // NOLINT(*-member-init) 274| 337k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 275| 337k| return Self(r); 276| 337k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1162| 242k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 335| 134k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 346| 900k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 347| 900k| std::array z; // NOLINT(*-member-init) 348| 900k| comba_mul(z.data(), a.data(), b.data()); 349| 900k| return Self(Rep::redc(z)); 350| 900k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1167| 242k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 338| 4.48k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 281| 791k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 282| 791k| std::array r; // NOLINT(*-member-init) 283| 791k| W carry = 0; 284| 3.95M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (284:28): [True: 3.16M, False: 791k] ------------------ 285| 3.16M| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 286| 3.16M| } 287| | 288| 791k| const auto mask = CT::Mask::expand(carry).value(); 289| | 290| 791k| carry = 0; 291| | 292| 3.95M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (292:28): [True: 3.16M, False: 791k] ------------------ 293| 3.16M| r[i] = word_add(r[i], P[i] & mask, &carry); 294| 3.16M| } 295| | 296| 791k| return Self(r); 297| 791k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 325| 451k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 326| 451k| std::array t = value(); 327| 451k| const W carry = shift_left<1>(t); 328| | 329| 451k| std::array r; // NOLINT(*-member-init) 330| 451k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 331| 451k| return Self(r); 332| 451k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE5valueEv: 894| 477k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 341| 4.48k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1064| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1103| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1082| 74.7k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 395| 130k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 396| 130k| const W mask = cond.into_bitmask(); 397| | 398| 653k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (398:28): [True: 522k, False: 130k] ------------------ 399| 522k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 400| 522k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 401| 522k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 402| 522k| } 403| 130k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6invertEv: 538| 1.63k| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm4EEE: 477| 2.15k| constexpr Self pow_vartime(const std::array& exp) const { 478| 2.15k| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (478:40): [True: 0, Folded] ------------------ 479| 2.15k| constexpr size_t WindowElements = (1 << WindowBits) - 1; 480| | 481| 2.15k| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 482| | 483| | /* 484| | A simple fixed width window modular multiplication. 485| | 486| | TODO: investigate using sliding window here 487| | */ 488| | 489| 2.15k| std::array tbl; 490| | 491| 2.15k| tbl[0] = (*this); 492| | 493| 32.3k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (493:28): [True: 30.2k, False: 2.15k] ------------------ 494| | // Conditional ok: table indexes are public here 495| 30.2k| if(i % 2 == 1) { ------------------ | Branch (495:16): [True: 15.1k, False: 15.1k] ------------------ 496| 15.1k| tbl[i] = tbl[i / 2].square(); 497| 15.1k| } else { 498| 15.1k| tbl[i] = tbl[i - 1] * tbl[0]; 499| 15.1k| } 500| 30.2k| } 501| | 502| 2.15k| auto r = Self::one(); 503| | 504| 2.15k| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 505| | 506| | // Conditional ok: this function is variable time 507| 2.15k| if(w0 > 0) { ------------------ | Branch (507:13): [True: 2.15k, False: 0] ------------------ 508| 2.15k| r = tbl[w0 - 1]; 509| 2.15k| } 510| | 511| 138k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (511:28): [True: 136k, False: 2.15k] ------------------ 512| 136k| r.square_n(WindowBits); 513| | 514| 136k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 515| | 516| | // Conditional ok: this function is variable time 517| 136k| if(w > 0) { ------------------ | Branch (517:16): [True: 126k, False: 9.68k] ------------------ 518| 126k| r *= tbl[w - 1]; 519| 126k| } 520| 136k| } 521| | 522| 2.15k| return r; 523| 2.15k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEC2Ev: 180| 32.3k| constexpr IntMod() : m_val({}) {} pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE8square_nEm: 439| 136k| constexpr void square_n(size_t n) { 440| 136k| std::array z; // NOLINT(*-member-init) 441| 680k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (441:28): [True: 544k, False: 136k] ------------------ 442| 544k| comba_sqr(z.data(), this->data()); 443| 544k| m_val = Rep::redc(z); 444| 544k| } 445| 136k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEmLERKSA_: 355| 374k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 356| 374k| std::array z; // NOLINT(*-member-init) 357| 374k| comba_mul(z.data(), data(), other.data()); 358| 374k| m_val = Rep::redc(z); 359| 374k| return (*this); 360| 374k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 598| 1| constexpr Self invert_vartime() const { 599| | // Conditional ok: this function is variable time 600| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (600:13): [True: 0, False: 1] ------------------ 601| 0| return Self::zero(); 602| 0| } 603| | 604| 1| auto x = Self(std::array{1}); // 1 in standard domain 605| 1| auto b = Self(this->to_words()); // *this in standard domain 606| | 607| | // First loop iteration 608| 1| Self::_invert_vartime_div2_helper(b, x); 609| | 610| 1| auto a = b.negate(); 611| | // y += x but y is zero at the outset 612| 1| auto y = x; 613| | 614| | // First half of second loop iteration 615| 1| Self::_invert_vartime_div2_helper(a, y); 616| | 617| 177| for(;;) { 618| | // Conditional ok: this function is variable time 619| 177| if(a.m_val == b.m_val) { ------------------ | Branch (619:16): [True: 1, False: 176] ------------------ 620| | // At this point it should be that a == b == 1 621| 1| auto r = y.negate(); 622| | 623| | // Convert back to Montgomery if required 624| 1| r.m_val = Rep::to_rep(r.m_val); 625| 1| return r; 626| 1| } 627| | 628| 176| auto nx = x + y; 629| | 630| | /* 631| | * Otherwise either b > a or a > b 632| | * 633| | * If b > a we want to set b to b - a 634| | * Otherwise we want to set a to a - b 635| | * 636| | * Compute r = b - a and check if it underflowed 637| | * If it did not then we are in the b > a path 638| | */ 639| 176| std::array r; // NOLINT(*-member-init) 640| 176| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 641| | 642| | // Conditional ok: this function is variable time 643| 176| if(carry == 0) { ------------------ | Branch (643:16): [True: 94, False: 82] ------------------ 644| | // b > a 645| 94| b.m_val = r; 646| 94| x = nx; 647| 94| Self::_invert_vartime_div2_helper(b, x); 648| 94| } else { 649| | // We know this can't underflow because a > b 650| 82| bigint_sub3(r.data(), a.data(), N, b.data(), N); 651| 82| a.m_val = r; 652| 82| y = nx; 653| 82| Self::_invert_vartime_div2_helper(a, y); 654| 82| } 655| 176| } 656| 1| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4zeroEv: 195| 125k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 734| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 137| 6.01k| constexpr static std::array from_rep(const std::array& z) { 138| 6.01k| std::array ze = {}; 139| 6.01k| copy_mem(std::span{ze}.template first(), z); 140| 6.01k| return Self::redc(ze); 141| 6.01k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 547| 178| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 548| 178| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 549| | 550| | // Conditional ok: this function is variable time 551| 553| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (551:16): [True: 375, False: 178] ------------------ 552| 375| shift_right<1>(a.m_val); 553| | 554| 375| const W borrow = shift_right<1>(x.m_val); 555| | 556| | // Conditional ok: this function is variable time 557| 375| if(borrow) { ------------------ | Branch (557:16): [True: 193, False: 182] ------------------ 558| 193| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 559| 193| } 560| 375| } 561| 178| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6negateEv: 452| 62.4k| constexpr Self negate() const { 453| 62.4k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 454| | 455| 62.4k| std::array r; // NOLINT(*-member-init) 456| 62.4k| W carry = 0; 457| 312k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (457:28): [True: 249k, False: 62.4k] ------------------ 458| 249k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 459| 249k| } 460| | 461| 62.4k| return Self(r); 462| 62.4k| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 115| 6.31k| constexpr static std::array to_rep(const std::array& x) { 116| 6.31k| std::array z; // NOLINT(*-member-init) 117| 6.31k| comba_mul(z.data(), x.data(), R2.data()); 118| 6.31k| return Self::redc(z); 119| 6.31k| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 917| 78.0k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 5.44k| std::array stash_value() const { 760| 5.44k| static_assert(L >= N); 761| 5.44k| std::array stash = {}; 762| 27.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 21.7k, False: 5.44k] ------------------ 763| 21.7k| stash[i] = m_val[i]; 764| 21.7k| } 765| 5.44k| return stash; 766| 5.44k| } pcurves_brainpool256r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1407| 725| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1408| 725| const BlindedScalar scalar(s, rng); 1409| 725| return basemul_booth_exec(m_table, scalar, rng); 1410| 725| } pcurves_brainpool256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 725| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 725| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 725, Folded] | Branch (1308:33): [True: 725, False: 0] ------------------ 1309| 725| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 725| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 725| constexpr size_t n_words = C::Words; 1313| | 1314| 725| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 725| rng.randomize(maskb, MaskBytes); 1316| | 1317| 725| W mask[n_words] = {0}; 1318| 725| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 725| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 725| if constexpr(ExcessBits > 0) { 1323| 725| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 725| mask[MaskWords - 1] &= ExcessMask; 1325| 725| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 725| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 725| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 725| mask[0] |= 1; 1331| | 1332| 725| W mask_n[2 * n_words] = {0}; 1333| | 1334| 725| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 725| comba_mul(mask_n, mask, C::NW.data()); 1338| 725| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 725| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 725| m_bytes = store_be>(mask_n); 1342| 725| m_bits = C::Scalar::BITS + BlindingBits; 1343| 725| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 725| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 725| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE8to_wordsEv: 734| 1.18k| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 137| 1.90k| constexpr static std::array from_rep(const std::array& z) { 138| 1.90k| std::array ze = {}; 139| 1.90k| copy_mem(std::span{ze}.template first(), z); 140| 1.90k| return Self::redc(ze); 141| 1.90k| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 104| 2.63k| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 2.63k| } else { 108| 2.63k| return monty_redc(z, P, P_dash); 109| 2.63k| } 110| 2.63k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 739| 725| constexpr void serialize_to(std::span bytes) const { 740| 725| auto v = Rep::from_rep(m_val); 741| 725| std::reverse(v.begin(), v.end()); 742| | 743| 725| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 725| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 725| } pcurves_brainpool256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EE4bitsEv: 1305| 725| size_t bits() const { return m_bits; } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1084| 1.18k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1085| 1.18k| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1086| 1.18k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E6negateEv: 1134| 1.18k| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1174| 1.18k| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18_const_time_poisonEv: 889| 3.54k| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_brainpool256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EE10get_windowEm: 1353| 35.5k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 35.5k| return read_window_bits(std::span{m_bytes}, offset); 1356| 35.5k| } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1096| 60.7k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1097| 60.7k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one()); 1098| 60.7k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 367| 61.7k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 368| 61.7k| const W mask = cond.into_bitmask(); 369| | 370| 308k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (370:28): [True: 247k, False: 61.7k] ------------------ 371| 247k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 372| 247k| } 373| 61.7k| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 955| 35.5k| static constexpr auto ct_select(std::span pts, size_t idx) { 956| 35.5k| auto result = Self::identity(pts[0]); 957| | 958| | // Intentionally wrapping; set to maximum size_t if idx == 0 959| 35.5k| const size_t idx1 = static_cast(idx - 1); 960| 1.17M| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (960:28): [True: 1.13M, False: 35.5k] ------------------ 961| 1.13M| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 962| 1.13M| result.conditional_assign(found, pts[i]); 963| 1.13M| } 964| | 965| 35.5k| return result; 966| 35.5k| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE8identityERKSC_: 924| 61.9k| static constexpr Self identity(const Self& /*unused*/) { 925| 61.9k| return Self(FieldElement::zero(), FieldElement::zero()); 926| 61.9k| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 981| 1.55M| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 982| 1.55M| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 983| 1.55M| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 380| 1.55M| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 381| 1.55M| const W mask = cond.into_bitmask(); 382| | 383| 7.79M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (383:28): [True: 6.23M, False: 1.55M] ------------------ 384| 6.23M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 385| 6.23M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 386| 6.23M| } 387| 1.55M| } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E13randomize_repERNS_21RandomNumberGeneratorE: 1142| 4.72k| void randomize_rep(RandomNumberGenerator& rng) { 1143| | // In certain contexts we may be called with a Null_RNG; in that case the 1144| | // caller is accepting that randomization will not occur 1145| | 1146| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1147| 4.72k| if(rng.is_seeded()) { ------------------ | Branch (1147:13): [True: 4.72k, False: 0] ------------------ 1148| 4.72k| auto r = FieldElement::random(rng); 1149| | 1150| 4.72k| auto r2 = r.square(); 1151| 4.72k| auto r3 = r2 * r; 1152| | 1153| 4.72k| m_x *= r2; 1154| 4.72k| m_y *= r3; 1155| 4.72k| m_z *= r; 1156| 4.72k| } 1157| 4.72k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 4.72k| static Self random(RandomNumberGenerator& rng) { 852| 4.72k| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 4.72k| std::array buf{}; 855| | 856| 7.06k| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 7.06k, False: 0] ------------------ 857| 7.06k| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 7.06k| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 4.72k, False: 2.34k] ------------------ 868| 4.72k| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 4.72k, False: 0] ------------------ 869| 4.72k| return s.value(); 870| 4.72k| } 871| 4.72k| } 872| 7.06k| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 4.72k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 8.65k| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 8.65k| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 8.65k] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 8.65k| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 8.65k| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 2.34k, False: 6.31k] ------------------ 802| 2.34k| return {}; 803| 2.34k| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 6.31k| return Self::from_words(words); 807| 8.65k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE: 211| 6.31k| static constexpr Self from_words(std::array w) { 212| 6.31k| if constexpr(L == N) { 213| 6.31k| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 6.31k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE10is_nonzeroEv: 230| 4.72k| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1176| 1.18k| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE20_const_time_unpoisonEv: 891| 3.54k| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_brainpool256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EED2Ev: 1358| 725| ~BlindedScalarBits() { 1359| 725| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 725| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 725| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 2.63k| static Self from_stash(const std::array& stash) { 775| 2.63k| static_assert(L >= N); 776| 2.63k| std::array val = {}; 777| 13.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 10.5k, False: 2.63k] ------------------ 778| 10.5k| val[i] = stash[i]; 779| 10.5k| } 780| 2.63k| return Self(val); 781| 2.63k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 898| 3.35k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 739| 5.55k| constexpr void serialize_to(std::span bytes) const { 740| 5.55k| auto v = Rep::from_rep(m_val); 741| 5.55k| std::reverse(v.begin(), v.end()); 742| | 743| 5.55k| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 5.55k| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 5.55k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 725| std::array stash_value() const { 760| 725| static_assert(L >= N); 761| 725| std::array stash = {}; 762| 3.62k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 2.90k, False: 725] ------------------ 763| 2.90k| stash[i] = m_val[i]; 764| 2.90k| } 765| 725| return stash; 766| 725| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 13.2k| static Self from_stash(const std::array& stash) { 775| 13.2k| static_assert(L >= N); 776| 13.2k| std::array val = {}; 777| 66.4k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 53.1k, False: 13.2k] ------------------ 778| 53.1k| val[i] = stash[i]; 779| 53.1k| } 780| 13.2k| return Self(val); 781| 13.2k| } pcurves_brainpool256r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm4EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1487| 456| explicit WindowedBoothMulTable(const AffinePoint& p) : m_table(varpoint_setup(p)) {} pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EERKNS_16AffineCurvePointISB_EE: 1066| 3.19k| friend constexpr Self operator+(const Self& a, const AffinePoint& b) { return Self::add_mixed(a, b); } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E9add_mixedERKSC_RKNS_16AffineCurvePointISB_EE: 1091| 3.19k| constexpr static Self add_mixed(const Self& a, const AffinePoint& b) { 1092| 3.19k| return point_add_mixed(a, b, FieldElement::one()); 1093| 3.19k| } pcurves_brainpool256r1.cpp:_ZNK5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm4EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1489| 456| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1490| 456| const BlindedScalar bits(s, rng); 1491| | 1492| 456| const size_t scalar_bits = bits.bits(); 1493| 456| const size_t full_windows = compute_full_windows(scalar_bits + 1, WindowBits); 1494| 456| const size_t initial_shift = compute_initial_shift(scalar_bits + 1, WindowBits); 1495| | 1496| 456| BOTAN_DEBUG_ASSERT(full_windows * WindowBits + initial_shift == scalar_bits + 1); ------------------ | | 130| 456| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 456| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 456] | | ------------------ ------------------ 1497| 456| BOTAN_DEBUG_ASSERT(initial_shift > 0); ------------------ | | 130| 456| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 456| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 456] | | ------------------ ------------------ 1498| | 1499| 456| auto accum = ProjectivePoint::identity(); 1500| 456| CT::poison(accum); 1501| | 1502| 26.4k| for(size_t i = 0; i != full_windows; ++i) { ------------------ | Branch (1502:28): [True: 25.9k, False: 456] ------------------ 1503| 25.9k| const size_t idx = scalar_bits - initial_shift - WindowBits * i; 1504| | 1505| 25.9k| const size_t w_i = bits.get_window(idx); 1506| 25.9k| const auto [tidx, tneg] = booth_recode(w_i); 1507| | 1508| | // Conditional ok: loop iteration count is public 1509| 25.9k| if(i == 0) { ------------------ | Branch (1509:16): [True: 456, False: 25.5k] ------------------ 1510| 456| accum = ProjectivePoint::from_affine(m_table.ct_select(tidx)); 1511| 456| accum.conditional_assign(tneg, accum.negate()); 1512| 25.5k| } else { 1513| 25.5k| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1514| 25.5k| } 1515| | 1516| 25.9k| accum = accum.dbl_n(WindowBits); 1517| | 1518| | // Conditional ok: loop iteration count is public 1519| 25.9k| if(i <= 3) { ------------------ | Branch (1519:16): [True: 1.82k, False: 24.1k] ------------------ 1520| 1.82k| accum.randomize_rep(rng); 1521| 1.82k| } 1522| 25.9k| } 1523| | 1524| | // final window (note one bit shorter than previous reads) 1525| 456| const size_t w_l = bits.get_window(0) & ((1 << WindowBits) - 1); 1526| 456| const auto [tidx, tneg] = booth_recode(w_l << 1); 1527| 456| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1528| | 1529| 456| CT::unpoison(accum); 1530| 456| return accum; 1531| 456| } pcurves_brainpool256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 456| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 456| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 456, Folded] | Branch (1308:33): [True: 456, False: 0] ------------------ 1309| 456| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 456| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 456| constexpr size_t n_words = C::Words; 1313| | 1314| 456| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 456| rng.randomize(maskb, MaskBytes); 1316| | 1317| 456| W mask[n_words] = {0}; 1318| 456| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 456| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 456| if constexpr(ExcessBits > 0) { 1323| 456| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 456| mask[MaskWords - 1] &= ExcessMask; 1325| 456| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 456| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 456| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 456| mask[0] |= 1; 1331| | 1332| 456| W mask_n[2 * n_words] = {0}; 1333| | 1334| 456| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 456| comba_mul(mask_n, mask, C::NW.data()); 1338| 456| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 456| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 456| m_bytes = store_be>(mask_n); 1342| 456| m_bits = C::Scalar::BITS + BlindingBits; 1343| 456| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 456| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 456| } pcurves_brainpool256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EE4bitsEv: 1305| 456| size_t bits() const { return m_bits; } pcurves_brainpool256r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm4EE20compute_full_windowsEmm: 1468| 456| static constexpr size_t compute_full_windows(size_t sb, size_t wb) { 1469| 456| if(sb % wb == 0) { ------------------ | Branch (1469:13): [True: 0, False: 456] ------------------ 1470| 0| return (sb - 1) / wb; 1471| 456| } else { 1472| 456| return sb / wb; 1473| 456| } 1474| 456| } pcurves_brainpool256r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm4EE21compute_initial_shiftEmm: 1476| 456| static constexpr size_t compute_initial_shift(size_t sb, size_t wb) { 1477| 456| if(sb % wb == 0) { ------------------ | Branch (1477:13): [True: 0, False: 456] ------------------ 1478| 0| return wb; 1479| 456| } else { 1480| 456| return sb - (sb / wb) * wb; 1481| 456| } 1482| 456| } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E8identityEv: 1038| 456| static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::one(), FieldElement::zero()); } pcurves_brainpool256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EE10get_windowEm: 1353| 26.4k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 26.4k| return read_window_bits(std::span{m_bytes}, offset); 1356| 26.4k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E5dbl_nEm: 1108| 25.9k| constexpr Self dbl_n(size_t n) const { 1109| | if constexpr(Self::A_is_minus_3) { 1110| | return dbl_n_a_minus_3(*this, n); 1111| | } else if constexpr(Self::A_is_zero) { 1112| | return dbl_n_a_zero(*this, n); 1113| 25.9k| } else { 1114| 25.9k| return dbl_n_generic(*this, A, n); 1115| 25.9k| } 1116| 25.9k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4div2Ev: 302| 25.9k| Self div2() const { 303| | // The inverse of 2 modulo P is (P/2)+1; this avoids a constexpr time 304| | // general inversion, which some compilers can't handle 305| 25.9k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 306| | 307| | // We could multiply by INV_2 but there is a better way ... 308| | 309| 25.9k| std::array t = value(); 310| 25.9k| const W borrow = shift_right<1>(t); 311| | 312| | // If value was odd, add (P/2)+1 313| 25.9k| const auto mask = CT::Mask::expand(borrow).value(); 314| | 315| 25.9k| W carry = 0; 316| | 317| 129k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (317:28): [True: 103k, False: 25.9k] ------------------ 318| 103k| t[i] = word_add(t[i], INV_2[i] & mask, &carry); 319| 103k| } 320| | 321| 25.9k| return Self(t); 322| 25.9k| } pcurves_brainpool256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EED2Ev: 1358| 456| ~BlindedScalarBits() { 1359| 456| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 456| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 456| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 225| 1.45k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEeqERKSA_: 722| 1.77k| constexpr CT::Choice operator==(const Self& other) const { 723| 1.77k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 724| 1.77k| } pcurves_brainpool256r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsENS_13MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1275| 1.77k| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4sqrtEv: 663| 522| constexpr CT::Option sqrt() const { 664| 522| if constexpr(Self::P_MOD_4 == 3) { 665| | // The easy case for square root is when p == 3 (mod 4) 666| | 667| 522| constexpr auto P_PLUS_1_OVER_4 = p_plus_1_over_4(P); 668| 522| auto z = pow_vartime(P_PLUS_1_OVER_4); 669| | 670| | // Zero out the return value if it would otherwise be incorrect 671| 522| const CT::Choice correct = (z.square() == *this); 672| 522| z.conditional_assign(!correct, Self::zero()); 673| 522| return CT::Option(z, correct); 674| | } else { 675| | // Shanks-Tonelli, following I.4 in RFC 9380 676| | 677| | /* 678| | Constants: 679| | 1. c1, the largest integer such that 2^c1 divides q - 1. 680| | 2. c2 = (q - 1) / (2^c1) # Integer arithmetic 681| | 3. c3 = (c2 - 1) / 2 # Integer arithmetic 682| | 4. c4, a non-square value in F 683| | 5. c5 = c4^c2 in F 684| | */ 685| | constexpr auto C1_C2 = shanks_tonelli_c1c2(Self::P); 686| | constexpr std::array C3 = shanks_tonelli_c3(C1_C2.second); 687| | constexpr std::array P_MINUS_1_OVER_2 = p_minus_1_over_2(Self::P); 688| | constexpr Self C4 = shanks_tonelli_c4(P_MINUS_1_OVER_2); 689| | constexpr Self C5 = C4.pow_vartime(C1_C2.second); 690| | 691| | const Self& x = (*this); 692| | 693| | auto z = x.pow_vartime(C3); 694| | auto t = z.square(); 695| | t *= x; 696| | z *= x; 697| | auto b = t; 698| | auto c = C5; 699| | 700| | for(size_t i = C1_C2.first; i >= 2; i--) { 701| | b.square_n(i - 2); 702| | const CT::Choice e = b.is_one(); 703| | z.conditional_assign(!e, z * c); 704| | c.square_n(1); 705| | t.conditional_assign(!e, t * c); 706| | b = t; 707| | } 708| | 709| | // Zero out the return value if it would otherwise be incorrect 710| | const CT::Choice correct = (z.square() == *this); 711| | z.conditional_assign(!correct, Self::zero()); 712| | return CT::Option(z, correct); 713| | } 714| 522| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE: 248| 456| constexpr Self correct_sign(CT::Choice even) const { 249| 456| const auto flip = (even != this->is_even()); 250| 456| return Self::choose(flip, this->negate(), *this); 251| 456| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE7is_evenEv: 240| 456| constexpr CT::Choice is_even() const { 241| 456| auto v = Rep::from_rep(m_val); 242| 456| return !CT::Choice::from_int(v[0] & 0x01); 243| 456| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_: 256| 456| static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) { 257| 456| auto r = y; 258| 456| r.conditional_assign(choice, x); 259| 456| return r; 260| 456| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 1.10k| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 1.10k| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 1.10k] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 1.10k| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 1.10k| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 376, False: 725] ------------------ 802| 376| return {}; 803| 376| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 725| return Self::from_words(words); 807| 1.10k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE: 211| 725| static constexpr Self from_words(std::array w) { 212| 725| if constexpr(L == N) { 213| 725| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 725| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 115| 725| constexpr static std::array to_rep(const std::array& x) { 116| 725| std::array z; // NOLINT(*-member-init) 117| 725| comba_mul(z.data(), x.data(), R2.data()); 118| 725| return Self::redc(z); 119| 725| } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm65EEE: 941| 2.54k| constexpr void serialize_to(std::span bytes) const { 942| 2.54k| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 2.54k| do { \ | | 52| 2.54k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 2.54k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 2.54k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 2.54k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 2.54k] | | ------------------ ------------------ 943| 2.54k| BufferStuffer pack(bytes); 944| 2.54k| pack.append(0x04); 945| 2.54k| x().serialize_to(pack.next()); 946| 2.54k| y().serialize_to(pack.next()); 947| 2.54k| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 130| 2.54k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 2.54k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 2.54k] | | ------------------ ------------------ 948| 2.54k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 725| static Self random(RandomNumberGenerator& rng) { 852| 725| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 725| std::array buf{}; 855| | 856| 1.10k| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 1.10k, False: 0] ------------------ 857| 1.10k| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 1.10k| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 725, False: 376] ------------------ 868| 725| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 725, False: 0] ------------------ 869| 725| return s.value(); 870| 725| } 871| 725| } 872| 1.10k| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 725| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE10is_nonzeroEv: 230| 725| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_brainpool384r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1405| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1016| 601| static constexpr Self from_affine(const AffinePoint& pt) { 1017| | /* 1018| | * If the point is the identity element (x=0, y=0) then instead of 1019| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1020| | * encoding of (0, 1, 0) 1021| | * 1022| | * Which we can achieve by a conditional swap of y and z if the 1023| | * affine point is the identity. 1024| | */ 1025| | 1026| 601| auto x = pt.x(); 1027| 601| auto y = pt.y(); 1028| 601| auto z = FieldElement::one(); 1029| | 1030| 601| FieldElement::conditional_swap(pt.is_identity(), y, z); 1031| | 1032| 601| return ProjectiveCurvePoint(x, y, z); 1033| 601| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE1xEv: 971| 1.03M| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE1yEv: 976| 1.00M| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE3oneEv: 200| 37.3k| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE3oneEv: 99| 37.3k| constexpr static std::array one() { return R1; } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm6EEE: 898| 1.87M| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 410| 601| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 411| 601| const W mask = cond.into_bitmask(); 412| | 413| 4.20k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (413:28): [True: 3.60k, False: 601] ------------------ 414| 3.60k| auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 415| 3.60k| auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 416| 3.60k| x.m_val[i] = nx; 417| 3.60k| y.m_val[i] = ny; 418| 3.60k| } 419| 601| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 928| 38.4k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 225| 195k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1056| 53.2k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1121| 2.40k| constexpr Self dbl() const { 1122| | if constexpr(Self::A_is_minus_3) { 1123| | return dbl_a_minus_3(*this); 1124| | } else if constexpr(Self::A_is_zero) { 1125| | return dbl_a_zero(*this); 1126| 2.40k| } else { 1127| 2.40k| return dbl_generic(*this, A); 1128| 2.40k| } 1129| 2.40k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1172| 222k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6squareEv: 426| 420k| constexpr BOTAN_FORCE_INLINE Self square() const { 427| 420k| std::array z; // NOLINT(*-member-init) 428| 420k| comba_sqr(z.data(), this->data()); 429| 420k| return Self(Rep::redc(z)); 430| 420k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4dataEv: 896| 2.09M| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm12EEE: 104| 1.39M| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 1.39M| } else { 108| 1.39M| return monty_redc(z, P, P_dash); 109| 1.39M| } 110| 1.39M| } pcurves_brainpool384r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 265| 167k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 266| 167k| std::array t; // NOLINT(*-member-init) 267| | 268| 167k| W carry = 0; 269| 1.17M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (269:28): [True: 1.00M, False: 167k] ------------------ 270| 1.00M| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 271| 1.00M| } 272| | 273| 167k| std::array r; // NOLINT(*-member-init) 274| 167k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 275| 167k| return Self(r); 276| 167k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1162| 135k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 335| 64.7k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 346| 489k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 347| 489k| std::array z; // NOLINT(*-member-init) 348| 489k| comba_mul(z.data(), a.data(), b.data()); 349| 489k| return Self(Rep::redc(z)); 350| 489k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1167| 135k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 338| 2.40k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 281| 415k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 282| 415k| std::array r; // NOLINT(*-member-init) 283| 415k| W carry = 0; 284| 2.90M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (284:28): [True: 2.49M, False: 415k] ------------------ 285| 2.49M| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 286| 2.49M| } 287| | 288| 415k| const auto mask = CT::Mask::expand(carry).value(); 289| | 290| 415k| carry = 0; 291| | 292| 2.90M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (292:28): [True: 2.49M, False: 415k] ------------------ 293| 2.49M| r[i] = word_add(r[i], P[i] & mask, &carry); 294| 2.49M| } 295| | 296| 415k| return Self(r); 297| 415k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 325| 218k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 326| 218k| std::array t = value(); 327| 218k| const W carry = shift_left<1>(t); 328| | 329| 218k| std::array r; // NOLINT(*-member-init) 330| 218k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 331| 218k| return Self(r); 332| 218k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE5valueEv: 894| 231k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 341| 2.40k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1064| 1.09k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1103| 1.09k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1082| 42.7k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 395| 74.2k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 396| 74.2k| const W mask = cond.into_bitmask(); 397| | 398| 519k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (398:28): [True: 445k, False: 74.2k] ------------------ 399| 445k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 400| 445k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 401| 445k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 402| 445k| } 403| 74.2k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6invertEv: 538| 600| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm6EEE: 477| 801| constexpr Self pow_vartime(const std::array& exp) const { 478| 801| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (478:40): [Folded, False: 801] ------------------ 479| 801| constexpr size_t WindowElements = (1 << WindowBits) - 1; 480| | 481| 801| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 482| | 483| | /* 484| | A simple fixed width window modular multiplication. 485| | 486| | TODO: investigate using sliding window here 487| | */ 488| | 489| 801| std::array tbl; 490| | 491| 801| tbl[0] = (*this); 492| | 493| 24.8k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (493:28): [True: 24.0k, False: 801] ------------------ 494| | // Conditional ok: table indexes are public here 495| 24.0k| if(i % 2 == 1) { ------------------ | Branch (495:16): [True: 12.0k, False: 12.0k] ------------------ 496| 12.0k| tbl[i] = tbl[i / 2].square(); 497| 12.0k| } else { 498| 12.0k| tbl[i] = tbl[i - 1] * tbl[0]; 499| 12.0k| } 500| 24.0k| } 501| | 502| 801| auto r = Self::one(); 503| | 504| 801| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 505| | 506| | // Conditional ok: this function is variable time 507| 801| if(w0 > 0) { ------------------ | Branch (507:13): [True: 801, False: 0] ------------------ 508| 801| r = tbl[w0 - 1]; 509| 801| } 510| | 511| 61.6k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (511:28): [True: 60.8k, False: 801] ------------------ 512| 60.8k| r.square_n(WindowBits); 513| | 514| 60.8k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 515| | 516| | // Conditional ok: this function is variable time 517| 60.8k| if(w > 0) { ------------------ | Branch (517:16): [True: 58.2k, False: 2.60k] ------------------ 518| 58.2k| r *= tbl[w - 1]; 519| 58.2k| } 520| 60.8k| } 521| | 522| 801| return r; 523| 801| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEC2Ev: 180| 24.8k| constexpr IntMod() : m_val({}) {} pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE8square_nEm: 439| 60.8k| constexpr void square_n(size_t n) { 440| 60.8k| std::array z; // NOLINT(*-member-init) 441| 365k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (441:28): [True: 304k, False: 60.8k] ------------------ 442| 304k| comba_sqr(z.data(), this->data()); 443| 304k| m_val = Rep::redc(z); 444| 304k| } 445| 60.8k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEmLERKSA_: 355| 175k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 356| 175k| std::array z; // NOLINT(*-member-init) 357| 175k| comba_mul(z.data(), data(), other.data()); 358| 175k| m_val = Rep::redc(z); 359| 175k| return (*this); 360| 175k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 598| 1| constexpr Self invert_vartime() const { 599| | // Conditional ok: this function is variable time 600| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (600:13): [True: 0, False: 1] ------------------ 601| 0| return Self::zero(); 602| 0| } 603| | 604| 1| auto x = Self(std::array{1}); // 1 in standard domain 605| 1| auto b = Self(this->to_words()); // *this in standard domain 606| | 607| | // First loop iteration 608| 1| Self::_invert_vartime_div2_helper(b, x); 609| | 610| 1| auto a = b.negate(); 611| | // y += x but y is zero at the outset 612| 1| auto y = x; 613| | 614| | // First half of second loop iteration 615| 1| Self::_invert_vartime_div2_helper(a, y); 616| | 617| 262| for(;;) { 618| | // Conditional ok: this function is variable time 619| 262| if(a.m_val == b.m_val) { ------------------ | Branch (619:16): [True: 1, False: 261] ------------------ 620| | // At this point it should be that a == b == 1 621| 1| auto r = y.negate(); 622| | 623| | // Convert back to Montgomery if required 624| 1| r.m_val = Rep::to_rep(r.m_val); 625| 1| return r; 626| 1| } 627| | 628| 261| auto nx = x + y; 629| | 630| | /* 631| | * Otherwise either b > a or a > b 632| | * 633| | * If b > a we want to set b to b - a 634| | * Otherwise we want to set a to a - b 635| | * 636| | * Compute r = b - a and check if it underflowed 637| | * If it did not then we are in the b > a path 638| | */ 639| 261| std::array r; // NOLINT(*-member-init) 640| 261| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 641| | 642| | // Conditional ok: this function is variable time 643| 261| if(carry == 0) { ------------------ | Branch (643:16): [True: 128, False: 133] ------------------ 644| | // b > a 645| 128| b.m_val = r; 646| 128| x = nx; 647| 128| Self::_invert_vartime_div2_helper(b, x); 648| 133| } else { 649| | // We know this can't underflow because a > b 650| 133| bigint_sub3(r.data(), a.data(), N, b.data(), N); 651| 133| a.m_val = r; 652| 133| y = nx; 653| 133| Self::_invert_vartime_div2_helper(a, y); 654| 133| } 655| 261| } 656| 1| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4zeroEv: 195| 70.9k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 734| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm6EEE: 137| 2.07k| constexpr static std::array from_rep(const std::array& z) { 138| 2.07k| std::array ze = {}; 139| 2.07k| copy_mem(std::span{ze}.template first(), z); 140| 2.07k| return Self::redc(ze); 141| 2.07k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 547| 263| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 548| 263| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 549| | 550| | // Conditional ok: this function is variable time 551| 814| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (551:16): [True: 551, False: 263] ------------------ 552| 551| shift_right<1>(a.m_val); 553| | 554| 551| const W borrow = shift_right<1>(x.m_val); 555| | 556| | // Conditional ok: this function is variable time 557| 551| if(borrow) { ------------------ | Branch (557:16): [True: 291, False: 260] ------------------ 558| 291| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 559| 291| } 560| 551| } 561| 263| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6negateEv: 452| 35.3k| constexpr Self negate() const { 453| 35.3k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 454| | 455| 35.3k| std::array r; // NOLINT(*-member-init) 456| 35.3k| W carry = 0; 457| 247k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (457:28): [True: 212k, False: 35.3k] ------------------ 458| 212k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 459| 212k| } 460| | 461| 35.3k| return Self(r); 462| 35.3k| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm6EEE: 115| 2.32k| constexpr static std::array to_rep(const std::array& x) { 116| 2.32k| std::array z; // NOLINT(*-member-init) 117| 2.32k| comba_mul(z.data(), x.data(), R2.data()); 118| 2.32k| return Self::redc(z); 119| 2.32k| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 917| 42.4k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 2.13k| std::array stash_value() const { 760| 2.13k| static_assert(L >= N); 761| 2.13k| std::array stash = {}; 762| 14.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 12.7k, False: 2.13k] ------------------ 763| 12.7k| stash[i] = m_val[i]; 764| 12.7k| } 765| 2.13k| return stash; 766| 2.13k| } pcurves_brainpool384r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1407| 310| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1408| 310| const BlindedScalar scalar(s, rng); 1409| 310| return basemul_booth_exec(m_table, scalar, rng); 1410| 310| } pcurves_brainpool384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 310| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 310| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 310, Folded] | Branch (1308:33): [True: 310, False: 0] ------------------ 1309| 310| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 310| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 310| constexpr size_t n_words = C::Words; 1313| | 1314| 310| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 310| rng.randomize(maskb, MaskBytes); 1316| | 1317| 310| W mask[n_words] = {0}; 1318| 310| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 310| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 310| if constexpr(ExcessBits > 0) { 1323| 310| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 310| mask[MaskWords - 1] &= ExcessMask; 1325| 310| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 310| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 310| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 310| mask[0] |= 1; 1331| | 1332| 310| W mask_n[2 * n_words] = {0}; 1333| | 1334| 310| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 310| comba_mul(mask_n, mask, C::NW.data()); 1338| 310| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 310| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 310| m_bytes = store_be>(mask_n); 1342| 310| m_bits = C::Scalar::BITS + BlindingBits; 1343| 310| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 310| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 310| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE8to_wordsEv: 734| 455| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm6EEE: 137| 765| constexpr static std::array from_rep(const std::array& z) { 138| 765| std::array ze = {}; 139| 765| copy_mem(std::span{ze}.template first(), z); 140| 765| return Self::redc(ze); 141| 765| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm12EEE: 104| 1.07k| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 1.07k| } else { 108| 1.07k| return monty_redc(z, P, P_dash); 109| 1.07k| } 110| 1.07k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 739| 310| constexpr void serialize_to(std::span bytes) const { 740| 310| auto v = Rep::from_rep(m_val); 741| 310| std::reverse(v.begin(), v.end()); 742| | 743| 310| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 310| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 310| } pcurves_brainpool384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EE4bitsEv: 1305| 310| size_t bits() const { return m_bits; } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1084| 455| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1085| 455| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1086| 455| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E6negateEv: 1134| 455| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1174| 455| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18_const_time_poisonEv: 889| 1.36k| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_brainpool384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EE10get_windowEm: 1353| 22.6k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 22.6k| return read_window_bits(std::span{m_bytes}, offset); 1356| 22.6k| } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1096| 34.7k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1097| 34.7k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one()); 1098| 34.7k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 367| 35.1k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 368| 35.1k| const W mask = cond.into_bitmask(); 369| | 370| 245k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (370:28): [True: 210k, False: 35.1k] ------------------ 371| 210k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 372| 210k| } 373| 35.1k| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 955| 22.6k| static constexpr auto ct_select(std::span pts, size_t idx) { 956| 22.6k| auto result = Self::identity(pts[0]); 957| | 958| | // Intentionally wrapping; set to maximum size_t if idx == 0 959| 22.6k| const size_t idx1 = static_cast(idx - 1); 960| 746k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (960:28): [True: 724k, False: 22.6k] ------------------ 961| 724k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 962| 724k| result.conditional_assign(found, pts[i]); 963| 724k| } 964| | 965| 22.6k| return result; 966| 22.6k| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE8identityERKSC_: 924| 35.2k| static constexpr Self identity(const Self& /*unused*/) { 925| 35.2k| return Self(FieldElement::zero(), FieldElement::zero()); 926| 35.2k| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 981| 926k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 982| 926k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 983| 926k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 380| 926k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 381| 926k| const W mask = cond.into_bitmask(); 382| | 383| 6.48M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (383:28): [True: 5.55M, False: 926k] ------------------ 384| 5.55M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 385| 5.55M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 386| 5.55M| } 387| 926k| } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E13randomize_repERNS_21RandomNumberGeneratorE: 1142| 1.82k| void randomize_rep(RandomNumberGenerator& rng) { 1143| | // In certain contexts we may be called with a Null_RNG; in that case the 1144| | // caller is accepting that randomization will not occur 1145| | 1146| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1147| 1.82k| if(rng.is_seeded()) { ------------------ | Branch (1147:13): [True: 1.82k, False: 0] ------------------ 1148| 1.82k| auto r = FieldElement::random(rng); 1149| | 1150| 1.82k| auto r2 = r.square(); 1151| 1.82k| auto r3 = r2 * r; 1152| | 1153| 1.82k| m_x *= r2; 1154| 1.82k| m_y *= r3; 1155| 1.82k| m_z *= r; 1156| 1.82k| } 1157| 1.82k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 1.82k| static Self random(RandomNumberGenerator& rng) { 852| 1.82k| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 1.82k| std::array buf{}; 855| | 856| 3.36k| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 3.36k, False: 0] ------------------ 857| 3.36k| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 3.36k| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 1.82k, False: 1.54k] ------------------ 868| 1.82k| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 1.82k, False: 0] ------------------ 869| 1.82k| return s.value(); 870| 1.82k| } 871| 1.82k| } 872| 3.36k| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 1.82k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 3.86k| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 3.86k| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 3.86k] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 3.86k| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 3.86k| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 1.54k, False: 2.32k] ------------------ 802| 1.54k| return {}; 803| 1.54k| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 2.32k| return Self::from_words(words); 807| 3.86k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE10from_wordsILm6EEESA_NSt3__15arrayImXT_EEE: 211| 2.32k| static constexpr Self from_words(std::array w) { 212| 2.32k| if constexpr(L == N) { 213| 2.32k| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 2.32k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE10is_nonzeroEv: 230| 1.82k| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1176| 455| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE20_const_time_unpoisonEv: 891| 1.36k| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_brainpool384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EED2Ev: 1358| 310| ~BlindedScalarBits() { 1359| 310| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 310| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 310| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 1.07k| static Self from_stash(const std::array& stash) { 775| 1.07k| static_assert(L >= N); 776| 1.07k| std::array val = {}; 777| 7.52k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 6.45k, False: 1.07k] ------------------ 778| 6.45k| val[i] = stash[i]; 779| 6.45k| } 780| 1.07k| return Self(val); 781| 1.07k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm6EEE: 898| 1.38k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 739| 1.92k| constexpr void serialize_to(std::span bytes) const { 740| 1.92k| auto v = Rep::from_rep(m_val); 741| 1.92k| std::reverse(v.begin(), v.end()); 742| | 743| 1.92k| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 1.92k| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 1.92k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 310| std::array stash_value() const { 760| 310| static_assert(L >= N); 761| 310| std::array stash = {}; 762| 2.17k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 1.86k, False: 310] ------------------ 763| 1.86k| stash[i] = m_val[i]; 764| 1.86k| } 765| 310| return stash; 766| 310| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 4.78k| static Self from_stash(const std::array& stash) { 775| 4.78k| static_assert(L >= N); 776| 4.78k| std::array val = {}; 777| 33.4k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 28.6k, False: 4.78k] ------------------ 778| 28.6k| val[i] = stash[i]; 779| 28.6k| } 780| 4.78k| return Self(val); 781| 4.78k| } pcurves_brainpool384r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm4EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1487| 145| explicit WindowedBoothMulTable(const AffinePoint& p) : m_table(varpoint_setup(p)) {} pcurves_brainpool384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_EERKNS_16AffineCurvePointISB_EE: 1066| 1.01k| friend constexpr Self operator+(const Self& a, const AffinePoint& b) { return Self::add_mixed(a, b); } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E9add_mixedERKSC_RKNS_16AffineCurvePointISB_EE: 1091| 1.01k| constexpr static Self add_mixed(const Self& a, const AffinePoint& b) { 1092| 1.01k| return point_add_mixed(a, b, FieldElement::one()); 1093| 1.01k| } pcurves_brainpool384r1.cpp:_ZNK5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm4EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1489| 145| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1490| 145| const BlindedScalar bits(s, rng); 1491| | 1492| 145| const size_t scalar_bits = bits.bits(); 1493| 145| const size_t full_windows = compute_full_windows(scalar_bits + 1, WindowBits); 1494| 145| const size_t initial_shift = compute_initial_shift(scalar_bits + 1, WindowBits); 1495| | 1496| 145| BOTAN_DEBUG_ASSERT(full_windows * WindowBits + initial_shift == scalar_bits + 1); ------------------ | | 130| 145| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 145| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 145] | | ------------------ ------------------ 1497| 145| BOTAN_DEBUG_ASSERT(initial_shift > 0); ------------------ | | 130| 145| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 145| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 145] | | ------------------ ------------------ 1498| | 1499| 145| auto accum = ProjectivePoint::identity(); 1500| 145| CT::poison(accum); 1501| | 1502| 12.6k| for(size_t i = 0; i != full_windows; ++i) { ------------------ | Branch (1502:28): [True: 12.4k, False: 145] ------------------ 1503| 12.4k| const size_t idx = scalar_bits - initial_shift - WindowBits * i; 1504| | 1505| 12.4k| const size_t w_i = bits.get_window(idx); 1506| 12.4k| const auto [tidx, tneg] = booth_recode(w_i); 1507| | 1508| | // Conditional ok: loop iteration count is public 1509| 12.4k| if(i == 0) { ------------------ | Branch (1509:16): [True: 145, False: 12.3k] ------------------ 1510| 145| accum = ProjectivePoint::from_affine(m_table.ct_select(tidx)); 1511| 145| accum.conditional_assign(tneg, accum.negate()); 1512| 12.3k| } else { 1513| 12.3k| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1514| 12.3k| } 1515| | 1516| 12.4k| accum = accum.dbl_n(WindowBits); 1517| | 1518| | // Conditional ok: loop iteration count is public 1519| 12.4k| if(i <= 3) { ------------------ | Branch (1519:16): [True: 580, False: 11.8k] ------------------ 1520| 580| accum.randomize_rep(rng); 1521| 580| } 1522| 12.4k| } 1523| | 1524| | // final window (note one bit shorter than previous reads) 1525| 145| const size_t w_l = bits.get_window(0) & ((1 << WindowBits) - 1); 1526| 145| const auto [tidx, tneg] = booth_recode(w_l << 1); 1527| 145| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1528| | 1529| 145| CT::unpoison(accum); 1530| 145| return accum; 1531| 145| } pcurves_brainpool384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 145| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 145| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 145, Folded] | Branch (1308:33): [True: 145, False: 0] ------------------ 1309| 145| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 145| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 145| constexpr size_t n_words = C::Words; 1313| | 1314| 145| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 145| rng.randomize(maskb, MaskBytes); 1316| | 1317| 145| W mask[n_words] = {0}; 1318| 145| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 145| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 145| if constexpr(ExcessBits > 0) { 1323| 145| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 145| mask[MaskWords - 1] &= ExcessMask; 1325| 145| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 145| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 145| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 145| mask[0] |= 1; 1331| | 1332| 145| W mask_n[2 * n_words] = {0}; 1333| | 1334| 145| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 145| comba_mul(mask_n, mask, C::NW.data()); 1338| 145| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 145| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 145| m_bytes = store_be>(mask_n); 1342| 145| m_bits = C::Scalar::BITS + BlindingBits; 1343| 145| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 145| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 145| } pcurves_brainpool384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EE4bitsEv: 1305| 145| size_t bits() const { return m_bits; } pcurves_brainpool384r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm4EE20compute_full_windowsEmm: 1468| 145| static constexpr size_t compute_full_windows(size_t sb, size_t wb) { 1469| 145| if(sb % wb == 0) { ------------------ | Branch (1469:13): [True: 0, False: 145] ------------------ 1470| 0| return (sb - 1) / wb; 1471| 145| } else { 1472| 145| return sb / wb; 1473| 145| } 1474| 145| } pcurves_brainpool384r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm4EE21compute_initial_shiftEmm: 1476| 145| static constexpr size_t compute_initial_shift(size_t sb, size_t wb) { 1477| 145| if(sb % wb == 0) { ------------------ | Branch (1477:13): [True: 0, False: 145] ------------------ 1478| 0| return wb; 1479| 145| } else { 1480| 145| return sb - (sb / wb) * wb; 1481| 145| } 1482| 145| } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E8identityEv: 1038| 145| static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::one(), FieldElement::zero()); } pcurves_brainpool384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EE10get_windowEm: 1353| 12.6k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 12.6k| return read_window_bits(std::span{m_bytes}, offset); 1356| 12.6k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E5dbl_nEm: 1108| 12.4k| constexpr Self dbl_n(size_t n) const { 1109| | if constexpr(Self::A_is_minus_3) { 1110| | return dbl_n_a_minus_3(*this, n); 1111| | } else if constexpr(Self::A_is_zero) { 1112| | return dbl_n_a_zero(*this, n); 1113| 12.4k| } else { 1114| 12.4k| return dbl_n_generic(*this, A, n); 1115| 12.4k| } 1116| 12.4k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4div2Ev: 302| 12.4k| Self div2() const { 303| | // The inverse of 2 modulo P is (P/2)+1; this avoids a constexpr time 304| | // general inversion, which some compilers can't handle 305| 12.4k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 306| | 307| | // We could multiply by INV_2 but there is a better way ... 308| | 309| 12.4k| std::array t = value(); 310| 12.4k| const W borrow = shift_right<1>(t); 311| | 312| | // If value was odd, add (P/2)+1 313| 12.4k| const auto mask = CT::Mask::expand(borrow).value(); 314| | 315| 12.4k| W carry = 0; 316| | 317| 87.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (317:28): [True: 74.8k, False: 12.4k] ------------------ 318| 74.8k| t[i] = word_add(t[i], INV_2[i] & mask, &carry); 319| 74.8k| } 320| | 321| 12.4k| return Self(t); 322| 12.4k| } pcurves_brainpool384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EED2Ev: 1358| 145| ~BlindedScalarBits() { 1359| 145| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 145| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 145| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 225| 620| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEeqERKSA_: 722| 660| constexpr CT::Choice operator==(const Self& other) const { 723| 660| return CT::is_equal(this->data(), other.data(), N).as_choice(); 724| 660| } pcurves_brainpool384r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsENS_13MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1275| 660| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4sqrtEv: 663| 201| constexpr CT::Option sqrt() const { 664| 201| if constexpr(Self::P_MOD_4 == 3) { 665| | // The easy case for square root is when p == 3 (mod 4) 666| | 667| 201| constexpr auto P_PLUS_1_OVER_4 = p_plus_1_over_4(P); 668| 201| auto z = pow_vartime(P_PLUS_1_OVER_4); 669| | 670| | // Zero out the return value if it would otherwise be incorrect 671| 201| const CT::Choice correct = (z.square() == *this); 672| 201| z.conditional_assign(!correct, Self::zero()); 673| 201| return CT::Option(z, correct); 674| | } else { 675| | // Shanks-Tonelli, following I.4 in RFC 9380 676| | 677| | /* 678| | Constants: 679| | 1. c1, the largest integer such that 2^c1 divides q - 1. 680| | 2. c2 = (q - 1) / (2^c1) # Integer arithmetic 681| | 3. c3 = (c2 - 1) / 2 # Integer arithmetic 682| | 4. c4, a non-square value in F 683| | 5. c5 = c4^c2 in F 684| | */ 685| | constexpr auto C1_C2 = shanks_tonelli_c1c2(Self::P); 686| | constexpr std::array C3 = shanks_tonelli_c3(C1_C2.second); 687| | constexpr std::array P_MINUS_1_OVER_2 = p_minus_1_over_2(Self::P); 688| | constexpr Self C4 = shanks_tonelli_c4(P_MINUS_1_OVER_2); 689| | constexpr Self C5 = C4.pow_vartime(C1_C2.second); 690| | 691| | const Self& x = (*this); 692| | 693| | auto z = x.pow_vartime(C3); 694| | auto t = z.square(); 695| | t *= x; 696| | z *= x; 697| | auto b = t; 698| | auto c = C5; 699| | 700| | for(size_t i = C1_C2.first; i >= 2; i--) { 701| | b.square_n(i - 2); 702| | const CT::Choice e = b.is_one(); 703| | z.conditional_assign(!e, z * c); 704| | c.square_n(1); 705| | t.conditional_assign(!e, t * c); 706| | b = t; 707| | } 708| | 709| | // Zero out the return value if it would otherwise be incorrect 710| | const CT::Choice correct = (z.square() == *this); 711| | z.conditional_assign(!correct, Self::zero()); 712| | return CT::Option(z, correct); 713| | } 714| 201| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE: 248| 145| constexpr Self correct_sign(CT::Choice even) const { 249| 145| const auto flip = (even != this->is_even()); 250| 145| return Self::choose(flip, this->negate(), *this); 251| 145| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE7is_evenEv: 240| 145| constexpr CT::Choice is_even() const { 241| 145| auto v = Rep::from_rep(m_val); 242| 145| return !CT::Choice::from_int(v[0] & 0x01); 243| 145| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_: 256| 145| static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) { 257| 145| auto r = y; 258| 145| r.conditional_assign(choice, x); 259| 145| return r; 260| 145| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 557| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 557| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 557] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 557| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 557| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 247, False: 310] ------------------ 802| 247| return {}; 803| 247| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 310| return Self::from_words(words); 807| 557| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm6EEESA_NSt3__15arrayImXT_EEE: 211| 310| static constexpr Self from_words(std::array w) { 212| 310| if constexpr(L == N) { 213| 310| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 310| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm6EEE: 115| 310| constexpr static std::array to_rep(const std::array& x) { 116| 310| std::array z; // NOLINT(*-member-init) 117| 310| comba_mul(z.data(), x.data(), R2.data()); 118| 310| return Self::redc(z); 119| 310| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm97EEE: 941| 890| constexpr void serialize_to(std::span bytes) const { 942| 890| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 890| do { \ | | 52| 890| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 890| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 890] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 890| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 890] | | ------------------ ------------------ 943| 890| BufferStuffer pack(bytes); 944| 890| pack.append(0x04); 945| 890| x().serialize_to(pack.next()); 946| 890| y().serialize_to(pack.next()); 947| 890| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 130| 890| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 890| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 890] | | ------------------ ------------------ 948| 890| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 310| static Self random(RandomNumberGenerator& rng) { 852| 310| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 310| std::array buf{}; 855| | 856| 557| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 557, False: 0] ------------------ 857| 557| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 557| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 310, False: 247] ------------------ 868| 310| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 310, False: 0] ------------------ 869| 310| return s.value(); 870| 310| } 871| 310| } 872| 557| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 310| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE10is_nonzeroEv: 230| 310| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_brainpool512r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1405| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1016| 891| static constexpr Self from_affine(const AffinePoint& pt) { 1017| | /* 1018| | * If the point is the identity element (x=0, y=0) then instead of 1019| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1020| | * encoding of (0, 1, 0) 1021| | * 1022| | * Which we can achieve by a conditional swap of y and z if the 1023| | * affine point is the identity. 1024| | */ 1025| | 1026| 891| auto x = pt.x(); 1027| 891| auto y = pt.y(); 1028| 891| auto z = FieldElement::one(); 1029| | 1030| 891| FieldElement::conditional_swap(pt.is_identity(), y, z); 1031| | 1032| 891| return ProjectiveCurvePoint(x, y, z); 1033| 891| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE1xEv: 971| 1.99M| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE1yEv: 976| 1.92M| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE3oneEv: 200| 71.8k| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE3oneEv: 99| 71.8k| constexpr static std::array one() { return R1; } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm8EEE: 898| 3.70M| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 410| 891| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 411| 891| const W mask = cond.into_bitmask(); 412| | 413| 8.01k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (413:28): [True: 7.12k, False: 891] ------------------ 414| 7.12k| auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 415| 7.12k| auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 416| 7.12k| x.m_val[i] = nx; 417| 7.12k| y.m_val[i] = ny; 418| 7.12k| } 419| 891| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 928| 73.5k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 225| 371k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1056| 102k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1121| 3.46k| constexpr Self dbl() const { 1122| | if constexpr(Self::A_is_minus_3) { 1123| | return dbl_a_minus_3(*this); 1124| | } else if constexpr(Self::A_is_zero) { 1125| | return dbl_a_zero(*this); 1126| 3.46k| } else { 1127| 3.46k| return dbl_generic(*this, A); 1128| 3.46k| } 1129| 3.46k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1172| 417k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6squareEv: 426| 839k| constexpr BOTAN_FORCE_INLINE Self square() const { 427| 839k| std::array z; // NOLINT(*-member-init) 428| 839k| comba_sqr(z.data(), this->data()); 429| 839k| return Self(Rep::redc(z)); 430| 839k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4dataEv: 896| 4.10M| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm16EEE: 104| 2.73M| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 2.73M| } else { 108| 2.73M| return monty_redc(z, P, P_dash); 109| 2.73M| } 110| 2.73M| } pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 265| 341k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 266| 341k| std::array t; // NOLINT(*-member-init) 267| | 268| 341k| W carry = 0; 269| 3.07M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (269:28): [True: 2.73M, False: 341k] ------------------ 270| 2.73M| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 271| 2.73M| } 272| | 273| 341k| std::array r; // NOLINT(*-member-init) 274| 341k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 275| 341k| return Self(r); 276| 341k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1162| 256k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 335| 133k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool512r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 346| 937k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 347| 937k| std::array z; // NOLINT(*-member-init) 348| 937k| comba_mul(z.data(), a.data(), b.data()); 349| 937k| return Self(Rep::redc(z)); 350| 937k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1167| 256k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 338| 3.46k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool512r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 281| 828k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 282| 828k| std::array r; // NOLINT(*-member-init) 283| 828k| W carry = 0; 284| 7.45M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (284:28): [True: 6.62M, False: 828k] ------------------ 285| 6.62M| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 286| 6.62M| } 287| | 288| 828k| const auto mask = CT::Mask::expand(carry).value(); 289| | 290| 828k| carry = 0; 291| | 292| 7.45M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (292:28): [True: 6.62M, False: 828k] ------------------ 293| 6.62M| r[i] = word_add(r[i], P[i] & mask, &carry); 294| 6.62M| } 295| | 296| 828k| return Self(r); 297| 828k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 325| 445k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 326| 445k| std::array t = value(); 327| 445k| const W carry = shift_left<1>(t); 328| | 329| 445k| std::array r; // NOLINT(*-member-init) 330| 445k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 331| 445k| return Self(r); 332| 445k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE5valueEv: 894| 471k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 341| 3.46k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1064| 1.45k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1103| 1.45k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1082| 79.4k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 395| 142k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 396| 142k| const W mask = cond.into_bitmask(); 397| | 398| 1.28M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (398:28): [True: 1.14M, False: 142k] ------------------ 399| 1.14M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 400| 1.14M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 401| 1.14M| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 402| 1.14M| } 403| 142k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6invertEv: 538| 890| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm8EEE: 477| 1.17k| constexpr Self pow_vartime(const std::array& exp) const { 478| 1.17k| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (478:40): [Folded, False: 1.17k] ------------------ 479| 1.17k| constexpr size_t WindowElements = (1 << WindowBits) - 1; 480| | 481| 1.17k| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 482| | 483| | /* 484| | A simple fixed width window modular multiplication. 485| | 486| | TODO: investigate using sliding window here 487| | */ 488| | 489| 1.17k| std::array tbl; 490| | 491| 1.17k| tbl[0] = (*this); 492| | 493| 36.2k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (493:28): [True: 35.1k, False: 1.17k] ------------------ 494| | // Conditional ok: table indexes are public here 495| 35.1k| if(i % 2 == 1) { ------------------ | Branch (495:16): [True: 17.5k, False: 17.5k] ------------------ 496| 17.5k| tbl[i] = tbl[i / 2].square(); 497| 17.5k| } else { 498| 17.5k| tbl[i] = tbl[i - 1] * tbl[0]; 499| 17.5k| } 500| 35.1k| } 501| | 502| 1.17k| auto r = Self::one(); 503| | 504| 1.17k| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 505| | 506| | // Conditional ok: this function is variable time 507| 1.17k| if(w0 > 0) { ------------------ | Branch (507:13): [True: 890, False: 280] ------------------ 508| 890| r = tbl[w0 - 1]; 509| 890| } 510| | 511| 120k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (511:28): [True: 119k, False: 1.17k] ------------------ 512| 119k| r.square_n(WindowBits); 513| | 514| 119k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 515| | 516| | // Conditional ok: this function is variable time 517| 119k| if(w > 0) { ------------------ | Branch (517:16): [True: 116k, False: 3.18k] ------------------ 518| 116k| r *= tbl[w - 1]; 519| 116k| } 520| 119k| } 521| | 522| 1.17k| return r; 523| 1.17k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEC2Ev: 180| 36.2k| constexpr IntMod() : m_val({}) {} pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE8square_nEm: 439| 119k| constexpr void square_n(size_t n) { 440| 119k| std::array z; // NOLINT(*-member-init) 441| 716k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (441:28): [True: 596k, False: 119k] ------------------ 442| 596k| comba_sqr(z.data(), this->data()); 443| 596k| m_val = Rep::redc(z); 444| 596k| } 445| 119k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEmLERKSA_: 355| 359k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 356| 359k| std::array z; // NOLINT(*-member-init) 357| 359k| comba_mul(z.data(), data(), other.data()); 358| 359k| m_val = Rep::redc(z); 359| 359k| return (*this); 360| 359k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 598| 1| constexpr Self invert_vartime() const { 599| | // Conditional ok: this function is variable time 600| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (600:13): [True: 0, False: 1] ------------------ 601| 0| return Self::zero(); 602| 0| } 603| | 604| 1| auto x = Self(std::array{1}); // 1 in standard domain 605| 1| auto b = Self(this->to_words()); // *this in standard domain 606| | 607| | // First loop iteration 608| 1| Self::_invert_vartime_div2_helper(b, x); 609| | 610| 1| auto a = b.negate(); 611| | // y += x but y is zero at the outset 612| 1| auto y = x; 613| | 614| | // First half of second loop iteration 615| 1| Self::_invert_vartime_div2_helper(a, y); 616| | 617| 366| for(;;) { 618| | // Conditional ok: this function is variable time 619| 366| if(a.m_val == b.m_val) { ------------------ | Branch (619:16): [True: 1, False: 365] ------------------ 620| | // At this point it should be that a == b == 1 621| 1| auto r = y.negate(); 622| | 623| | // Convert back to Montgomery if required 624| 1| r.m_val = Rep::to_rep(r.m_val); 625| 1| return r; 626| 1| } 627| | 628| 365| auto nx = x + y; 629| | 630| | /* 631| | * Otherwise either b > a or a > b 632| | * 633| | * If b > a we want to set b to b - a 634| | * Otherwise we want to set a to a - b 635| | * 636| | * Compute r = b - a and check if it underflowed 637| | * If it did not then we are in the b > a path 638| | */ 639| 365| std::array r; // NOLINT(*-member-init) 640| 365| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 641| | 642| | // Conditional ok: this function is variable time 643| 365| if(carry == 0) { ------------------ | Branch (643:16): [True: 175, False: 190] ------------------ 644| | // b > a 645| 175| b.m_val = r; 646| 175| x = nx; 647| 175| Self::_invert_vartime_div2_helper(b, x); 648| 190| } else { 649| | // We know this can't underflow because a > b 650| 190| bigint_sub3(r.data(), a.data(), N, b.data(), N); 651| 190| a.m_val = r; 652| 190| y = nx; 653| 190| Self::_invert_vartime_div2_helper(a, y); 654| 190| } 655| 365| } 656| 1| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4zeroEv: 195| 137k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 734| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm8EEE: 137| 3.14k| constexpr static std::array from_rep(const std::array& z) { 138| 3.14k| std::array ze = {}; 139| 3.14k| copy_mem(std::span{ze}.template first(), z); 140| 3.14k| return Self::redc(ze); 141| 3.14k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 547| 367| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 548| 367| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 549| | 550| | // Conditional ok: this function is variable time 551| 1.08k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (551:16): [True: 713, False: 367] ------------------ 552| 713| shift_right<1>(a.m_val); 553| | 554| 713| const W borrow = shift_right<1>(x.m_val); 555| | 556| | // Conditional ok: this function is variable time 557| 713| if(borrow) { ------------------ | Branch (557:16): [True: 362, False: 351] ------------------ 558| 362| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 559| 362| } 560| 713| } 561| 367| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6negateEv: 452| 68.8k| constexpr Self negate() const { 453| 68.8k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 454| | 455| 68.8k| std::array r; // NOLINT(*-member-init) 456| 68.8k| W carry = 0; 457| 619k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (457:28): [True: 550k, False: 68.8k] ------------------ 458| 550k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 459| 550k| } 460| | 461| 68.8k| return Self(r); 462| 68.8k| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm8EEE: 115| 3.53k| constexpr static std::array to_rep(const std::array& x) { 116| 3.53k| std::array z; // NOLINT(*-member-init) 117| 3.53k| comba_mul(z.data(), x.data(), R2.data()); 118| 3.53k| return Self::redc(z); 119| 3.53k| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 917| 79.1k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 3.08k| std::array stash_value() const { 760| 3.08k| static_assert(L >= N); 761| 3.08k| std::array stash = {}; 762| 27.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 24.7k, False: 3.08k] ------------------ 763| 24.7k| stash[i] = m_val[i]; 764| 24.7k| } 765| 3.08k| return stash; 766| 3.08k| } pcurves_brainpool512r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1407| 436| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1408| 436| const BlindedScalar scalar(s, rng); 1409| 436| return basemul_booth_exec(m_table, scalar, rng); 1410| 436| } pcurves_brainpool512r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 436| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 436| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 436, Folded] | Branch (1308:33): [True: 436, False: 0] ------------------ 1309| 436| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 436| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 436| constexpr size_t n_words = C::Words; 1313| | 1314| 436| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 436| rng.randomize(maskb, MaskBytes); 1316| | 1317| 436| W mask[n_words] = {0}; 1318| 436| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 436| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| | if constexpr(ExcessBits > 0) { 1323| | constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| | mask[MaskWords - 1] &= ExcessMask; 1325| | } 1326| | 1327| | // Set top and bottom bits of mask 1328| 436| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 436| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 436| mask[0] |= 1; 1331| | 1332| 436| W mask_n[2 * n_words] = {0}; 1333| | 1334| 436| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 436| comba_mul(mask_n, mask, C::NW.data()); 1338| 436| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 436| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 436| m_bytes = store_be>(mask_n); 1342| 436| m_bits = C::Scalar::BITS + BlindingBits; 1343| 436| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 436| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 436| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE8to_wordsEv: 734| 663| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm8EEE: 137| 1.09k| constexpr static std::array from_rep(const std::array& z) { 138| 1.09k| std::array ze = {}; 139| 1.09k| copy_mem(std::span{ze}.template first(), z); 140| 1.09k| return Self::redc(ze); 141| 1.09k| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm16EEE: 104| 1.53k| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 1.53k| } else { 108| 1.53k| return monty_redc(z, P, P_dash); 109| 1.53k| } 110| 1.53k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm64EEE: 739| 436| constexpr void serialize_to(std::span bytes) const { 740| 436| auto v = Rep::from_rep(m_val); 741| 436| std::reverse(v.begin(), v.end()); 742| | 743| 436| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 436| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 436| } pcurves_brainpool512r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EE4bitsEv: 1305| 436| size_t bits() const { return m_bits; } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1084| 663| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1085| 663| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1086| 663| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E6negateEv: 1134| 663| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1174| 663| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18_const_time_poisonEv: 889| 1.98k| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_brainpool512r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EE10get_windowEm: 1353| 42.2k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 42.2k| return read_window_bits(std::span{m_bytes}, offset); 1356| 42.2k| } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1096| 67.9k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1097| 67.9k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one()); 1098| 67.9k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 367| 68.4k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 368| 68.4k| const W mask = cond.into_bitmask(); 369| | 370| 616k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (370:28): [True: 547k, False: 68.4k] ------------------ 371| 547k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 372| 547k| } 373| 68.4k| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 955| 42.2k| static constexpr auto ct_select(std::span pts, size_t idx) { 956| 42.2k| auto result = Self::identity(pts[0]); 957| | 958| | // Intentionally wrapping; set to maximum size_t if idx == 0 959| 42.2k| const size_t idx1 = static_cast(idx - 1); 960| 1.39M| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (960:28): [True: 1.35M, False: 42.2k] ------------------ 961| 1.35M| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 962| 1.35M| result.conditional_assign(found, pts[i]); 963| 1.35M| } 964| | 965| 42.2k| return result; 966| 42.2k| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE8identityERKSC_: 924| 68.6k| static constexpr Self identity(const Self& /*unused*/) { 925| 68.6k| return Self(FieldElement::zero(), FieldElement::zero()); 926| 68.6k| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 981| 1.77M| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 982| 1.77M| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 983| 1.77M| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 380| 1.77M| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 381| 1.77M| const W mask = cond.into_bitmask(); 382| | 383| 15.9M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (383:28): [True: 14.1M, False: 1.77M] ------------------ 384| 14.1M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 385| 14.1M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 386| 14.1M| } 387| 1.77M| } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E13randomize_repERNS_21RandomNumberGeneratorE: 1142| 2.65k| void randomize_rep(RandomNumberGenerator& rng) { 1143| | // In certain contexts we may be called with a Null_RNG; in that case the 1144| | // caller is accepting that randomization will not occur 1145| | 1146| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1147| 2.65k| if(rng.is_seeded()) { ------------------ | Branch (1147:13): [True: 2.65k, False: 0] ------------------ 1148| 2.65k| auto r = FieldElement::random(rng); 1149| | 1150| 2.65k| auto r2 = r.square(); 1151| 2.65k| auto r3 = r2 * r; 1152| | 1153| 2.65k| m_x *= r2; 1154| 2.65k| m_y *= r3; 1155| 2.65k| m_z *= r; 1156| 2.65k| } 1157| 2.65k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 2.65k| static Self random(RandomNumberGenerator& rng) { 852| 2.65k| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 2.65k| std::array buf{}; 855| | 856| 4.03k| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 4.03k, False: 0] ------------------ 857| 4.03k| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 4.03k| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 2.65k, False: 1.38k] ------------------ 868| 2.65k| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 2.65k, False: 0] ------------------ 869| 2.65k| return s.value(); 870| 2.65k| } 871| 2.65k| } 872| 4.03k| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 2.65k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 4.92k| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 4.92k| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 4.92k] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 4.92k| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 4.92k| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 1.39k, False: 3.53k] ------------------ 802| 1.39k| return {}; 803| 1.39k| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 3.53k| return Self::from_words(words); 807| 4.92k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE10from_wordsILm8EEESA_NSt3__15arrayImXT_EEE: 211| 3.53k| static constexpr Self from_words(std::array w) { 212| 3.53k| if constexpr(L == N) { 213| 3.53k| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 3.53k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE10is_nonzeroEv: 230| 2.65k| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1176| 663| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE20_const_time_unpoisonEv: 891| 1.98k| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_brainpool512r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EED2Ev: 1358| 436| ~BlindedScalarBits() { 1359| 436| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 436| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 436| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 1.53k| static Self from_stash(const std::array& stash) { 775| 1.53k| static_assert(L >= N); 776| 1.53k| std::array val = {}; 777| 13.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 12.2k, False: 1.53k] ------------------ 778| 12.2k| val[i] = stash[i]; 779| 12.2k| } 780| 1.53k| return Self(val); 781| 1.53k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm8EEE: 898| 1.97k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm64EEE: 739| 2.91k| constexpr void serialize_to(std::span bytes) const { 740| 2.91k| auto v = Rep::from_rep(m_val); 741| 2.91k| std::reverse(v.begin(), v.end()); 742| | 743| 2.91k| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 2.91k| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 2.91k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 436| std::array stash_value() const { 760| 436| static_assert(L >= N); 761| 436| std::array stash = {}; 762| 3.92k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 3.48k, False: 436] ------------------ 763| 3.48k| stash[i] = m_val[i]; 764| 3.48k| } 765| 436| return stash; 766| 436| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 7.13k| static Self from_stash(const std::array& stash) { 775| 7.13k| static_assert(L >= N); 776| 7.13k| std::array val = {}; 777| 64.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 57.1k, False: 7.13k] ------------------ 778| 57.1k| val[i] = stash[i]; 779| 57.1k| } 780| 7.13k| return Self(val); 781| 7.13k| } pcurves_brainpool512r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm4EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1487| 227| explicit WindowedBoothMulTable(const AffinePoint& p) : m_table(varpoint_setup(p)) {} pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EERKNS_16AffineCurvePointISB_EE: 1066| 1.58k| friend constexpr Self operator+(const Self& a, const AffinePoint& b) { return Self::add_mixed(a, b); } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E9add_mixedERKSC_RKNS_16AffineCurvePointISB_EE: 1091| 1.58k| constexpr static Self add_mixed(const Self& a, const AffinePoint& b) { 1092| 1.58k| return point_add_mixed(a, b, FieldElement::one()); 1093| 1.58k| } pcurves_brainpool512r1.cpp:_ZNK5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm4EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1489| 227| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1490| 227| const BlindedScalar bits(s, rng); 1491| | 1492| 227| const size_t scalar_bits = bits.bits(); 1493| 227| const size_t full_windows = compute_full_windows(scalar_bits + 1, WindowBits); 1494| 227| const size_t initial_shift = compute_initial_shift(scalar_bits + 1, WindowBits); 1495| | 1496| 227| BOTAN_DEBUG_ASSERT(full_windows * WindowBits + initial_shift == scalar_bits + 1); ------------------ | | 130| 227| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 227| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 227] | | ------------------ ------------------ 1497| 227| BOTAN_DEBUG_ASSERT(initial_shift > 0); ------------------ | | 130| 227| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 227| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 227] | | ------------------ ------------------ 1498| | 1499| 227| auto accum = ProjectivePoint::identity(); 1500| 227| CT::poison(accum); 1501| | 1502| 26.3k| for(size_t i = 0; i != full_windows; ++i) { ------------------ | Branch (1502:28): [True: 26.1k, False: 227] ------------------ 1503| 26.1k| const size_t idx = scalar_bits - initial_shift - WindowBits * i; 1504| | 1505| 26.1k| const size_t w_i = bits.get_window(idx); 1506| 26.1k| const auto [tidx, tneg] = booth_recode(w_i); 1507| | 1508| | // Conditional ok: loop iteration count is public 1509| 26.1k| if(i == 0) { ------------------ | Branch (1509:16): [True: 227, False: 25.8k] ------------------ 1510| 227| accum = ProjectivePoint::from_affine(m_table.ct_select(tidx)); 1511| 227| accum.conditional_assign(tneg, accum.negate()); 1512| 25.8k| } else { 1513| 25.8k| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1514| 25.8k| } 1515| | 1516| 26.1k| accum = accum.dbl_n(WindowBits); 1517| | 1518| | // Conditional ok: loop iteration count is public 1519| 26.1k| if(i <= 3) { ------------------ | Branch (1519:16): [True: 908, False: 25.1k] ------------------ 1520| 908| accum.randomize_rep(rng); 1521| 908| } 1522| 26.1k| } 1523| | 1524| | // final window (note one bit shorter than previous reads) 1525| 227| const size_t w_l = bits.get_window(0) & ((1 << WindowBits) - 1); 1526| 227| const auto [tidx, tneg] = booth_recode(w_l << 1); 1527| 227| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1528| | 1529| 227| CT::unpoison(accum); 1530| 227| return accum; 1531| 227| } pcurves_brainpool512r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 227| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 227| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 227, Folded] | Branch (1308:33): [True: 227, False: 0] ------------------ 1309| 227| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 227| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 227| constexpr size_t n_words = C::Words; 1313| | 1314| 227| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 227| rng.randomize(maskb, MaskBytes); 1316| | 1317| 227| W mask[n_words] = {0}; 1318| 227| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 227| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| | if constexpr(ExcessBits > 0) { 1323| | constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| | mask[MaskWords - 1] &= ExcessMask; 1325| | } 1326| | 1327| | // Set top and bottom bits of mask 1328| 227| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 227| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 227| mask[0] |= 1; 1331| | 1332| 227| W mask_n[2 * n_words] = {0}; 1333| | 1334| 227| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 227| comba_mul(mask_n, mask, C::NW.data()); 1338| 227| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 227| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 227| m_bytes = store_be>(mask_n); 1342| 227| m_bits = C::Scalar::BITS + BlindingBits; 1343| 227| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 227| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 227| } pcurves_brainpool512r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EE4bitsEv: 1305| 227| size_t bits() const { return m_bits; } pcurves_brainpool512r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm4EE20compute_full_windowsEmm: 1468| 227| static constexpr size_t compute_full_windows(size_t sb, size_t wb) { 1469| 227| if(sb % wb == 0) { ------------------ | Branch (1469:13): [True: 0, False: 227] ------------------ 1470| 0| return (sb - 1) / wb; 1471| 227| } else { 1472| 227| return sb / wb; 1473| 227| } 1474| 227| } pcurves_brainpool512r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm4EE21compute_initial_shiftEmm: 1476| 227| static constexpr size_t compute_initial_shift(size_t sb, size_t wb) { 1477| 227| if(sb % wb == 0) { ------------------ | Branch (1477:13): [True: 0, False: 227] ------------------ 1478| 0| return wb; 1479| 227| } else { 1480| 227| return sb - (sb / wb) * wb; 1481| 227| } 1482| 227| } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E8identityEv: 1038| 227| static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::one(), FieldElement::zero()); } pcurves_brainpool512r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EE10get_windowEm: 1353| 26.3k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 26.3k| return read_window_bits(std::span{m_bytes}, offset); 1356| 26.3k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E5dbl_nEm: 1108| 26.1k| constexpr Self dbl_n(size_t n) const { 1109| | if constexpr(Self::A_is_minus_3) { 1110| | return dbl_n_a_minus_3(*this, n); 1111| | } else if constexpr(Self::A_is_zero) { 1112| | return dbl_n_a_zero(*this, n); 1113| 26.1k| } else { 1114| 26.1k| return dbl_n_generic(*this, A, n); 1115| 26.1k| } 1116| 26.1k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4div2Ev: 302| 26.1k| Self div2() const { 303| | // The inverse of 2 modulo P is (P/2)+1; this avoids a constexpr time 304| | // general inversion, which some compilers can't handle 305| 26.1k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 306| | 307| | // We could multiply by INV_2 but there is a better way ... 308| | 309| 26.1k| std::array t = value(); 310| 26.1k| const W borrow = shift_right<1>(t); 311| | 312| | // If value was odd, add (P/2)+1 313| 26.1k| const auto mask = CT::Mask::expand(borrow).value(); 314| | 315| 26.1k| W carry = 0; 316| | 317| 234k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (317:28): [True: 208k, False: 26.1k] ------------------ 318| 208k| t[i] = word_add(t[i], INV_2[i] & mask, &carry); 319| 208k| } 320| | 321| 26.1k| return Self(t); 322| 26.1k| } pcurves_brainpool512r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EED2Ev: 1358| 227| ~BlindedScalarBits() { 1359| 227| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 227| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 227| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 225| 872| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEeqERKSA_: 722| 1.01k| constexpr CT::Choice operator==(const Self& other) const { 723| 1.01k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 724| 1.01k| } pcurves_brainpool512r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsENS_13MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1275| 1.01k| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4sqrtEv: 663| 280| constexpr CT::Option sqrt() const { 664| 280| if constexpr(Self::P_MOD_4 == 3) { 665| | // The easy case for square root is when p == 3 (mod 4) 666| | 667| 280| constexpr auto P_PLUS_1_OVER_4 = p_plus_1_over_4(P); 668| 280| auto z = pow_vartime(P_PLUS_1_OVER_4); 669| | 670| | // Zero out the return value if it would otherwise be incorrect 671| 280| const CT::Choice correct = (z.square() == *this); 672| 280| z.conditional_assign(!correct, Self::zero()); 673| 280| return CT::Option(z, correct); 674| | } else { 675| | // Shanks-Tonelli, following I.4 in RFC 9380 676| | 677| | /* 678| | Constants: 679| | 1. c1, the largest integer such that 2^c1 divides q - 1. 680| | 2. c2 = (q - 1) / (2^c1) # Integer arithmetic 681| | 3. c3 = (c2 - 1) / 2 # Integer arithmetic 682| | 4. c4, a non-square value in F 683| | 5. c5 = c4^c2 in F 684| | */ 685| | constexpr auto C1_C2 = shanks_tonelli_c1c2(Self::P); 686| | constexpr std::array C3 = shanks_tonelli_c3(C1_C2.second); 687| | constexpr std::array P_MINUS_1_OVER_2 = p_minus_1_over_2(Self::P); 688| | constexpr Self C4 = shanks_tonelli_c4(P_MINUS_1_OVER_2); 689| | constexpr Self C5 = C4.pow_vartime(C1_C2.second); 690| | 691| | const Self& x = (*this); 692| | 693| | auto z = x.pow_vartime(C3); 694| | auto t = z.square(); 695| | t *= x; 696| | z *= x; 697| | auto b = t; 698| | auto c = C5; 699| | 700| | for(size_t i = C1_C2.first; i >= 2; i--) { 701| | b.square_n(i - 2); 702| | const CT::Choice e = b.is_one(); 703| | z.conditional_assign(!e, z * c); 704| | c.square_n(1); 705| | t.conditional_assign(!e, t * c); 706| | b = t; 707| | } 708| | 709| | // Zero out the return value if it would otherwise be incorrect 710| | const CT::Choice correct = (z.square() == *this); 711| | z.conditional_assign(!correct, Self::zero()); 712| | return CT::Option(z, correct); 713| | } 714| 280| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE: 248| 227| constexpr Self correct_sign(CT::Choice even) const { 249| 227| const auto flip = (even != this->is_even()); 250| 227| return Self::choose(flip, this->negate(), *this); 251| 227| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE7is_evenEv: 240| 227| constexpr CT::Choice is_even() const { 241| 227| auto v = Rep::from_rep(m_val); 242| 227| return !CT::Choice::from_int(v[0] & 0x01); 243| 227| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_: 256| 227| static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) { 257| 227| auto r = y; 258| 227| r.conditional_assign(choice, x); 259| 227| return r; 260| 227| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 643| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 643| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 643] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 643| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 643| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 207, False: 436] ------------------ 802| 207| return {}; 803| 207| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 436| return Self::from_words(words); 807| 643| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm8EEESA_NSt3__15arrayImXT_EEE: 211| 436| static constexpr Self from_words(std::array w) { 212| 436| if constexpr(L == N) { 213| 436| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 436| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm8EEE: 115| 436| constexpr static std::array to_rep(const std::array& x) { 116| 436| std::array z; // NOLINT(*-member-init) 117| 436| comba_mul(z.data(), x.data(), R2.data()); 118| 436| return Self::redc(z); 119| 436| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm129EEE: 941| 1.34k| constexpr void serialize_to(std::span bytes) const { 942| 1.34k| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 1.34k| do { \ | | 52| 1.34k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 1.34k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 1.34k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 1.34k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 1.34k] | | ------------------ ------------------ 943| 1.34k| BufferStuffer pack(bytes); 944| 1.34k| pack.append(0x04); 945| 1.34k| x().serialize_to(pack.next()); 946| 1.34k| y().serialize_to(pack.next()); 947| 1.34k| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 130| 1.34k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 1.34k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 1.34k] | | ------------------ ------------------ 948| 1.34k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 436| static Self random(RandomNumberGenerator& rng) { 852| 436| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 436| std::array buf{}; 855| | 856| 643| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 643, False: 0] ------------------ 857| 643| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 643| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 436, False: 207] ------------------ 868| 436| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 436, False: 0] ------------------ 869| 436| return s.value(); 870| 436| } 871| 436| } 872| 643| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 436| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE10is_nonzeroEv: 230| 436| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_secp256r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_12Secp256r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1405| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1016| 969| static constexpr Self from_affine(const AffinePoint& pt) { 1017| | /* 1018| | * If the point is the identity element (x=0, y=0) then instead of 1019| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1020| | * encoding of (0, 1, 0) 1021| | * 1022| | * Which we can achieve by a conditional swap of y and z if the 1023| | * affine point is the identity. 1024| | */ 1025| | 1026| 969| auto x = pt.x(); 1027| 969| auto y = pt.y(); 1028| 969| auto z = FieldElement::one(); 1029| | 1030| 969| FieldElement::conditional_swap(pt.is_identity(), y, z); 1031| | 1032| 969| return ProjectiveCurvePoint(x, y, z); 1033| 969| } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE1xEv: 971| 1.03M| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE1yEv: 976| 998k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE3oneEv: 200| 38.5k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 898| 2.24M| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 410| 969| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 411| 969| const W mask = cond.into_bitmask(); 412| | 413| 4.84k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (413:28): [True: 3.87k, False: 969] ------------------ 414| 3.87k| auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 415| 3.87k| auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 416| 3.87k| x.m_val[i] = nx; 417| 3.87k| y.m_val[i] = ny; 418| 3.87k| } 419| 969| } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE11is_identityEv: 928| 54.2k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE7is_zeroEv: 225| 232k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1056| 59.7k| m_x(x), m_y(y), m_z(z) {} pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E3dblEv: 1121| 3.11k| constexpr Self dbl() const { 1122| 3.11k| if constexpr(Self::A_is_minus_3) { 1123| 3.11k| return dbl_a_minus_3(*this); 1124| | } else if constexpr(Self::A_is_zero) { 1125| | return dbl_a_zero(*this); 1126| | } else { 1127| | return dbl_generic(*this, A); 1128| | } 1129| 3.11k| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1zEv: 1172| 237k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6squareEv: 426| 511k| constexpr BOTAN_FORCE_INLINE Self square() const { 427| 511k| std::array z; // NOLINT(*-member-init) 428| 511k| comba_sqr(z.data(), this->data()); 429| 511k| return Self(Rep::redc(z)); 430| 511k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4dataEv: 896| 2.27M| constexpr const W* data() const { return m_val.data(); } pcurves_secp256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 346| 530k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 347| 530k| std::array z; // NOLINT(*-member-init) 348| 530k| comba_mul(z.data(), a.data(), b.data()); 349| 530k| return Self(Rep::redc(z)); 350| 530k| } pcurves_secp256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 281| 565k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 282| 565k| std::array r; // NOLINT(*-member-init) 283| 565k| W carry = 0; 284| 2.82M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (284:28): [True: 2.26M, False: 565k] ------------------ 285| 2.26M| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 286| 2.26M| } 287| | 288| 565k| const auto mask = CT::Mask::expand(carry).value(); 289| | 290| 565k| carry = 0; 291| | 292| 2.82M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (292:28): [True: 2.26M, False: 565k] ------------------ 293| 2.26M| r[i] = word_add(r[i], P[i] & mask, &carry); 294| 2.26M| } 295| | 296| 565k| return Self(r); 297| 565k| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1xEv: 1162| 149k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul3Ev: 335| 84.3k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp256r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 265| 140k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 266| 140k| std::array t; // NOLINT(*-member-init) 267| | 268| 140k| W carry = 0; 269| 700k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (269:28): [True: 560k, False: 140k] ------------------ 270| 560k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 271| 560k| } 272| | 273| 140k| std::array r; // NOLINT(*-member-init) 274| 140k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 275| 140k| return Self(r); 276| 140k| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1yEv: 1167| 145k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul4Ev: 338| 3.11k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul2Ev: 325| 284k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 326| 284k| std::array t = value(); 327| 284k| const W carry = shift_left<1>(t); 328| | 329| 284k| std::array r; // NOLINT(*-member-init) 330| 284k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 331| 284k| return Self(r); 332| 284k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE5valueEv: 894| 301k| constexpr const std::array& value() const { return m_val; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul8Ev: 341| 3.11k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EESE_: 1064| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1103| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E11is_identityEv: 1082| 45.2k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 395| 76.8k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 396| 76.8k| const W mask = cond.into_bitmask(); 397| | 398| 384k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (398:28): [True: 307k, False: 76.8k] ------------------ 399| 307k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 400| 307k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 401| 307k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 402| 307k| } 403| 76.8k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEmLERKSA_: 355| 167k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 356| 167k| std::array z; // NOLINT(*-member-init) 357| 167k| comba_mul(z.data(), data(), other.data()); 358| 167k| m_val = Rep::redc(z); 359| 167k| return (*this); 360| 167k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE8square_nEm: 439| 10.7k| constexpr void square_n(size_t n) { 440| 10.7k| std::array z; // NOLINT(*-member-init) 441| 327k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (441:28): [True: 316k, False: 10.7k] ------------------ 442| 316k| comba_sqr(z.data(), this->data()); 443| 316k| m_val = Rep::redc(z); 444| 316k| } 445| 10.7k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE14invert_vartimeEv: 598| 1| constexpr Self invert_vartime() const { 599| | // Conditional ok: this function is variable time 600| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (600:13): [True: 0, False: 1] ------------------ 601| 0| return Self::zero(); 602| 0| } 603| | 604| 1| auto x = Self(std::array{1}); // 1 in standard domain 605| 1| auto b = Self(this->to_words()); // *this in standard domain 606| | 607| | // First loop iteration 608| 1| Self::_invert_vartime_div2_helper(b, x); 609| | 610| 1| auto a = b.negate(); 611| | // y += x but y is zero at the outset 612| 1| auto y = x; 613| | 614| | // First half of second loop iteration 615| 1| Self::_invert_vartime_div2_helper(a, y); 616| | 617| 176| for(;;) { 618| | // Conditional ok: this function is variable time 619| 176| if(a.m_val == b.m_val) { ------------------ | Branch (619:16): [True: 1, False: 175] ------------------ 620| | // At this point it should be that a == b == 1 621| 1| auto r = y.negate(); 622| | 623| | // Convert back to Montgomery if required 624| 1| r.m_val = Rep::to_rep(r.m_val); 625| 1| return r; 626| 1| } 627| | 628| 175| auto nx = x + y; 629| | 630| | /* 631| | * Otherwise either b > a or a > b 632| | * 633| | * If b > a we want to set b to b - a 634| | * Otherwise we want to set a to a - b 635| | * 636| | * Compute r = b - a and check if it underflowed 637| | * If it did not then we are in the b > a path 638| | */ 639| 175| std::array r; // NOLINT(*-member-init) 640| 175| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 641| | 642| | // Conditional ok: this function is variable time 643| 175| if(carry == 0) { ------------------ | Branch (643:16): [True: 85, False: 90] ------------------ 644| | // b > a 645| 85| b.m_val = r; 646| 85| x = nx; 647| 85| Self::_invert_vartime_div2_helper(b, x); 648| 90| } else { 649| | // We know this can't underflow because a > b 650| 90| bigint_sub3(r.data(), a.data(), N, b.data(), N); 651| 90| a.m_val = r; 652| 90| y = nx; 653| 90| Self::_invert_vartime_div2_helper(a, y); 654| 90| } 655| 175| } 656| 1| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4zeroEv: 195| 72.9k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE8to_wordsEv: 734| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 547| 177| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 548| 177| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 549| | 550| | // Conditional ok: this function is variable time 551| 545| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (551:16): [True: 368, False: 177] ------------------ 552| 368| shift_right<1>(a.m_val); 553| | 554| 368| const W borrow = shift_right<1>(x.m_val); 555| | 556| | // Conditional ok: this function is variable time 557| 368| if(borrow) { ------------------ | Branch (557:16): [True: 129, False: 239] ------------------ 558| 129| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 559| 129| } 560| 368| } 561| 177| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6negateEv: 452| 36.3k| constexpr Self negate() const { 453| 36.3k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 454| | 455| 36.3k| std::array r; // NOLINT(*-member-init) 456| 36.3k| W carry = 0; 457| 181k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (457:28): [True: 145k, False: 36.3k] ------------------ 458| 145k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 459| 145k| } 460| | 461| 36.3k| return Self(r); 462| 36.3k| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEEC2ERKSB_SE_: 917| 65.2k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 15.6k| std::array stash_value() const { 760| 15.6k| static_assert(L >= N); 761| 15.6k| std::array stash = {}; 762| 78.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 62.5k, False: 15.6k] ------------------ 763| 62.5k| stash[i] = m_val[i]; 764| 62.5k| } 765| 15.6k| return stash; 766| 15.6k| } pcurves_secp256r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp256r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1407| 398| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1408| 398| const BlindedScalar scalar(s, rng); 1409| 398| return basemul_booth_exec(m_table, scalar, rng); 1410| 398| } pcurves_secp256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp256r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 398| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 398| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 398, Folded] | Branch (1308:33): [True: 398, False: 0] ------------------ 1309| 398| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 398| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 398| constexpr size_t n_words = C::Words; 1313| | 1314| 398| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 398| rng.randomize(maskb, MaskBytes); 1316| | 1317| 398| W mask[n_words] = {0}; 1318| 398| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 398| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 398| if constexpr(ExcessBits > 0) { 1323| 398| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 398| mask[MaskWords - 1] &= ExcessMask; 1325| 398| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 398| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 398| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 398| mask[0] |= 1; 1331| | 1332| 398| W mask_n[2 * n_words] = {0}; 1333| | 1334| 398| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 398| comba_mul(mask_n, mask, C::NW.data()); 1338| 398| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 398| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 398| m_bytes = store_be>(mask_n); 1342| 398| m_bits = C::Scalar::BITS + BlindingBits; 1343| 398| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 398| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 398| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE8to_wordsEv: 734| 683| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_12Secp256r1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 137| 7.33k| constexpr static std::array from_rep(const std::array& z) { 138| 7.33k| std::array ze = {}; 139| 7.33k| copy_mem(std::span{ze}.template first(), z); 140| 7.33k| return Self::redc(ze); 141| 7.33k| } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_12Secp256r1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 104| 13.9k| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 13.9k| } else { 108| 13.9k| return monty_redc(z, P, P_dash); 109| 13.9k| } 110| 13.9k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 739| 6.64k| constexpr void serialize_to(std::span bytes) const { 740| 6.64k| auto v = Rep::from_rep(m_val); 741| 6.64k| std::reverse(v.begin(), v.end()); 742| | 743| 6.64k| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 6.64k| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 6.64k| } pcurves_secp256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EE4bitsEv: 1305| 398| size_t bits() const { return m_bits; } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1084| 683| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1085| 683| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1086| 683| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E6negateEv: 1134| 683| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1174| 683| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18_const_time_poisonEv: 889| 2.04k| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_secp256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EE10get_windowEm: 1353| 19.5k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 19.5k| return read_window_bits(std::span{m_bytes}, offset); 1356| 19.5k| } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1096| 35.3k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1097| 35.3k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one()); 1098| 35.3k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 367| 35.9k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 368| 35.9k| const W mask = cond.into_bitmask(); 369| | 370| 179k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (370:28): [True: 143k, False: 35.9k] ------------------ 371| 143k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 372| 143k| } 373| 35.9k| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 955| 19.5k| static constexpr auto ct_select(std::span pts, size_t idx) { 956| 19.5k| auto result = Self::identity(pts[0]); 957| | 958| | // Intentionally wrapping; set to maximum size_t if idx == 0 959| 19.5k| const size_t idx1 = static_cast(idx - 1); 960| 643k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (960:28): [True: 624k, False: 19.5k] ------------------ 961| 624k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 962| 624k| result.conditional_assign(found, pts[i]); 963| 624k| } 964| | 965| 19.5k| return result; 966| 19.5k| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE8identityERKSC_: 924| 36.0k| static constexpr Self identity(const Self& /*unused*/) { 925| 36.0k| return Self(FieldElement::zero(), FieldElement::zero()); 926| 36.0k| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 981| 888k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 982| 888k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 983| 888k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 380| 888k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 381| 888k| const W mask = cond.into_bitmask(); 382| | 383| 4.44M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (383:28): [True: 3.55M, False: 888k] ------------------ 384| 3.55M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 385| 3.55M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 386| 3.55M| } 387| 888k| } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E13randomize_repERNS_21RandomNumberGeneratorE: 1142| 2.73k| void randomize_rep(RandomNumberGenerator& rng) { 1143| | // In certain contexts we may be called with a Null_RNG; in that case the 1144| | // caller is accepting that randomization will not occur 1145| | 1146| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1147| 2.73k| if(rng.is_seeded()) { ------------------ | Branch (1147:13): [True: 2.73k, False: 0] ------------------ 1148| 2.73k| auto r = FieldElement::random(rng); 1149| | 1150| 2.73k| auto r2 = r.square(); 1151| 2.73k| auto r3 = r2 * r; 1152| | 1153| 2.73k| m_x *= r2; 1154| 2.73k| m_y *= r3; 1155| 2.73k| m_z *= r; 1156| 2.73k| } 1157| 2.73k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 2.73k| static Self random(RandomNumberGenerator& rng) { 852| 2.73k| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 2.73k| std::array buf{}; 855| | 856| 2.73k| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 2.73k, False: 0] ------------------ 857| 2.73k| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 2.73k| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 2.73k, False: 0] ------------------ 868| 2.73k| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 2.73k, False: 0] ------------------ 869| 2.73k| return s.value(); 870| 2.73k| } 871| 2.73k| } 872| 2.73k| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 2.73k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 16.1k| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 16.1k| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 16.1k] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 16.1k| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 16.1k| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 4, False: 16.1k] ------------------ 802| 4| return {}; 803| 4| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 16.1k| return Self::from_words(words); 807| 16.1k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE: 211| 16.1k| static constexpr Self from_words(std::array w) { 212| 16.1k| if constexpr(L == N) { 213| 16.1k| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 16.1k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE10is_nonzeroEv: 230| 2.73k| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1176| 683| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE20_const_time_unpoisonEv: 891| 2.04k| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_secp256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EED2Ev: 1358| 398| ~BlindedScalarBits() { 1359| 398| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 398| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 398| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 774| 13.9k| static Self from_stash(const std::array& stash) { 775| 13.9k| static_assert(L >= N); 776| 13.9k| std::array val = {}; 777| 69.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 55.9k, False: 13.9k] ------------------ 778| 55.9k| val[i] = stash[i]; 779| 55.9k| } 780| 13.9k| return Self(val); 781| 13.9k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 898| 20.6k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 739| 15.8k| constexpr void serialize_to(std::span bytes) const { 740| 15.8k| auto v = Rep::from_rep(m_val); 741| 15.8k| std::reverse(v.begin(), v.end()); 742| | 743| 15.8k| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 15.8k| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 15.8k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 6.64k| std::array stash_value() const { 760| 6.64k| static_assert(L >= N); 761| 6.64k| std::array stash = {}; 762| 33.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 26.5k, False: 6.64k] ------------------ 763| 26.5k| stash[i] = m_val[i]; 764| 26.5k| } 765| 6.64k| return stash; 766| 6.64k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 32.9k| static Self from_stash(const std::array& stash) { 775| 32.9k| static_assert(L >= N); 776| 32.9k| std::array val = {}; 777| 164k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 131k, False: 32.9k] ------------------ 778| 131k| val[i] = stash[i]; 779| 131k| } 780| 32.9k| return Self(val); 781| 32.9k| } pcurves_secp256r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm4EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_12Secp256r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1487| 285| explicit WindowedBoothMulTable(const AffinePoint& p) : m_table(varpoint_setup(p)) {} pcurves_secp256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EERKNS_16AffineCurvePointISB_EE: 1066| 1.99k| friend constexpr Self operator+(const Self& a, const AffinePoint& b) { return Self::add_mixed(a, b); } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E9add_mixedERKSC_RKNS_16AffineCurvePointISB_EE: 1091| 1.99k| constexpr static Self add_mixed(const Self& a, const AffinePoint& b) { 1092| 1.99k| return point_add_mixed(a, b, FieldElement::one()); 1093| 1.99k| } pcurves_secp256r1.cpp:_ZNK5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm4EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp256r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1489| 285| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1490| 285| const BlindedScalar bits(s, rng); 1491| | 1492| 285| const size_t scalar_bits = bits.bits(); 1493| 285| const size_t full_windows = compute_full_windows(scalar_bits + 1, WindowBits); 1494| 285| const size_t initial_shift = compute_initial_shift(scalar_bits + 1, WindowBits); 1495| | 1496| 285| BOTAN_DEBUG_ASSERT(full_windows * WindowBits + initial_shift == scalar_bits + 1); ------------------ | | 130| 285| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 285| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 285] | | ------------------ ------------------ 1497| 285| BOTAN_DEBUG_ASSERT(initial_shift > 0); ------------------ | | 130| 285| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 285| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 285] | | ------------------ ------------------ 1498| | 1499| 285| auto accum = ProjectivePoint::identity(); 1500| 285| CT::poison(accum); 1501| | 1502| 16.5k| for(size_t i = 0; i != full_windows; ++i) { ------------------ | Branch (1502:28): [True: 16.2k, False: 285] ------------------ 1503| 16.2k| const size_t idx = scalar_bits - initial_shift - WindowBits * i; 1504| | 1505| 16.2k| const size_t w_i = bits.get_window(idx); 1506| 16.2k| const auto [tidx, tneg] = booth_recode(w_i); 1507| | 1508| | // Conditional ok: loop iteration count is public 1509| 16.2k| if(i == 0) { ------------------ | Branch (1509:16): [True: 285, False: 15.9k] ------------------ 1510| 285| accum = ProjectivePoint::from_affine(m_table.ct_select(tidx)); 1511| 285| accum.conditional_assign(tneg, accum.negate()); 1512| 15.9k| } else { 1513| 15.9k| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1514| 15.9k| } 1515| | 1516| 16.2k| accum = accum.dbl_n(WindowBits); 1517| | 1518| | // Conditional ok: loop iteration count is public 1519| 16.2k| if(i <= 3) { ------------------ | Branch (1519:16): [True: 1.14k, False: 15.1k] ------------------ 1520| 1.14k| accum.randomize_rep(rng); 1521| 1.14k| } 1522| 16.2k| } 1523| | 1524| | // final window (note one bit shorter than previous reads) 1525| 285| const size_t w_l = bits.get_window(0) & ((1 << WindowBits) - 1); 1526| 285| const auto [tidx, tneg] = booth_recode(w_l << 1); 1527| 285| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1528| | 1529| 285| CT::unpoison(accum); 1530| 285| return accum; 1531| 285| } pcurves_secp256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp256r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 285| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 285| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 285, Folded] | Branch (1308:33): [True: 285, False: 0] ------------------ 1309| 285| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 285| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 285| constexpr size_t n_words = C::Words; 1313| | 1314| 285| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 285| rng.randomize(maskb, MaskBytes); 1316| | 1317| 285| W mask[n_words] = {0}; 1318| 285| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 285| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 285| if constexpr(ExcessBits > 0) { 1323| 285| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 285| mask[MaskWords - 1] &= ExcessMask; 1325| 285| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 285| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 285| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 285| mask[0] |= 1; 1331| | 1332| 285| W mask_n[2 * n_words] = {0}; 1333| | 1334| 285| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 285| comba_mul(mask_n, mask, C::NW.data()); 1338| 285| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 285| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 285| m_bytes = store_be>(mask_n); 1342| 285| m_bits = C::Scalar::BITS + BlindingBits; 1343| 285| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 285| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 285| } pcurves_secp256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EE4bitsEv: 1305| 285| size_t bits() const { return m_bits; } pcurves_secp256r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm4EE20compute_full_windowsEmm: 1468| 285| static constexpr size_t compute_full_windows(size_t sb, size_t wb) { 1469| 285| if(sb % wb == 0) { ------------------ | Branch (1469:13): [True: 0, False: 285] ------------------ 1470| 0| return (sb - 1) / wb; 1471| 285| } else { 1472| 285| return sb / wb; 1473| 285| } 1474| 285| } pcurves_secp256r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm4EE21compute_initial_shiftEmm: 1476| 285| static constexpr size_t compute_initial_shift(size_t sb, size_t wb) { 1477| 285| if(sb % wb == 0) { ------------------ | Branch (1477:13): [True: 0, False: 285] ------------------ 1478| 0| return wb; 1479| 285| } else { 1480| 285| return sb - (sb / wb) * wb; 1481| 285| } 1482| 285| } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E8identityEv: 1038| 285| static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::one(), FieldElement::zero()); } pcurves_secp256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EE10get_windowEm: 1353| 16.5k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 16.5k| return read_window_bits(std::span{m_bytes}, offset); 1356| 16.5k| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E5dbl_nEm: 1108| 16.2k| constexpr Self dbl_n(size_t n) const { 1109| 16.2k| if constexpr(Self::A_is_minus_3) { 1110| 16.2k| return dbl_n_a_minus_3(*this, n); 1111| | } else if constexpr(Self::A_is_zero) { 1112| | return dbl_n_a_zero(*this, n); 1113| | } else { 1114| | return dbl_n_generic(*this, A, n); 1115| | } 1116| 16.2k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4div2Ev: 302| 16.2k| Self div2() const { 303| | // The inverse of 2 modulo P is (P/2)+1; this avoids a constexpr time 304| | // general inversion, which some compilers can't handle 305| 16.2k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 306| | 307| | // We could multiply by INV_2 but there is a better way ... 308| | 309| 16.2k| std::array t = value(); 310| 16.2k| const W borrow = shift_right<1>(t); 311| | 312| | // If value was odd, add (P/2)+1 313| 16.2k| const auto mask = CT::Mask::expand(borrow).value(); 314| | 315| 16.2k| W carry = 0; 316| | 317| 81.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (317:28): [True: 64.9k, False: 16.2k] ------------------ 318| 64.9k| t[i] = word_add(t[i], INV_2[i] & mask, &carry); 319| 64.9k| } 320| | 321| 16.2k| return Self(t); 322| 16.2k| } pcurves_secp256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EED2Ev: 1358| 285| ~BlindedScalarBits() { 1359| 285| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 285| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 285| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE7is_zeroEv: 225| 13.2k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEeqERKSA_: 722| 7.23k| constexpr CT::Choice operator==(const Self& other) const { 723| 7.23k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 724| 7.23k| } pcurves_secp256r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS2_12Secp256r1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1275| 7.23k| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE: 248| 285| constexpr Self correct_sign(CT::Choice even) const { 249| 285| const auto flip = (even != this->is_even()); 250| 285| return Self::choose(flip, this->negate(), *this); 251| 285| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE7is_evenEv: 240| 285| constexpr CT::Choice is_even() const { 241| 285| auto v = Rep::from_rep(m_val); 242| 285| return !CT::Choice::from_int(v[0] & 0x01); 243| 285| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_: 256| 285| static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) { 257| 285| auto r = y; 258| 285| r.conditional_assign(choice, x); 259| 285| return r; 260| 285| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 6.64k| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 6.64k| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 6.64k] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 6.64k| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 6.64k| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 0, False: 6.64k] ------------------ 802| 0| return {}; 803| 0| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 6.64k| return Self::from_words(words); 807| 6.64k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE10from_wordsILm4EEESB_NSt3__15arrayImXT_EEE: 211| 6.64k| static constexpr Self from_words(std::array w) { 212| 6.64k| if constexpr(L == N) { 213| 6.64k| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 6.64k| } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_12Secp256r1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 115| 6.64k| constexpr static std::array to_rep(const std::array& x) { 116| 6.64k| std::array z; // NOLINT(*-member-init) 117| 6.64k| comba_mul(z.data(), x.data(), R2.data()); 118| 6.64k| return Self::redc(z); 119| 6.64k| } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm65EEE: 941| 7.78k| constexpr void serialize_to(std::span bytes) const { 942| 7.78k| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 7.78k| do { \ | | 52| 7.78k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 7.78k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 7.78k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 7.78k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 7.78k] | | ------------------ ------------------ 943| 7.78k| BufferStuffer pack(bytes); 944| 7.78k| pack.append(0x04); 945| 7.78k| x().serialize_to(pack.next()); 946| 7.78k| y().serialize_to(pack.next()); 947| 7.78k| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 130| 7.78k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 7.78k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 7.78k] | | ------------------ ------------------ 948| 7.78k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 398| static Self random(RandomNumberGenerator& rng) { 852| 398| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 398| std::array buf{}; 855| | 856| 398| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 398, False: 0] ------------------ 857| 398| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 398| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 398, False: 0] ------------------ 868| 398| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 398, False: 0] ------------------ 869| 398| return s.value(); 870| 398| } 871| 398| } 872| 398| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 398| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_12Secp256r1RepEE12ScalarParamsEEEE10is_nonzeroEv: 230| 398| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_secp384r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1405| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1016| 699| static constexpr Self from_affine(const AffinePoint& pt) { 1017| | /* 1018| | * If the point is the identity element (x=0, y=0) then instead of 1019| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1020| | * encoding of (0, 1, 0) 1021| | * 1022| | * Which we can achieve by a conditional swap of y and z if the 1023| | * affine point is the identity. 1024| | */ 1025| | 1026| 699| auto x = pt.x(); 1027| 699| auto y = pt.y(); 1028| 699| auto z = FieldElement::one(); 1029| | 1030| 699| FieldElement::conditional_swap(pt.is_identity(), y, z); 1031| | 1032| 699| return ProjectiveCurvePoint(x, y, z); 1033| 699| } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE1xEv: 971| 1.08M| constexpr const FieldElement& x() const { return m_x; } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE1yEv: 976| 1.04M| constexpr const FieldElement& y() const { return m_y; } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE3oneEv: 200| 40.7k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEC2ENSt3__15arrayImLm6EEE: 898| 2.32M| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 410| 699| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 411| 699| const W mask = cond.into_bitmask(); 412| | 413| 4.89k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (413:28): [True: 4.19k, False: 699] ------------------ 414| 4.19k| auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 415| 4.19k| auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 416| 4.19k| x.m_val[i] = nx; 417| 4.19k| y.m_val[i] = ny; 418| 4.19k| } 419| 699| } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE11is_identityEv: 928| 43.0k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE7is_zeroEv: 225| 217k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1056| 63.0k| m_x(x), m_y(y), m_z(z) {} pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E3dblEv: 1121| 2.87k| constexpr Self dbl() const { 1122| 2.87k| if constexpr(Self::A_is_minus_3) { 1123| 2.87k| return dbl_a_minus_3(*this); 1124| | } else if constexpr(Self::A_is_zero) { 1125| | return dbl_a_zero(*this); 1126| | } else { 1127| | return dbl_generic(*this, A); 1128| | } 1129| 2.87k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1zEv: 1172| 252k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6squareEv: 426| 532k| constexpr BOTAN_FORCE_INLINE Self square() const { 427| 532k| std::array z; // NOLINT(*-member-init) 428| 532k| comba_sqr(z.data(), this->data()); 429| 532k| return Self(Rep::redc(z)); 430| 532k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4dataEv: 896| 2.38M| constexpr const W* data() const { return m_val.data(); } pcurves_secp384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 346| 556k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 347| 556k| std::array z; // NOLINT(*-member-init) 348| 556k| comba_mul(z.data(), a.data(), b.data()); 349| 556k| return Self(Rep::redc(z)); 350| 556k| } pcurves_secp384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 281| 608k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 282| 608k| std::array r; // NOLINT(*-member-init) 283| 608k| W carry = 0; 284| 4.25M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (284:28): [True: 3.64M, False: 608k] ------------------ 285| 3.64M| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 286| 3.64M| } 287| | 288| 608k| const auto mask = CT::Mask::expand(carry).value(); 289| | 290| 608k| carry = 0; 291| | 292| 4.25M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (292:28): [True: 3.64M, False: 608k] ------------------ 293| 3.64M| r[i] = word_add(r[i], P[i] & mask, &carry); 294| 3.64M| } 295| | 296| 608k| return Self(r); 297| 608k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1xEv: 1162| 157k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul3Ev: 335| 90.5k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp384r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 265| 136k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 266| 136k| std::array t; // NOLINT(*-member-init) 267| | 268| 136k| W carry = 0; 269| 952k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (269:28): [True: 816k, False: 136k] ------------------ 270| 816k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 271| 816k| } 272| | 273| 136k| std::array r; // NOLINT(*-member-init) 274| 136k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 275| 136k| return Self(r); 276| 136k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1yEv: 1167| 154k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul4Ev: 338| 2.87k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul2Ev: 325| 303k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 326| 303k| std::array t = value(); 327| 303k| const W carry = shift_left<1>(t); 328| | 329| 303k| std::array r; // NOLINT(*-member-init) 330| 303k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 331| 303k| return Self(r); 332| 303k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE5valueEv: 894| 321k| constexpr const std::array& value() const { return m_val; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul8Ev: 341| 2.87k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EESE_: 1064| 1.09k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1103| 1.09k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E11is_identityEv: 1082| 47.8k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 395| 82.3k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 396| 82.3k| const W mask = cond.into_bitmask(); 397| | 398| 576k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (398:28): [True: 494k, False: 82.3k] ------------------ 399| 494k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 400| 494k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 401| 494k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 402| 494k| } 403| 82.3k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEmLERKSA_: 355| 175k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 356| 175k| std::array z; // NOLINT(*-member-init) 357| 175k| comba_mul(z.data(), data(), other.data()); 358| 175k| m_val = Rep::redc(z); 359| 175k| return (*this); 360| 175k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE8square_nEm: 439| 10.6k| constexpr void square_n(size_t n) { 440| 10.6k| std::array z; // NOLINT(*-member-init) 441| 355k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (441:28): [True: 344k, False: 10.6k] ------------------ 442| 344k| comba_sqr(z.data(), this->data()); 443| 344k| m_val = Rep::redc(z); 444| 344k| } 445| 10.6k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE14invert_vartimeEv: 598| 1| constexpr Self invert_vartime() const { 599| | // Conditional ok: this function is variable time 600| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (600:13): [True: 0, False: 1] ------------------ 601| 0| return Self::zero(); 602| 0| } 603| | 604| 1| auto x = Self(std::array{1}); // 1 in standard domain 605| 1| auto b = Self(this->to_words()); // *this in standard domain 606| | 607| | // First loop iteration 608| 1| Self::_invert_vartime_div2_helper(b, x); 609| | 610| 1| auto a = b.negate(); 611| | // y += x but y is zero at the outset 612| 1| auto y = x; 613| | 614| | // First half of second loop iteration 615| 1| Self::_invert_vartime_div2_helper(a, y); 616| | 617| 252| for(;;) { 618| | // Conditional ok: this function is variable time 619| 252| if(a.m_val == b.m_val) { ------------------ | Branch (619:16): [True: 1, False: 251] ------------------ 620| | // At this point it should be that a == b == 1 621| 1| auto r = y.negate(); 622| | 623| | // Convert back to Montgomery if required 624| 1| r.m_val = Rep::to_rep(r.m_val); 625| 1| return r; 626| 1| } 627| | 628| 251| auto nx = x + y; 629| | 630| | /* 631| | * Otherwise either b > a or a > b 632| | * 633| | * If b > a we want to set b to b - a 634| | * Otherwise we want to set a to a - b 635| | * 636| | * Compute r = b - a and check if it underflowed 637| | * If it did not then we are in the b > a path 638| | */ 639| 251| std::array r; // NOLINT(*-member-init) 640| 251| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 641| | 642| | // Conditional ok: this function is variable time 643| 251| if(carry == 0) { ------------------ | Branch (643:16): [True: 118, False: 133] ------------------ 644| | // b > a 645| 118| b.m_val = r; 646| 118| x = nx; 647| 118| Self::_invert_vartime_div2_helper(b, x); 648| 133| } else { 649| | // We know this can't underflow because a > b 650| 133| bigint_sub3(r.data(), a.data(), N, b.data(), N); 651| 133| a.m_val = r; 652| 133| y = nx; 653| 133| Self::_invert_vartime_div2_helper(a, y); 654| 133| } 655| 251| } 656| 1| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4zeroEv: 195| 78.4k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE8to_wordsEv: 734| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 547| 253| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 548| 253| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 549| | 550| | // Conditional ok: this function is variable time 551| 809| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (551:16): [True: 556, False: 253] ------------------ 552| 556| shift_right<1>(a.m_val); 553| | 554| 556| const W borrow = shift_right<1>(x.m_val); 555| | 556| | // Conditional ok: this function is variable time 557| 556| if(borrow) { ------------------ | Branch (557:16): [True: 248, False: 308] ------------------ 558| 248| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 559| 248| } 560| 556| } 561| 253| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6negateEv: 452| 39.1k| constexpr Self negate() const { 453| 39.1k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 454| | 455| 39.1k| std::array r; // NOLINT(*-member-init) 456| 39.1k| W carry = 0; 457| 273k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (457:28): [True: 234k, False: 39.1k] ------------------ 458| 234k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 459| 234k| } 460| | 461| 39.1k| return Self(r); 462| 39.1k| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEEC2ERKSB_SE_: 917| 47.6k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 2.26k| std::array stash_value() const { 760| 2.26k| static_assert(L >= N); 761| 2.26k| std::array stash = {}; 762| 15.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 13.5k, False: 2.26k] ------------------ 763| 13.5k| stash[i] = m_val[i]; 764| 13.5k| } 765| 2.26k| return stash; 766| 2.26k| } pcurves_secp384r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1407| 290| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1408| 290| const BlindedScalar scalar(s, rng); 1409| 290| return basemul_booth_exec(m_table, scalar, rng); 1410| 290| } pcurves_secp384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 290| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 290| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 290, Folded] | Branch (1308:33): [True: 290, False: 0] ------------------ 1309| 290| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 290| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 290| constexpr size_t n_words = C::Words; 1313| | 1314| 290| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 290| rng.randomize(maskb, MaskBytes); 1316| | 1317| 290| W mask[n_words] = {0}; 1318| 290| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 290| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 290| if constexpr(ExcessBits > 0) { 1323| 290| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 290| mask[MaskWords - 1] &= ExcessMask; 1325| 290| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 290| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 290| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 290| mask[0] |= 1; 1331| | 1332| 290| W mask_n[2 * n_words] = {0}; 1333| | 1334| 290| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 290| comba_mul(mask_n, mask, C::NW.data()); 1338| 290| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 290| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 290| m_bytes = store_be>(mask_n); 1342| 290| m_bits = C::Scalar::BITS + BlindingBits; 1343| 290| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 290| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 290| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE8to_wordsEv: 734| 494| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm6EEE: 137| 784| constexpr static std::array from_rep(const std::array& z) { 138| 784| std::array ze = {}; 139| 784| copy_mem(std::span{ze}.template first(), z); 140| 784| return Self::redc(ze); 141| 784| } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm12EEE: 104| 1.07k| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 1.07k| } else { 108| 1.07k| return monty_redc(z, P, P_dash); 109| 1.07k| } 110| 1.07k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 739| 290| constexpr void serialize_to(std::span bytes) const { 740| 290| auto v = Rep::from_rep(m_val); 741| 290| std::reverse(v.begin(), v.end()); 742| | 743| 290| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 290| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 290| } pcurves_secp384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EE4bitsEv: 1305| 290| size_t bits() const { return m_bits; } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1084| 494| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1085| 494| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1086| 494| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E6negateEv: 1134| 494| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1174| 494| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18_const_time_poisonEv: 889| 1.48k| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_secp384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EE10get_windowEm: 1353| 21.1k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 21.1k| return read_window_bits(std::span{m_bytes}, offset); 1356| 21.1k| } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1096| 38.4k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1097| 38.4k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one()); 1098| 38.4k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 367| 38.8k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 368| 38.8k| const W mask = cond.into_bitmask(); 369| | 370| 271k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (370:28): [True: 233k, False: 38.8k] ------------------ 371| 233k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 372| 233k| } 373| 38.8k| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 955| 21.1k| static constexpr auto ct_select(std::span pts, size_t idx) { 956| 21.1k| auto result = Self::identity(pts[0]); 957| | 958| | // Intentionally wrapping; set to maximum size_t if idx == 0 959| 21.1k| const size_t idx1 = static_cast(idx - 1); 960| 698k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (960:28): [True: 677k, False: 21.1k] ------------------ 961| 677k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 962| 677k| result.conditional_assign(found, pts[i]); 963| 677k| } 964| | 965| 21.1k| return result; 966| 21.1k| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE8identityERKSC_: 924| 38.9k| static constexpr Self identity(const Self& /*unused*/) { 925| 38.9k| return Self(FieldElement::zero(), FieldElement::zero()); 926| 38.9k| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 981| 961k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 982| 961k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 983| 961k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 380| 961k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 381| 961k| const W mask = cond.into_bitmask(); 382| | 383| 6.72M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (383:28): [True: 5.76M, False: 961k] ------------------ 384| 5.76M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 385| 5.76M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 386| 5.76M| } 387| 961k| } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E13randomize_repERNS_21RandomNumberGeneratorE: 1142| 1.97k| void randomize_rep(RandomNumberGenerator& rng) { 1143| | // In certain contexts we may be called with a Null_RNG; in that case the 1144| | // caller is accepting that randomization will not occur 1145| | 1146| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1147| 1.97k| if(rng.is_seeded()) { ------------------ | Branch (1147:13): [True: 1.97k, False: 0] ------------------ 1148| 1.97k| auto r = FieldElement::random(rng); 1149| | 1150| 1.97k| auto r2 = r.square(); 1151| 1.97k| auto r3 = r2 * r; 1152| | 1153| 1.97k| m_x *= r2; 1154| 1.97k| m_y *= r3; 1155| 1.97k| m_z *= r; 1156| 1.97k| } 1157| 1.97k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 1.97k| static Self random(RandomNumberGenerator& rng) { 852| 1.97k| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 1.97k| std::array buf{}; 855| | 856| 1.97k| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 1.97k, False: 0] ------------------ 857| 1.97k| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 1.97k| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 1.97k, False: 0] ------------------ 868| 1.97k| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 1.97k, False: 0] ------------------ 869| 1.97k| return s.value(); 870| 1.97k| } 871| 1.97k| } 872| 1.97k| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 1.97k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 2.60k| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 2.60k| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 2.60k] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 2.60k| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 2.60k| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 5, False: 2.59k] ------------------ 802| 5| return {}; 803| 5| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 2.59k| return Self::from_words(words); 807| 2.60k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE10from_wordsILm6EEESA_NSt3__15arrayImXT_EEE: 211| 2.59k| static constexpr Self from_words(std::array w) { 212| 2.59k| if constexpr(L == N) { 213| 2.59k| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 2.59k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE10is_nonzeroEv: 230| 1.97k| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1176| 494| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE20_const_time_unpoisonEv: 891| 1.48k| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_secp384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EED2Ev: 1358| 290| ~BlindedScalarBits() { 1359| 290| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 290| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 290| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 774| 1.07k| static Self from_stash(const std::array& stash) { 775| 1.07k| static_assert(L >= N); 776| 1.07k| std::array val = {}; 777| 7.51k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 6.44k, False: 1.07k] ------------------ 778| 6.44k| val[i] = stash[i]; 779| 6.44k| } 780| 1.07k| return Self(val); 781| 1.07k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm6EEE: 898| 1.36k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 739| 2.41k| constexpr void serialize_to(std::span bytes) const { 740| 2.41k| auto v = Rep::from_rep(m_val); 741| 2.41k| std::reverse(v.begin(), v.end()); 742| | 743| 2.41k| if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| 2.41k| store_be(bytes, v); 745| | } else { 746| | // Remove leading zero bytes 747| | const auto padded_bytes = store_be(v); 748| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| | } 751| 2.41k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 290| std::array stash_value() const { 760| 290| static_assert(L >= N); 761| 290| std::array stash = {}; 762| 2.03k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 1.74k, False: 290] ------------------ 763| 1.74k| stash[i] = m_val[i]; 764| 1.74k| } 765| 290| return stash; 766| 290| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 5.70k| static Self from_stash(const std::array& stash) { 775| 5.70k| static_assert(L >= N); 776| 5.70k| std::array val = {}; 777| 39.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 34.2k, False: 5.70k] ------------------ 778| 34.2k| val[i] = stash[i]; 779| 34.2k| } 780| 5.70k| return Self(val); 781| 5.70k| } pcurves_secp384r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm4EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1487| 204| explicit WindowedBoothMulTable(const AffinePoint& p) : m_table(varpoint_setup(p)) {} pcurves_secp384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EERKNS_16AffineCurvePointISB_EE: 1066| 1.42k| friend constexpr Self operator+(const Self& a, const AffinePoint& b) { return Self::add_mixed(a, b); } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E9add_mixedERKSC_RKNS_16AffineCurvePointISB_EE: 1091| 1.42k| constexpr static Self add_mixed(const Self& a, const AffinePoint& b) { 1092| 1.42k| return point_add_mixed(a, b, FieldElement::one()); 1093| 1.42k| } pcurves_secp384r1.cpp:_ZNK5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm4EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1489| 204| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1490| 204| const BlindedScalar bits(s, rng); 1491| | 1492| 204| const size_t scalar_bits = bits.bits(); 1493| 204| const size_t full_windows = compute_full_windows(scalar_bits + 1, WindowBits); 1494| 204| const size_t initial_shift = compute_initial_shift(scalar_bits + 1, WindowBits); 1495| | 1496| 204| BOTAN_DEBUG_ASSERT(full_windows * WindowBits + initial_shift == scalar_bits + 1); ------------------ | | 130| 204| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 204| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 204] | | ------------------ ------------------ 1497| 204| BOTAN_DEBUG_ASSERT(initial_shift > 0); ------------------ | | 130| 204| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 204| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 204] | | ------------------ ------------------ 1498| | 1499| 204| auto accum = ProjectivePoint::identity(); 1500| 204| CT::poison(accum); 1501| | 1502| 17.7k| for(size_t i = 0; i != full_windows; ++i) { ------------------ | Branch (1502:28): [True: 17.5k, False: 204] ------------------ 1503| 17.5k| const size_t idx = scalar_bits - initial_shift - WindowBits * i; 1504| | 1505| 17.5k| const size_t w_i = bits.get_window(idx); 1506| 17.5k| const auto [tidx, tneg] = booth_recode(w_i); 1507| | 1508| | // Conditional ok: loop iteration count is public 1509| 17.5k| if(i == 0) { ------------------ | Branch (1509:16): [True: 204, False: 17.3k] ------------------ 1510| 204| accum = ProjectivePoint::from_affine(m_table.ct_select(tidx)); 1511| 204| accum.conditional_assign(tneg, accum.negate()); 1512| 17.3k| } else { 1513| 17.3k| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1514| 17.3k| } 1515| | 1516| 17.5k| accum = accum.dbl_n(WindowBits); 1517| | 1518| | // Conditional ok: loop iteration count is public 1519| 17.5k| if(i <= 3) { ------------------ | Branch (1519:16): [True: 816, False: 16.7k] ------------------ 1520| 816| accum.randomize_rep(rng); 1521| 816| } 1522| 17.5k| } 1523| | 1524| | // final window (note one bit shorter than previous reads) 1525| 204| const size_t w_l = bits.get_window(0) & ((1 << WindowBits) - 1); 1526| 204| const auto [tidx, tneg] = booth_recode(w_l << 1); 1527| 204| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1528| | 1529| 204| CT::unpoison(accum); 1530| 204| return accum; 1531| 204| } pcurves_secp384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 204| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 204| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 204, Folded] | Branch (1308:33): [True: 204, False: 0] ------------------ 1309| 204| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 204| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 204| constexpr size_t n_words = C::Words; 1313| | 1314| 204| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 204| rng.randomize(maskb, MaskBytes); 1316| | 1317| 204| W mask[n_words] = {0}; 1318| 204| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 204| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 204| if constexpr(ExcessBits > 0) { 1323| 204| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 204| mask[MaskWords - 1] &= ExcessMask; 1325| 204| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 204| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 204| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 204| mask[0] |= 1; 1331| | 1332| 204| W mask_n[2 * n_words] = {0}; 1333| | 1334| 204| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 204| comba_mul(mask_n, mask, C::NW.data()); 1338| 204| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 204| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 204| m_bytes = store_be>(mask_n); 1342| 204| m_bits = C::Scalar::BITS + BlindingBits; 1343| 204| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 204| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 204| } pcurves_secp384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EE4bitsEv: 1305| 204| size_t bits() const { return m_bits; } pcurves_secp384r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm4EE20compute_full_windowsEmm: 1468| 204| static constexpr size_t compute_full_windows(size_t sb, size_t wb) { 1469| 204| if(sb % wb == 0) { ------------------ | Branch (1469:13): [True: 0, False: 204] ------------------ 1470| 0| return (sb - 1) / wb; 1471| 204| } else { 1472| 204| return sb / wb; 1473| 204| } 1474| 204| } pcurves_secp384r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm4EE21compute_initial_shiftEmm: 1476| 204| static constexpr size_t compute_initial_shift(size_t sb, size_t wb) { 1477| 204| if(sb % wb == 0) { ------------------ | Branch (1477:13): [True: 0, False: 204] ------------------ 1478| 0| return wb; 1479| 204| } else { 1480| 204| return sb - (sb / wb) * wb; 1481| 204| } 1482| 204| } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E8identityEv: 1038| 204| static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::one(), FieldElement::zero()); } pcurves_secp384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EE10get_windowEm: 1353| 17.7k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 17.7k| return read_window_bits(std::span{m_bytes}, offset); 1356| 17.7k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E5dbl_nEm: 1108| 17.5k| constexpr Self dbl_n(size_t n) const { 1109| 17.5k| if constexpr(Self::A_is_minus_3) { 1110| 17.5k| return dbl_n_a_minus_3(*this, n); 1111| | } else if constexpr(Self::A_is_zero) { 1112| | return dbl_n_a_zero(*this, n); 1113| | } else { 1114| | return dbl_n_generic(*this, A, n); 1115| | } 1116| 17.5k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4div2Ev: 302| 17.5k| Self div2() const { 303| | // The inverse of 2 modulo P is (P/2)+1; this avoids a constexpr time 304| | // general inversion, which some compilers can't handle 305| 17.5k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 306| | 307| | // We could multiply by INV_2 but there is a better way ... 308| | 309| 17.5k| std::array t = value(); 310| 17.5k| const W borrow = shift_right<1>(t); 311| | 312| | // If value was odd, add (P/2)+1 313| 17.5k| const auto mask = CT::Mask::expand(borrow).value(); 314| | 315| 17.5k| W carry = 0; 316| | 317| 122k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (317:28): [True: 105k, False: 17.5k] ------------------ 318| 105k| t[i] = word_add(t[i], INV_2[i] & mask, &carry); 319| 105k| } 320| | 321| 17.5k| return Self(t); 322| 17.5k| } pcurves_secp384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EED2Ev: 1358| 204| ~BlindedScalarBits() { 1359| 204| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 204| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 204| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE7is_zeroEv: 225| 580| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEeqERKSA_: 722| 703| constexpr CT::Choice operator==(const Self& other) const { 723| 703| return CT::is_equal(this->data(), other.data(), N).as_choice(); 724| 703| } pcurves_secp384r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS2_12Secp384r1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1275| 703| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE: 248| 204| constexpr Self correct_sign(CT::Choice even) const { 249| 204| const auto flip = (even != this->is_even()); 250| 204| return Self::choose(flip, this->negate(), *this); 251| 204| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE7is_evenEv: 240| 204| constexpr CT::Choice is_even() const { 241| 204| auto v = Rep::from_rep(m_val); 242| 204| return !CT::Choice::from_int(v[0] & 0x01); 243| 204| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_: 256| 204| static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) { 257| 204| auto r = y; 258| 204| r.conditional_assign(choice, x); 259| 204| return r; 260| 204| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 290| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 290| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 290] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 290| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 290| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 0, False: 290] ------------------ 802| 0| return {}; 803| 0| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 290| return Self::from_words(words); 807| 290| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE10from_wordsILm6EEESB_NSt3__15arrayImXT_EEE: 211| 290| static constexpr Self from_words(std::array w) { 212| 290| if constexpr(L == N) { 213| 290| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 290| } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm6EEE: 115| 290| constexpr static std::array to_rep(const std::array& x) { 116| 290| std::array z; // NOLINT(*-member-init) 117| 290| comba_mul(z.data(), x.data(), R2.data()); 118| 290| return Self::redc(z); 119| 290| } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm97EEE: 941| 1.10k| constexpr void serialize_to(std::span bytes) const { 942| 1.10k| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 1.10k| do { \ | | 52| 1.10k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 1.10k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 1.10k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 1.10k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 1.10k] | | ------------------ ------------------ 943| 1.10k| BufferStuffer pack(bytes); 944| 1.10k| pack.append(0x04); 945| 1.10k| x().serialize_to(pack.next()); 946| 1.10k| y().serialize_to(pack.next()); 947| 1.10k| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 130| 1.10k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 1.10k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 1.10k] | | ------------------ ------------------ 948| 1.10k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 290| static Self random(RandomNumberGenerator& rng) { 852| 290| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 290| std::array buf{}; 855| | 856| 290| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 290, False: 0] ------------------ 857| 290| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| | if constexpr(Self::BITS % 8 != 0) { 862| | constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| | buf[0] &= mask; 864| | } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 290| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 290, False: 0] ------------------ 868| 290| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 290, False: 0] ------------------ 869| 290| return s.value(); 870| 290| } 871| 290| } 872| 290| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 290| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE10is_nonzeroEv: 230| 290| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_secp521r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1405| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1016| 1.10k| static constexpr Self from_affine(const AffinePoint& pt) { 1017| | /* 1018| | * If the point is the identity element (x=0, y=0) then instead of 1019| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1020| | * encoding of (0, 1, 0) 1021| | * 1022| | * Which we can achieve by a conditional swap of y and z if the 1023| | * affine point is the identity. 1024| | */ 1025| | 1026| 1.10k| auto x = pt.x(); 1027| 1.10k| auto y = pt.y(); 1028| 1.10k| auto z = FieldElement::one(); 1029| | 1030| 1.10k| FieldElement::conditional_swap(pt.is_identity(), y, z); 1031| | 1032| 1.10k| return ProjectiveCurvePoint(x, y, z); 1033| 1.10k| } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 971| 2.27M| constexpr const FieldElement& x() const { return m_x; } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 976| 2.19M| constexpr const FieldElement& y() const { return m_y; } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 200| 84.6k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm9EEE: 898| 4.78M| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 410| 1.10k| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 411| 1.10k| const W mask = cond.into_bitmask(); 412| | 413| 11.0k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (413:28): [True: 9.92k, False: 1.10k] ------------------ 414| 9.92k| auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 415| 9.92k| auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 416| 9.92k| x.m_val[i] = nx; 417| 9.92k| y.m_val[i] = ny; 418| 9.92k| } 419| 1.10k| } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 928| 88.3k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 225| 443k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1056| 128k| m_x(x), m_y(y), m_z(z) {} pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1121| 4.22k| constexpr Self dbl() const { 1122| 4.22k| if constexpr(Self::A_is_minus_3) { 1123| 4.22k| return dbl_a_minus_3(*this); 1124| | } else if constexpr(Self::A_is_zero) { 1125| | return dbl_a_zero(*this); 1126| | } else { 1127| | return dbl_generic(*this, A); 1128| | } 1129| 4.22k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1172| 504k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 426| 1.10M| constexpr BOTAN_FORCE_INLINE Self square() const { 427| 1.10M| std::array z; // NOLINT(*-member-init) 428| 1.10M| comba_sqr(z.data(), this->data()); 429| 1.10M| return Self(Rep::redc(z)); 430| 1.10M| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 896| 4.89M| constexpr const W* data() const { return m_val.data(); } pcurves_secp521r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 346| 1.12M| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 347| 1.12M| std::array z; // NOLINT(*-member-init) 348| 1.12M| comba_mul(z.data(), a.data(), b.data()); 349| 1.12M| return Self(Rep::redc(z)); 350| 1.12M| } pcurves_secp521r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 281| 1.26M| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 282| 1.26M| std::array r; // NOLINT(*-member-init) 283| 1.26M| W carry = 0; 284| 12.6M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (284:28): [True: 11.3M, False: 1.26M] ------------------ 285| 11.3M| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 286| 11.3M| } 287| | 288| 1.26M| const auto mask = CT::Mask::expand(carry).value(); 289| | 290| 1.26M| carry = 0; 291| | 292| 12.6M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (292:28): [True: 11.3M, False: 1.26M] ------------------ 293| 11.3M| r[i] = word_add(r[i], P[i] & mask, &carry); 294| 11.3M| } 295| | 296| 1.26M| return Self(r); 297| 1.26M| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1162| 316k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 335| 189k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp521r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 265| 280k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 266| 280k| std::array t; // NOLINT(*-member-init) 267| | 268| 280k| W carry = 0; 269| 2.80M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (269:28): [True: 2.52M, False: 280k] ------------------ 270| 2.52M| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 271| 2.52M| } 272| | 273| 280k| std::array r; // NOLINT(*-member-init) 274| 280k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 275| 280k| return Self(r); 276| 280k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1167| 311k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 338| 4.22k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 325| 626k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 326| 626k| std::array t = value(); 327| 626k| const W carry = shift_left<1>(t); 328| | 329| 626k| std::array r; // NOLINT(*-member-init) 330| 626k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 331| 626k| return Self(r); 332| 626k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 894| 663k| constexpr const std::array& value() const { return m_val; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 341| 4.22k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp521r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1064| 1.45k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1103| 1.45k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1082| 94.7k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 395| 170k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 396| 170k| const W mask = cond.into_bitmask(); 397| | 398| 1.70M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (398:28): [True: 1.53M, False: 170k] ------------------ 399| 1.53M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 400| 1.53M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 401| 1.53M| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 402| 1.53M| } 403| 170k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEmLERKSA_: 355| 355k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 356| 355k| std::array z; // NOLINT(*-member-init) 357| 355k| comba_mul(z.data(), data(), other.data()); 358| 355k| m_val = Rep::redc(z); 359| 355k| return (*this); 360| 355k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8square_nEm: 439| 12.4k| constexpr void square_n(size_t n) { 440| 12.4k| std::array z; // NOLINT(*-member-init) 441| 752k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (441:28): [True: 740k, False: 12.4k] ------------------ 442| 740k| comba_sqr(z.data(), this->data()); 443| 740k| m_val = Rep::redc(z); 444| 740k| } 445| 12.4k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 598| 1| constexpr Self invert_vartime() const { 599| | // Conditional ok: this function is variable time 600| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (600:13): [True: 0, False: 1] ------------------ 601| 0| return Self::zero(); 602| 0| } 603| | 604| 1| auto x = Self(std::array{1}); // 1 in standard domain 605| 1| auto b = Self(this->to_words()); // *this in standard domain 606| | 607| | // First loop iteration 608| 1| Self::_invert_vartime_div2_helper(b, x); 609| | 610| 1| auto a = b.negate(); 611| | // y += x but y is zero at the outset 612| 1| auto y = x; 613| | 614| | // First half of second loop iteration 615| 1| Self::_invert_vartime_div2_helper(a, y); 616| | 617| 350| for(;;) { 618| | // Conditional ok: this function is variable time 619| 350| if(a.m_val == b.m_val) { ------------------ | Branch (619:16): [True: 1, False: 349] ------------------ 620| | // At this point it should be that a == b == 1 621| 1| auto r = y.negate(); 622| | 623| | // Convert back to Montgomery if required 624| 1| r.m_val = Rep::to_rep(r.m_val); 625| 1| return r; 626| 1| } 627| | 628| 349| auto nx = x + y; 629| | 630| | /* 631| | * Otherwise either b > a or a > b 632| | * 633| | * If b > a we want to set b to b - a 634| | * Otherwise we want to set a to a - b 635| | * 636| | * Compute r = b - a and check if it underflowed 637| | * If it did not then we are in the b > a path 638| | */ 639| 349| std::array r; // NOLINT(*-member-init) 640| 349| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 641| | 642| | // Conditional ok: this function is variable time 643| 349| if(carry == 0) { ------------------ | Branch (643:16): [True: 170, False: 179] ------------------ 644| | // b > a 645| 170| b.m_val = r; 646| 170| x = nx; 647| 170| Self::_invert_vartime_div2_helper(b, x); 648| 179| } else { 649| | // We know this can't underflow because a > b 650| 179| bigint_sub3(r.data(), a.data(), N, b.data(), N); 651| 179| a.m_val = r; 652| 179| y = nx; 653| 179| Self::_invert_vartime_div2_helper(a, y); 654| 179| } 655| 349| } 656| 1| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4zeroEv: 195| 164k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 734| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 547| 351| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 548| 351| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 549| | 550| | // Conditional ok: this function is variable time 551| 1.09k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (551:16): [True: 742, False: 351] ------------------ 552| 742| shift_right<1>(a.m_val); 553| | 554| 742| const W borrow = shift_right<1>(x.m_val); 555| | 556| | // Conditional ok: this function is variable time 557| 742| if(borrow) { ------------------ | Branch (557:16): [True: 109, False: 633] ------------------ 558| 109| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 559| 109| } 560| 742| } 561| 351| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 452| 82.1k| constexpr Self negate() const { 453| 82.1k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 454| | 455| 82.1k| std::array r; // NOLINT(*-member-init) 456| 82.1k| W carry = 0; 457| 821k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (457:28): [True: 738k, False: 82.1k] ------------------ 458| 738k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 459| 738k| } 460| | 461| 82.1k| return Self(r); 462| 82.1k| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 917| 94.9k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 3.57k| std::array stash_value() const { 760| 3.57k| static_assert(L >= N); 761| 3.57k| std::array stash = {}; 762| 35.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 32.2k, False: 3.57k] ------------------ 763| 32.2k| stash[i] = m_val[i]; 764| 32.2k| } 765| 3.57k| return stash; 766| 3.57k| } pcurves_secp521r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1407| 458| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1408| 458| const BlindedScalar scalar(s, rng); 1409| 458| return basemul_booth_exec(m_table, scalar, rng); 1410| 458| } pcurves_secp521r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 458| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 458| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 458, Folded] | Branch (1308:33): [True: 458, False: 0] ------------------ 1309| 458| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 458| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 458| constexpr size_t n_words = C::Words; 1313| | 1314| 458| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 458| rng.randomize(maskb, MaskBytes); 1316| | 1317| 458| W mask[n_words] = {0}; 1318| 458| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 458| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 458| if constexpr(ExcessBits > 0) { 1323| 458| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 458| mask[MaskWords - 1] &= ExcessMask; 1325| 458| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 458| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 458| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 458| mask[0] |= 1; 1331| | 1332| 458| W mask_n[2 * n_words] = {0}; 1333| | 1334| 458| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 458| comba_mul(mask_n, mask, C::NW.data()); 1338| 458| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 458| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 458| m_bytes = store_be>(mask_n); 1342| 458| m_bits = C::Scalar::BITS + BlindingBits; 1343| 458| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 458| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 458| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE8to_wordsEv: 734| 780| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm9EEE: 137| 1.23k| constexpr static std::array from_rep(const std::array& z) { 138| 1.23k| std::array ze = {}; 139| 1.23k| copy_mem(std::span{ze}.template first(), z); 140| 1.23k| return Self::redc(ze); 141| 1.23k| } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm18EEE: 104| 1.69k| constexpr static std::array redc(const std::array& z) { 105| | if constexpr(P_dash == 1) { 106| | return monty_redc_pdash1(z, P); 107| 1.69k| } else { 108| 1.69k| return monty_redc(z, P, P_dash); 109| 1.69k| } 110| 1.69k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm66EEE: 739| 458| constexpr void serialize_to(std::span bytes) const { 740| 458| auto v = Rep::from_rep(m_val); 741| 458| std::reverse(v.begin(), v.end()); 742| | 743| | if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| | store_be(bytes, v); 745| 458| } else { 746| | // Remove leading zero bytes 747| 458| const auto padded_bytes = store_be(v); 748| 458| constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| 458| copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| 458| } 751| 458| } pcurves_secp521r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EE4bitsEv: 1305| 458| size_t bits() const { return m_bits; } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1084| 780| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1085| 780| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1086| 780| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E6negateEv: 1134| 780| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1174| 780| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18_const_time_poisonEv: 889| 2.34k| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_secp521r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EE10get_windowEm: 1353| 44.4k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 44.4k| return read_window_bits(std::span{m_bytes}, offset); 1356| 44.4k| } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1096| 80.9k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1097| 80.9k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one()); 1098| 80.9k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 367| 81.6k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 368| 81.6k| const W mask = cond.into_bitmask(); 369| | 370| 816k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (370:28): [True: 734k, False: 81.6k] ------------------ 371| 734k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 372| 734k| } 373| 81.6k| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 955| 44.4k| static constexpr auto ct_select(std::span pts, size_t idx) { 956| 44.4k| auto result = Self::identity(pts[0]); 957| | 958| | // Intentionally wrapping; set to maximum size_t if idx == 0 959| 44.4k| const size_t idx1 = static_cast(idx - 1); 960| 1.46M| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (960:28): [True: 1.42M, False: 44.4k] ------------------ 961| 1.42M| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 962| 1.42M| result.conditional_assign(found, pts[i]); 963| 1.42M| } 964| | 965| 44.4k| return result; 966| 44.4k| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE8identityERKSC_: 924| 81.7k| static constexpr Self identity(const Self& /*unused*/) { 925| 81.7k| return Self(FieldElement::zero(), FieldElement::zero()); 926| 81.7k| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 981| 2.01M| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 982| 2.01M| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 983| 2.01M| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 380| 2.01M| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 381| 2.01M| const W mask = cond.into_bitmask(); 382| | 383| 20.1M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (383:28): [True: 18.1M, False: 2.01M] ------------------ 384| 18.1M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 385| 18.1M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 386| 18.1M| } 387| 2.01M| } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E13randomize_repERNS_21RandomNumberGeneratorE: 1142| 3.12k| void randomize_rep(RandomNumberGenerator& rng) { 1143| | // In certain contexts we may be called with a Null_RNG; in that case the 1144| | // caller is accepting that randomization will not occur 1145| | 1146| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1147| 3.12k| if(rng.is_seeded()) { ------------------ | Branch (1147:13): [True: 3.12k, False: 0] ------------------ 1148| 3.12k| auto r = FieldElement::random(rng); 1149| | 1150| 3.12k| auto r2 = r.square(); 1151| 3.12k| auto r3 = r2 * r; 1152| | 1153| 3.12k| m_x *= r2; 1154| 3.12k| m_y *= r3; 1155| 3.12k| m_z *= r; 1156| 3.12k| } 1157| 3.12k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 3.12k| static Self random(RandomNumberGenerator& rng) { 852| 3.12k| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 3.12k| std::array buf{}; 855| | 856| 3.12k| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 3.12k, False: 0] ------------------ 857| 3.12k| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| 3.12k| if constexpr(Self::BITS % 8 != 0) { 862| 3.12k| constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| 3.12k| buf[0] &= mask; 864| 3.12k| } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 3.12k| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 3.12k, False: 0] ------------------ 868| 3.12k| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 3.12k, False: 0] ------------------ 869| 3.12k| return s.value(); 870| 3.12k| } 871| 3.12k| } 872| 3.12k| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 3.12k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 4.21k| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 4.21k| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 4.21k] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 4.21k| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 4.21k| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 5, False: 4.20k] ------------------ 802| 5| return {}; 803| 5| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 4.20k| return Self::from_words(words); 807| 4.21k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_wordsILm9EEESA_NSt3__15arrayImXT_EEE: 211| 4.20k| static constexpr Self from_words(std::array w) { 212| 4.20k| if constexpr(L == N) { 213| 4.20k| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 4.20k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10is_nonzeroEv: 230| 3.12k| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1176| 780| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE20_const_time_unpoisonEv: 891| 2.34k| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_secp521r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EED2Ev: 1358| 458| ~BlindedScalarBits() { 1359| 458| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 458| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 458| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 774| 1.69k| static Self from_stash(const std::array& stash) { 775| 1.69k| static_assert(L >= N); 776| 1.69k| std::array val = {}; 777| 16.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 15.2k, False: 1.69k] ------------------ 778| 15.2k| val[i] = stash[i]; 779| 15.2k| } 780| 1.69k| return Self(val); 781| 1.69k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm9EEE: 898| 2.15k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm66EEE: 739| 3.81k| constexpr void serialize_to(std::span bytes) const { 740| 3.81k| auto v = Rep::from_rep(m_val); 741| 3.81k| std::reverse(v.begin(), v.end()); 742| | 743| | if constexpr(Self::BYTES == N * WordInfo::bytes) { 744| | store_be(bytes, v); 745| 3.81k| } else { 746| | // Remove leading zero bytes 747| 3.81k| const auto padded_bytes = store_be(v); 748| 3.81k| constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 749| 3.81k| copy_mem(bytes, std::span{padded_bytes}.template subspan()); 750| 3.81k| } 751| 3.81k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 759| 458| std::array stash_value() const { 760| 458| static_assert(L >= N); 761| 458| std::array stash = {}; 762| 4.58k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (762:28): [True: 4.12k, False: 458] ------------------ 763| 4.12k| stash[i] = m_val[i]; 764| 4.12k| } 765| 458| return stash; 766| 458| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 774| 9.00k| static Self from_stash(const std::array& stash) { 775| 9.00k| static_assert(L >= N); 776| 9.00k| std::array val = {}; 777| 90.0k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (777:28): [True: 81.0k, False: 9.00k] ------------------ 778| 81.0k| val[i] = stash[i]; 779| 81.0k| } 780| 9.00k| return Self(val); 781| 9.00k| } pcurves_secp521r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm4EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1487| 322| explicit WindowedBoothMulTable(const AffinePoint& p) : m_table(varpoint_setup(p)) {} pcurves_secp521r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EERKNS_16AffineCurvePointISB_EE: 1066| 2.25k| friend constexpr Self operator+(const Self& a, const AffinePoint& b) { return Self::add_mixed(a, b); } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E9add_mixedERKSC_RKNS_16AffineCurvePointISB_EE: 1091| 2.25k| constexpr static Self add_mixed(const Self& a, const AffinePoint& b) { 1092| 2.25k| return point_add_mixed(a, b, FieldElement::one()); 1093| 2.25k| } pcurves_secp521r1.cpp:_ZNK5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm4EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1489| 322| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1490| 322| const BlindedScalar bits(s, rng); 1491| | 1492| 322| const size_t scalar_bits = bits.bits(); 1493| 322| const size_t full_windows = compute_full_windows(scalar_bits + 1, WindowBits); 1494| 322| const size_t initial_shift = compute_initial_shift(scalar_bits + 1, WindowBits); 1495| | 1496| 322| BOTAN_DEBUG_ASSERT(full_windows * WindowBits + initial_shift == scalar_bits + 1); ------------------ | | 130| 322| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 322| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 322] | | ------------------ ------------------ 1497| 322| BOTAN_DEBUG_ASSERT(initial_shift > 0); ------------------ | | 130| 322| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 322| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 322] | | ------------------ ------------------ 1498| | 1499| 322| auto accum = ProjectivePoint::identity(); 1500| 322| CT::poison(accum); 1501| | 1502| 37.3k| for(size_t i = 0; i != full_windows; ++i) { ------------------ | Branch (1502:28): [True: 37.0k, False: 322] ------------------ 1503| 37.0k| const size_t idx = scalar_bits - initial_shift - WindowBits * i; 1504| | 1505| 37.0k| const size_t w_i = bits.get_window(idx); 1506| 37.0k| const auto [tidx, tneg] = booth_recode(w_i); 1507| | 1508| | // Conditional ok: loop iteration count is public 1509| 37.0k| if(i == 0) { ------------------ | Branch (1509:16): [True: 322, False: 36.7k] ------------------ 1510| 322| accum = ProjectivePoint::from_affine(m_table.ct_select(tidx)); 1511| 322| accum.conditional_assign(tneg, accum.negate()); 1512| 36.7k| } else { 1513| 36.7k| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1514| 36.7k| } 1515| | 1516| 37.0k| accum = accum.dbl_n(WindowBits); 1517| | 1518| | // Conditional ok: loop iteration count is public 1519| 37.0k| if(i <= 3) { ------------------ | Branch (1519:16): [True: 1.28k, False: 35.7k] ------------------ 1520| 1.28k| accum.randomize_rep(rng); 1521| 1.28k| } 1522| 37.0k| } 1523| | 1524| | // final window (note one bit shorter than previous reads) 1525| 322| const size_t w_l = bits.get_window(0) & ((1 << WindowBits) - 1); 1526| 322| const auto [tidx, tneg] = booth_recode(w_l << 1); 1527| 322| accum = ProjectivePoint::add_or_sub(accum, m_table.ct_select(tidx), tneg); 1528| | 1529| 322| CT::unpoison(accum); 1530| 322| return accum; 1531| 322| } pcurves_secp521r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEC2ERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1307| 322| BlindedScalarBits(const typename C::Scalar& scalar, RandomNumberGenerator& rng) { 1308| 322| if(BlindingBits > 0 && rng.is_seeded()) { ------------------ | Branch (1308:13): [True: 322, Folded] | Branch (1308:33): [True: 322, False: 0] ------------------ 1309| 322| constexpr size_t MaskWords = (BlindingBits + WordInfo::bits - 1) / WordInfo::bits; 1310| 322| constexpr size_t MaskBytes = MaskWords * WordInfo::bytes; 1311| | 1312| 322| constexpr size_t n_words = C::Words; 1313| | 1314| 322| uint8_t maskb[MaskBytes + (BlindingBits == 0 ? 1 : 0)] = {0}; 1315| 322| rng.randomize(maskb, MaskBytes); 1316| | 1317| 322| W mask[n_words] = {0}; 1318| 322| load_le(mask, maskb, MaskWords); 1319| | 1320| | // Mask to exactly BlindingBits 1321| 322| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1322| 322| if constexpr(ExcessBits > 0) { 1323| 322| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1324| 322| mask[MaskWords - 1] &= ExcessMask; 1325| 322| } 1326| | 1327| | // Set top and bottom bits of mask 1328| 322| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1329| 322| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1330| 322| mask[0] |= 1; 1331| | 1332| 322| W mask_n[2 * n_words] = {0}; 1333| | 1334| 322| const auto sw = scalar.to_words(); 1335| | 1336| | // Compute masked scalar s + k*n 1337| 322| comba_mul(mask_n, mask, C::NW.data()); 1338| 322| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1339| | 1340| 322| std::reverse(mask_n, mask_n + 2 * n_words); 1341| 322| m_bytes = store_be>(mask_n); 1342| 322| m_bits = C::Scalar::BITS + BlindingBits; 1343| 322| } else { 1344| | // No RNG available, skip blinding 1345| 0| m_bytes.resize(C::Scalar::BYTES); 1346| 0| scalar.serialize_to(std::span{m_bytes}.template first()); 1347| 0| m_bits = C::Scalar::BITS; 1348| 0| } 1349| | 1350| 322| CT::poison(m_bytes.data(), m_bytes.size()); 1351| 322| } pcurves_secp521r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EE4bitsEv: 1305| 322| size_t bits() const { return m_bits; } pcurves_secp521r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm4EE20compute_full_windowsEmm: 1468| 322| static constexpr size_t compute_full_windows(size_t sb, size_t wb) { 1469| 322| if(sb % wb == 0) { ------------------ | Branch (1469:13): [True: 0, False: 322] ------------------ 1470| 0| return (sb - 1) / wb; 1471| 322| } else { 1472| 322| return sb / wb; 1473| 322| } 1474| 322| } pcurves_secp521r1.cpp:_ZN5Botan21WindowedBoothMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm4EE21compute_initial_shiftEmm: 1476| 322| static constexpr size_t compute_initial_shift(size_t sb, size_t wb) { 1477| 322| if(sb % wb == 0) { ------------------ | Branch (1477:13): [True: 0, False: 322] ------------------ 1478| 0| return wb; 1479| 322| } else { 1480| 322| return sb - (sb / wb) * wb; 1481| 322| } 1482| 322| } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E8identityEv: 1038| 322| static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::one(), FieldElement::zero()); } pcurves_secp521r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EE10get_windowEm: 1353| 37.3k| size_t get_window(size_t offset) const { 1354| | // Extract a WindowBits sized window out of s, depending on offset. 1355| 37.3k| return read_window_bits(std::span{m_bytes}, offset); 1356| 37.3k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E5dbl_nEm: 1108| 37.0k| constexpr Self dbl_n(size_t n) const { 1109| 37.0k| if constexpr(Self::A_is_minus_3) { 1110| 37.0k| return dbl_n_a_minus_3(*this, n); 1111| | } else if constexpr(Self::A_is_zero) { 1112| | return dbl_n_a_zero(*this, n); 1113| | } else { 1114| | return dbl_n_generic(*this, A, n); 1115| | } 1116| 37.0k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4div2Ev: 302| 37.0k| Self div2() const { 303| | // The inverse of 2 modulo P is (P/2)+1; this avoids a constexpr time 304| | // general inversion, which some compilers can't handle 305| 37.0k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 306| | 307| | // We could multiply by INV_2 but there is a better way ... 308| | 309| 37.0k| std::array t = value(); 310| 37.0k| const W borrow = shift_right<1>(t); 311| | 312| | // If value was odd, add (P/2)+1 313| 37.0k| const auto mask = CT::Mask::expand(borrow).value(); 314| | 315| 37.0k| W carry = 0; 316| | 317| 370k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (317:28): [True: 333k, False: 37.0k] ------------------ 318| 333k| t[i] = word_add(t[i], INV_2[i] & mask, &carry); 319| 333k| } 320| | 321| 37.0k| return Self(t); 322| 37.0k| } pcurves_secp521r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EED2Ev: 1358| 322| ~BlindedScalarBits() { 1359| 322| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1360| 322| CT::unpoison(m_bytes.data(), m_bytes.size()); 1361| 322| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE7is_zeroEv: 225| 916| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEeqERKSA_: 722| 1.16k| constexpr CT::Choice operator==(const Self& other) const { 723| 1.16k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 724| 1.16k| } pcurves_secp521r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS3_7P521RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1275| 1.16k| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE: 248| 322| constexpr Self correct_sign(CT::Choice even) const { 249| 322| const auto flip = (even != this->is_even()); 250| 322| return Self::choose(flip, this->negate(), *this); 251| 322| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_evenEv: 240| 322| constexpr CT::Choice is_even() const { 241| 322| auto v = Rep::from_rep(m_val); 242| 322| return !CT::Choice::from_int(v[0] & 0x01); 243| 322| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_: 256| 322| static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) { 257| 322| auto r = y; 258| 322| r.conditional_assign(choice, x); 259| 322| return r; 260| 322| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 792| 458| static std::optional deserialize(std::span bytes) { 793| | // Conditional ok: input length is public 794| 458| if(bytes.size() != Self::BYTES) { ------------------ | Branch (794:13): [True: 0, False: 458] ------------------ 795| 0| return {}; 796| 0| } 797| | 798| 458| const auto words = bytes_to_words(bytes.first()); 799| | 800| | // Conditional acceptable: std::optional is implicitly not constant time 801| 458| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (801:13): [True: 0, False: 458] ------------------ 802| 0| return {}; 803| 0| } 804| | 805| | // Safe because we checked above that words is an integer < P 806| 458| return Self::from_words(words); 807| 458| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE10from_wordsILm9EEESB_NSt3__15arrayImXT_EEE: 211| 458| static constexpr Self from_words(std::array w) { 212| 458| if constexpr(L == N) { 213| 458| return Self(Rep::to_rep(w)); 214| | } else { 215| | static_assert(L < N); 216| | std::array ew = {}; 217| | copy_mem(std::span{ew}.template first(), w); 218| | return Self(Rep::to_rep(ew)); 219| | } 220| 458| } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm9EEE: 115| 458| constexpr static std::array to_rep(const std::array& x) { 116| 458| std::array z; // NOLINT(*-member-init) 117| 458| comba_mul(z.data(), x.data(), R2.data()); 118| 458| return Self::redc(z); 119| 458| } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm133EEE: 941| 1.74k| constexpr void serialize_to(std::span bytes) const { 942| 1.74k| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 1.74k| do { \ | | 52| 1.74k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 1.74k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 1.74k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 1.74k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 1.74k] | | ------------------ ------------------ 943| 1.74k| BufferStuffer pack(bytes); 944| 1.74k| pack.append(0x04); 945| 1.74k| x().serialize_to(pack.next()); 946| 1.74k| y().serialize_to(pack.next()); 947| 1.74k| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 130| 1.74k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 1.74k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 1.74k] | | ------------------ ------------------ 948| 1.74k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE6randomERNS_21RandomNumberGeneratorE: 851| 458| static Self random(RandomNumberGenerator& rng) { 852| 458| constexpr size_t MAX_ATTEMPTS = 1000; 853| | 854| 458| std::array buf{}; 855| | 856| 458| for(size_t i = 0; i != MAX_ATTEMPTS; ++i) { ------------------ | Branch (856:28): [True: 458, False: 0] ------------------ 857| 458| rng.randomize(buf); 858| | 859| | // Zero off high bits that if set would certainly cause us 860| | // to be out of range 861| 458| if constexpr(Self::BITS % 8 != 0) { 862| 458| constexpr uint8_t mask = 0xFF >> (8 - (Self::BITS % 8)); 863| 458| buf[0] &= mask; 864| 458| } 865| | 866| | // Conditionals ok: rejection sampling reveals only values we didn't use 867| 458| if(auto s = Self::deserialize(buf)) { ------------------ | Branch (867:21): [True: 458, False: 0] ------------------ 868| 458| if(s.value().is_nonzero().as_bool()) { ------------------ | Branch (868:19): [True: 458, False: 0] ------------------ 869| 458| return s.value(); 870| 458| } 871| 458| } 872| 458| } 873| | 874| 0| throw Internal_Error("Failed to generate random Scalar within bounded number of attempts"); 875| 458| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE10is_nonzeroEv: 230| 458| constexpr CT::Choice is_nonzero() const { return !is_zero(); } pcurves_brainpool256r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 254| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 255| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 256| | 257| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 258| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 259| | 260| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 261| | 262| 1| const size_t TableSize = Windows * WindowElements; 263| | 264| 1| std::vector table; 265| 1| table.reserve(TableSize); 266| | 267| 1| auto accum = C::ProjectivePoint::from_affine(p); 268| | 269| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (269:22): [True: 49, False: 1] ------------------ 270| 49| table.push_back(accum); 271| | 272| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (272:25): [True: 1.51k, False: 49] ------------------ 273| | // Conditional ok: loop iteration count is public 274| 1.51k| if(j % 2 == 1) { ------------------ | Branch (274:13): [True: 784, False: 735] ------------------ 275| 784| table.emplace_back(table[i + j / 2].dbl()); 276| 784| } else { 277| 735| table.emplace_back(table[i + j - 1] + table[i]); 278| 735| } 279| 1.51k| } 280| | 281| | // Advance to next window's base: 2^W * current_base 282| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 283| 49| accum = table[i + WindowElements - 1].dbl(); 284| 49| } 285| | 286| | // Variable time batch conversion is fine since generator is public 287| 1| return to_affine_batch(table); 288| 1|} pcurves_brainpool256r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorE: 308| 725| RandomNumberGenerator& rng) { 309| 725| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 310| | 311| 725| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 312| | 313| 725| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 725| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 725| const size_t raw = w_bits << 1; 317| 725| const auto [tidx, tneg] = booth_recode(raw); 318| 725| const auto tbl_0 = table.first(WindowElements); 319| | 320| 725| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 725| pt.conditional_assign(tneg, pt.negate()); 322| 725| CT::poison(pt); 323| 725| pt.randomize_rep(rng); 324| 725| return pt; 325| 725| }(); 326| | 327| 35.5k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (327:22): [True: 34.8k, False: 725] ------------------ 328| | // Extract W+1 bits overlapping by 1 with the previous window 329| 34.8k| const size_t bit_pos = WindowBits * i - 1; 330| 34.8k| const size_t raw = scalar.get_window(bit_pos); 331| 34.8k| const auto [tidx, tneg] = booth_recode(raw); 332| | 333| 34.8k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 334| | 335| 34.8k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 336| | 337| | // Conditional ok: loop iteration count is public 338| 34.8k| if(i <= 3) { ------------------ | Branch (338:10): [True: 2.17k, False: 32.6k] ------------------ 339| 2.17k| accum.randomize_rep(rng); 340| 2.17k| } 341| 34.8k| } 342| | 343| 725| CT::unpoison(accum); 344| 725| return accum; 345| 725|} pcurves_brainpool256r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorEENKUlvE_clEv: 313| 725| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 725| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 725| const size_t raw = w_bits << 1; 317| 725| const auto [tidx, tneg] = booth_recode(raw); 318| 725| const auto tbl_0 = table.first(WindowElements); 319| | 320| 725| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 725| pt.conditional_assign(tneg, pt.negate()); 322| 725| CT::poison(pt); 323| 725| pt.randomize_rep(rng); 324| 725| return pt; 325| 725| }(); _ZN5Botan12booth_recodeILm6ETkNSt3__117unsigned_integralEmEENS1_4pairImNS_2CT6ChoiceEEET0_: 294| 185k|constexpr std::pair booth_recode(T x) { 295| 185k| static_assert(WindowBits >= 1 && WindowBits <= 8); 296| | 297| 185k| auto s_mask = CT::Mask::expand(x >> WindowBits); 298| 185k| const T neg_x = (1 << (WindowBits + 1)) - x - 1; 299| 185k| T d = s_mask.select(neg_x, x); 300| 185k| d = (d >> 1) + (d & 1); 301| | 302| 185k| return std::make_pair(static_cast(d), s_mask.as_choice()); 303| 185k|} pcurves_brainpool256r1.cpp:_ZN5Botan14varpoint_setupINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm16EEENS_16AffinePointTableIT_Lm0EEERKNS6_11AffinePointE: 351| 456|AffinePointTable varpoint_setup(const typename C::AffinePoint& p) { 352| 456| static_assert(TableSize > 2); 353| | 354| 456| std::vector table; 355| 456| table.reserve(TableSize); 356| 456| table.push_back(C::ProjectivePoint::from_affine(p)); 357| | 358| 7.29k| for(size_t i = 1; i != TableSize; ++i) { ------------------ | Branch (358:22): [True: 6.84k, False: 456] ------------------ 359| | // Conditional ok: loop iteration count is public 360| 6.84k| if(i % 2 == 1) { ------------------ | Branch (360:10): [True: 3.64k, False: 3.19k] ------------------ 361| 3.64k| table.push_back(table[i / 2].dbl()); 362| 3.64k| } else { 363| 3.19k| table.push_back(table[i - 1] + p); 364| 3.19k| } 365| 6.84k| } 366| | 367| 456| return AffinePointTable(table); 368| 456|} pcurves_brainpool256r1.cpp:_ZN5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm0EEC2ENSt3__14spanIKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsESA_E11FieldParamsEEEEESC_EELm18446744073709551615EEE: 70| 456| explicit AffinePointTable(std::span pts) { 71| 456| BOTAN_ASSERT_NOMSG(pts.size() > 1); ------------------ | | 77| 456| do { \ | | 78| 456| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 456| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 456] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 456| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 456] | | ------------------ ------------------ 72| | 73| | if constexpr(R > 0) { 74| | BOTAN_ASSERT_NOMSG(pts.size() % R == 0); 75| | } 76| | 77| | // TODO scatter/gather with SIMD lookup 78| 456| m_table = to_affine_batch(pts); 79| 456| } _ZN5Botan12booth_recodeILm5ETkNSt3__117unsigned_integralEmEENS1_4pairImNS_2CT6ChoiceEEET0_: 294| 137k|constexpr std::pair booth_recode(T x) { 295| 137k| static_assert(WindowBits >= 1 && WindowBits <= 8); 296| | 297| 137k| auto s_mask = CT::Mask::expand(x >> WindowBits); 298| 137k| const T neg_x = (1 << (WindowBits + 1)) - x - 1; 299| 137k| T d = s_mask.select(neg_x, x); 300| 137k| d = (d >> 1) + (d & 1); 301| | 302| 137k| return std::make_pair(static_cast(d), s_mask.as_choice()); 303| 137k|} pcurves_brainpool256r1.cpp:_ZNK5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm0EE9ct_selectEmQL_ZNS_16AffinePointTable16WholeRangeSearchEE: 86| 26.4k| { 87| 26.4k| BOTAN_DEBUG_ASSERT(idx < m_table.size() + 1); ------------------ | | 130| 26.4k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 26.4k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 26.4k] | | ------------------ ------------------ 88| | 89| 26.4k| auto result = AffinePoint::identity(m_table[0]); 90| | 91| | // Intentionally wrapping; set to maximum size_t if idx == 0 92| 26.4k| const size_t idx1 = static_cast(idx - 1); 93| 449k| for(size_t i = 0; i != m_table.size(); ++i) { ------------------ | Branch (93:28): [True: 423k, False: 26.4k] ------------------ 94| 423k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 95| 423k| result.conditional_assign(found, m_table[i]); 96| 423k| } 97| | 98| 26.4k| return result; 99| 26.4k| } pcurves_brainpool384r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 254| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 255| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 256| | 257| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 258| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 259| | 260| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 261| | 262| 1| const size_t TableSize = Windows * WindowElements; 263| | 264| 1| std::vector table; 265| 1| table.reserve(TableSize); 266| | 267| 1| auto accum = C::ProjectivePoint::from_affine(p); 268| | 269| 74| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (269:22): [True: 73, False: 1] ------------------ 270| 73| table.push_back(accum); 271| | 272| 2.33k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (272:25): [True: 2.26k, False: 73] ------------------ 273| | // Conditional ok: loop iteration count is public 274| 2.26k| if(j % 2 == 1) { ------------------ | Branch (274:13): [True: 1.16k, False: 1.09k] ------------------ 275| 1.16k| table.emplace_back(table[i + j / 2].dbl()); 276| 1.16k| } else { 277| 1.09k| table.emplace_back(table[i + j - 1] + table[i]); 278| 1.09k| } 279| 2.26k| } 280| | 281| | // Advance to next window's base: 2^W * current_base 282| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 283| 73| accum = table[i + WindowElements - 1].dbl(); 284| 73| } 285| | 286| | // Variable time batch conversion is fine since generator is public 287| 1| return to_affine_batch(table); 288| 1|} pcurves_brainpool384r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorE: 308| 310| RandomNumberGenerator& rng) { 309| 310| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 310| | 311| 310| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 312| | 313| 310| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 310| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 310| const size_t raw = w_bits << 1; 317| 310| const auto [tidx, tneg] = booth_recode(raw); 318| 310| const auto tbl_0 = table.first(WindowElements); 319| | 320| 310| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 310| pt.conditional_assign(tneg, pt.negate()); 322| 310| CT::poison(pt); 323| 310| pt.randomize_rep(rng); 324| 310| return pt; 325| 310| }(); 326| | 327| 22.6k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (327:22): [True: 22.3k, False: 310] ------------------ 328| | // Extract W+1 bits overlapping by 1 with the previous window 329| 22.3k| const size_t bit_pos = WindowBits * i - 1; 330| 22.3k| const size_t raw = scalar.get_window(bit_pos); 331| 22.3k| const auto [tidx, tneg] = booth_recode(raw); 332| | 333| 22.3k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 334| | 335| 22.3k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 336| | 337| | // Conditional ok: loop iteration count is public 338| 22.3k| if(i <= 3) { ------------------ | Branch (338:10): [True: 930, False: 21.3k] ------------------ 339| 930| accum.randomize_rep(rng); 340| 930| } 341| 22.3k| } 342| | 343| 310| CT::unpoison(accum); 344| 310| return accum; 345| 310|} pcurves_brainpool384r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorEENKUlvE_clEv: 313| 310| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 310| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 310| const size_t raw = w_bits << 1; 317| 310| const auto [tidx, tneg] = booth_recode(raw); 318| 310| const auto tbl_0 = table.first(WindowElements); 319| | 320| 310| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 310| pt.conditional_assign(tneg, pt.negate()); 322| 310| CT::poison(pt); 323| 310| pt.randomize_rep(rng); 324| 310| return pt; 325| 310| }(); pcurves_brainpool384r1.cpp:_ZN5Botan14varpoint_setupINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm16EEENS_16AffinePointTableIT_Lm0EEERKNS6_11AffinePointE: 351| 145|AffinePointTable varpoint_setup(const typename C::AffinePoint& p) { 352| 145| static_assert(TableSize > 2); 353| | 354| 145| std::vector table; 355| 145| table.reserve(TableSize); 356| 145| table.push_back(C::ProjectivePoint::from_affine(p)); 357| | 358| 2.32k| for(size_t i = 1; i != TableSize; ++i) { ------------------ | Branch (358:22): [True: 2.17k, False: 145] ------------------ 359| | // Conditional ok: loop iteration count is public 360| 2.17k| if(i % 2 == 1) { ------------------ | Branch (360:10): [True: 1.16k, False: 1.01k] ------------------ 361| 1.16k| table.push_back(table[i / 2].dbl()); 362| 1.16k| } else { 363| 1.01k| table.push_back(table[i - 1] + p); 364| 1.01k| } 365| 2.17k| } 366| | 367| 145| return AffinePointTable(table); 368| 145|} pcurves_brainpool384r1.cpp:_ZN5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm0EEC2ENSt3__14spanIKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsESA_E11FieldParamsEEEEESC_EELm18446744073709551615EEE: 70| 145| explicit AffinePointTable(std::span pts) { 71| 145| BOTAN_ASSERT_NOMSG(pts.size() > 1); ------------------ | | 77| 145| do { \ | | 78| 145| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 145| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 145] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 145| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 145] | | ------------------ ------------------ 72| | 73| | if constexpr(R > 0) { 74| | BOTAN_ASSERT_NOMSG(pts.size() % R == 0); 75| | } 76| | 77| | // TODO scatter/gather with SIMD lookup 78| 145| m_table = to_affine_batch(pts); 79| 145| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm0EE9ct_selectEmQL_ZNS_16AffinePointTable16WholeRangeSearchEE: 86| 12.6k| { 87| 12.6k| BOTAN_DEBUG_ASSERT(idx < m_table.size() + 1); ------------------ | | 130| 12.6k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 12.6k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 12.6k] | | ------------------ ------------------ 88| | 89| 12.6k| auto result = AffinePoint::identity(m_table[0]); 90| | 91| | // Intentionally wrapping; set to maximum size_t if idx == 0 92| 12.6k| const size_t idx1 = static_cast(idx - 1); 93| 214k| for(size_t i = 0; i != m_table.size(); ++i) { ------------------ | Branch (93:28): [True: 201k, False: 12.6k] ------------------ 94| 201k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 95| 201k| result.conditional_assign(found, m_table[i]); 96| 201k| } 97| | 98| 12.6k| return result; 99| 12.6k| } pcurves_brainpool512r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 254| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 255| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 256| | 257| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 258| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 259| | 260| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 261| | 262| 1| const size_t TableSize = Windows * WindowElements; 263| | 264| 1| std::vector table; 265| 1| table.reserve(TableSize); 266| | 267| 1| auto accum = C::ProjectivePoint::from_affine(p); 268| | 269| 98| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (269:22): [True: 97, False: 1] ------------------ 270| 97| table.push_back(accum); 271| | 272| 3.10k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (272:25): [True: 3.00k, False: 97] ------------------ 273| | // Conditional ok: loop iteration count is public 274| 3.00k| if(j % 2 == 1) { ------------------ | Branch (274:13): [True: 1.55k, False: 1.45k] ------------------ 275| 1.55k| table.emplace_back(table[i + j / 2].dbl()); 276| 1.55k| } else { 277| 1.45k| table.emplace_back(table[i + j - 1] + table[i]); 278| 1.45k| } 279| 3.00k| } 280| | 281| | // Advance to next window's base: 2^W * current_base 282| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 283| 97| accum = table[i + WindowElements - 1].dbl(); 284| 97| } 285| | 286| | // Variable time batch conversion is fine since generator is public 287| 1| return to_affine_batch(table); 288| 1|} pcurves_brainpool512r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorE: 308| 436| RandomNumberGenerator& rng) { 309| 436| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 310| | 311| 436| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 312| | 313| 436| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 436| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 436| const size_t raw = w_bits << 1; 317| 436| const auto [tidx, tneg] = booth_recode(raw); 318| 436| const auto tbl_0 = table.first(WindowElements); 319| | 320| 436| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 436| pt.conditional_assign(tneg, pt.negate()); 322| 436| CT::poison(pt); 323| 436| pt.randomize_rep(rng); 324| 436| return pt; 325| 436| }(); 326| | 327| 42.2k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (327:22): [True: 41.8k, False: 436] ------------------ 328| | // Extract W+1 bits overlapping by 1 with the previous window 329| 41.8k| const size_t bit_pos = WindowBits * i - 1; 330| 41.8k| const size_t raw = scalar.get_window(bit_pos); 331| 41.8k| const auto [tidx, tneg] = booth_recode(raw); 332| | 333| 41.8k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 334| | 335| 41.8k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 336| | 337| | // Conditional ok: loop iteration count is public 338| 41.8k| if(i <= 3) { ------------------ | Branch (338:10): [True: 1.30k, False: 40.5k] ------------------ 339| 1.30k| accum.randomize_rep(rng); 340| 1.30k| } 341| 41.8k| } 342| | 343| 436| CT::unpoison(accum); 344| 436| return accum; 345| 436|} pcurves_brainpool512r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorEENKUlvE_clEv: 313| 436| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 436| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 436| const size_t raw = w_bits << 1; 317| 436| const auto [tidx, tneg] = booth_recode(raw); 318| 436| const auto tbl_0 = table.first(WindowElements); 319| | 320| 436| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 436| pt.conditional_assign(tneg, pt.negate()); 322| 436| CT::poison(pt); 323| 436| pt.randomize_rep(rng); 324| 436| return pt; 325| 436| }(); pcurves_brainpool512r1.cpp:_ZN5Botan14varpoint_setupINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm16EEENS_16AffinePointTableIT_Lm0EEERKNS6_11AffinePointE: 351| 227|AffinePointTable varpoint_setup(const typename C::AffinePoint& p) { 352| 227| static_assert(TableSize > 2); 353| | 354| 227| std::vector table; 355| 227| table.reserve(TableSize); 356| 227| table.push_back(C::ProjectivePoint::from_affine(p)); 357| | 358| 3.63k| for(size_t i = 1; i != TableSize; ++i) { ------------------ | Branch (358:22): [True: 3.40k, False: 227] ------------------ 359| | // Conditional ok: loop iteration count is public 360| 3.40k| if(i % 2 == 1) { ------------------ | Branch (360:10): [True: 1.81k, False: 1.58k] ------------------ 361| 1.81k| table.push_back(table[i / 2].dbl()); 362| 1.81k| } else { 363| 1.58k| table.push_back(table[i - 1] + p); 364| 1.58k| } 365| 3.40k| } 366| | 367| 227| return AffinePointTable(table); 368| 227|} pcurves_brainpool512r1.cpp:_ZN5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm0EEC2ENSt3__14spanIKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsESA_E11FieldParamsEEEEESC_EELm18446744073709551615EEE: 70| 227| explicit AffinePointTable(std::span pts) { 71| 227| BOTAN_ASSERT_NOMSG(pts.size() > 1); ------------------ | | 77| 227| do { \ | | 78| 227| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 227| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 227] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 227| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 227] | | ------------------ ------------------ 72| | 73| | if constexpr(R > 0) { 74| | BOTAN_ASSERT_NOMSG(pts.size() % R == 0); 75| | } 76| | 77| | // TODO scatter/gather with SIMD lookup 78| 227| m_table = to_affine_batch(pts); 79| 227| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm0EE9ct_selectEmQL_ZNS_16AffinePointTable16WholeRangeSearchEE: 86| 26.3k| { 87| 26.3k| BOTAN_DEBUG_ASSERT(idx < m_table.size() + 1); ------------------ | | 130| 26.3k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 26.3k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 26.3k] | | ------------------ ------------------ 88| | 89| 26.3k| auto result = AffinePoint::identity(m_table[0]); 90| | 91| | // Intentionally wrapping; set to maximum size_t if idx == 0 92| 26.3k| const size_t idx1 = static_cast(idx - 1); 93| 447k| for(size_t i = 0; i != m_table.size(); ++i) { ------------------ | Branch (93:28): [True: 421k, False: 26.3k] ------------------ 94| 421k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 95| 421k| result.conditional_assign(found, m_table[i]); 96| 421k| } 97| | 98| 26.3k| return result; 99| 26.3k| } pcurves_secp256r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 254| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 255| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 256| | 257| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 258| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 259| | 260| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 261| | 262| 1| const size_t TableSize = Windows * WindowElements; 263| | 264| 1| std::vector table; 265| 1| table.reserve(TableSize); 266| | 267| 1| auto accum = C::ProjectivePoint::from_affine(p); 268| | 269| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (269:22): [True: 49, False: 1] ------------------ 270| 49| table.push_back(accum); 271| | 272| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (272:25): [True: 1.51k, False: 49] ------------------ 273| | // Conditional ok: loop iteration count is public 274| 1.51k| if(j % 2 == 1) { ------------------ | Branch (274:13): [True: 784, False: 735] ------------------ 275| 784| table.emplace_back(table[i + j / 2].dbl()); 276| 784| } else { 277| 735| table.emplace_back(table[i + j - 1] + table[i]); 278| 735| } 279| 1.51k| } 280| | 281| | // Advance to next window's base: 2^W * current_base 282| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 283| 49| accum = table[i + WindowElements - 1].dbl(); 284| 49| } 285| | 286| | // Variable time batch conversion is fine since generator is public 287| 1| return to_affine_batch(table); 288| 1|} pcurves_secp256r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorE: 308| 398| RandomNumberGenerator& rng) { 309| 398| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 310| | 311| 398| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 312| | 313| 398| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 398| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 398| const size_t raw = w_bits << 1; 317| 398| const auto [tidx, tneg] = booth_recode(raw); 318| 398| const auto tbl_0 = table.first(WindowElements); 319| | 320| 398| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 398| pt.conditional_assign(tneg, pt.negate()); 322| 398| CT::poison(pt); 323| 398| pt.randomize_rep(rng); 324| 398| return pt; 325| 398| }(); 326| | 327| 19.5k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (327:22): [True: 19.1k, False: 398] ------------------ 328| | // Extract W+1 bits overlapping by 1 with the previous window 329| 19.1k| const size_t bit_pos = WindowBits * i - 1; 330| 19.1k| const size_t raw = scalar.get_window(bit_pos); 331| 19.1k| const auto [tidx, tneg] = booth_recode(raw); 332| | 333| 19.1k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 334| | 335| 19.1k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 336| | 337| | // Conditional ok: loop iteration count is public 338| 19.1k| if(i <= 3) { ------------------ | Branch (338:10): [True: 1.19k, False: 17.9k] ------------------ 339| 1.19k| accum.randomize_rep(rng); 340| 1.19k| } 341| 19.1k| } 342| | 343| 398| CT::unpoison(accum); 344| 398| return accum; 345| 398|} pcurves_secp256r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorEENKUlvE_clEv: 313| 398| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 398| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 398| const size_t raw = w_bits << 1; 317| 398| const auto [tidx, tneg] = booth_recode(raw); 318| 398| const auto tbl_0 = table.first(WindowElements); 319| | 320| 398| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 398| pt.conditional_assign(tneg, pt.negate()); 322| 398| CT::poison(pt); 323| 398| pt.randomize_rep(rng); 324| 398| return pt; 325| 398| }(); pcurves_secp256r1.cpp:_ZN5Botan14varpoint_setupINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm16EEENS_16AffinePointTableIT_Lm0EEERKNS6_11AffinePointE: 351| 285|AffinePointTable varpoint_setup(const typename C::AffinePoint& p) { 352| 285| static_assert(TableSize > 2); 353| | 354| 285| std::vector table; 355| 285| table.reserve(TableSize); 356| 285| table.push_back(C::ProjectivePoint::from_affine(p)); 357| | 358| 4.56k| for(size_t i = 1; i != TableSize; ++i) { ------------------ | Branch (358:22): [True: 4.27k, False: 285] ------------------ 359| | // Conditional ok: loop iteration count is public 360| 4.27k| if(i % 2 == 1) { ------------------ | Branch (360:10): [True: 2.28k, False: 1.99k] ------------------ 361| 2.28k| table.push_back(table[i / 2].dbl()); 362| 2.28k| } else { 363| 1.99k| table.push_back(table[i - 1] + p); 364| 1.99k| } 365| 4.27k| } 366| | 367| 285| return AffinePointTable(table); 368| 285|} pcurves_secp256r1.cpp:_ZN5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm0EEC2ENSt3__14spanIKNS_20ProjectiveCurvePointINS_6IntModINS2_12Secp256r1RepINS_13EllipticCurveINS3_6ParamsESA_E11FieldParamsEEEEESC_EELm18446744073709551615EEE: 70| 285| explicit AffinePointTable(std::span pts) { 71| 285| BOTAN_ASSERT_NOMSG(pts.size() > 1); ------------------ | | 77| 285| do { \ | | 78| 285| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 285| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 285] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 285| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 285] | | ------------------ ------------------ 72| | 73| | if constexpr(R > 0) { 74| | BOTAN_ASSERT_NOMSG(pts.size() % R == 0); 75| | } 76| | 77| | // TODO scatter/gather with SIMD lookup 78| 285| m_table = to_affine_batch(pts); 79| 285| } pcurves_secp256r1.cpp:_ZNK5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm0EE9ct_selectEmQL_ZNS_16AffinePointTable16WholeRangeSearchEE: 86| 16.5k| { 87| 16.5k| BOTAN_DEBUG_ASSERT(idx < m_table.size() + 1); ------------------ | | 130| 16.5k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 16.5k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 16.5k] | | ------------------ ------------------ 88| | 89| 16.5k| auto result = AffinePoint::identity(m_table[0]); 90| | 91| | // Intentionally wrapping; set to maximum size_t if idx == 0 92| 16.5k| const size_t idx1 = static_cast(idx - 1); 93| 281k| for(size_t i = 0; i != m_table.size(); ++i) { ------------------ | Branch (93:28): [True: 264k, False: 16.5k] ------------------ 94| 264k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 95| 264k| result.conditional_assign(found, m_table[i]); 96| 264k| } 97| | 98| 16.5k| return result; 99| 16.5k| } pcurves_secp384r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 254| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 255| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 256| | 257| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 258| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 259| | 260| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 261| | 262| 1| const size_t TableSize = Windows * WindowElements; 263| | 264| 1| std::vector table; 265| 1| table.reserve(TableSize); 266| | 267| 1| auto accum = C::ProjectivePoint::from_affine(p); 268| | 269| 74| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (269:22): [True: 73, False: 1] ------------------ 270| 73| table.push_back(accum); 271| | 272| 2.33k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (272:25): [True: 2.26k, False: 73] ------------------ 273| | // Conditional ok: loop iteration count is public 274| 2.26k| if(j % 2 == 1) { ------------------ | Branch (274:13): [True: 1.16k, False: 1.09k] ------------------ 275| 1.16k| table.emplace_back(table[i + j / 2].dbl()); 276| 1.16k| } else { 277| 1.09k| table.emplace_back(table[i + j - 1] + table[i]); 278| 1.09k| } 279| 2.26k| } 280| | 281| | // Advance to next window's base: 2^W * current_base 282| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 283| 73| accum = table[i + WindowElements - 1].dbl(); 284| 73| } 285| | 286| | // Variable time batch conversion is fine since generator is public 287| 1| return to_affine_batch(table); 288| 1|} pcurves_secp384r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorE: 308| 290| RandomNumberGenerator& rng) { 309| 290| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 310| | 311| 290| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 312| | 313| 290| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 290| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 290| const size_t raw = w_bits << 1; 317| 290| const auto [tidx, tneg] = booth_recode(raw); 318| 290| const auto tbl_0 = table.first(WindowElements); 319| | 320| 290| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 290| pt.conditional_assign(tneg, pt.negate()); 322| 290| CT::poison(pt); 323| 290| pt.randomize_rep(rng); 324| 290| return pt; 325| 290| }(); 326| | 327| 21.1k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (327:22): [True: 20.8k, False: 290] ------------------ 328| | // Extract W+1 bits overlapping by 1 with the previous window 329| 20.8k| const size_t bit_pos = WindowBits * i - 1; 330| 20.8k| const size_t raw = scalar.get_window(bit_pos); 331| 20.8k| const auto [tidx, tneg] = booth_recode(raw); 332| | 333| 20.8k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 334| | 335| 20.8k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 336| | 337| | // Conditional ok: loop iteration count is public 338| 20.8k| if(i <= 3) { ------------------ | Branch (338:10): [True: 870, False: 20.0k] ------------------ 339| 870| accum.randomize_rep(rng); 340| 870| } 341| 20.8k| } 342| | 343| 290| CT::unpoison(accum); 344| 290| return accum; 345| 290|} pcurves_secp384r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorEENKUlvE_clEv: 313| 290| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 290| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 290| const size_t raw = w_bits << 1; 317| 290| const auto [tidx, tneg] = booth_recode(raw); 318| 290| const auto tbl_0 = table.first(WindowElements); 319| | 320| 290| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 290| pt.conditional_assign(tneg, pt.negate()); 322| 290| CT::poison(pt); 323| 290| pt.randomize_rep(rng); 324| 290| return pt; 325| 290| }(); pcurves_secp384r1.cpp:_ZN5Botan14varpoint_setupINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm16EEENS_16AffinePointTableIT_Lm0EEERKNS6_11AffinePointE: 351| 204|AffinePointTable varpoint_setup(const typename C::AffinePoint& p) { 352| 204| static_assert(TableSize > 2); 353| | 354| 204| std::vector table; 355| 204| table.reserve(TableSize); 356| 204| table.push_back(C::ProjectivePoint::from_affine(p)); 357| | 358| 3.26k| for(size_t i = 1; i != TableSize; ++i) { ------------------ | Branch (358:22): [True: 3.06k, False: 204] ------------------ 359| | // Conditional ok: loop iteration count is public 360| 3.06k| if(i % 2 == 1) { ------------------ | Branch (360:10): [True: 1.63k, False: 1.42k] ------------------ 361| 1.63k| table.push_back(table[i / 2].dbl()); 362| 1.63k| } else { 363| 1.42k| table.push_back(table[i - 1] + p); 364| 1.42k| } 365| 3.06k| } 366| | 367| 204| return AffinePointTable(table); 368| 204|} pcurves_secp384r1.cpp:_ZN5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm0EEC2ENSt3__14spanIKNS_20ProjectiveCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsESA_E11FieldParamsEEEEESC_EELm18446744073709551615EEE: 70| 204| explicit AffinePointTable(std::span pts) { 71| 204| BOTAN_ASSERT_NOMSG(pts.size() > 1); ------------------ | | 77| 204| do { \ | | 78| 204| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 204| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 204] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 204| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 204] | | ------------------ ------------------ 72| | 73| | if constexpr(R > 0) { 74| | BOTAN_ASSERT_NOMSG(pts.size() % R == 0); 75| | } 76| | 77| | // TODO scatter/gather with SIMD lookup 78| 204| m_table = to_affine_batch(pts); 79| 204| } pcurves_secp384r1.cpp:_ZNK5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm0EE9ct_selectEmQL_ZNS_16AffinePointTable16WholeRangeSearchEE: 86| 17.7k| { 87| 17.7k| BOTAN_DEBUG_ASSERT(idx < m_table.size() + 1); ------------------ | | 130| 17.7k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 17.7k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 17.7k] | | ------------------ ------------------ 88| | 89| 17.7k| auto result = AffinePoint::identity(m_table[0]); 90| | 91| | // Intentionally wrapping; set to maximum size_t if idx == 0 92| 17.7k| const size_t idx1 = static_cast(idx - 1); 93| 301k| for(size_t i = 0; i != m_table.size(); ++i) { ------------------ | Branch (93:28): [True: 283k, False: 17.7k] ------------------ 94| 283k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 95| 283k| result.conditional_assign(found, m_table[i]); 96| 283k| } 97| | 98| 17.7k| return result; 99| 17.7k| } pcurves_secp521r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 254| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 255| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 256| | 257| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 258| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 259| | 260| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 261| | 262| 1| const size_t TableSize = Windows * WindowElements; 263| | 264| 1| std::vector table; 265| 1| table.reserve(TableSize); 266| | 267| 1| auto accum = C::ProjectivePoint::from_affine(p); 268| | 269| 98| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (269:22): [True: 97, False: 1] ------------------ 270| 97| table.push_back(accum); 271| | 272| 3.10k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (272:25): [True: 3.00k, False: 97] ------------------ 273| | // Conditional ok: loop iteration count is public 274| 3.00k| if(j % 2 == 1) { ------------------ | Branch (274:13): [True: 1.55k, False: 1.45k] ------------------ 275| 1.55k| table.emplace_back(table[i + j / 2].dbl()); 276| 1.55k| } else { 277| 1.45k| table.emplace_back(table[i + j - 1] + table[i]); 278| 1.45k| } 279| 3.00k| } 280| | 281| | // Advance to next window's base: 2^W * current_base 282| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 283| 97| accum = table[i + WindowElements - 1].dbl(); 284| 97| } 285| | 286| | // Variable time batch conversion is fine since generator is public 287| 1| return to_affine_batch(table); 288| 1|} pcurves_secp521r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorE: 308| 458| RandomNumberGenerator& rng) { 309| 458| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 310| | 311| 458| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 312| | 313| 458| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 458| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 458| const size_t raw = w_bits << 1; 317| 458| const auto [tidx, tneg] = booth_recode(raw); 318| 458| const auto tbl_0 = table.first(WindowElements); 319| | 320| 458| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 458| pt.conditional_assign(tneg, pt.negate()); 322| 458| CT::poison(pt); 323| 458| pt.randomize_rep(rng); 324| 458| return pt; 325| 458| }(); 326| | 327| 44.4k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (327:22): [True: 43.9k, False: 458] ------------------ 328| | // Extract W+1 bits overlapping by 1 with the previous window 329| 43.9k| const size_t bit_pos = WindowBits * i - 1; 330| 43.9k| const size_t raw = scalar.get_window(bit_pos); 331| 43.9k| const auto [tidx, tneg] = booth_recode(raw); 332| | 333| 43.9k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 334| | 335| 43.9k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 336| | 337| | // Conditional ok: loop iteration count is public 338| 43.9k| if(i <= 3) { ------------------ | Branch (338:10): [True: 1.37k, False: 42.5k] ------------------ 339| 1.37k| accum.randomize_rep(rng); 340| 1.37k| } 341| 43.9k| } 342| | 343| 458| CT::unpoison(accum); 344| 458| return accum; 345| 458|} pcurves_secp521r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEEEENT_15ProjectivePointENSt3__14spanIKNS7_11AffinePointELm18446744073709551615EEERKT1_RNS_21RandomNumberGeneratorEENKUlvE_clEv: 313| 458| auto accum = [&]() { 314| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 315| 458| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 316| 458| const size_t raw = w_bits << 1; 317| 458| const auto [tidx, tneg] = booth_recode(raw); 318| 458| const auto tbl_0 = table.first(WindowElements); 319| | 320| 458| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 321| 458| pt.conditional_assign(tneg, pt.negate()); 322| 458| CT::poison(pt); 323| 458| pt.randomize_rep(rng); 324| 458| return pt; 325| 458| }(); pcurves_secp521r1.cpp:_ZN5Botan14varpoint_setupINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm16EEENS_16AffinePointTableIT_Lm0EEERKNS6_11AffinePointE: 351| 322|AffinePointTable varpoint_setup(const typename C::AffinePoint& p) { 352| 322| static_assert(TableSize > 2); 353| | 354| 322| std::vector table; 355| 322| table.reserve(TableSize); 356| 322| table.push_back(C::ProjectivePoint::from_affine(p)); 357| | 358| 5.15k| for(size_t i = 1; i != TableSize; ++i) { ------------------ | Branch (358:22): [True: 4.83k, False: 322] ------------------ 359| | // Conditional ok: loop iteration count is public 360| 4.83k| if(i % 2 == 1) { ------------------ | Branch (360:10): [True: 2.57k, False: 2.25k] ------------------ 361| 2.57k| table.push_back(table[i / 2].dbl()); 362| 2.57k| } else { 363| 2.25k| table.push_back(table[i - 1] + p); 364| 2.25k| } 365| 4.83k| } 366| | 367| 322| return AffinePointTable(table); 368| 322|} pcurves_secp521r1.cpp:_ZN5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm0EEC2ENSt3__14spanIKNS_20ProjectiveCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsESA_E11FieldParamsEEEEESC_EELm18446744073709551615EEE: 70| 322| explicit AffinePointTable(std::span pts) { 71| 322| BOTAN_ASSERT_NOMSG(pts.size() > 1); ------------------ | | 77| 322| do { \ | | 78| 322| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 322| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 322] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 322| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 322] | | ------------------ ------------------ 72| | 73| | if constexpr(R > 0) { 74| | BOTAN_ASSERT_NOMSG(pts.size() % R == 0); 75| | } 76| | 77| | // TODO scatter/gather with SIMD lookup 78| 322| m_table = to_affine_batch(pts); 79| 322| } pcurves_secp521r1.cpp:_ZNK5Botan16AffinePointTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm0EE9ct_selectEmQL_ZNS_16AffinePointTable16WholeRangeSearchEE: 86| 37.3k| { 87| 37.3k| BOTAN_DEBUG_ASSERT(idx < m_table.size() + 1); ------------------ | | 130| 37.3k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 37.3k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 37.3k] | | ------------------ ------------------ 88| | 89| 37.3k| auto result = AffinePoint::identity(m_table[0]); 90| | 91| | // Intentionally wrapping; set to maximum size_t if idx == 0 92| 37.3k| const size_t idx1 = static_cast(idx - 1); 93| 634k| for(size_t i = 0; i != m_table.size(); ++i) { ------------------ | Branch (93:28): [True: 597k, False: 37.3k] ------------------ 94| 597k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 95| 597k| result.conditional_assign(found, m_table[i]); 96| 597k| } 97| | 98| 37.3k| return result; 99| 37.3k| } _ZN5Botan10get_uint32ITkNS_8WordTypeEmEEjPKT_m: 33| 63.0M|constexpr uint32_t get_uint32(const W xw[], size_t i) { 34| 63.0M| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 35| | 36| | if constexpr(WordInfo::bits == 32) { 37| | return xw[i]; 38| 63.0M| } else { 39| 63.0M| return static_cast(xw[i / 2] >> ((i % 2) * 32)); 40| 63.0M| } 41| 63.0M|} _ZN5Botan12SolinasAccumImLm4EEC2ERNSt3__15arrayImLm4EEE: 50| 1.52M| constexpr explicit SolinasAccum(std::array& r) : m_r(r) {} _ZN5Botan12SolinasAccumImLm4EE5accumEl: 52| 12.2M| constexpr void accum(int64_t v) { 53| 12.2M| BOTAN_DEBUG_ASSERT(m_idx < N32); ------------------ | | 130| 12.2M| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 12.2M| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 12.2M] | | ------------------ ------------------ 54| | 55| 12.2M| m_S += v; 56| 12.2M| const uint32_t r = static_cast(m_S); 57| 12.2M| m_S >>= 32; 58| | 59| | if constexpr(WordInfo::bits == 32) { 60| | m_r[m_idx] = r; 61| 12.2M| } else { 62| 12.2M| m_r[m_idx / 2] |= static_cast(r) << (32 * (m_idx % 2)); 63| 12.2M| } 64| | 65| 12.2M| m_idx += 1; 66| 12.2M| } _ZN5Botan12SolinasAccumImLm4EE11final_carryEl: 68| 1.52M| constexpr W final_carry(int64_t C) { 69| 1.52M| m_S += C; 70| 1.52M| BOTAN_DEBUG_ASSERT(m_S >= 0); ------------------ | | 130| 1.52M| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 1.52M| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 1.52M] | | ------------------ ------------------ 71| 1.52M| return static_cast(m_S); 72| 1.52M| } _ZN5Botan20solinas_correct_redcILm4ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_: 84| 1.52M|constexpr inline void solinas_correct_redc(std::array& r, const std::array& P, const std::array& C) { 85| 1.52M| W borrow = 0; 86| 7.62M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (86:22): [True: 6.10M, False: 1.52M] ------------------ 87| 6.10M| r[i] = word_sub(r[i], C[i], &borrow); 88| 6.10M| } 89| | 90| | // borrow is either 0 or 1, perfect for setting up a mask without extra work 91| 1.52M| const W mask = CT::value_barrier(0 - borrow); 92| | 93| 1.52M| W carry = 0; 94| | 95| 7.62M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (95:22): [True: 6.10M, False: 1.52M] ------------------ 96| 6.10M| r[i] = word_add(r[i], P[i] & mask, &carry); 97| 6.10M| } 98| 1.52M|} _ZN5Botan12SolinasAccumImLm6EEC2ERNSt3__15arrayImLm6EEE: 50| 1.60M| constexpr explicit SolinasAccum(std::array& r) : m_r(r) {} _ZN5Botan12SolinasAccumImLm6EE5accumEl: 52| 19.3M| constexpr void accum(int64_t v) { 53| 19.3M| BOTAN_DEBUG_ASSERT(m_idx < N32); ------------------ | | 130| 19.3M| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 19.3M| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 19.3M] | | ------------------ ------------------ 54| | 55| 19.3M| m_S += v; 56| 19.3M| const uint32_t r = static_cast(m_S); 57| 19.3M| m_S >>= 32; 58| | 59| | if constexpr(WordInfo::bits == 32) { 60| | m_r[m_idx] = r; 61| 19.3M| } else { 62| 19.3M| m_r[m_idx / 2] |= static_cast(r) << (32 * (m_idx % 2)); 63| 19.3M| } 64| | 65| 19.3M| m_idx += 1; 66| 19.3M| } _ZN5Botan12SolinasAccumImLm6EE11final_carryEl: 68| 1.60M| constexpr W final_carry(int64_t C) { 69| 1.60M| m_S += C; 70| 1.60M| BOTAN_DEBUG_ASSERT(m_S >= 0); ------------------ | | 130| 1.60M| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 1.60M| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 1.60M] | | ------------------ ------------------ 71| 1.60M| return static_cast(m_S); 72| 1.60M| } _ZN5Botan20solinas_correct_redcILm6ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_: 84| 1.60M|constexpr inline void solinas_correct_redc(std::array& r, const std::array& P, const std::array& C) { 85| 1.60M| W borrow = 0; 86| 11.2M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (86:22): [True: 9.65M, False: 1.60M] ------------------ 87| 9.65M| r[i] = word_sub(r[i], C[i], &borrow); 88| 9.65M| } 89| | 90| | // borrow is either 0 or 1, perfect for setting up a mask without extra work 91| 1.60M| const W mask = CT::value_barrier(0 - borrow); 92| | 93| 1.60M| W carry = 0; 94| | 95| 11.2M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (95:22): [True: 9.65M, False: 1.60M] ------------------ 96| 9.65M| r[i] = word_add(r[i], P[i] & mask, &carry); 97| 9.65M| } 98| 1.60M|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm4EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 2.67M| -> std::array { 111| 2.67M| static_assert(N >= 1); 112| | 113| 2.67M| std::array ws; // NOLINT(*-member-init) 114| 2.67M| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 2.67M| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 2.67M, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| 2.67M| if constexpr(N == 4) { 120| 2.67M| bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| 2.67M| return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 2.67M| } 136| | 137| 0| word3 accum; 138| | 139| 2.67M| accum.add(z[0]); 140| | 141| 2.67M| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 2.67M| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 2.67M] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 2.67M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 2.67M] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 2.67M| accum.add(z[2 * N - 1]); 164| | 165| 2.67M| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 2.67M| const W w1 = accum.extract(); 168| | 169| 2.67M| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 2.67M| return r; 172| 2.67M|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm4ELm32EEEDaNSt3__14spanIKhXT1_EEE: 287| 32.5k|inline constexpr auto bytes_to_words(std::span bytes) { 288| 32.5k| static_assert(L <= WordInfo::bytes * N); 289| | 290| 32.5k| std::array r = {}; 291| | 292| 32.5k| constexpr size_t full_words = L / WordInfo::bytes; 293| 32.5k| constexpr size_t extra_bytes = L % WordInfo::bytes; 294| | 295| 32.5k| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 296| | 297| 162k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (297:22): [True: 130k, False: 32.5k] ------------------ 298| 130k| r[i] = load_be(bytes.data(), full_words - 1 - i); 299| 130k| } 300| | 301| | if constexpr(extra_bytes > 0) { 302| | constexpr size_t shift = extra_bytes * 8; 303| | shift_left(r); 304| | 305| | for(size_t i = 0; i != extra_bytes; ++i) { 306| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 307| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 308| | } 309| | } 310| | 311| 32.5k| return r; 312| 32.5k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm8ELm64EEEDaNSt3__14spanIKhXT1_EEE: 287| 5.56k|inline constexpr auto bytes_to_words(std::span bytes) { 288| 5.56k| static_assert(L <= WordInfo::bytes * N); 289| | 290| 5.56k| std::array r = {}; 291| | 292| 5.56k| constexpr size_t full_words = L / WordInfo::bytes; 293| 5.56k| constexpr size_t extra_bytes = L % WordInfo::bytes; 294| | 295| 5.56k| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 296| | 297| 50.0k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (297:22): [True: 44.5k, False: 5.56k] ------------------ 298| 44.5k| r[i] = load_be(bytes.data(), full_words - 1 - i); 299| 44.5k| } 300| | 301| | if constexpr(extra_bytes > 0) { 302| | constexpr size_t shift = extra_bytes * 8; 303| | shift_left(r); 304| | 305| | for(size_t i = 0; i != extra_bytes; ++i) { 306| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 307| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 308| | } 309| | } 310| | 311| 5.56k| return r; 312| 5.56k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm6EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 1.39M| -> std::array { 111| 1.39M| static_assert(N >= 1); 112| | 113| 1.39M| std::array ws; // NOLINT(*-member-init) 114| 1.39M| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 1.39M| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 1.39M, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| 1.39M| } else if constexpr(N == 6) { 123| 1.39M| bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| 1.39M| return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 1.39M| } 136| | 137| 0| word3 accum; 138| | 139| 1.39M| accum.add(z[0]); 140| | 141| 1.39M| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 1.39M| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 1.39M] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 1.39M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 1.39M] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 1.39M| accum.add(z[2 * N - 1]); 164| | 165| 1.39M| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 1.39M| const W w1 = accum.extract(); 168| | 169| 1.39M| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 1.39M| return r; 172| 1.39M|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm6ELm48EEEDaNSt3__14spanIKhXT1_EEE: 287| 7.31k|inline constexpr auto bytes_to_words(std::span bytes) { 288| 7.31k| static_assert(L <= WordInfo::bytes * N); 289| | 290| 7.31k| std::array r = {}; 291| | 292| 7.31k| constexpr size_t full_words = L / WordInfo::bytes; 293| 7.31k| constexpr size_t extra_bytes = L % WordInfo::bytes; 294| | 295| 7.31k| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 296| | 297| 51.2k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (297:22): [True: 43.8k, False: 7.31k] ------------------ 298| 43.8k| r[i] = load_be(bytes.data(), full_words - 1 - i); 299| 43.8k| } 300| | 301| | if constexpr(extra_bytes > 0) { 302| | constexpr size_t shift = extra_bytes * 8; 303| | shift_left(r); 304| | 305| | for(size_t i = 0; i != extra_bytes; ++i) { 306| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 307| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 308| | } 309| | } 310| | 311| 7.31k| return r; 312| 7.31k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm8EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 2.74M| -> std::array { 111| 2.74M| static_assert(N >= 1); 112| | 113| 2.74M| std::array ws; // NOLINT(*-member-init) 114| 2.74M| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 2.74M| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 2.74M, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| 2.74M| } else if constexpr(N == 8) { 126| 2.74M| bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| 2.74M| return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 2.74M| } 136| | 137| 0| word3 accum; 138| | 139| 2.74M| accum.add(z[0]); 140| | 141| 2.74M| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 2.74M| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 2.74M] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 2.74M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 2.74M] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 2.74M| accum.add(z[2 * N - 1]); 164| | 165| 2.74M| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 2.74M| const W w1 = accum.extract(); 168| | 169| 2.74M| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 2.74M| return r; 172| 2.74M|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm9EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 1.69k| -> std::array { 111| 1.69k| static_assert(N >= 1); 112| | 113| 1.69k| std::array ws; // NOLINT(*-member-init) 114| 1.69k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 1.69k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 1.69k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| 1.69k| } else if constexpr(N == 16) { 132| 1.69k| bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| 1.69k| return r; 134| 1.69k| } 135| 1.69k| } 136| | 137| 1.69k| word3 accum; 138| | 139| 1.69k| accum.add(z[0]); 140| | 141| 1.69k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 15.2k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 13.5k, False: 1.69k] ------------------ 144| 74.6k| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 61.0k, False: 13.5k] ------------------ 145| 61.0k| accum.mul(ws[j], p[i - j]); 146| 61.0k| } 147| | 148| 13.5k| accum.add(z[i]); 149| | 150| 13.5k| ws[i] = accum.monty_step(p[0], p_dash); 151| 13.5k| } 152| | 153| 15.2k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 13.5k, False: 1.69k] ------------------ 154| 74.6k| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 61.0k, False: 13.5k] ------------------ 155| 61.0k| accum.mul(ws[j], p[N + i - j]); 156| 61.0k| } 157| | 158| 13.5k| accum.add(z[N + i]); 159| | 160| 13.5k| ws[i] = accum.extract(); 161| 13.5k| } 162| | 163| 1.69k| accum.add(z[2 * N - 1]); 164| | 165| 1.69k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 1.69k| const W w1 = accum.extract(); 168| | 169| 1.69k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 1.69k| return r; 172| 1.69k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm9ELm66EEEDaNSt3__14spanIKhXT1_EEE: 287| 4.66k|inline constexpr auto bytes_to_words(std::span bytes) { 288| 4.66k| static_assert(L <= WordInfo::bytes * N); 289| | 290| 4.66k| std::array r = {}; 291| | 292| 4.66k| constexpr size_t full_words = L / WordInfo::bytes; 293| 4.66k| constexpr size_t extra_bytes = L % WordInfo::bytes; 294| | 295| 4.66k| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 296| | 297| 42.0k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (297:22): [True: 37.3k, False: 4.66k] ------------------ 298| 37.3k| r[i] = load_be(bytes.data(), full_words - 1 - i); 299| 37.3k| } 300| | 301| 4.66k| if constexpr(extra_bytes > 0) { 302| 4.66k| constexpr size_t shift = extra_bytes * 8; 303| 4.66k| shift_left(r); 304| | 305| 14.0k| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (305:25): [True: 9.33k, False: 4.66k] ------------------ 306| 9.33k| const W b0 = bytes[WordInfo::bytes * full_words + i]; 307| 9.33k| r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 308| 9.33k| } 309| 4.66k| } 310| | 311| 4.66k| return r; 312| 4.66k|} pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE8instanceEv: 344| 11.9k| static std::shared_ptr instance() { 345| 11.9k| static auto g_curve = std::make_shared>(); 346| 11.9k| return g_curve; 347| 11.9k| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEEC2Ev: 342| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE19field_element_bytesEv: 36| 6.10k| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 725| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 725| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 725| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 376| 725| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 377| 725| auto x_w = pt.x().template stash_value(); 378| 725| auto y_w = pt.y().template stash_value(); 379| 725| auto z_w = pt.z().template stash_value(); 380| 725| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 381| 725| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 354| 2.63k| static typename C::Scalar from_stash(const Scalar& s) { 355| 2.63k| if(s._curve() != instance()) { ------------------ | Branch (355:13): [True: 0, False: 2.63k] ------------------ 356| 0| throw Invalid_Argument("Curve mismatch"); 357| 0| } 358| 2.63k| return C::Scalar::from_stash(s._value()); 359| 2.63k| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 350| 725| static Scalar stash(const typename C::Scalar& s) { 351| 725| return Scalar::_create(instance(), s.template stash_value()); 352| 725| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 367| 5.55k| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 368| 5.55k| if(pt._curve() != instance()) { ------------------ | Branch (368:13): [True: 0, False: 5.55k] ------------------ 369| 0| throw Invalid_Argument("Curve mismatch"); 370| 0| } 371| 5.55k| auto x = C::FieldElement::from_stash(pt._x()); 372| 5.55k| auto y = C::FieldElement::from_stash(pt._y()); 373| 5.55k| return typename C::AffinePoint(x, y); 374| 5.55k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10mul_x_onlyERKNS0_15PrimeOrderCurve11AffinePointERKNS6_6ScalarERNS_21RandomNumberGeneratorE: 49| 456| RandomNumberGenerator& rng) const override { 50| 456| auto tbl = WindowedBoothMulTable(from_stash(pt)); 51| 456| auto result = tbl.mul(from_stash(scalar), rng); 52| 456| BOTAN_STATE_CHECK(!result.is_identity().as_bool()); ------------------ | | 51| 456| do { \ | | 52| 456| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 456| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 456] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 456| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 456] | | ------------------ ------------------ 53| 456| auto pt_x = to_affine_x(result); 54| 456| secure_vector x_bytes(C::FieldElement::BYTES); 55| 456| pt_x.serialize_to(std::span{x_bytes}); 56| 456| return x_bytes; 57| 456| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 361| 1.63k| static AffinePoint stash(const typename C::AffinePoint& pt) { 362| 1.63k| auto x_w = pt.x().template stash_value(); 363| 1.63k| auto y_w = pt.y().template stash_value(); 364| 1.63k| return AffinePoint::_create(instance(), x_w, y_w); 365| 1.63k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 244| 535| std::optional deserialize_point_uncompressed(std::span bytes) const override { 245| 535| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 246| 535| constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1; 247| | 248| 535| if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) { ------------------ | Branch (248:13): [True: 535, False: 0] | Branch (248:50): [True: 535, False: 0] ------------------ 249| 535| const auto encoded_point = bytes.subspan(1); 250| 535| auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes)); 251| 535| auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes)); 252| | 253| 535| if(x && y) { ------------------ | Branch (253:16): [True: 534, False: 1] | Branch (253:21): [True: 531, False: 3] ------------------ 254| | // Check that y^2 = x^3 + ax + b 255| 531| const auto lhs = (*y).square(); 256| 531| const auto rhs = C::x3_ax_b(*x); 257| 531| const auto valid = (lhs == rhs); 258| 531| if(valid.as_bool()) { ------------------ | Branch (258:19): [True: 456, False: 75] ------------------ 259| 456| return stash(typename C::AffinePoint(*x, *y)); 260| 456| } 261| 531| } 262| 535| } 263| | 264| 79| return {}; 265| 535| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE28deserialize_point_compressedENSt3__14spanIKhLm18446744073709551615EEE: 267| 523| std::optional deserialize_point_compressed(std::span bytes) const override { 268| 523| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 269| 523| constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1; 270| | 271| 523| if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) { ------------------ | Branch (271:13): [True: 523, False: 0] | Branch (271:49): [True: 189, False: 334] | Branch (271:69): [True: 334, False: 0] ------------------ 272| 523| const CT::Choice y_is_even = CT::Mask::is_equal(bytes[0], 0x02).as_choice(); 273| | 274| 523| if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) { ------------------ | Branch (274:21): [True: 522, False: 1] ------------------ 275| 522| if(auto y = sqrt_field_element(C::x3_ax_b(*x)).as_optional_vartime()) { ------------------ | Branch (275:24): [True: 456, False: 66] ------------------ 276| 456| return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even))); 277| 456| } 278| 522| } 279| 523| } 280| | 281| 67| return {}; 282| 523| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 192| 725| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 193| 725| auto affine = to_affine(from_stash(pt)); 194| | 195| 725| const auto y2 = affine.y().square(); 196| 725| const auto x3_ax_b = C::x3_ax_b(affine.x()); 197| 725| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 198| | 199| 725| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 64| 725| do { \ | | 65| 725| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 725| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 725] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 725| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 725] | | ------------------ ------------------ 200| | 201| 725| return stash(affine); 202| 725| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 383| 725| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 384| 725| if(pt._curve() != instance()) { ------------------ | Branch (384:13): [True: 0, False: 725] ------------------ 385| 0| throw Invalid_Argument("Curve mismatch"); 386| 0| } 387| 725| auto x = C::FieldElement::from_stash(pt._x()); 388| 725| auto y = C::FieldElement::from_stash(pt._y()); 389| 725| auto z = C::FieldElement::from_stash(pt._z()); 390| 725| return typename C::ProjectivePoint(x, y, z); 391| 725| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 210| 2.54k| bool affine_point_is_identity(const AffinePoint& pt) const override { 211| 2.54k| return from_stash(pt).is_identity().as_bool(); 212| 2.54k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 214| 2.54k| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 215| 2.54k| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 2.54k| do { \ | | 36| 2.54k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 2.54k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 2.54k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 2.54k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 2.54k] | | ------------------ ------------------ 216| 2.54k| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 217| 2.54k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 219| 725| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 220| 725| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 725| do { \ | | 36| 725| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 725| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 725] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 725| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 725] | | ------------------ ------------------ 221| 725| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 222| 725| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 332| 725| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE13random_scalarERNS_21RandomNumberGeneratorE: 340| 725| Scalar random_scalar(RandomNumberGenerator& rng) const override { return stash(C::Scalar::random(rng)); } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE8instanceEv: 344| 4.53k| static std::shared_ptr instance() { 345| 4.53k| static auto g_curve = std::make_shared>(); 346| 4.53k| return g_curve; 347| 4.53k| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEEC2Ev: 342| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE19field_element_bytesEv: 36| 2.27k| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 310| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 310| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 310| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 376| 310| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 377| 310| auto x_w = pt.x().template stash_value(); 378| 310| auto y_w = pt.y().template stash_value(); 379| 310| auto z_w = pt.z().template stash_value(); 380| 310| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 381| 310| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 354| 1.07k| static typename C::Scalar from_stash(const Scalar& s) { 355| 1.07k| if(s._curve() != instance()) { ------------------ | Branch (355:13): [True: 0, False: 1.07k] ------------------ 356| 0| throw Invalid_Argument("Curve mismatch"); 357| 0| } 358| 1.07k| return C::Scalar::from_stash(s._value()); 359| 1.07k| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 350| 310| static Scalar stash(const typename C::Scalar& s) { 351| 310| return Scalar::_create(instance(), s.template stash_value()); 352| 310| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 367| 1.92k| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 368| 1.92k| if(pt._curve() != instance()) { ------------------ | Branch (368:13): [True: 0, False: 1.92k] ------------------ 369| 0| throw Invalid_Argument("Curve mismatch"); 370| 0| } 371| 1.92k| auto x = C::FieldElement::from_stash(pt._x()); 372| 1.92k| auto y = C::FieldElement::from_stash(pt._y()); 373| 1.92k| return typename C::AffinePoint(x, y); 374| 1.92k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10mul_x_onlyERKNS0_15PrimeOrderCurve11AffinePointERKNS6_6ScalarERNS_21RandomNumberGeneratorE: 49| 145| RandomNumberGenerator& rng) const override { 50| 145| auto tbl = WindowedBoothMulTable(from_stash(pt)); 51| 145| auto result = tbl.mul(from_stash(scalar), rng); 52| 145| BOTAN_STATE_CHECK(!result.is_identity().as_bool()); ------------------ | | 51| 145| do { \ | | 52| 145| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 145| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 145] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 145| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 145] | | ------------------ ------------------ 53| 145| auto pt_x = to_affine_x(result); 54| 145| secure_vector x_bytes(C::FieldElement::BYTES); 55| 145| pt_x.serialize_to(std::span{x_bytes}); 56| 145| return x_bytes; 57| 145| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 361| 600| static AffinePoint stash(const typename C::AffinePoint& pt) { 362| 600| auto x_w = pt.x().template stash_value(); 363| 600| auto y_w = pt.y().template stash_value(); 364| 600| return AffinePoint::_create(instance(), x_w, y_w); 365| 600| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 244| 152| std::optional deserialize_point_uncompressed(std::span bytes) const override { 245| 152| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 246| 152| constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1; 247| | 248| 152| if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) { ------------------ | Branch (248:13): [True: 152, False: 0] | Branch (248:50): [True: 152, False: 0] ------------------ 249| 152| const auto encoded_point = bytes.subspan(1); 250| 152| auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes)); 251| 152| auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes)); 252| | 253| 152| if(x && y) { ------------------ | Branch (253:16): [True: 150, False: 2] | Branch (253:21): [True: 149, False: 1] ------------------ 254| | // Check that y^2 = x^3 + ax + b 255| 149| const auto lhs = (*y).square(); 256| 149| const auto rhs = C::x3_ax_b(*x); 257| 149| const auto valid = (lhs == rhs); 258| 149| if(valid.as_bool()) { ------------------ | Branch (258:19): [True: 145, False: 4] ------------------ 259| 145| return stash(typename C::AffinePoint(*x, *y)); 260| 145| } 261| 149| } 262| 152| } 263| | 264| 7| return {}; 265| 152| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE28deserialize_point_compressedENSt3__14spanIKhLm18446744073709551615EEE: 267| 203| std::optional deserialize_point_compressed(std::span bytes) const override { 268| 203| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 269| 203| constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1; 270| | 271| 203| if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) { ------------------ | Branch (271:13): [True: 203, False: 0] | Branch (271:49): [True: 194, False: 9] | Branch (271:69): [True: 9, False: 0] ------------------ 272| 203| const CT::Choice y_is_even = CT::Mask::is_equal(bytes[0], 0x02).as_choice(); 273| | 274| 203| if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) { ------------------ | Branch (274:21): [True: 201, False: 2] ------------------ 275| 201| if(auto y = sqrt_field_element(C::x3_ax_b(*x)).as_optional_vartime()) { ------------------ | Branch (275:24): [True: 145, False: 56] ------------------ 276| 145| return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even))); 277| 145| } 278| 201| } 279| 203| } 280| | 281| 58| return {}; 282| 203| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 192| 310| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 193| 310| auto affine = to_affine(from_stash(pt)); 194| | 195| 310| const auto y2 = affine.y().square(); 196| 310| const auto x3_ax_b = C::x3_ax_b(affine.x()); 197| 310| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 198| | 199| 310| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 64| 310| do { \ | | 65| 310| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 310| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 310] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 310| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 310] | | ------------------ ------------------ 200| | 201| 310| return stash(affine); 202| 310| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 383| 310| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 384| 310| if(pt._curve() != instance()) { ------------------ | Branch (384:13): [True: 0, False: 310] ------------------ 385| 0| throw Invalid_Argument("Curve mismatch"); 386| 0| } 387| 310| auto x = C::FieldElement::from_stash(pt._x()); 388| 310| auto y = C::FieldElement::from_stash(pt._y()); 389| 310| auto z = C::FieldElement::from_stash(pt._z()); 390| 310| return typename C::ProjectivePoint(x, y, z); 391| 310| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 210| 890| bool affine_point_is_identity(const AffinePoint& pt) const override { 211| 890| return from_stash(pt).is_identity().as_bool(); 212| 890| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 214| 890| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 215| 890| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 890| do { \ | | 36| 890| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 890| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 890] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 890| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 890] | | ------------------ ------------------ 216| 890| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 217| 890| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 219| 310| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 220| 310| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 310| do { \ | | 36| 310| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 310| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 310] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 310| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 310] | | ------------------ ------------------ 221| 310| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 222| 310| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 332| 310| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE13random_scalarERNS_21RandomNumberGeneratorE: 340| 310| Scalar random_scalar(RandomNumberGenerator& rng) const override { return stash(C::Scalar::random(rng)); } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE8instanceEv: 344| 6.64k| static std::shared_ptr instance() { 345| 6.64k| static auto g_curve = std::make_shared>(); 346| 6.64k| return g_curve; 347| 6.64k| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEEC2Ev: 342| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE19field_element_bytesEv: 36| 3.33k| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 436| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 436| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 436| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 376| 436| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 377| 436| auto x_w = pt.x().template stash_value(); 378| 436| auto y_w = pt.y().template stash_value(); 379| 436| auto z_w = pt.z().template stash_value(); 380| 436| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 381| 436| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 354| 1.53k| static typename C::Scalar from_stash(const Scalar& s) { 355| 1.53k| if(s._curve() != instance()) { ------------------ | Branch (355:13): [True: 0, False: 1.53k] ------------------ 356| 0| throw Invalid_Argument("Curve mismatch"); 357| 0| } 358| 1.53k| return C::Scalar::from_stash(s._value()); 359| 1.53k| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 350| 436| static Scalar stash(const typename C::Scalar& s) { 351| 436| return Scalar::_create(instance(), s.template stash_value()); 352| 436| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 367| 2.91k| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 368| 2.91k| if(pt._curve() != instance()) { ------------------ | Branch (368:13): [True: 0, False: 2.91k] ------------------ 369| 0| throw Invalid_Argument("Curve mismatch"); 370| 0| } 371| 2.91k| auto x = C::FieldElement::from_stash(pt._x()); 372| 2.91k| auto y = C::FieldElement::from_stash(pt._y()); 373| 2.91k| return typename C::AffinePoint(x, y); 374| 2.91k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10mul_x_onlyERKNS0_15PrimeOrderCurve11AffinePointERKNS6_6ScalarERNS_21RandomNumberGeneratorE: 49| 227| RandomNumberGenerator& rng) const override { 50| 227| auto tbl = WindowedBoothMulTable(from_stash(pt)); 51| 227| auto result = tbl.mul(from_stash(scalar), rng); 52| 227| BOTAN_STATE_CHECK(!result.is_identity().as_bool()); ------------------ | | 51| 227| do { \ | | 52| 227| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 227| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 227] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 227| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 227] | | ------------------ ------------------ 53| 227| auto pt_x = to_affine_x(result); 54| 227| secure_vector x_bytes(C::FieldElement::BYTES); 55| 227| pt_x.serialize_to(std::span{x_bytes}); 56| 227| return x_bytes; 57| 227| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 361| 890| static AffinePoint stash(const typename C::AffinePoint& pt) { 362| 890| auto x_w = pt.x().template stash_value(); 363| 890| auto y_w = pt.y().template stash_value(); 364| 890| return AffinePoint::_create(instance(), x_w, y_w); 365| 890| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 244| 303| std::optional deserialize_point_uncompressed(std::span bytes) const override { 245| 303| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 246| 303| constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1; 247| | 248| 303| if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) { ------------------ | Branch (248:13): [True: 303, False: 0] | Branch (248:50): [True: 303, False: 0] ------------------ 249| 303| const auto encoded_point = bytes.subspan(1); 250| 303| auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes)); 251| 303| auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes)); 252| | 253| 303| if(x && y) { ------------------ | Branch (253:16): [True: 302, False: 1] | Branch (253:21): [True: 297, False: 5] ------------------ 254| | // Check that y^2 = x^3 + ax + b 255| 297| const auto lhs = (*y).square(); 256| 297| const auto rhs = C::x3_ax_b(*x); 257| 297| const auto valid = (lhs == rhs); 258| 297| if(valid.as_bool()) { ------------------ | Branch (258:19): [True: 227, False: 70] ------------------ 259| 227| return stash(typename C::AffinePoint(*x, *y)); 260| 227| } 261| 297| } 262| 303| } 263| | 264| 76| return {}; 265| 303| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE28deserialize_point_compressedENSt3__14spanIKhLm18446744073709551615EEE: 267| 281| std::optional deserialize_point_compressed(std::span bytes) const override { 268| 281| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 269| 281| constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1; 270| | 271| 281| if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) { ------------------ | Branch (271:13): [True: 281, False: 0] | Branch (271:49): [True: 277, False: 4] | Branch (271:69): [True: 4, False: 0] ------------------ 272| 281| const CT::Choice y_is_even = CT::Mask::is_equal(bytes[0], 0x02).as_choice(); 273| | 274| 281| if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) { ------------------ | Branch (274:21): [True: 280, False: 1] ------------------ 275| 280| if(auto y = sqrt_field_element(C::x3_ax_b(*x)).as_optional_vartime()) { ------------------ | Branch (275:24): [True: 227, False: 53] ------------------ 276| 227| return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even))); 277| 227| } 278| 280| } 279| 281| } 280| | 281| 54| return {}; 282| 281| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 192| 436| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 193| 436| auto affine = to_affine(from_stash(pt)); 194| | 195| 436| const auto y2 = affine.y().square(); 196| 436| const auto x3_ax_b = C::x3_ax_b(affine.x()); 197| 436| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 198| | 199| 436| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 64| 436| do { \ | | 65| 436| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 436| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 436] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 436| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 436] | | ------------------ ------------------ 200| | 201| 436| return stash(affine); 202| 436| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 383| 436| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 384| 436| if(pt._curve() != instance()) { ------------------ | Branch (384:13): [True: 0, False: 436] ------------------ 385| 0| throw Invalid_Argument("Curve mismatch"); 386| 0| } 387| 436| auto x = C::FieldElement::from_stash(pt._x()); 388| 436| auto y = C::FieldElement::from_stash(pt._y()); 389| 436| auto z = C::FieldElement::from_stash(pt._z()); 390| 436| return typename C::ProjectivePoint(x, y, z); 391| 436| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 210| 1.34k| bool affine_point_is_identity(const AffinePoint& pt) const override { 211| 1.34k| return from_stash(pt).is_identity().as_bool(); 212| 1.34k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 214| 1.34k| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 215| 1.34k| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 1.34k| do { \ | | 36| 1.34k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.34k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.34k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.34k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.34k] | | ------------------ ------------------ 216| 1.34k| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 217| 1.34k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 219| 436| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 220| 436| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 436| do { \ | | 36| 436| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 436| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 436] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 436| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 436] | | ------------------ ------------------ 221| 436| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 222| 436| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 332| 436| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE13random_scalarERNS_21RandomNumberGeneratorE: 340| 436| Scalar random_scalar(RandomNumberGenerator& rng) const override { return stash(C::Scalar::random(rng)); } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE8instanceEv: 344| 44.4k| static std::shared_ptr instance() { 345| 44.4k| static auto g_curve = std::make_shared>(); 346| 44.4k| return g_curve; 347| 44.4k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEEC2Ev: 342| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE19field_element_bytesEv: 36| 16.0k| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 398| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 398| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 398| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS2_12Secp256r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 376| 398| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 377| 398| auto x_w = pt.x().template stash_value(); 378| 398| auto y_w = pt.y().template stash_value(); 379| 398| auto z_w = pt.z().template stash_value(); 380| 398| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 381| 398| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 354| 13.9k| static typename C::Scalar from_stash(const Scalar& s) { 355| 13.9k| if(s._curve() != instance()) { ------------------ | Branch (355:13): [True: 0, False: 13.9k] ------------------ 356| 0| throw Invalid_Argument("Curve mismatch"); 357| 0| } 358| 13.9k| return C::Scalar::from_stash(s._value()); 359| 13.9k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp256r1RepEE12ScalarParamsEEEEE: 350| 6.64k| static Scalar stash(const typename C::Scalar& s) { 351| 6.64k| return Scalar::_create(instance(), s.template stash_value()); 352| 6.64k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 367| 15.8k| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 368| 15.8k| if(pt._curve() != instance()) { ------------------ | Branch (368:13): [True: 0, False: 15.8k] ------------------ 369| 0| throw Invalid_Argument("Curve mismatch"); 370| 0| } 371| 15.8k| auto x = C::FieldElement::from_stash(pt._x()); 372| 15.8k| auto y = C::FieldElement::from_stash(pt._y()); 373| 15.8k| return typename C::AffinePoint(x, y); 374| 15.8k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10mul_x_onlyERKNS0_15PrimeOrderCurve11AffinePointERKNS6_6ScalarERNS_21RandomNumberGeneratorE: 49| 285| RandomNumberGenerator& rng) const override { 50| 285| auto tbl = WindowedBoothMulTable(from_stash(pt)); 51| 285| auto result = tbl.mul(from_stash(scalar), rng); 52| 285| BOTAN_STATE_CHECK(!result.is_identity().as_bool()); ------------------ | | 51| 285| do { \ | | 52| 285| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 285| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 285] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 285| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 285] | | ------------------ ------------------ 53| 285| auto pt_x = to_affine_x(result); 54| 285| secure_vector x_bytes(C::FieldElement::BYTES); 55| 285| pt_x.serialize_to(std::span{x_bytes}); 56| 285| return x_bytes; 57| 285| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS2_12Secp256r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 361| 7.21k| static AffinePoint stash(const typename C::AffinePoint& pt) { 362| 7.21k| auto x_w = pt.x().template stash_value(); 363| 7.21k| auto y_w = pt.y().template stash_value(); 364| 7.21k| return AffinePoint::_create(instance(), x_w, y_w); 365| 7.21k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 244| 6.54k| std::optional deserialize_point_uncompressed(std::span bytes) const override { 245| 6.54k| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 246| 6.54k| constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1; 247| | 248| 6.54k| if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) { ------------------ | Branch (248:13): [True: 6.54k, False: 0] | Branch (248:50): [True: 6.54k, False: 0] ------------------ 249| 6.54k| const auto encoded_point = bytes.subspan(1); 250| 6.54k| auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes)); 251| 6.54k| auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes)); 252| | 253| 6.54k| if(x && y) { ------------------ | Branch (253:16): [True: 6.54k, False: 1] | Branch (253:21): [True: 6.54k, False: 1] ------------------ 254| | // Check that y^2 = x^3 + ax + b 255| 6.54k| const auto lhs = (*y).square(); 256| 6.54k| const auto rhs = C::x3_ax_b(*x); 257| 6.54k| const auto valid = (lhs == rhs); 258| 6.54k| if(valid.as_bool()) { ------------------ | Branch (258:19): [True: 6.53k, False: 10] ------------------ 259| 6.53k| return stash(typename C::AffinePoint(*x, *y)); 260| 6.53k| } 261| 6.54k| } 262| 6.54k| } 263| | 264| 12| return {}; 265| 6.54k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE28deserialize_point_compressedENSt3__14spanIKhLm18446744073709551615EEE: 267| 290| std::optional deserialize_point_compressed(std::span bytes) const override { 268| 290| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 269| 290| constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1; 270| | 271| 290| if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) { ------------------ | Branch (271:13): [True: 290, False: 0] | Branch (271:49): [True: 70, False: 220] | Branch (271:69): [True: 220, False: 0] ------------------ 272| 290| const CT::Choice y_is_even = CT::Mask::is_equal(bytes[0], 0x02).as_choice(); 273| | 274| 290| if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) { ------------------ | Branch (274:21): [True: 289, False: 1] ------------------ 275| 289| if(auto y = sqrt_field_element(C::x3_ax_b(*x)).as_optional_vartime()) { ------------------ | Branch (275:24): [True: 285, False: 4] ------------------ 276| 285| return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even))); 277| 285| } 278| 289| } 279| 290| } 280| | 281| 5| return {}; 282| 290| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 224| 6.24k| std::optional deserialize_scalar(std::span bytes) const override { 225| 6.24k| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (225:18): [True: 6.24k, False: 0] ------------------ 226| 6.24k| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (226:16): [True: 6.24k, False: 0] ------------------ 227| 6.24k| return stash(*scalar); 228| 6.24k| } 229| 6.24k| } 230| | 231| 0| return {}; 232| 6.24k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 192| 398| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 193| 398| auto affine = to_affine(from_stash(pt)); 194| | 195| 398| const auto y2 = affine.y().square(); 196| 398| const auto x3_ax_b = C::x3_ax_b(affine.x()); 197| 398| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 198| | 199| 398| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 64| 398| do { \ | | 65| 398| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 398| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 398] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 398| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 398] | | ------------------ ------------------ 200| | 201| 398| return stash(affine); 202| 398| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 383| 398| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 384| 398| if(pt._curve() != instance()) { ------------------ | Branch (384:13): [True: 0, False: 398] ------------------ 385| 0| throw Invalid_Argument("Curve mismatch"); 386| 0| } 387| 398| auto x = C::FieldElement::from_stash(pt._x()); 388| 398| auto y = C::FieldElement::from_stash(pt._y()); 389| 398| auto z = C::FieldElement::from_stash(pt._z()); 390| 398| return typename C::ProjectivePoint(x, y, z); 391| 398| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 210| 7.78k| bool affine_point_is_identity(const AffinePoint& pt) const override { 211| 7.78k| return from_stash(pt).is_identity().as_bool(); 212| 7.78k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 214| 7.78k| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 215| 7.78k| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 7.78k| do { \ | | 36| 7.78k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 7.78k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 7.78k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 7.78k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 7.78k] | | ------------------ ------------------ 216| 7.78k| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 217| 7.78k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 219| 6.64k| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 220| 6.64k| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 6.64k| do { \ | | 36| 6.64k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 6.64k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 6.64k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 6.64k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 6.64k] | | ------------------ ------------------ 221| 6.64k| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 222| 6.64k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 332| 6.64k| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE13random_scalarERNS_21RandomNumberGeneratorE: 340| 398| Scalar random_scalar(RandomNumberGenerator& rng) const override { return stash(C::Scalar::random(rng)); } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE8instanceEv: 344| 5.05k| static std::shared_ptr instance() { 345| 5.05k| static auto g_curve = std::make_shared>(); 346| 5.05k| return g_curve; 347| 5.05k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEEC2Ev: 342| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE19field_element_bytesEv: 36| 2.58k| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 290| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 290| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 290| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 376| 290| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 377| 290| auto x_w = pt.x().template stash_value(); 378| 290| auto y_w = pt.y().template stash_value(); 379| 290| auto z_w = pt.z().template stash_value(); 380| 290| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 381| 290| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 354| 1.07k| static typename C::Scalar from_stash(const Scalar& s) { 355| 1.07k| if(s._curve() != instance()) { ------------------ | Branch (355:13): [True: 0, False: 1.07k] ------------------ 356| 0| throw Invalid_Argument("Curve mismatch"); 357| 0| } 358| 1.07k| return C::Scalar::from_stash(s._value()); 359| 1.07k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEE: 350| 290| static Scalar stash(const typename C::Scalar& s) { 351| 290| return Scalar::_create(instance(), s.template stash_value()); 352| 290| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 367| 2.41k| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 368| 2.41k| if(pt._curve() != instance()) { ------------------ | Branch (368:13): [True: 0, False: 2.41k] ------------------ 369| 0| throw Invalid_Argument("Curve mismatch"); 370| 0| } 371| 2.41k| auto x = C::FieldElement::from_stash(pt._x()); 372| 2.41k| auto y = C::FieldElement::from_stash(pt._y()); 373| 2.41k| return typename C::AffinePoint(x, y); 374| 2.41k| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10mul_x_onlyERKNS0_15PrimeOrderCurve11AffinePointERKNS6_6ScalarERNS_21RandomNumberGeneratorE: 49| 204| RandomNumberGenerator& rng) const override { 50| 204| auto tbl = WindowedBoothMulTable(from_stash(pt)); 51| 204| auto result = tbl.mul(from_stash(scalar), rng); 52| 204| BOTAN_STATE_CHECK(!result.is_identity().as_bool()); ------------------ | | 51| 204| do { \ | | 52| 204| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 204| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 204] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 204| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 204] | | ------------------ ------------------ 53| 204| auto pt_x = to_affine_x(result); 54| 204| secure_vector x_bytes(C::FieldElement::BYTES); 55| 204| pt_x.serialize_to(std::span{x_bytes}); 56| 204| return x_bytes; 57| 204| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 361| 698| static AffinePoint stash(const typename C::AffinePoint& pt) { 362| 698| auto x_w = pt.x().template stash_value(); 363| 698| auto y_w = pt.y().template stash_value(); 364| 698| return AffinePoint::_create(instance(), x_w, y_w); 365| 698| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 244| 208| std::optional deserialize_point_uncompressed(std::span bytes) const override { 245| 208| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 246| 208| constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1; 247| | 248| 208| if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) { ------------------ | Branch (248:13): [True: 208, False: 0] | Branch (248:50): [True: 208, False: 0] ------------------ 249| 208| const auto encoded_point = bytes.subspan(1); 250| 208| auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes)); 251| 208| auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes)); 252| | 253| 208| if(x && y) { ------------------ | Branch (253:16): [True: 206, False: 2] | Branch (253:21): [True: 205, False: 1] ------------------ 254| | // Check that y^2 = x^3 + ax + b 255| 205| const auto lhs = (*y).square(); 256| 205| const auto rhs = C::x3_ax_b(*x); 257| 205| const auto valid = (lhs == rhs); 258| 205| if(valid.as_bool()) { ------------------ | Branch (258:19): [True: 204, False: 1] ------------------ 259| 204| return stash(typename C::AffinePoint(*x, *y)); 260| 204| } 261| 205| } 262| 208| } 263| | 264| 4| return {}; 265| 208| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE28deserialize_point_compressedENSt3__14spanIKhLm18446744073709551615EEE: 267| 209| std::optional deserialize_point_compressed(std::span bytes) const override { 268| 209| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 269| 209| constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1; 270| | 271| 209| if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) { ------------------ | Branch (271:13): [True: 209, False: 0] | Branch (271:49): [True: 184, False: 25] | Branch (271:69): [True: 25, False: 0] ------------------ 272| 209| const CT::Choice y_is_even = CT::Mask::is_equal(bytes[0], 0x02).as_choice(); 273| | 274| 209| if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) { ------------------ | Branch (274:21): [True: 208, False: 1] ------------------ 275| 208| if(auto y = sqrt_field_element(C::x3_ax_b(*x)).as_optional_vartime()) { ------------------ | Branch (275:24): [True: 204, False: 4] ------------------ 276| 204| return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even))); 277| 204| } 278| 208| } 279| 209| } 280| | 281| 5| return {}; 282| 209| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 192| 290| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 193| 290| auto affine = to_affine(from_stash(pt)); 194| | 195| 290| const auto y2 = affine.y().square(); 196| 290| const auto x3_ax_b = C::x3_ax_b(affine.x()); 197| 290| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 198| | 199| 290| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 64| 290| do { \ | | 65| 290| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 290| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 290] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 290| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 290] | | ------------------ ------------------ 200| | 201| 290| return stash(affine); 202| 290| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 383| 290| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 384| 290| if(pt._curve() != instance()) { ------------------ | Branch (384:13): [True: 0, False: 290] ------------------ 385| 0| throw Invalid_Argument("Curve mismatch"); 386| 0| } 387| 290| auto x = C::FieldElement::from_stash(pt._x()); 388| 290| auto y = C::FieldElement::from_stash(pt._y()); 389| 290| auto z = C::FieldElement::from_stash(pt._z()); 390| 290| return typename C::ProjectivePoint(x, y, z); 391| 290| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 210| 1.10k| bool affine_point_is_identity(const AffinePoint& pt) const override { 211| 1.10k| return from_stash(pt).is_identity().as_bool(); 212| 1.10k| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 214| 1.10k| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 215| 1.10k| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 1.10k| do { \ | | 36| 1.10k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.10k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.10k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.10k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.10k] | | ------------------ ------------------ 216| 1.10k| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 217| 1.10k| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 219| 290| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 220| 290| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 290| do { \ | | 36| 290| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 290| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 290] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 290| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 290] | | ------------------ ------------------ 221| 290| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 222| 290| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 332| 290| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE13random_scalarERNS_21RandomNumberGeneratorE: 340| 290| Scalar random_scalar(RandomNumberGenerator& rng) const override { return stash(C::Scalar::random(rng)); } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE8instanceEv: 344| 7.98k| static std::shared_ptr instance() { 345| 7.98k| static auto g_curve = std::make_shared>(); 346| 7.98k| return g_curve; 347| 7.98k| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEEC2Ev: 342| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE19field_element_bytesEv: 36| 4.09k| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 458| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 458| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 458| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 376| 458| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 377| 458| auto x_w = pt.x().template stash_value(); 378| 458| auto y_w = pt.y().template stash_value(); 379| 458| auto z_w = pt.z().template stash_value(); 380| 458| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 381| 458| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 354| 1.69k| static typename C::Scalar from_stash(const Scalar& s) { 355| 1.69k| if(s._curve() != instance()) { ------------------ | Branch (355:13): [True: 0, False: 1.69k] ------------------ 356| 0| throw Invalid_Argument("Curve mismatch"); 357| 0| } 358| 1.69k| return C::Scalar::from_stash(s._value()); 359| 1.69k| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEE: 350| 458| static Scalar stash(const typename C::Scalar& s) { 351| 458| return Scalar::_create(instance(), s.template stash_value()); 352| 458| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 367| 3.81k| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 368| 3.81k| if(pt._curve() != instance()) { ------------------ | Branch (368:13): [True: 0, False: 3.81k] ------------------ 369| 0| throw Invalid_Argument("Curve mismatch"); 370| 0| } 371| 3.81k| auto x = C::FieldElement::from_stash(pt._x()); 372| 3.81k| auto y = C::FieldElement::from_stash(pt._y()); 373| 3.81k| return typename C::AffinePoint(x, y); 374| 3.81k| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10mul_x_onlyERKNS0_15PrimeOrderCurve11AffinePointERKNS6_6ScalarERNS_21RandomNumberGeneratorE: 49| 322| RandomNumberGenerator& rng) const override { 50| 322| auto tbl = WindowedBoothMulTable(from_stash(pt)); 51| 322| auto result = tbl.mul(from_stash(scalar), rng); 52| 322| BOTAN_STATE_CHECK(!result.is_identity().as_bool()); ------------------ | | 51| 322| do { \ | | 52| 322| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 322| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 322] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 322| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 322] | | ------------------ ------------------ 53| 322| auto pt_x = to_affine_x(result); 54| 322| secure_vector x_bytes(C::FieldElement::BYTES); 55| 322| pt_x.serialize_to(std::span{x_bytes}); 56| 322| return x_bytes; 57| 322| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 361| 1.10k| static AffinePoint stash(const typename C::AffinePoint& pt) { 362| 1.10k| auto x_w = pt.x().template stash_value(); 363| 1.10k| auto y_w = pt.y().template stash_value(); 364| 1.10k| return AffinePoint::_create(instance(), x_w, y_w); 365| 1.10k| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 244| 381| std::optional deserialize_point_uncompressed(std::span bytes) const override { 245| 381| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 246| 381| constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1; 247| | 248| 381| if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) { ------------------ | Branch (248:13): [True: 381, False: 0] | Branch (248:50): [True: 381, False: 0] ------------------ 249| 381| const auto encoded_point = bytes.subspan(1); 250| 381| auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes)); 251| 381| auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes)); 252| | 253| 381| if(x && y) { ------------------ | Branch (253:16): [True: 380, False: 1] | Branch (253:21): [True: 379, False: 1] ------------------ 254| | // Check that y^2 = x^3 + ax + b 255| 379| const auto lhs = (*y).square(); 256| 379| const auto rhs = C::x3_ax_b(*x); 257| 379| const auto valid = (lhs == rhs); 258| 379| if(valid.as_bool()) { ------------------ | Branch (258:19): [True: 322, False: 57] ------------------ 259| 322| return stash(typename C::AffinePoint(*x, *y)); 260| 322| } 261| 379| } 262| 381| } 263| | 264| 59| return {}; 265| 381| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE28deserialize_point_compressedENSt3__14spanIKhLm18446744073709551615EEE: 267| 329| std::optional deserialize_point_compressed(std::span bytes) const override { 268| 329| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 269| 329| constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1; 270| | 271| 329| if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) { ------------------ | Branch (271:13): [True: 329, False: 0] | Branch (271:49): [True: 8, False: 321] | Branch (271:69): [True: 321, False: 0] ------------------ 272| 329| const CT::Choice y_is_even = CT::Mask::is_equal(bytes[0], 0x02).as_choice(); 273| | 274| 329| if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) { ------------------ | Branch (274:21): [True: 327, False: 2] ------------------ 275| 327| if(auto y = sqrt_field_element(C::x3_ax_b(*x)).as_optional_vartime()) { ------------------ | Branch (275:24): [True: 322, False: 5] ------------------ 276| 322| return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even))); 277| 322| } 278| 327| } 279| 329| } 280| | 281| 7| return {}; 282| 329| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 192| 458| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 193| 458| auto affine = to_affine(from_stash(pt)); 194| | 195| 458| const auto y2 = affine.y().square(); 196| 458| const auto x3_ax_b = C::x3_ax_b(affine.x()); 197| 458| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 198| | 199| 458| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 64| 458| do { \ | | 65| 458| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 458| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 458] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 458| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 458] | | ------------------ ------------------ 200| | 201| 458| return stash(affine); 202| 458| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 383| 458| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 384| 458| if(pt._curve() != instance()) { ------------------ | Branch (384:13): [True: 0, False: 458] ------------------ 385| 0| throw Invalid_Argument("Curve mismatch"); 386| 0| } 387| 458| auto x = C::FieldElement::from_stash(pt._x()); 388| 458| auto y = C::FieldElement::from_stash(pt._y()); 389| 458| auto z = C::FieldElement::from_stash(pt._z()); 390| 458| return typename C::ProjectivePoint(x, y, z); 391| 458| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 210| 1.74k| bool affine_point_is_identity(const AffinePoint& pt) const override { 211| 1.74k| return from_stash(pt).is_identity().as_bool(); 212| 1.74k| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 214| 1.74k| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 215| 1.74k| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 1.74k| do { \ | | 36| 1.74k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.74k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.74k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.74k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.74k] | | ------------------ ------------------ 216| 1.74k| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 217| 1.74k| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 219| 458| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 220| 458| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 458| do { \ | | 36| 458| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 458| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 458] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 458| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 458] | | ------------------ ------------------ 221| 458| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 222| 458| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 332| 458| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE13random_scalarERNS_21RandomNumberGeneratorE: 340| 458| Scalar random_scalar(RandomNumberGenerator& rng) const override { return stash(C::Scalar::random(rng)); } _ZN5Botan16polyval_multiplyERKNS_9SIMD_4x32ES2_: 150| 985|BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_CLMUL polyval_multiply(const SIMD_4x32& H, const SIMD_4x32& x) { 151| 985| SIMD_4x32 hi = clmul<0x11>(H, x); 152| 985| const SIMD_4x32 mid = clmul<0x10>(H, x) ^ clmul<0x01>(H, x); 153| 985| SIMD_4x32 lo = clmul<0x00>(H, x); 154| | 155| 985| hi ^= mid.shift_elems_right<2>(); 156| 985| lo ^= mid.shift_elems_left<2>(); 157| | 158| 985| return polyval_reduce(hi, lo); 159| 985|} _ZN5Botan5clmulILi17EEENS_9SIMD_4x32ERKS1_S3_: 31| 6.02k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_CLMUL SIMD_4x32 clmul(const SIMD_4x32& H, const SIMD_4x32& x) { 32| 6.02k| static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode"); 33| | 34| 6.02k|#if defined(BOTAN_SIMD_USE_SSSE3) 35| 6.02k| return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M)); 36| |#elif defined(BOTAN_SIMD_USE_NEON) 37| | const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01); 38| | const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4); 39| | 40| | #if defined(BOTAN_BUILD_COMPILER_IS_MSVC) 41| | __n64 a1 = {a}, b1 = {b}; 42| | return SIMD_4x32(vmull_p64(a1, b1)); 43| | #else 44| | return SIMD_4x32(reinterpret_cast(vmull_p64(a, b))); 45| | #endif 46| | 47| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 48| | const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF); 49| | constexpr uint8_t flip = (std::endian::native == std::endian::big) ? 0x11 : 0x00; 50| | 51| | SIMD_4x32 i1 = x; 52| | SIMD_4x32 i2 = H; 53| | 54| | if constexpr(std::endian::native == std::endian::big) { 55| | i1 = reverse_vector(i1).bswap(); 56| | i2 = reverse_vector(i2).bswap(); 57| | } 58| | 59| | if constexpr(M == (0x11 ^ flip)) { 60| | i1 &= mask_lo; 61| | i2 &= mask_lo; 62| | } else if constexpr(M == (0x10 ^ flip)) { 63| | i1 = i1.shift_elems_left<2>(); 64| | } else if constexpr(M == (0x01 ^ flip)) { 65| | i2 = i2.shift_elems_left<2>(); 66| | } else if constexpr(M == (0x00 ^ flip)) { 67| | i1 = mask_lo.andc(i1); 68| | i2 = mask_lo.andc(i2); 69| | } 70| | 71| | auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw()); 72| | auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw()); 73| | 74| | #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd) 75| | auto rv = __builtin_crypto_vpmsumd(i1v, i2v); 76| | #else 77| | auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v); 78| | #endif 79| | 80| | auto z = SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv)); 81| | 82| | if constexpr(std::endian::native == std::endian::big) { 83| | z = reverse_vector(z).bswap(); 84| | } 85| | 86| | return z; 87| |#endif 88| 6.02k|} _ZN5Botan5clmulILi16EEENS_9SIMD_4x32ERKS1_S3_: 31| 985|BOTAN_FORCE_INLINE BOTAN_FN_ISA_CLMUL SIMD_4x32 clmul(const SIMD_4x32& H, const SIMD_4x32& x) { 32| 985| static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode"); 33| | 34| 985|#if defined(BOTAN_SIMD_USE_SSSE3) 35| 985| return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M)); 36| |#elif defined(BOTAN_SIMD_USE_NEON) 37| | const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01); 38| | const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4); 39| | 40| | #if defined(BOTAN_BUILD_COMPILER_IS_MSVC) 41| | __n64 a1 = {a}, b1 = {b}; 42| | return SIMD_4x32(vmull_p64(a1, b1)); 43| | #else 44| | return SIMD_4x32(reinterpret_cast(vmull_p64(a, b))); 45| | #endif 46| | 47| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 48| | const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF); 49| | constexpr uint8_t flip = (std::endian::native == std::endian::big) ? 0x11 : 0x00; 50| | 51| | SIMD_4x32 i1 = x; 52| | SIMD_4x32 i2 = H; 53| | 54| | if constexpr(std::endian::native == std::endian::big) { 55| | i1 = reverse_vector(i1).bswap(); 56| | i2 = reverse_vector(i2).bswap(); 57| | } 58| | 59| | if constexpr(M == (0x11 ^ flip)) { 60| | i1 &= mask_lo; 61| | i2 &= mask_lo; 62| | } else if constexpr(M == (0x10 ^ flip)) { 63| | i1 = i1.shift_elems_left<2>(); 64| | } else if constexpr(M == (0x01 ^ flip)) { 65| | i2 = i2.shift_elems_left<2>(); 66| | } else if constexpr(M == (0x00 ^ flip)) { 67| | i1 = mask_lo.andc(i1); 68| | i2 = mask_lo.andc(i2); 69| | } 70| | 71| | auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw()); 72| | auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw()); 73| | 74| | #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd) 75| | auto rv = __builtin_crypto_vpmsumd(i1v, i2v); 76| | #else 77| | auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v); 78| | #endif 79| | 80| | auto z = SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv)); 81| | 82| | if constexpr(std::endian::native == std::endian::big) { 83| | z = reverse_vector(z).bswap(); 84| | } 85| | 86| | return z; 87| |#endif 88| 985|} _ZN5Botan5clmulILi1EEENS_9SIMD_4x32ERKS1_S3_: 31| 985|BOTAN_FORCE_INLINE BOTAN_FN_ISA_CLMUL SIMD_4x32 clmul(const SIMD_4x32& H, const SIMD_4x32& x) { 32| 985| static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode"); 33| | 34| 985|#if defined(BOTAN_SIMD_USE_SSSE3) 35| 985| return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M)); 36| |#elif defined(BOTAN_SIMD_USE_NEON) 37| | const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01); 38| | const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4); 39| | 40| | #if defined(BOTAN_BUILD_COMPILER_IS_MSVC) 41| | __n64 a1 = {a}, b1 = {b}; 42| | return SIMD_4x32(vmull_p64(a1, b1)); 43| | #else 44| | return SIMD_4x32(reinterpret_cast(vmull_p64(a, b))); 45| | #endif 46| | 47| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 48| | const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF); 49| | constexpr uint8_t flip = (std::endian::native == std::endian::big) ? 0x11 : 0x00; 50| | 51| | SIMD_4x32 i1 = x; 52| | SIMD_4x32 i2 = H; 53| | 54| | if constexpr(std::endian::native == std::endian::big) { 55| | i1 = reverse_vector(i1).bswap(); 56| | i2 = reverse_vector(i2).bswap(); 57| | } 58| | 59| | if constexpr(M == (0x11 ^ flip)) { 60| | i1 &= mask_lo; 61| | i2 &= mask_lo; 62| | } else if constexpr(M == (0x10 ^ flip)) { 63| | i1 = i1.shift_elems_left<2>(); 64| | } else if constexpr(M == (0x01 ^ flip)) { 65| | i2 = i2.shift_elems_left<2>(); 66| | } else if constexpr(M == (0x00 ^ flip)) { 67| | i1 = mask_lo.andc(i1); 68| | i2 = mask_lo.andc(i2); 69| | } 70| | 71| | auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw()); 72| | auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw()); 73| | 74| | #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd) 75| | auto rv = __builtin_crypto_vpmsumd(i1v, i2v); 76| | #else 77| | auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v); 78| | #endif 79| | 80| | auto z = SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv)); 81| | 82| | if constexpr(std::endian::native == std::endian::big) { 83| | z = reverse_vector(z).bswap(); 84| | } 85| | 86| | return z; 87| |#endif 88| 985|} _ZN5Botan5clmulILi0EEENS_9SIMD_4x32ERKS1_S3_: 31| 14.3k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_CLMUL SIMD_4x32 clmul(const SIMD_4x32& H, const SIMD_4x32& x) { 32| 14.3k| static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode"); 33| | 34| 14.3k|#if defined(BOTAN_SIMD_USE_SSSE3) 35| 14.3k| return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M)); 36| |#elif defined(BOTAN_SIMD_USE_NEON) 37| | const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01); 38| | const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4); 39| | 40| | #if defined(BOTAN_BUILD_COMPILER_IS_MSVC) 41| | __n64 a1 = {a}, b1 = {b}; 42| | return SIMD_4x32(vmull_p64(a1, b1)); 43| | #else 44| | return SIMD_4x32(reinterpret_cast(vmull_p64(a, b))); 45| | #endif 46| | 47| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 48| | const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF); 49| | constexpr uint8_t flip = (std::endian::native == std::endian::big) ? 0x11 : 0x00; 50| | 51| | SIMD_4x32 i1 = x; 52| | SIMD_4x32 i2 = H; 53| | 54| | if constexpr(std::endian::native == std::endian::big) { 55| | i1 = reverse_vector(i1).bswap(); 56| | i2 = reverse_vector(i2).bswap(); 57| | } 58| | 59| | if constexpr(M == (0x11 ^ flip)) { 60| | i1 &= mask_lo; 61| | i2 &= mask_lo; 62| | } else if constexpr(M == (0x10 ^ flip)) { 63| | i1 = i1.shift_elems_left<2>(); 64| | } else if constexpr(M == (0x01 ^ flip)) { 65| | i2 = i2.shift_elems_left<2>(); 66| | } else if constexpr(M == (0x00 ^ flip)) { 67| | i1 = mask_lo.andc(i1); 68| | i2 = mask_lo.andc(i2); 69| | } 70| | 71| | auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw()); 72| | auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw()); 73| | 74| | #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd) 75| | auto rv = __builtin_crypto_vpmsumd(i1v, i2v); 76| | #else 77| | auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v); 78| | #endif 79| | 80| | auto z = SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv)); 81| | 82| | if constexpr(std::endian::native == std::endian::big) { 83| | z = reverse_vector(z).bswap(); 84| | } 85| | 86| | return z; 87| |#endif 88| 14.3k|} _ZN5Botan14polyval_reduceERKNS_9SIMD_4x32ES2_: 129| 1.63k|BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_CLMUL polyval_reduce(const SIMD_4x32& hi, const SIMD_4x32& lo) { 130| 1.63k| const SIMD_4x32 V(0, 0xC2000000, 0, 0); 131| | 132| | /* 133| | Montgomery reduction 134| | Input: 256-bit operand [X3 : X2 : X1 : X0] 135| | [A1 : A0] = X0 • 0xc200000000000000 136| | [B1 : B0] = [X0 ⨁ A1 : X1 ⨁ A0] 137| | [C1 : C0] = B0 • 0xc200000000000000 138| | [D1 : D0] = [B0 ⨁ C1 : B1 ⨁ C0] 139| | Output: [D1 ⨁ X3 : D0 ⨁ X2] 140| | */ 141| | 142| 1.63k| const auto A = clmul<0x00>(lo, V); 143| 1.63k| const auto B = A ^ lo.swap_halves(); 144| 1.63k| const auto C = clmul<0x00>(B, V); 145| 1.63k| const auto D = C ^ B.swap_halves(); 146| | 147| 1.63k| return D ^ hi; 148| 1.63k|} _ZN5Botan12mulx_polyvalERKNS_9SIMD_4x32E: 114| 114|BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 mulx_polyval(const SIMD_4x32& h) { 115| 114| const auto V = SIMD_4x32(0x00000001, 0x00000000, 0x00000000, 0xc2000000); 116| | 117| | // Bitmask set iff the top bit of h is set 118| 114| const auto mask = h.top_bit_mask(); 119| | 120| | // Extract the top bits of the words and move them into place as the low bit of the next word 121| 114| auto top_bits = h.shr<31>().shift_elems_left<1>(); 122| | 123| | // The main shift, adding back in the top bits that are otherwise lost 124| 114| auto shifted_h = h.shl<1>() | top_bits; 125| | 126| 114| return shifted_h ^ (mask & V); 127| 114|} _ZN5Botan14reverse_vectorERKNS_9SIMD_4x32E: 16| 6.34k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32 reverse_vector(const SIMD_4x32& in) { 17| 6.34k|#if defined(BOTAN_SIMD_USE_SSSE3) 18| 6.34k| const __m128i BSWAP_MASK = _mm_set_epi8(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15); 19| 6.34k| return SIMD_4x32(_mm_shuffle_epi8(in.raw(), BSWAP_MASK)); 20| |#elif defined(BOTAN_SIMD_USE_NEON) 21| | const uint8_t maskb[16] = {15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0}; 22| | const uint8x16_t mask = vld1q_u8(maskb); 23| | return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(in.raw()), mask))); 24| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 25| | const __vector unsigned char mask = {15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0}; 26| | return SIMD_4x32(vec_perm(in.raw(), in.raw(), mask)); 27| |#endif 28| 6.34k|} _ZN5Botan10load_blockILb1EEENS_9SIMD_4x32EPKh: 97| 5.85k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32 load_block(const uint8_t in[]) { 98| 5.85k| if constexpr(BSWAP) { 99| 5.85k| return reverse_vector(SIMD_4x32::load_le(in)); 100| | } else { 101| | return SIMD_4x32::load_le(in); 102| | } 103| 5.85k|} _ZN5Botan11store_blockILb1EEEvRKNS_9SIMD_4x32EPh: 106| 383|BOTAN_FORCE_INLINE BOTAN_FN_ISA_SIMD_4X32 void store_block(const SIMD_4x32& b, uint8_t out[]) { 107| 383| if constexpr(BSWAP) { 108| 383| reverse_vector(b).store_le(out); 109| | } else { 110| | b.store_le(out); 111| | } 112| 383|} _ZN5Botan15prefetch_arraysITkNSt3__117unsigned_integralEKhJLm256ELm256ELm256ELm256EEEET_DpRAT0__S3_: 34| 4|T prefetch_arrays(T (&... arr)[Ns]) noexcept { 35| 4| return (static_cast(prefetch_array_raw(sizeof(T) * Ns, arr)) & ...); 36| 4|} _ZN5Botan15prefetch_arraysITkNSt3__117unsigned_integralEKhJLm256EEEET_DpRAT0__S3_: 34| 4|T prefetch_arrays(T (&... arr)[Ns]) noexcept { 35| 4| return (static_cast(prefetch_array_raw(sizeof(T) * Ns, arr)) & ...); 36| 4|} _ZN5Botan10TLS_12_PRFC2ENSt3__110unique_ptrINS_25MessageAuthenticationCodeENS1_14default_deleteIS3_EEEE: 28| 1.59k| explicit TLS_12_PRF(std::unique_ptr mac) : m_mac(std::move(mac)) {} _ZN5Botan4rotlILm1ETkNSt3__117unsigned_integralEhEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 96|{ 26| 96| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 96|} _ZN5Botan4rotlILm7ETkNSt3__117unsigned_integralEhEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 48|{ 26| 48| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 48|} _ZN5Botan4rotrILm8ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 208|{ 38| 208| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 208|} _ZN5Botan4rotlILm5ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 7.23M|{ 26| 7.23M| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 7.23M|} _ZN5Botan4rotrILm2ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 9.81M|{ 38| 9.81M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 9.81M|} _ZN5Botan4rotrILm22ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 9.81M|{ 38| 9.81M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 9.81M|} _ZN5Botan4rotrILm13ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 9.81M|{ 38| 9.81M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 9.81M|} _ZN5Botan3rhoILm2ELm13ELm22ETkNSt3__117unsigned_integralEjEET2_S2_: 53| 9.81M|BOTAN_FORCE_INLINE constexpr T rho(T x) { 54| 9.81M| return rotr(x) ^ rotr(x) ^ rotr(x); 55| 9.81M|} _ZN5Botan3rhoILm6ELm11ELm25ETkNSt3__117unsigned_integralEjEET2_S2_: 53| 9.81M|BOTAN_FORCE_INLINE constexpr T rho(T x) { 54| 9.81M| return rotr(x) ^ rotr(x) ^ rotr(x); 55| 9.81M|} _ZN5Botan4rotrILm6ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 9.81M|{ 38| 9.81M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 9.81M|} _ZN5Botan4rotrILm11ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 9.81M|{ 38| 9.81M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 9.81M|} _ZN5Botan4rotrILm25ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 9.81M|{ 38| 9.81M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 9.81M|} _ZN5Botan4rotrILm16ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 272|{ 38| 272| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 272|} _ZN5Botan4rotrILm24ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 208|{ 38| 208| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 208|} _ZN5Botan4rotrILm39ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 1.36M|{ 38| 1.36M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 1.36M|} _ZN5Botan4rotrILm34ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 1.36M|{ 38| 1.36M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 1.36M|} _ZN5Botan4rotrILm14ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 1.36M|{ 38| 1.36M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 1.36M|} _ZN5Botan4rotlILm30ETkNSt3__117unsigned_integralEjEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 7.23M|{ 26| 7.23M| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 7.23M|} _ZN5Botan3rhoILm14ELm18ELm41ETkNSt3__117unsigned_integralEmEET2_S2_: 53| 1.36M|BOTAN_FORCE_INLINE constexpr T rho(T x) { 54| 1.36M| return rotr(x) ^ rotr(x) ^ rotr(x); 55| 1.36M|} _ZN5Botan4rotrILm18ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 1.36M|{ 38| 1.36M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 1.36M|} _ZN5Botan4rotrILm41ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 1.36M|{ 38| 1.36M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 1.36M|} _ZN5Botan3rhoILm28ELm34ELm39ETkNSt3__117unsigned_integralEmEET2_S2_: 53| 1.36M|BOTAN_FORCE_INLINE constexpr T rho(T x) { 54| 1.36M| return rotr(x) ^ rotr(x) ^ rotr(x); 55| 1.36M|} _ZN5Botan4rotrILm28ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 1.36M|{ 38| 1.36M| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 1.36M|} _ZN5Botan8round_upEmm: 26| 113k|constexpr inline size_t round_up(size_t n, size_t align_to) { 27| | // Arguably returning n in this case would also be sensible 28| 113k| BOTAN_ARG_CHECK(align_to != 0, "align_to must not be 0"); ------------------ | | 35| 113k| do { \ | | 36| 113k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 113k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 113k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 113k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 113k] | | ------------------ ------------------ 29| | 30| 113k| if(n % align_to > 0) { ------------------ | Branch (30:7): [True: 74.1k, False: 39.2k] ------------------ 31| 74.1k| const size_t adj = align_to - (n % align_to); 32| 74.1k| BOTAN_ARG_CHECK(n + adj >= n, "Integer overflow during rounding"); ------------------ | | 35| 74.1k| do { \ | | 36| 74.1k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 74.1k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 74.1k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 74.1k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 74.1k] | | ------------------ ------------------ 33| 74.1k| n += adj; 34| 74.1k| } 35| 113k| return n; 36| 113k|} _ZNK5Botan9SCAN_Name9arg_countEv: 43| 7.64k| size_t arg_count() const { return m_args.size(); } _ZNK5Botan9SCAN_Name9algo_nameEv: 38| 19.1k| const std::string& algo_name() const { return m_alg_name; } _ZN5Botan14scoped_cleanupIZNS_2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS8_EEEDaDpRKS8_EUlvE_EC2ESC_: 26| 15| explicit scoped_cleanup(FunT cleanup) : m_cleanup(std::move(cleanup)) {} _ZN5Botan14scoped_cleanupIZNS_2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS8_EEEDaDpRKS8_EUlvE_EC2EOSD_: 32| 15| scoped_cleanup(scoped_cleanup&& other) noexcept : m_cleanup(std::move(other.m_cleanup)) { other.disengage(); } _ZN5Botan14scoped_cleanupIZNS_2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS8_EEEDaDpRKS8_EUlvE_E9disengageEv: 43| 15| void disengage() noexcept { m_cleanup.reset(); } _ZN5Botan14scoped_cleanupIZNS_2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS8_EEEDaDpRKS8_EUlvE_ED2Ev: 34| 30| ~scoped_cleanup() { 35| 30| if(m_cleanup.has_value()) { ------------------ | Branch (35:13): [True: 15, False: 15] ------------------ 36| 15| (*m_cleanup)(); // NOLINT(bugprone-exception-escape) clang-tidy bug 37| 15| } 38| 30| } _ZNK5Botan5SHA_14nameEv: 32| 207| std::string name() const override { return "SHA-1"; } _ZNK5Botan5SHA_113output_lengthEv: 34| 44.4k| size_t output_length() const override { return 20; } _ZNK5Botan5SHA_115hash_block_sizeEv: 36| 134| size_t hash_block_size() const override { return block_bytes; } _ZN5Botan5SHA_15clearEv: 47| 134| void clear() override { m_md.clear(); } _ZN5Botan6SHA1_F2F1EjRjjjS1_j: 21| 1.80M|inline void F1(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t M) { 22| 1.80M| E += choose(B, C, D) + M + rotl<5>(A); 23| 1.80M| B = rotl<30>(B); 24| 1.80M|} _ZN5Botan6SHA1_F2F2EjRjjjS1_j: 26| 1.80M|inline void F2(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t M) { 27| 1.80M| E += (B ^ C ^ D) + M + rotl<5>(A); 28| 1.80M| B = rotl<30>(B); 29| 1.80M|} _ZN5Botan6SHA1_F2F3EjRjjjS1_j: 31| 1.80M|inline void F3(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t M) { 32| 1.80M| E += majority(B, C, D) + M + rotl<5>(A); 33| 1.80M| B = rotl<30>(B); 34| 1.80M|} _ZN5Botan6SHA1_F2F4EjRjjjS1_j: 37| 1.80M|inline void F4(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t M) { 38| 1.80M| E += (B ^ C ^ D) + M + rotl<5>(A); 39| 1.80M| B = rotl<30>(B); 40| 1.80M|} _ZNK5Botan7SHA_2564nameEv: 73| 56| std::string name() const override { return "SHA-256"; } _ZNK5Botan7SHA_25613output_lengthEv: 75| 88.1k| size_t output_length() const override { return output_bytes; } _ZNK5Botan7SHA_25615hash_block_sizeEv: 77| 1.18k| size_t hash_block_size() const override { return block_bytes; } _ZN5Botan7SHA_2565clearEv: 83| 2.21k| void clear() override { m_md.clear(); } _ZN5Botan9SHA2_32_FEjjjRjjjjS0_j: 42| 9.81M| uint32_t A, uint32_t B, uint32_t C, uint32_t& D, uint32_t E, uint32_t F, uint32_t G, uint32_t& H, uint32_t M) { 43| 9.81M| H += rho<6, 11, 25>(E) + choose(E, F, G) + M; 44| 9.81M| D += H; 45| 9.81M| H += rho<2, 13, 22>(A) + majority(A, B, C); 46| 9.81M|} _ZNK5Botan7SHA_3844nameEv: 32| 106| std::string name() const override { return "SHA-384"; } _ZNK5Botan7SHA_38413output_lengthEv: 34| 13.5k| size_t output_length() const override { return output_bytes; } _ZNK5Botan7SHA_38415hash_block_sizeEv: 36| 521| size_t hash_block_size() const override { return block_bytes; } _ZN5Botan7SHA_3845clearEv: 44| 904| void clear() override { m_md.clear(); } _ZN5Botan9SHA2_64_FEmmmRmmmmS0_m: 42| 1.36M| uint64_t A, uint64_t B, uint64_t C, uint64_t& D, uint64_t E, uint64_t F, uint64_t G, uint64_t& H, uint64_t M) { 43| 1.36M| H += rho<14, 18, 41>(E) + choose(E, F, G) + M; 44| 1.36M| D += H; 45| 1.36M| H += rho<28, 34, 39>(A) + majority(A, B, C); 46| 1.36M|} _ZN5Botan9SIMD_2x64C2Ev: 50| 125k| m_simd(_mm_setzero_si128()) 51| |#elif defined(BOTAN_SIMD_USE_SIMD128) 52| | m_simd(wasm_u64x2_const_splat(0)) 53| |#endif 54| 125k| { 55| 125k| } _ZN5Botan9SIMD_2x647load_beEPKv: 90| 125k| static SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 load_be(const void* in) { return SIMD_2x64::load_le(in).bswap(); } _ZNK5Botan9SIMD_2x645bswapEv: 100| 125k| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 bswap() const { 101| 125k|#if defined(BOTAN_SIMD_USE_SSSE3) 102| 125k| const auto idx = _mm_set_epi8(8, 9, 10, 11, 12, 13, 14, 15, 0, 1, 2, 3, 4, 5, 6, 7); 103| 125k| return SIMD_2x64(_mm_shuffle_epi8(m_simd, idx)); 104| |#elif defined(BOTAN_SIMD_USE_SIMD128) 105| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8)); 106| |#endif 107| 125k| } _ZN5Botan9SIMD_2x64C2EDv2_x: 316| 4.89M| explicit BOTAN_FN_ISA_SIMD_2X64 SIMD_2x64(native_simd_type x) : m_simd(x) {} _ZNK5Botan9SIMD_2x64plERKS0_: 144| 2.13M| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 operator+(const SIMD_2x64& other) const { 145| 2.13M| SIMD_2x64 retval(*this); 146| 2.13M| retval += other; 147| 2.13M| return retval; 148| 2.13M| } _ZN5Botan9SIMD_2x64pLERKS0_: 156| 2.13M| void BOTAN_FN_ISA_SIMD_2X64 operator+=(const SIMD_2x64& other) { 157| 2.13M|#if defined(BOTAN_SIMD_USE_SSSE3) 158| 2.13M| m_simd = _mm_add_epi64(m_simd, other.m_simd); 159| |#elif defined(BOTAN_SIMD_USE_SIMD128) 160| | m_simd = wasm_i64x2_add(m_simd, other.m_simd); 161| |#endif 162| 2.13M| } _ZN5Botan9SIMD_2x647load_leEPKv: 82| 753k| static SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 load_le(const void* in) { 83| 753k|#if defined(BOTAN_SIMD_USE_SSSE3) 84| 753k| return SIMD_2x64(_mm_loadu_si128(reinterpret_cast(in))); 85| |#elif defined(BOTAN_SIMD_USE_SIMD128) 86| | return SIMD_2x64(wasm_v128_load(in)); 87| |#endif 88| 753k| } _ZNK5Botan9SIMD_2x648store_leEPm: 126| 627k| void BOTAN_FN_ISA_SIMD_2X64 store_le(uint64_t out[2]) const { this->store_le(reinterpret_cast(out)); } _ZNK5Botan9SIMD_2x648store_leEPh: 128| 627k| void BOTAN_FN_ISA_SIMD_2X64 store_le(uint8_t out[]) const { 129| 627k|#if defined(BOTAN_SIMD_USE_SSSE3) 130| 627k| _mm_storeu_si128(reinterpret_cast<__m128i*>(out), m_simd); 131| |#elif defined(BOTAN_SIMD_USE_SIMD128) 132| | wasm_v128_store(out, m_simd); 133| |#endif 134| 627k| } _ZN5Botan9SIMD_2x647alignr8ERKS0_S2_: 240| 1.00M| static SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 alignr8(const SIMD_2x64& a, const SIMD_2x64& b) { 241| 1.00M|#if defined(BOTAN_SIMD_USE_SSSE3) 242| 1.00M| return SIMD_2x64(_mm_alignr_epi8(a.m_simd, b.m_simd, 8)); 243| |#elif defined(BOTAN_SIMD_USE_SIMD128) 244| | return SIMD_2x64( 245| | wasm_i8x16_shuffle(b.m_simd, a.m_simd, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23)); 246| |#endif 247| 1.00M| } _ZNK5Botan9SIMD_2x644rotrILm1EEES0_vQaagtT_Li0EltT_Li64E: 184| 502k| { 185| 502k|#if defined(BOTAN_SIMD_USE_SSSE3) 186| | if constexpr(ROT == 8) { 187| | auto tab = _mm_setr_epi8(1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8); 188| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 189| | } else if constexpr(ROT == 16) { 190| | auto tab = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9); 191| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 192| | } else if constexpr(ROT == 24) { 193| | auto tab = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10); 194| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 195| | } else if constexpr(ROT == 32) { 196| | auto tab = _mm_setr_epi8(4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11); 197| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 198| 502k| } else { 199| 502k| return SIMD_2x64(_mm_or_si128(_mm_srli_epi64(m_simd, static_cast(ROT)), 200| 502k| _mm_slli_epi64(m_simd, static_cast(64 - ROT)))); 201| 502k| } 202| |#elif defined(BOTAN_SIMD_USE_SIMD128) 203| | if constexpr(ROT == 8) { 204| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8)); 205| | } else if constexpr(ROT == 16) { 206| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)); 207| | } else if constexpr(ROT == 24) { 208| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)); 209| | } else if constexpr(ROT == 32) { 210| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11)); 211| | } else { 212| | return SIMD_2x64(wasm_v128_or(wasm_u64x2_shr(m_simd, ROT), wasm_i64x2_shl(m_simd, 64 - ROT))); 213| | } 214| |#endif 215| 502k| } _ZNK5Botan9SIMD_2x64eoERKS0_: 150| 2.00M| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 operator^(const SIMD_2x64& other) const { 151| 2.00M| SIMD_2x64 retval(*this); 152| 2.00M| retval ^= other; 153| 2.00M| return retval; 154| 2.00M| } _ZN5Botan9SIMD_2x64eOERKS0_: 164| 2.00M| void BOTAN_FN_ISA_SIMD_2X64 operator^=(const SIMD_2x64& other) { 165| 2.00M|#if defined(BOTAN_SIMD_USE_SSSE3) 166| 2.00M| m_simd = _mm_xor_si128(m_simd, other.m_simd); 167| |#elif defined(BOTAN_SIMD_USE_SIMD128) 168| | m_simd = wasm_v128_xor(m_simd, other.m_simd); 169| |#endif 170| 2.00M| } _ZNK5Botan9SIMD_2x644rotrILm8EEES0_vQaagtT_Li0EltT_Li64E: 184| 502k| { 185| 502k|#if defined(BOTAN_SIMD_USE_SSSE3) 186| 502k| if constexpr(ROT == 8) { 187| 502k| auto tab = _mm_setr_epi8(1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8); 188| 502k| return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 189| | } else if constexpr(ROT == 16) { 190| | auto tab = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9); 191| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 192| | } else if constexpr(ROT == 24) { 193| | auto tab = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10); 194| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 195| | } else if constexpr(ROT == 32) { 196| | auto tab = _mm_setr_epi8(4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11); 197| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 198| | } else { 199| | return SIMD_2x64(_mm_or_si128(_mm_srli_epi64(m_simd, static_cast(ROT)), 200| | _mm_slli_epi64(m_simd, static_cast(64 - ROT)))); 201| | } 202| |#elif defined(BOTAN_SIMD_USE_SIMD128) 203| | if constexpr(ROT == 8) { 204| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8)); 205| | } else if constexpr(ROT == 16) { 206| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)); 207| | } else if constexpr(ROT == 24) { 208| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)); 209| | } else if constexpr(ROT == 32) { 210| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11)); 211| | } else { 212| | return SIMD_2x64(wasm_v128_or(wasm_u64x2_shr(m_simd, ROT), wasm_i64x2_shl(m_simd, 64 - ROT))); 213| | } 214| |#endif 215| 502k| } _ZNK5Botan9SIMD_2x643shrILi7EEES0_v: 223| 502k| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 shr() const noexcept { 224| 502k|#if defined(BOTAN_SIMD_USE_SSSE3) 225| 502k| return SIMD_2x64(_mm_srli_epi64(m_simd, SHIFT)); 226| |#elif defined(BOTAN_SIMD_USE_SIMD128) 227| | return SIMD_2x64(wasm_u64x2_shr(m_simd, SHIFT)); 228| |#endif 229| 502k| } _ZNK5Botan9SIMD_2x644rotrILm19EEES0_vQaagtT_Li0EltT_Li64E: 184| 502k| { 185| 502k|#if defined(BOTAN_SIMD_USE_SSSE3) 186| | if constexpr(ROT == 8) { 187| | auto tab = _mm_setr_epi8(1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8); 188| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 189| | } else if constexpr(ROT == 16) { 190| | auto tab = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9); 191| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 192| | } else if constexpr(ROT == 24) { 193| | auto tab = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10); 194| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 195| | } else if constexpr(ROT == 32) { 196| | auto tab = _mm_setr_epi8(4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11); 197| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 198| 502k| } else { 199| 502k| return SIMD_2x64(_mm_or_si128(_mm_srli_epi64(m_simd, static_cast(ROT)), 200| 502k| _mm_slli_epi64(m_simd, static_cast(64 - ROT)))); 201| 502k| } 202| |#elif defined(BOTAN_SIMD_USE_SIMD128) 203| | if constexpr(ROT == 8) { 204| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8)); 205| | } else if constexpr(ROT == 16) { 206| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)); 207| | } else if constexpr(ROT == 24) { 208| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)); 209| | } else if constexpr(ROT == 32) { 210| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11)); 211| | } else { 212| | return SIMD_2x64(wasm_v128_or(wasm_u64x2_shr(m_simd, ROT), wasm_i64x2_shl(m_simd, 64 - ROT))); 213| | } 214| |#endif 215| 502k| } _ZNK5Botan9SIMD_2x644rotrILm61EEES0_vQaagtT_Li0EltT_Li64E: 184| 502k| { 185| 502k|#if defined(BOTAN_SIMD_USE_SSSE3) 186| | if constexpr(ROT == 8) { 187| | auto tab = _mm_setr_epi8(1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8); 188| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 189| | } else if constexpr(ROT == 16) { 190| | auto tab = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9); 191| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 192| | } else if constexpr(ROT == 24) { 193| | auto tab = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10); 194| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 195| | } else if constexpr(ROT == 32) { 196| | auto tab = _mm_setr_epi8(4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11); 197| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 198| 502k| } else { 199| 502k| return SIMD_2x64(_mm_or_si128(_mm_srli_epi64(m_simd, static_cast(ROT)), 200| 502k| _mm_slli_epi64(m_simd, static_cast(64 - ROT)))); 201| 502k| } 202| |#elif defined(BOTAN_SIMD_USE_SIMD128) 203| | if constexpr(ROT == 8) { 204| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8)); 205| | } else if constexpr(ROT == 16) { 206| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)); 207| | } else if constexpr(ROT == 24) { 208| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)); 209| | } else if constexpr(ROT == 32) { 210| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11)); 211| | } else { 212| | return SIMD_2x64(wasm_v128_or(wasm_u64x2_shr(m_simd, ROT), wasm_i64x2_shl(m_simd, 64 - ROT))); 213| | } 214| |#endif 215| 502k| } _ZNK5Botan9SIMD_2x643shrILi6EEES0_v: 223| 502k| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 shr() const noexcept { 224| 502k|#if defined(BOTAN_SIMD_USE_SSSE3) 225| 502k| return SIMD_2x64(_mm_srli_epi64(m_simd, SHIFT)); 226| |#elif defined(BOTAN_SIMD_USE_SIMD128) 227| | return SIMD_2x64(wasm_u64x2_shr(m_simd, SHIFT)); 228| |#endif 229| 502k| } _ZN5Botan9SIMD_4x32C2Ev: 86| 439k| BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32() noexcept { 87| 439k|#if defined(BOTAN_SIMD_USE_SSSE3) 88| 439k| m_simd = _mm_setzero_si128(); 89| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 90| | m_simd = vec_splat_u32(0); 91| |#elif defined(BOTAN_SIMD_USE_NEON) 92| | m_simd = vdupq_n_u32(0); 93| |#elif defined(BOTAN_SIMD_USE_LSX) 94| | m_simd = __lsx_vldi(0); 95| |#elif defined(BOTAN_SIMD_USE_SIMD128) 96| | m_simd = wasm_u32x4_const_splat(0); 97| |#endif 98| 439k| } _ZN5Botan9SIMD_4x3212byte_shuffleERKS0_S2_: 825| 2.65M| static inline SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 byte_shuffle(const SIMD_4x32& tbl, const SIMD_4x32& idx) { 826| 2.65M|#if defined(BOTAN_SIMD_USE_SSSE3) 827| 2.65M| return SIMD_4x32(_mm_shuffle_epi8(tbl.raw(), idx.raw())); 828| |#elif defined(BOTAN_SIMD_USE_NEON) 829| | const uint8x16_t tbl8 = vreinterpretq_u8_u32(tbl.raw()); 830| | const uint8x16_t idx8 = vreinterpretq_u8_u32(idx.raw()); 831| | 832| | #if defined(BOTAN_TARGET_ARCH_IS_ARM32) 833| | const uint8x8x2_t tbl2 = {vget_low_u8(tbl8), vget_high_u8(tbl8)}; 834| | 835| | return SIMD_4x32( 836| | vreinterpretq_u32_u8(vcombine_u8(vtbl2_u8(tbl2, vget_low_u8(idx8)), vtbl2_u8(tbl2, vget_high_u8(idx8))))); 837| | #else 838| | return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(tbl8, idx8))); 839| | #endif 840| | 841| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 842| | const auto r = vec_perm(reinterpret_cast<__vector signed char>(tbl.raw()), 843| | reinterpret_cast<__vector signed char>(tbl.raw()), 844| | reinterpret_cast<__vector unsigned char>(idx.raw())); 845| | return SIMD_4x32(reinterpret_cast<__vector unsigned int>(r)); 846| |#elif defined(BOTAN_SIMD_USE_LSX) 847| | return SIMD_4x32(__lsx_vshuf_b(tbl.raw(), tbl.raw(), idx.raw())); 848| |#elif defined(BOTAN_SIMD_USE_SIMD128) 849| | return SIMD_4x32(wasm_i8x16_swizzle(tbl.raw(), idx.raw())); 850| |#endif 851| 2.65M| } _ZNK5Botan9SIMD_4x323rawEv: 996| 21.3M| native_simd_type BOTAN_FN_ISA_SIMD_4X32 raw() const noexcept { return m_simd; } _ZN5Botan9SIMD_4x32C2EDv2_x: 998| 25.5M| explicit BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32(native_simd_type x) noexcept : m_simd(x) {} _ZN5Botan9SIMD_4x327load_leEPKv: 162| 2.29M| static SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 load_le(const void* in) noexcept { 163| 2.29M|#if defined(BOTAN_SIMD_USE_SSSE3) 164| 2.29M| return SIMD_4x32(_mm_loadu_si128(reinterpret_cast(in))); 165| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 166| | uint32_t R0 = Botan::load_le(reinterpret_cast(in), 0); 167| | uint32_t R1 = Botan::load_le(reinterpret_cast(in), 1); 168| | uint32_t R2 = Botan::load_le(reinterpret_cast(in), 2); 169| | uint32_t R3 = Botan::load_le(reinterpret_cast(in), 3); 170| | __vector unsigned int val = {R0, R1, R2, R3}; 171| | return SIMD_4x32(val); 172| |#elif defined(BOTAN_SIMD_USE_NEON) 173| | SIMD_4x32 l(vld1q_u32(static_cast(in))); 174| | if constexpr(std::endian::native == std::endian::big) { 175| | return l.bswap(); 176| | } else { 177| | return l; 178| | } 179| |#elif defined(BOTAN_SIMD_USE_LSX) 180| | return SIMD_4x32(__lsx_vld(in, 0)); 181| |#elif defined(BOTAN_SIMD_USE_SIMD128) 182| | return SIMD_4x32(wasm_v128_load(in)); 183| |#endif 184| 2.29M| } _ZN5Botan9SIMD_4x32C2Ejjjj: 103| 2.66M| BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32(uint32_t B0, uint32_t B1, uint32_t B2, uint32_t B3) noexcept { 104| 2.66M|#if defined(BOTAN_SIMD_USE_SSSE3) 105| 2.66M| m_simd = _mm_set_epi32(B3, B2, B1, B0); 106| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 107| | __vector unsigned int val = {B0, B1, B2, B3}; 108| | m_simd = val; 109| |#elif defined(BOTAN_SIMD_USE_NEON) 110| | // Better way to do this? 111| | const uint32_t B[4] = {B0, B1, B2, B3}; 112| | m_simd = vld1q_u32(B); 113| |#elif defined(BOTAN_SIMD_USE_LSX) 114| | // Better way to do this? 115| | const uint32_t B[4] = {B0, B1, B2, B3}; 116| | m_simd = __lsx_vld(B, 0); 117| |#elif defined(BOTAN_SIMD_USE_SIMD128) 118| | m_simd = wasm_u32x4_make(B0, B1, B2, B3); 119| |#endif 120| 2.66M| } _ZN5Botan9SIMD_4x3210byte_blendERKS0_S2_S2_: 795| 2.79k| const SIMD_4x32& b) noexcept { 796| | // TODO(SSE4.1) could use _mm_blendv_epi8 here 797| 2.79k| return SIMD_4x32::choose(mask, a, b); 798| 2.79k| } _ZN5Botan9SIMD_4x326chooseERKS0_S2_S2_: 772| 2.79k| const SIMD_4x32& b) noexcept { 773| |#if defined(BOTAN_SIMD_USE_ALTIVEC) 774| | return SIMD_4x32(vec_sel(b.raw(), a.raw(), mask.raw())); 775| |#elif defined(BOTAN_SIMD_USE_NEON) 776| | return SIMD_4x32(vbslq_u32(mask.raw(), a.raw(), b.raw())); 777| |#elif defined(BOTAN_SIMD_USE_LSX) 778| | return SIMD_4x32(__lsx_vbitsel_v(b.raw(), a.raw(), mask.raw())); 779| |#elif defined(BOTAN_SIMD_USE_SIMD128) 780| | return SIMD_4x32(wasm_v128_bitselect(a.raw(), b.raw(), mask.raw())); 781| |#else 782| 2.79k| return (mask & a) ^ mask.andc(b); 783| 2.79k|#endif 784| 2.79k| } _ZNK5Botan9SIMD_4x32anERKS0_: 421| 13.5k| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 operator&(const SIMD_4x32& other) const noexcept { 422| 13.5k| SIMD_4x32 retval(*this); 423| 13.5k| retval &= other; 424| 13.5k| return retval; 425| 13.5k| } _ZN5Botan9SIMD_4x32aNERKS0_: 485| 13.5k| void BOTAN_FN_ISA_SIMD_4X32 operator&=(const SIMD_4x32& other) noexcept { 486| 13.5k|#if defined(BOTAN_SIMD_USE_SSSE3) 487| 13.5k| m_simd = _mm_and_si128(m_simd, other.m_simd); 488| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 489| | m_simd = vec_and(m_simd, other.m_simd); 490| |#elif defined(BOTAN_SIMD_USE_NEON) 491| | m_simd = vandq_u32(m_simd, other.m_simd); 492| |#elif defined(BOTAN_SIMD_USE_LSX) 493| | m_simd = __lsx_vand_v(m_simd, other.m_simd); 494| |#elif defined(BOTAN_SIMD_USE_SIMD128) 495| | m_simd = wasm_v128_and(m_simd, other.m_simd); 496| |#endif 497| 13.5k| } _ZNK5Botan9SIMD_4x32eoERKS0_: 403| 6.62M| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 operator^(const SIMD_4x32& other) const noexcept { 404| 6.62M| SIMD_4x32 retval(*this); 405| 6.62M| retval ^= other; 406| 6.62M| return retval; 407| 6.62M| } _ZNK5Botan9SIMD_4x324andcERKS0_: 552| 2.79k| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 andc(const SIMD_4x32& other) const noexcept { 553| 2.79k|#if defined(BOTAN_SIMD_USE_SSSE3) 554| 2.79k| return SIMD_4x32(_mm_andnot_si128(m_simd, other.m_simd)); 555| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 556| | /* 557| | AltiVec does arg1 & ~arg2 rather than SSE's ~arg1 & arg2 558| | so swap the arguments 559| | */ 560| | return SIMD_4x32(vec_andc(other.m_simd, m_simd)); 561| |#elif defined(BOTAN_SIMD_USE_NEON) 562| | // NEON is also a & ~b 563| | return SIMD_4x32(vbicq_u32(other.m_simd, m_simd)); 564| |#elif defined(BOTAN_SIMD_USE_LSX) 565| | // LSX is ~a & b 566| | return SIMD_4x32(__lsx_vandn_v(m_simd, other.m_simd)); 567| |#elif defined(BOTAN_SIMD_USE_SIMD128) 568| | // SIMD128 is a & ~b 569| | return SIMD_4x32(wasm_v128_andnot(other.m_simd, m_simd)); 570| |#endif 571| 2.79k| } _ZNK5Botan9SIMD_4x3211swap_halvesEv: 956| 3.41k| inline SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 swap_halves() const { 957| 3.41k|#if defined(BOTAN_SIMD_USE_SSSE3) 958| 3.41k| return SIMD_4x32(_mm_shuffle_epi32(raw(), 0b01001110)); 959| |#else 960| | return SIMD_4x32::alignr8(*this, *this); 961| |#endif 962| 3.41k| } _ZN5Botan9SIMD_4x32eOERKS0_: 455| 10.6M| void BOTAN_FN_ISA_SIMD_4X32 operator^=(const SIMD_4x32& other) noexcept { 456| 10.6M|#if defined(BOTAN_SIMD_USE_SSSE3) 457| 10.6M| m_simd = _mm_xor_si128(m_simd, other.m_simd); 458| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 459| | m_simd = vec_xor(m_simd, other.m_simd); 460| |#elif defined(BOTAN_SIMD_USE_NEON) 461| | m_simd = veorq_u32(m_simd, other.m_simd); 462| |#elif defined(BOTAN_SIMD_USE_LSX) 463| | m_simd = __lsx_vxor_v(m_simd, other.m_simd); 464| |#elif defined(BOTAN_SIMD_USE_SIMD128) 465| | m_simd = wasm_v128_xor(m_simd, other.m_simd); 466| |#endif 467| 10.6M| } _ZN5Botan9SIMD_4x328splat_u8Eh: 144| 5.20k| static SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 splat_u8(uint8_t B) noexcept { 145| 5.20k|#if defined(BOTAN_SIMD_USE_SSSE3) 146| 5.20k| return SIMD_4x32(_mm_set1_epi8(B)); 147| |#elif defined(BOTAN_SIMD_USE_NEON) 148| | return SIMD_4x32(vreinterpretq_u32_u8(vdupq_n_u8(B))); 149| |#elif defined(BOTAN_SIMD_USE_LSX) 150| | return SIMD_4x32(__lsx_vreplgr2vr_b(B)); 151| |#elif defined(BOTAN_SIMD_USE_SIMD128) 152| | return SIMD_4x32(wasm_u8x16_splat(B)); 153| |#else 154| | const uint32_t B4 = make_uint32(B, B, B, B); 155| | return SIMD_4x32(B4, B4, B4, B4); 156| |#endif 157| 5.20k| } _ZNK5Botan9SIMD_4x323shrILi4EEES0_v: 520| 5.20k| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shr() const noexcept { 521| 5.20k|#if defined(BOTAN_SIMD_USE_SSSE3) 522| 5.20k| return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT)); 523| | 524| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 525| | const unsigned int s = static_cast(SHIFT); 526| | const __vector unsigned int shifts = {s, s, s, s}; 527| | return SIMD_4x32(vec_sr(m_simd, shifts)); 528| |#elif defined(BOTAN_SIMD_USE_NEON) 529| | return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT)); 530| |#elif defined(BOTAN_SIMD_USE_LSX) 531| | return SIMD_4x32(__lsx_vsrli_w(m_simd, SHIFT)); 532| |#elif defined(BOTAN_SIMD_USE_SIMD128) 533| | return SIMD_4x32(wasm_u32x4_shr(m_simd, SHIFT)); 534| |#endif 535| 5.20k| } _ZN5Botan9SIMD_4x325splatEj: 127| 2.80k| static SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 splat(uint32_t B) noexcept { 128| 2.80k|#if defined(BOTAN_SIMD_USE_SSSE3) 129| 2.80k| return SIMD_4x32(_mm_set1_epi32(B)); 130| |#elif defined(BOTAN_SIMD_USE_NEON) 131| | return SIMD_4x32(vdupq_n_u32(B)); 132| |#elif defined(BOTAN_SIMD_USE_LSX) 133| | return SIMD_4x32(__lsx_vreplgr2vr_w(B)); 134| |#elif defined(BOTAN_SIMD_USE_SIMD128) 135| | return SIMD_4x32(wasm_u32x4_splat(B)); 136| |#else 137| | return SIMD_4x32(B, B, B, B); 138| |#endif 139| 2.80k| } _ZNK5Botan9SIMD_4x324rotlILm1EEES0_vQaagtT_Li0EltT_Li32E: 331| 200| { 332| 200|#if defined(BOTAN_SIMD_USE_SSSE3) 333| | if constexpr(ROT == 8) { 334| | const auto shuf_rotl_8 = _mm_set_epi64x(0x0e0d0c0f0a09080b, 0x0605040702010003); 335| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_8)); 336| | } else if constexpr(ROT == 16) { 337| | const auto shuf_rotl_16 = _mm_set_epi64x(0x0d0c0f0e09080b0a, 0x0504070601000302); 338| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_16)); 339| | } else if constexpr(ROT == 24) { 340| | const auto shuf_rotl_24 = _mm_set_epi64x(0x0c0f0e0d080b0a09, 0x0407060500030201); 341| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_24)); 342| 200| } else { 343| 200| return SIMD_4x32(_mm_xor_si128(_mm_slli_epi32(raw(), static_cast(ROT)), 344| 200| _mm_srli_epi32(raw(), static_cast(32 - ROT)))); 345| 200| } 346| | 347| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 348| | 349| | const unsigned int r = static_cast(ROT); 350| | __vector unsigned int rot = {r, r, r, r}; 351| | return SIMD_4x32(vec_rl(m_simd, rot)); 352| | 353| |#elif defined(BOTAN_SIMD_USE_NEON) 354| | 355| | #if defined(BOTAN_TARGET_ARCH_IS_ARM64) 356| | 357| | if constexpr(ROT == 8) { 358| | const uint8_t maskb[16] = {3, 0, 1, 2, 7, 4, 5, 6, 11, 8, 9, 10, 15, 12, 13, 14}; 359| | const uint8x16_t mask = vld1q_u8(maskb); 360| | return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask))); 361| | } else if constexpr(ROT == 16) { 362| | return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd)))); 363| | } 364| | #endif 365| | return SIMD_4x32( 366| | vorrq_u32(vshlq_n_u32(m_simd, static_cast(ROT)), vshrq_n_u32(m_simd, static_cast(32 - ROT)))); 367| |#elif defined(BOTAN_SIMD_USE_LSX) 368| | return SIMD_4x32(__lsx_vrotri_w(raw(), 32 - ROT)); 369| |#elif defined(BOTAN_SIMD_USE_SIMD128) 370| | return SIMD_4x32(wasm_v128_or(wasm_i32x4_shl(m_simd, ROT), wasm_u32x4_shr(m_simd, 32 - ROT))); 371| |#endif 372| 200| } _ZNK5Botan9SIMD_4x32orERKS0_: 412| 314| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 operator|(const SIMD_4x32& other) const noexcept { 413| 314| SIMD_4x32 retval(*this); 414| 314| retval |= other; 415| 314| return retval; 416| 314| } _ZN5Botan9SIMD_4x32oRERKS0_: 471| 314| void BOTAN_FN_ISA_SIMD_4X32 operator|=(const SIMD_4x32& other) noexcept { 472| 314|#if defined(BOTAN_SIMD_USE_SSSE3) 473| 314| m_simd = _mm_or_si128(m_simd, other.m_simd); 474| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 475| | m_simd = vec_or(m_simd, other.m_simd); 476| |#elif defined(BOTAN_SIMD_USE_NEON) 477| | m_simd = vorrq_u32(m_simd, other.m_simd); 478| |#elif defined(BOTAN_SIMD_USE_LSX) 479| | m_simd = __lsx_vor_v(m_simd, other.m_simd); 480| |#elif defined(BOTAN_SIMD_USE_SIMD128) 481| | m_simd = wasm_v128_or(m_simd, other.m_simd); 482| |#endif 483| 314| } _ZNK5Botan9SIMD_4x328store_leEPh: 234| 1.78M| void BOTAN_FN_ISA_SIMD_4X32 store_le(uint8_t out[]) const noexcept { 235| 1.78M|#if defined(BOTAN_SIMD_USE_SSSE3) 236| | 237| 1.78M| _mm_storeu_si128(reinterpret_cast<__m128i*>(out), raw()); 238| | 239| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 240| | 241| | union { 242| | __vector unsigned int V; 243| | uint32_t R[4]; 244| | } vec{}; 245| | 246| | // NOLINTNEXTLINE(*-union-access) 247| | vec.V = raw(); 248| | // NOLINTNEXTLINE(*-union-access) 249| | Botan::store_le(out, vec.R[0], vec.R[1], vec.R[2], vec.R[3]); 250| | 251| |#elif defined(BOTAN_SIMD_USE_NEON) 252| | if constexpr(std::endian::native == std::endian::little) { 253| | vst1q_u8(out, vreinterpretq_u8_u32(m_simd)); 254| | } else { 255| | vst1q_u8(out, vreinterpretq_u8_u32(bswap().m_simd)); 256| | } 257| |#elif defined(BOTAN_SIMD_USE_LSX) 258| | __lsx_vst(raw(), out, 0); 259| |#elif defined(BOTAN_SIMD_USE_SIMD128) 260| | wasm_v128_store(out, m_simd); 261| |#endif 262| 1.78M| } _ZN5Botan9SIMD_4x327load_beEPKv: 189| 439k| static SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 load_be(const void* in) noexcept { 190| 439k|#if defined(BOTAN_SIMD_USE_SSSE3) || defined(BOTAN_SIMD_USE_LSX) || defined(BOTAN_SIMD_USE_SIMD128) 191| 439k| return load_le(in).bswap(); 192| | 193| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 194| | uint32_t R0 = Botan::load_be(reinterpret_cast(in), 0); 195| | uint32_t R1 = Botan::load_be(reinterpret_cast(in), 1); 196| | uint32_t R2 = Botan::load_be(reinterpret_cast(in), 2); 197| | uint32_t R3 = Botan::load_be(reinterpret_cast(in), 3); 198| | __vector unsigned int val = {R0, R1, R2, R3}; 199| | return SIMD_4x32(val); 200| | 201| |#elif defined(BOTAN_SIMD_USE_NEON) 202| | SIMD_4x32 l(vld1q_u32(static_cast(in))); 203| | if constexpr(std::endian::native == std::endian::little) { 204| | return l.bswap(); 205| | } else { 206| | return l; 207| | } 208| |#endif 209| 439k| } _ZNK5Botan9SIMD_4x328store_leEPj: 219| 1.76M| void BOTAN_FN_ISA_SIMD_4X32 store_le(uint32_t out[4]) const noexcept { 220| 1.76M| this->store_le(reinterpret_cast(out)); 221| 1.76M| } _ZNK5Botan9SIMD_4x328store_leEPm: 227| 668| void BOTAN_FN_ISA_SIMD_4X32 store_le(uint64_t out[2]) const noexcept { 228| 668| this->store_le(reinterpret_cast(out)); 229| 668| } _ZNK5Botan9SIMD_4x328store_beEPh: 267| 160| BOTAN_FN_ISA_SIMD_4X32 void store_be(uint8_t out[]) const noexcept { 268| 160|#if defined(BOTAN_SIMD_USE_SSSE3) || defined(BOTAN_SIMD_USE_LSX) || defined(BOTAN_SIMD_USE_SIMD128) 269| | 270| 160| bswap().store_le(out); 271| | 272| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 273| | 274| | union { 275| | __vector unsigned int V; 276| | uint32_t R[4]; 277| | } vec{}; 278| | 279| | // NOLINTNEXTLINE(*-union-access) 280| | vec.V = m_simd; 281| | // NOLINTNEXTLINE(*-union-access) 282| | Botan::store_be(out, vec.R[0], vec.R[1], vec.R[2], vec.R[3]); 283| | 284| |#elif defined(BOTAN_SIMD_USE_NEON) 285| | if constexpr(std::endian::native == std::endian::little) { 286| | vst1q_u8(out, vreinterpretq_u8_u32(bswap().m_simd)); 287| | } else { 288| | vst1q_u8(out, vreinterpretq_u8_u32(m_simd)); 289| | } 290| |#endif 291| 160| } _ZNK5Botan9SIMD_4x32plERKS0_: 385| 1.75M| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 operator+(const SIMD_4x32& other) const noexcept { 386| 1.75M| SIMD_4x32 retval(*this); 387| 1.75M| retval += other; 388| 1.75M| return retval; 389| 1.75M| } _ZN5Botan9SIMD_4x32pLERKS0_: 427| 7.02M| void BOTAN_FN_ISA_SIMD_4X32 operator+=(const SIMD_4x32& other) noexcept { 428| 7.02M|#if defined(BOTAN_SIMD_USE_SSSE3) 429| 7.02M| m_simd = _mm_add_epi32(m_simd, other.m_simd); 430| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 431| | m_simd = vec_add(m_simd, other.m_simd); 432| |#elif defined(BOTAN_SIMD_USE_NEON) 433| | m_simd = vaddq_u32(m_simd, other.m_simd); 434| |#elif defined(BOTAN_SIMD_USE_LSX) 435| | m_simd = __lsx_vadd_w(m_simd, other.m_simd); 436| |#elif defined(BOTAN_SIMD_USE_SIMD128) 437| | m_simd = wasm_i32x4_add(m_simd, other.m_simd); 438| |#endif 439| 7.02M| } _ZNK5Botan9SIMD_4x325bswapEv: 576| 439k| BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32 bswap() const noexcept { 577| 439k|#if defined(BOTAN_SIMD_USE_SSSE3) 578| 439k| const auto idx = _mm_set_epi8(12, 13, 14, 15, 8, 9, 10, 11, 4, 5, 6, 7, 0, 1, 2, 3); 579| | 580| 439k| return SIMD_4x32(_mm_shuffle_epi8(raw(), idx)); 581| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 582| | #ifdef BOTAN_SIMD_USE_VSX 583| | return SIMD_4x32(vec_revb(m_simd)); 584| | #else 585| | const __vector unsigned char rev[1] = { 586| | {3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12}, 587| | }; 588| | 589| | return SIMD_4x32(vec_perm(m_simd, m_simd, rev[0])); 590| | #endif 591| | 592| |#elif defined(BOTAN_SIMD_USE_NEON) 593| | return SIMD_4x32(vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(m_simd)))); 594| |#elif defined(BOTAN_SIMD_USE_LSX) 595| | return SIMD_4x32(__lsx_vshuf4i_b(m_simd, 0b00011011)); 596| |#elif defined(BOTAN_SIMD_USE_SIMD128) 597| | return SIMD_4x32(wasm_i8x16_shuffle(m_simd, m_simd, 3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12)); 598| |#endif 599| 439k| } _ZN5Botan9SIMD_4x329transposeERS0_S1_S1_S1_: 684| 1.20k| SIMD_4x32& B3) noexcept { 685| 1.20k|#if defined(BOTAN_SIMD_USE_SSSE3) 686| 1.20k| const __m128i T0 = _mm_unpacklo_epi32(B0.m_simd, B1.m_simd); 687| 1.20k| const __m128i T1 = _mm_unpacklo_epi32(B2.m_simd, B3.m_simd); 688| 1.20k| const __m128i T2 = _mm_unpackhi_epi32(B0.m_simd, B1.m_simd); 689| 1.20k| const __m128i T3 = _mm_unpackhi_epi32(B2.m_simd, B3.m_simd); 690| | 691| 1.20k| B0.m_simd = _mm_unpacklo_epi64(T0, T1); 692| 1.20k| B1.m_simd = _mm_unpackhi_epi64(T0, T1); 693| 1.20k| B2.m_simd = _mm_unpacklo_epi64(T2, T3); 694| 1.20k| B3.m_simd = _mm_unpackhi_epi64(T2, T3); 695| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 696| | const __vector unsigned int T0 = vec_mergeh(B0.m_simd, B2.m_simd); 697| | const __vector unsigned int T1 = vec_mergeh(B1.m_simd, B3.m_simd); 698| | const __vector unsigned int T2 = vec_mergel(B0.m_simd, B2.m_simd); 699| | const __vector unsigned int T3 = vec_mergel(B1.m_simd, B3.m_simd); 700| | 701| | B0.m_simd = vec_mergeh(T0, T1); 702| | B1.m_simd = vec_mergel(T0, T1); 703| | B2.m_simd = vec_mergeh(T2, T3); 704| | B3.m_simd = vec_mergel(T2, T3); 705| | 706| |#elif defined(BOTAN_SIMD_USE_NEON) && defined(BOTAN_TARGET_ARCH_IS_ARM32) 707| | const uint32x4x2_t T0 = vzipq_u32(B0.m_simd, B2.m_simd); 708| | const uint32x4x2_t T1 = vzipq_u32(B1.m_simd, B3.m_simd); 709| | const uint32x4x2_t O0 = vzipq_u32(T0.val[0], T1.val[0]); 710| | const uint32x4x2_t O1 = vzipq_u32(T0.val[1], T1.val[1]); 711| | 712| | B0.m_simd = O0.val[0]; 713| | B1.m_simd = O0.val[1]; 714| | B2.m_simd = O1.val[0]; 715| | B3.m_simd = O1.val[1]; 716| | 717| |#elif defined(BOTAN_SIMD_USE_NEON) && defined(BOTAN_TARGET_ARCH_IS_ARM64) 718| | const uint32x4_t T0 = vzip1q_u32(B0.m_simd, B2.m_simd); 719| | const uint32x4_t T2 = vzip2q_u32(B0.m_simd, B2.m_simd); 720| | const uint32x4_t T1 = vzip1q_u32(B1.m_simd, B3.m_simd); 721| | const uint32x4_t T3 = vzip2q_u32(B1.m_simd, B3.m_simd); 722| | 723| | B0.m_simd = vzip1q_u32(T0, T1); 724| | B1.m_simd = vzip2q_u32(T0, T1); 725| | B2.m_simd = vzip1q_u32(T2, T3); 726| | B3.m_simd = vzip2q_u32(T2, T3); 727| |#elif defined(BOTAN_SIMD_USE_LSX) 728| | const __m128i T0 = __lsx_vilvl_w(B2.raw(), B0.raw()); 729| | const __m128i T1 = __lsx_vilvh_w(B2.raw(), B0.raw()); 730| | const __m128i T2 = __lsx_vilvl_w(B3.raw(), B1.raw()); 731| | const __m128i T3 = __lsx_vilvh_w(B3.raw(), B1.raw()); 732| | B0.m_simd = __lsx_vilvl_w(T2, T0); 733| | B1.m_simd = __lsx_vilvh_w(T2, T0); 734| | B2.m_simd = __lsx_vilvl_w(T3, T1); 735| | B3.m_simd = __lsx_vilvh_w(T3, T1); 736| |#elif defined(BOTAN_SIMD_USE_SIMD128) 737| | const auto T0 = wasm_i32x4_shuffle(B0.m_simd, B2.m_simd, 0, 4, 1, 5); 738| | const auto T2 = wasm_i32x4_shuffle(B0.m_simd, B2.m_simd, 2, 6, 3, 7); 739| | const auto T1 = wasm_i32x4_shuffle(B1.m_simd, B3.m_simd, 0, 4, 1, 5); 740| | const auto T3 = wasm_i32x4_shuffle(B1.m_simd, B3.m_simd, 2, 6, 3, 7); 741| | 742| | B0.m_simd = wasm_i32x4_shuffle(T0, T1, 0, 4, 1, 5); 743| | B1.m_simd = wasm_i32x4_shuffle(T0, T1, 2, 6, 3, 7); 744| | B2.m_simd = wasm_i32x4_shuffle(T2, T3, 0, 4, 1, 5); 745| | B3.m_simd = wasm_i32x4_shuffle(T2, T3, 2, 6, 3, 7); 746| |#endif 747| 1.20k| } _ZNK5Botan9SIMD_4x3212top_bit_maskEv: 931| 114| inline SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 top_bit_mask() const { 932| 114|#if defined(BOTAN_SIMD_USE_SSSE3) 933| 114| return SIMD_4x32(_mm_shuffle_epi32(_mm_srai_epi32(raw(), 31), 0b11111111)); 934| |#elif defined(BOTAN_SIMD_USE_NEON) 935| | #if defined(BOTAN_TARGET_ARCH_IS_ARM32) 936| | int32x4_t v = vshrq_n_s32(vreinterpretq_s32_u32(raw()), 31); 937| | int32x2_t hi = vget_high_s32(v); 938| | return SIMD_4x32(vreinterpretq_u32_s32(vdupq_lane_s32(hi, 1))); 939| | #else 940| | return SIMD_4x32(vreinterpretq_u32_s32(vdupq_laneq_s32(vshrq_n_s32(vreinterpretq_s32_u32(raw()), 31), 3))); 941| | #endif 942| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 943| | const __vector unsigned int shift = vec_splats(31U); 944| | const __vector signed int shifted = vec_sra(reinterpret_cast<__vector signed int>(raw()), shift); 945| | return SIMD_4x32(reinterpret_cast<__vector unsigned int>(vec_splat(shifted, 3))); 946| |#elif defined(BOTAN_SIMD_USE_LSX) 947| | return SIMD_4x32(__lsx_vshuf4i_w(__lsx_vsrai_w(raw(), 31), 0xFF)); 948| |#elif defined(BOTAN_SIMD_USE_SIMD128) 949| | return SIMD_4x32(wasm_i32x4_splat(wasm_i32x4_extract_lane(wasm_i32x4_shr(raw(), 31), 3))); 950| |#endif 951| 114| } _ZNK5Botan9SIMD_4x324rotlILm8EEES0_vQaagtT_Li0EltT_Li32E: 331| 2.08k| { 332| 2.08k|#if defined(BOTAN_SIMD_USE_SSSE3) 333| 2.08k| if constexpr(ROT == 8) { 334| 2.08k| const auto shuf_rotl_8 = _mm_set_epi64x(0x0e0d0c0f0a09080b, 0x0605040702010003); 335| 2.08k| return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_8)); 336| | } else if constexpr(ROT == 16) { 337| | const auto shuf_rotl_16 = _mm_set_epi64x(0x0d0c0f0e09080b0a, 0x0504070601000302); 338| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_16)); 339| | } else if constexpr(ROT == 24) { 340| | const auto shuf_rotl_24 = _mm_set_epi64x(0x0c0f0e0d080b0a09, 0x0407060500030201); 341| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_24)); 342| | } else { 343| | return SIMD_4x32(_mm_xor_si128(_mm_slli_epi32(raw(), static_cast(ROT)), 344| | _mm_srli_epi32(raw(), static_cast(32 - ROT)))); 345| | } 346| | 347| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 348| | 349| | const unsigned int r = static_cast(ROT); 350| | __vector unsigned int rot = {r, r, r, r}; 351| | return SIMD_4x32(vec_rl(m_simd, rot)); 352| | 353| |#elif defined(BOTAN_SIMD_USE_NEON) 354| | 355| | #if defined(BOTAN_TARGET_ARCH_IS_ARM64) 356| | 357| | if constexpr(ROT == 8) { 358| | const uint8_t maskb[16] = {3, 0, 1, 2, 7, 4, 5, 6, 11, 8, 9, 10, 15, 12, 13, 14}; 359| | const uint8x16_t mask = vld1q_u8(maskb); 360| | return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask))); 361| | } else if constexpr(ROT == 16) { 362| | return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd)))); 363| | } 364| | #endif 365| | return SIMD_4x32( 366| | vorrq_u32(vshlq_n_u32(m_simd, static_cast(ROT)), vshrq_n_u32(m_simd, static_cast(32 - ROT)))); 367| |#elif defined(BOTAN_SIMD_USE_LSX) 368| | return SIMD_4x32(__lsx_vrotri_w(raw(), 32 - ROT)); 369| |#elif defined(BOTAN_SIMD_USE_SIMD128) 370| | return SIMD_4x32(wasm_v128_or(wasm_i32x4_shl(m_simd, ROT), wasm_u32x4_shr(m_simd, 32 - ROT))); 371| |#endif 372| 2.08k| } _ZNK5Botan9SIMD_4x324rotlILm24EEES0_vQaagtT_Li0EltT_Li32E: 331| 2.08k| { 332| 2.08k|#if defined(BOTAN_SIMD_USE_SSSE3) 333| | if constexpr(ROT == 8) { 334| | const auto shuf_rotl_8 = _mm_set_epi64x(0x0e0d0c0f0a09080b, 0x0605040702010003); 335| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_8)); 336| | } else if constexpr(ROT == 16) { 337| | const auto shuf_rotl_16 = _mm_set_epi64x(0x0d0c0f0e09080b0a, 0x0504070601000302); 338| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_16)); 339| 2.08k| } else if constexpr(ROT == 24) { 340| 2.08k| const auto shuf_rotl_24 = _mm_set_epi64x(0x0c0f0e0d080b0a09, 0x0407060500030201); 341| 2.08k| return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_24)); 342| | } else { 343| | return SIMD_4x32(_mm_xor_si128(_mm_slli_epi32(raw(), static_cast(ROT)), 344| | _mm_srli_epi32(raw(), static_cast(32 - ROT)))); 345| | } 346| | 347| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 348| | 349| | const unsigned int r = static_cast(ROT); 350| | __vector unsigned int rot = {r, r, r, r}; 351| | return SIMD_4x32(vec_rl(m_simd, rot)); 352| | 353| |#elif defined(BOTAN_SIMD_USE_NEON) 354| | 355| | #if defined(BOTAN_TARGET_ARCH_IS_ARM64) 356| | 357| | if constexpr(ROT == 8) { 358| | const uint8_t maskb[16] = {3, 0, 1, 2, 7, 4, 5, 6, 11, 8, 9, 10, 15, 12, 13, 14}; 359| | const uint8x16_t mask = vld1q_u8(maskb); 360| | return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask))); 361| | } else if constexpr(ROT == 16) { 362| | return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd)))); 363| | } 364| | #endif 365| | return SIMD_4x32( 366| | vorrq_u32(vshlq_n_u32(m_simd, static_cast(ROT)), vshrq_n_u32(m_simd, static_cast(32 - ROT)))); 367| |#elif defined(BOTAN_SIMD_USE_LSX) 368| | return SIMD_4x32(__lsx_vrotri_w(raw(), 32 - ROT)); 369| |#elif defined(BOTAN_SIMD_USE_SIMD128) 370| | return SIMD_4x32(wasm_v128_or(wasm_i32x4_shl(m_simd, ROT), wasm_u32x4_shr(m_simd, 32 - ROT))); 371| |#endif 372| 2.08k| } _ZNK5Botan9SIMD_4x323shlILi14EEES0_vQaagtT_Li0EltT_Li32E: 502| 1.31M| { 503| 1.31M|#if defined(BOTAN_SIMD_USE_SSSE3) 504| 1.31M| return SIMD_4x32(_mm_slli_epi32(m_simd, SHIFT)); 505| | 506| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 507| | const unsigned int s = static_cast(SHIFT); 508| | const __vector unsigned int shifts = {s, s, s, s}; 509| | return SIMD_4x32(vec_sl(m_simd, shifts)); 510| |#elif defined(BOTAN_SIMD_USE_NEON) 511| | return SIMD_4x32(vshlq_n_u32(m_simd, SHIFT)); 512| |#elif defined(BOTAN_SIMD_USE_LSX) 513| | return SIMD_4x32(__lsx_vslli_w(m_simd, SHIFT)); 514| |#elif defined(BOTAN_SIMD_USE_SIMD128) 515| | return SIMD_4x32(wasm_i32x4_shl(m_simd, SHIFT)); 516| |#endif 517| 1.31M| } _ZNK5Botan9SIMD_4x323shrILi7EEES0_v: 520| 1.31M| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shr() const noexcept { 521| 1.31M|#if defined(BOTAN_SIMD_USE_SSSE3) 522| 1.31M| return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT)); 523| | 524| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 525| | const unsigned int s = static_cast(SHIFT); 526| | const __vector unsigned int shifts = {s, s, s, s}; 527| | return SIMD_4x32(vec_sr(m_simd, shifts)); 528| |#elif defined(BOTAN_SIMD_USE_NEON) 529| | return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT)); 530| |#elif defined(BOTAN_SIMD_USE_LSX) 531| | return SIMD_4x32(__lsx_vsrli_w(m_simd, SHIFT)); 532| |#elif defined(BOTAN_SIMD_USE_SIMD128) 533| | return SIMD_4x32(wasm_u32x4_shr(m_simd, SHIFT)); 534| |#endif 535| 1.31M| } _ZNK5Botan9SIMD_4x323shrILi3EEES0_v: 520| 1.31M| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shr() const noexcept { 521| 1.31M|#if defined(BOTAN_SIMD_USE_SSSE3) 522| 1.31M| return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT)); 523| | 524| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 525| | const unsigned int s = static_cast(SHIFT); 526| | const __vector unsigned int shifts = {s, s, s, s}; 527| | return SIMD_4x32(vec_sr(m_simd, shifts)); 528| |#elif defined(BOTAN_SIMD_USE_NEON) 529| | return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT)); 530| |#elif defined(BOTAN_SIMD_USE_LSX) 531| | return SIMD_4x32(__lsx_vsrli_w(m_simd, SHIFT)); 532| |#elif defined(BOTAN_SIMD_USE_SIMD128) 533| | return SIMD_4x32(wasm_u32x4_shr(m_simd, SHIFT)); 534| |#endif 535| 1.31M| } _ZNK5Botan9SIMD_4x323shrILi11EEES0_v: 520| 1.31M| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shr() const noexcept { 521| 1.31M|#if defined(BOTAN_SIMD_USE_SSSE3) 522| 1.31M| return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT)); 523| | 524| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 525| | const unsigned int s = static_cast(SHIFT); 526| | const __vector unsigned int shifts = {s, s, s, s}; 527| | return SIMD_4x32(vec_sr(m_simd, shifts)); 528| |#elif defined(BOTAN_SIMD_USE_NEON) 529| | return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT)); 530| |#elif defined(BOTAN_SIMD_USE_LSX) 531| | return SIMD_4x32(__lsx_vsrli_w(m_simd, SHIFT)); 532| |#elif defined(BOTAN_SIMD_USE_SIMD128) 533| | return SIMD_4x32(wasm_u32x4_shr(m_simd, SHIFT)); 534| |#endif 535| 1.31M| } _ZNK5Botan9SIMD_4x323shlILi11EEES0_vQaagtT_Li0EltT_Li32E: 502| 1.31M| { 503| 1.31M|#if defined(BOTAN_SIMD_USE_SSSE3) 504| 1.31M| return SIMD_4x32(_mm_slli_epi32(m_simd, SHIFT)); 505| | 506| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 507| | const unsigned int s = static_cast(SHIFT); 508| | const __vector unsigned int shifts = {s, s, s, s}; 509| | return SIMD_4x32(vec_sl(m_simd, shifts)); 510| |#elif defined(BOTAN_SIMD_USE_NEON) 511| | return SIMD_4x32(vshlq_n_u32(m_simd, SHIFT)); 512| |#elif defined(BOTAN_SIMD_USE_LSX) 513| | return SIMD_4x32(__lsx_vslli_w(m_simd, SHIFT)); 514| |#elif defined(BOTAN_SIMD_USE_SIMD128) 515| | return SIMD_4x32(wasm_i32x4_shl(m_simd, SHIFT)); 516| |#endif 517| 1.31M| } _ZNK5Botan9SIMD_4x323shrILi10EEES0_v: 520| 2.63M| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shr() const noexcept { 521| 2.63M|#if defined(BOTAN_SIMD_USE_SSSE3) 522| 2.63M| return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT)); 523| | 524| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 525| | const unsigned int s = static_cast(SHIFT); 526| | const __vector unsigned int shifts = {s, s, s, s}; 527| | return SIMD_4x32(vec_sr(m_simd, shifts)); 528| |#elif defined(BOTAN_SIMD_USE_NEON) 529| | return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT)); 530| |#elif defined(BOTAN_SIMD_USE_LSX) 531| | return SIMD_4x32(__lsx_vsrli_w(m_simd, SHIFT)); 532| |#elif defined(BOTAN_SIMD_USE_SIMD128) 533| | return SIMD_4x32(wasm_u32x4_shr(m_simd, SHIFT)); 534| |#endif 535| 2.63M| } _ZNK5Botan9SIMD_4x3217shift_elems_rightILm2EEES0_vQleT_Li3E: 641| 11.7k| { 642| 11.7k|#if defined(BOTAN_SIMD_USE_SSSE3) 643| 11.7k| return SIMD_4x32(_mm_srli_si128(raw(), 4 * I)); 644| |#elif defined(BOTAN_SIMD_USE_NEON) 645| | return SIMD_4x32(vextq_u32(raw(), vdupq_n_u32(0), I)); 646| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 647| | const __vector unsigned int zero = vec_splat_u32(0); 648| | 649| | const __vector unsigned char shuf[3] = { 650| | {4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19}, 651| | {8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23}, 652| | {12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27}, 653| | }; 654| | 655| | return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1])); 656| |#elif defined(BOTAN_SIMD_USE_LSX) 657| | return SIMD_4x32(__lsx_vbsrl_v(raw(), 4 * I)); 658| |#elif defined(BOTAN_SIMD_USE_SIMD128) 659| | if constexpr(I == 0) { 660| | return SIMD_4x32(m_simd); 661| | } 662| | 663| | const auto zero = wasm_u32x4_const_splat(0); 664| | if constexpr(I == 1) { 665| | return SIMD_4x32( 666| | wasm_i8x16_shuffle(m_simd, zero, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 16, 16, 16)); 667| | } 668| | if constexpr(I == 2) { 669| | return SIMD_4x32( 670| | wasm_i8x16_shuffle(m_simd, zero, 8, 9, 10, 11, 12, 13, 14, 15, 16, 16, 16, 16, 16, 16, 16, 16)); 671| | } 672| | 673| | return SIMD_4x32( 674| | wasm_i8x16_shuffle(m_simd, zero, 12, 13, 14, 15, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16)); 675| |#endif 676| 11.7k| } _ZNK5Botan9SIMD_4x324rotlILm16EEES0_vQaagtT_Li0EltT_Li32E: 331| 1.64k| { 332| 1.64k|#if defined(BOTAN_SIMD_USE_SSSE3) 333| | if constexpr(ROT == 8) { 334| | const auto shuf_rotl_8 = _mm_set_epi64x(0x0e0d0c0f0a09080b, 0x0605040702010003); 335| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_8)); 336| 1.64k| } else if constexpr(ROT == 16) { 337| 1.64k| const auto shuf_rotl_16 = _mm_set_epi64x(0x0d0c0f0e09080b0a, 0x0504070601000302); 338| 1.64k| return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_16)); 339| | } else if constexpr(ROT == 24) { 340| | const auto shuf_rotl_24 = _mm_set_epi64x(0x0c0f0e0d080b0a09, 0x0407060500030201); 341| | return SIMD_4x32(_mm_shuffle_epi8(raw(), shuf_rotl_24)); 342| | } else { 343| | return SIMD_4x32(_mm_xor_si128(_mm_slli_epi32(raw(), static_cast(ROT)), 344| | _mm_srli_epi32(raw(), static_cast(32 - ROT)))); 345| | } 346| | 347| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 348| | 349| | const unsigned int r = static_cast(ROT); 350| | __vector unsigned int rot = {r, r, r, r}; 351| | return SIMD_4x32(vec_rl(m_simd, rot)); 352| | 353| |#elif defined(BOTAN_SIMD_USE_NEON) 354| | 355| | #if defined(BOTAN_TARGET_ARCH_IS_ARM64) 356| | 357| | if constexpr(ROT == 8) { 358| | const uint8_t maskb[16] = {3, 0, 1, 2, 7, 4, 5, 6, 11, 8, 9, 10, 15, 12, 13, 14}; 359| | const uint8x16_t mask = vld1q_u8(maskb); 360| | return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask))); 361| | } else if constexpr(ROT == 16) { 362| | return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd)))); 363| | } 364| | #endif 365| | return SIMD_4x32( 366| | vorrq_u32(vshlq_n_u32(m_simd, static_cast(ROT)), vshrq_n_u32(m_simd, static_cast(32 - ROT)))); 367| |#elif defined(BOTAN_SIMD_USE_LSX) 368| | return SIMD_4x32(__lsx_vrotri_w(raw(), 32 - ROT)); 369| |#elif defined(BOTAN_SIMD_USE_SIMD128) 370| | return SIMD_4x32(wasm_v128_or(wasm_i32x4_shl(m_simd, ROT), wasm_u32x4_shr(m_simd, 32 - ROT))); 371| |#endif 372| 1.64k| } _ZNK5Botan9SIMD_4x3216shift_elems_leftILm2EEES0_vQleT_Li3E: 604| 1.63k| { 605| 1.63k|#if defined(BOTAN_SIMD_USE_SSSE3) 606| 1.63k| return SIMD_4x32(_mm_slli_si128(raw(), 4 * I)); 607| |#elif defined(BOTAN_SIMD_USE_NEON) 608| | return SIMD_4x32(vextq_u32(vdupq_n_u32(0), raw(), 4 - I)); 609| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 610| | const __vector unsigned int zero = vec_splat_u32(0); 611| | 612| | const __vector unsigned char shuf[3] = { 613| | {16, 17, 18, 19, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 614| | {16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3, 4, 5, 6, 7}, 615| | {16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 0, 1, 2, 3}, 616| | }; 617| | 618| | return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1])); 619| |#elif defined(BOTAN_SIMD_USE_LSX) 620| | return SIMD_4x32(__lsx_vbsll_v(raw(), 4 * I)); 621| |#elif defined(BOTAN_SIMD_USE_SIMD128) 622| | if constexpr(I == 0) { 623| | return SIMD_4x32(m_simd); 624| | } 625| | 626| | const auto zero = wasm_u32x4_const_splat(0); 627| | if constexpr(I == 1) { 628| | return SIMD_4x32(wasm_i8x16_shuffle(m_simd, zero, 16, 16, 16, 16, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11)); 629| | } 630| | if constexpr(I == 2) { 631| | return SIMD_4x32(wasm_i8x16_shuffle(m_simd, zero, 16, 16, 16, 16, 16, 16, 16, 16, 0, 1, 2, 3, 4, 5, 6, 7)); 632| | } 633| | 634| | return SIMD_4x32(wasm_i8x16_shuffle(m_simd, zero, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 0, 1, 2, 3)); 635| |#endif 636| 1.63k| } _ZNK5Botan9SIMD_4x323shrILi31EEES0_v: 520| 114| SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shr() const noexcept { 521| 114|#if defined(BOTAN_SIMD_USE_SSSE3) 522| 114| return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT)); 523| | 524| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 525| | const unsigned int s = static_cast(SHIFT); 526| | const __vector unsigned int shifts = {s, s, s, s}; 527| | return SIMD_4x32(vec_sr(m_simd, shifts)); 528| |#elif defined(BOTAN_SIMD_USE_NEON) 529| | return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT)); 530| |#elif defined(BOTAN_SIMD_USE_LSX) 531| | return SIMD_4x32(__lsx_vsrli_w(m_simd, SHIFT)); 532| |#elif defined(BOTAN_SIMD_USE_SIMD128) 533| | return SIMD_4x32(wasm_u32x4_shr(m_simd, SHIFT)); 534| |#endif 535| 114| } _ZNK5Botan9SIMD_4x3216shift_elems_leftILm1EEES0_vQleT_Li3E: 604| 13.2k| { 605| 13.2k|#if defined(BOTAN_SIMD_USE_SSSE3) 606| 13.2k| return SIMD_4x32(_mm_slli_si128(raw(), 4 * I)); 607| |#elif defined(BOTAN_SIMD_USE_NEON) 608| | return SIMD_4x32(vextq_u32(vdupq_n_u32(0), raw(), 4 - I)); 609| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 610| | const __vector unsigned int zero = vec_splat_u32(0); 611| | 612| | const __vector unsigned char shuf[3] = { 613| | {16, 17, 18, 19, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 614| | {16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3, 4, 5, 6, 7}, 615| | {16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 0, 1, 2, 3}, 616| | }; 617| | 618| | return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1])); 619| |#elif defined(BOTAN_SIMD_USE_LSX) 620| | return SIMD_4x32(__lsx_vbsll_v(raw(), 4 * I)); 621| |#elif defined(BOTAN_SIMD_USE_SIMD128) 622| | if constexpr(I == 0) { 623| | return SIMD_4x32(m_simd); 624| | } 625| | 626| | const auto zero = wasm_u32x4_const_splat(0); 627| | if constexpr(I == 1) { 628| | return SIMD_4x32(wasm_i8x16_shuffle(m_simd, zero, 16, 16, 16, 16, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11)); 629| | } 630| | if constexpr(I == 2) { 631| | return SIMD_4x32(wasm_i8x16_shuffle(m_simd, zero, 16, 16, 16, 16, 16, 16, 16, 16, 0, 1, 2, 3, 4, 5, 6, 7)); 632| | } 633| | 634| | return SIMD_4x32(wasm_i8x16_shuffle(m_simd, zero, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 0, 1, 2, 3)); 635| |#endif 636| 13.2k| } _ZNK5Botan9SIMD_4x323shlILi1EEES0_vQaagtT_Li0EltT_Li32E: 502| 114| { 503| 114|#if defined(BOTAN_SIMD_USE_SSSE3) 504| 114| return SIMD_4x32(_mm_slli_epi32(m_simd, SHIFT)); 505| | 506| |#elif defined(BOTAN_SIMD_USE_ALTIVEC) 507| | const unsigned int s = static_cast(SHIFT); 508| | const __vector unsigned int shifts = {s, s, s, s}; 509| | return SIMD_4x32(vec_sl(m_simd, shifts)); 510| |#elif defined(BOTAN_SIMD_USE_NEON) 511| | return SIMD_4x32(vshlq_n_u32(m_simd, SHIFT)); 512| |#elif defined(BOTAN_SIMD_USE_LSX) 513| | return SIMD_4x32(__lsx_vslli_w(m_simd, SHIFT)); 514| |#elif defined(BOTAN_SIMD_USE_SIMD128) 515| | return SIMD_4x32(wasm_i32x4_shl(m_simd, SHIFT)); 516| |#endif 517| 114| } _ZN5Botan9SIMD_4x64C2Ev: 34| 5.24k| BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64() : m_simd(_mm256_setzero_si256()) {} _ZNK5Botan9SIMD_4x645bswapEv: 56| 5.24k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 bswap() const { 57| 5.24k| const auto idx = _mm256_set_epi8( 58| 5.24k| 8, 9, 10, 11, 12, 13, 14, 15, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 0, 1, 2, 3, 4, 5, 6, 7); 59| | 60| 5.24k| return SIMD_4x64(_mm256_shuffle_epi8(m_simd, idx)); 61| 5.24k| } _ZN5Botan9SIMD_4x64C2EDv4_x: 196| 204k| explicit BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64(__m256i x) : m_simd(x) {} _ZN5Botan9SIMD_4x64eOERKS0_: 103| 83.8k| BOTAN_FN_ISA_SIMD_4X64 void operator^=(const SIMD_4x64& other) { 104| 83.8k| m_simd = _mm256_xor_si256(m_simd, other.m_simd); 105| 83.8k| } _ZNK5Botan9SIMD_4x64eoERKS0_: 81| 83.8k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 operator^(const SIMD_4x64& other) const { 82| 83.8k| SIMD_4x64 retval(*this); 83| 83.8k| retval ^= other; 84| 83.8k| return retval; 85| 83.8k| } _ZN5Botan9SIMD_4x648load_le2EPKvS2_: 37| 5.24k| static BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64 load_le2(const void* lo, const void* hi) { 38| 5.24k| return SIMD_4x64( 39| 5.24k| _mm256_loadu2_m128i(reinterpret_cast(lo), reinterpret_cast(hi))); 40| 5.24k| } _ZN5Botan9SIMD_4x648load_be2EPKvS2_: 42| 5.24k| static BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64 load_be2(const void* lo, const void* hi) { 43| 5.24k| return SIMD_4x64::load_le2(lo, hi).bswap(); 44| 5.24k| } _ZN5Botan9SIMD_4x6414broadcast_2x64EPKm: 52| 26.2k| static BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64 broadcast_2x64(const uint64_t* in) { 53| 26.2k| return SIMD_4x64(_mm256_broadcastsi128_si256(_mm_loadu_si128(reinterpret_cast(in)))); 54| 26.2k| } _ZN5Botan9SIMD_4x649store_le2EPvS1_: 69| 26.2k| BOTAN_FN_ISA_SIMD_4X64 void store_le2(void* outh, void* outl) { 70| 26.2k| _mm256_storeu2_m128i(reinterpret_cast<__m128i*>(outh), reinterpret_cast<__m128i*>(outl), m_simd); 71| 26.2k| } _ZNK5Botan9SIMD_4x64plERKS0_: 75| 89.0k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 operator+(const SIMD_4x64& other) const { 76| 89.0k| SIMD_4x64 retval(*this); 77| 89.0k| retval += other; 78| 89.0k| return retval; 79| 89.0k| } _ZN5Botan9SIMD_4x64pLERKS0_: 99| 89.0k| BOTAN_FN_ISA_SIMD_4X64 void operator+=(const SIMD_4x64& other) { 100| 89.0k| m_simd = _mm256_add_epi64(m_simd, other.m_simd); 101| 89.0k| } _ZN5Botan9SIMD_4x647alignr8ERKS0_S2_: 162| 41.9k| static SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 alignr8(const SIMD_4x64& a, const SIMD_4x64& b) { 163| | return SIMD_4x64(_mm256_alignr_epi8(a.m_simd, b.m_simd, 8)); 164| 41.9k| } _ZNK5Botan9SIMD_4x644rotrILm1EEES0_vQaagtT_Li0EltT_Li64E: 116| 20.9k| { 117| |#if defined(__AVX512VL__) 118| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 119| |#else 120| | if constexpr(ROT == 8) { 121| | auto shuf_rot_8 = 122| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 123| | 124| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 125| | } else if constexpr(ROT == 16) { 126| | auto shuf_rot_16 = 127| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 128| | 129| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 130| | } else if constexpr(ROT == 24) { 131| | auto shuf_rot_24 = 132| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 133| | 134| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 135| | } else if constexpr(ROT == 32) { 136| | auto shuf_rot_32 = 137| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 138| | 139| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 140| 20.9k| } else { 141| 20.9k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 142| 20.9k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 143| 20.9k| } 144| 20.9k|#endif 145| 20.9k| } _ZNK5Botan9SIMD_4x644rotrILm8EEES0_vQaagtT_Li0EltT_Li64E: 116| 20.9k| { 117| |#if defined(__AVX512VL__) 118| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 119| |#else 120| 20.9k| if constexpr(ROT == 8) { 121| 20.9k| auto shuf_rot_8 = 122| 20.9k| _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 123| | 124| 20.9k| return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 125| | } else if constexpr(ROT == 16) { 126| | auto shuf_rot_16 = 127| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 128| | 129| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 130| | } else if constexpr(ROT == 24) { 131| | auto shuf_rot_24 = 132| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 133| | 134| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 135| | } else if constexpr(ROT == 32) { 136| | auto shuf_rot_32 = 137| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 138| | 139| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 140| | } else { 141| | return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 142| | _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 143| | } 144| 20.9k|#endif 145| 20.9k| } _ZNK5Botan9SIMD_4x643shrILi7EEES0_v: 153| 20.9k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 shr() const noexcept { 154| 20.9k| return SIMD_4x64(_mm256_srli_epi64(m_simd, SHIFT)); 155| 20.9k| } _ZNK5Botan9SIMD_4x644rotrILm19EEES0_vQaagtT_Li0EltT_Li64E: 116| 20.9k| { 117| |#if defined(__AVX512VL__) 118| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 119| |#else 120| | if constexpr(ROT == 8) { 121| | auto shuf_rot_8 = 122| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 123| | 124| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 125| | } else if constexpr(ROT == 16) { 126| | auto shuf_rot_16 = 127| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 128| | 129| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 130| | } else if constexpr(ROT == 24) { 131| | auto shuf_rot_24 = 132| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 133| | 134| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 135| | } else if constexpr(ROT == 32) { 136| | auto shuf_rot_32 = 137| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 138| | 139| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 140| 20.9k| } else { 141| 20.9k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 142| 20.9k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 143| 20.9k| } 144| 20.9k|#endif 145| 20.9k| } _ZNK5Botan9SIMD_4x644rotrILm61EEES0_vQaagtT_Li0EltT_Li64E: 116| 20.9k| { 117| |#if defined(__AVX512VL__) 118| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 119| |#else 120| | if constexpr(ROT == 8) { 121| | auto shuf_rot_8 = 122| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 123| | 124| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 125| | } else if constexpr(ROT == 16) { 126| | auto shuf_rot_16 = 127| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 128| | 129| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 130| | } else if constexpr(ROT == 24) { 131| | auto shuf_rot_24 = 132| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 133| | 134| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 135| | } else if constexpr(ROT == 32) { 136| | auto shuf_rot_32 = 137| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 138| | 139| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 140| 20.9k| } else { 141| 20.9k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 142| 20.9k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 143| 20.9k| } 144| 20.9k|#endif 145| 20.9k| } _ZNK5Botan9SIMD_4x643shrILi6EEES0_v: 153| 20.9k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 shr() const noexcept { 154| 20.9k| return SIMD_4x64(_mm256_srli_epi64(m_simd, SHIFT)); 155| 20.9k| } _ZN5Botan9SIMD_8x32C2Ev: 30| 87.2k| BOTAN_FORCE_INLINE SIMD_8x32() noexcept : m_avx2(_mm256_setzero_si256()) {} _ZN5Botan9SIMD_8x32C2Ejjjjjjjj: 46| 104k| uint32_t B7) noexcept { 47| | // NOLINTNEXTLINE(*-prefer-member-initializer) 48| 104k| m_avx2 = _mm256_set_epi32(B7, B6, B5, B4, B3, B2, B1, B0); 49| 104k| } _ZN5Botan9SIMD_8x32C2Ejjjj: 52| 523k| explicit SIMD_8x32(uint32_t B0, uint32_t B1, uint32_t B2, uint32_t B3) noexcept { 53| | // NOLINTNEXTLINE(*-prefer-member-initializer) 54| 523k| m_avx2 = _mm256_set_epi32(B3, B2, B1, B0, B3, B2, B1, B0); 55| 523k| } _ZN5Botan9SIMD_8x325splatEj: 58| 684k| static SIMD_8x32 splat(uint32_t B) noexcept { return SIMD_8x32(_mm256_set1_epi32(B)); } _ZN5Botan9SIMD_8x327load_leEPKh: 61| 105k| static SIMD_8x32 load_le(const uint8_t* in) noexcept { 62| 105k| return SIMD_8x32(_mm256_loadu_si256(reinterpret_cast(in))); 63| 105k| } _ZN5Botan9SIMD_8x3210load_le128EPKh: 71| 32| static SIMD_8x32 load_le128(const uint8_t* in) noexcept { 72| 32| return SIMD_8x32(_mm256_broadcastsi128_si256(_mm_loadu_si128(reinterpret_cast(in)))); 73| 32| } _ZN5Botan9SIMD_8x3210load_le128EPKj: 76| 348k| static SIMD_8x32 load_le128(const uint32_t* in) noexcept { 77| 348k| return SIMD_8x32(_mm256_broadcastsi128_si256(_mm_loadu_si128(reinterpret_cast(in)))); 78| 348k| } _ZN5Botan9SIMD_8x327load_beEPKh: 81| 101k| static SIMD_8x32 load_be(const uint8_t* in) noexcept { return load_le(in).bswap(); } _ZNK5Botan9SIMD_8x328store_leEPh: 84| 48.0k| void store_le(uint8_t out[]) const noexcept { _mm256_storeu_si256(reinterpret_cast<__m256i*>(out), m_avx2); } _ZNK5Botan9SIMD_8x328store_leEPj: 87| 507k| void store_le(uint32_t out[]) const noexcept { _mm256_storeu_si256(reinterpret_cast<__m256i*>(out), m_avx2); } _ZN5Botan9SIMD_8x3210load_be128EPKhS2_: 101| 166k| static SIMD_8x32 load_be128(const uint8_t in1[], const uint8_t in2[]) noexcept { 102| 166k| return SIMD_8x32( 103| 166k| _mm256_loadu2_m128i(reinterpret_cast(in2), reinterpret_cast(in1))) 104| 166k| .bswap(); 105| 166k| } _ZNK5Botan9SIMD_8x3211store_le128EPjS1_: 108| 745k| void store_le128(uint32_t out1[], uint32_t out2[]) const noexcept { 109| 745k| _mm256_storeu2_m128i(reinterpret_cast<__m128i*>(out2), reinterpret_cast<__m128i*>(out1), raw()); 110| 745k| } _ZNK5Botan9SIMD_8x32plERKS0_: 164| 1.25M| SIMD_8x32 operator+(const SIMD_8x32& other) const noexcept { 165| 1.25M| SIMD_8x32 retval(*this); 166| 1.25M| retval += other; 167| 1.25M| return retval; 168| 1.25M| } _ZNK5Botan9SIMD_8x32miERKS0_: 171| 2.75k| SIMD_8x32 operator-(const SIMD_8x32& other) const noexcept { 172| 2.75k| SIMD_8x32 retval(*this); 173| 2.75k| retval -= other; 174| 2.75k| return retval; 175| 2.75k| } _ZNK5Botan9SIMD_8x32eoERKS0_: 178| 1.71M| SIMD_8x32 operator^(const SIMD_8x32& other) const noexcept { 179| 1.71M| SIMD_8x32 retval(*this); 180| 1.71M| retval ^= other; 181| 1.71M| return retval; 182| 1.71M| } _ZN5Botan9SIMD_8x32pLERKS0_: 199| 3.22M| void operator+=(const SIMD_8x32& other) { m_avx2 = _mm256_add_epi32(m_avx2, other.m_avx2); } _ZN5Botan9SIMD_8x32mIERKS0_: 202| 2.75k| void operator-=(const SIMD_8x32& other) { m_avx2 = _mm256_sub_epi32(m_avx2, other.m_avx2); } _ZN5Botan9SIMD_8x32eOERKS0_: 205| 6.27M| void operator^=(const SIMD_8x32& other) { m_avx2 = _mm256_xor_si256(m_avx2, other.m_avx2); } _ZNK5Botan9SIMD_8x325bswapEv: 238| 268k| SIMD_8x32 bswap() const noexcept { 239| 268k| alignas(32) const uint8_t BSWAP_TBL[32] = {3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12, 240| 268k| 19, 18, 17, 16, 23, 22, 21, 20, 27, 26, 25, 24, 31, 30, 29, 28}; 241| | 242| 268k| const __m256i bswap = _mm256_load_si256(reinterpret_cast(BSWAP_TBL)); 243| | 244| 268k| const __m256i output = _mm256_shuffle_epi8(m_avx2, bswap); 245| | 246| 268k| return SIMD_8x32(output); 247| 268k| } _ZN5Botan9SIMD_8x329transposeERS0_S1_S1_S1_: 264| 11.0k| static void transpose(SIMD_8x32& B0, SIMD_8x32& B1, SIMD_8x32& B2, SIMD_8x32& B3) noexcept { 265| 11.0k| const __m256i T0 = _mm256_unpacklo_epi32(B0.m_avx2, B1.m_avx2); 266| 11.0k| const __m256i T1 = _mm256_unpacklo_epi32(B2.m_avx2, B3.m_avx2); 267| 11.0k| const __m256i T2 = _mm256_unpackhi_epi32(B0.m_avx2, B1.m_avx2); 268| 11.0k| const __m256i T3 = _mm256_unpackhi_epi32(B2.m_avx2, B3.m_avx2); 269| | 270| 11.0k| B0.m_avx2 = _mm256_unpacklo_epi64(T0, T1); 271| 11.0k| B1.m_avx2 = _mm256_unpackhi_epi64(T0, T1); 272| 11.0k| B2.m_avx2 = _mm256_unpacklo_epi64(T2, T3); 273| 11.0k| B3.m_avx2 = _mm256_unpackhi_epi64(T2, T3); 274| 11.0k| } _ZN5Botan9SIMD_8x329transposeERS0_S1_S1_S1_S1_S1_S1_S1_: 302| 5.50k| SIMD_8x32& B7) noexcept { 303| 5.50k| transpose(B0, B1, B2, B3); 304| 5.50k| transpose(B4, B5, B6, B7); 305| | 306| 5.50k| swap_tops(B0, B4); 307| 5.50k| swap_tops(B1, B5); 308| 5.50k| swap_tops(B2, B6); 309| 5.50k| swap_tops(B3, B7); 310| 5.50k| } _ZNK5Botan9SIMD_8x3211unsigned_ltERKS0_: 317| 2.75k| SIMD_8x32 BOTAN_FN_ISA_AVX2 unsigned_lt(const SIMD_8x32& other) const noexcept { 318| | // No unsigned comparison before AVX-512; bias into the signed domain 319| 2.75k| const __m256i bias = _mm256_set1_epi32(static_cast(0x80000000)); 320| 2.75k| return SIMD_8x32(_mm256_cmpgt_epi32(_mm256_xor_si256(other.raw(), bias), _mm256_xor_si256(raw(), bias))); 321| 2.75k| } _ZN5Botan9SIMD_8x3212byte_shuffleERKS0_S2_: 341| 525k| static inline SIMD_8x32 BOTAN_FN_ISA_AVX2 byte_shuffle(const SIMD_8x32& tbl, const SIMD_8x32& idx) { 342| 525k| return SIMD_8x32(_mm256_shuffle_epi8(tbl.raw(), idx.raw())); 343| 525k| } _ZN5Botan9SIMD_8x3215reset_registersEv: 346| 2.75k| static void reset_registers() noexcept { _mm256_zeroupper(); } _ZN5Botan9SIMD_8x3214zero_registersEv: 349| 2.75k| static void zero_registers() noexcept { _mm256_zeroall(); } _ZNK5Botan9SIMD_8x323rawEv: 351| 7.40M| __m256i BOTAN_FN_ISA_AVX2 raw() const noexcept { return m_avx2; } _ZN5Botan9SIMD_8x32C2EDv4_x: 354| 11.3M| explicit SIMD_8x32(__m256i x) noexcept : m_avx2(x) {} _ZN5Botan9SIMD_8x329swap_topsERS0_S1_: 358| 22.0k| static void swap_tops(SIMD_8x32& A, SIMD_8x32& B) { 359| 22.0k| auto T0 = SIMD_8x32(_mm256_permute2x128_si256(A.raw(), B.raw(), 0 + (2 << 4))); 360| | auto T1 = SIMD_8x32(_mm256_permute2x128_si256(A.raw(), B.raw(), 1 + (3 << 4))); 361| 22.0k| A = T0; 362| 22.0k| B = T1; 363| 22.0k| } _ZNK5Botan9SIMD_8x324rotlILm7EEES0_vQaagtT_Li0EltT_Li32E: 118| 220k| { 119| |#if defined(__AVX512VL__) 120| | return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT)); 121| |#else 122| | if constexpr(ROT == 8) { 123| | const __m256i shuf_rotl_8 = 124| | _mm256_set_epi64x(0x0e0d0c0f'0a09080b, 0x06050407'02010003, 0x0e0d0c0f'0a09080b, 0x06050407'02010003); 125| | 126| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8)); 127| | } else if constexpr(ROT == 16) { 128| | const __m256i shuf_rotl_16 = 129| | _mm256_set_epi64x(0x0d0c0f0e'09080b0a, 0x05040706'01000302, 0x0d0c0f0e'09080b0a, 0x05040706'01000302); 130| | 131| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16)); 132| | } else if constexpr(ROT == 24) { 133| | const __m256i shuf_rotl_24 = 134| | _mm256_set_epi64x(0x0c0f0e0d'080b0a09, 0x04070605'00030201, 0x0c0f0e0d'080b0a09, 0x04070605'00030201); 135| | 136| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_24)); 137| 220k| } else { 138| 220k| return SIMD_8x32(_mm256_xor_si256(_mm256_slli_epi32(m_avx2, static_cast(ROT)), 139| 220k| _mm256_srli_epi32(m_avx2, static_cast(32 - ROT)))); 140| 220k| } 141| 220k|#endif 142| 220k| } _ZNK5Botan9SIMD_8x324rotlILm1EEES0_vQaagtT_Li0EltT_Li32E: 118| 1.12M| { 119| |#if defined(__AVX512VL__) 120| | return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT)); 121| |#else 122| | if constexpr(ROT == 8) { 123| | const __m256i shuf_rotl_8 = 124| | _mm256_set_epi64x(0x0e0d0c0f'0a09080b, 0x06050407'02010003, 0x0e0d0c0f'0a09080b, 0x06050407'02010003); 125| | 126| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8)); 127| | } else if constexpr(ROT == 16) { 128| | const __m256i shuf_rotl_16 = 129| | _mm256_set_epi64x(0x0d0c0f0e'09080b0a, 0x05040706'01000302, 0x0d0c0f0e'09080b0a, 0x05040706'01000302); 130| | 131| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16)); 132| | } else if constexpr(ROT == 24) { 133| | const __m256i shuf_rotl_24 = 134| | _mm256_set_epi64x(0x0c0f0e0d'080b0a09, 0x04070605'00030201, 0x0c0f0e0d'080b0a09, 0x04070605'00030201); 135| | 136| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_24)); 137| 1.12M| } else { 138| 1.12M| return SIMD_8x32(_mm256_xor_si256(_mm256_slli_epi32(m_avx2, static_cast(ROT)), 139| 1.12M| _mm256_srli_epi32(m_avx2, static_cast(32 - ROT)))); 140| 1.12M| } 141| 1.12M|#endif 142| 1.12M| } _ZNK5Botan9SIMD_8x324rotlILm2EEES0_vQaagtT_Li0EltT_Li32E: 118| 723k| { 119| |#if defined(__AVX512VL__) 120| | return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT)); 121| |#else 122| | if constexpr(ROT == 8) { 123| | const __m256i shuf_rotl_8 = 124| | _mm256_set_epi64x(0x0e0d0c0f'0a09080b, 0x06050407'02010003, 0x0e0d0c0f'0a09080b, 0x06050407'02010003); 125| | 126| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8)); 127| | } else if constexpr(ROT == 16) { 128| | const __m256i shuf_rotl_16 = 129| | _mm256_set_epi64x(0x0d0c0f0e'09080b0a, 0x05040706'01000302, 0x0d0c0f0e'09080b0a, 0x05040706'01000302); 130| | 131| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16)); 132| | } else if constexpr(ROT == 24) { 133| | const __m256i shuf_rotl_24 = 134| | _mm256_set_epi64x(0x0c0f0e0d'080b0a09, 0x04070605'00030201, 0x0c0f0e0d'080b0a09, 0x04070605'00030201); 135| | 136| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_24)); 137| 723k| } else { 138| 723k| return SIMD_8x32(_mm256_xor_si256(_mm256_slli_epi32(m_avx2, static_cast(ROT)), 139| 723k| _mm256_srli_epi32(m_avx2, static_cast(32 - ROT)))); 140| 723k| } 141| 723k|#endif 142| 723k| } _ZNK5Botan9SIMD_8x323shlILi14EEES0_v: 217| 261k| BOTAN_FN_ISA_AVX2 SIMD_8x32 shl() const noexcept { 218| 261k| return SIMD_8x32(_mm256_slli_epi32(m_avx2, SHIFT)); 219| 261k| } _ZNK5Botan9SIMD_8x323shrILi7EEES0_v: 222| 261k| BOTAN_FN_ISA_AVX2 SIMD_8x32 shr() const noexcept { 223| 261k| return SIMD_8x32(_mm256_srli_epi32(m_avx2, SHIFT)); 224| 261k| } _ZNK5Botan9SIMD_8x323shrILi3EEES0_v: 222| 261k| BOTAN_FN_ISA_AVX2 SIMD_8x32 shr() const noexcept { 223| 261k| return SIMD_8x32(_mm256_srli_epi32(m_avx2, SHIFT)); 224| 261k| } _ZNK5Botan9SIMD_8x323shrILi11EEES0_v: 222| 261k| BOTAN_FN_ISA_AVX2 SIMD_8x32 shr() const noexcept { 223| 261k| return SIMD_8x32(_mm256_srli_epi32(m_avx2, SHIFT)); 224| 261k| } _ZNK5Botan9SIMD_8x323shlILi11EEES0_v: 217| 261k| BOTAN_FN_ISA_AVX2 SIMD_8x32 shl() const noexcept { 218| 261k| return SIMD_8x32(_mm256_slli_epi32(m_avx2, SHIFT)); 219| 261k| } _ZNK5Botan9SIMD_8x323shrILi10EEES0_v: 222| 523k| BOTAN_FN_ISA_AVX2 SIMD_8x32 shr() const noexcept { 223| 523k| return SIMD_8x32(_mm256_srli_epi32(m_avx2, SHIFT)); 224| 523k| } _ZNK5Botan9SIMD_8x324rotlILm16EEES0_vQaagtT_Li0EltT_Li32E: 118| 220k| { 119| |#if defined(__AVX512VL__) 120| | return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT)); 121| |#else 122| | if constexpr(ROT == 8) { 123| | const __m256i shuf_rotl_8 = 124| | _mm256_set_epi64x(0x0e0d0c0f'0a09080b, 0x06050407'02010003, 0x0e0d0c0f'0a09080b, 0x06050407'02010003); 125| | 126| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8)); 127| 220k| } else if constexpr(ROT == 16) { 128| 220k| const __m256i shuf_rotl_16 = 129| 220k| _mm256_set_epi64x(0x0d0c0f0e'09080b0a, 0x05040706'01000302, 0x0d0c0f0e'09080b0a, 0x05040706'01000302); 130| | 131| 220k| return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16)); 132| | } else if constexpr(ROT == 24) { 133| | const __m256i shuf_rotl_24 = 134| | _mm256_set_epi64x(0x0c0f0e0d'080b0a09, 0x04070605'00030201, 0x0c0f0e0d'080b0a09, 0x04070605'00030201); 135| | 136| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_24)); 137| | } else { 138| | return SIMD_8x32(_mm256_xor_si256(_mm256_slli_epi32(m_avx2, static_cast(ROT)), 139| | _mm256_srli_epi32(m_avx2, static_cast(32 - ROT)))); 140| | } 141| 220k|#endif 142| 220k| } _ZNK5Botan9SIMD_8x324rotlILm12EEES0_vQaagtT_Li0EltT_Li32E: 118| 220k| { 119| |#if defined(__AVX512VL__) 120| | return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT)); 121| |#else 122| | if constexpr(ROT == 8) { 123| | const __m256i shuf_rotl_8 = 124| | _mm256_set_epi64x(0x0e0d0c0f'0a09080b, 0x06050407'02010003, 0x0e0d0c0f'0a09080b, 0x06050407'02010003); 125| | 126| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8)); 127| | } else if constexpr(ROT == 16) { 128| | const __m256i shuf_rotl_16 = 129| | _mm256_set_epi64x(0x0d0c0f0e'09080b0a, 0x05040706'01000302, 0x0d0c0f0e'09080b0a, 0x05040706'01000302); 130| | 131| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16)); 132| | } else if constexpr(ROT == 24) { 133| | const __m256i shuf_rotl_24 = 134| | _mm256_set_epi64x(0x0c0f0e0d'080b0a09, 0x04070605'00030201, 0x0c0f0e0d'080b0a09, 0x04070605'00030201); 135| | 136| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_24)); 137| 220k| } else { 138| 220k| return SIMD_8x32(_mm256_xor_si256(_mm256_slli_epi32(m_avx2, static_cast(ROT)), 139| 220k| _mm256_srli_epi32(m_avx2, static_cast(32 - ROT)))); 140| 220k| } 141| 220k|#endif 142| 220k| } _ZNK5Botan9SIMD_8x324rotlILm8EEES0_vQaagtT_Li0EltT_Li32E: 118| 220k| { 119| |#if defined(__AVX512VL__) 120| | return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT)); 121| |#else 122| 220k| if constexpr(ROT == 8) { 123| 220k| const __m256i shuf_rotl_8 = 124| 220k| _mm256_set_epi64x(0x0e0d0c0f'0a09080b, 0x06050407'02010003, 0x0e0d0c0f'0a09080b, 0x06050407'02010003); 125| | 126| 220k| return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8)); 127| | } else if constexpr(ROT == 16) { 128| | const __m256i shuf_rotl_16 = 129| | _mm256_set_epi64x(0x0d0c0f0e'09080b0a, 0x05040706'01000302, 0x0d0c0f0e'09080b0a, 0x05040706'01000302); 130| | 131| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16)); 132| | } else if constexpr(ROT == 24) { 133| | const __m256i shuf_rotl_24 = 134| | _mm256_set_epi64x(0x0c0f0e0d'080b0a09, 0x04070605'00030201, 0x0c0f0e0d'080b0a09, 0x04070605'00030201); 135| | 136| | return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_24)); 137| | } else { 138| | return SIMD_8x32(_mm256_xor_si256(_mm256_slli_epi32(m_avx2, static_cast(ROT)), 139| | _mm256_srli_epi32(m_avx2, static_cast(32 - ROT)))); 140| | } 141| 220k|#endif 142| 220k| } _ZNK5Botan23Gf2AffineTransformation16affine_transformENS_9SIMD_4x32E: 155| 5.20k| inline SIMD_4x32 BOTAN_FN_ISA_HWAES affine_transform(SIMD_4x32 x) const { 156| 5.20k| const SIMD_4x32 tbl_lo(lo[0], lo[1], lo[2], lo[3]); 157| 5.20k| const SIMD_4x32 tbl_hi(hi[0], hi[1], hi[2], hi[3]); 158| 5.20k| const auto lo_mask = SIMD_4x32::splat_u8(0x0F); 159| | 160| 5.20k| return SIMD_4x32::byte_shuffle(tbl_lo, lo_mask & x) ^ SIMD_4x32::byte_shuffle(tbl_hi, lo_mask & x.shr<4>()); 161| 5.20k| } _ZN5Botan11hw_aes_sboxENS_9SIMD_4x32E: 19| 1.93k|inline SIMD_4x32 BOTAN_FN_ISA_HWAES hw_aes_sbox(SIMD_4x32 x) { 20| | // Undo the ShiftRows with a byte shuffle implementing InvShiftRows 21| 1.93k| const auto inv_sr = SIMD_4x32(0x070A0D00, 0x0B0E0104, 0x0F020508, 0x0306090C); 22| | 23| 1.93k|#if defined(BOTAN_TARGET_ARCH_IS_X86_FAMILY) 24| 1.93k| auto enc = SIMD_4x32(_mm_aesenclast_si128(x.raw(), _mm_setzero_si128())); 25| |#elif defined(BOTAN_TARGET_ARCH_IS_ARM64) 26| | auto enc = SIMD_4x32(vreinterpretq_u32_u8(vaeseq_u8(vreinterpretq_u8_u32(x.raw()), vdupq_n_u8(0)))); 27| |#else 28| | #error "hw_aes_sbox not implemented for this architecture" 29| |#endif 30| | 31| 1.93k| return SIMD_4x32::byte_shuffle(enc, inv_sr); 32| 1.93k|} _ZN5Botan15hw_aes_inv_sboxENS_9SIMD_4x32E: 37| 1.12k|inline SIMD_4x32 BOTAN_FN_ISA_HWAES hw_aes_inv_sbox(SIMD_4x32 x) { 38| | // Undo the InvShiftRows with a byte shuffle implementing ShiftRows 39| 1.12k| const auto sr = SIMD_4x32(0x0F0A0500, 0x030E0904, 0x07020D08, 0x0B06010C); 40| | 41| 1.12k|#if defined(BOTAN_TARGET_ARCH_IS_X86_FAMILY) 42| 1.12k| auto dec = SIMD_4x32(_mm_aesdeclast_si128(x.raw(), _mm_setzero_si128())); 43| |#elif defined(BOTAN_TARGET_ARCH_IS_ARM64) 44| | auto dec = SIMD_4x32(vreinterpretq_u32_u8(vaesdq_u8(vreinterpretq_u8_u32(x.raw()), vdupq_n_u8(0)))); 45| |#else 46| | #error "hw_aes_inv_sbox not implemented for this architecture" 47| |#endif 48| | 49| 1.12k| return SIMD_4x32::byte_shuffle(dec, sr); 50| 1.12k|} _ZN5Botan12value_existsINSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EEEEbRKNS1_6vectorIT_NS5_ISB_EEEERKT0_: 44| 143k|bool value_exists(const std::vector& vec, const V& val) { 45| 255k| for(const auto& elem : vec) { ------------------ | Branch (45:25): [True: 255k, False: 0] ------------------ 46| 255k| if(elem == val) { ------------------ | Branch (46:10): [True: 143k, False: 112k] ------------------ 47| 143k| return true; 48| 143k| } 49| 255k| } 50| 0| return false; 51| 143k|} _ZN5Botan12value_existsINS_3TLS12Group_ParamsES2_EEbRKNSt3__16vectorIT_NS3_9allocatorIS5_EEEERKT0_: 44| 49.7k|bool value_exists(const std::vector& vec, const V& val) { 45| 52.3k| for(const auto& elem : vec) { ------------------ | Branch (45:25): [True: 52.3k, False: 44.4k] ------------------ 46| 52.3k| if(elem == val) { ------------------ | Branch (46:10): [True: 5.32k, False: 46.9k] ------------------ 47| 5.32k| return true; 48| 5.32k| } 49| 52.3k| } 50| 44.4k| return false; 51| 49.7k|} _ZN5Botan12value_existsINSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES7_EEbRKNS1_6vectorIT_NS5_IS9_EEEERKT0_: 44| 32|bool value_exists(const std::vector& vec, const V& val) { 45| 32| for(const auto& elem : vec) { ------------------ | Branch (45:25): [True: 32, False: 2] ------------------ 46| 32| if(elem == val) { ------------------ | Branch (46:10): [True: 30, False: 2] ------------------ 47| 30| return true; 48| 30| } 49| 32| } 50| 2| return false; 51| 32|} _ZN5Botan12value_existsINS_3TLS16Protocol_VersionES2_EEbRKNSt3__16vectorIT_NS3_9allocatorIS5_EEEERKT0_: 44| 18|bool value_exists(const std::vector& vec, const V& val) { 45| 353| for(const auto& elem : vec) { ------------------ | Branch (45:25): [True: 353, False: 12] ------------------ 46| 353| if(elem == val) { ------------------ | Branch (46:10): [True: 6, False: 347] ------------------ 47| 6| return true; 48| 6| } 49| 353| } 50| 12| return false; 51| 18|} _ZN5Botan12value_existsIhhEEbRKNSt3__16vectorIT_NS1_9allocatorIS3_EEEERKT0_: 44| 3.10k|bool value_exists(const std::vector& vec, const V& val) { 45| 3.52k| for(const auto& elem : vec) { ------------------ | Branch (45:25): [True: 3.52k, False: 36] ------------------ 46| 3.52k| if(elem == val) { ------------------ | Branch (46:10): [True: 3.07k, False: 451] ------------------ 47| 3.07k| return true; 48| 3.07k| } 49| 3.52k| } 50| 36| return false; 51| 3.10k|} tls_channel_impl_12.cpp:_ZN5Botan13map_remove_ifINSt3__13mapItNS1_10shared_ptrINS_3TLS23Connection_Cipher_StateEEENS1_4lessItEENS1_9allocatorINS1_4pairIKtS6_EEEEEEZNS4_15Channel_Impl_1216activate_sessionEvE3$_0EEvT0_RT_: 54| 96|void map_remove_if(Pred pred, T& assoc) { 55| 96| auto i = assoc.begin(); 56| 288| while(i != assoc.end()) { ------------------ | Branch (56:10): [True: 192, False: 96] ------------------ 57| 192| if(pred(i->first)) { ------------------ | Branch (57:10): [True: 96, False: 96] ------------------ 58| 96| assoc.erase(i++); 59| 96| } else { 60| 96| i++; 61| 96| } 62| 192| } 63| 96|} tls_channel_impl_12.cpp:_ZN5Botan13map_remove_ifINSt3__13mapItNS_3TLS15Channel_Impl_1226Retained_Read_Cipher_StateENS1_4lessItEENS1_9allocatorINS1_4pairIKtS5_EEEEEEZNS4_16activate_sessionEvE3$_0EEvT0_RT_: 54| 96|void map_remove_if(Pred pred, T& assoc) { 55| 96| auto i = assoc.begin(); 56| 288| while(i != assoc.end()) { ------------------ | Branch (56:10): [True: 192, False: 96] ------------------ 57| 192| if(pred(i->first)) { ------------------ | Branch (57:10): [True: 96, False: 96] ------------------ 58| 96| assoc.erase(i++); 59| 96| } else { 60| 96| i++; 61| 96| } 62| 192| } 63| 96|} _ZN5Botan12holds_any_ofIJNS_3TLS20Client_Hello_12_ShimENS1_15Client_Hello_13ENS1_15Server_Hello_13ENS1_19Hello_Retry_RequestENS1_11Finished_13EEJS3_S2_S4_NS1_20Server_Hello_12_ShimES5_NS1_20Encrypted_ExtensionsENS1_14Certificate_13ENS1_22Certificate_Request_13ENS1_21Certificate_Verify_13ES6_EEEbRKNSt3__17variantIJDpT0_EEE: 66| 3.33k|constexpr bool holds_any_of(const std::variant& v) noexcept { 67| 4.69k| return (std::holds_alternative(v) || ...); ------------------ | Branch (67:12): [True: 0, False: 194] | Branch (67:12): [True: 10, False: 184] | Branch (67:12): [True: 0, False: 194] | Branch (67:12): [True: 0, False: 194] | Branch (67:12): [True: 3.14k, False: 194] ------------------ 68| 3.33k|} _ZN5Botan13generalize_toINSt3__17variantIJNS_3TLS15Client_Hello_13ENS3_20Client_Hello_12_ShimENS3_15Server_Hello_13ENS3_20Server_Hello_12_ShimENS3_19Hello_Retry_RequestENS3_20Encrypted_ExtensionsENS3_14Certificate_13ENS3_22Certificate_Request_13ENS3_21Certificate_Verify_13ENS3_11Finished_13EEEEJS4_S5_EEET_NS2_IJDpT0_EEE: 102| 3.14k|constexpr GeneralVariantT generalize_to(std::variant specific) { 103| 3.14k| static_assert( 104| 3.14k| is_generalizable_to(specific), 105| 3.14k| "Desired general type must be implicitly constructible by all types of the specialized std::variant<>"); 106| 3.14k| return std::visit([](auto s) -> GeneralVariantT { return s; }, std::move(specific)); 107| 3.14k|} _ZZN5Botan13generalize_toINSt3__17variantIJNS_3TLS15Client_Hello_13ENS3_20Client_Hello_12_ShimENS3_15Server_Hello_13ENS3_20Server_Hello_12_ShimENS3_19Hello_Retry_RequestENS3_20Encrypted_ExtensionsENS3_14Certificate_13ENS3_22Certificate_Request_13ENS3_21Certificate_Verify_13ENS3_11Finished_13EEEEJS4_S5_EEET_NS2_IJDpT0_EEEENKUlSF_E_clIS5_EESE_SF_: 106| 3.14k| return std::visit([](auto s) -> GeneralVariantT { return s; }, std::move(specific)); _ZN5Botan13generalize_toINSt3__17variantIJNS_3TLS15Client_Hello_13ENS3_20Client_Hello_12_ShimENS3_15Server_Hello_13ENS3_20Server_Hello_12_ShimENS3_19Hello_Retry_RequestENS3_20Encrypted_ExtensionsENS3_14Certificate_13ENS3_22Certificate_Request_13ENS3_21Certificate_Verify_13ENS3_11Finished_13EEEEJS8_S6_S7_EEET_NS2_IJDpT0_EEE: 102| 22|constexpr GeneralVariantT generalize_to(std::variant specific) { 103| 22| static_assert( 104| 22| is_generalizable_to(specific), 105| 22| "Desired general type must be implicitly constructible by all types of the specialized std::variant<>"); 106| 22| return std::visit([](auto s) -> GeneralVariantT { return s; }, std::move(specific)); 107| 22|} _ZZN5Botan13generalize_toINSt3__17variantIJNS_3TLS15Client_Hello_13ENS3_20Client_Hello_12_ShimENS3_15Server_Hello_13ENS3_20Server_Hello_12_ShimENS3_19Hello_Retry_RequestENS3_20Encrypted_ExtensionsENS3_14Certificate_13ENS3_22Certificate_Request_13ENS3_21Certificate_Verify_13ENS3_11Finished_13EEEEJS8_S6_S7_EEET_NS2_IJDpT0_EEEENKUlSF_E_clIS7_EESE_SF_: 106| 22| return std::visit([](auto s) -> GeneralVariantT { return s; }, std::move(specific)); _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode8tag_sizeEv: 43| 1.74k| size_t tag_size() const final { return m_tag_size; } _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode7iv_sizeEv: 74| 80| size_t iv_size() const { return m_iv_size; } _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode10block_sizeEv: 76| 1.06k| size_t block_size() const { return m_block_size; } _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode20use_encrypt_then_macEv: 78| 838| bool use_encrypt_then_mac() const { return m_use_encrypt_then_mac; } _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode20is_datagram_protocolEv: 80| 127| bool is_datagram_protocol() const { return m_is_datagram; } _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode3cbcEv: 82| 722| Cipher_Mode& cbc() const { return *m_cbc; } _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode3macEv: 84| 1.24k| MessageAuthenticationCode& mac() const { return *m_mac; } _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode9cbc_stateEv: 86| 495| secure_vector& cbc_state() { return m_cbc_state; } _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode10assoc_dataEv: 88| 157| std::vector& assoc_data() { return m_ad; } _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode3msgEv: 90| 510| secure_vector& msg() { return m_msg; } _ZNK5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption18minimum_final_sizeEv: 159| 144| size_t minimum_final_size() const override { return tag_size(); } _ZNK5Botan3TLS12Channel_Impl17expects_downgradeEv: 290| 17.9k| bool expects_downgrade() const { 291| 17.9k|#if defined(BOTAN_HAS_TLS_DOWNGRADE_SUPPORT) 292| 17.9k| return m_downgrade_info != nullptr; 293| |#else 294| | return false; 295| |#endif 296| 17.9k| } _ZN5Botan3TLS12Channel_Impl18set_io_buffer_sizeEm: 243| 5.57k| void set_io_buffer_size(size_t io_buf_sz) { 244| 5.57k| BOTAN_STATE_CHECK(m_downgrade_info); ------------------ | | 51| 5.57k| do { \ | | 52| 5.57k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 5.57k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 5.57k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 5.57k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 5.57k] | | ------------------ ------------------ 245| 5.57k| m_downgrade_info->io_buffer_size = io_buf_sz; 246| 5.57k| } _ZNK5Botan3TLS12Channel_Impl14is_downgradingEv: 282| 14.6k| bool is_downgrading() const { 283| 14.6k|#if defined(BOTAN_HAS_TLS_DOWNGRADE_SUPPORT) 284| 14.6k| return m_downgrade_info && m_downgrade_info->will_downgrade; ------------------ | Branch (284:17): [True: 14.3k, False: 344] | Branch (284:37): [True: 6.27k, False: 8.02k] ------------------ 285| |#else 286| | return false; 287| |#endif 288| 14.6k| } _ZN5Botan3TLS12Channel_Impl22extract_downgrade_infoEv: 273| 3.13k| std::unique_ptr extract_downgrade_info() { return std::exchange(m_downgrade_info, {}); } _ZN5Botan3TLS12Channel_Impl18send_warning_alertENS0_9AlertTypeE: 70| 223| void send_warning_alert(Alert::Type type) { send_alert(Alert(type, false)); } _ZN5Botan3TLS12Channel_Impl16send_fatal_alertENS0_9AlertTypeE: 75| 4.52k| void send_fatal_alert(Alert::Type type) { send_alert(Alert(type, true)); } _ZN5Botan3TLS12Channel_Impl5closeEv: 80| 15| void close() { send_warning_alert(Alert::CloseNotify); } _ZN5Botan3TLS12Channel_Impl24preserve_peer_transcriptENSt3__14spanIKhLm18446744073709551615EEE: 230| 5.57k| void preserve_peer_transcript(std::span input) { 231| 5.57k| BOTAN_STATE_CHECK(m_downgrade_info); ------------------ | | 51| 5.57k| do { \ | | 52| 5.57k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 5.57k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 5.57k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 5.57k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 5.57k] | | ------------------ ------------------ 232| 5.57k| m_downgrade_info->peer_transcript.insert(m_downgrade_info->peer_transcript.end(), input.begin(), input.end()); 233| 5.57k| } _ZN5Botan3TLS12Channel_Impl17request_downgradeEv: 256| 3.13k| void request_downgrade() { 257| 3.13k| BOTAN_STATE_CHECK(m_downgrade_info && !m_downgrade_info->will_downgrade); ------------------ | | 51| 3.13k| do { \ | | 52| 3.13k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 6.27k| if(!(expr)) { \ | | ------------------ | | | Branch (53:12): [True: 3.13k, False: 0] | | | Branch (53:12): [True: 3.13k, False: 0] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 3.13k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 3.13k] | | ------------------ ------------------ 258| 3.13k| m_downgrade_info->will_downgrade = true; 259| 3.13k| } _ZN5Botan3TLS12Channel_ImplC2Ev: 189| 9.38k| Channel_Impl() = default; _ZN5Botan3TLS12Channel_ImplD2Ev: 40| 9.38k| virtual ~Channel_Impl() = default; _ZNK5Botan3TLS15Channel_Impl_1212active_stateEv: 154| 9.24k| const std::optional& active_state() const { return m_active_state; } _ZN5Botan3TLS15Channel_Impl_123rngEv: 180| 10.6k| RandomNumberGenerator& rng() { return *m_rng; } _ZN5Botan3TLS15Channel_Impl_1215session_managerEv: 182| 2.97k| Session_Manager& session_manager() { return *m_session_manager; } _ZNK5Botan3TLS15Channel_Impl_126policyEv: 184| 44.5k| const Policy& policy() const { return *m_policy; } _ZNK5Botan3TLS15Channel_Impl_129callbacksEv: 186| 24.0k| Callbacks& callbacks() const { return *m_callbacks; } _ZNK5Botan3TLS15Channel_Impl_1213pending_stateEv: 224| 15.5k| const Handshake_State* pending_state() const { return m_pending_state.get(); } _ZNK5Botan3TLS15Channel_Impl_139callbacksEv: 266| 6.36k| Callbacks& callbacks() const { return *m_callbacks; } _ZNK5Botan3TLS15Channel_Impl_136policyEv: 274| 11.8k| const Policy& policy() const { return *m_policy; } _ZN5Botan3TLS13Secret_LoggerD2Ev: 34| 5.57k| virtual ~Secret_Logger() = default; _ZNK5Botan3TLS26Active_Connection_State_127versionEv: 48| 78| Protocol_Version version() const { return m_version; } _ZNK5Botan3TLS26Active_Connection_State_1210session_idEv: 62| 78| const Session_ID& session_id() const { return m_session_id; } _ZN5Botan3TLS14Handshake_Hash6updateERKNSt3__16vectorIhNS2_9allocatorIhEEEE: 23| 13.7k| void update(const std::vector& in) { m_data += in; } _ZN5Botan3TLS19Stream_Handshake_IOC2ENSt3__18functionIFvNS0_11Record_TypeERKNS2_6vectorIhNS2_9allocatorIhEEEEEEE: 94| 3.13k| explicit Stream_Handshake_IO(writer_fn writer) : m_send_hs(std::move(writer)) {} _ZNK5Botan3TLS19Stream_Handshake_IO14have_more_dataEv: 102| 3.23k| bool have_more_data() const override { return !m_queue.empty(); } _ZNK5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly11initializedEv: 246| 895| bool initialized() const { return m_msg_type != Handshake_Type::None; } _ZNK5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly5epochEv: 250| 120| uint16_t epoch() const { return m_epoch; } _ZNK5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly10msg_lengthEv: 253| 120| size_t msg_length() const { return m_msg_length; } _ZN5Botan3TLS12Handshake_IOD2Ev: 84| 3.65k| virtual ~Handshake_IO() = default; _ZN5Botan3TLS12Handshake_IOC2Ev: 77| 3.65k| Handshake_IO() = default; _ZN5Botan3TLS15Handshake_LayerC2ENS0_15Connection_SideE: 31| 5.57k| m_peer(whoami == Connection_Side::Server ? Connection_Side::Client : Connection_Side::Server) ------------------ | Branch (31:20): [True: 5.57k, False: 0] ------------------ 32| | // RFC 8446 4.4.2 33| | // If the corresponding certificate type extension 34| | // ("server_certificate_type" or "client_certificate_type") was not 35| | // negotiated in EncryptedExtensions, or the X.509 certificate type 36| | // was negotiated, then each CertificateEntry contains a DER-encoded 37| | // X.509 certificate. 38| | // 39| | // We need the certificate_type info to parse Certificate messages. 40| | , 41| 5.57k| m_certificate_type(Certificate_Type::X509) {} _ZNK5Botan3TLS15Handshake_Layer16has_pending_dataEv: 95| 4.08k| bool has_pending_data() const { return m_read_offset < m_read_buffer.size(); } _ZN5Botan3TLS15Handshake_State12handshake_ioEv: 71| 24.2k| Handshake_IO& handshake_io() { return *m_handshake_io; } _ZNK5Botan3TLS15Handshake_State12client_helloEv: 135| 49.4k| const Client_Hello_12* client_hello() const { return m_client_hello.get(); } _ZNK5Botan3TLS15Handshake_State12client_certsEv: 147| 192| const Certificate_12* client_certs() const { return m_client_certs.get(); } _ZNK5Botan3TLS15Handshake_State12session_keysEv: 169| 865| const Session_Keys& session_keys() const { return m_session_keys; } _ZN5Botan3TLS15Handshake_State4hashEv: 177| 13.7k| Handshake_Hash& hash() { return m_handshake_hash; } _ZNK5Botan3TLS15Handshake_State15client_finishedEv: 161| 192| const Finished_12* client_finished() const { return m_client_finished.get(); } _ZNK5Botan3TLS15Handshake_State15server_finishedEv: 159| 192| const Finished_12* server_finished() const { return m_server_finished.get(); } _ZNK5Botan3TLS15Handshake_State12server_helloEv: 137| 13.3k| const Server_Hello_12* server_hello() const { return m_server_hello.get(); } _ZNK5Botan3TLS15Handshake_State18new_session_ticketEv: 157| 96| const New_Session_Ticket_12* new_session_ticket() const { return m_new_session_ticket.get(); } _ZNK5Botan3TLS15Handshake_State7versionEv: 110| 19.6k| Protocol_Version version() const { return m_version; } _ZNK5Botan3TLS15Handshake_State12server_certsEv: 139| 5| const Certificate_12* server_certs() const { return m_server_certs.get(); } _ZNK5Botan3TLS15Handshake_State10server_kexEv: 141| 4.20k| const Server_Key_Exchange* server_kex() const { return m_server_kex.get(); } _ZNK5Botan3TLS15Handshake_State10client_kexEv: 149| 2.81k| const Client_Key_Exchange* client_kex() const { return m_client_kex.get(); } _ZNK5Botan3TLS15Handshake_State9callbacksEv: 171| 4.74k| Callbacks& callbacks() const { return m_callbacks; } _ZNK5Botan3TLS15Handshake_State4hashEv: 179| 1.59k| const Handshake_Hash& hash() const { return m_handshake_hash; } _ZNK5Botan3TLS8Internal23Handshake_State_13_Base16has_client_helloEv: 25| 2.29k| bool has_client_hello() const { return m_client_hello.has_value(); } _ZNK5Botan3TLS8Internal23Handshake_State_13_Base23has_hello_retry_requestEv: 33| 3.13k| bool has_hello_retry_request() const { return m_hello_retry_request.has_value(); } _ZNK5Botan3TLS8Internal23Handshake_State_13_Base19has_server_finishedEv: 37| 11.8k| bool has_server_finished() const { return m_server_finished.has_value(); } _ZNK5Botan3TLS8Internal23Handshake_State_13_Base18handshake_finishedEv: 41| 11.8k| bool handshake_finished() const { 42| 11.8k| return has_server_finished() && has_client_finished() && m_peer_finished_verified; ------------------ | Branch (42:17): [True: 0, False: 11.8k] | Branch (42:42): [True: 0, False: 0] | Branch (42:67): [True: 0, False: 0] ------------------ 43| 11.8k| } _ZN5Botan3TLS8Internal23Handshake_State_13_BaseC2ENS0_15Connection_SideE: 90| 5.57k| explicit Handshake_State_13_Base(Connection_Side whoami) : m_side(whoami) {} _ZN5Botan3TLS18Handshake_State_13ILNS0_15Connection_SideE2ENSt3__17variantIJNS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEENS4_IJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimES9_SB_SC_EEENS4_IJNS0_10Key_UpdateEEEEE8receivedENS4_IJSE_SF_S5_S6_S7_S8_S9_SA_SB_SC_EEE: 176| 3.13k| decltype(auto) received(Handshake_Message_13 message) { 177| 3.13k| return std::visit( 178| 3.13k| [&](auto msg) -> detail::as_wrapped_references_t { 179| 3.13k| if constexpr(std::is_constructible_v) { 180| 3.13k| return std::reference_wrapper(store(std::move(msg), true)); 181| 3.13k| } else { 182| 3.13k| throw TLS_Exception(AlertType::UnexpectedMessage, "received an illegal handshake message"); 183| 3.13k| } 184| 3.13k| }, 185| 3.13k| std::move(message)); 186| 3.13k| } _ZZN5Botan3TLS18Handshake_State_13ILNS0_15Connection_SideE2ENSt3__17variantIJNS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEENS4_IJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimES9_SB_SC_EEENS4_IJNS0_10Key_UpdateEEEEE8receivedENS4_IJSE_SF_S5_S6_S7_S8_S9_SA_SB_SC_EEEENKUlT_E_clISF_EENS4_IJNS3_17reference_wrapperISE_EENSO_ISF_EENSO_IS9_EENSO_ISB_EENSO_ISC_EEEEESL_: 178| 3.13k| [&](auto msg) -> detail::as_wrapped_references_t { 179| 3.13k| if constexpr(std::is_constructible_v) { 180| 3.13k| return std::reference_wrapper(store(std::move(msg), true)); 181| | } else { 182| | throw TLS_Exception(AlertType::UnexpectedMessage, "received an illegal handshake message"); 183| | } 184| 3.13k| }, _ZN5Botan3TLS18Handshake_State_13ILNS0_15Connection_SideE2ENSt3__17variantIJNS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEENS4_IJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimES9_SB_SC_EEENS4_IJNS0_10Key_UpdateEEEEEC2Ev: 156| 5.57k| Handshake_State_13() : Handshake_State_13_Base(whoami) {} _ZNK5Botan3TLS21Client_Hello_Internal10extensionsEv: 88| 3.23k| const Extensions& extensions() const { return m_extensions; } _ZNK5Botan3TLS21Client_Hello_Internal14legacy_versionEv: 74| 3.18k| Protocol_Version legacy_version() const { return m_legacy_version; } _ZNK5Botan3TLS21Client_Hello_Internal6randomEv: 78| 1.50k| const std::vector& random() const { return m_random; } _ZNK5Botan3TLS21Client_Hello_Internal10session_idEv: 76| 2.94k| const Session_ID& session_id() const { return m_session_id; } _ZNK5Botan3TLS21Client_Hello_Internal12comp_methodsEv: 82| 3.12k| const std::vector& comp_methods() const { return m_comp_methods; } _ZNK5Botan3TLS21Client_Hello_Internal12ciphersuitesEv: 80| 12.3k| const std::vector& ciphersuites() const { return m_suites; } _ZN5Botan3TLS21Client_Hello_Internal10extensionsEv: 90| 65.3k| Extensions& extensions() { return m_extensions; } _ZN5Botan3TLS21Server_Hello_InternalC2ENS0_16Protocol_VersionENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS0_11Session_ID_EJEEES8_thb: 123| 2.76k| m_legacy_version(lv), 124| 2.76k| m_session_id(std::move(sid)), 125| 2.76k| m_random(std::move(r)), 126| 2.76k| m_is_hello_retry_request(is_hrr), 127| 2.76k| m_ciphersuite(cs), 128| 2.76k| m_comp_method(cm) {} _ZNK5Botan3TLS21Server_Hello_Internal14legacy_versionEv: 132| 8.43k| Protocol_Version legacy_version() const { return m_legacy_version; } _ZNK5Botan3TLS21Server_Hello_Internal10session_idEv: 134| 3.05k| const Session_ID& session_id() const { return m_session_id; } _ZNK5Botan3TLS21Server_Hello_Internal6randomEv: 136| 4.26k| const std::vector& random() const { return m_random; } _ZNK5Botan3TLS21Server_Hello_Internal11ciphersuiteEv: 138| 11.2k| uint16_t ciphersuite() const { return m_ciphersuite; } _ZNK5Botan3TLS21Server_Hello_Internal11comp_methodEv: 140| 3.25k| uint8_t comp_method() const { return m_comp_method; } _ZNK5Botan3TLS21Server_Hello_Internal22is_hello_retry_requestEv: 142| 58| bool is_hello_retry_request() const { return m_is_hello_retry_request; } _ZNK5Botan3TLS21Server_Hello_Internal10extensionsEv: 144| 2.91k| const Extensions& extensions() const { return m_extensions; } _ZN5Botan3TLS21Server_Hello_Internal10extensionsEv: 146| 14.3k| Extensions& extensions() { return m_extensions; } _ZN5Botan3TLS15TLS_Data_ReaderC2EPKcNSt3__14spanIKhLm18446744073709551615EEE: 27| 66.5k| m_typename(type), m_buf(buf_in), m_offset(0) {} _ZN5Botan3TLS15TLS_Data_Reader8get_byteEv: 83| 49.7k| uint8_t get_byte() { 84| 49.7k| assert_at_least(1); 85| 49.7k| const uint8_t result = m_buf[m_offset]; 86| 49.7k| m_offset += 1; 87| 49.7k| return result; 88| 49.7k| } _ZN5Botan3TLS15TLS_Data_Reader20get_data_read_so_farEv: 46| 143| std::vector get_data_read_so_far() { 47| 143| const std::span first = m_buf.first(m_offset); 48| 143| return std::vector(first.begin(), first.end()); 49| 143| } _ZN5Botan3TLS15TLS_Data_Reader13get_remainingEv: 41| 136| std::vector get_remaining() { 42| 136| const std::span rest = m_buf.subspan(m_offset); 43| 136| return std::vector(rest.begin(), rest.end()); 44| 136| } _ZN5Botan3TLS15TLS_Data_Reader9get_fixedIhEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEm: 129| 88.1k| std::vector get_fixed(size_t size) { 130| 88.1k| return get_elem>(size); 131| 88.1k| } _ZN5Botan3TLS15TLS_Data_Reader8get_elemIhNSt3__16vectorIhNS3_9allocatorIhEEEEEET0_m: 91| 110k| Container get_elem(size_t num_elems) { 92| 110k| assert_at_least(num_elems * sizeof(T)); 93| | 94| 110k| Container result(num_elems); 95| | 96| 1.74M| for(size_t i = 0; i != num_elems; ++i) { ------------------ | Branch (96:28): [True: 1.63M, False: 110k] ------------------ 97| 1.63M| result[i] = load_be(&m_buf[m_offset], i); 98| 1.63M| } 99| | 100| 110k| m_offset += num_elems * sizeof(T); 101| | 102| 110k| return result; 103| 110k| } _ZN5Botan3TLS15TLS_Data_Reader16get_range_vectorIhEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEmmm: 117| 11.2k| std::vector get_range_vector(size_t len_bytes, size_t min_elems, size_t max_elems) { 118| 11.2k| const size_t num_elems = get_num_elems(len_bytes, sizeof(T), min_elems, max_elems); 119| | 120| 11.2k| return get_elem>(num_elems); 121| 11.2k| } _ZN5Botan3TLS15TLS_Data_Reader13get_num_elemsEmmmm: 148| 29.2k| size_t get_num_elems(size_t len_bytes, size_t T_size, size_t min_elems, size_t max_elems) { 149| 29.2k| const size_t byte_length = get_length_field(len_bytes); 150| | 151| 29.2k| if(byte_length % T_size != 0) { ------------------ | Branch (151:13): [True: 8, False: 29.2k] ------------------ 152| 8| throw_decode_error("Size isn't multiple of T"); 153| 8| } 154| | 155| 29.2k| const size_t num_elems = byte_length / T_size; 156| | 157| 29.2k| if(num_elems < min_elems || num_elems > max_elems) { ------------------ | Branch (157:13): [True: 47, False: 29.1k] | Branch (157:38): [True: 27, False: 29.1k] ------------------ 158| 47| throw_decode_error("Length field outside parameters"); 159| 47| } 160| | 161| 29.2k| return num_elems; 162| 29.2k| } _ZN5Botan3TLS15TLS_Data_Reader16get_length_fieldEm: 134| 30.5k| size_t get_length_field(size_t len_bytes) { 135| 30.5k| assert_at_least(len_bytes); 136| | 137| 30.5k| if(len_bytes == 1) { ------------------ | Branch (137:13): [True: 19.5k, False: 11.0k] ------------------ 138| 19.5k| return get_byte(); 139| 19.5k| } else if(len_bytes == 2) { ------------------ | Branch (139:20): [True: 10.5k, False: 521] ------------------ 140| 10.5k| return get_uint16_t(); 141| 10.5k| } else if(len_bytes == 3) { ------------------ | Branch (141:20): [True: 501, False: 20] ------------------ 142| 501| return get_uint24_t(); 143| 501| } 144| | 145| 20| throw_decode_error("Bad length size"); 146| 20| } _ZN5Botan3TLS15TLS_Data_Reader12get_uint16_tEv: 71| 174k| uint16_t get_uint16_t() { 72| 174k| assert_at_least(2); 73| 174k| const uint16_t result = make_uint16(m_buf[m_offset], m_buf[m_offset + 1]); 74| 174k| m_offset += 2; 75| 174k| return result; 76| 174k| } _ZN5Botan3TLS15TLS_Data_Reader12get_uint24_tEv: 64| 12.8k| uint32_t get_uint24_t() { 65| 12.8k| assert_at_least(3); 66| 12.8k| const uint32_t result = make_uint32(0, m_buf[m_offset], m_buf[m_offset + 1], m_buf[m_offset + 2]); 67| 12.8k| m_offset += 3; 68| 12.8k| return result; 69| 12.8k| } _ZN5Botan3TLS15TLS_Data_Reader9get_rangeIhEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEmmm: 110| 10.7k| std::vector get_range(size_t len_bytes, size_t min_elems, size_t max_elems) { 111| 10.7k| const size_t num_elems = get_num_elems(len_bytes, sizeof(T), min_elems, max_elems); 112| | 113| 10.7k| return get_elem>(num_elems); 114| 10.7k| } _ZN5Botan3TLS15TLS_Data_Reader16get_range_vectorItEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEmmm: 117| 7.00k| std::vector get_range_vector(size_t len_bytes, size_t min_elems, size_t max_elems) { 118| 7.00k| const size_t num_elems = get_num_elems(len_bytes, sizeof(T), min_elems, max_elems); 119| | 120| 7.00k| return get_elem>(num_elems); 121| 7.00k| } _ZN5Botan3TLS15TLS_Data_Reader8get_elemItNSt3__16vectorItNS3_9allocatorItEEEEEET0_m: 91| 7.10k| Container get_elem(size_t num_elems) { 92| 7.10k| assert_at_least(num_elems * sizeof(T)); 93| | 94| 7.10k| Container result(num_elems); 95| | 96| 35.3k| for(size_t i = 0; i != num_elems; ++i) { ------------------ | Branch (96:28): [True: 28.2k, False: 7.10k] ------------------ 97| 28.2k| result[i] = load_be(&m_buf[m_offset], i); 98| 28.2k| } 99| | 100| 7.10k| m_offset += num_elems * sizeof(T); 101| | 102| 7.10k| return result; 103| 7.10k| } _ZN5Botan3TLS23append_tls_length_valueIhNSt3__19allocatorIhEES4_EEvRNS2_6vectorIhT0_EERKNS5_IT_T1_EEm: 209| 5.56k| size_t tag_size) { 210| 5.56k| append_tls_length_value(buf, std::span{vals}, tag_size); 211| 5.56k|} _ZN5Botan3TLS23append_tls_length_valueIhNSt3__19allocatorIhEEEEvRNS2_6vectorIhT0_EENS2_4spanIKT_Lm18446744073709551615EEEm: 202| 8.34k|inline void append_tls_length_value(std::vector& buf, std::span vals, size_t tag_size) { 203| 8.34k| append_tls_length_value(buf, vals.data(), vals.size(), tag_size); 204| 8.34k|} _ZN5Botan3TLS23append_tls_length_valueIhNSt3__19allocatorIhEEEEvRNS2_6vectorIhT0_EEPKT_mm: 180| 8.34k| size_t tag_size) { 181| 8.34k| const size_t T_size = sizeof(T); 182| 8.34k| const size_t val_bytes = T_size * vals_size; 183| | 184| 8.34k| BOTAN_ARG_CHECK(tag_size == 1 || tag_size == 2 || tag_size == 3, "Invalid TLS tag size"); ------------------ | | 35| 8.34k| do { \ | | 36| 8.34k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 19.4k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 5.58k, False: 2.75k] | | | Branch (37:12): [True: 2.75k, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 8.34k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 8.34k] | | ------------------ ------------------ 185| | 186| 8.34k| const size_t max_possible_size = (1 << (8 * tag_size)) - 1; 187| | 188| 8.34k| BOTAN_ARG_CHECK(val_bytes <= max_possible_size, "Value too large to encode"); ------------------ | | 35| 8.34k| do { \ | | 36| 8.34k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 8.34k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 8.34k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 8.34k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 8.34k] | | ------------------ ------------------ 189| | 190| 19.4k| for(size_t i = 0; i != tag_size; ++i) { ------------------ | Branch (190:22): [True: 11.0k, False: 8.34k] ------------------ 191| 11.0k| buf.push_back(get_byte_var(sizeof(val_bytes) - tag_size + i, val_bytes)); 192| 11.0k| } 193| | 194| 368k| for(size_t i = 0; i != vals_size; ++i) { ------------------ | Branch (194:22): [True: 359k, False: 8.34k] ------------------ 195| 719k| for(size_t j = 0; j != T_size; ++j) { ------------------ | Branch (195:25): [True: 359k, False: 359k] ------------------ 196| 359k| buf.push_back(get_byte_var(j, vals[i])); 197| 359k| } 198| 359k| } 199| 8.34k|} _ZNK5Botan3TLS15TLS_Data_Reader11assert_doneEv: 29| 45.0k| void assert_done() const { 30| 45.0k| if(has_remaining()) { ------------------ | Branch (30:13): [True: 269, False: 44.7k] ------------------ 31| 269| throw_decode_error("Extra bytes at end of message"); 32| 269| } 33| 45.0k| } _ZNK5Botan3TLS15TLS_Data_Reader11read_so_farEv: 35| 7.74k| size_t read_so_far() const { return m_offset; } _ZNK5Botan3TLS15TLS_Data_Reader15remaining_bytesEv: 37| 568k| size_t remaining_bytes() const { return m_buf.size() - m_offset; } _ZNK5Botan3TLS15TLS_Data_Reader13has_remainingEv: 39| 105k| bool has_remaining() const { return (remaining_bytes() > 0); } _ZN5Botan3TLS15TLS_Data_Reader12discard_nextEm: 51| 342| void discard_next(size_t bytes) { 52| 342| assert_at_least(bytes); 53| 342| m_offset += bytes; 54| 342| } _ZN5Botan3TLS15TLS_Data_Reader12get_uint32_tEv: 56| 533| uint32_t get_uint32_t() { 57| 533| assert_at_least(4); 58| 533| const uint32_t result = 59| 533| make_uint32(m_buf[m_offset], m_buf[m_offset + 1], m_buf[m_offset + 2], m_buf[m_offset + 3]); 60| 533| m_offset += 4; 61| 533| return result; 62| 533| } _ZN5Botan3TLS15TLS_Data_Reader20get_tls_length_valueEm: 105| 1.38k| std::vector get_tls_length_value(size_t len_bytes) { 106| 1.38k| return get_fixed(get_length_field(len_bytes)); 107| 1.38k| } _ZN5Botan3TLS15TLS_Data_Reader10get_stringEmmm: 123| 4.30k| std::string get_string(size_t len_bytes, size_t min_bytes, size_t max_bytes) { 124| 4.30k| std::vector v = get_range_vector(len_bytes, min_bytes, max_bytes); 125| 4.30k| return bytes_to_string(v); 126| 4.30k| } _ZN5Botan3TLS23append_tls_length_valueINSt3__19allocatorIhEEEEvRNS2_6vectorIhT_EENS2_17basic_string_viewIcNS2_11char_traitsIcEEEEm: 214| 2.78k|inline void append_tls_length_value(std::vector& buf, std::string_view str, size_t tag_size) { 215| 2.78k| append_tls_length_value(buf, as_span_of_bytes(str), tag_size); 216| 2.78k|} _ZN5Botan3TLS15TLS_Data_Reader9get_rangeItEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEmmm: 110| 133| std::vector get_range(size_t len_bytes, size_t min_elems, size_t max_elems) { 111| 133| const size_t num_elems = get_num_elems(len_bytes, sizeof(T), min_elems, max_elems); 112| | 113| 133| return get_elem>(num_elems); 114| 133| } _ZN5Botan3TLS23append_tls_length_valueIhNS_16secure_allocatorIhEENSt3__19allocatorIhEEEEvRNS4_6vectorIhT0_EERKNS7_IT_T1_EEm: 209| 14| size_t tag_size) { 210| 14| append_tls_length_value(buf, std::span{vals}, tag_size); 211| 14|} _ZN5Botan3TLS23append_tls_length_valueIhNS_16secure_allocatorIhEEEEvRNSt3__16vectorIhT0_EENS4_4spanIKT_Lm18446744073709551615EEEm: 202| 3.31k|inline void append_tls_length_value(std::vector& buf, std::span vals, size_t tag_size) { 203| 3.31k| append_tls_length_value(buf, vals.data(), vals.size(), tag_size); 204| 3.31k|} _ZN5Botan3TLS23append_tls_length_valueIhNS_16secure_allocatorIhEEEEvRNSt3__16vectorIhT0_EEPKT_mm: 180| 3.31k| size_t tag_size) { 181| 3.31k| const size_t T_size = sizeof(T); 182| 3.31k| const size_t val_bytes = T_size * vals_size; 183| | 184| 3.31k| BOTAN_ARG_CHECK(tag_size == 1 || tag_size == 2 || tag_size == 3, "Invalid TLS tag size"); ------------------ | | 35| 3.31k| do { \ | | 36| 3.31k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 9.93k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 3.31k] | | | Branch (37:12): [True: 3.31k, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 3.31k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 3.31k] | | ------------------ ------------------ 185| | 186| 3.31k| const size_t max_possible_size = (1 << (8 * tag_size)) - 1; 187| | 188| 3.31k| BOTAN_ARG_CHECK(val_bytes <= max_possible_size, "Value too large to encode"); ------------------ | | 35| 3.31k| do { \ | | 36| 3.31k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 3.31k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 3.31k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 3.31k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 3.31k] | | ------------------ ------------------ 189| | 190| 9.93k| for(size_t i = 0; i != tag_size; ++i) { ------------------ | Branch (190:22): [True: 6.62k, False: 3.31k] ------------------ 191| 6.62k| buf.push_back(get_byte_var(sizeof(val_bytes) - tag_size + i, val_bytes)); 192| 6.62k| } 193| | 194| 106k| for(size_t i = 0; i != vals_size; ++i) { ------------------ | Branch (194:22): [True: 103k, False: 3.31k] ------------------ 195| 206k| for(size_t j = 0; j != T_size; ++j) { ------------------ | Branch (195:25): [True: 103k, False: 103k] ------------------ 196| 103k| buf.push_back(get_byte_var(j, vals[i])); 197| 103k| } 198| 103k| } 199| 3.31k|} _ZN5Botan3TLS23append_tls_length_valueIhNS_16secure_allocatorIhEES3_EEvRNSt3__16vectorIhT0_EERKNS5_IT_T1_EEm: 209| 3.29k| size_t tag_size) { 210| 3.29k| append_tls_length_value(buf, std::span{vals}, tag_size); 211| 3.29k|} _ZNK5Botan3TLS13Record_Header6neededEv: 91| 8.23k| size_t needed() const { return m_needed; } _ZNK5Botan3TLS13Record_Header4typeEv: 105| 34.4k| Record_Type type() const { 106| 34.4k| BOTAN_ASSERT_NOMSG(m_needed == 0); ------------------ | | 77| 34.4k| do { \ | | 78| 34.4k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 34.4k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 34.4k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 34.4k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 34.4k] | | ------------------ ------------------ 107| 34.4k| return m_type; 108| 34.4k| } _ZNK5Botan3TLS13Record_Header5epochEv: 103| 1.57k| uint16_t epoch() const { return static_cast(sequence() >> 48); } _ZNK5Botan3TLS13Record_Header7versionEv: 93| 14.0k| Protocol_Version version() const { 94| 14.0k| BOTAN_ASSERT_NOMSG(m_needed == 0); ------------------ | | 77| 14.0k| do { \ | | 78| 14.0k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 14.0k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 14.0k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 14.0k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 14.0k] | | ------------------ ------------------ 95| 14.0k| return m_version; 96| 14.0k| } _ZNK5Botan3TLS13Record_Header8sequenceEv: 98| 8.70k| uint64_t sequence() const { 99| 8.70k| BOTAN_ASSERT_NOMSG(m_needed == 0); ------------------ | | 77| 8.70k| do { \ | | 78| 8.70k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 8.70k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 8.70k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 8.70k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 8.70k] | | ------------------ ------------------ 100| 8.70k| return m_sequence; 101| 8.70k| } _ZN5Botan3TLS23Connection_Cipher_State4aeadEv: 58| 487| AEAD_Mode& aead() { 59| 487| BOTAN_ASSERT_NONNULL(m_aead.get()); ------------------ | | 116| 487| do { \ | | 117| 487| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 487] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 487| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 487] | | ------------------ ------------------ 60| 487| return *m_aead; 61| 487| } _ZNK5Botan3TLS23Connection_Cipher_State26nonce_bytes_from_handshakeEv: 69| 186| size_t nonce_bytes_from_handshake() const { return m_nonce_bytes_from_handshake; } _ZNK5Botan3TLS23Connection_Cipher_State23nonce_bytes_from_recordEv: 71| 1.32k| size_t nonce_bytes_from_record() const { return m_nonce_bytes_from_record; } _ZNK5Botan3TLS23Connection_Cipher_State12nonce_formatEv: 73| 871| Nonce_Format nonce_format() const { return m_nonce_format; } _ZN5Botan3TLS13Record_HeaderC2EmNS0_16Protocol_VersionENS0_11Record_TypeE: 87| 7.79k| m_needed(0), m_sequence(sequence), m_version(version), m_type(type) {} _ZN5Botan3TLS13Record_HeaderC2Em: 89| 446| explicit Record_Header(size_t needed) : m_needed(needed), m_sequence(0), m_type(Record_Type::Invalid) {} _ZN5Botan3TLS6RecordC2ENS0_11Record_TypeENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 34| 12.8k| type(record_type), fragment(std::move(frgmnt)), seq_no(std::nullopt) {} _ZN5Botan3TLS12Record_Layer17clear_read_bufferEv: 84| 15| void clear_read_buffer() { 85| 15| zap(m_read_buffer); 86| 15| m_read_offset = 0; 87| 15| } _ZN5Botan3TLS25Datagram_Sequence_NumbersC2Ev: 89| 522| Datagram_Sequence_Numbers() { Datagram_Sequence_Numbers::reset(); } _ZN5Botan3TLS25Datagram_Sequence_Numbers5resetEv: 91| 522| void reset() override { 92| 522| m_write_seqs.clear(); 93| 522| m_write_seqs[0] = 0; 94| 522| m_write_epoch = 0; 95| 522| m_read_epoch = 0; 96| 522| m_read_windows.clear(); 97| 522| m_read_windows[0] = Replay_Window{}; 98| 522| } _ZN5Botan3TLS27Connection_Sequence_NumbersD2Ev: 20| 3.65k| virtual ~Connection_Sequence_Numbers() = default; _ZNK5Botan3TLS25Datagram_Sequence_Numbers18current_read_epochEv: 112| 522| uint16_t current_read_epoch() const override { return m_read_epoch; } _ZNK5Botan3TLS25Datagram_Sequence_Numbers19current_write_epochEv: 114| 805| uint16_t current_write_epoch() const override { return m_write_epoch; } _ZN5Botan3TLS25Datagram_Sequence_Numbers19next_write_sequenceEt: 116| 283| uint64_t next_write_sequence(uint16_t epoch) override { 117| 283| auto i = m_write_seqs.find(epoch); 118| 283| if(i == m_write_seqs.end()) { ------------------ | Branch (118:13): [True: 0, False: 283] ------------------ 119| 0| throw Invalid_State("DTLS epoch not found"); 120| 0| } 121| 283| if(i->second > 0x0000FFFFFFFFFFFF) { ------------------ | Branch (121:13): [True: 0, False: 283] ------------------ 122| 0| throw Invalid_State("DTLS write sequence number overflow"); 123| 0| } 124| 283| return (static_cast(epoch) << 48) | i->second++; 125| 283| } _ZNK5Botan3TLS25Datagram_Sequence_Numbers12already_seenEm: 129| 742| bool already_seen(uint64_t sequence) const override { 130| 742| const uint16_t epoch = static_cast(sequence >> 48); 131| 742| const uint64_t record_sequence = sequence & 0x0000FFFFFFFFFFFF; 132| 742| const auto window = m_read_windows.find(epoch); 133| | 134| 742| if(window == m_read_windows.end()) { ------------------ | Branch (134:13): [True: 13, False: 729] ------------------ 135| 13| return false; 136| 13| } 137| | 138| 729| const size_t window_size = sizeof(window->second.bits) * 8; 139| | 140| 729| if(record_sequence > window->second.highest) { ------------------ | Branch (140:13): [True: 696, False: 33] ------------------ 141| 696| return false; 142| 696| } 143| | 144| 33| const uint64_t offset = window->second.highest - record_sequence; 145| | 146| 33| if(offset >= window_size) { ------------------ | Branch (146:13): [True: 0, False: 33] ------------------ 147| 0| return true; // really old? 148| 0| } 149| | 150| 33| return (((window->second.bits >> offset) & 1) == 1); 151| 33| } _ZN5Botan3TLS23Stream_Sequence_NumbersC2Ev: 39| 3.13k| Stream_Sequence_Numbers() : m_write_seq_no(0), m_read_seq_no(0), m_read_epoch(0), m_write_epoch(0) {} _ZN5Botan3TLS23Stream_Sequence_Numbers21new_read_cipher_stateEv: 48| 385| void new_read_cipher_state() override { 49| 385| m_read_seq_no = 0; 50| 385| m_read_epoch++; 51| 385| } _ZN5Botan3TLS23Stream_Sequence_Numbers22new_write_cipher_stateEv: 53| 96| void new_write_cipher_state() override { 54| 96| m_write_seq_no = 0; 55| 96| m_write_epoch++; 56| 96| } _ZNK5Botan3TLS23Stream_Sequence_Numbers18current_read_epochEv: 58| 6.67k| uint16_t current_read_epoch() const override { return m_read_epoch; } _ZNK5Botan3TLS23Stream_Sequence_Numbers19current_write_epochEv: 60| 13.7k| uint16_t current_write_epoch() const override { return m_write_epoch; } _ZN5Botan3TLS23Stream_Sequence_Numbers19next_write_sequenceEt: 62| 10.3k| uint64_t next_write_sequence(uint16_t /*epoch*/) override { 63| 10.3k| if(m_write_seq_no == std::numeric_limits::max()) { ------------------ | Branch (63:13): [True: 0, False: 10.3k] ------------------ 64| 0| throw Invalid_State("TLS 1.2 write sequence number overflow"); 65| 0| } 66| 10.3k| return m_write_seq_no++; 67| 10.3k| } _ZN5Botan3TLS23Stream_Sequence_Numbers18next_read_sequenceEv: 69| 3.15k| uint64_t next_read_sequence() override { return m_read_seq_no; } _ZNK5Botan3TLS14Server_Impl_1220application_protocolEv: 66| 96| std::string application_protocol() const override { return m_next_protocol; } _ZNK5Botan3TLS12Session_Keys13master_secretEv: 46| 384| const secure_vector& master_secret() const { return m_master_sec; } _ZNK5Botan3TLS12Session_Keys15client_aead_keyEv: 26| 385| const secure_vector& client_aead_key() const { return m_c_aead; } _ZNK5Botan3TLS12Session_Keys15server_aead_keyEv: 31| 96| const secure_vector& server_aead_key() const { return m_s_aead; } _ZNK5Botan3TLS12Session_Keys12client_nonceEv: 36| 385| const std::vector& client_nonce() const { return m_c_nonce; } _ZNK5Botan3TLS12Session_Keys12server_nonceEv: 41| 96| const std::vector& server_nonce() const { return m_s_nonce; } _ZNK5Botan3TLS12Session_Keys8aead_keyENS0_15Connection_SideE: 48| 481| const secure_vector& aead_key(Connection_Side side) const { 49| 481| return (side == Connection_Side::Client) ? client_aead_key() : server_aead_key(); ------------------ | Branch (49:17): [True: 385, False: 96] ------------------ 50| 481| } _ZNK5Botan3TLS12Session_Keys5nonceENS0_15Connection_SideE: 52| 481| const std::vector& nonce(Connection_Side side) const { 53| 481| return (side == Connection_Side::Client) ? client_nonce() : server_nonce(); ------------------ | Branch (53:17): [True: 385, False: 96] ------------------ 54| 481| } _ZN5Botan3TLS12Session_KeysC2Ev: 56| 3.65k| Session_Keys() = default; _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEhQntsr3stdE7same_asIbT_EEES3_S3_: 43| 12.9k|constexpr inline T value_barrier(T x) { 44| 12.9k| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 12.9k] ------------------ 45| 0| return x; 46| 12.9k| } else { 47| 12.9k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 12.9k| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 12.9k| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 12.9k| } 64| 12.9k|} _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEmQntsr3stdE7same_asIbT_EEES3_S3_: 43| 177M|constexpr inline T value_barrier(T x) { 44| 177M| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 177M] ------------------ 45| 0| return x; 46| 177M| } else { 47| 177M|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 177M| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 177M| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 177M| } 64| 177M|} _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEjQntsr3stdE7same_asIbT_EEES3_S3_: 43| 271k|constexpr inline T value_barrier(T x) { 44| 271k| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 271k] ------------------ 45| 0| return x; 46| 271k| } else { 47| 271k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 271k| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 271k| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 271k| } 64| 271k|} _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEtQntsr3stdE7same_asIbT_EEES3_S3_: 43| 289k|constexpr inline T value_barrier(T x) { 44| 289k| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 289k] ------------------ 45| 0| return x; 46| 289k| } else { 47| 289k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 289k| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 289k| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 289k| } 64| 289k|} _ZN5Botan17is_sub_element_ofERKNS_3OIDESt16initializer_listIjE: 22| 24.9k|inline std::optional is_sub_element_of(const OID& oid, std::initializer_list prefix) { 23| 24.9k| const auto& c = oid.get_components(); 24| | 25| 24.9k| if(c.size() != prefix.size() + 1) { ------------------ | Branch (25:7): [True: 0, False: 24.9k] ------------------ 26| 0| return {}; 27| 0| } 28| | 29| 24.9k| if(!std::equal(c.begin(), c.end() - 1, prefix.begin(), prefix.end())) { ------------------ | Branch (29:7): [True: 0, False: 24.9k] ------------------ 30| 0| return {}; 31| 0| } 32| | 33| 24.9k| return c[c.size() - 1]; 34| 24.9k|} _ZN5Botan9AEAD_Mode19set_associated_dataENSt3__14spanIKhLm18446744073709551615EEE: 59| 480| void set_associated_data(std::span ad) { set_associated_data_n(0, ad); } _ZN5Botan21Allocator_InitializerC2Ev: 57| 1| Allocator_Initializer() { initialize_allocator(); } _ZN5Botan11ASN1_ObjectC2ERKS0_: 151| 147k| ASN1_Object(const ASN1_Object&) = default; _ZN5Botan11ASN1_ObjectD2Ev: 168| 930k| virtual ~ASN1_Object() = default; _ZN5Botan11ASN1_ObjectC2EOS0_: 161| 302k| ASN1_Object(ASN1_Object&&) = default; _ZNK5Botan14ASN1_BitString5bytesEv: 206| 37.6k| std::span bytes() const { return std::span{m_bytes}; } _ZNK5Botan14ASN1_BitString11unused_bitsEv: 211| 18.8k| size_t unused_bits() const { return m_unused_bits; } _ZNK5Botan10BER_Object6is_setEv: 267| 1.42M| bool is_set() const { return m_type_tag != ASN1_Type::NoObject; } _ZNK5Botan10BER_Object7taggingEv: 272| 567k| uint32_t tagging() const { return type_tag() | class_tag(); } _ZNK5Botan10BER_Object8type_tagEv: 277| 573k| ASN1_Type type_tag() const { return m_type_tag; } _ZNK5Botan10BER_Object9class_tagEv: 282| 654k| ASN1_Class class_tag() const { return m_class_tag; } _ZNK5Botan10BER_Object4typeEv: 287| 101k| ASN1_Type type() const { return m_type_tag; } _ZNK5Botan10BER_Object9get_classEv: 292| 50.5k| ASN1_Class get_class() const { return m_class_tag; } _ZNK5Botan10BER_Object4bitsEv: 298| 4.59M| const uint8_t* bits() const { return m_value.data(); } _ZNK5Botan10BER_Object6lengthEv: 303| 9.79M| size_t length() const { return m_value.size(); } _ZNK5Botan10BER_Object4dataEv: 308| 194k| std::span data() const { return std::span{m_value}; } _ZN5Botan10BER_Object12mutable_bitsEm: 344| 472k| uint8_t* mutable_bits(size_t length) { 345| 472k| m_value.resize(length); 346| 472k| return m_value.data(); 347| 472k| } _ZNK5Botan3OID5emptyEv: 468| 66.2k| bool empty() const { return m_id.empty(); } _ZNK5Botan3OID9has_valueEv: 474| 49.4k| bool has_value() const { return !empty(); } _ZNK5Botan3OIDeqERKS0_: 510| 36.9k| bool operator==(const OID& other) const { return m_id == other.m_id; } _ZNK5Botan3OID14get_componentsEv: 530| 725k| const std::vector& get_components() const { 531| 725k| return m_id; 532| 725k| } _ZNK5Botan11ASN1_String5valueEv: 590| 37.8k| const std::string& value() const { return m_utf8_str; } _ZNK5Botan19AlgorithmIdentifier3oidEv: 688| 68.5k| const OID& oid() const { return m_oid; } _ZNK5Botan19AlgorithmIdentifier10parametersEv: 693| 56.0k| const std::vector& parameters() const { return m_parameters; } _ZNK5Botan19AlgorithmIdentifier20parameters_are_emptyEv: 715| 31.4k| bool parameters_are_empty() const { return m_parameters.empty(); } _ZNK5Botan19AlgorithmIdentifier28parameters_are_null_or_emptyEv: 720| 25.1k| bool parameters_are_null_or_empty() const { return parameters_are_empty() || parameters_are_null(); } ------------------ | Branch (720:58): [True: 12.6k, False: 12.5k] | Branch (720:84): [True: 1, False: 12.5k] ------------------ _ZN5BotanorENS_10ASN1_ClassES0_: 91| 318k|inline ASN1_Class operator|(ASN1_Class x, ASN1_Class y) { 92| 318k| return static_cast(static_cast(x) | static_cast(y)); 93| 318k|} _ZN5BotanorENS_9ASN1_TypeENS_10ASN1_ClassE: 98| 567k|inline uint32_t operator|(ASN1_Type x, ASN1_Class y) { 99| 567k| return static_cast(x) | static_cast(y); 100| 567k|} _ZN5BotanorENS_10ASN1_ClassENS_9ASN1_TypeE: 105| 94.5k|inline uint32_t operator|(ASN1_Class x, ASN1_Type y) { 106| 94.5k| return static_cast(x) | static_cast(y); 107| 94.5k|} _ZN5BotanneERKNS_3OIDES2_: 561| 6.25k|inline bool operator!=(const OID& a, const OID& b) { 562| 6.25k| return !(a == b); 563| 6.25k|} _ZNKSt3__14hashIN5Botan3OIDEEclERKS2_: 761| 4| size_t operator()(const Botan::OID& oid) const noexcept { return static_cast(oid.hash_code()); } _ZN5Botan19AlgorithmIdentifierC2Ev: 655| 52.2k| AlgorithmIdentifier() = default; _ZN5Botan11ASN1_ObjectC2Ev: 146| 480k| ASN1_Object() = default; _ZN5Botan3OIDC2Ev: 423| 134k| explicit OID() = default; _ZN5Botan11ASN1_ObjectaSERKS0_: 156| 12.4k| ASN1_Object& operator=(const ASN1_Object&) = default; _ZN5Botan11ASN1_ObjectaSEOS0_: 166| 19.0k| ASN1_Object& operator=(ASN1_Object&&) = default; _ZN5Botan10BER_ObjectC2Ev: 239| 864k| BER_Object() = default; _ZN5Botan10BER_ObjectaSEOS0_: 259| 212k| BER_Object& operator=(BER_Object&& other) = default; _ZN5Botan14ASN1_BitStringC2Ev: 179| 18.8k| ASN1_BitString() = default; _ZN5Botan10BER_ObjectC2EOS0_: 249| 252k| BER_Object(BER_Object&& other) = default; _ZN5Botan9ASN1_TimeC2Ev: 42| 12.6k| ASN1_Time() = default; _ZN5Botan13ignore_paramsIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEEEEvDpRKT_: 142| 478|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJNS_3TLS15Session_SummaryEEEEvDpRKT_: 142| 96|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJNSt3__16vectorINS_16X509_CertificateENS1_9allocatorIS3_EEEENS_3TLS26Certificate_Status_RequestEEEEvDpRKT_: 142| 3|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJNS_3TLS16Protocol_VersionEEEEvDpRKT_: 142| 481|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJPKhmEEEvDpRKT_: 142| 11.8k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJjEEEvDpRKT_: 142| 213k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJPKtmEEEvDpRKT_: 142| 381|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJPKmmEEEvDpRKT_: 142| 10.6M|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJNS_3TLS20Client_Hello_12_ShimEEEEvDpRKT_: 142| 3.13k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan11BER_Decoder6Limits3DEREv: 42| 69.8k| static Limits DER() { return Limits(false, 0, false, DefaultMaxObjectSize, false); } _ZN5Botan11BER_Decoder6LimitsC2EbmbNSt3__18optionalImEEb: 133| 69.8k| m_allow_ber(allow_ber), 134| 69.8k| m_max_nested_indef(max_nested_indef), 135| 69.8k| m_allow_standalone_eoc(allow_standalone_eoc), 136| 69.8k| m_max_object_size(max_object_size), 137| 69.8k| m_reject_default_value_encoding(reject_default_value_encoding) {} _ZN5Botan11BER_Decoder14start_sequenceEv: 275| 158k| BER_Decoder start_sequence() { return start_cons(ASN1_Type::Sequence, ASN1_Class::Universal); } _ZN5Botan11BER_Decoder16decode_and_checkImEERS0_RKT_NSt3__117basic_string_viewIcNS6_11char_traitsIcEEEE: 701| 12.4k| BER_Decoder& decode_and_check(const T& expected, std::string_view error_msg) { 702| 12.4k| T actual; 703| 12.4k| decode(actual); 704| | 705| 12.4k| if(actual != expected) { ------------------ | Branch (705:13): [True: 0, False: 12.4k] ------------------ 706| 0| throw Decoding_Error(error_msg); 707| 0| } 708| | 709| 12.4k| return (*this); 710| 12.4k| } _ZN5Botan11BER_Decoder6decodeERm: 363| 18.7k| BER_Decoder& decode(size_t& out) { return decode(out, ASN1_Type::Integer, ASN1_Class::Universal); } _ZN5Botan11BER_Decoder6decodeINS_16secure_allocatorIhEEEERS0_RNSt3__16vectorIhT_EENS_9ASN1_TypeE: 386| 12.4k| BER_Decoder& decode(std::vector& out, ASN1_Type real_type) { 387| 12.4k| return decode(out, real_type, real_type, ASN1_Class::Universal); 388| 12.4k| } _ZNK5Botan11BER_Decoder6Limits18allow_ber_encodingEv: 56| 1.19M| bool allow_ber_encoding() const { return m_allow_ber; } _ZNK5Botan11BER_Decoder6Limits20require_der_encodingEv: 61| 719k| bool require_der_encoding() const { return !allow_ber_encoding(); } _ZNK5Botan11BER_Decoder6Limits15max_object_sizeEv: 80| 472k| std::optional max_object_size() const { return m_max_object_size; } _ZN5Botan11BER_DecoderC2ERKNS_10BER_ObjectENS0_6LimitsE: 167| 18.7k| BER_Decoder(obj.data(), limits) {} _ZNK5Botan11BER_Decoder6limitsEv: 197| 208k| Limits limits() const { return m_limits; } _ZN5Botan11BER_Decoder8get_nextERNS_10BER_ObjectE: 210| 12.4k| BER_Decoder& get_next(BER_Object& ber) { 211| 12.4k| ber = get_next_object(); 212| 12.4k| return (*this); 213| 12.4k| } _ZN5Botan11BER_Decoder9start_setEv: 281| 37.9k| BER_Decoder start_set() { return start_cons(ASN1_Type::Set, ASN1_Class::Universal); } _ZN5Botan11BER_Decoder6decodeERNS_6BigIntE: 368| 6.33k| BER_Decoder& decode(BigInt& out) { return decode(out, ASN1_Type::Integer, ASN1_Class::Universal); } _ZN5Botan11BER_Decoder6decodeINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EENS_9ASN1_TypeE: 386| 31.2k| BER_Decoder& decode(std::vector& out, ASN1_Type real_type) { 387| 31.2k| return decode(out, real_type, real_type, ASN1_Class::Universal); 388| 31.2k| } _ZN5Botan11BER_Decoder9raw_bytesINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EE: 338| 44.6k| BER_Decoder& raw_bytes(std::vector& out) { 339| 44.6k| out.clear(); 340| 3.33M| for(;;) { 341| 3.33M| if(auto next = this->read_next_byte()) { ------------------ | Branch (341:21): [True: 3.29M, False: 44.6k] ------------------ 342| 3.29M| out.push_back(*next); 343| 3.29M| } else { 344| 44.6k| break; 345| 44.6k| } 346| 3.33M| } 347| 44.6k| return (*this); 348| 44.6k| } _ZN5Botan11BER_Decoder30decode_octet_aligned_bitstringINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EENS_9ASN1_TypeENS_10ASN1_ClassE: 464| 12.6k| ASN1_Class class_tag = ASN1_Class::Universal) { 465| 12.6k| ASN1_BitString bits; 466| 12.6k| decode_bitstring(bits, type_tag, class_tag); 467| | 468| 12.6k| if(bits.unused_bits() != 0) { ------------------ | Branch (468:13): [True: 2, False: 12.6k] ------------------ 469| 2| throw Decoding_Error("Expected octet-aligned BIT STRING"); 470| 2| } 471| | 472| 12.6k| out.assign(bits.bytes().begin(), bits.bytes().end()); 473| 12.6k| return (*this); 474| 12.6k| } _ZN5Botan11BER_Decoder15decode_optionalImEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassERKS3_: 553| 6.33k| BER_Decoder& decode_optional(T& out, ASN1_Type type_tag, ASN1_Class class_tag, const T& default_value = T()) { 554| 6.33k| std::optional optval; 555| 6.33k| this->decode_optional(optval, type_tag, class_tag); 556| 6.33k| out = optval ? *optval : default_value; ------------------ | Branch (556:16): [True: 6.24k, False: 85] ------------------ 557| 6.33k| return (*this); 558| 6.33k| } _ZN5Botan11BER_Decoder15decode_optionalImEERS0_RNSt3__18optionalIT_EENS_9ASN1_TypeENS_10ASN1_ClassE: 827| 12.5k|BER_Decoder& BER_Decoder::decode_optional(std::optional& optval, ASN1_Type type_tag, ASN1_Class class_tag) { 828| 12.5k| BER_Object obj = get_next_object(); 829| | 830| 12.5k| if(obj.is_a(type_tag, class_tag)) { ------------------ | Branch (830:7): [True: 6.25k, False: 6.33k] ------------------ 831| 6.25k| T out{}; 832| 6.25k| if(class_tag == ASN1_Class::ExplicitContextSpecific) { ------------------ | Branch (832:10): [True: 6.25k, False: 0] ------------------ 833| 6.25k| BER_Decoder(obj, m_limits).decode(out).verify_end(); 834| 6.25k| } else { 835| 0| this->push_back(std::move(obj)); 836| | if constexpr(std::is_base_of_v) { 837| | // Object types check the tag in decode_from; a re-tagging 838| | // implicit override of an object is not supported here 839| | this->decode(out); 840| 0| } else { 841| 0| this->decode(out, type_tag, class_tag); 842| 0| } 843| 0| } 844| 6.25k| optval = std::move(out); 845| 6.33k| } else { 846| 6.33k| this->push_back(std::move(obj)); 847| 6.33k| optval = std::nullopt; 848| 6.33k| } 849| | 850| 12.5k| return (*this); 851| 12.5k|} _ZN5Botan11BER_Decoder22decode_optional_stringINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EENS_9ASN1_TypeEjNS_10ASN1_ClassE: 724| 12.4k| ASN1_Class class_tag = ASN1_Class::ContextSpecific) { 725| 12.4k| BER_Object obj = get_next_object(); 726| | 727| 12.4k| const ASN1_Type type_tag = static_cast(expected_tag); 728| | 729| 12.4k| if(obj.is_a(type_tag, class_tag)) { ------------------ | Branch (729:13): [True: 0, False: 12.4k] ------------------ 730| 0| if(class_tag == ASN1_Class::ExplicitContextSpecific) { ------------------ | Branch (730:16): [True: 0, False: 0] ------------------ 731| 0| BER_Decoder(obj, m_limits).decode(out, real_type).verify_end(); 732| 0| } else { 733| 0| push_back(std::move(obj)); 734| 0| decode(out, real_type, type_tag, class_tag); 735| 0| } 736| 12.4k| } else { 737| 12.4k| out.clear(); 738| 12.4k| push_back(std::move(obj)); 739| 12.4k| } 740| | 741| 12.4k| return (*this); 742| 12.4k| } _ZN5Botan11BER_Decoder15decode_optionalIbEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassERKS3_: 553| 31.2k| BER_Decoder& decode_optional(T& out, ASN1_Type type_tag, ASN1_Class class_tag, const T& default_value = T()) { 554| 31.2k| std::optional optval; 555| 31.2k| this->decode_optional(optval, type_tag, class_tag); 556| 31.2k| out = optval ? *optval : default_value; ------------------ | Branch (556:16): [True: 6.24k, False: 24.9k] ------------------ 557| 31.2k| return (*this); 558| 31.2k| } _ZN5Botan11BER_Decoder15decode_optionalIbEERS0_RNSt3__18optionalIT_EENS_9ASN1_TypeENS_10ASN1_ClassE: 827| 31.2k|BER_Decoder& BER_Decoder::decode_optional(std::optional& optval, ASN1_Type type_tag, ASN1_Class class_tag) { 828| 31.2k| BER_Object obj = get_next_object(); 829| | 830| 31.2k| if(obj.is_a(type_tag, class_tag)) { ------------------ | Branch (830:7): [True: 6.24k, False: 24.9k] ------------------ 831| 6.24k| T out{}; 832| 6.24k| if(class_tag == ASN1_Class::ExplicitContextSpecific) { ------------------ | Branch (832:10): [True: 0, False: 6.24k] ------------------ 833| 0| BER_Decoder(obj, m_limits).decode(out).verify_end(); 834| 6.24k| } else { 835| 6.24k| this->push_back(std::move(obj)); 836| | if constexpr(std::is_base_of_v) { 837| | // Object types check the tag in decode_from; a re-tagging 838| | // implicit override of an object is not supported here 839| | this->decode(out); 840| 6.24k| } else { 841| 6.24k| this->decode(out, type_tag, class_tag); 842| 6.24k| } 843| 6.24k| } 844| 6.24k| optval = std::move(out); 845| 24.9k| } else { 846| 24.9k| this->push_back(std::move(obj)); 847| 24.9k| optval = std::nullopt; 848| 24.9k| } 849| | 850| 31.2k| return (*this); 851| 31.2k|} x509_ext.cpp:_ZN5Botan11BER_Decoder21decode_optional_fieldIZNS_14Cert_Extension16Authority_Key_ID12decode_innerERKNSt3__16vectorIhNS4_9allocatorIhEEEEE3$_0EERS0_jNS_10ASN1_ClassEOT_: 626| 6.24k| BER_Decoder& decode_optional_field(uint32_t tag_no, ASN1_Class class_tag, F&& fn) { 627| 6.24k| if(peek_next_object().is_a(tag_no, class_tag)) { ------------------ | Branch (627:13): [True: 6.24k, False: 0] ------------------ 628| 6.24k| std::forward(fn)(*this); 629| 6.24k| } 630| 6.24k| return (*this); 631| 6.24k| } x509_ext.cpp:_ZN5Botan11BER_Decoder21decode_optional_fieldIZNS_14Cert_Extension16Authority_Key_ID12decode_innerERKNSt3__16vectorIhNS4_9allocatorIhEEEEE3$_1EERS0_jNS_10ASN1_ClassEOT_: 626| 6.24k| BER_Decoder& decode_optional_field(uint32_t tag_no, ASN1_Class class_tag, F&& fn) { 627| 6.24k| if(peek_next_object().is_a(tag_no, class_tag)) { ------------------ | Branch (627:13): [True: 0, False: 6.24k] ------------------ 628| 0| std::forward(fn)(*this); 629| 0| } 630| 6.24k| return (*this); 631| 6.24k| } x509_ext.cpp:_ZN5Botan11BER_Decoder21decode_optional_fieldIZNS_14Cert_Extension16Authority_Key_ID12decode_innerERKNSt3__16vectorIhNS4_9allocatorIhEEEEE3$_2EERS0_jNS_10ASN1_ClassEOT_: 626| 6.24k| BER_Decoder& decode_optional_field(uint32_t tag_no, ASN1_Class class_tag, F&& fn) { 627| 6.24k| if(peek_next_object().is_a(tag_no, class_tag)) { ------------------ | Branch (627:13): [True: 0, False: 6.24k] ------------------ 628| 0| std::forward(fn)(*this); 629| 0| } 630| 6.24k| return (*this); 631| 6.24k| } _ZN5Botan11BER_Decoder15decode_optionalINS_3OIDEEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassERKS4_: 553| 6.24k| BER_Decoder& decode_optional(T& out, ASN1_Type type_tag, ASN1_Class class_tag, const T& default_value = T()) { 554| 6.24k| std::optional optval; 555| 6.24k| this->decode_optional(optval, type_tag, class_tag); 556| 6.24k| out = optval ? *optval : default_value; ------------------ | Branch (556:16): [True: 0, False: 6.24k] ------------------ 557| 6.24k| return (*this); 558| 6.24k| } _ZN5Botan11BER_Decoder15decode_optionalINS_3OIDEEERS0_RNSt3__18optionalIT_EENS_9ASN1_TypeENS_10ASN1_ClassE: 827| 6.24k|BER_Decoder& BER_Decoder::decode_optional(std::optional& optval, ASN1_Type type_tag, ASN1_Class class_tag) { 828| 6.24k| BER_Object obj = get_next_object(); 829| | 830| 6.24k| if(obj.is_a(type_tag, class_tag)) { ------------------ | Branch (830:7): [True: 0, False: 6.24k] ------------------ 831| 0| T out{}; 832| 0| if(class_tag == ASN1_Class::ExplicitContextSpecific) { ------------------ | Branch (832:10): [True: 0, False: 0] ------------------ 833| 0| BER_Decoder(obj, m_limits).decode(out).verify_end(); 834| 0| } else { 835| 0| this->push_back(std::move(obj)); 836| 0| if constexpr(std::is_base_of_v) { 837| | // Object types check the tag in decode_from; a re-tagging 838| | // implicit override of an object is not supported here 839| 0| this->decode(out); 840| | } else { 841| | this->decode(out, type_tag, class_tag); 842| | } 843| 0| } 844| 0| optval = std::move(out); 845| 6.24k| } else { 846| 6.24k| this->push_back(std::move(obj)); 847| 6.24k| optval = std::nullopt; 848| 6.24k| } 849| | 850| 6.24k| return (*this); 851| 6.24k|} _ZN5Botan11BER_Decoder39decode_optional_octet_aligned_bitstringINS_16secure_allocatorIhEEEERS0_RNSt3__16vectorIhT_EEjNS_10ASN1_ClassE: 771| 6.24k| ASN1_Class class_tag = ASN1_Class::ContextSpecific) { 772| 6.24k| BER_Object obj = get_next_object(); 773| | 774| 6.24k| const ASN1_Type type_tag = static_cast(expected_tag); 775| | 776| 6.24k| if(obj.is_a(type_tag, class_tag)) { ------------------ | Branch (776:13): [True: 6.24k, False: 0] ------------------ 777| 6.24k| if(class_tag == ASN1_Class::ExplicitContextSpecific) { ------------------ | Branch (777:16): [True: 6.24k, False: 0] ------------------ 778| 6.24k| BER_Decoder(obj, m_limits).decode_octet_aligned_bitstring(out).verify_end(); 779| 6.24k| } else { 780| 0| push_back(std::move(obj)); 781| 0| decode_octet_aligned_bitstring(out, type_tag, class_tag); 782| 0| } 783| 6.24k| } else { 784| 0| out.clear(); 785| 0| push_back(std::move(obj)); 786| 0| } 787| | 788| 6.24k| return (*this); 789| 6.24k| } _ZN5Botan11BER_Decoder30decode_octet_aligned_bitstringINS_16secure_allocatorIhEEEERS0_RNSt3__16vectorIhT_EENS_9ASN1_TypeENS_10ASN1_ClassE: 464| 6.24k| ASN1_Class class_tag = ASN1_Class::Universal) { 465| 6.24k| ASN1_BitString bits; 466| 6.24k| decode_bitstring(bits, type_tag, class_tag); 467| | 468| 6.24k| if(bits.unused_bits() != 0) { ------------------ | Branch (468:13): [True: 0, False: 6.24k] ------------------ 469| 0| throw Decoding_Error("Expected octet-aligned BIT STRING"); 470| 0| } 471| | 472| 6.24k| out.assign(bits.bytes().begin(), bits.bytes().end()); 473| 6.24k| return (*this); 474| 6.24k| } _ZN5BotangeERKNS_6BigIntES2_: 1343| 21.0k|inline bool operator>=(const BigInt& a, const BigInt& b) { 1344| 21.0k| return (a.cmp(b) >= 0); 1345| 21.0k|} _ZN5BotanmiERKNS_6BigIntEm: 1229| 6|inline BigInt operator-(const BigInt& x, word y) { 1230| 6| return BigInt::add2(x, &y, 1, BigInt::Negative); 1231| 6|} _ZN5Botan6BigIntD2Ev: 185| 153k| ~BigInt() { _const_time_unpoison(); } _ZN5Botan6BigInt4zeroEv: 50| 18| static BigInt zero() { return BigInt(); } _ZN5Botan6BigIntC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 98| 36| explicit BigInt(std::string_view str) { *this = BigInt::from_string(str); } _ZN5Botan6BigIntC2EOS0_: 183| 21.0k| BigInt(BigInt&& other) noexcept { this->swap(other); } _ZN5Botan6BigIntaSEOS0_: 190| 25.1k| BigInt& operator=(BigInt&& other) noexcept { 191| 25.1k| if(this != &other) { ------------------ | Branch (191:13): [True: 25.1k, False: 0] ------------------ 192| 25.1k| this->swap(other); 193| 25.1k| } 194| | 195| 25.1k| return (*this); 196| 25.1k| } _ZN5Botan6BigInt4swapERS0_: 207| 77.6k| void swap(BigInt& other) noexcept { 208| 77.6k| m_data.swap(other.m_data); 209| 77.6k| std::swap(m_signedness, other.m_signedness); 210| 77.6k| } _ZN5Botan6BigInt3subEPKmmNS0_4SignE: 358| 101| BigInt& sub(const word y[], size_t y_words, Sign sign) { 359| 101| return add(y, y_words, sign == Positive ? Negative : Positive); ------------------ | Branch (359:33): [True: 101, False: 0] ------------------ 360| 101| } _ZN5Botan6BigInt5clearEv: 441| 54.9k| void clear() { 442| 54.9k| m_data.set_to_zero(); 443| 54.9k| m_signedness = Positive; 444| 54.9k| } _ZNK5Botan6BigInt7is_evenEv: 481| 6| bool is_even() const { return !get_bit(0); } _ZNK5Botan6BigInt6signumEv: 493| 157k| int signum() const { 494| 157k| if(sig_words() == 0) { ------------------ | Branch (494:13): [True: 6.25k, False: 151k] ------------------ 495| 6.25k| return 0; 496| 6.25k| } 497| 151k| return (sign() == Negative) ? -1 : 1; ------------------ | Branch (497:17): [True: 46, False: 151k] ------------------ 498| 157k| } _ZNK5Botan6BigInt7is_zeroEv: 510| 47| bool is_zero() const { return sig_words() == 0; } _ZN5Botan6BigInt7set_bitEm: 516| 24| void set_bit(size_t n) { conditionally_set_bit(n, true); } _ZN5Botan6BigInt21conditionally_set_bitEmb: 526| 24| void conditionally_set_bit(size_t n, bool set_it) { 527| 24| const size_t which = n / (sizeof(word) * 8); 528| 24| const word mask = static_cast(set_it) << (n % (sizeof(word) * 8)); 529| 24| m_data.set_word_at(which, word_at(which) | mask); 530| 24| } _ZNK5Botan6BigInt7get_bitEm: 549| 6| bool get_bit(size_t n) const { return ((word_at(n / (sizeof(word) * 8)) >> (n % (sizeof(word) * 8))) & 1) == 1; } _ZNK5Botan6BigInt7word_atEm: 601| 150k| word word_at(size_t n) const { return m_data.get_word_at(n); } _ZNK5Botan6BigInt4signEv: 641| 151k| Sign sign() const { return (m_signedness); } _ZN5Botan6BigInt8set_signENS0_4SignE: 663| 179| void set_sign(Sign sign) { 664| 179| if(sign == Negative && is_zero()) { ------------------ | Branch (664:13): [True: 23, False: 156] | Branch (664:33): [True: 0, False: 23] ------------------ 665| 0| sign = Positive; 666| 0| } 667| | 668| 179| m_signedness = sign; 669| 179| } _ZNK5Botan6BigInt4sizeEv: 681| 147k| size_t size() const { return m_data.size(); } _ZNK5Botan6BigInt9sig_wordsEv: 687| 293k| size_t sig_words() const { return m_data.sig_words(); } _ZN5Botan6BigInt12mutable_dataEv: 712| 21.2k| BOTAN_DEPRECATED("Deprecated no replacement") word* mutable_data() { return m_data.mutable_data(); } _ZNK5Botan6BigInt4dataEv: 718| 12| BOTAN_DEPRECATED("Deprecated no replacement") const word* data() const { return m_data.const_data(); } _ZNK5Botan6BigInt7grow_toEm: 738| 5.09k| BOTAN_DEPRECATED("Deprecated no replacement") void grow_to(size_t n) const { m_data.grow_to(n); } _ZN5Botan6BigInt10power_of_2Em: 906| 6| static BigInt power_of_2(size_t n) { 907| 6| BigInt b; 908| 6| b.set_bit(n); 909| 6| return b; 910| 6| } _ZNK5Botan6BigInt8_as_spanEv: 1023| 12| std::span _as_span() const { return m_data.const_span(); } _ZNK5Botan6BigInt5_dataEv: 1033| 116k| const word* _data() const { return m_data.const_data(); } _ZN5Botan6BigInt18_assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE: 1044| 25.0k| void _assign_from_bytes(std::span bytes) { assign_from_bytes(bytes); } _ZN5Botan6BigInt11_from_wordsERNSt3__16vectorImNS_16secure_allocatorImEEEE: 1052| 48| static BigInt _from_words(secure_vector& words) { 1053| 48| BigInt bn; 1054| 48| bn.m_data.swap(words); 1055| 48| return bn; 1056| 48| } _ZN5Botan6BigInt4Data12mutable_dataEv: 1083| 21.4k| word* mutable_data() { 1084| 21.4k| invalidate_sig_words(); 1085| 21.4k| return m_reg.data(); 1086| 21.4k| } _ZNK5Botan6BigInt4Data10const_dataEv: 1088| 270k| const word* const_data() const { return m_reg.data(); } _ZNK5Botan6BigInt4Data10const_spanEv: 1090| 12| std::span const_span() const { return std::span{m_reg}; } _ZNK5Botan6BigInt4Data11get_word_atEm: 1099| 150k| word get_word_at(size_t n) const { 1100| 150k| if(n < m_reg.size()) { ------------------ | Branch (1100:19): [True: 150k, False: 24] ------------------ 1101| 150k| return m_reg[n]; 1102| 150k| } 1103| 24| return 0; 1104| 150k| } _ZN5Botan6BigInt4Data11set_word_atEmm: 1106| 10.3k| void set_word_at(size_t i, word w) { 1107| 10.3k| invalidate_sig_words(); 1108| 10.3k| if(i >= m_reg.size()) { ------------------ | Branch (1108:19): [True: 10.3k, False: 0] ------------------ 1109| 10.3k| if(w == 0) { ------------------ | Branch (1109:22): [True: 0, False: 10.3k] ------------------ 1110| 0| return; 1111| 0| } 1112| 10.3k| grow_to(i + 1); 1113| 10.3k| } 1114| 10.3k| m_reg[i] = w; 1115| 10.3k| } _ZNK5Botan6BigInt4Data7grow_toEm: 1126| 15.4k| void grow_to(size_t n) const { 1127| 15.4k| if(n > size()) { ------------------ | Branch (1127:19): [True: 15.3k, False: 119] ------------------ 1128| 15.3k| if(n <= m_reg.capacity()) { ------------------ | Branch (1128:22): [True: 0, False: 15.3k] ------------------ 1129| 0| m_reg.resize(n); 1130| 15.3k| } else { 1131| 15.3k| m_reg.resize(n + (8 - (n % 8))); 1132| 15.3k| } 1133| 15.3k| } 1134| 15.4k| } _ZNK5Botan6BigInt4Data4sizeEv: 1136| 317k| size_t size() const { return m_reg.size(); } _ZN5Botan6BigInt4Data4swapERS1_: 1151| 77.6k| void swap(Data& other) noexcept { 1152| 77.6k| m_reg.swap(other.m_reg); 1153| 77.6k| std::swap(m_sig_words, other.m_sig_words); 1154| 77.6k| } _ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE: 1156| 54.9k| void swap(secure_vector& reg) noexcept { 1157| 54.9k| m_reg.swap(reg); 1158| 54.9k| invalidate_sig_words(); 1159| 54.9k| } _ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv: 1161| 86.8k| void invalidate_sig_words() const noexcept { m_sig_words = sig_words_npos; } _ZNK5Botan6BigInt4Data9sig_wordsEv: 1163| 293k| size_t sig_words() const { 1164| 293k| if(m_sig_words == sig_words_npos) { ------------------ | Branch (1164:19): [True: 56.8k, False: 236k] ------------------ 1165| 56.8k| m_sig_words = calc_sig_words(); 1166| 56.8k| } 1167| 293k| return m_sig_words; 1168| 293k| } _ZN5BotanplERKNS_6BigIntES2_: 1189| 12|inline BigInt operator+(const BigInt& x, const BigInt& y) { 1190| 12| return BigInt::add2(x, y._data(), y.sig_words(), y.sign()); 1191| 12|} _ZN5BotanmlEmRKNS_6BigIntE: 1255| 84|inline BigInt operator*(word x, const BigInt& y) { 1256| 84| return y * x; 1257| 84|} _ZN5BotaneqERKNS_6BigIntES2_: 1313| 6|inline bool operator==(const BigInt& a, const BigInt& b) { 1314| 6| return a.is_equal(b); 1315| 6|} _ZN5BotanneERKNS_6BigIntES2_: 1323| 6|inline bool operator!=(const BigInt& a, const BigInt& b) { 1324| 6| return !a.is_equal(b); 1325| 6|} _ZN5BotanltERKNS_6BigIntES2_: 1353| 6|inline bool operator<(const BigInt& a, const BigInt& b) { 1354| 6| return a.is_less_than(b); 1355| 6|} _ZN5BotaneqERKNS_6BigIntEm: 1373| 16.6k|inline bool operator==(const BigInt& a, word b) { 1374| 16.6k| return (a.cmp_word(b) == 0); 1375| 16.6k|} _ZN5BotanneERKNS_6BigIntEm: 1383| 6|inline bool operator!=(const BigInt& a, word b) { 1384| 6| return (a.cmp_word(b) != 0); 1385| 6|} _ZN5BotanltERKNS_6BigIntEm: 1413| 21.0k|inline bool operator<(const BigInt& a, word b) { 1414| 21.0k| return (a.cmp_word(b) < 0); 1415| 21.0k|} _ZNK5Botan6BigInt9serializeINSt3__16vectorIhNS2_9allocatorIhEEEEEET_m: 790| 16.6k| T serialize(size_t len) const { 791| | // TODO this supports std::vector and secure_vector 792| | // it would be nice if this also could work with std::array as in 793| | // bn.serialize_to>(32); 794| 16.6k| T out(len); 795| 16.6k| this->serialize_to(out); 796| 16.6k| return out; 797| 16.6k| } _ZN5Botan6BigIntC2Ev: 45| 111k| BigInt() = default; _ZN5Botan6BigIntC2ERKS0_: 88| 10.6k| BigInt(const BigInt& other) = default; _ZN5Botan6BigIntaSERKS0_: 201| 6| BigInt& operator=(const BigInt&) = default; _ZNK5Botan11BlockCipher14parallel_bytesEv: 71| 641| size_t parallel_bytes() const { return parallelism() * block_size() * BlockCipher::ParallelismMult; } _ZNK5Botan11BlockCipher7encryptEPh: 104| 442| void encrypt(uint8_t block[]) const { encrypt_n(block, block, 1); } _ZNK5Botan11BlockCipher7encryptENSt3__14spanIhLm18446744073709551615EEE: 118| 2.17k| void encrypt(std::span block) const { 119| 2.17k| return encrypt_n(block.data(), block.data(), block.size() / block_size()); 120| 2.17k| } _ZNK5Botan11BlockCipher7encryptENSt3__14spanIKhLm18446744073709551615EEENS2_IhLm18446744073709551615EEE: 135| 1.96k| void encrypt(std::span in, std::span out) const { 136| 1.96k| return encrypt_n(in.data(), out.data(), in.size() / block_size()); 137| 1.96k| } _ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm16ELm0ELm1ENS_11BlockCipherEE8key_specEv: 246| 357| Key_Length_Specification key_spec() const final { return Key_Length_Specification(KMIN, KMAX, KMOD); } _ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm16ELm0ELm1ENS_11BlockCipherEE10block_sizeEv: 240| 4.10k| size_t block_size() const final { return BS; } _ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm32ELm0ELm1ENS_11BlockCipherEE8key_specEv: 246| 646| Key_Length_Specification key_spec() const final { return Key_Length_Specification(KMIN, KMAX, KMOD); } _ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm32ELm0ELm1ENS_11BlockCipherEE10block_sizeEv: 240| 1.46k| size_t block_size() const final { return BS; } _ZNK5Botan25Block_Cipher_Fixed_ParamsILm8ELm16ELm24ELm8ENS_11BlockCipherEE8key_specEv: 246| 315| Key_Length_Specification key_spec() const final { return Key_Length_Specification(KMIN, KMAX, KMOD); } _ZNK5Botan25Block_Cipher_Fixed_ParamsILm8ELm16ELm24ELm8ENS_11BlockCipherEE10block_sizeEv: 240| 288| size_t block_size() const final { return BS; } _ZN5Botan20Buffered_Computation6updateEPKhm: 35| 244| void update(const uint8_t in[], size_t length) { add_data({in, length}); } _ZN5Botan20Buffered_Computation6updateENSt3__14spanIKhLm18446744073709551615EEE: 41| 157k| void update(std::span in) { add_data(in); } _ZN5Botan20Buffered_Computation5finalEPh: 97| 640| void final(uint8_t out[]) { final_result({out, output_length()}); } _ZN5Botan20Buffered_Computation12final_stdvecEv: 114| 18.8k| std::vector final_stdvec() { return final>(); } _ZN5Botan20Buffered_Computation5finalITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS3_9allocatorIhEEEEEET_v: 104| 18.8k| T final() { 105| 18.8k| T output(output_length()); 106| 18.8k| final_result(output); 107| 18.8k| return output; 108| 18.8k| } _ZN5Botan20Buffered_Computation5finalITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_v: 104| 8.39k| T final() { 105| 8.39k| T output(output_length()); 106| 8.39k| final_result(output); 107| 8.39k| return output; 108| 8.39k| } _ZN5Botan20Buffered_ComputationD2Ev: 169| 23.4k| virtual ~Buffered_Computation() = default; _ZN5Botan20Buffered_Computation5finalITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEEvRT_: 127| 6.79k| void final(T& out) { 128| 6.79k| out.resize(output_length()); 129| 6.79k| final_result(out); 130| 6.79k| } _ZN5Botan20Buffered_Computation7processITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_NS3_4spanIKhLm18446744073709551615EEE: 164| 6.79k| T process(std::span in) { 165| 6.79k| update(in); 166| 6.79k| return final(); 167| 6.79k| } _ZN5Botan20Buffered_Computation5finalITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS3_9allocatorIhEEEEEEvRT_: 127| 5.52k| void final(T& out) { 128| 5.52k| out.resize(output_length()); 129| 5.52k| final_result(out); 130| 5.52k| } _ZNK5Botan10ChaCha_RNG31max_number_of_bytes_per_requestEv: 120| 35.6k| size_t max_number_of_bytes_per_request() const override { return 0; } _ZN5Botan11Cipher_Mode5startENSt3__14spanIKhLm18446744073709551615EEE: 98| 720| void start(std::span nonce) { start_msg(nonce.data(), nonce.size()); } _ZN5Botan11Cipher_Mode6finishERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 185| 480| void finish(secure_vector& final_block, size_t offset = 0) { finish_msg(final_block, offset); } _ZN5Botan11Cipher_Mode7processENSt3__14spanIhLm18446744073709551615EEE: 132| 255| size_t process(std::span msg) { return this->process_msg(msg.data(), msg.size()); } _ZN5Botan11Cipher_Mode7processEPhm: 140| 240| size_t process(uint8_t msg[], size_t msg_len) { return this->process_msg(msg, msg_len); } _ZN5Botan11Cipher_Mode6updateITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEEvRT_m: 155| 255| void update(T& buffer, size_t offset = 0) { 156| 255| const size_t written = process(std::span(buffer).subspan(offset)); 157| 255| buffer.resize(offset + written); 158| 255| } _ZN5Botan19Credentials_ManagerD2Ev: 42| 6.24k| virtual ~Credentials_Manager() = default; _ZN5Botan8CurveGFp4swapERS0_: 82| 10.5k| void swap(CurveGFp& other) noexcept { std::swap(m_group, other.m_group); } _ZN5Botan8CurveGFpC2Ev: 75| 10.5k| CurveGFp() = default; _ZN5Botan10DataSourceD2Ev: 109| 303k| virtual ~DataSource() = default; _ZN5Botan17DataSource_MemoryC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 175| 6.24k| explicit DataSource_Memory(secure_vector in) : m_source(std::move(in)), m_offset(0) {} _ZN5Botan17DataSource_MemoryC2ENSt3__14spanIKhLm18446744073709551615EEE: 181| 101k| explicit DataSource_Memory(std::span in) : m_offset(0) { 182| | // Guard against forming a range from a null pointer (eg an empty span) 183| 101k| if(!in.empty()) { ------------------ | Branch (183:13): [True: 101k, False: 16] ------------------ 184| 101k| m_source.assign(in.begin(), in.end()); 185| 101k| } 186| 101k| } _ZN5Botan10DataSourceC2Ev: 107| 366k| DataSource() = default; _ZN5Botan11DER_Encoder14start_sequenceEv: 86| 60.2k| DER_Encoder& start_sequence() { return start_cons(ASN1_Type::Sequence, ASN1_Class::Universal); } _ZN5Botan11DER_Encoder12DER_SequenceD2Ev: 504| 311k| ~DER_Sequence() = default; _ZN5Botan11DER_Encoder22start_context_specificEj: 113| 31.0k| DER_Encoder& start_context_specific(uint32_t tag) { 114| 31.0k| return start_cons(ASN1_Type(tag), ASN1_Class::ContextSpecific); 115| 31.0k| } _ZN5Botan11DER_Encoder9raw_bytesENSt3__14spanIKhLm18446744073709551615EEE: 154| 43.5k| DER_Encoder& raw_bytes(std::span val) { return raw_bytes(val.data(), val.size()); } _ZN5Botan11DER_Encoder30encode_octet_aligned_bitstringENSt3__14spanIKhLm18446744073709551615EEENS_9ASN1_TypeENS_10ASN1_ClassE: 212| 6.25k| ASN1_Class class_tag = ASN1_Class::Universal) { 213| 6.25k| return encode_bitstring(bytes, 0, type_tag, class_tag); 214| 6.25k| } _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassENSt3__14spanIKhLm18446744073709551615EEE: 410| 91.7k| DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, std::span rep) { 411| 91.7k| return add_object(type_tag, class_tag, rep.data(), rep.size()); 412| 91.7k| } _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS3_9allocatorIhEEEE: 421| 85.5k| DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const std::vector& rep) { 422| 85.5k| return add_object(type_tag, class_tag, std::span{rep}); 423| 85.5k| } _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE: 432| 6.25k| DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const secure_vector& rep) { 433| 6.25k| return add_object(type_tag, class_tag, std::span{rep}); 434| 6.25k| } _ZN5Botan11DER_Encoder12DER_SequenceC2EOS1_: 487| 219k| m_type_tag(seq.m_type_tag), 488| 219k| m_class_tag(seq.m_class_tag), 489| 219k| m_sort_contents(seq.m_sort_contents), 490| 219k| m_contents(std::move(seq.m_contents)), 491| 219k| m_set_contents(std::move(seq.m_set_contents)) {} _ZN5Botan7DNSNameC2ENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEE: 101| 6.24k| explicit DNSName(std::string canonical) : m_name(std::move(canonical)) {} _ZNK5Botan14EC_AffinePoint5innerEv: 354| 25.5k| const EC_AffinePoint_Data& inner() const { return *m_point; } _ZNK5Botan14EC_AffinePoint22serialize_uncompressedITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS3_9allocatorIhEEEEEET_v: 232| 4.20k| T serialize_uncompressed() const { 233| 4.20k| T bytes(1 + 2 * this->field_element_bytes()); 234| 4.20k| this->serialize_uncompressed_to(bytes); 235| 4.20k| return bytes; 236| 4.20k| } _ZNK5Botan14EC_AffinePoint20serialize_compressedITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS3_9allocatorIhEEEEEET_v: 242| 53| T serialize_compressed() const { 243| 53| T bytes(1 + this->field_element_bytes()); 244| 53| this->serialize_compressed_to(bytes); 245| 53| return bytes; 246| 53| } _ZNK5Botan8EC_Group5_dataEv: 545| 20.9k| const std::shared_ptr& _data() const { return m_data; } _ZN5Botan8EC_GroupC2EOS0_: 238| 19.3k| EC_Group(EC_Group&&) = default; _ZN5Botan8EC_PointaSEOS0_: 75| 10.5k| EC_Point& operator=(EC_Point&& other) noexcept { 76| 10.5k| if(this != &other) { ------------------ | Branch (76:13): [True: 10.5k, False: 0] ------------------ 77| 10.5k| this->swap(other); 78| 10.5k| } 79| 10.5k| return (*this); 80| 10.5k| } _ZN5Botan8EC_PointD2Ev: 82| 21.0k| ~EC_Point() = default; _ZN5Botan8EC_PointC2Ev: 49| 10.5k| EC_Point() = default; _ZNK5Botan9EC_Scalar10is_nonzeroEv: 170| 8.86k| bool is_nonzero() const { return !is_zero(); } _ZNK5Botan9EC_Scalar6_innerEv: 277| 4.25k| const EC_Scalar_Data& _inner() const { return inner(); } _ZNK5Botan9EC_Scalar5innerEv: 291| 23.6k| const EC_Scalar_Data& inner() const { return *m_scalar; } _ZN5Botan12EC_PublicKeyC2Ev: 140| 8.86k| EC_PublicKey() = default; _ZN5Botan12EC_PublicKeyD2Ev: 42| 10.5k| ~EC_PublicKey() override = default; _ZN5Botan13EC_PrivateKeyD2Ev: 173| 8.86k| ~EC_PrivateKey() override = default; _ZNK5Botan12EC_PublicKey14point_encodingEv: 102| 4.25k| EC_Point_Format point_encoding() const { return m_point_encoding; } _ZN5Botan14ECDH_PublicKeyC1ERKNS_8EC_GroupERKNS_14EC_AffinePointE: 44| 1.63k| ECDH_PublicKey(const EC_Group& group, const EC_AffinePoint& public_key) : EC_PublicKey(group, public_key) {} _ZN5Botan15ECDH_PrivateKeyC1ERNS_21RandomNumberGeneratorERKNS_8EC_GroupE: 101| 2.61k| ECDH_PrivateKey(RandomNumberGenerator& rng, const EC_Group& group) : EC_PrivateKey(rng, group) {} _ZN5Botan14ECDH_PublicKeyC2Ev: 67| 2.61k| ECDH_PublicKey() = default; _ZNK5Botan14ECDH_PublicKey9algo_nameEv: 50| 5.37k| std::string algo_name() const override { return "ECDH"; } _ZN5Botan16ECDSA_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 98| 6.24k| EC_PrivateKey(assert_algorithm_identifier(alg_id, "ECDSA"), key_bits) {} _ZN5Botan15ECDSA_PublicKeyC2Ev: 79| 6.24k| ECDSA_PublicKey() = default; _ZNK5Botan9Exception4whatEv: 94| 1.44k| const char* what() const noexcept override { return m_msg.c_str(); } _ZN5Botan13Invalid_StateC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 284| 27| explicit Invalid_State(std::string_view err) : Exception(err) {} _ZN5Botan10hex_encodeENSt3__14spanIKhLm18446744073709551615EEEb: 43| 12.4k|inline std::string hex_encode(std::span input, bool uppercase = true) { 44| 12.4k| return hex_encode(input.data(), input.size(), uppercase); 45| 12.4k|} _ZN5Botan3KDFD2Ev: 27| 1.59k| virtual ~KDF() = default; _ZNK5Botan3KDF10derive_keyITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_mNS3_4spanIKhLm18446744073709551615EEESB_SB_: 145| 3.00k| std::span label) const { 146| 3.00k| T key(key_len); 147| 3.00k| perform_kdf(key, secret, salt, label); 148| 3.00k| return key; 149| 3.00k| } _ZNK5Botan3KDF10derive_keyITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_mPKhmSA_mSA_m: 99| 1.40k| size_t label_len = 0) const { 100| 1.40k| return derive_key(key_len, {secret, secret_len}, {salt, salt_len}, {label, label_len}); 101| 1.40k| } _ZN5Botan9clear_memIhEEvPT_m: 118| 22.0k|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 22.0k| clear_bytes(ptr, sizeof(T) * n); 120| 22.0k|} _ZN5Botan11clear_bytesEPvm: 101| 198k|inline constexpr void clear_bytes(void* ptr, size_t bytes) { 102| 198k| if(bytes > 0) { ------------------ | Branch (102:7): [True: 143k, False: 54.9k] ------------------ 103| 143k| std::memset(ptr, 0, bytes); 104| 143k| } 105| 198k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm4EEETkNS1_16contiguous_rangeENS2_4spanIhLm32EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEEEvOSM_RKSC_: 176| 10.8k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 10.8k| ranges::assert_equal_byte_lengths(out, in); 178| 10.8k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 10.8k|} _ZN5Botan13typecast_copyINSt3__15arrayImLm4EEETkNS_6ranges16contiguous_rangeENS1_4spanIhLm32EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS7_Esr3stdE23is_trivially_copyable_vINS1_11conditionalIXsr21__is_primary_templateINS1_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS1_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS1_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEES7_RKSC_: 210| 10.8k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 10.8k| ToT dst; // NOLINT(*-member-init) 212| 10.8k| typecast_copy(dst, src); 213| 10.8k| return dst; 214| 10.8k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm4EEETkNS1_16contiguous_rangeENS2_4spanIKhLm32EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 11.7k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 11.7k| ranges::assert_equal_byte_lengths(out, in); 178| 11.7k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 11.7k|} _ZN5Botan13typecast_copyINSt3__15arrayImLm4EEETkNS_6ranges16contiguous_rangeENS1_4spanIKhLm32EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS8_Esr3stdE23is_trivially_copyable_vINS1_11conditionalIXsr21__is_primary_templateINS1_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS1_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS1_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEEES8_RKSD_: 210| 11.7k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 11.7k| ToT dst; // NOLINT(*-member-init) 212| 11.7k| typecast_copy(dst, src); 213| 11.7k| return dst; 214| 11.7k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm32EEETkNS1_16contiguous_rangeENS2_5arrayImLm4EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 11.2k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 11.2k| ranges::assert_equal_byte_lengths(out, in); 178| 11.2k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 11.2k|} _ZN5Botan7xor_bufITkNS_6ranges23contiguous_output_rangeIhEENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeIhEENS4_IKhLm18446744073709551615EEEEEvOT_OT0_: 404| 8.94k| ranges::contiguous_range auto&& in) { 405| 8.94k| ranges::assert_equal_byte_lengths(out, in); 406| | 407| 8.94k| std::span o(out); 408| 8.94k| std::span i(in); 409| | 410| 19.7k| for(; o.size_bytes() >= 32; o = o.subspan(32), i = i.subspan(32)) { ------------------ | Branch (410:10): [True: 10.8k, False: 8.94k] ------------------ 411| 10.8k| auto x = typecast_copy>(o.template first<32>()); 412| 10.8k| const auto y = typecast_copy>(i.template first<32>()); 413| | 414| 10.8k| x[0] ^= y[0]; 415| 10.8k| x[1] ^= y[1]; 416| 10.8k| x[2] ^= y[2]; 417| 10.8k| x[3] ^= y[3]; 418| | 419| 10.8k| typecast_copy(o.template first<32>(), x); 420| 10.8k| } 421| | 422| 137k| for(size_t off = 0; off != o.size_bytes(); ++off) { ------------------ | Branch (422:24): [True: 128k, False: 8.94k] ------------------ 423| 128k| o[off] ^= i[off]; 424| 128k| } 425| 8.94k|} _ZN5Botan7xor_bufITkNS_6ranges23contiguous_output_rangeIhEENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeIhEENS4_IKhLm18446744073709551615EEETkNS6_IhEES8_EEvOT_OT0_OT1_: 435| 1.76k| ranges::contiguous_range auto&& in2) { 436| 1.76k| ranges::assert_equal_byte_lengths(out, in1, in2); 437| | 438| 1.76k| std::span o{out}; 439| 1.76k| std::span i1{in1}; 440| 1.76k| std::span i2{in2}; 441| | 442| 2.26k| for(; o.size_bytes() >= 32; o = o.subspan(32), i1 = i1.subspan(32), i2 = i2.subspan(32)) { ------------------ | Branch (442:10): [True: 496, False: 1.76k] ------------------ 443| 496| auto x = typecast_copy>(i1.template first<32>()); 444| 496| const auto y = typecast_copy>(i2.template first<32>()); 445| | 446| 496| x[0] ^= y[0]; 447| 496| x[1] ^= y[1]; 448| 496| x[2] ^= y[2]; 449| 496| x[3] ^= y[3]; 450| | 451| 496| typecast_copy(o.template first<32>(), x); 452| 496| } 453| | 454| 29.7k| for(size_t off = 0; off != o.size_bytes(); ++off) { ------------------ | Branch (454:24): [True: 27.9k, False: 1.76k] ------------------ 455| 27.9k| o[off] = i1[off] ^ i2[off]; 456| 27.9k| } 457| 1.76k|} _ZN5Botan7xor_bufEPhPKhm: 465| 8.86k|inline void xor_buf(uint8_t out[], const uint8_t in[], size_t length) { 466| | // simply assumes that *out and *in point to "length" allocated bytes at least 467| 8.86k| xor_buf(std::span{out, length}, std::span{in, length}); 468| 8.86k|} _ZN5Botan7xor_bufEPhPKhS2_m: 477| 1.76k|inline void xor_buf(uint8_t out[], const uint8_t in[], const uint8_t in2[], size_t length) { 478| | // simply assumes that *out, *in, and *in2 point to "length" allocated bytes at least 479| 1.76k| xor_buf(std::span{out, length}, std::span{in, length}, std::span{in2, length}); 480| 1.76k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm8EEEmQaaaasr3stdE23is_trivially_copyable_vIT0_Entsr3std6rangesE5rangeIS7_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvOSC_RKS7_: 199| 418k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromT& in) { 200| 418k| typecast_copy(out, std::span(&in, 1)); 201| 418k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm8EEETkNS1_16contiguous_rangeENS3_IKmLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 418k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 418k| ranges::assert_equal_byte_lengths(out, in); 178| 418k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 418k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_: 210| 428k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 428k| ToT dst; // NOLINT(*-member-init) 212| 428k| typecast_copy(dst, src); 213| 428k| return dst; 214| 428k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_: 188| 428k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 428k| typecast_copy(std::span(&out, 1), in); 190| 428k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IKhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 428k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 428k| ranges::assert_equal_byte_lengths(out, in); 178| 428k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 428k|} _ZN5Botan13typecast_copyItTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm2EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_: 210| 29.7k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 29.7k| ToT dst; // NOLINT(*-member-init) 212| 29.7k| typecast_copy(dst, src); 213| 29.7k| return dst; 214| 29.7k|} _ZN5Botan13typecast_copyItTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm2EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_: 188| 29.7k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 29.7k| typecast_copy(std::span(&out, 1), in); 190| 29.7k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanItLm1EEETkNS1_16contiguous_rangeENS3_IKhLm2EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 29.7k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 29.7k| ranges::assert_equal_byte_lengths(out, in); 178| 29.7k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 29.7k|} _ZN5Botan13typecast_copyIjTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm4EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_: 210| 547|inline constexpr ToT typecast_copy(const FromR& src) { 211| 547| ToT dst; // NOLINT(*-member-init) 212| 547| typecast_copy(dst, src); 213| 547| return dst; 214| 547|} _ZN5Botan13typecast_copyIjTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm4EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_: 188| 547|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 547| typecast_copy(std::span(&out, 1), in); 190| 547|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanIjLm1EEETkNS1_16contiguous_rangeENS3_IKhLm4EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 547|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 547| ranges::assert_equal_byte_lengths(out, in); 178| 547| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 547|} _ZN5Botan8copy_memIhQsr3stdE12is_trivial_vIu7__decayIT_EEEEvPS1_PKS1_m: 144| 10.8M|inline constexpr void copy_mem(T* out, const T* in, size_t n) { 145| 10.8M| BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null"); ------------------ | | 103| 10.8M| do { \ | | 104| 10.8M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 105| 21.5M| if((expr1) && !(expr2)) { \ | | ------------------ | | | Branch (105:10): [True: 10.7M, False: 84.5k] | | | Branch (105:23): [True: 10.7M, False: 0] | | | Branch (105:23): [True: 10.7M, False: 0] | | ------------------ | | 106| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 107| 0| Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \ | | 108| 0| } \ | | 109| 10.8M| } while(0) | | ------------------ | | | Branch (109:12): [Folded, False: 10.8M] | | ------------------ ------------------ 146| | 147| 10.8M| if(in != nullptr && out != nullptr && n > 0) { ------------------ | Branch (147:7): [True: 10.8M, False: 12.6k] | Branch (147:24): [True: 10.8M, False: 6.60k] | Branch (147:42): [True: 10.7M, False: 65.2k] ------------------ 148| 10.7M| std::memmove(out, in, sizeof(T) * n); 149| 10.7M| } 150| 10.8M|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm8EEETkNS1_16contiguous_rangeENS3_ImLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 113k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 113k| ranges::assert_equal_byte_lengths(out, in); 178| 113k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 113k|} _ZN5Botan19secure_scrub_memoryITkNS_6ranges23contiguous_output_rangeERNSt3__16vectorIhNS2_9allocatorIhEEEEEEvOT_: 59| 1.11M|void secure_scrub_memory(ranges::contiguous_output_range auto&& data) { 60| 1.11M| secure_scrub_memory(std::ranges::data(data), ranges::size_bytes(data)); 61| 1.11M|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm2EEEtQaaaasr3stdE23is_trivially_copyable_vIT0_Entsr3std6rangesE5rangeIS7_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvOSC_RKS7_: 199| 13|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromT& in) { 200| 13| typecast_copy(out, std::span(&in, 1)); 201| 13|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm2EEETkNS1_16contiguous_rangeENS3_IKtLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 13|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 13| ranges::assert_equal_byte_lengths(out, in); 178| 13| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 13|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm4EEEjQaaaasr3stdE23is_trivially_copyable_vIT0_Entsr3std6rangesE5rangeIS7_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvOSC_RKS7_: 199| 564k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromT& in) { 200| 564k| typecast_copy(out, std::span(&in, 1)); 201| 564k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm4EEETkNS1_16contiguous_rangeENS3_IKjLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 564k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 564k| ranges::assert_equal_byte_lengths(out, in); 178| 564k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 564k|} _ZN5Botan9clear_memIjEEvPT_m: 118| 6|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 6| clear_bytes(ptr, sizeof(T) * n); 120| 6|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__14spanImLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEEEvOSM_RKSC_: 176| 4.25k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 4.25k| ranges::assert_equal_byte_lengths(out, in); 178| 4.25k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 4.25k|} _ZN5Botan8copy_memImQsr3stdE12is_trivial_vIu7__decayIT_EEEEvPS1_PKS1_m: 144| 33.4k|inline constexpr void copy_mem(T* out, const T* in, size_t n) { 145| 33.4k| BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null"); ------------------ | | 103| 33.4k| do { \ | | 104| 33.4k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 105| 66.8k| if((expr1) && !(expr2)) { \ | | ------------------ | | | Branch (105:10): [True: 33.4k, False: 0] | | | Branch (105:23): [True: 33.4k, False: 0] | | | Branch (105:23): [True: 33.4k, False: 0] | | ------------------ | | 106| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 107| 0| Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \ | | 108| 0| } \ | | 109| 33.4k| } while(0) | | ------------------ | | | Branch (109:12): [Folded, False: 33.4k] | | ------------------ ------------------ 146| | 147| 33.4k| if(in != nullptr && out != nullptr && n > 0) { ------------------ | Branch (147:7): [True: 33.4k, False: 0] | Branch (147:24): [True: 33.4k, False: 0] | Branch (147:42): [True: 33.4k, False: 0] ------------------ 148| 33.4k| std::memmove(out, in, sizeof(T) * n); 149| 33.4k| } 150| 33.4k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 53|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 53| ranges::assert_equal_byte_lengths(out, in); 162| 53| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 53] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 53| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 53, False: 0] ------------------ 165| 53| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 53| } 167| 53|} _ZN5Botan9clear_memImEEvPT_m: 118| 55.0k|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 55.0k| clear_bytes(ptr, sizeof(T) * n); 120| 55.0k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 29.9k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 29.9k| ranges::assert_equal_byte_lengths(out, in); 162| 29.9k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 29.9k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 29.9k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 29.9k, False: 0] ------------------ 165| 29.9k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 29.9k| } 167| 29.9k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_: 210| 27.0k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 27.0k| ToT dst; // NOLINT(*-member-init) 212| 27.0k| typecast_copy(dst, src); 213| 27.0k| return dst; 214| 27.0k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_: 188| 27.0k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 27.0k| typecast_copy(std::span(&out, 1), in); 190| 27.0k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_: 176| 27.0k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 27.0k| ranges::assert_equal_byte_lengths(out, in); 178| 27.0k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 27.0k|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm18446744073709551615EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS5_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEE: 132| 164|{ 133| 164| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 164|} _ZN5BotaneOINS_16secure_allocatorIhEES2_EERNSt3__16vectorIhT_EES7_RKNS4_IhT0_EE: 532| 417|std::vector& operator^=(std::vector& out, const std::vector& in) { 533| 417| if(out.size() < in.size()) { ------------------ | Branch (533:7): [True: 0, False: 417] ------------------ 534| 0| out.resize(in.size()); 535| 0| } 536| | 537| 417| xor_buf(std::span{out}.first(in.size()), in); 538| 417| return out; 539| 417|} _ZN5Botan7xor_bufITkNS_6ranges23contiguous_output_rangeIhEENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeIhEERKNS3_6vectorIhNS_16secure_allocatorIhEEEEEEvOT_OT0_: 404| 417| ranges::contiguous_range auto&& in) { 405| 417| ranges::assert_equal_byte_lengths(out, in); 406| | 407| 417| std::span o(out); 408| 417| std::span i(in); 409| | 410| 417| for(; o.size_bytes() >= 32; o = o.subspan(32), i = i.subspan(32)) { ------------------ | Branch (410:10): [True: 0, False: 417] ------------------ 411| 0| auto x = typecast_copy>(o.template first<32>()); 412| 0| const auto y = typecast_copy>(i.template first<32>()); 413| | 414| 0| x[0] ^= y[0]; 415| 0| x[1] ^= y[1]; 416| 0| x[2] ^= y[2]; 417| 0| x[3] ^= y[3]; 418| | 419| 0| typecast_copy(o.template first<32>(), x); 420| 0| } 421| | 422| 7.08k| for(size_t off = 0; off != o.size_bytes(); ++off) { ------------------ | Branch (422:24): [True: 6.67k, False: 417] ------------------ 423| 6.67k| o[off] ^= i[off]; 424| 6.67k| } 425| 417|} _ZN5Botan19secure_scrub_memoryITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm16EEEEEvOT_: 59| 332|void secure_scrub_memory(ranges::contiguous_output_range auto&& data) { 60| 332| secure_scrub_memory(std::ranges::data(data), ranges::size_bytes(data)); 61| 332|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm56EEETkNS1_16contiguous_rangeENS2_4spanIKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeENS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISV_EEEvOSD_RKSN_: 160| 2|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 2| ranges::assert_equal_byte_lengths(out, in); 162| 2| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 2] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 2| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 2, False: 0] ------------------ 165| 2| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 2| } 167| 2|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm56EEETkNS1_16contiguous_rangeENS2_6vectorIhNS_16secure_allocatorIhEEEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISH_EESI_E4type10value_typeENSA_IXsr21__is_primary_templateINSB_Iu14__remove_cvrefIDTclL_ZNSD_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSJ_ISR_EESS_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISW_EEEvOSE_RKSO_: 160| 13|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 13| ranges::assert_equal_byte_lengths(out, in); 162| 13| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 13] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 13| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 13, False: 0] ------------------ 165| 13| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 13| } 167| 13|} _ZN5Botan13typecast_copyINS_6StrongINSt3__15arrayIhLm56EEENS_9Point448_EJEEETkNS_6ranges16contiguous_rangeENS2_4spanIKhLm18446744073709551615EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vISB_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEESB_RKSG_: 210| 2|inline constexpr ToT typecast_copy(const FromR& src) { 211| 2| ToT dst; // NOLINT(*-member-init) 212| 2| typecast_copy(dst, src); 213| 2| return dst; 214| 2|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNS_6StrongINSt3__15arrayIhLm56EEENS_9Point448_EJEEETkNS1_16contiguous_rangeENS3_4spanIKhLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINSC_IXsr21__is_primary_templateINSD_Iu14__remove_cvrefIDTclL_ZNSF_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSL_IST_EESU_E4type10value_typeEEEEvOSQ_RKSG_: 176| 2|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 2| ranges::assert_equal_byte_lengths(out, in); 178| 2| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 2|} _ZN5Botan13typecast_copyINS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEETkNS_6ranges16contiguous_rangeENS2_4spanIKhLm18446744073709551615EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vISB_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEESB_RKSG_: 210| 15|inline constexpr ToT typecast_copy(const FromR& src) { 211| 15| ToT dst; // NOLINT(*-member-init) 212| 15| typecast_copy(dst, src); 213| 15| return dst; 214| 15|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEETkNS1_16contiguous_rangeENS3_4spanIKhLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINSC_IXsr21__is_primary_templateINSD_Iu14__remove_cvrefIDTclL_ZNSF_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSL_IST_EESU_E4type10value_typeEEEEvOSQ_RKSG_: 176| 15|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 15| ranges::assert_equal_byte_lengths(out, in); 178| 15| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 15|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS2_6vectorIhNS_16secure_allocatorIhEEEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISH_EESI_E4type10value_typeENSA_IXsr21__is_primary_templateINSB_Iu14__remove_cvrefIDTclL_ZNSD_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSJ_ISR_EESS_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISW_EEEvOSE_RKSO_: 160| 4.20k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 4.20k| ranges::assert_equal_byte_lengths(out, in); 162| 4.20k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 4.20k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 4.20k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 4.20k, False: 0] ------------------ 165| 4.20k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 4.20k| } 167| 4.20k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIjLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEEEvOSM_RKSC_: 176| 2|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 2| ranges::assert_equal_byte_lengths(out, in); 178| 2| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 2|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm18446744073709551615EEEmQaaaasr3stdE23is_trivially_copyable_vIT0_Entsr3std6rangesE5rangeIS7_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvOSC_RKS7_: 199| 2.76k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromT& in) { 200| 2.76k| typecast_copy(out, std::span(&in, 1)); 201| 2.76k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKmLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 2.76k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 2.76k| ranges::assert_equal_byte_lengths(out, in); 178| 2.76k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 2.76k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm16EEETkNS1_16contiguous_rangeENS2_4spanIKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeENS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISV_EEEvOSD_RKSN_: 160| 109|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 109| ranges::assert_equal_byte_lengths(out, in); 162| 109| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 109] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 109| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 109, False: 0] ------------------ 165| 109| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 109| } 167| 109|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm16EEETkNS1_16contiguous_rangeES4_Qaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeENS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISS_EEEvOSA_RKSK_: 160| 109|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 109| ranges::assert_equal_byte_lengths(out, in); 162| 109| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 109] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 109| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 109, False: 0] ------------------ 165| 109| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 109| } 167| 109|} _ZN5Botan7xor_bufITkNS_6ranges23contiguous_output_rangeIhEERNSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeIhEES5_TkNS7_IhEES5_EEvOT_OT0_OT1_: 435| 109| ranges::contiguous_range auto&& in2) { 436| 109| ranges::assert_equal_byte_lengths(out, in1, in2); 437| | 438| 109| std::span o{out}; 439| 109| std::span i1{in1}; 440| 109| std::span i2{in2}; 441| | 442| 109| for(; o.size_bytes() >= 32; o = o.subspan(32), i1 = i1.subspan(32), i2 = i2.subspan(32)) { ------------------ | Branch (442:10): [True: 0, False: 109] ------------------ 443| 0| auto x = typecast_copy>(i1.template first<32>()); 444| 0| const auto y = typecast_copy>(i2.template first<32>()); 445| | 446| 0| x[0] ^= y[0]; 447| 0| x[1] ^= y[1]; 448| 0| x[2] ^= y[2]; 449| 0| x[3] ^= y[3]; 450| | 451| 0| typecast_copy(o.template first<32>(), x); 452| 0| } 453| | 454| 1.85k| for(size_t off = 0; off != o.size_bytes(); ++off) { ------------------ | Branch (454:24): [True: 1.74k, False: 109] ------------------ 455| 1.74k| o[off] = i1[off] ^ i2[off]; 456| 1.74k| } 457| 109|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm18446744073709551615EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS5_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEE: 132| 48|{ 133| 48| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 48|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm4EEETkNS1_16contiguous_rangeENS2_5arrayImLm4EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 15.2k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 15.2k| ranges::assert_equal_byte_lengths(out, in); 162| 15.2k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 15.2k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 15.2k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 15.2k, False: 0] ------------------ 165| 15.2k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 15.2k| } 167| 15.2k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm6EEETkNS1_16contiguous_rangeENS2_5arrayImLm6EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 3.62k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 3.62k| ranges::assert_equal_byte_lengths(out, in); 162| 3.62k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 3.62k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 3.62k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 3.62k, False: 0] ------------------ 165| 3.62k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 3.62k| } 167| 3.62k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm8EEETkNS1_16contiguous_rangeENS2_5arrayImLm8EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 4.24k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 4.24k| ranges::assert_equal_byte_lengths(out, in); 162| 4.24k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 4.24k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 4.24k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 4.24k, False: 0] ------------------ 165| 4.24k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 4.24k| } 167| 4.24k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm9EEETkNS1_16contiguous_rangeENS2_5arrayImLm9EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 1.23k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1.23k| ranges::assert_equal_byte_lengths(out, in); 162| 1.23k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1.23k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1.23k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1.23k, False: 0] ------------------ 165| 1.23k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1.23k| } 167| 1.23k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm66EEETkNS1_16contiguous_rangeENS3_IKhLm66EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 4.27k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 4.27k| ranges::assert_equal_byte_lengths(out, in); 162| 4.27k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 4.27k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 4.27k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 4.27k, False: 0] ------------------ 165| 4.27k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 4.27k| } 167| 4.27k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm7EEETkNS1_16contiguous_rangeENS2_4spanIKhLm56EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 30|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 30| ranges::assert_equal_byte_lengths(out, in); 178| 30| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 30|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm7EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS6_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEE: 132| 121k|{ 133| 121k| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 121k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm56EEETkNS1_16contiguous_rangeENS2_5arrayImLm7EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEEEvOSM_RKSC_: 176| 15|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 15| ranges::assert_equal_byte_lengths(out, in); 178| 15| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 15|} _ZN5Botan7xor_bufINSt3__19allocatorIhEEEEvRNS1_6vectorIhT_EEPKhm: 503| 79|void xor_buf(std::vector& out, const uint8_t* in, size_t n) { 504| 79| BOTAN_ARG_CHECK(out.size() >= n, "output vector is too small"); ------------------ | | 35| 79| do { \ | | 36| 79| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 79| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 79] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 79| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 79] | | ------------------ ------------------ 505| | // simply assumes that *in points to "n" allocated bytes at least 506| 79| xor_buf(std::span{out}.first(n), std::span{in, n}); 507| 79|} _ZN5Botan14Asymmetric_KeyD2Ev: 62| 10.5k| virtual ~Asymmetric_Key() = default; _ZN5Botan6PK_Ops13Key_AgreementD2Ev: 153| 1.64k| virtual ~Key_Agreement() = default; _ZN5Botan15Key_ConstraintsC2Ev: 166| 6.33k| Key_Constraints() : m_value(0) {} _ZN5Botan18X509_Serial_NumberC2Ev: 70| 6.33k| X509_Serial_Number() : m_contents{0x00} {} _ZNK5Botan7X509_DN8get_bitsEv: 198| 12.4k| const std::vector& get_bits() const { return m_dn_bits; } _ZNK5Botan7X509_DN16_canonical_bytesEv: 274| 12.4k| const std::vector& _canonical_bytes() const { return m_canonical_dn_bits; } _ZN5Botan10Extensions15Extensions_InfoC2EbRKNSt3__16vectorIhNS2_9allocatorIhEEEENS2_10unique_ptrINS_21Certificate_ExtensionENS2_14default_deleteISA_EEEE: 1053| 24.9k| m_obj(std::move(ext)), m_bits(encoding), m_critical(critical) {} _ZN5Botan10ExtensionsC2Ev: 1029| 6.33k| Extensions() = default; _ZN5Botan10ExtensionsD2Ev: 1037| 6.33k| ~Extensions() override = default; _ZN5Botan7X509_DNC2Ev: 159| 13.2k| X509_DN() = default; _ZN5Botan15NameConstraintsC2Ev: 755| 6.33k| NameConstraints() = default; _ZN5Botan21Certificate_ExtensionD2Ev: 858| 24.9k| virtual ~Certificate_Extension() = default; _ZN5Botan15AlternativeNameC2Ev: 338| 18.9k| AlternativeName() = default; _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension17Basic_ConstraintsEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 6.24k, False: 0] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 6.24k| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 6.24k] ------------------ 888| 0| return nullptr; 889| 6.24k| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 6.24k, False: 0] ------------------ 890| 6.24k| return extn_as_T; 891| 6.24k| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 6.24k| } 895| | 896| 0| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension28Authority_Information_AccessEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 0, False: 6.24k] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 0| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 0] ------------------ 888| 0| return nullptr; 889| 0| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 0, False: 0] ------------------ 890| 0| return extn_as_T; 891| 0| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 0| } 895| | 896| 6.24k| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension9Key_UsageEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 0, False: 6.24k] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 0| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 0] ------------------ 888| 0| return nullptr; 889| 0| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 0, False: 0] ------------------ 890| 0| return extn_as_T; 891| 0| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 0| } 895| | 896| 6.24k| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension14Subject_Key_IDEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 6.24k, False: 0] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 6.24k| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 6.24k] ------------------ 888| 0| return nullptr; 889| 6.24k| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 6.24k, False: 0] ------------------ 890| 6.24k| return extn_as_T; 891| 6.24k| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 6.24k| } 895| | 896| 0| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension16Authority_Key_IDEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 6.24k, False: 0] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 6.24k| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 6.24k] ------------------ 888| 0| return nullptr; 889| 6.24k| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 6.24k, False: 0] ------------------ 890| 6.24k| return extn_as_T; 891| 6.24k| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 6.24k| } 895| | 896| 0| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension16Name_ConstraintsEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 0, False: 6.24k] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 0| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 0] ------------------ 888| 0| return nullptr; 889| 0| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 0, False: 0] ------------------ 890| 0| return extn_as_T; 891| 0| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 0| } 895| | 896| 6.24k| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension18Extended_Key_UsageEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 0, False: 6.24k] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 0| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 0] ------------------ 888| 0| return nullptr; 889| 0| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 0, False: 0] ------------------ 890| 0| return extn_as_T; 891| 0| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 0| } 895| | 896| 6.24k| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension23Issuer_Alternative_NameEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 0, False: 6.24k] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 0| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 0] ------------------ 888| 0| return nullptr; 889| 0| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 0, False: 0] ------------------ 890| 0| return extn_as_T; 891| 0| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 0| } 895| | 896| 6.24k| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension24Subject_Alternative_NameEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 6.24k, False: 0] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 6.24k| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 6.24k] ------------------ 888| 0| return nullptr; 889| 6.24k| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 6.24k, False: 0] ------------------ 890| 6.24k| return extn_as_T; 891| 6.24k| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 6.24k| } 895| | 896| 0| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension20Certificate_PoliciesEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 0, False: 6.24k] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 0| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 0] ------------------ 888| 0| return nullptr; 889| 0| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 0, False: 0] ------------------ 890| 0| return extn_as_T; 891| 0| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 0| } 895| | 896| 6.24k| return nullptr; 897| 6.24k| } _ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension23CRL_Distribution_PointsEEEPKT_RKNS_3OIDE: 884| 6.24k| const T* get_extension_object_as(const OID& oid = T::static_oid()) const { 885| 6.24k| if(const Certificate_Extension* extn = get_extension_object(oid)) { ------------------ | Branch (885:42): [True: 0, False: 6.24k] ------------------ 886| | // Unknown_Extension oid_name is empty 887| 0| if(extn->oid_name().empty()) { ------------------ | Branch (887:16): [True: 0, False: 0] ------------------ 888| 0| return nullptr; 889| 0| } else if(const T* extn_as_T = dynamic_cast(extn)) { ------------------ | Branch (889:32): [True: 0, False: 0] ------------------ 890| 0| return extn_as_T; 891| 0| } else { 892| 0| throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed"); 893| 0| } 894| 0| } 895| | 896| 6.24k| return nullptr; 897| 6.24k| } _ZN5Botan6ranges24assert_exact_byte_lengthILm32ETkNS0_14spanable_rangeENSt3__14spanIhLm32EEEEEvRKT0_: 77| 10.8k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 10.8k| const std::span s{r}; 79| 10.8k| if constexpr(statically_spanable_range) { 80| 10.8k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 10.8k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayImLm4EEETpTkNS0_14spanable_rangeEJNS2_4spanIhLm32EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 10.8k|{ 101| 10.8k| const std::span s0{r0}; 102| | 103| 10.8k| if constexpr(statically_spanable_range) { 104| 10.8k| constexpr size_t expected_size = s0.size_bytes(); 105| 10.8k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 10.8k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayImLm4EEEEEmRKT_: 59| 22.5k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 22.5k| return std::span{r}.size_bytes(); 61| 22.5k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm32ETkNS0_14spanable_rangeENSt3__14spanIKhLm32EEEEEvRKT0_: 77| 11.7k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 11.7k| const std::span s{r}; 79| 11.7k| if constexpr(statically_spanable_range) { 80| 11.7k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 11.7k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayImLm4EEETpTkNS0_14spanable_rangeEJNS2_4spanIKhLm32EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 11.7k|{ 101| 11.7k| const std::span s0{r0}; 102| | 103| 11.7k| if constexpr(statically_spanable_range) { 104| 11.7k| constexpr size_t expected_size = s0.size_bytes(); 105| 11.7k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 11.7k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm32ETkNS0_14spanable_rangeENSt3__15arrayImLm4EEEEEvRKT0_: 77| 55.3k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 55.3k| const std::span s{r}; 79| 55.3k| if constexpr(statically_spanable_range) { 80| 55.3k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 55.3k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm32EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 40.0k|{ 101| 40.0k| const std::span s0{r0}; 102| | 103| 40.0k| if constexpr(statically_spanable_range) { 104| 40.0k| constexpr size_t expected_size = s0.size_bytes(); 105| 40.0k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 40.0k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm32EEEEEmRKT_: 59| 11.2k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 11.2k| return std::span{r}.size_bytes(); 61| 11.2k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 38.9k|{ 101| 38.9k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 38.9k| } else { 107| 38.9k| const size_t expected_size = s0.size_bytes(); 108| 38.9k| const bool correct_size = 109| 38.9k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 38.9k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 38.9k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 38.9k| } 115| 38.9k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEES6_EEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.76k|{ 101| 1.76k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 1.76k| } else { 107| 1.76k| const size_t expected_size = s0.size_bytes(); 108| 1.76k| const bool correct_size = 109| 3.52k| ((std::span>{rs}.size_bytes() == expected_size) && ...); ------------------ | Branch (109:11): [True: 1.76k, False: 0] | Branch (109:11): [True: 1.76k, False: 0] ------------------ 110| | 111| 1.76k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 1.76k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 1.76k| } 115| 1.76k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEvRKT0_: 77| 765k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 765k| const std::span s{r}; 79| 765k| if constexpr(statically_spanable_range) { 80| 765k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 765k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm8EEETpTkNS0_14spanable_rangeEJNS3_IKmLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 418k|{ 101| 418k| const std::span s0{r0}; 102| | 103| 418k| if constexpr(statically_spanable_range) { 104| 418k| constexpr size_t expected_size = s0.size_bytes(); 105| 418k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 418k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKmLm1EEEEEvRKT0_: 77| 418k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 418k| const std::span s{r}; 79| 418k| if constexpr(statically_spanable_range) { 80| 418k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 418k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEmRKT_: 59| 418k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 418k| return std::span{r}.size_bytes(); 61| 418k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKhLm8EEEEEvRKT0_: 77| 856k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 856k| const std::span s{r}; 79| 856k| if constexpr(statically_spanable_range) { 80| 856k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 856k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 428k|{ 101| 428k| const std::span s0{r0}; 102| | 103| 428k| if constexpr(statically_spanable_range) { 104| 428k| constexpr size_t expected_size = s0.size_bytes(); 105| 428k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 428k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm1EEEEEmRKT_: 59| 455k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 455k| return std::span{r}.size_bytes(); 61| 455k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm2ETkNS0_14spanable_rangeENSt3__14spanIhLm2EEEEEvRKT0_: 77| 13|inline constexpr void assert_exact_byte_length(const R& r) { 78| 13| const std::span s{r}; 79| 13| if constexpr(statically_spanable_range) { 80| 13| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 13|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanItLm1EEEEEmRKT_: 59| 29.7k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 29.7k| return std::span{r}.size_bytes(); 61| 29.7k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm2ETkNS0_14spanable_rangeENSt3__14spanIKhLm2EEEEEvRKT0_: 77| 59.4k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 59.4k| const std::span s{r}; 79| 59.4k| if constexpr(statically_spanable_range) { 80| 59.4k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 59.4k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanItLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm2EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 29.7k|{ 101| 29.7k| const std::span s0{r0}; 102| | 103| 29.7k| if constexpr(statically_spanable_range) { 104| 29.7k| constexpr size_t expected_size = s0.size_bytes(); 105| 29.7k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 29.7k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm4ETkNS0_14spanable_rangeENSt3__14spanIKhLm4EEEEEvRKT0_: 77| 1.09k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1.09k| const std::span s{r}; 79| 1.09k| if constexpr(statically_spanable_range) { 80| 1.09k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 1.09k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIjLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 547|{ 101| 547| const std::span s0{r0}; 102| | 103| 547| if constexpr(statically_spanable_range) { 104| 547| constexpr size_t expected_size = s0.size_bytes(); 105| 547| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 547|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIjLm1EEEEEmRKT_: 59| 547|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 547| return std::span{r}.size_bytes(); 61| 547|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm8EEETpTkNS0_14spanable_rangeEJNS3_ImLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 226k|{ 101| 226k| const std::span s0{r0}; 102| | 103| 226k| if constexpr(statically_spanable_range) { 104| 226k| constexpr size_t expected_size = s0.size_bytes(); 105| 226k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 226k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayImLm1EEEEEvRKT0_: 77| 226k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 226k| const std::span s{r}; 79| 226k| if constexpr(statically_spanable_range) { 80| 226k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 226k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEmRKT_: 59| 113k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 113k| return std::span{r}.size_bytes(); 61| 113k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__16vectorIhNS2_9allocatorIhEEEEEEmRKT_: 59| 1.11M|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 1.11M| return std::span{r}.size_bytes(); 61| 1.11M|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm2EEETpTkNS0_14spanable_rangeEJNS3_IKtLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 13|{ 101| 13| const std::span s0{r0}; 102| | 103| 13| if constexpr(statically_spanable_range) { 104| 13| constexpr size_t expected_size = s0.size_bytes(); 105| 13| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 13|} _ZN5Botan6ranges24assert_exact_byte_lengthILm2ETkNS0_14spanable_rangeENSt3__14spanIKtLm1EEEEEvRKT0_: 77| 13|inline constexpr void assert_exact_byte_length(const R& r) { 78| 13| const std::span s{r}; 79| 13| if constexpr(statically_spanable_range) { 80| 13| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 13|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm2EEEEEmRKT_: 59| 13|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 13| return std::span{r}.size_bytes(); 61| 13|} _ZN5Botan6ranges24assert_exact_byte_lengthILm4ETkNS0_14spanable_rangeENSt3__14spanIhLm4EEEEEvRKT0_: 77| 1.11M|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1.11M| const std::span s{r}; 79| 1.11M| if constexpr(statically_spanable_range) { 80| 1.11M| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 1.11M|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm4EEETpTkNS0_14spanable_rangeEJNS3_IKjLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 564k|{ 101| 564k| const std::span s0{r0}; 102| | 103| 564k| if constexpr(statically_spanable_range) { 104| 564k| constexpr size_t expected_size = s0.size_bytes(); 105| 564k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 564k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm4ETkNS0_14spanable_rangeENSt3__14spanIKjLm1EEEEEvRKT0_: 77| 564k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 564k| const std::span s{r}; 79| 564k| if constexpr(statically_spanable_range) { 80| 564k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 564k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm4EEEEEmRKT_: 59| 564k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 564k| return std::span{r}.size_bytes(); 61| 564k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 9.97k|{ 101| 9.97k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 9.97k| } else { 107| 9.97k| const size_t expected_size = s0.size_bytes(); 108| 9.97k| const bool correct_size = 109| 9.97k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 9.97k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 9.97k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 9.97k| } 115| 9.97k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIjLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4|{ 101| 4| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 4| } else { 107| 4| const size_t expected_size = s0.size_bytes(); 108| 4| const bool correct_size = 109| 4| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 4| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 4] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 4| } 115| 4|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKjLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 78.5k|{ 101| 78.5k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 78.5k| } else { 107| 78.5k| const size_t expected_size = s0.size_bytes(); 108| 78.5k| const bool correct_size = 109| 78.5k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 78.5k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 78.5k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 78.5k| } 115| 78.5k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEEEEmRKT_: 59| 71.2k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 71.2k| return std::span{r}.size_bytes(); 61| 71.2k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKmLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 7.43k|{ 101| 7.43k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 7.43k| } else { 107| 7.43k| const size_t expected_size = s0.size_bytes(); 108| 7.43k| const bool correct_size = 109| 7.43k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 7.43k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 7.43k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 7.43k| } 115| 7.43k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm18446744073709551615EEEEEmRKT_: 59| 4.30k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 4.30k| return std::span{r}.size_bytes(); 61| 4.30k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEvRKT0_: 77| 27.0k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 27.0k| const std::span s{r}; 79| 27.0k| if constexpr(statically_spanable_range) { 80| 27.0k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 27.0k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 27.0k|{ 101| 27.0k| const std::span s0{r0}; 102| | 103| 27.0k| if constexpr(statically_spanable_range) { 104| 27.0k| constexpr size_t expected_size = s0.size_bytes(); 105| 27.0k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 27.0k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayIhLm16EEEEEmRKT_: 59| 768|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 768| return std::span{r}.size_bytes(); 61| 768|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS2_6vectorIhNS_16secure_allocatorIhEEEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4.62k|{ 101| 4.62k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 4.62k| } else { 107| 4.62k| const size_t expected_size = s0.size_bytes(); 108| 4.62k| const bool correct_size = 109| 4.62k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 4.62k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 4.62k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 4.62k| } 115| 4.62k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm16EEETpTkNS0_14spanable_rangeEJNS3_ImLm2EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 109|{ 101| 109| const std::span s0{r0}; 102| | 103| 109| if constexpr(statically_spanable_range) { 104| 109| constexpr size_t expected_size = s0.size_bytes(); 105| 109| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 109|} _ZN5Botan6ranges24assert_exact_byte_lengthILm16ETkNS0_14spanable_rangeENSt3__15arrayImLm2EEEEEvRKT0_: 77| 109|inline constexpr void assert_exact_byte_length(const R& r) { 78| 109| const std::span s{r}; 79| 109| if constexpr(statically_spanable_range) { 80| 109| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 109|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm56EEETpTkNS0_14spanable_rangeEJNS2_4spanIKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2|{ 101| 2| const std::span s0{r0}; 102| | 103| 2| if constexpr(statically_spanable_range) { 104| 2| constexpr size_t expected_size = s0.size_bytes(); 105| 2| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 2|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__14spanIKhLm18446744073709551615EEEEEvRKT0_: 77| 2|inline constexpr void assert_exact_byte_length(const R& r) { 78| 2| const std::span s{r}; 79| | if constexpr(statically_spanable_range) { 80| | static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| 2| } else { 82| 2| if(s.size_bytes() != expected) { ------------------ | Branch (82:10): [True: 0, False: 2] ------------------ 83| 0| memory_region_size_violation(); 84| 0| } 85| 2| } 86| 2|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayIhLm56EEEEEmRKT_: 59| 4|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 4| return std::span{r}.size_bytes(); 61| 4|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm56EEETpTkNS0_14spanable_rangeEJNS2_6vectorIhNS_16secure_allocatorIhEEEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 13|{ 101| 13| const std::span s0{r0}; 102| | 103| 13| if constexpr(statically_spanable_range) { 104| 13| constexpr size_t expected_size = s0.size_bytes(); 105| 13| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 13|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEEEEvRKT0_: 77| 13|inline constexpr void assert_exact_byte_length(const R& r) { 78| 13| const std::span s{r}; 79| | if constexpr(statically_spanable_range) { 80| | static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| 13| } else { 82| 13| if(s.size_bytes() != expected) { ------------------ | Branch (82:10): [True: 0, False: 13] ------------------ 83| 0| memory_region_size_violation(); 84| 0| } 85| 13| } 86| 13|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm56EEEEEmRKT_: 59| 41|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 41| return std::span{r}.size_bytes(); 61| 41|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENS_6StrongINSt3__15arrayIhLm56EEENS_9Point448_EJEEETpTkNS0_14spanable_rangeEJNS3_4spanIKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2|{ 101| 2| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 2| } else { 107| 2| const size_t expected_size = s0.size_bytes(); 108| 2| const bool correct_size = 109| 2| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 2| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 2] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 2| } 115| 2|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENS_6StrongINSt3__15arrayIhLm56EEENS_9Point448_EJEEEEEmRKT_: 59| 2|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2| return std::span{r}.size_bytes(); 61| 2|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEETpTkNS0_14spanable_rangeEJNS3_4spanIKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 15|{ 101| 15| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 15| } else { 107| 15| const size_t expected_size = s0.size_bytes(); 108| 15| const bool correct_size = 109| 15| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 15| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 15] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 15| } 115| 15|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEEEEmRKT_: 59| 15|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 15| return std::span{r}.size_bytes(); 61| 15|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayImLm7EEEEEmRKT_: 59| 121k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 121k| return std::span{r}.size_bytes(); 61| 121k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm16ETkNS0_14spanable_rangeENSt3__15arrayIhLm16EEEEEvRKT0_: 77| 109|inline constexpr void assert_exact_byte_length(const R& r) { 78| 109| const std::span s{r}; 79| 109| if constexpr(statically_spanable_range) { 80| 109| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 109|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIjLm18446744073709551615EEEEEmRKT_: 59| 2|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2| return std::span{r}.size_bytes(); 61| 2|} _ZN5Botan6ranges24assert_exact_byte_lengthILm1ETkNS0_14spanable_rangeENSt3__14spanIKhLm1EEEEEvRKT0_: 77| 1.63M|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1.63M| const std::span s{r}; 79| 1.63M| if constexpr(statically_spanable_range) { 80| 1.63M| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 1.63M|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEEEEvRKT0_: 77| 2.76k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 2.76k| const std::span s{r}; 79| | if constexpr(statically_spanable_range) { 80| | static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| 2.76k| } else { 82| 2.76k| if(s.size_bytes() != expected) { ------------------ | Branch (82:10): [True: 0, False: 2.76k] ------------------ 83| 0| memory_region_size_violation(); 84| 0| } 85| 2.76k| } 86| 2.76k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKmLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2.76k|{ 101| 2.76k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 2.76k| } else { 107| 2.76k| const size_t expected_size = s0.size_bytes(); 108| 2.76k| const bool correct_size = 109| 2.76k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 2.76k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 2.76k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 2.76k| } 115| 2.76k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm16EEETpTkNS0_14spanable_rangeEJNS2_4spanIKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 109|{ 101| 109| const std::span s0{r0}; 102| | 103| 109| if constexpr(statically_spanable_range) { 104| 109| constexpr size_t expected_size = s0.size_bytes(); 105| 109| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 109|} _ZN5Botan6ranges24assert_exact_byte_lengthILm16ETkNS0_14spanable_rangeENSt3__14spanIKhLm18446744073709551615EEEEEvRKT0_: 77| 109|inline constexpr void assert_exact_byte_length(const R& r) { 78| 109| const std::span s{r}; 79| | if constexpr(statically_spanable_range) { 80| | static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| 109| } else { 82| 109| if(s.size_bytes() != expected) { ------------------ | Branch (82:10): [True: 0, False: 109] ------------------ 83| 0| memory_region_size_violation(); 84| 0| } 85| 109| } 86| 109|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm16EEETpTkNS0_14spanable_rangeEJS4_EEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 109|{ 101| 109| const std::span s0{r0}; 102| | 103| 109| if constexpr(statically_spanable_range) { 104| 109| constexpr size_t expected_size = s0.size_bytes(); 105| 109| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 109|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJS4_S4_EEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 109|{ 101| 109| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 109| } else { 107| 109| const size_t expected_size = s0.size_bytes(); 108| 109| const bool correct_size = 109| 218| ((std::span>{rs}.size_bytes() == expected_size) && ...); ------------------ | Branch (109:11): [True: 109, False: 0] | Branch (109:11): [True: 109, False: 0] ------------------ 110| | 111| 109| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 109] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 109| } 115| 109|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm4EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 15.2k|{ 101| 15.2k| const std::span s0{r0}; 102| | 103| 15.2k| if constexpr(statically_spanable_range) { 104| 15.2k| constexpr size_t expected_size = s0.size_bytes(); 105| 15.2k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 15.2k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm4EEEEEmRKT_: 59| 30.4k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 30.4k| return std::span{r}.size_bytes(); 61| 30.4k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__16vectorIhNS2_9allocatorIhEEEETpTkNS0_14spanable_rangeEJA8_mEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.86k|{ 101| 1.86k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 1.86k| } else { 107| 1.86k| const size_t expected_size = s0.size_bytes(); 108| 1.86k| const bool correct_size = 109| 1.86k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 1.86k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 1.86k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 1.86k| } 115| 1.86k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm6EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm6EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 3.62k|{ 101| 3.62k| const std::span s0{r0}; 102| | 103| 3.62k| if constexpr(statically_spanable_range) { 104| 3.62k| constexpr size_t expected_size = s0.size_bytes(); 105| 3.62k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 3.62k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm48ETkNS0_14spanable_rangeENSt3__15arrayImLm6EEEEEvRKT0_: 77| 8.56k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 8.56k| const std::span s{r}; 79| 8.56k| if constexpr(statically_spanable_range) { 80| 8.56k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 8.56k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm6EEEEEmRKT_: 59| 7.24k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 7.24k| return std::span{r}.size_bytes(); 61| 7.24k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__16vectorIhNS2_9allocatorIhEEEETpTkNS0_14spanable_rangeEJA12_mEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 949|{ 101| 949| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 949| } else { 107| 949| const size_t expected_size = s0.size_bytes(); 108| 949| const bool correct_size = 109| 949| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 949| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 949] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 949| } 115| 949|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm48EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm6EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4.94k|{ 101| 4.94k| const std::span s0{r0}; 102| | 103| 4.94k| if constexpr(statically_spanable_range) { 104| 4.94k| constexpr size_t expected_size = s0.size_bytes(); 105| 4.94k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 4.94k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm8EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4.24k|{ 101| 4.24k| const std::span s0{r0}; 102| | 103| 4.24k| if constexpr(statically_spanable_range) { 104| 4.24k| constexpr size_t expected_size = s0.size_bytes(); 105| 4.24k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 4.24k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm64ETkNS0_14spanable_rangeENSt3__15arrayImLm8EEEEEvRKT0_: 77| 7.59k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 7.59k| const std::span s{r}; 79| 7.59k| if constexpr(statically_spanable_range) { 80| 7.59k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 7.59k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm8EEEEEmRKT_: 59| 8.48k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 8.48k| return std::span{r}.size_bytes(); 61| 8.48k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__16vectorIhNS2_9allocatorIhEEEETpTkNS0_14spanable_rangeEJA16_mEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 663|{ 101| 663| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 663| } else { 107| 663| const size_t expected_size = s0.size_bytes(); 108| 663| const bool correct_size = 109| 663| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 663| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 663] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 663| } 115| 663|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm64EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 3.35k|{ 101| 3.35k| const std::span s0{r0}; 102| | 103| 3.35k| if constexpr(statically_spanable_range) { 104| 3.35k| constexpr size_t expected_size = s0.size_bytes(); 105| 3.35k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 3.35k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm9EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm9EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.23k|{ 101| 1.23k| const std::span s0{r0}; 102| | 103| 1.23k| if constexpr(statically_spanable_range) { 104| 1.23k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.23k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.23k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm72ETkNS0_14spanable_rangeENSt3__15arrayImLm9EEEEEvRKT0_: 77| 5.51k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 5.51k| const std::span s{r}; 79| 5.51k| if constexpr(statically_spanable_range) { 80| 5.51k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 5.51k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm9EEEEEmRKT_: 59| 2.47k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2.47k| return std::span{r}.size_bytes(); 61| 2.47k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm72EEETpTkNS0_14spanable_rangeEJNS3_ImLm9EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4.27k|{ 101| 4.27k| const std::span s0{r0}; 102| | 103| 4.27k| if constexpr(statically_spanable_range) { 104| 4.27k| constexpr size_t expected_size = s0.size_bytes(); 105| 4.27k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 4.27k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__16vectorIhNS2_9allocatorIhEEEETpTkNS0_14spanable_rangeEJA18_mEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 780|{ 101| 780| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 780| } else { 107| 780| const size_t expected_size = s0.size_bytes(); 108| 780| const bool correct_size = 109| 780| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 780| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 780] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 780| } 115| 780|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm66EEETpTkNS0_14spanable_rangeEJNS3_IKhLm66EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4.27k|{ 101| 4.27k| const std::span s0{r0}; 102| | 103| 4.27k| if constexpr(statically_spanable_range) { 104| 4.27k| constexpr size_t expected_size = s0.size_bytes(); 105| 4.27k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 4.27k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm66ETkNS0_14spanable_rangeENSt3__14spanIKhLm66EEEEEvRKT0_: 77| 4.27k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 4.27k| const std::span s{r}; 79| 4.27k| if constexpr(statically_spanable_range) { 80| 4.27k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 4.27k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm66EEEEEmRKT_: 59| 8.54k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 8.54k| return std::span{r}.size_bytes(); 61| 8.54k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayImLm7EEETpTkNS0_14spanable_rangeEJNS2_4spanIKhLm56EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 60|{ 101| 60| const std::span s0{r0}; 102| | 103| 60| if constexpr(statically_spanable_range) { 104| 60| constexpr size_t expected_size = s0.size_bytes(); 105| 60| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 60|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__14spanIKhLm56EEEEEvRKT0_: 77| 60|inline constexpr void assert_exact_byte_length(const R& r) { 78| 60| const std::span s{r}; 79| 60| if constexpr(statically_spanable_range) { 80| 60| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 60|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm56EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm7EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 30|{ 101| 30| const std::span s0{r0}; 102| | 103| 30| if constexpr(statically_spanable_range) { 104| 30| constexpr size_t expected_size = s0.size_bytes(); 105| 30| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 30|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__15arrayImLm7EEEEEvRKT0_: 77| 30|inline constexpr void assert_exact_byte_length(const R& r) { 78| 30| const std::span s{r}; 79| 30| if constexpr(statically_spanable_range) { 80| 30| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 30|} _ZN5Botan21RandomNumberGeneratorD2Ev: 52| 6.25k| virtual ~RandomNumberGenerator() = default; _ZN5Botan21RandomNumberGenerator9randomizeENSt3__14spanIhLm18446744073709551615EEE: 86| 35.6k| void randomize(std::span output) { this->fill_bytes_with_input(output, {}); } _ZN5Botan21RandomNumberGenerator9randomizeEPhm: 93| 4.36k| void randomize(uint8_t output[], size_t length) { this->randomize(std::span(output, length)); } _ZN5Botan21RandomNumberGenerator11add_entropyENSt3__14spanIKhLm18446744073709551615EEE: 114| 1| void add_entropy(std::span input) { this->fill_bytes_with_input({}, input); } _ZN5Botan21RandomNumberGenerator10random_vecENSt3__14spanIhLm18446744073709551615EEE: 244| 5.55k| void random_vec(std::span v) { this->randomize(v); } _ZN5Botan21RandomNumberGeneratorC2Ev: 57| 6.25k| RandomNumberGenerator() = default; _ZN5Botan21RandomNumberGenerator10random_vecITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS3_9allocatorIhEEEEEEvRT_m: 255| 5.52k| void random_vec(T& v, size_t bytes) { 256| 5.52k| v.resize(bytes); 257| 5.52k| random_vec(v); 258| 5.52k| } _ZN5Botan21RandomNumberGenerator10random_vecITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEQsr3stdE21default_initializableIT_EEES8_m: 270| 26| T random_vec(size_t bytes) { 271| 26| T result; 272| 26| random_vec(result, bytes); 273| 26| return result; 274| 26| } _ZN5Botan21RandomNumberGenerator10random_vecITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEEvRT_m: 255| 26| void random_vec(T& v, size_t bytes) { 256| 26| v.resize(bytes); 257| 26| random_vec(v); 258| 26| } _ZN5Botan21RandomNumberGenerator10random_vecITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS3_9allocatorIhEEEEQsr3stdE21default_initializableIT_EEES8_m: 270| 5.52k| T random_vec(size_t bytes) { 271| 5.52k| T result; 272| 5.52k| random_vec(result, bytes); 273| 5.52k| return result; 274| 5.52k| } _ZN5Botan16secure_allocatorIhE8allocateEm: 95| 471k| T* allocate(std::size_t n) { return static_cast(allocate_memory(n, sizeof(T))); } _ZN5Botan16secure_allocatorIhE10deallocateEPhm: 102| 471k| void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); } _ZN5BotanneIhhEEbRKNS_16secure_allocatorIT_EERKNS1_IT0_EE: 123| 23.1k|inline bool operator!=(const secure_allocator& /*a*/, const secure_allocator& /*b*/) { 124| 23.1k| return false; 125| 23.1k|} _ZN5Botan16secure_allocatorIjE10deallocateEPjm: 102| 21.4k| void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); } _ZN5Botan16secure_allocatorImE10deallocateEPmm: 102| 103k| void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); } _ZN5Botan16secure_allocatorImE8allocateEm: 95| 103k| T* allocate(std::size_t n) { return static_cast(allocate_memory(n, sizeof(T))); } _ZN5Botan3zapIhNSt3__19allocatorIhEEEEvRNS1_6vectorIT_T0_EE: 261| 2.75k|void zap(std::vector& vec) { 262| 2.75k| zeroise(vec); 263| 2.75k| vec.clear(); 264| 2.75k| vec.shrink_to_fit(); 265| 2.75k|} _ZN5Botan7zeroiseIhNSt3__19allocatorIhEEEEvRNS1_6vectorIT_T0_EE: 241| 3.09k|void zeroise(std::vector& vec) { 242| 308k| for(size_t i = 0; i != vec.size(); ++i) { ------------------ | Branch (242:22): [True: 305k, False: 3.09k] ------------------ 243| 305k| vec[i] = static_cast(0); 244| 305k| } 245| 3.09k|} _ZN5BotanpLIhNSt3__19allocatorIhEES3_EERNS1_6vectorIT_T0_EES8_RKNS4_IS5_T1_EE: 168| 25.3k|std::vector& operator+=(std::vector& out, const std::vector& in) { 169| 25.3k| out.insert(out.end(), in.begin(), in.end()); 170| 25.3k| return out; 171| 25.3k|} _ZN5BotanpLIhNSt3__19allocatorIhEENS_16secure_allocatorIhEEEERNS1_6vectorIT_T0_EESA_RKNS6_IS7_T1_EE: 168| 1.59k|std::vector& operator+=(std::vector& out, const std::vector& in) { 169| 1.59k| out.insert(out.end(), in.begin(), in.end()); 170| 1.59k| return out; 171| 1.59k|} _ZN5BotanpLIhNS_16secure_allocatorIhEES2_EERNSt3__16vectorIT_T0_EES8_RKNS4_IS5_T1_EE: 168| 5|std::vector& operator+=(std::vector& out, const std::vector& in) { 169| 5| out.insert(out.end(), in.begin(), in.end()); 170| 5| return out; 171| 5|} _ZN5BotanpLIhNS_16secure_allocatorIhEEmEERNSt3__16vectorIT_T0_EES8_RKNS3_4pairIPKS5_T1_EE: 204| 280k|std::vector& operator+=(std::vector& out, const std::pair& in) { 205| 280k| if(in.second > 0) { ------------------ | Branch (205:7): [True: 274k, False: 6.25k] ------------------ 206| 274k| out.insert(out.end(), in.first, in.first + in.second); 207| 274k| } 208| 280k| return out; 209| 280k|} _ZN5BotanpLIhNS_16secure_allocatorIhEENSt3__19allocatorIhEEEERNS3_6vectorIT_T0_EESA_RKNS6_IS7_T1_EE: 168| 113|std::vector& operator+=(std::vector& out, const std::vector& in) { 169| 113| out.insert(out.end(), in.begin(), in.end()); 170| 113| return out; 171| 113|} _ZN5Botan16secure_allocatorIjE8allocateEm: 95| 21.4k| T* allocate(std::size_t n) { return static_cast(allocate_memory(n, sizeof(T))); } _ZN5Botan3zapImNS_16secure_allocatorImEEEEvRNSt3__16vectorIT_T0_EE: 261| 114|void zap(std::vector& vec) { 262| 114| zeroise(vec); 263| 114| vec.clear(); 264| 114| vec.shrink_to_fit(); 265| 114|} _ZN5Botan7zeroiseImNS_16secure_allocatorImEEEEvRNSt3__16vectorIT_T0_EE: 241| 114|void zeroise(std::vector& vec) { 242| 114| for(size_t i = 0; i != vec.size(); ++i) { ------------------ | Branch (242:22): [True: 0, False: 114] ------------------ 243| 0| vec[i] = static_cast(0); 244| 0| } 245| 114|} _ZN5Botan7zeroiseIhNS_16secure_allocatorIhEEEEvRNSt3__16vectorIT_T0_EE: 241| 961|void zeroise(std::vector& vec) { 242| 150k| for(size_t i = 0; i != vec.size(); ++i) { ------------------ | Branch (242:22): [True: 149k, False: 961] ------------------ 243| 149k| vec[i] = static_cast(0); 244| 149k| } 245| 961|} _ZN5BotanpLIhNS_16secure_allocatorIhEEmEERNSt3__16vectorIT_T0_EES8_RKNS3_4pairIPS5_T1_EE: 218| 61|std::vector& operator+=(std::vector& out, const std::pair& in) { 219| 61| if(in.second > 0) { ------------------ | Branch (219:7): [True: 61, False: 0] ------------------ 220| 61| out.insert(out.end(), in.first, in.first + in.second); 221| 61| } 222| 61| return out; 223| 61|} _ZN5Botan6unlockIhEENSt3__16vectorIT_NS1_9allocatorIS3_EEEERKNS2_IS3_NS_16secure_allocatorIS3_EEEE: 155| 192|std::vector unlock(const secure_vector& in) { 156| 192| return std::vector(in.begin(), in.end()); 157| 192|} _ZN5BotanpLIhNSt3__19allocatorIhEEmEERNS1_6vectorIT_T0_EES8_RKNS1_4pairIPKS5_T1_EE: 204| 192|std::vector& operator+=(std::vector& out, const std::pair& in) { 205| 192| if(in.second > 0) { ------------------ | Branch (205:7): [True: 192, False: 0] ------------------ 206| 192| out.insert(out.end(), in.first, in.first + in.second); 207| 192| } 208| 192| return out; 209| 192|} _ZN5Botan12Stateful_RNGC2Ev: 64| 1| Stateful_RNG() : m_reseed_interval(0) {} _ZN5Botan12StreamCipher6cipherEPKhPhm: 61| 331| void cipher(const uint8_t in[], uint8_t out[], size_t len) { cipher_bytes(in, out, len); } _ZN5Botan12StreamCipher15write_keystreamENSt3__14spanIhLm18446744073709551615EEE: 88| 35.6k| void write_keystream(std::span out) { generate_keystream(out.data(), out.size()); } _ZN5Botan12StreamCipher8encipherENSt3__14spanIhLm18446744073709551615EEE: 124| 223| void encipher(std::span inout) { cipher(inout.data(), inout.data(), inout.size()); } _ZN5Botan12StreamCipher6set_ivEPKhm: 168| 225| void set_iv(const uint8_t iv[], size_t iv_len) { set_iv_bytes(iv, iv_len); } _ZN5Botan12StreamCipher6set_ivENSt3__14spanIKhLm18446744073709551615EEE: 175| 114| void set_iv(std::span iv) { set_iv_bytes(iv.data(), iv.size()); } _ZN5Botan12StreamCipher15keystream_bytesITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_m: 98| 1| T keystream_bytes(size_t bytes) { 99| 1| T out(bytes); 100| 1| write_keystream(out); 101| 1| return out; 102| 1| } _ZNKR5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE3getEv: 113| 8.98k| constexpr const T& get() const& { return m_value; } _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE4sizeEv: 210| 115| size_type size() const noexcept(noexcept(this->get().size())) { return this->get().size(); } _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEED2Ev: 101| 29.3k| ~Strong_Base() = default; _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE5emptyEvQsr8conceptsE9has_emptyIT_E: 216| 6.11k| { 217| 6.11k| return this->get().empty(); 218| 6.11k| } _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2ES6_: 105| 10.0k| constexpr explicit Strong_Base(T v) : m_value(std::move(v)) {} _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2EOS7_: 91| 5.77k| Strong_Base(Strong_Base&&) noexcept = default; _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2ERKS7_: 88| 3.20k| Strong_Base(const Strong_Base&) = default; _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2Ev: 85| 10.3k| Strong_Base() = default; _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEaSEOS7_: 99| 7.34k| Strong_Base& operator=(Strong_Base&&) noexcept = default; _ZN5Botan18unwrap_strong_typeIRmEEDcOT_: 328| 421k|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 329| 421k| if constexpr(!concepts::strong_type>) { 330| | // If the parameter type isn't a strong type, return it as is. 331| 421k| return std::forward(t); 332| | } else { 333| | // Unwrap the strong type and return the underlying value. 334| | return std::forward(t).get(); 335| | } 336| 421k|} _ZN5Botan16wrap_strong_typeImRmQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_: 353| 455k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) { 354| 455k| if constexpr(std::same_as, T>) { 355| | // Noop, if the parameter type already is the desired return type. 356| 455k| return std::forward(t); 357| | } else if constexpr(std::constructible_from) { 358| | // Implicit conversion from the parameter type to the return type. 359| | return T{std::forward(t)}; 360| | } else { 361| | // Explicitly calling the wrapped type's constructor to support 362| | // implicit conversions on types that mark their constructors as explicit. 363| | static_assert(concepts::strong_type && std::constructible_from); 364| | return T{typename T::wrapped_type{std::forward(t)}}; 365| | } 366| 455k|} _ZN5Botan16wrap_strong_typeItRtQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_: 353| 29.7k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) { 354| 29.7k| if constexpr(std::same_as, T>) { 355| | // Noop, if the parameter type already is the desired return type. 356| 29.7k| return std::forward(t); 357| | } else if constexpr(std::constructible_from) { 358| | // Implicit conversion from the parameter type to the return type. 359| | return T{std::forward(t)}; 360| | } else { 361| | // Explicitly calling the wrapped type's constructor to support 362| | // implicit conversions on types that mark their constructors as explicit. 363| | static_assert(concepts::strong_type && std::constructible_from); 364| | return T{typename T::wrapped_type{std::forward(t)}}; 365| | } 366| 29.7k|} _ZN5Botan16wrap_strong_typeIjRjQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_: 353| 547|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) { 354| 547| if constexpr(std::same_as, T>) { 355| | // Noop, if the parameter type already is the desired return type. 356| 547| return std::forward(t); 357| | } else if constexpr(std::constructible_from) { 358| | // Implicit conversion from the parameter type to the return type. 359| | return T{std::forward(t)}; 360| | } else { 361| | // Explicitly calling the wrapped type's constructor to support 362| | // implicit conversions on types that mark their constructors as explicit. 363| | static_assert(concepts::strong_type && std::constructible_from); 364| | return T{typename T::wrapped_type{std::forward(t)}}; 365| | } 366| 547|} _ZN5Botan18unwrap_strong_typeIRtEEDcOT_: 328| 13|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 329| 13| if constexpr(!concepts::strong_type>) { 330| | // If the parameter type isn't a strong type, return it as is. 331| 13| return std::forward(t); 332| | } else { 333| | // Unwrap the strong type and return the underlying value. 334| | return std::forward(t).get(); 335| | } 336| 13|} _ZN5Botan18unwrap_strong_typeIRjEEDcOT_: 328| 564k|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 329| 564k| if constexpr(!concepts::strong_type>) { 330| | // If the parameter type isn't a strong type, return it as is. 331| 564k| return std::forward(t); 332| | } else { 333| | // Unwrap the strong type and return the underlying value. 334| | return std::forward(t).get(); 335| | } 336| 564k|} _ZN5Botan18unwrap_strong_typeIRNSt3__16vectorIhNS_16secure_allocatorIhEEEEEEDcOT_: 328| 6.00k|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 329| 6.00k| if constexpr(!concepts::strong_type>) { 330| | // If the parameter type isn't a strong type, return it as is. 331| 6.00k| return std::forward(t); 332| | } else { 333| | // Unwrap the strong type and return the underlying value. 334| | return std::forward(t).get(); 335| | } 336| 6.00k|} _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEE5beginEv: 182| 15| decltype(auto) begin() const noexcept(noexcept(this->get().begin())) { return this->get().begin(); } _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEE3endEv: 190| 15| decltype(auto) end() const noexcept(noexcept(this->get().end())) { return this->get().end(); } _ZNK5Botan6detail14Strong_AdapterINSt3__15arrayIhLm56EEEE4dataEv: 281| 34| decltype(auto) data() const noexcept(noexcept(this->get().data())) { return this->get().data(); } _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEE4sizeEv: 210| 34| size_type size() const noexcept(noexcept(this->get().size())) { return this->get().size(); } _ZN5Botan6detail14Strong_AdapterINSt3__15arrayIhLm56EEEE4dataEv: 279| 17| decltype(auto) data() noexcept(noexcept(this->get().data())) { return this->get().data(); } _ZNR5Botan6detail11Strong_BaseINSt3__15arrayIhLm56EEEE3getEv: 109| 47| constexpr T& get() & { return m_value; } _ZN5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEEixIiEEDcOT_: 248| 30| decltype(auto) operator[](U&& i) noexcept(noexcept(this->get().operator[](i))) { 249| 30| return this->get()[std::forward(i)]; 250| 30| } _ZNKR5Botan6detail11Strong_BaseINSt3__15arrayIhLm56EEEE3getEv: 113| 6.84k| constexpr const T& get() const& { return m_value; } _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEEixImEEDcOT_: 240| 6.72k| decltype(auto) operator[](U&& i) const noexcept(noexcept(this->get().operator[](i))) { 241| 6.72k| return this->get()[std::forward(i)]; 242| 6.72k| } _ZN5Botan6detail11Strong_BaseINSt3__15arrayIhLm56EEEEC2ES4_: 105| 15| constexpr explicit Strong_Base(T v) : m_value(std::move(v)) {} _ZN5Botan16wrap_strong_typeIhRhQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_: 353| 1.63M|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) { 354| 1.63M| if constexpr(std::same_as, T>) { 355| | // Noop, if the parameter type already is the desired return type. 356| 1.63M| return std::forward(t); 357| | } else if constexpr(std::constructible_from) { 358| | // Implicit conversion from the parameter type to the return type. 359| | return T{std::forward(t)}; 360| | } else { 361| | // Explicitly calling the wrapped type's constructor to support 362| | // implicit conversions on types that mark their constructors as explicit. 363| | static_assert(concepts::strong_type && std::constructible_from); 364| | return T{typename T::wrapped_type{std::forward(t)}}; 365| | } 366| 1.63M|} _ZN5Botan24Key_Length_SpecificationC2Em: 28| 356| explicit Key_Length_Specification(size_t keylen) : m_min_keylen(keylen), m_max_keylen(keylen), m_keylen_mod(1) {} _ZN5Botan24Key_Length_SpecificationC2Emmm: 37| 4.81k| m_min_keylen(min_k), m_max_keylen(max_k > 0 ? max_k : min_k), m_keylen_mod(k_mod) {} ------------------ | Branch (37:47): [True: 3.80k, False: 1.00k] ------------------ _ZNK5Botan24Key_Length_Specification15valid_keylengthEm: 44| 5.16k| bool valid_keylength(size_t length) const { 45| 5.16k| return ((length >= m_min_keylen) && (length <= m_max_keylen) && (length % m_keylen_mod == 0)); ------------------ | Branch (45:18): [True: 5.16k, False: 0] | Branch (45:46): [True: 5.16k, False: 0] | Branch (45:74): [True: 5.16k, False: 0] ------------------ 46| 5.16k| } _ZNK5Botan18SymmetricAlgorithm15valid_keylengthEm: 143| 5.16k| bool valid_keylength(size_t length) const { return key_spec().valid_keylength(length); } _ZNK5Botan18SymmetricAlgorithm23assert_key_material_setEv: 180| 84.5k| void assert_key_material_set() const { assert_key_material_set(has_keying_material()); } _ZNK5Botan18SymmetricAlgorithm23assert_key_material_setEb: 186| 84.5k| void assert_key_material_set(bool predicate) const { 187| 84.5k| if(!predicate) { ------------------ | Branch (187:13): [True: 0, False: 84.5k] ------------------ 188| 0| throw_key_not_set_error(); 189| 0| } 190| 84.5k| } _ZN5Botan18SymmetricAlgorithmD2Ev: 90| 3.27k| virtual ~SymmetricAlgorithm() = default; _ZN5Botan18SymmetricAlgorithmC2Ev: 88| 3.27k| SymmetricAlgorithm() = default; _ZNK5Botan11OctetString6lengthEv: 28| 14| size_t length() const { return m_data.size(); } _ZNK5Botan11OctetString5emptyEv: 40| 2.14k| bool empty() const { return m_data.empty(); } _ZNK5Botan11OctetString7bits_ofEv: 46| 3.99k| secure_vector bits_of() const { return m_data; } _ZN5Botan11OctetStringC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 112| 4.46k| explicit OctetString(secure_vector in) : m_data(std::move(in)) {} _ZNK5Botan3TLS5Alert8is_validEv: 78| 4.75k| bool is_valid() const { return (m_type_code != AlertType::None); } _ZNK5Botan3TLS5Alert8is_fatalEv: 93| 11.5k| bool is_fatal() const { return m_fatal; } _ZNK5Botan3TLS5Alert4typeEv: 100| 23.7k| Type type() const { return m_type_code; } _ZN5Botan3TLS5AlertC2ENS0_9AlertTypeEb: 126| 4.75k| m_fatal(fatal), m_type_code(type_code) {} _ZN5Botan3TLS12Group_ParamsC2Ev: 145| 110| constexpr Group_Params() : m_code(Group_Params_Code::NONE) {} _ZN5Botan3TLS12Group_ParamsC2ENS0_17Group_Params_CodeE: 148| 3.26k| constexpr Group_Params(Group_Params_Code code) : m_code(code) {} _ZN5Botan3TLS12Group_ParamsC2Et: 151| 28.4k| constexpr Group_Params(uint16_t code) : m_code(static_cast(code)) {} _ZNK5Botan3TLS12Group_ParamseqENS0_17Group_Params_CodeE: 158| 10.6k| constexpr bool operator==(Group_Params_Code code) const { return m_code == code; } _ZNK5Botan3TLS12Group_ParamseqES1_: 160| 52.3k| constexpr bool operator==(Group_Params other) const { return m_code == other.m_code; } _ZNK5Botan3TLS12Group_Params9wire_codeEv: 166| 71.7k| constexpr uint16_t wire_code() const { return static_cast(m_code); } _ZNK5Botan3TLS12Group_Params9is_x25519Ev: 173| 23.3k| constexpr bool is_x25519() const { return m_code == Group_Params_Code::X25519; } _ZNK5Botan3TLS12Group_Params7is_x448Ev: 175| 23.2k| constexpr bool is_x448() const { return m_code == Group_Params_Code::X448; } _ZNK5Botan3TLS12Group_Params19is_ecdh_named_curveEv: 177| 30.6k| constexpr bool is_ecdh_named_curve() const { 178| 30.6k| return m_code == Group_Params_Code::SECP256R1 || m_code == Group_Params_Code::SECP384R1 || ------------------ | Branch (178:17): [True: 1.91k, False: 28.7k] | Branch (178:59): [True: 1.38k, False: 27.3k] ------------------ 179| 27.3k| m_code == Group_Params_Code::SECP521R1 || m_code == Group_Params_Code::BRAINPOOL256R1 || ------------------ | Branch (179:17): [True: 2.24k, False: 25.0k] | Branch (179:59): [True: 3.30k, False: 21.7k] ------------------ 180| 21.7k| m_code == Group_Params_Code::BRAINPOOL384R1 || m_code == Group_Params_Code::BRAINPOOL512R1 || ------------------ | Branch (180:17): [True: 1.42k, False: 20.3k] | Branch (180:64): [True: 2.07k, False: 18.2k] ------------------ 181| 18.2k| m_code == Group_Params_Code::BRAINPOOL256R1TLS13 || m_code == Group_Params_Code::BRAINPOOL384R1TLS13 || ------------------ | Branch (181:17): [True: 248, False: 18.0k] | Branch (181:69): [True: 95, False: 17.9k] ------------------ 182| 17.9k| m_code == Group_Params_Code::BRAINPOOL512R1TLS13; ------------------ | Branch (182:17): [True: 65, False: 17.8k] ------------------ 183| 30.6k| } _ZNK5Botan3TLS12Group_Params17is_in_ffdhe_rangeEv: 185| 24.5k| constexpr bool is_in_ffdhe_range() const { 186| | // See RFC 7919 187| 24.5k| return wire_code() >= 256 && wire_code() < 512; ------------------ | Branch (187:17): [True: 16.0k, False: 8.54k] | Branch (187:39): [True: 984, False: 15.0k] ------------------ 188| 24.5k| } _ZNK5Botan3TLS12Group_Params17is_dh_named_groupEv: 190| 4.74k| constexpr bool is_dh_named_group() const { 191| 4.74k| return m_code == Group_Params_Code::FFDHE_2048 || m_code == Group_Params_Code::FFDHE_3072 || ------------------ | Branch (191:17): [True: 0, False: 4.74k] | Branch (191:60): [True: 0, False: 4.74k] ------------------ 192| 4.74k| m_code == Group_Params_Code::FFDHE_4096 || m_code == Group_Params_Code::FFDHE_6144 || ------------------ | Branch (192:17): [True: 0, False: 4.74k] | Branch (192:60): [True: 0, False: 4.74k] ------------------ 193| 4.74k| m_code == Group_Params_Code::FFDHE_8192; ------------------ | Branch (193:17): [True: 0, False: 4.74k] ------------------ 194| 4.74k| } _ZNK5Botan3TLS12Group_Params14is_pure_ml_kemEv: 196| 5.97k| constexpr bool is_pure_ml_kem() const { 197| 5.97k| return m_code == Group_Params_Code::ML_KEM_512 || m_code == Group_Params_Code::ML_KEM_768 || ------------------ | Branch (197:17): [True: 0, False: 5.97k] | Branch (197:60): [True: 0, False: 5.97k] ------------------ 198| 5.97k| m_code == Group_Params_Code::ML_KEM_1024; ------------------ | Branch (198:17): [True: 0, False: 5.97k] ------------------ 199| 5.97k| } _ZNK5Botan3TLS12Group_Params16is_pure_frodokemEv: 201| 5.97k| constexpr bool is_pure_frodokem() const { 202| 5.97k| return m_code == Group_Params_Code::eFRODOKEM_640_SHAKE_OQS || ------------------ | Branch (202:17): [True: 0, False: 5.97k] ------------------ 203| 5.97k| m_code == Group_Params_Code::eFRODOKEM_976_SHAKE_OQS || ------------------ | Branch (203:17): [True: 0, False: 5.97k] ------------------ 204| 5.97k| m_code == Group_Params_Code::eFRODOKEM_1344_SHAKE_OQS || ------------------ | Branch (204:17): [True: 0, False: 5.97k] ------------------ 205| 5.97k| m_code == Group_Params_Code::eFRODOKEM_640_AES_OQS || ------------------ | Branch (205:17): [True: 0, False: 5.97k] ------------------ 206| 5.97k| m_code == Group_Params_Code::eFRODOKEM_976_AES_OQS || ------------------ | Branch (206:17): [True: 0, False: 5.97k] ------------------ 207| 5.97k| m_code == Group_Params_Code::eFRODOKEM_1344_AES_OQS; ------------------ | Branch (207:17): [True: 0, False: 5.97k] ------------------ 208| 5.97k| } _ZNK5Botan3TLS12Group_Params17is_pure_ecc_groupEv: 210| 23.3k| constexpr bool is_pure_ecc_group() const { return is_x25519() || is_x448() || is_ecdh_named_curve(); } ------------------ | Branch (210:57): [True: 28, False: 23.2k] | Branch (210:72): [True: 33, False: 23.2k] | Branch (210:85): [True: 5.41k, False: 17.8k] ------------------ _ZNK5Botan3TLS12Group_Params15is_post_quantumEv: 212| 5.97k| constexpr bool is_post_quantum() const { 213| 5.97k| BOTAN_DIAGNOSTIC_PUSH 214| 5.97k| BOTAN_DIAGNOSTIC_IGNORE_DEPRECATED_DECLARATIONS 215| | 216| 5.97k| return is_pure_ml_kem() || is_pure_frodokem() || is_pqc_hybrid(); ------------------ | Branch (216:17): [True: 0, False: 5.97k] | Branch (216:37): [True: 0, False: 5.97k] | Branch (216:59): [True: 0, False: 5.97k] ------------------ 217| | 218| 5.97k| BOTAN_DIAGNOSTIC_POP 219| 5.97k| } _ZNK5Botan3TLS12Group_Params20is_pqc_hybrid_ml_kemEv: 221| 5.97k| constexpr bool is_pqc_hybrid_ml_kem() const { 222| 5.97k| return m_code == Group_Params_Code::HYBRID_SECP256R1_ML_KEM_768 || ------------------ | Branch (222:17): [True: 0, False: 5.97k] ------------------ 223| 5.97k| m_code == Group_Params_Code::HYBRID_SECP384R1_ML_KEM_1024 || ------------------ | Branch (223:17): [True: 0, False: 5.97k] ------------------ 224| 5.97k| m_code == Group_Params_Code::HYBRID_X25519_ML_KEM_768; ------------------ | Branch (224:17): [True: 0, False: 5.97k] ------------------ 225| 5.97k| } _ZNK5Botan3TLS12Group_Params22is_pqc_hybrid_frodokemEv: 227| 5.97k| constexpr bool is_pqc_hybrid_frodokem() const { 228| 5.97k| return m_code == Group_Params_Code::HYBRID_X25519_eFRODOKEM_640_SHAKE_OQS || ------------------ | Branch (228:17): [True: 0, False: 5.97k] ------------------ 229| 5.97k| m_code == Group_Params_Code::HYBRID_X25519_eFRODOKEM_640_AES_OQS || ------------------ | Branch (229:17): [True: 0, False: 5.97k] ------------------ 230| 5.97k| m_code == Group_Params_Code::HYBRID_X448_eFRODOKEM_976_SHAKE_OQS || ------------------ | Branch (230:17): [True: 0, False: 5.97k] ------------------ 231| 5.97k| m_code == Group_Params_Code::HYBRID_X448_eFRODOKEM_976_AES_OQS || ------------------ | Branch (231:17): [True: 0, False: 5.97k] ------------------ 232| 5.97k| m_code == Group_Params_Code::HYBRID_SECP256R1_eFRODOKEM_640_SHAKE_OQS || ------------------ | Branch (232:17): [True: 0, False: 5.97k] ------------------ 233| 5.97k| m_code == Group_Params_Code::HYBRID_SECP256R1_eFRODOKEM_640_AES_OQS || ------------------ | Branch (233:17): [True: 0, False: 5.97k] ------------------ 234| 5.97k| m_code == Group_Params_Code::HYBRID_SECP384R1_eFRODOKEM_976_SHAKE_OQS || ------------------ | Branch (234:17): [True: 0, False: 5.97k] ------------------ 235| 5.97k| m_code == Group_Params_Code::HYBRID_SECP384R1_eFRODOKEM_976_AES_OQS || ------------------ | Branch (235:17): [True: 0, False: 5.97k] ------------------ 236| 5.97k| m_code == Group_Params_Code::HYBRID_SECP521R1_eFRODOKEM_1344_SHAKE_OQS || ------------------ | Branch (236:17): [True: 0, False: 5.97k] ------------------ 237| 5.97k| m_code == Group_Params_Code::HYBRID_SECP521R1_eFRODOKEM_1344_AES_OQS; ------------------ | Branch (237:17): [True: 0, False: 5.97k] ------------------ 238| 5.97k| } _ZNK5Botan3TLS12Group_Params13is_pqc_hybridEv: 240| 5.97k| constexpr bool is_pqc_hybrid() const { return is_pqc_hybrid_ml_kem() || is_pqc_hybrid_frodokem(); } ------------------ | Branch (240:53): [True: 0, False: 5.97k] | Branch (240:79): [True: 0, False: 5.97k] ------------------ _ZN5Botan3TLS19key_exchange_is_pskENS0_8Kex_AlgoE: 284| 2.15k|inline bool key_exchange_is_psk(Kex_Algo m) { 285| 2.15k| return (m == Kex_Algo::PSK || m == Kex_Algo::ECDHE_PSK || m == Kex_Algo::DHE_PSK); ------------------ | Branch (285:12): [True: 18, False: 2.13k] | Branch (285:34): [True: 2.13k, False: 0] | Branch (285:62): [True: 0, False: 0] ------------------ 286| 2.15k|} _ZN5Botan3TLS9CallbacksD2Ev: 59| 6.24k| virtual ~Callbacks() = default; _ZN5Botan3TLS9Callbacks21tls_session_activatedEv: 154| 96| virtual void tls_session_activated() {} _ZN5Botan3TLS9Callbacks26tls_peer_closed_connectionEv: 176| 223| virtual bool tls_peer_closed_connection() { return true; } _ZN5Botan3TLS7Channel13received_dataENSt3__14spanIKhLm18446744073709551615EEE: 59| 6.24k| size_t received_data(std::span data) { return this->from_peer(data); } _ZN5Botan3TLS7ChannelC2Ev: 48| 6.24k| Channel() = default; _ZN5Botan3TLS7ChannelD2Ev: 40| 6.24k| virtual ~Channel() = default; _ZNK5Botan3TLS11Ciphersuite5validEv: 147| 307k| bool valid() const { return m_usable; } _ZNK5Botan3TLS11Ciphersuite16ciphersuite_codeEv: 62| 610k| uint16_t ciphersuite_code() const { return m_ciphersuite_code; } _ZNK5Botan3TLS11Ciphersuite8kex_algoEv: 108| 96| std::string kex_algo() const { return kex_method_to_string(kex_method()); } _ZNK5Botan3TLS11Ciphersuite10kex_methodEv: 110| 22.1k| Kex_Algo kex_method() const { return m_kex_algo; } _ZNK5Botan3TLS11Ciphersuite8sig_algoEv: 115| 238| std::string sig_algo() const { return auth_method_to_string(auth_method()); } _ZNK5Botan3TLS11Ciphersuite11auth_methodEv: 117| 11.9k| Auth_Method auth_method() const { return m_auth_method; } _ZNK5Botan3TLS11Ciphersuite11cipher_algoEv: 122| 2.33k| std::string cipher_algo() const { return m_cipher_algo; } _ZNK5Botan3TLS11Ciphersuite8mac_algoEv: 127| 3.00k| std::string mac_algo() const { return m_mac_algo; } _ZNK5Botan3TLS11Ciphersuite8prf_algoEv: 129| 3.29k| std::string prf_algo() const { return kdf_algo_to_string(m_prf_algo); } _ZNK5Botan3TLS11Ciphersuite13cipher_keylenEv: 134| 1.64k| size_t cipher_keylen() const { return m_cipher_keylen; } _ZNK5Botan3TLS11Ciphersuite12nonce_formatEv: 140| 481| Nonce_Format nonce_format() const { return m_nonce_format; } _ZNK5Botan3TLS11Ciphersuite10mac_keylenEv: 142| 1.64k| size_t mac_keylen() const { return m_mac_keylen; } _ZNK5Botan3TLS11CiphersuiteltEt: 153| 57.7k| bool operator<(const uint16_t c) const { return ciphersuite_code() < c; } _ZN5Botan3TLS11CiphersuiteC2EtPKcNS0_11Auth_MethodENS0_8Kex_AlgoES3_mS3_mNS0_8KDF_AlgoENS0_12Nonce_FormatE: 168| 102| m_ciphersuite_code(ciphersuite_code), 169| 102| m_iana_id(iana_id), 170| 102| m_auth_method(auth_method), 171| 102| m_kex_algo(kex_algo), 172| 102| m_prf_algo(prf_algo), 173| 102| m_nonce_format(nonce_format), 174| 102| m_cipher_algo(cipher_algo), 175| 102| m_mac_algo(mac_algo), 176| 102| m_cipher_keylen(cipher_keylen), 177| 102| m_mac_keylen(mac_keylen), 178| 102| m_usable(is_known_usable(ciphersuite_code)) {} _ZN5Botan3TLS13TLS_ExceptionC2ENS0_9AlertTypeENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE: 24| 2.77k| Exception(err_msg), m_alert_type(type) {} _ZNK5Botan3TLS13TLS_Exception4typeEv: 21| 2.77k| Alert::Type type() const { return m_alert_type; } _ZN5Botan3TLS18Unexpected_MessageC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 39| 292| explicit Unexpected_Message(std::string_view err) : TLS_Exception(AlertType::UnexpectedMessage, err) {} _ZNK5Botan3TLS9Extension14is_implementedEv: 113| 57| virtual bool is_implemented() const { return true; } _ZN5Botan3TLS21Server_Name_Indicator11static_typeEv: 123| 8.03k| static Extension_Code static_type() { return Extension_Code::ServerNameIndication; } _ZNK5Botan3TLS21Server_Name_Indicator4typeEv: 125| 62| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS21Server_Name_Indicator9host_nameEv: 131| 15| std::string host_name() const { return m_sni_host_name; } _ZNK5Botan3TLS21Server_Name_Indicator5emptyEv: 135| 20| bool empty() const override { return false; } _ZN5Botan3TLS39Application_Layer_Protocol_Notification11static_typeEv: 148| 3.14k| static Extension_Code static_type() { return Extension_Code::ApplicationLayerProtocolNegotiation; } _ZNK5Botan3TLS39Application_Layer_Protocol_Notification4typeEv: 150| 115| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS39Application_Layer_Protocol_Notification9protocolsEv: 152| 32| const std::vector& protocols() const { return m_protocols; } _ZNK5Botan3TLS39Application_Layer_Protocol_Notification5emptyEv: 170| 28| bool empty() const override { return m_protocols.empty(); } _ZNK5Botan3TLS21Certificate_Type_Base5emptyEv: 202| 31| bool empty() const override { 203| | // RFC 7250 4.1 204| | // If the client has no remaining certificate types to send in the 205| | // client hello, other than the default X.509 type, it MUST omit the 206| | // entire client[/server]_certificate_type extension [...]. 207| 31| return m_from == Connection_Side::Client && m_certificate_types.size() == 1 && ------------------ | Branch (207:17): [True: 20, False: 11] | Branch (207:54): [True: 4, False: 16] ------------------ 208| 4| m_certificate_types.front() == Certificate_Type::X509; ------------------ | Branch (208:17): [True: 2, False: 2] ------------------ 209| 31| } _ZN5Botan3TLS23Client_Certificate_Type11static_typeEv: 225| 24| static Extension_Code static_type() { return Extension_Code::ClientCertificateType; } _ZNK5Botan3TLS23Client_Certificate_Type4typeEv: 227| 24| Extension_Code type() const override { return static_type(); } _ZN5Botan3TLS23Server_Certificate_Type11static_typeEv: 239| 46| static Extension_Code static_type() { return Extension_Code::ServerCertificateType; } _ZNK5Botan3TLS23Server_Certificate_Type4typeEv: 241| 46| Extension_Code type() const override { return static_type(); } _ZN5Botan3TLS16Supported_Groups11static_typeEv: 249| 17.0k| static Extension_Code static_type() { return Extension_Code::SupportedGroups; } _ZNK5Botan3TLS16Supported_Groups4typeEv: 251| 5.51k| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS16Supported_Groups5emptyEv: 267| 2.68k| bool empty() const override { return m_groups.empty(); } _ZN5Botan3TLS20Signature_Algorithms11static_typeEv: 278| 6.31k| static Extension_Code static_type() { return Extension_Code::SignatureAlgorithms; } _ZNK5Botan3TLS20Signature_Algorithms4typeEv: 280| 374| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS20Signature_Algorithms17supported_schemesEv: 282| 365| const std::vector& supported_schemes() const { return m_schemes; } _ZNK5Botan3TLS20Signature_Algorithms5emptyEv: 286| 21| bool empty() const override { return m_schemes.empty(); } _ZN5Botan3TLS25Signature_Algorithms_Cert11static_typeEv: 311| 2.99k| static Extension_Code static_type() { return Extension_Code::CertSignatureAlgorithms; } _ZNK5Botan3TLS25Signature_Algorithms_Cert4typeEv: 313| 19| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS25Signature_Algorithms_Cert17supported_schemesEv: 315| 5| const std::vector& supported_schemes() const { return m_schemes; } _ZNK5Botan3TLS25Signature_Algorithms_Cert5emptyEv: 319| 4| bool empty() const override { return m_schemes.empty(); } _ZN5Botan3TLS24SRTP_Protection_Profiles11static_typeEv: 334| 107| static Extension_Code static_type() { return Extension_Code::UseSrtp; } _ZNK5Botan3TLS24SRTP_Protection_Profiles4typeEv: 336| 11| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS24SRTP_Protection_Profiles5emptyEv: 342| 4| bool empty() const override { return m_pp.empty(); } _ZN5Botan3TLS26Certificate_Status_Request11static_typeEv: 361| 3.15k| static Extension_Code static_type() { return Extension_Code::CertificateStatusRequest; } _ZNK5Botan3TLS26Certificate_Status_Request4typeEv: 363| 384| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS26Certificate_Status_Request5emptyEv: 367| 228| bool empty() const override { return false; } _ZN5Botan3TLS18Supported_Versions11static_typeEv: 399| 9.42k| static Extension_Code static_type() { return Extension_Code::SupportedVersions; } _ZNK5Botan3TLS18Supported_Versions4typeEv: 401| 102| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS18Supported_Versions5emptyEv: 405| 3| bool empty() const override { return m_versions.empty(); } _ZNK5Botan3TLS18Supported_Versions8versionsEv: 415| 31| const std::vector& versions() const { return m_versions; } _ZN5Botan3TLS17Record_Size_Limit11static_typeEv: 430| 27| static Extension_Code static_type() { return Extension_Code::RecordSizeLimit; } _ZNK5Botan3TLS17Record_Size_Limit4typeEv: 432| 27| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS17Record_Size_Limit5emptyEv: 442| 18| bool empty() const override { return m_limit == 0; } _ZNK5Botan3TLS17Unknown_Extension5emptyEv: 459| 13.8k| bool empty() const override { return false; } _ZNK5Botan3TLS17Unknown_Extension4typeEv: 461| 29.9k| Extension_Code type() const override { return m_type; } _ZNK5Botan3TLS17Unknown_Extension14is_implementedEv: 463| 406| bool is_implemented() const override { return false; } _ZN5Botan3TLS10Extensions3addEPNS0_9ExtensionE: 495| 3.42k| void add(Extension* extn) { add(std::unique_ptr(extn)); } _ZNK5Botan3TLS10Extensions42contains_implemented_extensions_other_thanERKNSt3__13setINS0_14Extension_CodeENS2_4lessIS4_EENS2_9allocatorIS4_EEEE: 516| 209| bool contains_implemented_extensions_other_than(const std::set& allowed_extensions) const { 517| 209| return contains_other_than(allowed_extensions, true); 518| 209| } _ZNK5Botan3TLS10Extensions3getINS0_9Key_ShareEEEPT_v: 478| 2| T* get() const { 479| 2| return dynamic_cast(get(T::static_type())); 480| 2| } _ZN5Botan3TLS10ExtensionsC2Ev: 548| 11.0k| Extensions() = default; _ZNK5Botan3TLS10Extensions3hasINS0_18Supported_VersionsEEEbv: 483| 6.13k| bool has() const { 484| 6.13k| return get() != nullptr; 485| 6.13k| } _ZNK5Botan3TLS10Extensions3getINS0_18Supported_VersionsEEEPT_v: 478| 9.32k| T* get() const { 479| 9.32k| return dynamic_cast(get(T::static_type())); 480| 9.32k| } _ZNK5Botan3TLS10Extensions3getINS0_20Signature_AlgorithmsEEEPT_v: 478| 5.94k| T* get() const { 479| 5.94k| return dynamic_cast(get(T::static_type())); 480| 5.94k| } _ZNK5Botan3TLS10Extensions3getINS0_25Signature_Algorithms_CertEEEPT_v: 478| 2.97k| T* get() const { 479| 2.97k| return dynamic_cast(get(T::static_type())); 480| 2.97k| } _ZNK5Botan3TLS10Extensions3getINS0_16Supported_GroupsEEEPT_v: 478| 11.5k| T* get() const { 479| 11.5k| return dynamic_cast(get(T::static_type())); 480| 11.5k| } _ZNK5Botan3TLS10Extensions3getINS0_21Server_Name_IndicatorEEEPT_v: 478| 7.97k| T* get() const { 479| 7.97k| return dynamic_cast(get(T::static_type())); 480| 7.97k| } _ZNK5Botan3TLS10Extensions3hasINS0_39Application_Layer_Protocol_NotificationEEEbv: 483| 2.99k| bool has() const { 484| 2.99k| return get() != nullptr; 485| 2.99k| } _ZNK5Botan3TLS10Extensions3hasINS0_20Signature_AlgorithmsEEEbv: 483| 3| bool has() const { 484| 3| return get() != nullptr; 485| 3| } _ZNK5Botan3TLS10Extensions3getINS0_39Application_Layer_Protocol_NotificationEEEPT_v: 478| 3.02k| T* get() const { 479| 3.02k| return dynamic_cast(get(T::static_type())); 480| 3.02k| } _ZNK5Botan3TLS10Extensions3getINS0_24SRTP_Protection_ProfilesEEEPT_v: 478| 96| T* get() const { 479| 96| return dynamic_cast(get(T::static_type())); 480| 96| } _ZNK5Botan3TLS10Extensions3getINS0_26Certificate_Status_RequestEEEPT_v: 478| 2.77k| T* get() const { 479| 2.77k| return dynamic_cast(get(T::static_type())); 480| 2.77k| } _ZN5Botan3TLS9ExtensionD2Ev: 115| 47.5k| virtual ~Extension() = default; _ZNK5Botan3TLS10Extensions3hasINS0_16Supported_GroupsEEEbv: 483| 6| bool has() const { 484| 6| return get() != nullptr; 485| 6| } _ZNK5Botan3TLS10Extensions3hasINS0_9Key_ShareEEEbv: 483| 2| bool has() const { 484| 2| return get() != nullptr; 485| 2| } _ZNK5Botan3TLS10Extensions3hasINS0_3PSKEEEbv: 483| 8| bool has() const { 484| 8| return get() != nullptr; 485| 8| } _ZNK5Botan3TLS10Extensions3getINS0_3PSKEEEPT_v: 478| 8| T* get() const { 479| 8| return dynamic_cast(get(T::static_type())); 480| 8| } _ZN5Botan3TLS10ExtensionsC2EOS1_: 551| 304| Extensions(Extensions&&) = default; _ZNK5Botan3TLS10Extensions3hasINS0_26Certificate_Status_RequestEEEbv: 483| 2.76k| bool has() const { 484| 2.76k| return get() != nullptr; 485| 2.76k| } _ZNK5Botan3TLS10Extensions3getINS0_23Supported_Point_FormatsEEEPT_v: 478| 2.61k| T* get() const { 479| 2.61k| return dynamic_cast(get(T::static_type())); 480| 2.61k| } _ZNK5Botan3TLS10Extensions3hasINS0_23Renegotiation_ExtensionEEEbv: 483| 8.76k| bool has() const { 484| 8.76k| return get() != nullptr; 485| 8.76k| } _ZNK5Botan3TLS10Extensions3getINS0_23Renegotiation_ExtensionEEEPT_v: 478| 9.35k| T* get() const { 479| 9.35k| return dynamic_cast(get(T::static_type())); 480| 9.35k| } _ZNK5Botan3TLS10Extensions3hasINS0_24Session_Ticket_ExtensionEEEbv: 483| 3.05k| bool has() const { 484| 3.05k| return get() != nullptr; 485| 3.05k| } _ZNK5Botan3TLS10Extensions3getINS0_24Session_Ticket_ExtensionEEEPT_v: 478| 6.02k| T* get() const { 479| 6.02k| return dynamic_cast(get(T::static_type())); 480| 6.02k| } _ZNK5Botan3TLS10Extensions3hasINS0_22Extended_Master_SecretEEEbv: 483| 7.40k| bool has() const { 484| 7.40k| return get() != nullptr; 485| 7.40k| } _ZNK5Botan3TLS10Extensions3getINS0_22Extended_Master_SecretEEEPT_v: 478| 7.40k| T* get() const { 479| 7.40k| return dynamic_cast(get(T::static_type())); 480| 7.40k| } _ZNK5Botan3TLS10Extensions3hasINS0_16Encrypt_then_MACEEEbv: 483| 2.19k| bool has() const { 484| 2.19k| return get() != nullptr; 485| 2.19k| } _ZNK5Botan3TLS10Extensions3getINS0_16Encrypt_then_MACEEEPT_v: 478| 2.19k| T* get() const { 479| 2.19k| return dynamic_cast(get(T::static_type())); 480| 2.19k| } _ZN5Botan3TLS23Renegotiation_Extension11static_typeEv: 31| 9.74k| static Extension_Code static_type() { return Extension_Code::SafeRenegotiation; } _ZNK5Botan3TLS23Renegotiation_Extension4typeEv: 33| 389| Extension_Code type() const override { return static_type(); } _ZN5Botan3TLS23Renegotiation_ExtensionC2ENSt3__16vectorIhNS2_9allocatorIhEEEE: 37| 153| explicit Renegotiation_Extension(std::vector bits) : m_reneg_data(std::move(bits)) {} _ZNK5Botan3TLS23Renegotiation_Extension18renegotiation_infoEv: 41| 369| const std::vector& renegotiation_info() const { return m_reneg_data; } _ZNK5Botan3TLS23Renegotiation_Extension5emptyEv: 45| 259| bool empty() const override { return false; } // always send this _ZN5Botan3TLS24Session_Ticket_Extension11static_typeEv: 56| 6.14k| static Extension_Code static_type() { return Extension_Code::SessionTicket; } _ZNK5Botan3TLS24Session_Ticket_Extension4typeEv: 58| 120| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS24Session_Ticket_Extension8contentsEv: 63| 40| const Session_Ticket& contents() const { return m_ticket; } _ZNK5Botan3TLS24Session_Ticket_Extension5emptyEv: 82| 32| bool empty() const override { return false; } _ZN5Botan3TLS23Supported_Point_Formats11static_typeEv: 99| 2.86k| static Extension_Code static_type() { return Extension_Code::EcPointFormats; } _ZNK5Botan3TLS23Supported_Point_Formats4typeEv: 101| 251| Extension_Code type() const override { return static_type(); } _ZN5Botan3TLS23Supported_Point_FormatsC2Eb: 105| 78| explicit Supported_Point_Formats(bool prefer_compressed) : m_prefers_compressed(prefer_compressed) {} _ZNK5Botan3TLS23Supported_Point_Formats5emptyEv: 109| 161| bool empty() const override { return false; } _ZNK5Botan3TLS23Supported_Point_Formats18prefers_compressedEv: 111| 78| bool prefers_compressed() const { return m_prefers_compressed; } _ZN5Botan3TLS22Extended_Master_Secret11static_typeEv: 122| 16.1k| static Extension_Code static_type() { return Extension_Code::ExtendedMasterSecret; } _ZNK5Botan3TLS22Extended_Master_Secret4typeEv: 124| 8.73k| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS22Extended_Master_Secret5emptyEv: 128| 5.42k| bool empty() const override { return false; } _ZN5Botan3TLS16Encrypt_then_MAC11static_typeEv: 140| 2.46k| static Extension_Code static_type() { return Extension_Code::EncryptThenMac; } _ZNK5Botan3TLS16Encrypt_then_MAC4typeEv: 142| 273| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS16Encrypt_then_MAC5emptyEv: 146| 160| bool empty() const override { return false; } _ZN5Botan3TLS22Extended_Master_SecretC2Ev: 130| 2.76k| Extended_Master_Secret() = default; _ZN5Botan3TLS16Encrypt_then_MACC2Ev: 148| 76| Encrypt_then_MAC() = default; _ZN5Botan3TLS23Renegotiation_ExtensionC2Ev: 35| 221| Renegotiation_Extension() = default; _ZN5Botan3TLS9Key_Share11static_typeEv: 212| 34| static Extension_Code static_type() { return Extension_Code::KeyShare; } _ZN5Botan3TLS6Cookie11static_typeEv: 44| 12| static Extension_Code static_type() { return Extension_Code::Cookie; } _ZNK5Botan3TLS6Cookie4typeEv: 46| 12| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS6Cookie5emptyEv: 50| 6| bool empty() const override { return m_cookie.empty(); } _ZN5Botan3TLS22PSK_Key_Exchange_Modes11static_typeEv: 67| 74| static Extension_Code static_type() { return Extension_Code::PskKeyExchangeModes; } _ZNK5Botan3TLS22PSK_Key_Exchange_Modes4typeEv: 69| 74| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS22PSK_Key_Exchange_Modes5emptyEv: 73| 40| bool empty() const override { return m_modes.empty(); } _ZN5Botan3TLS23Certificate_Authorities11static_typeEv: 90| 3| static Extension_Code static_type() { return Extension_Code::CertificateAuthorities; } _ZNK5Botan3TLS23Certificate_Authorities4typeEv: 92| 3| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS23Certificate_Authorities5emptyEv: 96| 1| bool empty() const override { return m_distinguished_names.empty(); } _ZN5Botan3TLS3PSK11static_typeEv: 112| 29| static Extension_Code static_type() { return Extension_Code::PresharedKey; } _ZNK5Botan3TLS3PSK4typeEv: 114| 21| Extension_Code type() const override { return static_type(); } _ZNK5Botan3TLS9Key_Share4typeEv: 214| 32| Extension_Code type() const override { return static_type(); } _ZN5Botan3TLS19EarlyDataIndication11static_typeEv: 306| 37| static Extension_Code static_type() { return Extension_Code::EarlyData; } _ZNK5Botan3TLS19EarlyDataIndication4typeEv: 308| 37| Extension_Code type() const override { return static_type(); } _ZN5Botan3TLS11ExternalPSKC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEES6_NS2_6vectorIhNS_16secure_allocatorIhEEEE: 31| 2.12k| m_identity(identity), m_prf_algo(prf_algo), m_master_secret(std::move(psk)), m_is_imported(false) {} _ZN5Botan3TLS11ExternalPSKD2Ev: 28| 2.12k| ~ExternalPSK() = default; _ZN5Botan3TLS17Handshake_MessageD2Ev: 54| 47.0k| virtual ~Handshake_Message() = default; _ZNK5Botan3TLS17Handshake_Message9wire_typeEv: 47| 8.38k| virtual Handshake_Type wire_type() const { return type(); } _ZN5Botan3TLS17Handshake_MessageC2EOS1_: 57| 28.7k| Handshake_Message(Handshake_Message&&) = default; _ZN5Botan3TLS17Handshake_MessageC2Ev: 55| 18.3k| Handshake_Message() = default; _ZNK5Botan3TLS8Finished4typeEv: 272| 195| Handshake_Type type() const override { return Handshake_Type::Finished; } _ZNK5Botan3TLS8Finished9serializeEv: 276| 96| std::vector serialize() const override { return m_verification_data; } _ZNK5Botan3TLS18Certificate_Verify4typeEv: 251| 6| Handshake_Type type() const override { return Handshake_Type::CertificateVerify; } _ZN5Botan3TLS8FinishedC2ENSt3__16vectorIhNS2_9allocatorIhEEEE: 270| 106| explicit Finished(std::vector buf) : m_verification_data(std::move(buf)) {} _ZNK5Botan3TLS8Finished11verify_dataEv: 274| 192| std::vector verify_data() const { return m_verification_data; } _ZNK5Botan3TLS14Certificate_1210cert_chainEv: 223| 5| const std::vector& cert_chain() const { return m_certs; } _ZNK5Botan3TLS18Change_Cipher_Spec4typeEv: 428| 96| Handshake_Type type() const override { return Handshake_Type::HandshakeCCS; } _ZNK5Botan3TLS18Change_Cipher_Spec9serializeEv: 430| 96| std::vector serialize() const override { return std::vector(1, 1); } _ZN5Botan3TLS15Server_Hello_128SettingsC2ENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS0_11Session_ID_EJEEENS0_16Protocol_VersionEtb: 109| 2.76k| m_new_session_id(std::move(new_session_id)), 110| 2.76k| m_new_session_version(new_session_version), 111| 2.76k| m_ciphersuite(ciphersuite), 112| 2.76k| m_offer_session_ticket(offer_session_ticket) {} _ZNK5Botan3TLS15Server_Hello_128Settings10session_idEv: 114| 2.76k| const Session_ID& session_id() const { return m_new_session_id; } _ZNK5Botan3TLS15Server_Hello_128Settings16protocol_versionEv: 116| 5.52k| Protocol_Version protocol_version() const { return m_new_session_version; } _ZNK5Botan3TLS15Server_Hello_128Settings11ciphersuiteEv: 118| 2.76k| uint16_t ciphersuite() const { return m_ciphersuite; } _ZNK5Botan3TLS15Server_Hello_128Settings20offer_session_ticketEv: 120| 30| bool offer_session_ticket() const { return m_offer_session_ticket; } _ZNK5Botan3TLS19Client_Key_Exchange17pre_master_secretEv: 186| 1.40k| const secure_vector& pre_master_secret() const { return m_pre_master; } _ZNK5Botan3TLS19Client_Key_Exchange12psk_identityEv: 191| 192| const std::optional& psk_identity() const { return m_psk_identity; } _ZNK5Botan3TLS14Certificate_124typeEv: 221| 10| Handshake_Type type() const override { return Handshake_Type::Certificate; } _ZNK5Botan3TLS19Server_Key_Exchange4typeEv: 336| 5.51k| Handshake_Type type() const override { return Handshake_Type::ServerKeyExchange; } _ZNK5Botan3TLS19Server_Key_Exchange6paramsEv: 338| 2.75k| const std::vector& params() const { return m_params; } _ZNK5Botan3TLS19Server_Key_Exchange12shared_groupEv: 349| 2.10k| const std::optional& shared_group() const { return m_shared_group; } _ZNK5Botan3TLS17Server_Hello_Done4typeEv: 387| 5.51k| Handshake_Type type() const override { return Handshake_Type::ServerHelloDone; } _ZNK5Botan3TLS20Encrypted_Extensions4typeEv: 162| 808| Handshake_Type type() const override { return Handshake_Type::EncryptedExtensions; } _ZNK5Botan3TLS14Certificate_134typeEv: 211| 4| Handshake_Type type() const override { return Handshake_Type::Certificate; } _ZN5Botan3TLS6PolicyD2Ev: 688| 6.24k| virtual ~Policy() = default; _ZN5Botan3TLS11PskIdentityC2ENSt3__16vectorIhNS2_9allocatorIhEEEEj: 41| 525| m_identity(std::move(identity)), m_obfuscated_age(obfuscated_age) {} _ZN5Botan3TLS18Server_InformationC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEt: 32| 6.34k| m_hostname(hostname), m_port(port) {} _ZN5Botan3TLS18Server_InformationC2Ev: 24| 5.57k| Server_Information() = default; _ZNK5Botan3TLS7Session13lifetime_hintEv: 350| 96| std::chrono::seconds lifetime_hint() const { return m_lifetime_hint; } _ZNK5Botan3TLS12Session_Base7versionEv: 74| 96| Protocol_Version version() const { return m_version; } _ZN5Botan3TLS15Session_Summary14set_session_idENS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS0_11Session_ID_EJEEE: 220| 96| void set_session_id(Session_ID id) { m_session_id = std::move(id); } _ZN5Botan3TLS14Session_HandleC2ENS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS0_11Session_ID_EJEEE: 59| 82| Session_Handle(Session_ID id) : m_handle(std::move(id)) { validate_constraints(); } _ZN5Botan3TLS14Session_HandleC2ENS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS0_15Session_Ticket_EJEEE: 70| 33| Session_Handle(Session_Ticket ticket) : m_handle(std::move(ticket)) { validate_constraints(); } _ZN5Botan3TLS15Session_ManagerD2Ev: 217| 6.24k| virtual ~Session_Manager() = default; _ZN5Botan3TLS15Session_Manager21emits_session_ticketsEv: 215| 2.76k| virtual bool emits_session_tickets() { return false; } _ZN5Botan3TLS20Session_Manager_Noop6removeERKNS0_14Session_HandleE: 33| 78| size_t remove(const Session_Handle& /*session*/) override { return 0; } _ZNK5Botan3TLS16Signature_Scheme9wire_codeEv: 104| 41.3k| Signature_Scheme::Code wire_code() const noexcept { return m_code; } _ZN5Botan3TLS16Protocol_VersionC2Ev: 54| 23.6k| Protocol_Version() : m_version(0) {} _ZN5Botan3TLS16Protocol_VersionC2Et: 56| 360k| explicit Protocol_Version(uint16_t code) : m_version(code) {} _ZN5Botan3TLS16Protocol_VersionC2ENS0_12Version_CodeE: 62| 328k| Protocol_Version(static_cast(named_version)) {} _ZN5Botan3TLS16Protocol_VersionC2Ehh: 69| 15.4k| Protocol_Version(static_cast((static_cast(major) << 8) | minor)) {} _ZNK5Botan3TLS16Protocol_Version13major_versionEv: 84| 424k| uint8_t major_version() const { return static_cast(m_version >> 8); } _ZNK5Botan3TLS16Protocol_Version13minor_versionEv: 89| 19.4k| uint8_t minor_version() const { return static_cast(m_version & 0xFF); } _ZNK5Botan3TLS16Protocol_VersioneqERKS1_: 123| 312k| bool operator==(const Protocol_Version& other) const { return (m_version == other.m_version); } _ZNK5Botan3TLS16Protocol_VersionneERKS1_: 128| 2.71k| bool operator!=(const Protocol_Version& other) const { return (m_version != other.m_version); } _ZNK5Botan3TLS16Protocol_VersiongeERKS1_: 138| 8.87k| bool operator>=(const Protocol_Version& other) const { return (*this == other || *this > other); } ------------------ | Branch (138:70): [True: 11, False: 8.86k] | Branch (138:88): [True: 8.80k, False: 60] ------------------ _ZNK5Botan3TLS16Protocol_VersionltERKS1_: 143| 5.73k| bool operator<(const Protocol_Version& other) const { return !(*this >= other); } _ZNK5Botan3TLS16Protocol_VersionleERKS1_: 148| 295k| bool operator<=(const Protocol_Version& other) const { return (*this == other || *this < other); } ------------------ | Branch (148:70): [True: 289k, False: 5.73k] | Branch (148:88): [True: 42, False: 5.69k] ------------------ _ZNK5Botan16X25519_PublicKey9algo_nameEv: 21| 11| std::string algo_name() const override { return "X25519"; } _ZNK5Botan16X25519_PublicKey10key_lengthEv: 25| 3| size_t key_length() const override { return 255; } _ZN5Botan16X25519_PublicKeyC2Ev: 57| 13| X25519_PublicKey() = default; _ZNK5Botan14X448_PublicKey9algo_nameEv: 39| 6| std::string algo_name() const override { return "X448"; } _ZNK5Botan14X448_PublicKey10key_lengthEv: 43| 2| size_t key_length() const override { return 448; } _ZN5Botan14X448_PublicKeyC2Ev: 62| 13| X448_PublicKey() = default; _ZNK5Botan14Cert_Extension17Basic_Constraints5is_caEv: 53| 6.24k| bool is_ca() const { return m_is_ca; } _ZN5Botan14Cert_Extension17Basic_Constraints10static_oidEv: 57| 6.24k| static OID static_oid() { return OID({2, 5, 29, 19}); } _ZNK5Botan14Cert_Extension17Basic_Constraints8oid_nameEv: 62| 12.4k| std::string oid_name() const override { return "X509v3.BasicConstraints"; } _ZN5Botan14Cert_Extension9Key_Usage10static_oidEv: 88| 6.24k| static OID static_oid() { return OID({2, 5, 29, 15}); } _ZNK5Botan14Cert_Extension14Subject_Key_ID10get_key_idEv: 131| 6.24k| const std::vector& get_key_id() const { return m_key_id; } _ZN5Botan14Cert_Extension14Subject_Key_ID10static_oidEv: 133| 6.24k| static OID static_oid() { return OID({2, 5, 29, 14}); } _ZNK5Botan14Cert_Extension14Subject_Key_ID8oid_nameEv: 138| 6.24k| std::string oid_name() const override { return "X509v3.SubjectKeyIdentifier"; } _ZNK5Botan14Cert_Extension16Authority_Key_ID10get_key_idEv: 173| 6.24k| const std::vector& get_key_id() const { return m_key_id; } _ZN5Botan14Cert_Extension16Authority_Key_ID10static_oidEv: 180| 6.24k| static OID static_oid() { return OID({2, 5, 29, 35}); } _ZNK5Botan14Cert_Extension16Authority_Key_ID8oid_nameEv: 185| 6.24k| std::string oid_name() const override { return "X509v3.AuthorityKeyIdentifier"; } _ZNK5Botan14Cert_Extension24Subject_Alternative_Name12get_alt_nameEv: 203| 6.24k| const AlternativeName& get_alt_name() const { return m_alt_name; } _ZN5Botan14Cert_Extension24Subject_Alternative_Name10static_oidEv: 205| 6.24k| static OID static_oid() { return OID({2, 5, 29, 17}); } _ZN5Botan14Cert_Extension24Subject_Alternative_NameC2ERKNS_15AlternativeNameE: 213| 6.24k| explicit Subject_Alternative_Name(const AlternativeName& name = AlternativeName()) : m_alt_name(name) {} _ZNK5Botan14Cert_Extension24Subject_Alternative_Name8oid_nameEv: 216| 6.24k| std::string oid_name() const override { return "X509v3.SubjectAlternativeName"; } _ZN5Botan14Cert_Extension23Issuer_Alternative_Name10static_oidEv: 235| 6.24k| static OID static_oid() { return OID({2, 5, 29, 18}); } _ZN5Botan14Cert_Extension18Extended_Key_Usage10static_oidEv: 273| 6.24k| static OID static_oid() { return OID({2, 5, 29, 37}); } _ZN5Botan14Cert_Extension16Name_Constraints10static_oidEv: 311| 6.24k| static OID static_oid() { return OID({2, 5, 29, 30}); } _ZN5Botan14Cert_Extension20Certificate_Policies10static_oidEv: 343| 6.24k| static OID static_oid() { return OID({2, 5, 29, 32}); } _ZN5Botan14Cert_Extension28Authority_Information_Access10static_oidEv: 468| 6.24k| static OID static_oid() { return OID({1, 3, 6, 1, 5, 5, 7, 1, 1}); } _ZN5Botan14Cert_Extension23CRL_Distribution_Points10static_oidEv: 662| 6.24k| static OID static_oid() { return OID({2, 5, 29, 31}); } _ZN5Botan14Cert_Extension12OCSP_NoCheck10static_oidEv: 791| 6.24k| static OID static_oid() { return OID({1, 3, 6, 1, 5, 5, 7, 48, 1, 5}); } _ZN5Botan14Cert_Extension21NoRevocationAvailable10static_oidEv: 834| 6.24k| static OID static_oid() { return OID({2, 5, 29, 56}); } _ZN5Botan14Cert_Extension14Subject_Key_IDC2Ev: 110| 6.24k| Subject_Key_ID() = default; _ZN5Botan14Cert_Extension16Authority_Key_IDC2Ev: 157| 6.24k| Authority_Key_ID() = default; _ZN5Botan11X509_ObjectC2Ev: 120| 6.73k| X509_Object() = default; _ZN5Botan16X509_CertificateC2ERKS0_: 559| 5.95k| X509_Certificate(const X509_Certificate& other) = default; LLVMFuzzerInitialize: 28| 2|extern "C" int LLVMFuzzerInitialize(int* /*argc*/, char*** /*argv*/) { 29| | /* 30| | * This disables the mlock pool, as overwrites within the pool are 31| | * opaque to ASan or other instrumentation. 32| | */ 33| 2| ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1); 34| 2| return 0; 35| 2|} LLVMFuzzerTestOneInput: 39| 6.25k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) { 40| 6.25k| if(len <= max_fuzzer_input_size) { ------------------ | Branch (40:7): [True: 6.25k, False: 7] ------------------ 41| 6.25k| try { 42| 6.25k| fuzz(std::span(in, len)); 43| 6.25k| } catch(const std::exception& e) { 44| 0| std::cerr << "Uncaught exception from fuzzer driver " << e.what() << "\n"; 45| 0| abort(); 46| 0| } catch(...) { 47| 0| std::cerr << "Uncaught exception from fuzzer driver (unknown type)\n"; 48| 0| abort(); 49| 0| } 50| 6.25k| } 51| 6.25k| return 0; 52| 6.25k|} _Z20fuzzer_rng_as_sharedv: 56| 6.24k|inline std::shared_ptr fuzzer_rng_as_shared() { 57| 6.24k| static const std::shared_ptr rng = 58| 6.24k| std::make_shared(Botan::secure_vector(32)); 59| 6.24k| return rng; 60| 6.24k|} _Z4fuzzNSt3__14spanIKhLm18446744073709551615EEE: 175| 6.25k|void fuzz(std::span in) { 176| 6.25k| if(in.size() <= 1) { ------------------ | Branch (176:7): [True: 1, False: 6.24k] ------------------ 177| 1| return; 178| 1| } 179| | 180| 6.24k| auto session_manager = std::make_shared(); 181| 6.24k| auto policy = std::make_shared(); 182| 6.24k| const Botan::TLS::Server_Information info("server.name", 443); 183| 6.24k| auto creds = std::make_shared(); 184| 6.24k| auto callbacks = std::make_shared(); 185| | 186| 6.24k| const bool is_datagram = (in[0] & 1) == 1; 187| | 188| 6.24k| Botan::TLS::Server server(callbacks, session_manager, creds, policy, fuzzer_rng_as_shared(), is_datagram); 189| | 190| 6.24k| try { 191| 6.24k| server.received_data(in.subspan(1, in.size() - 1)); 192| 6.24k| } catch(const std::exception& e) {} 193| 6.24k|} tls_server.cpp:_ZNK12_GLOBAL__N_117Fuzzer_TLS_Policy16ciphersuite_listEN5Botan3TLS16Protocol_VersionE: 122| 2.97k| std::vector ciphersuite_list(Botan::TLS::Protocol_Version version) const override { 123| 2.97k| std::vector ciphersuites; 124| | 125| 303k| for(auto&& suite : Botan::TLS::Ciphersuite::all_known_ciphersuites()) { ------------------ | Branch (125:27): [True: 303k, False: 2.97k] ------------------ 126| 303k| if(suite.valid() and suite.usable_in_version(version)) { ------------------ | Branch (126:16): [True: 279k, False: 23.7k] | Branch (126:34): [True: 264k, False: 14.8k] ------------------ 127| 264k| ciphersuites.push_back(suite.ciphersuite_code()); 128| 264k| } 129| 303k| } 130| | 131| 2.97k| return ciphersuites; 132| 2.97k| } tls_server.cpp:_ZN12_GLOBAL__N_123Fuzzer_TLS_Server_CredsC2Ev: 49| 6.24k| Fuzzer_TLS_Server_Creds() { 50| 6.24k| Botan::DataSource_Memory cert_in(fixed_ecdsa_cert); 51| 6.24k| m_ecdsa_cert = std::make_unique(cert_in); 52| | 53| 6.24k| Botan::DataSource_Memory key_in(fixed_ecdsa_key); 54| 6.24k| m_ecdsa_key.reset(Botan::PKCS8::load_key(key_in).release()); 55| 6.24k| } tls_server.cpp:_ZN12_GLOBAL__N_123Fuzzer_TLS_Server_Creds10cert_chainERKNSt3__16vectorINS1_12basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS6_IS8_EEEERKNS2_IN5Botan19AlgorithmIdentifierENS6_ISE_EEEERKS8_SK_: 61| 5.94k| const std::string& /*hostname*/) override { 62| 5.94k| std::vector v; 63| | 64| 5.94k| for(const auto& algo : algos) { ------------------ | Branch (64:31): [True: 5.94k, False: 2.97k] ------------------ 65| 5.94k| if(algo == "ECDSA") { ------------------ | Branch (65:16): [True: 2.97k, False: 2.97k] ------------------ 66| 2.97k| v.push_back(*m_ecdsa_cert); 67| 2.97k| break; 68| 2.97k| } 69| 5.94k| } 70| | 71| 5.94k| return v; 72| 5.94k| } tls_server.cpp:_ZN12_GLOBAL__N_123Fuzzer_TLS_Server_Creds15private_key_forERKN5Botan16X509_CertificateERKNSt3__112basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEESD_: 76| 5| const std::string& /*context*/) override { 77| 5| if(type == "ECDSA") { ------------------ | Branch (77:13): [True: 0, False: 5] ------------------ 78| 0| return m_ecdsa_key; 79| 0| } 80| 5| return nullptr; 81| 5| } tls_server.cpp:_ZN12_GLOBAL__N_123Fuzzer_TLS_Server_Creds18dtls_cookie_secretEv: 87| 699| Botan::secure_vector dtls_cookie_secret() override { 88| 699| return Botan::hex_decode_locked("AABBCCDDEEFF00112233445566778899"); 89| 699| } tls_server.cpp:_ZN12_GLOBAL__N_123Fuzzer_TLS_Server_Creds17psk_identity_hintERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES9_: 91| 2.75k| std::string psk_identity_hint(const std::string& /*type*/, const std::string& /*context*/) override { 92| 2.75k| return "psk_hint"; 93| 2.75k| } tls_server.cpp:_ZN12_GLOBAL__N_123Fuzzer_TLS_Server_Creds19find_preshared_keysENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEN5Botan3TLS15Connection_SideERKNS1_6vectorINS1_12basic_stringIcS4_NS1_9allocatorIcEEEENSB_ISD_EEEERKNS1_8optionalISD_EE: 105| 2.14k| const std::optional& prf = std::nullopt) override { 106| 2.14k| if(!identities.empty() && std::find(identities.begin(), identities.end(), "psk_id") == identities.end()) { ------------------ | Branch (106:13): [True: 2.14k, False: 0] | Branch (106:13): [True: 22, False: 2.12k] | Branch (106:36): [True: 22, False: 2.12k] ------------------ 107| 22| return Botan::Credentials_Manager::find_preshared_keys(host, whoami, identities, prf); 108| 22| } 109| | 110| 2.12k| std::vector psks; 111| 2.12k| psks.emplace_back("psk_id", "SHA-256", Botan::hex_decode_locked("AABBCCDDEEFF00112233445566778899")); 112| 2.12k| return psks; 113| 2.14k| } tls_server.cpp:_ZN12_GLOBAL__N_127Fuzzer_TLS_Server_Callbacks13tls_emit_dataENSt3__14spanIKhLm18446744073709551615EEE: 137| 12.9k| void tls_emit_data(std::span /*data*/) override { 138| | // discard 139| 12.9k| } tls_server.cpp:_ZN12_GLOBAL__N_127Fuzzer_TLS_Server_Callbacks9tls_alertEN5Botan3TLS5AlertE: 145| 1.45k| void tls_alert(Botan::TLS::Alert /*alert*/) override { 146| | // ignore alert 147| 1.45k| } tls_server.cpp:_ZN12_GLOBAL__N_127Fuzzer_TLS_Server_Callbacks30tls_server_choose_app_protocolERKNSt3__16vectorINS1_12basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS6_IS8_EEEE: 149| 32| std::string tls_server_choose_app_protocol(const std::vector& client_protos) override { 150| 32| if(client_protos.size() > 1) { ------------------ | Branch (150:13): [True: 30, False: 2] ------------------ 151| 30| return client_protos[0]; 152| 30| } else { 153| 2| return "fuzzy"; 154| 2| } 155| 32| } _ZN5Botan19AlgorithmIdentifierC2ERKNS_3OIDERKNSt3__16vectorIhNS4_9allocatorIhEEEE: 20| 20.7k| m_oid(oid), m_parameters(param) {} _ZN5Botan19AlgorithmIdentifierC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKNS1_6vectorIhNS1_9allocatorIhEEEE: 26| 10.3k| AlgorithmIdentifier(OID::from_string(oid), param) {} _ZN5Botan19AlgorithmIdentifierC2ERKNS_3OIDENS0_15Encoding_OptionE: 31| 1.15k|AlgorithmIdentifier::AlgorithmIdentifier(const OID& oid, Encoding_Option option) : m_oid(oid) { 32| 1.15k| constexpr uint8_t DER_NULL[] = {0x05, 0x00}; 33| | 34| 1.15k| if(option == USE_NULL_PARAM) { ------------------ | Branch (34:7): [True: 604, False: 548] ------------------ 35| 604| m_parameters.assign(DER_NULL, DER_NULL + 2); 36| 604| } 37| 1.15k|} _ZN5Botan19AlgorithmIdentifierC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS0_15Encoding_OptionE: 42| 10.3k|AlgorithmIdentifier::AlgorithmIdentifier(std::string_view oid, Encoding_Option option) : m_oid(OID::from_string(oid)) { 43| 10.3k| constexpr uint8_t DER_NULL[2] = {0x05, 0x00}; 44| | 45| 10.3k| if(option == USE_NULL_PARAM) { ------------------ | Branch (45:7): [True: 10.3k, False: 0] ------------------ 46| 10.3k| m_parameters.assign(DER_NULL, DER_NULL + 2); 47| 10.3k| } 48| 10.3k|} _ZNK5Botan19AlgorithmIdentifier19parameters_are_nullEv: 50| 12.5k|bool AlgorithmIdentifier::parameters_are_null() const { 51| 12.5k| return (m_parameters.size() == 2 && (m_parameters[0] == 0x05) && (m_parameters[1] == 0x00)); ------------------ | Branch (51:12): [True: 17, False: 12.5k] | Branch (51:40): [True: 2, False: 15] | Branch (51:69): [True: 1, False: 1] ------------------ 52| 12.5k|} _ZN5BotaneqERKNS_19AlgorithmIdentifierES2_: 54| 6.24k|bool operator==(const AlgorithmIdentifier& x, const AlgorithmIdentifier& y) { 55| 6.24k| return (x.oid() == y.oid() && x.parameters() == y.parameters()); ------------------ | Branch (55:12): [True: 6.24k, False: 0] | Branch (55:34): [True: 6.24k, False: 0] ------------------ 56| 6.24k|} _ZN5BotanneERKNS_19AlgorithmIdentifierES2_: 58| 6.24k|bool operator!=(const AlgorithmIdentifier& x, const AlgorithmIdentifier& y) { 59| 6.24k| return !(x == y); 60| 6.24k|} _ZNK5Botan19AlgorithmIdentifier11encode_intoERNS_11DER_EncoderE: 65| 37.3k|void AlgorithmIdentifier::encode_into(DER_Encoder& codec) const { 66| 37.3k| codec.start_sequence().encode(oid()).raw_bytes(parameters()).end_cons(); 67| 37.3k|} _ZN5Botan19AlgorithmIdentifier11decode_fromERNS_11BER_DecoderE: 72| 25.3k|void AlgorithmIdentifier::decode_from(BER_Decoder& codec) { 73| 25.3k| codec.start_sequence().decode(m_oid).raw_bytes(m_parameters).end_cons(); 74| | 75| | /* 76| | * The parameters field is OPTIONAL ANY but in practice it is one of 77| | * - empty 78| | * - NULL 79| | * - SEQUENCE 80| | * - OBJECT IDENTIFIER (namedCurve) 81| | * - OCTET STRING (CBC IV in PBES2) 82| | * 83| | * So require it be exactly one of these values. In particular this ensures that 84| | * there is not any additional trailing data (eg after the SEQUENCE encoding) 85| | * that might be otherwise skipped over by a reader. 86| | */ 87| | 88| 25.3k| const bool acceptable_parameters = [&]() { 89| 25.3k| if(this->parameters_are_null_or_empty()) { 90| 25.3k| return true; 91| 25.3k| } 92| 25.3k| if(ASN1::is_der_sequence_header(m_parameters)) { 93| 25.3k| return true; 94| 25.3k| } 95| 25.3k| if(ASN1::is_single_der_object(m_parameters, ASN1_Type::ObjectId, ASN1_Class::Universal)) { 96| 25.3k| return true; 97| 25.3k| } 98| 25.3k| if(ASN1::is_single_der_object(m_parameters, ASN1_Type::OctetString, ASN1_Class::Universal)) { 99| 25.3k| return true; 100| 25.3k| } 101| 25.3k| return false; 102| 25.3k| }(); 103| | 104| 25.3k| if(!acceptable_parameters) { ------------------ | Branch (104:7): [True: 93, False: 25.2k] ------------------ 105| 93| throw Decoding_Error("AlgorithmIdentifier parameters were not NULL, a SEQUENCE, an OID, or an OCTET STRING"); 106| 93| } 107| 25.3k|} alg_id.cpp:_ZZN5Botan19AlgorithmIdentifier11decode_fromERNS_11BER_DecoderEENK3$_0clEv: 88| 25.1k| const bool acceptable_parameters = [&]() { 89| 25.1k| if(this->parameters_are_null_or_empty()) { ------------------ | Branch (89:10): [True: 12.6k, False: 12.5k] ------------------ 90| 12.6k| return true; 91| 12.6k| } 92| 12.5k| if(ASN1::is_der_sequence_header(m_parameters)) { ------------------ | Branch (92:10): [True: 1, False: 12.5k] ------------------ 93| 1| return true; 94| 1| } 95| 12.5k| if(ASN1::is_single_der_object(m_parameters, ASN1_Type::ObjectId, ASN1_Class::Universal)) { ------------------ | Branch (95:10): [True: 12.5k, False: 96] ------------------ 96| 12.5k| return true; 97| 12.5k| } 98| 96| if(ASN1::is_single_der_object(m_parameters, ASN1_Type::OctetString, ASN1_Class::Universal)) { ------------------ | Branch (98:10): [True: 3, False: 93] ------------------ 99| 3| return true; 100| 3| } 101| 93| return false; 102| 96| }(); _ZNK5Botan11ASN1_Object10BER_encodeEv: 21| 54.4k|std::vector ASN1_Object::BER_encode() const { 22| 54.4k| std::vector output; 23| 54.4k| DER_Encoder der(output); 24| 54.4k| this->encode_into(der); 25| 54.4k| return output; 26| 54.4k|} _ZN5Botan14ASN1_BitStringC2ENSt3__16vectorIhNS1_9allocatorIhEEEEm: 29| 18.8k| m_bytes(std::move(bytes)), m_unused_bits(unused_bits) { 30| 18.8k| if(m_unused_bits >= 8) { ------------------ | Branch (30:7): [True: 0, False: 18.8k] ------------------ 31| 0| throw Invalid_Argument("ASN1_BitString: Invalid unused bit count"); 32| 0| } 33| | 34| 18.8k| if(m_bytes.empty() && m_unused_bits != 0) { ------------------ | Branch (34:7): [True: 1, False: 18.8k] | Branch (34:26): [True: 0, False: 1] ------------------ 35| 0| throw Invalid_Argument("ASN1_BitString: Empty BIT STRING cannot have unused bits"); 36| 0| } 37| | 38| 18.8k| if(m_unused_bits > 0 && (m_bytes.back() & ((1U << m_unused_bits) - 1)) != 0) { ------------------ | Branch (38:7): [True: 2, False: 18.8k] | Branch (38:28): [True: 0, False: 2] ------------------ 39| 0| throw Invalid_Argument("ASN1_BitString: Unused bits must be zero"); 40| 0| } 41| 18.8k|} _ZN5Botan10BER_ObjectD2Ev: 58| 1.11M|BER_Object::~BER_Object() { 59| 1.11M| secure_scrub_memory(m_value); 60| 1.11M|} _ZNK5Botan10BER_Object11assert_is_aENS_9ASN1_TypeENS_10ASN1_ClassENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE: 65| 302k|void BER_Object::assert_is_a(ASN1_Type expected_type_tag, ASN1_Class expected_class_tag, std::string_view descr) const { 66| 302k| if(!this->is_a(expected_type_tag, expected_class_tag)) { ------------------ | Branch (66:7): [True: 189, False: 302k] ------------------ 67| 189| std::stringstream msg; 68| | 69| 189| msg << "Tag mismatch when decoding " << descr << " got "; 70| | 71| 189| if(m_class_tag == ASN1_Class::NoObject && m_type_tag == ASN1_Type::NoObject) { ------------------ | Branch (71:10): [True: 4, False: 185] | Branch (71:49): [True: 4, False: 0] ------------------ 72| 4| msg << "EOF"; 73| 185| } else { 74| 185| if(m_class_tag == ASN1_Class::Universal || m_class_tag == ASN1_Class::Constructed) { ------------------ | Branch (74:13): [True: 40, False: 145] | Branch (74:53): [True: 102, False: 43] ------------------ 75| 142| msg << asn1_tag_to_string(m_type_tag); 76| 142| } else { 77| 43| msg << std::to_string(static_cast(m_type_tag)); 78| 43| } 79| | 80| 185| msg << "/" << asn1_class_to_string(m_class_tag); 81| 185| } 82| | 83| 189| msg << " expected "; 84| | 85| 189| if(expected_class_tag == ASN1_Class::Universal || expected_class_tag == ASN1_Class::Constructed) { ------------------ | Branch (85:10): [True: 39, False: 150] | Branch (85:57): [True: 150, False: 0] ------------------ 86| 189| msg << asn1_tag_to_string(expected_type_tag); 87| 189| } else { 88| 0| msg << std::to_string(static_cast(expected_type_tag)); 89| 0| } 90| | 91| 189| msg << "/" << asn1_class_to_string(expected_class_tag); 92| | 93| 189| throw BER_Decoding_Error(msg.str()); 94| 189| } 95| 302k|} _ZNK5Botan10BER_Object4is_aENS_9ASN1_TypeENS_10ASN1_ClassE: 97| 415k|bool BER_Object::is_a(ASN1_Type expected_type_tag, ASN1_Class expected_class_tag) const { 98| 415k| return (m_type_tag == expected_type_tag && m_class_tag == expected_class_tag); ------------------ | Branch (98:12): [True: 339k, False: 75.2k] | Branch (98:47): [True: 339k, False: 8] ------------------ 99| 415k|} _ZNK5Botan10BER_Object4is_aEiNS_10ASN1_ClassE: 101| 43.7k|bool BER_Object::is_a(int expected_type_tag, ASN1_Class expected_class_tag) const { 102| 43.7k| return is_a(ASN1_Type(expected_type_tag), expected_class_tag); 103| 43.7k|} _ZN5Botan10BER_Object11set_taggingENS_9ASN1_TypeENS_10ASN1_ClassE: 105| 497k|void BER_Object::set_tagging(ASN1_Type type_tag, ASN1_Class class_tag) { 106| 497k| m_type_tag = type_tag; 107| 497k| m_class_tag = class_tag; 108| 497k|} _ZN5Botan20asn1_class_to_stringENS_10ASN1_ClassE: 110| 374|std::string asn1_class_to_string(ASN1_Class type) { 111| 374| switch(type) { 112| 79| case ASN1_Class::Universal: ------------------ | Branch (112:7): [True: 79, False: 295] ------------------ 113| 79| return "UNIVERSAL"; 114| 252| case ASN1_Class::Constructed: ------------------ | Branch (114:7): [True: 252, False: 122] ------------------ 115| 252| return "CONSTRUCTED"; 116| 3| case ASN1_Class::ContextSpecific: ------------------ | Branch (116:7): [True: 3, False: 371] ------------------ 117| 3| return "CONTEXT_SPECIFIC"; 118| 1| case ASN1_Class::Application: ------------------ | Branch (118:7): [True: 1, False: 373] ------------------ 119| 1| return "APPLICATION"; 120| 4| case ASN1_Class::Private: ------------------ | Branch (120:7): [True: 4, False: 370] ------------------ 121| 4| return "PRIVATE"; 122| 0| case ASN1_Class::NoObject: ------------------ | Branch (122:7): [True: 0, False: 374] ------------------ 123| 0| return "NO_OBJECT"; 124| 35| default: ------------------ | Branch (124:7): [True: 35, False: 339] ------------------ 125| 35| return "CLASS(" + std::to_string(static_cast(type)) + ")"; 126| 374| } 127| 374|} _ZN5Botan18asn1_tag_to_stringENS_9ASN1_TypeE: 129| 362|std::string asn1_tag_to_string(ASN1_Type type) { 130| 362| switch(type) { 131| 149| case ASN1_Type::Sequence: ------------------ | Branch (131:7): [True: 149, False: 213] ------------------ 132| 149| return "SEQUENCE"; 133| | 134| 5| case ASN1_Type::Set: ------------------ | Branch (134:7): [True: 5, False: 357] ------------------ 135| 5| return "SET"; 136| | 137| 2| case ASN1_Type::PrintableString: ------------------ | Branch (137:7): [True: 2, False: 360] ------------------ 138| 2| return "PRINTABLE STRING"; 139| | 140| 2| case ASN1_Type::NumericString: ------------------ | Branch (140:7): [True: 2, False: 360] ------------------ 141| 2| return "NUMERIC STRING"; 142| | 143| 5| case ASN1_Type::Ia5String: ------------------ | Branch (143:7): [True: 5, False: 357] ------------------ 144| 5| return "IA5 STRING"; 145| | 146| 2| case ASN1_Type::TeletexString: ------------------ | Branch (146:7): [True: 2, False: 360] ------------------ 147| 2| return "T61 STRING"; 148| | 149| 29| case ASN1_Type::Utf8String: ------------------ | Branch (149:7): [True: 29, False: 333] ------------------ 150| 29| return "UTF8 STRING"; 151| | 152| 2| case ASN1_Type::VisibleString: ------------------ | Branch (152:7): [True: 2, False: 360] ------------------ 153| 2| return "VISIBLE STRING"; 154| | 155| 1| case ASN1_Type::BmpString: ------------------ | Branch (155:7): [True: 1, False: 361] ------------------ 156| 1| return "BMP STRING"; 157| | 158| 1| case ASN1_Type::UniversalString: ------------------ | Branch (158:7): [True: 1, False: 361] ------------------ 159| 1| return "UNIVERSAL STRING"; 160| | 161| 2| case ASN1_Type::UtcTime: ------------------ | Branch (161:7): [True: 2, False: 360] ------------------ 162| 2| return "UTC TIME"; 163| | 164| 3| case ASN1_Type::GeneralizedTime: ------------------ | Branch (164:7): [True: 3, False: 359] ------------------ 165| 3| return "GENERALIZED TIME"; 166| | 167| 2| case ASN1_Type::OctetString: ------------------ | Branch (167:7): [True: 2, False: 360] ------------------ 168| 2| return "OCTET STRING"; 169| | 170| 5| case ASN1_Type::BitString: ------------------ | Branch (170:7): [True: 5, False: 357] ------------------ 171| 5| return "BIT STRING"; 172| | 173| 3| case ASN1_Type::Enumerated: ------------------ | Branch (173:7): [True: 3, False: 359] ------------------ 174| 3| return "ENUMERATED"; 175| | 176| 39| case ASN1_Type::Integer: ------------------ | Branch (176:7): [True: 39, False: 323] ------------------ 177| 39| return "INTEGER"; 178| | 179| 2| case ASN1_Type::Null: ------------------ | Branch (179:7): [True: 2, False: 360] ------------------ 180| 2| return "NULL"; 181| | 182| 2| case ASN1_Type::ObjectId: ------------------ | Branch (182:7): [True: 2, False: 360] ------------------ 183| 2| return "OBJECT"; 184| | 185| 1| case ASN1_Type::Boolean: ------------------ | Branch (185:7): [True: 1, False: 361] ------------------ 186| 1| return "BOOLEAN"; 187| | 188| 0| case ASN1_Type::NoObject: ------------------ | Branch (188:7): [True: 0, False: 362] ------------------ 189| 0| return "NO_OBJECT"; 190| | 191| 105| default: ------------------ | Branch (191:7): [True: 105, False: 257] ------------------ 192| 105| return "TAG(" + std::to_string(static_cast(type)) + ")"; 193| 362| } 194| 362|} _ZN5Botan18BER_Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 199| 673|BER_Decoding_Error::BER_Decoding_Error(std::string_view err) : Decoding_Error(fmt("BER: {}", err)) {} _ZN5Botan11BER_Bad_TagC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEj: 201| 36|BER_Bad_Tag::BER_Bad_Tag(std::string_view str, uint32_t tagging) : BER_Decoding_Error(fmt("{}: {}", str, tagging)) {} _ZN5Botan4ASN115put_in_sequenceERKNSt3__16vectorIhNS1_9allocatorIhEEEE: 208| 18.7k|std::vector put_in_sequence(const std::vector& contents) { 209| 18.7k| return ASN1::put_in_sequence(contents.data(), contents.size()); 210| 18.7k|} _ZN5Botan4ASN115put_in_sequenceEPKhm: 212| 18.7k|std::vector put_in_sequence(const uint8_t bits[], size_t len) { 213| 18.7k| std::vector output = der_sequence_header(len); 214| 18.7k| output.reserve(output.size() + len); 215| 18.7k| if(len > 0) { ------------------ | Branch (215:7): [True: 18.7k, False: 0] ------------------ 216| 18.7k| output.insert(output.end(), bits, bits + len); 217| 18.7k| } 218| 18.7k| return output; 219| 18.7k|} _ZN5Botan4ASN19to_stringERKNS_10BER_ObjectE: 224| 56.5k|std::string to_string(const BER_Object& obj) { 225| 56.5k| return bytes_to_string(obj.data()); 226| 56.5k|} _ZN5Botan4ASN19maybe_BERERNS_10DataSourceE: 231| 12.9k|bool maybe_BER(DataSource& source) { 232| 12.9k| uint8_t first_u8 = 0; 233| 12.9k| if(source.peek_byte(first_u8) == 0) { ------------------ | Branch (233:7): [True: 1, False: 12.9k] ------------------ 234| 1| BOTAN_ASSERT_EQUAL(source.read_byte(first_u8), 0, "Expected EOF"); ------------------ | | 90| 1| do { \ | | 91| 1| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 92| 1| if((expr1) != (expr2)) { \ | | ------------------ | | | Branch (92:10): [True: 0, False: 1] | | ------------------ | | 93| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 94| 0| Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \ | | 95| 0| } \ | | 96| 1| } while(0) | | ------------------ | | | Branch (96:12): [Folded, False: 1] | | ------------------ ------------------ 235| 1| throw Stream_IO_Error("ASN1::maybe_BER: Source was empty"); 236| 1| } 237| | 238| 12.9k| const auto cons_seq = static_cast(ASN1_Class::Constructed) | static_cast(ASN1_Type::Sequence); 239| 12.9k| return first_u8 == cons_seq; 240| 12.9k|} _ZN5Botan3OID9from_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 66| 4.71k|std::optional OID::from_name(std::string_view name) { 67| 4.71k| if(name.empty()) { ------------------ | Branch (67:7): [True: 0, False: 4.71k] ------------------ 68| 0| throw Invalid_Argument("OID::from_name argument must be non-empty"); 69| 0| } 70| | 71| 4.71k| OID o = OID_Map::global_registry().str2oid(name); 72| 4.71k| if(o.has_value()) { ------------------ | Branch (72:7): [True: 4.71k, False: 0] ------------------ 73| 4.71k| return std::optional(o); 74| 4.71k| } 75| | 76| 0| return std::nullopt; 77| 4.71k|} _ZN5Botan3OID11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 80| 44.7k|OID OID::from_string(std::string_view str) { 81| 44.7k| if(str.empty()) { ------------------ | Branch (81:7): [True: 0, False: 44.7k] ------------------ 82| 0| throw Invalid_Argument("OID::from_string argument must be non-empty"); 83| 0| } 84| | 85| 44.7k| OID o = OID_Map::global_registry().str2oid(str); 86| 44.7k| if(o.has_value()) { ------------------ | Branch (86:7): [True: 44.7k, False: 0] ------------------ 87| 44.7k| return o; 88| 44.7k| } 89| | 90| | // Try to parse as a dotted decimal 91| 0| try { 92| 0| return OID(str); 93| 0| } catch(...) {} 94| | 95| 0| throw Lookup_Error(fmt("No OID associated with name '{}'", str)); 96| 0|} _ZN5Botan3OIDC2ESt16initializer_listIjE: 98| 130k|OID::OID(std::initializer_list init) : m_id(init) { 99| 130k| oid_valid_check(m_id); 100| 130k|} _ZNK5Botan3OID15registered_nameEv: 149| 12.5k|std::optional OID::registered_name() const { 150| 12.5k| return OID_Map::global_registry().oid2str(*this); 151| 12.5k|} _ZNK5Botan3OID7matchesESt16initializer_listIjE: 157| 12.5k|bool OID::matches(std::initializer_list other) const { 158| | // TODO: once all target compilers support it, use std::ranges::equal 159| 12.5k| return std::equal(m_id.begin(), m_id.end(), other.begin(), other.end()); 160| 12.5k|} _ZNK5Botan3OID9hash_codeEv: 162| 12.5k|uint64_t OID::hash_code() const { 163| | // If this is changed also update gen_oids.py to match 164| 12.5k| uint64_t hash = 0x621F302327D9A49A; 165| 75.0k| for(auto id : m_id) { ------------------ | Branch (165:16): [True: 75.0k, False: 12.5k] ------------------ 166| 75.0k| hash *= 193; 167| 75.0k| hash += id; 168| 75.0k| } 169| 12.5k| return hash; 170| 12.5k|} _ZN5BotanltERKNS_3OIDES2_: 175| 350k|bool operator<(const OID& a, const OID& b) { 176| 350k| const std::vector& oid1 = a.get_components(); 177| 350k| const std::vector& oid2 = b.get_components(); 178| | 179| 350k| return std::lexicographical_compare(oid1.begin(), oid1.end(), oid2.begin(), oid2.end()); 180| 350k|} _ZNK5Botan3OID11encode_intoERNS_11DER_EncoderE: 185| 75.1k|void OID::encode_into(DER_Encoder& der) const { 186| 75.1k| if(m_id.size() < 2) { ------------------ | Branch (186:7): [True: 0, False: 75.1k] ------------------ 187| 0| throw Invalid_Argument("OID::encode_into: OID is invalid"); 188| 0| } 189| | 190| 75.1k| auto append = [](std::vector& encoding, uint32_t z) { 191| 75.1k| if(z <= 0x7F) { 192| 75.1k| encoding.push_back(static_cast(z)); 193| 75.1k| } else { 194| 75.1k| const size_t z7 = (high_bit(z) + 7 - 1) / 7; 195| | 196| 75.1k| for(size_t j = 0; j != z7; ++j) { 197| 75.1k| uint8_t zp = static_cast(z >> (7 * (z7 - j - 1)) & 0x7F); 198| | 199| 75.1k| if(j != z7 - 1) { 200| 75.1k| zp |= 0x80; 201| 75.1k| } 202| | 203| 75.1k| encoding.push_back(zp); 204| 75.1k| } 205| 75.1k| } 206| 75.1k| }; 207| | 208| 75.1k| std::vector encoding; 209| | 210| | // We know 40 * root can't overflow because root is between 0 and 2 211| 75.1k| auto first = checked_add(40 * m_id[0], m_id[1]); 212| 75.1k| BOTAN_ASSERT_NOMSG(first.has_value()); ------------------ | | 77| 75.1k| do { \ | | 78| 75.1k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 75.1k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 75.1k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 75.1k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 75.1k] | | ------------------ ------------------ 213| | 214| 75.1k| append(encoding, *first); 215| | 216| 379k| for(size_t i = 2; i != m_id.size(); ++i) { ------------------ | Branch (216:22): [True: 304k, False: 75.1k] ------------------ 217| 304k| append(encoding, m_id[i]); 218| 304k| } 219| 75.1k| der.add_object(ASN1_Type::ObjectId, ASN1_Class::Universal, encoding); 220| 75.1k|} _ZN5Botan3OID11decode_fromERNS_11BER_DecoderE: 225| 94.5k|void OID::decode_from(BER_Decoder& decoder) { 226| 94.5k| const BER_Object obj = decoder.get_next_object(); 227| 94.5k| if(obj.tagging() != (ASN1_Class::Universal | ASN1_Type::ObjectId)) { ------------------ | Branch (227:7): [True: 36, False: 94.5k] ------------------ 228| 36| throw BER_Bad_Tag("Error decoding OID, unknown tag", obj.tagging()); 229| 36| } 230| | 231| 94.5k| if(obj.length() == 0) { ------------------ | Branch (231:7): [True: 1, False: 94.5k] ------------------ 232| 1| throw BER_Decoding_Error("OID encoding is too short"); 233| 1| } 234| | 235| 94.5k| auto consume = [](BufferSlicer& data) -> uint32_t { 236| 94.5k| BOTAN_ASSERT_NOMSG(!data.empty()); 237| 94.5k| uint32_t b = data.take_byte(); 238| | 239| 94.5k| if(b > 0x7F) { 240| 94.5k| b &= 0x7F; 241| | 242| | // Even BER requires that the OID have minimal length, ie that 243| | // the first byte of a multibyte encoding cannot be zero 244| | // See X.690 section 8.19.2 245| 94.5k| if(b == 0) { 246| 94.5k| throw Decoding_Error("Leading zero byte in multibyte OID encoding"); 247| 94.5k| } 248| | 249| 94.5k| while(true) { 250| 94.5k| if(data.empty()) { 251| 94.5k| throw Decoding_Error("Truncated OID value"); 252| 94.5k| } 253| | 254| 94.5k| const uint8_t next = data.take_byte(); 255| 94.5k| const bool more = (next & 0x80) == 0x80; 256| 94.5k| const uint8_t value = next & 0x7F; 257| | 258| 94.5k| if((b >> (32 - 7)) != 0) { 259| 94.5k| throw Decoding_Error("OID component overflow"); 260| 94.5k| } 261| | 262| 94.5k| b = (b << 7) | value; 263| | 264| 94.5k| if(!more) { 265| 94.5k| break; 266| 94.5k| } 267| 94.5k| } 268| 94.5k| } 269| | 270| 94.5k| return b; 271| 94.5k| }; 272| | 273| 94.5k| BufferSlicer data(obj.data()); 274| 94.5k| std::vector parts; 275| 460k| while(!data.empty()) { ------------------ | Branch (275:10): [True: 366k, False: 94.5k] ------------------ 276| 366k| const uint32_t comp = consume(data); 277| | 278| 366k| if(parts.empty()) { ------------------ | Branch (278:10): [True: 94.5k, False: 271k] ------------------ 279| | // divide into root and second arc 280| | 281| 94.5k| const uint32_t root_arc = [](uint32_t b0) -> uint32_t { 282| 94.5k| if(b0 < 40) { 283| 94.5k| return 0; 284| 94.5k| } else if(b0 < 80) { 285| 94.5k| return 1; 286| 94.5k| } else { 287| 94.5k| return 2; 288| 94.5k| } 289| 94.5k| }(comp); 290| | 291| 94.5k| parts.push_back(root_arc); 292| 94.5k| BOTAN_ASSERT_NOMSG(comp >= 40 * root_arc); ------------------ | | 77| 94.5k| do { \ | | 78| 94.5k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 94.5k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 94.5k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 94.5k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 94.5k] | | ------------------ ------------------ 293| 94.5k| parts.push_back(comp - 40 * root_arc); 294| 271k| } else { 295| 271k| parts.push_back(comp); 296| 271k| } 297| 366k| } 298| | 299| 94.5k| m_id = parts; 300| 94.5k|} asn1_oid.cpp:_ZN5Botan12_GLOBAL__N_115oid_valid_checkENSt3__14spanIKjLm18446744073709551615EEE: 26| 130k|void oid_valid_check(std::span oid) { 27| 130k| BOTAN_ARG_CHECK(oid.size() >= 2, "OID too short to be valid"); ------------------ | | 35| 130k| do { \ | | 36| 130k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 130k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 130k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 130k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 130k] | | ------------------ ------------------ 28| 130k| BOTAN_ARG_CHECK(oid[0] <= 2, "OID root out of range"); ------------------ | | 35| 130k| do { \ | | 36| 130k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 130k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 130k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 130k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 130k] | | ------------------ ------------------ 29| 130k| BOTAN_ARG_CHECK(oid[1] <= 39 || oid[0] == 2, "OID second arc too large"); ------------------ | | 35| 130k| do { \ | | 36| 130k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 130k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 130k, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 130k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 130k] | | ------------------ ------------------ 30| | // This last is a limitation of using 32 bit integers when decoding 31| | // not a limitation of ASN.1 object identifiers in general 32| 130k| BOTAN_ARG_CHECK(oid[1] <= 0xFFFFFFAF, "OID second arc too large"); ------------------ | | 35| 130k| do { \ | | 36| 130k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 130k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 130k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 130k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 130k] | | ------------------ ------------------ 33| 130k|} asn1_oid.cpp:_ZZNK5Botan3OID11encode_intoERNS_11DER_EncoderEENK3$_0clERNSt3__16vectorIhNS4_9allocatorIhEEEEj: 190| 379k| auto append = [](std::vector& encoding, uint32_t z) { 191| 379k| if(z <= 0x7F) { ------------------ | Branch (191:10): [True: 324k, False: 54.2k] ------------------ 192| 324k| encoding.push_back(static_cast(z)); 193| 324k| } else { 194| 54.2k| const size_t z7 = (high_bit(z) + 7 - 1) / 7; 195| | 196| 173k| for(size_t j = 0; j != z7; ++j) { ------------------ | Branch (196:28): [True: 119k, False: 54.2k] ------------------ 197| 119k| uint8_t zp = static_cast(z >> (7 * (z7 - j - 1)) & 0x7F); 198| | 199| 119k| if(j != z7 - 1) { ------------------ | Branch (199:16): [True: 64.7k, False: 54.2k] ------------------ 200| 64.7k| zp |= 0x80; 201| 64.7k| } 202| | 203| 119k| encoding.push_back(zp); 204| 119k| } 205| 54.2k| } 206| 379k| }; asn1_oid.cpp:_ZZN5Botan3OID11decode_fromERNS_11BER_DecoderEENK3$_0clERNS_12BufferSlicerE: 235| 366k| auto consume = [](BufferSlicer& data) -> uint32_t { 236| 366k| BOTAN_ASSERT_NOMSG(!data.empty()); ------------------ | | 77| 366k| do { \ | | 78| 366k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 366k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 366k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 366k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 366k] | | ------------------ ------------------ 237| 366k| uint32_t b = data.take_byte(); 238| | 239| 366k| if(b > 0x7F) { ------------------ | Branch (239:10): [True: 63.3k, False: 302k] ------------------ 240| 63.3k| b &= 0x7F; 241| | 242| | // Even BER requires that the OID have minimal length, ie that 243| | // the first byte of a multibyte encoding cannot be zero 244| | // See X.690 section 8.19.2 245| 63.3k| if(b == 0) { ------------------ | Branch (245:13): [True: 1, False: 63.3k] ------------------ 246| 1| throw Decoding_Error("Leading zero byte in multibyte OID encoding"); 247| 1| } 248| | 249| 63.9k| while(true) { ------------------ | Branch (249:16): [True: 63.9k, Folded] ------------------ 250| 63.9k| if(data.empty()) { ------------------ | Branch (250:16): [True: 6, False: 63.9k] ------------------ 251| 6| throw Decoding_Error("Truncated OID value"); 252| 6| } 253| | 254| 63.9k| const uint8_t next = data.take_byte(); 255| 63.9k| const bool more = (next & 0x80) == 0x80; 256| 63.9k| const uint8_t value = next & 0x7F; 257| | 258| 63.9k| if((b >> (32 - 7)) != 0) { ------------------ | Branch (258:16): [True: 16, False: 63.9k] ------------------ 259| 16| throw Decoding_Error("OID component overflow"); 260| 16| } 261| | 262| 63.9k| b = (b << 7) | value; 263| | 264| 63.9k| if(!more) { ------------------ | Branch (264:16): [True: 63.3k, False: 621] ------------------ 265| 63.3k| break; 266| 63.3k| } 267| 63.9k| } 268| 63.3k| } 269| | 270| 366k| return b; 271| 366k| }; asn1_oid.cpp:_ZZN5Botan3OID11decode_fromERNS_11BER_DecoderEENK3$_1clEj: 281| 94.5k| const uint32_t root_arc = [](uint32_t b0) -> uint32_t { 282| 94.5k| if(b0 < 40) { ------------------ | Branch (282:16): [True: 308, False: 94.1k] ------------------ 283| 308| return 0; 284| 94.1k| } else if(b0 < 80) { ------------------ | Branch (284:23): [True: 31.3k, False: 62.8k] ------------------ 285| 31.3k| return 1; 286| 62.8k| } else { 287| 62.8k| return 2; 288| 62.8k| } 289| 94.5k| }(comp); _ZN5Botan11ASN1_StringC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_9ASN1_TypeE: 135| 38.0k|ASN1_String::ASN1_String(std::string_view str, ASN1_Type t) : m_utf8_str(str), m_tag(t) { 136| 38.0k| if(!is_utf8_subset_string_type(m_tag)) { ------------------ | Branch (136:7): [True: 0, False: 38.0k] ------------------ 137| 0| throw Invalid_Argument("ASN1_String only supports encoding to UTF-8 or a UTF-8 subset"); 138| 0| } 139| | 140| 38.0k| if(!is_valid_asn1_string_content(m_utf8_str, m_tag)) { ------------------ | Branch (140:7): [True: 0, False: 38.0k] ------------------ 141| 0| throw Invalid_Argument(fmt("ASN1_String: Invalid {} encoding", asn1_tag_to_string(m_tag))); 142| 0| } 143| 38.0k|} _ZN5Botan11ASN1_StringC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 145| 38.0k|ASN1_String::ASN1_String(std::string_view str) : ASN1_String(str, choose_encoding(str)) {} _ZN5Botan11ASN1_String11decode_fromERNS_11BER_DecoderE: 162| 38.0k|void ASN1_String::decode_from(BER_Decoder& source) { 163| 38.0k| const BER_Object obj = source.get_next_object(); 164| | 165| 38.0k| if(obj.get_class() != ASN1_Class::Universal || !is_asn1_string_type(obj.type())) { ------------------ | Branch (165:7): [True: 12, False: 38.0k] | Branch (165:51): [True: 41, False: 37.9k] ------------------ 166| 43| auto typ = static_cast(obj.type()); 167| 43| auto cls = static_cast(obj.get_class()); 168| 43| throw Decoding_Error(fmt("ASN1_String: Unknown string type {}/{}", typ, cls)); 169| 43| } 170| | 171| 37.9k| m_tag = obj.type(); 172| 37.9k| m_data.assign(obj.bits(), obj.bits() + obj.length()); 173| | 174| 37.9k| if(m_tag == ASN1_Type::BmpString) { ------------------ | Branch (174:7): [True: 35, False: 37.9k] ------------------ 175| 35| m_utf8_str = ucs2_to_utf8(m_data); 176| 37.9k| } else if(m_tag == ASN1_Type::UniversalString) { ------------------ | Branch (176:14): [True: 61, False: 37.9k] ------------------ 177| 61| m_utf8_str = ucs4_to_utf8(m_data); 178| 37.9k| } else if(m_tag == ASN1_Type::TeletexString) { ------------------ | Branch (178:14): [True: 90, False: 37.8k] ------------------ 179| | /* 180| | TeletexString is nominally ITU T.61 not ISO-8859-1 but it seems 181| | the majority of implementations actually used that charset here. 182| | */ 183| 90| m_utf8_str = latin1_to_utf8(m_data); 184| 37.8k| } else { 185| | // All other supported string types are UTF-8 or some subset thereof 186| 37.8k| m_utf8_str = ASN1::to_string(obj); 187| | 188| 37.8k| if(!is_valid_asn1_string_content(m_utf8_str, m_tag)) { ------------------ | Branch (188:10): [True: 31, False: 37.7k] ------------------ 189| 31| throw Decoding_Error(fmt("ASN1_String: Invalid {} encoding", asn1_tag_to_string(m_tag))); 190| 31| } 191| 37.8k| } 192| 37.9k|} asn1_str.cpp:_ZN5Botan12_GLOBAL__N_119is_asn1_string_typeENS_9ASN1_TypeE: 99| 38.0k|bool is_asn1_string_type(ASN1_Type tag) { 100| 38.0k| return (is_utf8_subset_string_type(tag) || tag == ASN1_Type::TeletexString || tag == ASN1_Type::BmpString || ------------------ | Branch (100:12): [True: 37.8k, False: 227] | Branch (100:47): [True: 90, False: 137] | Branch (100:82): [True: 35, False: 102] ------------------ 101| 102| tag == ASN1_Type::UniversalString); ------------------ | Branch (101:12): [True: 61, False: 41] ------------------ 102| 38.0k|} asn1_str.cpp:_ZN5Botan12_GLOBAL__N_126is_utf8_subset_string_typeENS_9ASN1_TypeE: 94| 151k|bool is_utf8_subset_string_type(ASN1_Type tag) { 95| 151k| return (tag == ASN1_Type::NumericString || tag == ASN1_Type::PrintableString || tag == ASN1_Type::VisibleString || ------------------ | Branch (95:12): [True: 36, False: 151k] | Branch (95:47): [True: 126k, False: 25.8k] | Branch (95:84): [True: 46, False: 25.7k] ------------------ 96| 25.7k| tag == ASN1_Type::Ia5String || tag == ASN1_Type::Utf8String); ------------------ | Branch (96:12): [True: 42, False: 25.7k] | Branch (96:43): [True: 25.4k, False: 227] ------------------ 97| 151k|} asn1_str.cpp:_ZN5Botan12_GLOBAL__N_128is_valid_asn1_string_contentERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS_9ASN1_TypeE: 104| 75.8k|bool is_valid_asn1_string_content(const std::string& str, ASN1_Type tag) { 105| 75.8k| BOTAN_ASSERT_NOMSG(is_utf8_subset_string_type(tag)); ------------------ | | 77| 75.8k| do { \ | | 78| 75.8k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 75.8k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 75.8k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 75.8k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 75.8k] | | ------------------ ------------------ 106| | 107| 75.8k| switch(tag) { 108| 12.7k| case ASN1_Type::Utf8String: ------------------ | Branch (108:7): [True: 12.7k, False: 63.1k] ------------------ 109| 12.7k| return is_valid_utf8(str); 110| 18| case ASN1_Type::NumericString: ------------------ | Branch (110:7): [True: 18, False: 75.8k] ------------------ 111| 63.0k| case ASN1_Type::PrintableString: ------------------ | Branch (111:7): [True: 63.0k, False: 12.8k] ------------------ 112| 63.1k| case ASN1_Type::Ia5String: ------------------ | Branch (112:7): [True: 21, False: 75.8k] ------------------ 113| 63.1k| case ASN1_Type::VisibleString: ------------------ | Branch (113:7): [True: 23, False: 75.8k] ------------------ 114| 63.1k| return g_char_validator.valid_encoding(str, tag); 115| 0| default: ------------------ | Branch (115:7): [True: 0, False: 75.8k] ------------------ 116| 0| return false; 117| 75.8k| } 118| 75.8k|} asn1_str.cpp:_ZNK5Botan12_GLOBAL__N_131ASN1_String_Codepoint_Validator14valid_encodingENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEENS_9ASN1_TypeE: 25| 101k| constexpr bool valid_encoding(std::string_view str, ASN1_Type tag) const { 26| 101k| const uint8_t mask = mask_for(tag); 27| 101k| for(const char c : str) { ------------------ | Branch (27:27): [True: 87.6k, False: 101k] ------------------ 28| 87.6k| const uint8_t codepoint = static_cast(c); 29| 87.6k| const bool is_valid = (m_table[codepoint] & mask) != 0; 30| | 31| 87.6k| if(!is_valid) { ------------------ | Branch (31:16): [True: 5, False: 87.6k] ------------------ 32| 5| return false; 33| 5| } 34| 87.6k| } 35| | 36| 101k| return true; 37| 101k| } asn1_str.cpp:_ZN5Botan12_GLOBAL__N_131ASN1_String_Codepoint_Validator8mask_forENS_9ASN1_TypeE: 45| 101k| static constexpr uint8_t mask_for(ASN1_Type tag) { 46| 101k| switch(tag) { 47| 18| case ASN1_Type::NumericString: ------------------ | Branch (47:13): [True: 18, False: 101k] ------------------ 48| 18| return Numeric_String; 49| 101k| case ASN1_Type::PrintableString: ------------------ | Branch (49:13): [True: 101k, False: 62] ------------------ 50| 101k| return Printable_String; 51| 21| case ASN1_Type::Ia5String: ------------------ | Branch (51:13): [True: 21, False: 101k] ------------------ 52| 21| return IA5_String; 53| 23| case ASN1_Type::VisibleString: ------------------ | Branch (53:13): [True: 23, False: 101k] ------------------ 54| 23| return Visible_String; 55| 0| default: ------------------ | Branch (55:13): [True: 0, False: 101k] ------------------ 56| 0| return 0; 57| 101k| } 58| 101k| } asn1_str.cpp:_ZN5Botan12_GLOBAL__N_115choose_encodingENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 120| 38.0k|ASN1_Type choose_encoding(std::string_view str) { 121| 38.0k| if(g_char_validator.valid_encoding(str, ASN1_Type::PrintableString)) { ------------------ | Branch (121:7): [True: 38.0k, False: 0] ------------------ 122| 38.0k| return ASN1_Type::PrintableString; 123| 38.0k| } else { 124| 0| return ASN1_Type::Utf8String; 125| 0| } 126| 38.0k|} _ZN5Botan9ASN1_TimeC2EthhhhhNS_9ASN1_TypeE: 43| 12.4k| m_year(year), m_month(month), m_day(day), m_hour(hour), m_minute(minute), m_second(second), m_tag(tag) { 44| 12.4k| if(tag != ASN1_Type::UtcTime && tag != ASN1_Type::GeneralizedTime) { ------------------ | Branch (44:7): [True: 0, False: 12.4k] | Branch (44:36): [True: 0, False: 0] ------------------ 45| 0| throw Invalid_Argument("ASN1_Time tag must be UtcTime or GeneralizedTime"); 46| 0| } 47| | 48| | /* 49| | * RFC 5280 Section 4.1.2.5: 50| | * To indicate that a certificate has no well-defined expiration date, 51| | * the notAfter SHOULD be assigned the GeneralizedTime value of 52| | * 99991231235959Z. 53| | */ 54| 12.4k| const uint16_t min_year = 1950; 55| 12.4k| const uint16_t max_year = (tag == ASN1_Type::UtcTime) ? 2049 : 9999; ------------------ | Branch (55:30): [True: 12.4k, False: 0] ------------------ 56| | 57| 12.4k| if(m_year < min_year || m_year > max_year) { ------------------ | Branch (57:7): [True: 0, False: 12.4k] | Branch (57:28): [True: 0, False: 12.4k] ------------------ 58| 0| throw Invalid_Argument(fmt("ASN1_Time year {} is out of range ({} to {})", m_year, min_year, max_year)); 59| 0| } 60| | 61| 12.4k| if(m_month < 1 || m_month > 12) { ------------------ | Branch (61:7): [True: 0, False: 12.4k] | Branch (61:22): [True: 0, False: 12.4k] ------------------ 62| 0| throw Invalid_Argument(fmt("ASN1_Time month {} is out of range", static_cast(m_month))); 63| 0| } 64| | 65| 12.4k| constexpr uint8_t days_in_month[12] = {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}; 66| | 67| 12.4k| const bool is_leap_year = (m_year % 4 == 0) && (m_year % 100 != 0 || m_year % 400 == 0); ------------------ | Branch (67:30): [True: 0, False: 12.4k] | Branch (67:52): [True: 0, False: 0] | Branch (67:73): [True: 0, False: 0] ------------------ 68| 12.4k| const uint8_t max_day = (m_month == 2 && is_leap_year) ? 29 : days_in_month[m_month - 1]; ------------------ | Branch (68:29): [True: 0, False: 12.4k] | Branch (68:45): [True: 0, False: 0] ------------------ 69| | 70| 12.4k| if(m_day < 1 || m_day > max_day) { ------------------ | Branch (70:7): [True: 0, False: 12.4k] | Branch (70:20): [True: 0, False: 12.4k] ------------------ 71| 0| throw Invalid_Argument(fmt("ASN1_Time day {} is out of range for month {}", 72| 0| static_cast(m_day), 73| 0| static_cast(m_month))); 74| 0| } 75| | 76| 12.4k| if(m_hour > 23) { ------------------ | Branch (76:7): [True: 0, False: 12.4k] ------------------ 77| 0| throw Invalid_Argument(fmt("ASN1_Time hour {} is out of range", static_cast(m_hour))); 78| 0| } 79| | 80| 12.4k| if(m_minute > 59) { ------------------ | Branch (80:7): [True: 0, False: 12.4k] ------------------ 81| 0| throw Invalid_Argument(fmt("ASN1_Time minute {} is out of range", static_cast(m_minute))); 82| 0| } 83| | 84| | /* 85| | * RFC 5280 is silent on the issue of leap seconds in certificate fields, but both 86| | * OpenSSL and Go reject which suggests they are rarely if ever used in practice. 87| | */ 88| 12.4k| if(m_second > 59) { ------------------ | Branch (88:7): [True: 0, False: 12.4k] ------------------ 89| 0| throw Invalid_Argument(fmt("ASN1_Time second {} is out of range", static_cast(m_second))); 90| 0| } 91| 12.4k|} _ZN5Botan9ASN1_Time11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_9ASN1_TypeE: 109| 12.4k|ASN1_Time ASN1_Time::from_string(std::string_view t_spec, ASN1_Type tag) { 110| 12.4k| BOTAN_ARG_CHECK(tag == ASN1_Type::UtcTime || tag == ASN1_Type::GeneralizedTime, "Invalid tag for ASN1_Time"); ------------------ | | 35| 12.4k| do { \ | | 36| 12.4k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 12.4k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 12.4k, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 12.4k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 12.4k] | | ------------------ ------------------ 111| | 112| 12.4k| if(tag == ASN1_Type::GeneralizedTime) { ------------------ | Branch (112:7): [True: 0, False: 12.4k] ------------------ 113| 0| BOTAN_ARG_CHECK(t_spec.size() == 15, "Invalid GeneralizedTime input string"); ------------------ | | 35| 0| do { \ | | 36| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 0| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 0| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 0] | | ------------------ ------------------ 114| 12.4k| } else { 115| 12.4k| BOTAN_ARG_CHECK(t_spec.size() == 13, "Invalid UTCTime input string"); ------------------ | | 35| 12.4k| do { \ | | 36| 12.4k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 12.4k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 12.4k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 12.4k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 12.4k] | | ------------------ ------------------ 116| 12.4k| } 117| | 118| 12.4k| BOTAN_ARG_CHECK(t_spec.back() == 'Z', "Botan does not support ASN1 times with timezones other than Z"); ------------------ | | 35| 12.4k| do { \ | | 36| 12.4k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 12.4k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 12.4k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 12.4k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 12.4k] | | ------------------ ------------------ 119| | 120| 12.4k| const size_t field_len = 2; 121| 12.4k| const size_t year_len = (tag == ASN1_Type::UtcTime) ? 2 : 4; ------------------ | Branch (121:28): [True: 12.4k, False: 0] ------------------ 122| | 123| 12.4k| const size_t year_start = 0; 124| 12.4k| const size_t month_start = year_start + year_len; 125| 12.4k| const size_t day_start = month_start + field_len; 126| 12.4k| const size_t hour_start = day_start + field_len; 127| 12.4k| const size_t min_start = hour_start + field_len; 128| 12.4k| const size_t sec_start = min_start + field_len; 129| | 130| 12.4k| uint32_t year = to_u32bit(t_spec.substr(year_start, year_len)); 131| 12.4k| const uint32_t month = to_u32bit(t_spec.substr(month_start, field_len)); 132| 12.4k| const uint32_t day = to_u32bit(t_spec.substr(day_start, field_len)); 133| 12.4k| const uint32_t hour = to_u32bit(t_spec.substr(hour_start, field_len)); 134| 12.4k| const uint32_t minute = to_u32bit(t_spec.substr(min_start, field_len)); 135| 12.4k| const uint32_t second = to_u32bit(t_spec.substr(sec_start, field_len)); 136| | 137| 12.4k| if(tag == ASN1_Type::UtcTime) { ------------------ | Branch (137:7): [True: 12.4k, False: 0] ------------------ 138| | // Interpret the two digit year by the 1950/2050 split (RFC 5280 Section 4.1.2.5.1) 139| 12.4k| year += (year >= 50) ? 1900 : 2000; ------------------ | Branch (139:15): [True: 0, False: 12.4k] ------------------ 140| 12.4k| } 141| | 142| 12.4k| return ASN1_Time(static_cast(year), 143| 12.4k| static_cast(month), 144| 12.4k| static_cast(day), 145| 12.4k| static_cast(hour), 146| 12.4k| static_cast(minute), 147| 12.4k| static_cast(second), 148| 12.4k| tag); 149| 12.4k|} _ZN5Botan9ASN1_Time11decode_fromERNS_11BER_DecoderE: 168| 12.4k|void ASN1_Time::decode_from(BER_Decoder& source) { 169| 12.4k| const BER_Object ber_time = source.get_next_object(); 170| | 171| 12.4k| if(ber_time.get_class() != ASN1_Class::Universal || ------------------ | Branch (171:7): [True: 0, False: 12.4k] ------------------ 172| 12.4k| (ber_time.type() != ASN1_Type::UtcTime && ber_time.type() != ASN1_Type::GeneralizedTime)) { ------------------ | Branch (172:8): [True: 0, False: 12.4k] | Branch (172:49): [True: 0, False: 0] ------------------ 173| 0| throw Decoding_Error(fmt("ASN1_Time: Unexpected tag {}/{}", 174| 0| static_cast(ber_time.type()), 175| 0| static_cast(ber_time.get_class()))); 176| 0| } 177| | 178| 12.4k| try { 179| | // Assigning only after a successful parse means that a decoding error 180| | // cannot leave this object in a partially written state 181| 12.4k| *this = ASN1_Time::from_string(ASN1::to_string(ber_time), ber_time.type()); 182| 12.4k| } catch(Invalid_Argument& e) { 183| 0| throw Decoding_Error(fmt("Invalid ASN1_Time encoding: {}", e.what())); 184| 0| } 185| 12.4k|} _ZN5Botan11BER_DecoderD2Ev: 456| 291k|BER_Decoder::~BER_Decoder() = default; _ZNK5Botan11BER_Decoder10more_itemsEv: 461| 169k|bool BER_Decoder::more_items() const { 462| 169k| if(m_source->end_of_data() && !m_pushed.is_set()) { ------------------ | Branch (462:7): [True: 62.7k, False: 107k] | Branch (462:34): [True: 62.7k, False: 0] ------------------ 463| 62.7k| return false; 464| 62.7k| } 465| 107k| return true; 466| 169k|} _ZN5Botan11BER_Decoder10verify_endEv: 471| 75.1k|BER_Decoder& BER_Decoder::verify_end() { 472| 75.1k| return verify_end("BER_Decoder::verify_end called, but data remains"); 473| 75.1k|} _ZN5Botan11BER_Decoder10verify_endENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 478| 81.3k|BER_Decoder& BER_Decoder::verify_end(std::string_view err) { 479| 81.3k| if(!m_source->end_of_data() || m_pushed.is_set()) { ------------------ | Branch (479:7): [True: 92, False: 81.2k] | Branch (479:35): [True: 0, False: 81.2k] ------------------ 480| 92| throw Decoding_Error(err); 481| 92| } 482| 81.2k| return (*this); 483| 81.3k|} _ZN5Botan11BER_Decoder17discard_remainingEv: 488| 6.24k|BER_Decoder& BER_Decoder::discard_remaining() { 489| 6.24k| m_pushed = BER_Object(); 490| 6.24k| uint8_t buf = 0; 491| 6.24k| while(m_source->read_byte(buf) != 0) {} ------------------ | Branch (491:10): [True: 0, False: 6.24k] ------------------ 492| 6.24k| return (*this); 493| 6.24k|} _ZN5Botan11BER_Decoder14read_next_byteEv: 495| 3.33M|std::optional BER_Decoder::read_next_byte() { 496| 3.33M| BOTAN_ASSERT_NOMSG(m_source != nullptr); ------------------ | | 77| 3.33M| do { \ | | 78| 3.33M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 3.33M| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 3.33M] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 3.33M| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 3.33M] | | ------------------ ------------------ 497| 3.33M| uint8_t b = 0; 498| 3.33M| if(m_source->read_byte(b) != 0) { ------------------ | Branch (498:7): [True: 3.29M, False: 44.6k] ------------------ 499| 3.29M| return b; 500| 3.29M| } else { 501| 44.6k| return {}; 502| 44.6k| } 503| 3.33M|} _ZN5Botan11BER_Decoder16peek_next_objectEv: 505| 24.9k|const BER_Object& BER_Decoder::peek_next_object() { 506| 24.9k| if(!m_pushed.is_set()) { ------------------ | Branch (506:7): [True: 24.9k, False: 0] ------------------ 507| 24.9k| m_pushed = get_next_object(); 508| 24.9k| } 509| | 510| 24.9k| return m_pushed; 511| 24.9k|} _ZN5Botan11BER_Decoder15get_next_objectEv: 516| 554k|BER_Object BER_Decoder::get_next_object() { 517| 554k| BER_Object next; 518| | 519| 554k| if(m_pushed.is_set()) { ------------------ | Branch (519:7): [True: 56.3k, False: 498k] ------------------ 520| 56.3k| std::swap(next, m_pushed); 521| 56.3k| return next; 522| 56.3k| } 523| | 524| 498k| for(;;) { 525| 498k| ASN1_Type type_tag = ASN1_Type::NoObject; 526| 498k| ASN1_Class class_tag = ASN1_Class::NoObject; 527| 498k| decode_tag(m_source, type_tag, class_tag); 528| 498k| next.set_tagging(type_tag, class_tag); 529| 498k| if(next.is_set() == false) { // no more objects ------------------ | Branch (529:10): [True: 25.0k, False: 472k] ------------------ 530| 25.0k| return next; 531| 25.0k| } 532| | 533| 472k| const size_t allow_indef = m_limits.allow_ber_encoding() ? m_limits.max_nested_indefinite_length() : 0; ------------------ | Branch (533:34): [True: 0, False: 472k] ------------------ 534| 472k| const bool der_mode = m_limits.require_der_encoding(); 535| 472k| const auto dl = decode_length(m_source, allow_indef, der_mode, is_constructed(class_tag)); 536| | 537| | // Per X.690 8.1.5 the only valid EOC encoding is the two-octet 538| | // sequence 0x00 0x00. Reject any other length encoding on a tag of 539| | // (Eoc, Universal) before we consume the "content" bytes. 540| 472k| if(type_tag == ASN1_Type::Eoc && class_tag == ASN1_Class::Universal && ------------------ | Branch (540:10): [True: 12.5k, False: 460k] | Branch (540:40): [True: 50, False: 12.5k] ------------------ 541| 50| (dl.content_length() != 0 || dl.indefinite_length())) { ------------------ | Branch (541:11): [True: 35, False: 15] | Branch (541:39): [True: 0, False: 15] ------------------ 542| 35| throw BER_Decoding_Error("EOC marker with non-zero length"); 543| 35| } 544| | 545| 472k| if(const auto max_size = m_limits.max_object_size(); max_size && dl.content_length() > *max_size) { ------------------ | Branch (545:60): [True: 472k, False: 95] | Branch (545:72): [True: 35, False: 472k] ------------------ 546| 35| throw BER_Decoding_Error("Encoded object exceeds maximum size"); 547| 35| } 548| | 549| 472k| if(!m_source->check_available(dl.total_length())) { ------------------ | Branch (549:10): [True: 107, False: 472k] ------------------ 550| 107| throw BER_Decoding_Error("Value truncated"); 551| 107| } 552| | 553| 472k| uint8_t* out = next.mutable_bits(dl.content_length()); 554| 472k| if(m_source->read(out, dl.content_length()) != dl.content_length()) { ------------------ | Branch (554:10): [True: 0, False: 472k] ------------------ 555| 0| throw BER_Decoding_Error("Value truncated"); 556| 0| } 557| | 558| 472k| if(dl.indefinite_length()) { ------------------ | Branch (558:10): [True: 0, False: 472k] ------------------ 559| | // After reading the data consume the 2-byte EOC 560| 0| uint8_t eoc[2] = {0xFF, 0xFF}; 561| 0| if(m_source->read(eoc, 2) != 2 || eoc[0] != 0x00 || eoc[1] != 0x00) { ------------------ | Branch (561:13): [True: 0, False: 0] | Branch (561:44): [True: 0, False: 0] | Branch (561:62): [True: 0, False: 0] ------------------ 562| 0| throw BER_Decoding_Error("Missing or malformed EOC marker"); 563| 0| } 564| 0| } 565| | 566| 472k| if(next.tagging() == static_cast(ASN1_Type::Eoc)) { ------------------ | Branch (566:10): [True: 15, False: 472k] ------------------ 567| 15| if(m_limits.require_der_encoding()) { ------------------ | Branch (567:13): [True: 15, False: 0] ------------------ 568| 15| throw BER_Decoding_Error("Detected EOC marker in DER structure"); 569| 15| } 570| | // An EOC marker is only valid as an indefinite-length terminator, which 571| | // is consumed above when reading the indefinite-length object. A 572| | // standalone EOC is rejected unless the caller opted to tolerate it. 573| 0| if(m_limits.allow_standalone_eoc()) { ------------------ | Branch (573:13): [True: 0, False: 0] ------------------ 574| 0| continue; 575| 0| } 576| 0| throw BER_Decoding_Error("Encountered EOC marker outside of indefinite-length encoding"); 577| 0| } 578| | 579| 472k| break; 580| 472k| } 581| | 582| 472k| return next; 583| 498k|} _ZN5Botan11BER_Decoder9push_backEONS_10BER_ObjectE: 607| 56.3k|void BER_Decoder::push_back(BER_Object&& obj) { 608| 56.3k| if(m_pushed.is_set()) { ------------------ | Branch (608:7): [True: 0, False: 56.3k] ------------------ 609| 0| throw Invalid_State("BER_Decoder: Only one push back is allowed"); 610| 0| } 611| 56.3k| m_pushed = std::move(obj); 612| 56.3k|} _ZN5Botan11BER_Decoder10start_consENS_9ASN1_TypeENS_10ASN1_ClassE: 614| 196k|BER_Decoder BER_Decoder::start_cons(ASN1_Type type_tag, ASN1_Class class_tag) { 615| 196k| BER_Object obj = get_next_object(); 616| 196k| obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed); 617| | 618| | // In DER mode the elements of a universal SET must appear in sorted order 619| 196k| if(m_limits.require_der_encoding() && type_tag == ASN1_Type::Set && class_tag == ASN1_Class::Universal) { ------------------ | Branch (619:7): [True: 196k, False: 410] | Branch (619:42): [True: 37.9k, False: 158k] | Branch (619:72): [True: 37.9k, False: 0] ------------------ 620| 37.9k| verify_set_is_sorted(std::span{obj.bits(), obj.length()}); 621| 37.9k| } 622| | 623| 196k| BER_Decoder child(std::move(obj), this); 624| 196k| return child; 625| 196k|} _ZN5Botan11BER_Decoder8end_consEv: 630| 145k|BER_Decoder& BER_Decoder::end_cons() { 631| 145k| if(m_parent == nullptr) { ------------------ | Branch (631:7): [True: 0, False: 145k] ------------------ 632| 0| throw Invalid_State("BER_Decoder::end_cons called with null parent"); 633| 0| } 634| 145k| if(!m_source->end_of_data() || m_pushed.is_set()) { ------------------ | Branch (634:7): [True: 19, False: 145k] | Branch (634:35): [True: 0, False: 145k] ------------------ 635| 19| throw Decoding_Error("BER_Decoder::end_cons called with data left"); 636| 19| } 637| 145k| return (*m_parent); 638| 145k|} _ZN5Botan11BER_DecoderC2EONS_10BER_ObjectEPS0_: 641| 195k| m_limits(parent != nullptr ? parent->limits() : BER_Decoder::Limits::BER()), m_parent(parent) { ------------------ | Branch (641:16): [True: 195k, False: 0] ------------------ 642| 195k| m_data_src = std::make_unique(std::move(obj)); 643| 195k| m_source = m_data_src.get(); 644| 195k|} _ZN5Botan11BER_DecoderC2ERNS_10DataSourceENS0_6LimitsE: 654| 6.70k|BER_Decoder::BER_Decoder(DataSource& src, Limits limits) : m_limits(limits), m_source(&src) {} _ZN5Botan11BER_DecoderC2ENSt3__14spanIKhLm18446744073709551615EEENS0_6LimitsE: 659| 88.5k|BER_Decoder::BER_Decoder(std::span buf, Limits limits) : m_limits(limits) { 660| 88.5k| m_data_src = std::make_unique(buf); 661| 88.5k| m_source = m_data_src.get(); 662| 88.5k|} _ZN5Botan11BER_Decoder6decodeERNS_11ASN1_ObjectENS_9ASN1_TypeENS_10ASN1_ClassE: 671| 196k|BER_Decoder& BER_Decoder::decode(ASN1_Object& obj, ASN1_Type type_tag, ASN1_Class class_tag) { 672| | // TODO support this case properly 673| 196k| if(type_tag != ASN1_Type::NoObject || class_tag != ASN1_Class::NoObject) { ------------------ | Branch (673:7): [True: 0, False: 196k] | Branch (673:42): [True: 0, False: 196k] ------------------ 674| 0| throw Not_Implemented("BER_Decoder::decode(ASN1_Object) does not support implicit tagged decoding"); 675| 0| } 676| 196k| obj.decode_from(*this); 677| 196k| return (*this); 678| 196k|} _ZN5Botan11BER_Decoder6decodeERbNS_9ASN1_TypeENS_10ASN1_ClassE: 702| 6.24k|BER_Decoder& BER_Decoder::decode(bool& out, ASN1_Type type_tag, ASN1_Class class_tag) { 703| 6.24k| const BER_Object obj = get_next_object(); 704| 6.24k| obj.assert_is_a(type_tag, class_tag); 705| | 706| 6.24k| if(obj.length() != 1) { ------------------ | Branch (706:7): [True: 0, False: 6.24k] ------------------ 707| 0| throw BER_Decoding_Error("BER boolean value had invalid size"); 708| 0| } 709| | 710| 6.24k| const uint8_t val = obj.bits()[0]; 711| | 712| | // DER requires boolean values to be exactly 0x00 or 0xFF 713| 6.24k| if(m_limits.require_der_encoding() && val != 0x00 && val != 0xFF) { ------------------ | Branch (713:7): [True: 6.24k, False: 0] | Branch (713:42): [True: 6.24k, False: 0] | Branch (713:57): [True: 0, False: 6.24k] ------------------ 714| 0| throw BER_Decoding_Error("Detected non-canonical boolean encoding in DER structure"); 715| 0| } 716| | 717| 6.24k| out = (val != 0) ? true : false; ------------------ | Branch (717:10): [True: 6.24k, False: 0] ------------------ 718| | 719| 6.24k| return (*this); 720| 6.24k|} _ZN5Botan11BER_Decoder6decodeERmNS_9ASN1_TypeENS_10ASN1_ClassE: 725| 18.7k|BER_Decoder& BER_Decoder::decode(size_t& out, ASN1_Type type_tag, ASN1_Class class_tag) { 726| 18.7k| BigInt integer; 727| 18.7k| decode(integer, type_tag, class_tag); 728| | 729| 18.7k| if(integer.signum() < 0) { ------------------ | Branch (729:7): [True: 0, False: 18.7k] ------------------ 730| 0| throw BER_Decoding_Error("Decoded small integer value was negative"); 731| 0| } 732| | 733| 18.7k| if(integer.bits() > 32) { ------------------ | Branch (733:7): [True: 0, False: 18.7k] ------------------ 734| 0| throw BER_Decoding_Error("Decoded integer value larger than expected"); 735| 0| } 736| | 737| 18.7k| out = 0; 738| 93.7k| for(size_t i = 0; i != 4; ++i) { ------------------ | Branch (738:22): [True: 74.9k, False: 18.7k] ------------------ 739| 74.9k| out = (out << 8) | integer.byte_at(3 - i); 740| 74.9k| } 741| | 742| 18.7k| return (*this); 743| 18.7k|} _ZN5Botan11BER_Decoder6decodeERNS_6BigIntENS_9ASN1_TypeENS_10ASN1_ClassE: 775| 25.0k|BER_Decoder& BER_Decoder::decode(BigInt& out, ASN1_Type type_tag, ASN1_Class class_tag) { 776| 25.0k| const BER_Object obj = get_next_object(); 777| 25.0k| obj.assert_is_a(type_tag, class_tag); 778| | 779| | // An INTEGER must have at least one content octet (X.690 section 8.3.1) 780| 25.0k| if(obj.length() == 0) { ------------------ | Branch (780:7): [True: 1, False: 25.0k] ------------------ 781| 1| throw BER_Decoding_Error("INTEGER encoding has no content octets"); 782| 1| } 783| | 784| | // DER requires minimal INTEGER encoding (X.690 section 8.3.2) 785| 25.0k| if(m_limits.require_der_encoding()) { ------------------ | Branch (785:7): [True: 25.0k, False: 38] ------------------ 786| 25.0k| if(obj.length() > 1) { ------------------ | Branch (786:10): [True: 6.29k, False: 18.7k] ------------------ 787| 6.29k| if(obj.bits()[0] == 0x00 && (obj.bits()[1] & 0x80) == 0) { ------------------ | Branch (787:13): [True: 6.25k, False: 35] | Branch (787:38): [True: 1, False: 6.25k] ------------------ 788| 1| throw BER_Decoding_Error("Detected non-minimal INTEGER encoding in DER structure"); 789| 1| } 790| 6.29k| if(obj.bits()[0] == 0xFF && (obj.bits()[1] & 0x80) != 0) { ------------------ | Branch (790:13): [True: 12, False: 6.27k] | Branch (790:38): [True: 3, False: 9] ------------------ 791| 3| throw BER_Decoding_Error("Detected non-minimal INTEGER encoding in DER structure"); 792| 3| } 793| 6.29k| } 794| 25.0k| } 795| | 796| 25.0k| out = ASN1::integer_from_contents(obj.data()); 797| | 798| 25.0k| return (*this); 799| 25.0k|} _ZN5Botan4ASN121integer_from_contentsENSt3__14spanIKhLm18446744073709551615EEE: 801| 25.0k|BigInt ASN1::integer_from_contents(std::span contents) { 802| 25.0k| if(contents.empty()) { ------------------ | Branch (802:7): [True: 0, False: 25.0k] ------------------ 803| 0| throw BER_Decoding_Error("INTEGER encoding has no content octets"); 804| 0| } 805| | 806| 25.0k| BigInt out; 807| | 808| 25.0k| const bool negative = (contents[0] & 0x80) == 0x80; 809| | 810| 25.0k| if(negative) { ------------------ | Branch (810:7): [True: 23, False: 25.0k] ------------------ 811| 23| secure_vector vec(contents.begin(), contents.end()); 812| 49| for(size_t i = vec.size(); i > 0; --i) { ------------------ | Branch (812:34): [True: 49, False: 0] ------------------ 813| 49| const bool gt0 = (vec[i - 1] > 0); 814| 49| vec[i - 1] -= 1; 815| 49| if(gt0) { ------------------ | Branch (815:13): [True: 23, False: 26] ------------------ 816| 23| break; 817| 23| } 818| 49| } 819| 100| for(auto& byte : vec) { ------------------ | Branch (819:22): [True: 100, False: 23] ------------------ 820| 100| byte = ~byte; 821| 100| } 822| 23| out._assign_from_bytes(vec); 823| 23| out.set_sign(BigInt::Negative); 824| 25.0k| } else { 825| 25.0k| out._assign_from_bytes(contents); 826| 25.0k| } 827| | 828| 25.0k| return out; 829| 25.0k|} _ZN5Botan11BER_Decoder6decodeERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS_9ASN1_TypeES7_NS_10ASN1_ClassE: 1021| 12.4k| ASN1_Class class_tag) { 1022| 12.4k| if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) { ------------------ | Branch (1022:7): [True: 0, False: 12.4k] | Branch (1022:46): [True: 0, False: 0] ------------------ 1023| 0| throw BER_Bad_Tag("Bad tag for {BIT,OCTET} STRING", static_cast(real_type)); 1024| 0| } 1025| | 1026| 12.4k| asn1_decode_binary_string(buffer, get_next_object(), real_type, type_tag, class_tag, m_limits); 1027| 12.4k| return (*this); 1028| 12.4k|} _ZN5Botan11BER_Decoder6decodeERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeES7_NS_10ASN1_ClassE: 1033| 37.4k| ASN1_Class class_tag) { 1034| 37.4k| if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) { ------------------ | Branch (1034:7): [True: 0, False: 37.4k] | Branch (1034:46): [True: 0, False: 0] ------------------ 1035| 0| throw BER_Bad_Tag("Bad tag for {BIT,OCTET} STRING", static_cast(real_type)); 1036| 0| } 1037| | 1038| 37.4k| asn1_decode_binary_string(buffer, get_next_object(), real_type, type_tag, class_tag, m_limits); 1039| 37.4k| return (*this); 1040| 37.4k|} _ZN5Botan11BER_Decoder16decode_bitstringERNS_14ASN1_BitStringENS_9ASN1_TypeENS_10ASN1_ClassE: 1042| 18.8k|BER_Decoder& BER_Decoder::decode_bitstring(ASN1_BitString& out, ASN1_Type type_tag, ASN1_Class class_tag) { 1043| 18.8k| const BER_Object obj = get_next_object(); 1044| | 1045| 18.8k| std::vector bits; 1046| 18.8k| uint8_t unused_bits = 0; 1047| | 1048| 18.8k| if(is_constructed(obj.class_tag())) { ------------------ | Branch (1048:7): [True: 3, False: 18.8k] ------------------ 1049| 3| obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed); 1050| 3| if(m_limits.require_der_encoding()) { ------------------ | Branch (1050:10): [True: 2, False: 1] ------------------ 1051| 2| throw BER_Decoding_Error("Detected constructed string encoding in DER structure"); 1052| 2| } 1053| 1| bits.reserve(obj.length()); // upper possible bound on the output size 1054| 1| unused_bits = asn1_concat_constructed_bit_string(bits, obj, m_limits, 0); 1055| 18.8k| } else { 1056| 18.8k| unused_bits = asn1_bitstring_unused_bits(obj, type_tag, class_tag, m_limits.require_der_encoding()); 1057| 18.8k| bits.assign(obj.bits() + 1, obj.bits() + obj.length()); 1058| 18.8k| } 1059| | 1060| 18.8k| if(unused_bits > 0 && !bits.empty()) { ------------------ | Branch (1060:7): [True: 2, False: 18.8k] | Branch (1060:26): [True: 2, False: 0] ------------------ 1061| 2| bits.back() &= static_cast(0xFF << unused_bits); 1062| 2| } 1063| | 1064| 18.8k| out = ASN1_BitString(std::move(bits), unused_bits); 1065| 18.8k| return (*this); 1066| 18.8k|} _ZN5Botan4ASN120is_single_der_objectENSt3__14spanIKhLm18446744073709551615EEENS_9ASN1_TypeENS_10ASN1_ClassE: 1100| 25.2k|bool is_single_der_object(std::span bytes, ASN1_Type expected_type, ASN1_Class expected_class) { 1101| 25.2k| if(bytes.empty()) { ------------------ | Branch (1101:7): [True: 0, False: 25.2k] ------------------ 1102| 0| return false; 1103| 0| } 1104| | 1105| 25.2k| try { 1106| 25.2k| DataSource_Span src(bytes); 1107| | 1108| 25.2k| ASN1_Type type_tag = ASN1_Type::NoObject; 1109| 25.2k| ASN1_Class class_tag = ASN1_Class::NoObject; 1110| 25.2k| const size_t tag_bytes = decode_tag(&src, type_tag, class_tag); 1111| | 1112| 25.2k| if(type_tag != expected_type || class_tag != expected_class) { ------------------ | Branch (1112:10): [True: 12.7k, False: 12.5k] | Branch (1112:39): [True: 1, False: 12.5k] ------------------ 1113| 12.7k| return false; 1114| 12.7k| } 1115| | 1116| 12.5k| const auto dl = decode_length(&src, /*allow_indef=*/0, /*der_mode=*/true, is_constructed(expected_class)); 1117| | 1118| 12.5k| const size_t header_bytes = tag_bytes + dl.field_length(); 1119| 12.5k| if(header_bytes > bytes.size()) { ------------------ | Branch (1119:10): [True: 0, False: 12.5k] ------------------ 1120| 0| return false; 1121| 0| } 1122| 12.5k| return dl.content_length() == bytes.size() - header_bytes; 1123| 12.5k| } catch(Decoding_Error&) { 1124| 23| return false; 1125| 23| } 1126| 25.2k|} _ZN5Botan4ASN122is_der_sequence_headerENSt3__14spanIKhLm18446744073709551615EEE: 1128| 12.5k|bool is_der_sequence_header(std::span bytes) { 1129| 12.5k| return is_single_der_object(bytes, ASN1_Type::Sequence, ASN1_Class::Universal | ASN1_Class::Constructed); 1130| 12.5k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_110decode_tagEPNS_10DataSourceERNS_9ASN1_TypeERNS_10ASN1_ClassE: 29| 523k|size_t decode_tag(DataSource* ber, ASN1_Type& type_tag, ASN1_Class& class_tag) { 30| 523k| auto b = ber->read_byte(); 31| | 32| 523k| if(!b) { ------------------ | Branch (32:7): [True: 25.0k, False: 498k] ------------------ 33| 25.0k| type_tag = ASN1_Type::NoObject; 34| 25.0k| class_tag = ASN1_Class::NoObject; 35| 25.0k| return 0; 36| 25.0k| } 37| | 38| 498k| if((*b & 0x1F) != 0x1F) { ------------------ | Branch (38:7): [True: 497k, False: 376] ------------------ 39| 497k| type_tag = ASN1_Type(*b & 0x1F); 40| 497k| class_tag = ASN1_Class(*b & 0xE0); 41| | // The EOC marker is primitive; a constructed universal tag 0 has no 42| | // valid meaning and would otherwise bypass the EOC handling, which 43| | // matches on (Eoc, Universal) exactly 44| 497k| if(type_tag == ASN1_Type::Eoc && class_tag == ASN1_Class::Constructed) { ------------------ | Branch (44:10): [True: 12.5k, False: 485k] | Branch (44:40): [True: 5, False: 12.5k] ------------------ 45| 5| throw BER_Decoding_Error("EOC tag with constructed encoding"); 46| 5| } 47| 497k| return 1; 48| 497k| } 49| | 50| 376| size_t tag_bytes = 1; 51| 376| class_tag = ASN1_Class(*b & 0xE0); 52| | 53| 376| uint32_t tag_buf = 0; 54| 1.34k| while(true) { ------------------ | Branch (54:10): [True: 1.34k, Folded] ------------------ 55| 1.34k| b = ber->read_byte(); 56| 1.34k| if(!b) { ------------------ | Branch (56:10): [True: 12, False: 1.32k] ------------------ 57| 12| throw BER_Decoding_Error("Long-form tag truncated"); 58| 12| } 59| | // Reject if shifting in another 7 bits would overflow the uint32_t tag 60| 1.32k| if((tag_buf >> 25) != 0) { ------------------ | Branch (60:10): [True: 12, False: 1.31k] ------------------ 61| 12| throw BER_Decoding_Error("Long-form tag overflowed 32 bits"); 62| 12| } 63| | // This is required even by BER (see X.690 section 8.1.2.4.2 sentence c). 64| | // Bits 7-1 of the first subsequent octet must not be all zero; this rules 65| | // out both 0x80 (continuation with no data) and 0x00 (a long-form encoding 66| | // of tag value 0, which collides with the EOC marker). 67| 1.31k| if(tag_bytes == 1 && (*b & 0x7F) == 0) { ------------------ | Branch (67:10): [True: 371, False: 946] | Branch (67:28): [True: 4, False: 367] ------------------ 68| 4| throw BER_Decoding_Error("Long form tag with leading zero"); 69| 4| } 70| 1.31k| ++tag_bytes; 71| 1.31k| tag_buf = (tag_buf << 7) | (*b & 0x7F); 72| 1.31k| if((*b & 0x80) == 0) { ------------------ | Branch (72:10): [True: 348, False: 965] ------------------ 73| 348| break; 74| 348| } 75| 1.31k| } 76| | // Per X.690 8.1.2.2, tag values 0-30 shall be encoded in the short form. 77| | // Long-form encoding is reserved for tag values >= 31 (X.690 8.1.2.3). 78| | // This is unconditional and applies to BER as well as DER. 79| 348| if(tag_buf <= 30) { ------------------ | Branch (79:7): [True: 8, False: 340] ------------------ 80| 8| throw BER_Decoding_Error("Long-form tag encoding used for small tag value"); 81| 8| } 82| | 83| 340| if(tag_buf == static_cast(ASN1_Type::NoObject)) { ------------------ | Branch (83:7): [True: 4, False: 336] ------------------ 84| 4| throw BER_Decoding_Error("Tag value collides with internal sentinel"); 85| 4| } 86| | 87| | // NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange) 88| 336| type_tag = ASN1_Type(tag_buf); 89| 336| return tag_bytes; 90| 340|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_113decode_lengthEPNS_10DataSourceEmbb: 135| 485k|BerDecodedLength decode_length(DataSource* ber, size_t allow_indef, bool der_mode, bool constructed) { 136| 485k| uint8_t b = 0; 137| 485k| if(ber->read_byte(b) == 0) { ------------------ | Branch (137:7): [True: 45, False: 485k] ------------------ 138| 45| throw BER_Decoding_Error("Length field not found"); 139| 45| } 140| 485k| if((b & 0x80) == 0) { ------------------ | Branch (140:7): [True: 466k, False: 18.9k] ------------------ 141| 466k| return BerDecodedLength(b, 1); 142| 466k| } 143| | 144| 18.9k| const size_t num_length_bytes = (b & 0x7F); 145| 18.9k| if(num_length_bytes > 4) { ------------------ | Branch (145:7): [True: 16, False: 18.9k] ------------------ 146| 16| throw BER_Decoding_Error("Length field is too large"); 147| 16| } 148| | 149| 18.9k| const size_t field_size = 1 + num_length_bytes; 150| | 151| 18.9k| if(num_length_bytes == 0) { ------------------ | Branch (151:7): [True: 4, False: 18.9k] ------------------ 152| 4| if(der_mode) { ------------------ | Branch (152:10): [True: 4, False: 0] ------------------ 153| 4| throw BER_Decoding_Error("Detected indefinite-length encoding in DER structure"); 154| 4| } else if(!constructed) { ------------------ | Branch (154:17): [True: 0, False: 0] ------------------ 155| | // Indefinite length is only valid for constructed types (X.690 8.1.3.2) 156| 0| throw BER_Decoding_Error("Indefinite-length encoding used with non-constructed type"); 157| 0| } else if(allow_indef == 0) { ------------------ | Branch (157:17): [True: 0, False: 0] ------------------ 158| 0| throw BER_Decoding_Error("Nested EOC markers too deep, rejecting to avoid stack exhaustion"); 159| 0| } else { 160| | // find_eoc returns bytes up to and including the EOC marker. 161| | // Return the content length; the caller consumes the EOC separately. 162| 0| const size_t eoc_len = find_eoc(ber, /*base_offset=*/0, allow_indef - 1); 163| 0| if(eoc_len < 2) { ------------------ | Branch (163:13): [True: 0, False: 0] ------------------ 164| 0| throw BER_Decoding_Error("Invalid EOC encoding"); 165| 0| } 166| 0| return BerDecodedLength::indefinite(eoc_len - 2, field_size); 167| 0| } 168| 4| } 169| | 170| 18.9k| size_t length = 0; 171| | 172| 50.7k| for(size_t i = 0; i != num_length_bytes; ++i) { ------------------ | Branch (172:22): [True: 31.8k, False: 18.9k] ------------------ 173| 31.8k| if(ber->read_byte(b) == 0) { ------------------ | Branch (173:10): [True: 3, False: 31.8k] ------------------ 174| 3| throw BER_Decoding_Error("Corrupted length field"); 175| 3| } 176| | // Can't overflow since we already checked that num_length_bytes <= 4 177| 31.8k| length = (length << 8) | b; 178| 31.8k| } 179| | 180| | // DER requires shortest possible length encoding 181| 18.9k| if(der_mode) { ------------------ | Branch (181:7): [True: 18.9k, False: 0] ------------------ 182| 18.9k| if(length < 128) { ------------------ | Branch (182:10): [True: 4, False: 18.9k] ------------------ 183| 4| throw BER_Decoding_Error("Detected non-canonical length encoding in DER structure"); 184| 4| } 185| 18.9k| if(num_length_bytes > 1 && length < (size_t(1) << ((num_length_bytes - 1) * 8))) { ------------------ | Branch (185:10): [True: 12.6k, False: 6.28k] | Branch (185:34): [True: 1, False: 12.6k] ------------------ 186| 1| throw BER_Decoding_Error("Detected non-canonical length encoding in DER structure"); 187| 1| } 188| 18.9k| } 189| | 190| 18.9k| return BerDecodedLength(length, field_size); 191| 18.9k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_116BerDecodedLengthC2Emm: 108| 485k| BerDecodedLength(content_length, field_length, false) {} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_116BerDecodedLengthC2Emmb: 125| 485k| m_content_length(content_length), m_field_length(field_length), m_indefinite(indefinite) {} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_18peek_tagEPNS_10DataSourceEmRNS_9ASN1_TypeERNS_10ASN1_ClassE: 197| 38.4k|size_t peek_tag(DataSource* src, size_t offset, ASN1_Type& type_tag, ASN1_Class& class_tag) { 198| 38.4k| uint8_t b = 0; 199| 38.4k| if(src->peek(&b, 1, offset) == 0) { ------------------ | Branch (199:7): [True: 0, False: 38.4k] ------------------ 200| 0| type_tag = ASN1_Type::NoObject; 201| 0| class_tag = ASN1_Class::NoObject; 202| 0| return 0; 203| 0| } 204| | 205| 38.4k| if((b & 0x1F) != 0x1F) { ------------------ | Branch (205:7): [True: 38.4k, False: 68] ------------------ 206| 38.4k| type_tag = ASN1_Type(b & 0x1F); 207| 38.4k| class_tag = ASN1_Class(b & 0xE0); 208| | // The EOC marker is primitive; a constructed universal tag 0 has no 209| | // valid meaning and would otherwise bypass the EOC handling, which 210| | // matches on (Eoc, Universal) exactly 211| 38.4k| if(type_tag == ASN1_Type::Eoc && class_tag == ASN1_Class::Constructed) { ------------------ | Branch (211:10): [True: 141, False: 38.2k] | Branch (211:40): [True: 1, False: 140] ------------------ 212| 1| throw BER_Decoding_Error("EOC tag with constructed encoding"); 213| 1| } 214| 38.4k| return 1; 215| 38.4k| } 216| | 217| 68| class_tag = ASN1_Class(b & 0xE0); 218| 68| size_t tag_bytes = 1; 219| 68| uint32_t tag_buf = 0; 220| | 221| 253| while(true) { ------------------ | Branch (221:10): [True: 253, Folded] ------------------ 222| 253| if(src->peek(&b, 1, offset + tag_bytes) == 0) { ------------------ | Branch (222:10): [True: 1, False: 252] ------------------ 223| 1| throw BER_Decoding_Error("Long-form tag truncated"); 224| 1| } 225| | // Reject if shifting in another 7 bits would overflow the uint32_t tag 226| 252| if((tag_buf >> 25) != 0) { ------------------ | Branch (226:10): [True: 7, False: 245] ------------------ 227| 7| throw BER_Decoding_Error("Long-form tag overflowed 32 bits"); 228| 7| } 229| | // Required even by BER (X.690 section 8.1.2.4.2 sentence c). 230| | // Bits 7-1 of the first subsequent octet must not be all zero; this rules 231| | // out both 0x80 (continuation with no data) and 0x00 (a long-form encoding 232| | // of tag value 0, which collides with the EOC marker). 233| 245| if(tag_bytes == 1 && (b & 0x7F) == 0) { ------------------ | Branch (233:10): [True: 68, False: 177] | Branch (233:28): [True: 1, False: 67] ------------------ 234| 1| throw BER_Decoding_Error("Long form tag with leading zero"); 235| 1| } 236| 244| ++tag_bytes; 237| 244| tag_buf = (tag_buf << 7) | (b & 0x7F); 238| 244| if((b & 0x80) == 0) { ------------------ | Branch (238:10): [True: 59, False: 185] ------------------ 239| 59| break; 240| 59| } 241| 244| } 242| | 243| | // Per X.690 8.1.2.2, tag values 0-30 shall be encoded in the short form. 244| | // Long-form encoding is reserved for tag values >= 31 (X.690 8.1.2.3). 245| | // This is unconditional and applies to BER as well as DER. 246| 59| if(tag_buf <= 30) { ------------------ | Branch (246:7): [True: 1, False: 58] ------------------ 247| 1| throw BER_Decoding_Error("Long-form tag encoding used for small tag value"); 248| 1| } 249| | 250| 58| if(tag_buf == static_cast(ASN1_Type::NoObject)) { ------------------ | Branch (250:7): [True: 1, False: 57] ------------------ 251| 1| throw BER_Decoding_Error("Tag value collides with internal sentinel"); 252| 1| } 253| | 254| | // NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange) 255| 57| type_tag = ASN1_Type(tag_buf); 256| 57| return tag_bytes; 257| 58|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_111peek_lengthEPNS_10DataSourceEmRmmbb: 265| 38.4k| DataSource* src, size_t offset, size_t& field_size, size_t allow_indef, bool constructed, bool der_mode) { 266| 38.4k| uint8_t b = 0; 267| 38.4k| if(src->peek(&b, 1, offset) == 0) { ------------------ | Branch (267:7): [True: 2, False: 38.4k] ------------------ 268| 2| throw BER_Decoding_Error("Length field not found"); 269| 2| } 270| | 271| 38.4k| field_size = 1; 272| 38.4k| if((b & 0x80) == 0) { ------------------ | Branch (272:7): [True: 38.3k, False: 70] ------------------ 273| 38.3k| return b; 274| 38.3k| } 275| | 276| 70| const size_t num_length_bytes = (b & 0x7F); 277| 70| field_size += num_length_bytes; 278| 70| if(field_size > 5) { ------------------ | Branch (278:7): [True: 15, False: 55] ------------------ 279| 15| throw BER_Decoding_Error("Length field is too large"); 280| 15| } 281| | 282| 55| if(num_length_bytes == 0) { ------------------ | Branch (282:7): [True: 1, False: 54] ------------------ 283| | // Indefinite length is not allowed in DER 284| 1| if(der_mode) { ------------------ | Branch (284:10): [True: 1, False: 0] ------------------ 285| 1| throw BER_Decoding_Error("Detected indefinite-length encoding in DER structure"); 286| 1| } 287| | // Indefinite length is only valid for constructed types (X.690 8.1.3.2) 288| 0| if(!constructed) { ------------------ | Branch (288:10): [True: 0, False: 0] ------------------ 289| 0| throw BER_Decoding_Error("Indefinite-length encoding used with non-constructed type"); 290| 0| } 291| 0| if(allow_indef == 0) { ------------------ | Branch (291:10): [True: 0, False: 0] ------------------ 292| 0| throw BER_Decoding_Error("Nested EOC markers too deep, rejecting to avoid stack exhaustion"); 293| 0| } 294| 0| return find_eoc(src, offset + 1, allow_indef - 1); 295| 0| } 296| | 297| 54| size_t length = 0; 298| 224| for(size_t i = 0; i < num_length_bytes; ++i) { ------------------ | Branch (298:22): [True: 171, False: 53] ------------------ 299| 171| if(src->peek(&b, 1, offset + 1 + i) == 0) { ------------------ | Branch (299:10): [True: 1, False: 170] ------------------ 300| 1| throw BER_Decoding_Error("Corrupted length field"); 301| 1| } 302| 170| if(get_byte<0>(length) != 0) { ------------------ | Branch (302:10): [True: 0, False: 170] ------------------ 303| 0| throw BER_Decoding_Error("Field length overflow"); 304| 0| } 305| 170| length = (length << 8) | b; 306| 170| } 307| 53| return length; 308| 54|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_114is_constructedENS_10ASN1_ClassE: 22| 611k|bool is_constructed(ASN1_Class class_tag) { 23| 611k| return (static_cast(class_tag) & static_cast(ASN1_Class::Constructed)) != 0; 24| 611k|} ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_116BerDecodedLength14content_lengthEv: 114| 1.90M| size_t content_length() const { return m_content_length; } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_116BerDecodedLength17indefinite_lengthEv: 121| 472k| bool indefinite_length() const { return m_indefinite; } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_116BerDecodedLength12total_lengthEv: 117| 472k| size_t total_length() const { return m_indefinite ? m_content_length + 2 : m_content_length; } ------------------ | Branch (117:44): [True: 0, False: 472k] ------------------ ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120verify_set_is_sortedENSt3__14spanIKhLm18446744073709551615EEE: 426| 37.9k|void verify_set_is_sorted(std::span content) { 427| 37.9k| DataSource_Span src(content); 428| 37.9k| size_t offset = 0; 429| 37.9k| std::optional> prev; 430| | 431| 76.2k| while(offset < content.size()) { ------------------ | Branch (431:10): [True: 38.4k, False: 37.8k] ------------------ 432| 38.4k| ASN1_Type type_tag = ASN1_Type::NoObject; 433| 38.4k| ASN1_Class class_tag = ASN1_Class::NoObject; 434| 38.4k| const size_t tag_size = peek_tag(&src, offset, type_tag, class_tag); 435| | 436| 38.4k| size_t length_size = 0; 437| 38.4k| const size_t item_size = 438| 38.4k| peek_length(&src, offset + tag_size, length_size, /*allow_indef=*/0, is_constructed(class_tag), true); 439| | 440| 38.4k| const auto end = checked_add(offset, tag_size, length_size, item_size); 441| 38.4k| if(!end || *end > content.size()) { ------------------ | Branch (441:10): [True: 31, False: 38.4k] | Branch (441:18): [True: 56, False: 38.3k] ------------------ 442| 56| throw BER_Decoding_Error("SET element exceeds available data"); 443| 56| } 444| | 445| 38.4k| const auto elem = content.subspan(offset, *end - offset); 446| 38.4k| if(prev && std::lexicographical_compare(elem.begin(), elem.end(), prev->begin(), prev->end())) { ------------------ | Branch (446:10): [True: 517, False: 37.9k] | Branch (446:18): [True: 37, False: 480] ------------------ 447| 37| throw BER_Decoding_Error("Detected unsorted SET in DER structure"); 448| 37| } 449| 38.3k| prev = elem; 450| 38.3k| offset = *end; 451| 38.3k| } 452| 37.9k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_126asn1_bitstring_unused_bitsERKNS_10BER_ObjectENS_9ASN1_TypeENS_10ASN1_ClassEb: 985| 18.8k|uint8_t asn1_bitstring_unused_bits(const BER_Object& obj, ASN1_Type type_tag, ASN1_Class class_tag, bool require_der) { 986| 18.8k| obj.assert_is_a(type_tag, class_tag); 987| 18.8k| BOTAN_ASSERT_NOMSG(!is_constructed(obj)); ------------------ | | 77| 18.8k| do { \ | | 78| 18.8k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 18.8k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 18.8k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 18.8k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 18.8k] | | ------------------ ------------------ 988| | 989| 18.8k| if(obj.length() == 0) { ------------------ | Branch (989:7): [True: 1, False: 18.8k] ------------------ 990| 1| throw BER_Decoding_Error("Invalid BIT STRING"); 991| 1| } 992| | 993| 18.8k| const uint8_t unused_bits = obj.bits()[0]; 994| | 995| 18.8k| if(unused_bits >= 8) { ------------------ | Branch (995:7): [True: 2, False: 18.8k] ------------------ 996| 2| throw BER_Decoding_Error("Invalid number of unused bits in BIT STRING"); 997| 2| } 998| | 999| 18.8k| if(obj.length() == 1 && unused_bits != 0) { ------------------ | Branch (999:7): [True: 2, False: 18.8k] | Branch (999:28): [True: 1, False: 1] ------------------ 1000| 1| throw BER_Decoding_Error("Invalid BIT STRING"); 1001| 1| } 1002| | 1003| 18.8k| if(require_der && unused_bits > 0) { ------------------ | Branch (1003:7): [True: 18.8k, False: 3] | Branch (1003:22): [True: 4, False: 18.8k] ------------------ 1004| 4| const uint8_t last_byte = obj.bits()[obj.length() - 1]; 1005| 4| if((last_byte & ((1 << unused_bits) - 1)) != 0) { ------------------ | Branch (1005:10): [True: 2, False: 2] ------------------ 1006| 2| throw BER_Decoding_Error("Detected non-zero padding bits in BIT STRING in DER structure"); 1007| 2| } 1008| 4| } 1009| | 1010| 18.8k| return unused_bits; 1011| 18.8k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_114is_constructedERKNS_10BER_ObjectE: 833| 68.8k|bool is_constructed(const BER_Object& obj) { 834| 68.8k| return is_constructed(obj.class_tag()); 835| 68.8k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_115DataSource_SpanC2ENSt3__14spanIKhLm18446744073709551615EEE: 414| 63.2k| explicit DataSource_Span(std::span buf) : m_buf(buf) {} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_115DataSource_Span4readEPhm: 392| 38.3k| size_t read(uint8_t out[], size_t length) override { 393| 38.3k| const size_t got = std::min(m_buf.size() - m_offset, length); 394| 38.3k| copy_mem(out, m_buf.data() + m_offset, got); 395| 38.3k| m_offset += got; 396| 38.3k| return got; 397| 38.3k| } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_115DataSource_Span4peekEPhmm: 399| 77.3k| size_t peek(uint8_t out[], size_t length, size_t peek_offset) const override { 400| 77.3k| if(peek_offset >= m_buf.size() - m_offset) { ------------------ | Branch (400:13): [True: 4, False: 77.3k] ------------------ 401| 4| return 0; 402| 4| } 403| 77.3k| const size_t got = std::min(m_buf.size() - m_offset - peek_offset, length); 404| 77.3k| copy_mem(out, m_buf.data() + m_offset + peek_offset, got); 405| 77.3k| return got; 406| 77.3k| } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_116BerDecodedLength12field_lengthEv: 119| 12.5k| size_t field_length() const { return m_field_length; } ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObjectC2EONS_10BER_ObjectE: 379| 195k| explicit DataSource_BERObject(BER_Object&& obj) : m_obj(std::move(obj)) {} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObject4readEPhm: 349| 4.28M| size_t read(uint8_t out[], size_t length) override { 350| 4.28M| BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length()); ------------------ | | 77| 4.28M| do { \ | | 78| 4.28M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 4.28M| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 4.28M] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 4.28M| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 4.28M] | | ------------------ ------------------ 351| 4.28M| const size_t got = std::min(m_obj.length() - m_offset, length); 352| 4.28M| copy_mem(out, m_obj.bits() + m_offset, got); 353| 4.28M| m_offset += got; 354| 4.28M| return got; 355| 4.28M| } ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObject15check_availableEm: 370| 302k| bool check_available(size_t n) override { 371| 302k| BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length()); ------------------ | | 77| 302k| do { \ | | 78| 302k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 302k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 302k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 302k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 302k] | | ------------------ ------------------ 372| 302k| return (n <= (m_obj.length() - m_offset)); 373| 302k| } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject11end_of_dataEv: 375| 270k| bool end_of_data() const override { return get_bytes_read() == m_obj.length(); } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject14get_bytes_readEv: 377| 270k| size_t get_bytes_read() const override { return m_offset; } ber_dec.cpp:_ZN5Botan12_GLOBAL__N_125asn1_decode_binary_stringINS_16secure_allocatorIhEEEEvRNSt3__16vectorIhT_EERKNS_10BER_ObjectENS_9ASN1_TypeESC_NS_10ASN1_ClassERKNS_11BER_Decoder6LimitsE: 927| 12.4k| const BER_Decoder::Limits& limits) { 928| | // DER requires BIT STRING and OCTET STRING to use primitive encoding; 929| | // in BER the constructed (fragmented) form is decoded by concatenation 930| 12.4k| if(is_constructed(obj)) { ------------------ | Branch (930:7): [True: 0, False: 12.4k] ------------------ 931| 0| obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed); 932| | 933| 0| if(limits.require_der_encoding()) { ------------------ | Branch (933:10): [True: 0, False: 0] ------------------ 934| 0| throw BER_Decoding_Error("Detected constructed string encoding in DER structure"); 935| 0| } 936| | 937| | // Concatenate into a temporary so a failed decode leaves buffer unmodified 938| 0| std::vector concat; 939| 0| concat.reserve(obj.length()); // upper possible bound on the output size 940| 0| if(real_type == ASN1_Type::OctetString) { ------------------ | Branch (940:10): [True: 0, False: 0] ------------------ 941| 0| asn1_concat_constructed_octet_string(concat, obj, limits, 0); 942| 0| } else { 943| 0| asn1_concat_constructed_bit_string(concat, obj, limits, 0); 944| 0| } 945| 0| buffer = std::move(concat); 946| 0| return; 947| 0| } 948| | 949| 12.4k| obj.assert_is_a(type_tag, class_tag); 950| | 951| 12.4k| if(real_type == ASN1_Type::OctetString) { ------------------ | Branch (951:7): [True: 12.4k, False: 0] ------------------ 952| 12.4k| buffer.assign(obj.bits(), obj.bits() + obj.length()); 953| 12.4k| } else { 954| 0| if(obj.length() == 0) { ------------------ | Branch (954:10): [True: 0, False: 0] ------------------ 955| 0| throw BER_Decoding_Error("Invalid BIT STRING"); 956| 0| } 957| | 958| 0| const uint8_t unused_bits = obj.bits()[0]; 959| | 960| 0| if(unused_bits >= 8) { ------------------ | Branch (960:10): [True: 0, False: 0] ------------------ 961| 0| throw BER_Decoding_Error("Bad number of unused bits in BIT STRING"); 962| 0| } 963| | 964| | // Empty BIT STRING with unused bits > 0 ... 965| 0| if(unused_bits > 0 && obj.length() < 2) { ------------------ | Branch (965:10): [True: 0, False: 0] | Branch (965:29): [True: 0, False: 0] ------------------ 966| 0| throw BER_Decoding_Error("Invalid BIT STRING"); 967| 0| } 968| | 969| | // DER requires unused bits in BIT STRING to be zero (X.690 section 11.2.2) 970| 0| if(limits.require_der_encoding() && unused_bits > 0) { ------------------ | Branch (970:10): [True: 0, False: 0] | Branch (970:43): [True: 0, False: 0] ------------------ 971| 0| const uint8_t last_byte = obj.bits()[obj.length() - 1]; 972| 0| if((last_byte & ((1 << unused_bits) - 1)) != 0) { ------------------ | Branch (972:13): [True: 0, False: 0] ------------------ 973| 0| throw BER_Decoding_Error("Detected non-zero padding bits in BIT STRING in DER structure"); 974| 0| } 975| 0| } 976| | 977| 0| buffer.resize(obj.length() - 1); 978| | 979| 0| if(obj.length() > 1) { ------------------ | Branch (979:10): [True: 0, False: 0] ------------------ 980| 0| copy_mem(buffer.data(), obj.bits() + 1, obj.length() - 1); 981| 0| } 982| 0| } 983| 12.4k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_125asn1_decode_binary_stringINSt3__19allocatorIhEEEEvRNS2_6vectorIhT_EERKNS_10BER_ObjectENS_9ASN1_TypeESC_NS_10ASN1_ClassERKNS_11BER_Decoder6LimitsE: 927| 37.4k| const BER_Decoder::Limits& limits) { 928| | // DER requires BIT STRING and OCTET STRING to use primitive encoding; 929| | // in BER the constructed (fragmented) form is decoded by concatenation 930| 37.4k| if(is_constructed(obj)) { ------------------ | Branch (930:7): [True: 0, False: 37.4k] ------------------ 931| 0| obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed); 932| | 933| 0| if(limits.require_der_encoding()) { ------------------ | Branch (933:10): [True: 0, False: 0] ------------------ 934| 0| throw BER_Decoding_Error("Detected constructed string encoding in DER structure"); 935| 0| } 936| | 937| | // Concatenate into a temporary so a failed decode leaves buffer unmodified 938| 0| std::vector concat; 939| 0| concat.reserve(obj.length()); // upper possible bound on the output size 940| 0| if(real_type == ASN1_Type::OctetString) { ------------------ | Branch (940:10): [True: 0, False: 0] ------------------ 941| 0| asn1_concat_constructed_octet_string(concat, obj, limits, 0); 942| 0| } else { 943| 0| asn1_concat_constructed_bit_string(concat, obj, limits, 0); 944| 0| } 945| 0| buffer = std::move(concat); 946| 0| return; 947| 0| } 948| | 949| 37.4k| obj.assert_is_a(type_tag, class_tag); 950| | 951| 37.4k| if(real_type == ASN1_Type::OctetString) { ------------------ | Branch (951:7): [True: 37.4k, False: 0] ------------------ 952| 37.4k| buffer.assign(obj.bits(), obj.bits() + obj.length()); 953| 37.4k| } else { 954| 0| if(obj.length() == 0) { ------------------ | Branch (954:10): [True: 0, False: 0] ------------------ 955| 0| throw BER_Decoding_Error("Invalid BIT STRING"); 956| 0| } 957| | 958| 0| const uint8_t unused_bits = obj.bits()[0]; 959| | 960| 0| if(unused_bits >= 8) { ------------------ | Branch (960:10): [True: 0, False: 0] ------------------ 961| 0| throw BER_Decoding_Error("Bad number of unused bits in BIT STRING"); 962| 0| } 963| | 964| | // Empty BIT STRING with unused bits > 0 ... 965| 0| if(unused_bits > 0 && obj.length() < 2) { ------------------ | Branch (965:10): [True: 0, False: 0] | Branch (965:29): [True: 0, False: 0] ------------------ 966| 0| throw BER_Decoding_Error("Invalid BIT STRING"); 967| 0| } 968| | 969| | // DER requires unused bits in BIT STRING to be zero (X.690 section 11.2.2) 970| 0| if(limits.require_der_encoding() && unused_bits > 0) { ------------------ | Branch (970:10): [True: 0, False: 0] | Branch (970:43): [True: 0, False: 0] ------------------ 971| 0| const uint8_t last_byte = obj.bits()[obj.length() - 1]; 972| 0| if((last_byte & ((1 << unused_bits) - 1)) != 0) { ------------------ | Branch (972:13): [True: 0, False: 0] ------------------ 973| 0| throw BER_Decoding_Error("Detected non-zero padding bits in BIT STRING in DER structure"); 974| 0| } 975| 0| } 976| | 977| 0| buffer.resize(obj.length() - 1); 978| | 979| 0| if(obj.length() > 1) { ------------------ | Branch (979:10): [True: 0, False: 0] ------------------ 980| 0| copy_mem(buffer.data(), obj.bits() + 1, obj.length() - 1); 981| 0| } 982| 0| } 983| 37.4k|} _ZN5Botan4ASN119der_sequence_headerEm: 71| 18.7k|std::vector der_sequence_header(size_t contents_len) { 72| 18.7k| std::vector header; 73| 18.7k| header.reserve(2 + sizeof(contents_len)); 74| 18.7k| encode_tag(header, ASN1_Type::Sequence, ASN1_Class::Constructed); 75| 18.7k| encode_length(header, contents_len); 76| 18.7k| return header; 77| 18.7k|} _ZN5Botan11DER_EncoderC2ERNSt3__16vectorIhNS1_9allocatorIhEEEE: 89| 64.7k|DER_Encoder::DER_Encoder(std::vector& vec) { 90| 64.7k| m_append_output = [&vec](const uint8_t b[], size_t l) { 91| 64.7k| if(l > 0) { 92| 64.7k| vec.insert(vec.end(), b, b + l); 93| 64.7k| } 94| 64.7k| }; 95| 64.7k|} _ZN5Botan11DER_Encoder12DER_Sequence13push_contentsERS0_: 100| 91.2k|void DER_Encoder::DER_Sequence::push_contents(DER_Encoder& der) { 101| 91.2k| const auto real_class_tag = m_class_tag | ASN1_Class::Constructed; 102| | 103| 91.2k| if(m_sort_contents) { ------------------ | Branch (103:7): [True: 0, False: 91.2k] ------------------ 104| 0| std::sort(m_set_contents.begin(), m_set_contents.end()); 105| 0| for(const auto& set_elem : m_set_contents) { ------------------ | Branch (105:32): [True: 0, False: 0] ------------------ 106| 0| m_contents += set_elem; 107| 0| } 108| 0| m_set_contents.clear(); 109| 0| } 110| | 111| 91.2k| der.add_object(m_type_tag, real_class_tag, m_contents.data(), m_contents.size()); 112| 91.2k| m_contents.clear(); 113| 91.2k|} _ZN5Botan11DER_Encoder12DER_Sequence9add_bytesEPKhm: 118| 43.5k|void DER_Encoder::DER_Sequence::add_bytes(const uint8_t data[], size_t length) { 119| 43.5k| if(m_sort_contents) { ------------------ | Branch (119:7): [True: 0, False: 43.5k] ------------------ 120| 0| if(length > 0) { ------------------ | Branch (120:10): [True: 0, False: 0] ------------------ 121| 0| m_set_contents.emplace_back(data, data + length); 122| 0| } else { 123| 0| m_set_contents.emplace_back(); 124| 0| } 125| 43.5k| } else { 126| 43.5k| m_contents += std::make_pair(data, length); 127| 43.5k| } 128| 43.5k|} _ZN5Botan11DER_Encoder12DER_Sequence9add_bytesEPKhmS3_m: 130| 118k|void DER_Encoder::DER_Sequence::add_bytes(const uint8_t hdr[], size_t hdr_len, const uint8_t val[], size_t val_len) { 131| 118k| if(m_sort_contents) { ------------------ | Branch (131:7): [True: 0, False: 118k] ------------------ 132| 0| secure_vector m; 133| 0| m.reserve(hdr_len + val_len); 134| 0| m += std::make_pair(hdr, hdr_len); 135| 0| m += std::make_pair(val, val_len); 136| 0| m_set_contents.push_back(std::move(m)); 137| 118k| } else { 138| 118k| m_contents += std::make_pair(hdr, hdr_len); 139| 118k| m_contents += std::make_pair(val, val_len); 140| 118k| } 141| 118k|} _ZN5Botan11DER_Encoder12DER_SequenceC2ENS_9ASN1_TypeENS_10ASN1_ClassEb: 154| 91.2k| m_type_tag(type_tag), 155| 91.2k| m_class_tag(class_tag), 156| 91.2k| m_sort_contents(sort_contents || (type_tag == ASN1_Type::Set && class_tag == ASN1_Class::Universal)) {} ------------------ | Branch (156:23): [True: 0, False: 91.2k] | Branch (156:41): [True: 0, False: 91.2k] | Branch (156:71): [True: 0, False: 0] ------------------ _ZN5Botan11DER_Encoder10start_consENS_9ASN1_TypeENS_10ASN1_ClassE: 192| 91.2k|DER_Encoder& DER_Encoder::start_cons(ASN1_Type type_tag, ASN1_Class class_tag) { 193| 91.2k| return start_cons(type_tag, class_tag, false); 194| 91.2k|} _ZN5Botan11DER_Encoder10start_consENS_9ASN1_TypeENS_10ASN1_ClassEb: 200| 91.2k|DER_Encoder& DER_Encoder::start_cons(ASN1_Type type_tag, ASN1_Class class_tag, bool sort_contents) { 201| 91.2k| m_subsequences.push_back(DER_Sequence(type_tag, class_tag, sort_contents)); 202| 91.2k| return (*this); 203| 91.2k|} _ZN5Botan11DER_Encoder8end_consEv: 208| 91.2k|DER_Encoder& DER_Encoder::end_cons() { 209| 91.2k| if(m_subsequences.empty()) { ------------------ | Branch (209:7): [True: 0, False: 91.2k] ------------------ 210| 0| throw Invalid_State("DER_Encoder::end_cons: No such sequence"); 211| 0| } 212| | 213| 91.2k| DER_Sequence last_seq = std::move(m_subsequences[m_subsequences.size() - 1]); 214| 91.2k| m_subsequences.pop_back(); 215| 91.2k| last_seq.push_contents(*this); 216| | 217| 91.2k| return (*this); 218| 91.2k|} _ZN5Botan11DER_Encoder9raw_bytesEPKhm: 237| 43.5k|DER_Encoder& DER_Encoder::raw_bytes(const uint8_t bytes[], size_t length) { 238| 43.5k| if(!m_subsequences.empty()) { ------------------ | Branch (238:7): [True: 43.5k, False: 0] ------------------ 239| 43.5k| m_subsequences[m_subsequences.size() - 1].add_bytes(bytes, length); 240| 43.5k| } else if(m_append_output) { ------------------ | Branch (240:14): [True: 0, False: 0] ------------------ 241| 0| m_append_output(bytes, length); 242| 0| } else { 243| 0| m_default_outbuf += std::make_pair(bytes, length); 244| 0| } 245| | 246| 43.5k| return (*this); 247| 43.5k|} _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassEPKhm: 285| 183k|DER_Encoder& DER_Encoder::add_object(ASN1_Type type_tag, ASN1_Class class_tag, const uint8_t rep[], size_t length) { 286| 183k| std::vector hdr; 287| 183k| encode_tag(hdr, type_tag, class_tag); 288| 183k| encode_length(hdr, length); 289| | 290| 183k| if(!m_subsequences.empty()) { ------------------ | Branch (290:7): [True: 118k, False: 64.7k] ------------------ 291| 118k| m_subsequences[m_subsequences.size() - 1].add_bytes(hdr.data(), hdr.size(), rep, length); 292| 118k| } else if(m_append_output) { ------------------ | Branch (292:14): [True: 64.7k, False: 0] ------------------ 293| 64.7k| m_append_output(hdr.data(), hdr.size()); 294| 64.7k| m_append_output(rep, length); 295| 64.7k| } else { 296| 0| m_default_outbuf += hdr; 297| 0| m_default_outbuf += std::make_pair(rep, length); 298| 0| } 299| | 300| 183k| return (*this); 301| 183k|} _ZN5Botan11DER_Encoder6encodeEm: 320| 10.3k|DER_Encoder& DER_Encoder::encode(size_t n) { 321| 10.3k| return encode(BigInt::from_u64(n), ASN1_Type::Integer, ASN1_Class::Universal); 322| 10.3k|} _ZN5Botan4ASN116integer_contentsERKNS_6BigIntE: 356| 16.6k|std::vector ASN1::integer_contents(const BigInt& n) { 357| 16.6k| if(n == 0) { ------------------ | Branch (357:7): [True: 1, False: 16.6k] ------------------ 358| 1| return {0x00}; 359| 1| } 360| | 361| | // Serialize magnitude with one extra leading byte 362| 16.6k| auto contents = n.serialize(n.bytes() + 1); 363| | 364| 16.6k| if(n.signum() < 0) { ------------------ | Branch (364:7): [True: 23, False: 16.6k] ------------------ 365| | // Two's complement: bitwise NOT then increment 366| 115| for(auto& byte : contents) { ------------------ | Branch (366:22): [True: 115, False: 23] ------------------ 367| 115| byte = ~byte; 368| 115| } 369| 49| for(size_t i = contents.size(); i > 0; --i) { ------------------ | Branch (369:39): [True: 49, False: 0] ------------------ 370| 49| if(++contents[i - 1] != 0) { ------------------ | Branch (370:13): [True: 23, False: 26] ------------------ 371| 23| break; 372| 23| } 373| 49| } 374| 23| } 375| | 376| | /* 377| | * DER requires the leading byte be emitted only if it required 378| | */ 379| 16.6k| BOTAN_ASSERT_NOMSG(contents.size() >= 2); ------------------ | | 77| 16.6k| do { \ | | 78| 16.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 16.6k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 16.6k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 16.6k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 16.6k] | | ------------------ ------------------ 380| 16.6k| const bool leading_byte_redundant = 381| 16.6k| (contents[0] == 0x00 && (contents[1] & 0x80) == 0) || (contents[0] == 0xFF && (contents[1] & 0x80) != 0); ------------------ | Branch (381:8): [True: 16.6k, False: 23] | Branch (381:31): [True: 10.3k, False: 6.25k] | Branch (381:62): [True: 23, False: 6.25k] | Branch (381:85): [True: 15, False: 8] ------------------ 382| | 383| 16.6k| if(leading_byte_redundant) { ------------------ | Branch (383:7): [True: 10.3k, False: 6.26k] ------------------ 384| 10.3k| contents.erase(contents.begin()); 385| 10.3k| } 386| 16.6k| return contents; 387| 16.6k|} _ZN5Botan11DER_Encoder6encodeERKNS_6BigIntENS_9ASN1_TypeENS_10ASN1_ClassE: 389| 10.3k|DER_Encoder& DER_Encoder::encode(const BigInt& n, ASN1_Type type_tag, ASN1_Class class_tag) { 390| 10.3k| return add_object(type_tag, class_tag, ASN1::integer_contents(n)); 391| 10.3k|} _ZN5Botan11DER_Encoder16encode_bitstringENSt3__14spanIKhLm18446744073709551615EEEmNS_9ASN1_TypeENS_10ASN1_ClassE: 414| 6.25k| ASN1_Class class_tag) { 415| 6.25k| if(unused_bits >= 8) { ------------------ | Branch (415:7): [True: 0, False: 6.25k] ------------------ 416| 0| throw Invalid_Argument("DER_Encoder: Invalid unused bit count for BIT STRING"); 417| 0| } 418| | 419| 6.25k| if(bits.empty() && unused_bits != 0) { ------------------ | Branch (419:7): [True: 0, False: 6.25k] | Branch (419:23): [True: 0, False: 0] ------------------ 420| 0| throw Invalid_Argument("DER_Encoder: Empty BIT STRING cannot have unused bits"); 421| 0| } 422| | 423| 6.25k| if(unused_bits > 0 && (bits.back() & ((1U << unused_bits) - 1)) != 0) { ------------------ | Branch (423:7): [True: 0, False: 6.25k] | Branch (423:26): [True: 0, False: 0] ------------------ 424| 0| throw Invalid_Argument("DER_Encoder: BIT STRING unused bits must be zero"); 425| 0| } 426| | 427| 6.25k| secure_vector encoded; 428| 6.25k| encoded.reserve(1 + bits.size()); 429| 6.25k| encoded.push_back(static_cast(unused_bits)); 430| 6.25k| encoded.insert(encoded.end(), bits.begin(), bits.end()); 431| 6.25k| return add_object(type_tag, class_tag, encoded); 432| 6.25k|} _ZN5Botan11DER_Encoder6encodeERKNS_11ASN1_ObjectE: 467| 74.6k|DER_Encoder& DER_Encoder::encode(const ASN1_Object& obj) { 468| 74.6k| obj.encode_into(*this); 469| 74.6k| return (*this); 470| 74.6k|} der_enc.cpp:_ZN5Botan12_GLOBAL__N_110encode_tagERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeENS_10ASN1_ClassE: 26| 201k|void encode_tag(std::vector& encoded_tag, ASN1_Type type_tag_e, ASN1_Class class_tag_e) { 27| 201k| const uint32_t type_tag = static_cast(type_tag_e); 28| 201k| const uint32_t class_tag = static_cast(class_tag_e); 29| | 30| 201k| if((class_tag | 0xE0) != 0xE0) { ------------------ | Branch (30:7): [True: 0, False: 201k] ------------------ 31| 0| throw Encoding_Error(fmt("DER_Encoder: Invalid class tag {}", std::to_string(class_tag))); 32| 0| } 33| | 34| 201k| if(type_tag <= 30) { ------------------ | Branch (34:7): [True: 201k, False: 0] ------------------ 35| 201k| encoded_tag.push_back(static_cast(type_tag | class_tag)); 36| 201k| } else { 37| 0| size_t blocks = high_bit(static_cast(type_tag)) + 6; 38| 0| blocks = (blocks - (blocks % 7)) / 7; 39| | 40| 0| BOTAN_ASSERT_NOMSG(blocks > 0); ------------------ | | 77| 0| do { \ | | 78| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 0| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 0| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 0] | | ------------------ ------------------ 41| | 42| 0| encoded_tag.push_back(static_cast(class_tag | 0x1F)); 43| 0| for(size_t i = 0; i != blocks - 1; ++i) { ------------------ | Branch (43:25): [True: 0, False: 0] ------------------ 44| 0| encoded_tag.push_back(0x80 | ((type_tag >> 7 * (blocks - i - 1)) & 0x7F)); 45| 0| } 46| 0| encoded_tag.push_back(type_tag & 0x7F); 47| 0| } 48| 201k|} der_enc.cpp:_ZN5Botan12_GLOBAL__N_113encode_lengthERNSt3__16vectorIhNS1_9allocatorIhEEEEm: 53| 201k|void encode_length(std::vector& encoded_length, size_t length) { 54| 201k| if(length <= 127) { ------------------ | Branch (54:7): [True: 189k, False: 12.5k] ------------------ 55| 189k| encoded_length.push_back(static_cast(length)); 56| 189k| } else { 57| 12.5k| const size_t bytes_needed = significant_bytes(length); 58| | 59| 12.5k| encoded_length.push_back(static_cast(0x80 | bytes_needed)); 60| | 61| 37.5k| for(size_t i = sizeof(length) - bytes_needed; i < sizeof(length); ++i) { ------------------ | Branch (61:53): [True: 25.0k, False: 12.5k] ------------------ 62| 25.0k| encoded_length.push_back(get_byte_var(i, length)); 63| 25.0k| } 64| 12.5k| } 65| 201k|} der_enc.cpp:_ZZN5Botan11DER_EncoderC1ERNSt3__16vectorIhNS1_9allocatorIhEEEEENK3$_0clEPKhm: 90| 129k| m_append_output = [&vec](const uint8_t b[], size_t l) { 91| 129k| if(l > 0) { ------------------ | Branch (91:10): [True: 129k, False: 0] ------------------ 92| 129k| vec.insert(vec.end(), b, b + l); 93| 129k| } 94| 129k| }; _ZN5Botan7OID_MapC2Ev: 11| 1|OID_Map::OID_Map() { 12| 1| m_str2oid = OID_Map::load_str2oid_map(); 13| 1| m_oid2str = OID_Map::load_oid2str_map(); 14| 1|} _ZN5Botan7OID_Map15global_registryEv: 16| 61.9k|OID_Map& OID_Map::global_registry() { 17| 61.9k| static OID_Map g_map; 18| 61.9k| return g_map; 19| 61.9k|} _ZN5Botan7OID_Map7oid2strERKNS_3OIDE: 73| 12.5k|std::optional OID_Map::oid2str(const OID& oid) { 74| 12.5k| if(auto name = lookup_static_oid(oid)) { ------------------ | Branch (74:12): [True: 12.5k, False: 0] ------------------ 75| 12.5k| return std::string(*name); 76| 12.5k| } 77| | 78| 0| const lock_guard_type lock(m_mutex); 79| | 80| 0| auto i = m_oid2str.find(oid); 81| 0| if(i != m_oid2str.end()) { ------------------ | Branch (81:7): [True: 0, False: 0] ------------------ 82| 0| return i->second; 83| 0| } 84| | 85| 0| return {}; 86| 0|} _ZN5Botan7OID_Map7str2oidENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 88| 49.4k|OID OID_Map::str2oid(std::string_view str) { 89| 49.4k| if(auto oid = lookup_static_oid_name(str)) { ------------------ | Branch (89:12): [True: 49.4k, False: 0] ------------------ 90| 49.4k| return std::move(*oid); 91| 49.4k| } 92| | 93| 0| const lock_guard_type lock(m_mutex); 94| 0| auto i = m_str2oid.find(std::string(str)); 95| 0| if(i != m_str2oid.end()) { ------------------ | Branch (95:7): [True: 0, False: 0] ------------------ 96| 0| return i->second; 97| 0| } 98| | 99| 0| return OID(); 100| 0|} _ZN5Botan10PSS_ParamsC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEm: 33| 10.3k| m_hash(hash_fn, AlgorithmIdentifier::USE_NULL_PARAM), 34| 10.3k| m_mgf("MGF1", m_hash.BER_encode()), 35| 10.3k| m_mgf_hash(m_hash), 36| 10.3k| m_salt_len(salt_len), 37| 10.3k| m_trailer_field(1) {} _ZNK5Botan10PSS_Params9serializeEv: 45| 10.3k|std::vector PSS_Params::serialize() const { 46| 10.3k| std::vector output; 47| 10.3k| DER_Encoder(output).encode(*this); 48| 10.3k| return output; 49| 10.3k|} _ZNK5Botan10PSS_Params11encode_intoERNS_11DER_EncoderE: 51| 10.3k|void PSS_Params::encode_into(DER_Encoder& to) const { 52| 10.3k| to.start_sequence() 53| 10.3k| .start_context_specific(0) 54| 10.3k| .encode(m_hash) 55| 10.3k| .end_cons() 56| 10.3k| .start_context_specific(1) 57| 10.3k| .encode(m_mgf) 58| 10.3k| .end_cons() 59| 10.3k| .start_context_specific(2) 60| 10.3k| .encode(m_salt_len) 61| 10.3k| .end_cons() 62| 10.3k| .end_cons(); 63| 10.3k|} _ZN5Botan7OID_Map17lookup_static_oidERKNS_3OIDE: 48| 12.5k|std::optional OID_Map::lookup_static_oid(const OID& oid) { 49| 12.5k| const uint32_t hc = static_cast(oid.hash_code() % 858701); 50| | 51| 12.5k| switch(hc) { 52| 0| case 0x01506: ------------------ | Branch (52:7): [True: 0, False: 12.5k] ------------------ 53| 0| return if_match(oid, {1, 2, 840, 10045, 4, 3, 1}, "ECDSA/SHA-224"); 54| 0| case 0x01507: ------------------ | Branch (54:7): [True: 0, False: 12.5k] ------------------ 55| 0| return if_match(oid, {1, 2, 840, 10045, 4, 3, 2}, "ECDSA/SHA-256"); 56| 0| case 0x01508: ------------------ | Branch (56:7): [True: 0, False: 12.5k] ------------------ 57| 0| return if_match(oid, {1, 2, 840, 10045, 4, 3, 3}, "ECDSA/SHA-384"); 58| 0| case 0x01509: ------------------ | Branch (58:7): [True: 0, False: 12.5k] ------------------ 59| 0| return if_match(oid, {1, 2, 840, 10045, 4, 3, 4}, "ECDSA/SHA-512"); 60| 0| case 0x04C1E: ------------------ | Branch (60:7): [True: 0, False: 12.5k] ------------------ 61| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 3029, 1, 2, 1}, "ElGamal"); 62| 0| case 0x04E61: ------------------ | Branch (62:7): [True: 0, False: 12.5k] ------------------ 63| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 3029, 1, 5, 1}, "OpenPGP.Curve25519"); 64| 0| case 0x0779B: ------------------ | Branch (64:7): [True: 0, False: 12.5k] ------------------ 65| 0| return if_match(oid, {1, 2, 840, 113549, 2, 5}, "MD5"); 66| 0| case 0x0779D: ------------------ | Branch (66:7): [True: 0, False: 12.5k] ------------------ 67| 0| return if_match(oid, {1, 2, 840, 113549, 2, 7}, "HMAC(SHA-1)"); 68| 0| case 0x0779E: ------------------ | Branch (68:7): [True: 0, False: 12.5k] ------------------ 69| 0| return if_match(oid, {1, 2, 840, 113549, 2, 8}, "HMAC(SHA-224)"); 70| 0| case 0x0779F: ------------------ | Branch (70:7): [True: 0, False: 12.5k] ------------------ 71| 0| return if_match(oid, {1, 2, 840, 113549, 2, 9}, "HMAC(SHA-256)"); 72| 0| case 0x077A0: ------------------ | Branch (72:7): [True: 0, False: 12.5k] ------------------ 73| 0| return if_match(oid, {1, 2, 840, 113549, 2, 10}, "HMAC(SHA-384)"); 74| 0| case 0x077A1: ------------------ | Branch (74:7): [True: 0, False: 12.5k] ------------------ 75| 0| return if_match(oid, {1, 2, 840, 113549, 2, 11}, "HMAC(SHA-512)"); 76| 0| case 0x077A3: ------------------ | Branch (76:7): [True: 0, False: 12.5k] ------------------ 77| 0| return if_match(oid, {1, 2, 840, 113549, 2, 13}, "HMAC(SHA-512-256)"); 78| 0| case 0x0785E: ------------------ | Branch (78:7): [True: 0, False: 12.5k] ------------------ 79| 0| return if_match(oid, {1, 2, 840, 113549, 3, 7}, "TripleDES/CBC"); 80| 0| case 0x0C904: ------------------ | Branch (80:7): [True: 0, False: 12.5k] ------------------ 81| 0| return if_match(oid, {1, 0, 14888, 3, 0, 5}, "ECKCDSA"); 82| 0| case 0x11547: ------------------ | Branch (82:7): [True: 0, False: 12.5k] ------------------ 83| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1}, "SphincsPlus-shake-128s-r3.1"); 84| 0| case 0x11548: ------------------ | Branch (84:7): [True: 0, False: 12.5k] ------------------ 85| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2}, "SphincsPlus-shake-128f-r3.1"); 86| 0| case 0x11549: ------------------ | Branch (86:7): [True: 0, False: 12.5k] ------------------ 87| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3}, "SphincsPlus-shake-192s-r3.1"); 88| 0| case 0x1154A: ------------------ | Branch (88:7): [True: 0, False: 12.5k] ------------------ 89| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4}, "SphincsPlus-shake-192f-r3.1"); 90| 0| case 0x1154B: ------------------ | Branch (90:7): [True: 0, False: 12.5k] ------------------ 91| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5}, "SphincsPlus-shake-256s-r3.1"); 92| 0| case 0x1154C: ------------------ | Branch (92:7): [True: 0, False: 12.5k] ------------------ 93| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6}, "SphincsPlus-shake-256f-r3.1"); 94| 0| case 0x11608: ------------------ | Branch (94:7): [True: 0, False: 12.5k] ------------------ 95| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1}, "SphincsPlus-sha2-128s-r3.1"); 96| 0| case 0x11609: ------------------ | Branch (96:7): [True: 0, False: 12.5k] ------------------ 97| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2}, "SphincsPlus-sha2-128f-r3.1"); 98| 0| case 0x1160A: ------------------ | Branch (98:7): [True: 0, False: 12.5k] ------------------ 99| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3}, "SphincsPlus-sha2-192s-r3.1"); 100| 0| case 0x1160B: ------------------ | Branch (100:7): [True: 0, False: 12.5k] ------------------ 101| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4}, "SphincsPlus-sha2-192f-r3.1"); 102| 0| case 0x1160C: ------------------ | Branch (102:7): [True: 0, False: 12.5k] ------------------ 103| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5}, "SphincsPlus-sha2-256s-r3.1"); 104| 0| case 0x1160D: ------------------ | Branch (104:7): [True: 0, False: 12.5k] ------------------ 105| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6}, "SphincsPlus-sha2-256f-r3.1"); 106| 0| case 0x116C9: ------------------ | Branch (106:7): [True: 0, False: 12.5k] ------------------ 107| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1}, "SphincsPlus-haraka-128s-r3.1"); 108| 0| case 0x116CA: ------------------ | Branch (108:7): [True: 0, False: 12.5k] ------------------ 109| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2}, "SphincsPlus-haraka-128f-r3.1"); 110| 0| case 0x116CB: ------------------ | Branch (110:7): [True: 0, False: 12.5k] ------------------ 111| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3}, "SphincsPlus-haraka-192s-r3.1"); 112| 0| case 0x116CC: ------------------ | Branch (112:7): [True: 0, False: 12.5k] ------------------ 113| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4}, "SphincsPlus-haraka-192f-r3.1"); 114| 0| case 0x116CD: ------------------ | Branch (114:7): [True: 0, False: 12.5k] ------------------ 115| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5}, "SphincsPlus-haraka-256s-r3.1"); 116| 0| case 0x116CE: ------------------ | Branch (116:7): [True: 0, False: 12.5k] ------------------ 117| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6}, "SphincsPlus-haraka-256f-r3.1"); 118| 0| case 0x1533B: ------------------ | Branch (118:7): [True: 0, False: 12.5k] ------------------ 119| 0| return if_match(oid, {1, 2, 156, 10197, 1, 104, 2}, "SM4/CBC"); 120| 0| case 0x15341: ------------------ | Branch (120:7): [True: 0, False: 12.5k] ------------------ 121| 0| return if_match(oid, {1, 2, 156, 10197, 1, 104, 8}, "SM4/GCM"); 122| 0| case 0x1539D: ------------------ | Branch (122:7): [True: 0, False: 12.5k] ------------------ 123| 0| return if_match(oid, {1, 2, 156, 10197, 1, 104, 100}, "SM4/OCB"); 124| 0| case 0x187D7: ------------------ | Branch (124:7): [True: 0, False: 12.5k] ------------------ 125| 0| return if_match(oid, {1, 3, 14, 3, 2, 7}, "DES/CBC"); 126| 0| case 0x187EA: ------------------ | Branch (126:7): [True: 0, False: 12.5k] ------------------ 127| 0| return if_match(oid, {1, 3, 14, 3, 2, 26}, "SHA-1"); 128| 0| case 0x19933: ------------------ | Branch (128:7): [True: 0, False: 12.5k] ------------------ 129| 0| return if_match(oid, {1, 3, 132, 0, 8}, "secp160r1"); 130| 0| case 0x19934: ------------------ | Branch (130:7): [True: 0, False: 12.5k] ------------------ 131| 0| return if_match(oid, {1, 3, 132, 0, 9}, "secp160k1"); 132| 0| case 0x19935: ------------------ | Branch (132:7): [True: 0, False: 12.5k] ------------------ 133| 0| return if_match(oid, {1, 3, 132, 0, 10}, "secp256k1"); 134| 0| case 0x19949: ------------------ | Branch (134:7): [True: 0, False: 12.5k] ------------------ 135| 0| return if_match(oid, {1, 3, 132, 0, 30}, "secp160r2"); 136| 0| case 0x1994A: ------------------ | Branch (136:7): [True: 0, False: 12.5k] ------------------ 137| 0| return if_match(oid, {1, 3, 132, 0, 31}, "secp192k1"); 138| 0| case 0x1994B: ------------------ | Branch (138:7): [True: 0, False: 12.5k] ------------------ 139| 0| return if_match(oid, {1, 3, 132, 0, 32}, "secp224k1"); 140| 0| case 0x1994C: ------------------ | Branch (140:7): [True: 0, False: 12.5k] ------------------ 141| 0| return if_match(oid, {1, 3, 132, 0, 33}, "secp224r1"); 142| 1| case 0x1994D: ------------------ | Branch (142:7): [True: 1, False: 12.5k] ------------------ 143| 1| return if_match(oid, {1, 3, 132, 0, 34}, "secp384r1"); 144| 1| case 0x1994E: ------------------ | Branch (144:7): [True: 1, False: 12.5k] ------------------ 145| 1| return if_match(oid, {1, 3, 132, 0, 35}, "secp521r1"); 146| 0| case 0x199F8: ------------------ | Branch (146:7): [True: 0, False: 12.5k] ------------------ 147| 0| return if_match(oid, {1, 3, 132, 1, 12}, "ECDH"); 148| 0| case 0x1E7BF: ------------------ | Branch (148:7): [True: 0, False: 12.5k] ------------------ 149| 0| return if_match(oid, {1, 2, 156, 10197, 1, 301, 1}, "SM2"); 150| 0| case 0x1E7C0: ------------------ | Branch (150:7): [True: 0, False: 12.5k] ------------------ 151| 0| return if_match(oid, {1, 2, 156, 10197, 1, 301, 2}, "SM2_Kex"); 152| 0| case 0x1E7C1: ------------------ | Branch (152:7): [True: 0, False: 12.5k] ------------------ 153| 0| return if_match(oid, {1, 2, 156, 10197, 1, 301, 3}, "SM2_Enc"); 154| 0| case 0x21960: ------------------ | Branch (154:7): [True: 0, False: 12.5k] ------------------ 155| 0| return if_match(oid, {1, 3, 36, 3, 3, 1, 2}, "RSA/PKCS1v15(RIPEMD-160)"); 156| 0| case 0x2198A: ------------------ | Branch (156:7): [True: 0, False: 12.5k] ------------------ 157| 0| return if_match(oid, {1, 2, 840, 113533, 7, 66, 10}, "CAST-128/CBC"); 158| 0| case 0x2198F: ------------------ | Branch (158:7): [True: 0, False: 12.5k] ------------------ 159| 0| return if_match(oid, {1, 2, 840, 113533, 7, 66, 15}, "KeyWrap.CAST-128"); 160| 0| case 0x227C0: ------------------ | Branch (160:7): [True: 0, False: 12.5k] ------------------ 161| 0| return if_match(oid, {1, 3, 101, 110}, "X25519"); 162| 0| case 0x227C1: ------------------ | Branch (162:7): [True: 0, False: 12.5k] ------------------ 163| 0| return if_match(oid, {1, 3, 101, 111}, "X448"); 164| 0| case 0x227C2: ------------------ | Branch (164:7): [True: 0, False: 12.5k] ------------------ 165| 0| return if_match(oid, {1, 3, 101, 112}, "Ed25519"); 166| 0| case 0x227C3: ------------------ | Branch (166:7): [True: 0, False: 12.5k] ------------------ 167| 0| return if_match(oid, {1, 3, 101, 113}, "Ed448"); 168| 0| case 0x27565: ------------------ | Branch (168:7): [True: 0, False: 12.5k] ------------------ 169| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 1}, "PKIX.OCSP.BasicResponse"); 170| 0| case 0x27566: ------------------ | Branch (170:7): [True: 0, False: 12.5k] ------------------ 171| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 2}, "PKIX.OCSP.Nonce"); 172| 0| case 0x27569: ------------------ | Branch (172:7): [True: 0, False: 12.5k] ------------------ 173| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 5}, "PKIX.OCSP.NoCheck"); 174| 0| case 0x29F7C: ------------------ | Branch (174:7): [True: 0, False: 12.5k] ------------------ 175| 0| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 3}, "ECKCDSA/SHA-1"); 176| 0| case 0x29F7D: ------------------ | Branch (176:7): [True: 0, False: 12.5k] ------------------ 177| 0| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 4}, "ECKCDSA/SHA-224"); 178| 0| case 0x29F7E: ------------------ | Branch (178:7): [True: 0, False: 12.5k] ------------------ 179| 0| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 5}, "ECKCDSA/SHA-256"); 180| 0| case 0x2AC3B: ------------------ | Branch (180:7): [True: 0, False: 12.5k] ------------------ 181| 0| return if_match(oid, {2, 5, 29, 32, 0}, "X509v3.AnyPolicy"); 182| 0| case 0x2B000: ------------------ | Branch (182:7): [True: 0, False: 12.5k] ------------------ 183| 0| return if_match(oid, {2, 5, 29, 37, 0}, "X509v3.AnyExtendedKeyUsage"); 184| 12.4k| case 0x2B5C9: ------------------ | Branch (184:7): [True: 12.4k, False: 6] ------------------ 185| 12.4k| return if_match(oid, {1, 2, 840, 10045, 2, 1}, "ECDSA"); 186| 0| case 0x2B74B: ------------------ | Branch (186:7): [True: 0, False: 12.5k] ------------------ 187| 0| return if_match(oid, {1, 2, 840, 10045, 4, 1}, "ECDSA/SHA-1"); 188| 0| case 0x3474A: ------------------ | Branch (188:7): [True: 0, False: 12.5k] ------------------ 189| 0| return if_match(oid, {1, 2, 840, 10046, 2, 1}, "DH"); 190| 0| case 0x38D6D: ------------------ | Branch (190:7): [True: 0, False: 12.5k] ------------------ 191| 0| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 1, 1}, "gost_256A"); 192| 0| case 0x38D6E: ------------------ | Branch (192:7): [True: 0, False: 12.5k] ------------------ 193| 0| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 1, 2}, "gost_256B"); 194| 0| case 0x38E2E: ------------------ | Branch (194:7): [True: 0, False: 12.5k] ------------------ 195| 0| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 2, 1}, "gost_512A"); 196| 0| case 0x38E2F: ------------------ | Branch (196:7): [True: 0, False: 12.5k] ------------------ 197| 0| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 2, 2}, "gost_512B"); 198| 0| case 0x38F2C: ------------------ | Branch (198:7): [True: 0, False: 12.5k] ------------------ 199| 0| return if_match(oid, {1, 2, 643, 2, 2, 3}, "GOST-34.10/GOST-R-34.11-94"); 200| 0| case 0x38F3C: ------------------ | Branch (200:7): [True: 0, False: 12.5k] ------------------ 201| 0| return if_match(oid, {1, 2, 643, 2, 2, 19}, "GOST-34.10"); 202| 0| case 0x3D7B8: ------------------ | Branch (202:7): [True: 0, False: 12.5k] ------------------ 203| 0| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 6}, "Camellia-128/GCM"); 204| 0| case 0x3D7CC: ------------------ | Branch (204:7): [True: 0, False: 12.5k] ------------------ 205| 0| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 26}, "Camellia-192/GCM"); 206| 0| case 0x3D7E0: ------------------ | Branch (206:7): [True: 0, False: 12.5k] ------------------ 207| 0| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 46}, "Camellia-256/GCM"); 208| 0| case 0x3F20F: ------------------ | Branch (208:7): [True: 0, False: 12.5k] ------------------ 209| 0| return if_match(oid, {1, 3, 36, 3, 2, 1}, "RIPEMD-160"); 210| 0| case 0x4266E: ------------------ | Branch (210:7): [True: 0, False: 12.5k] ------------------ 211| 0| return if_match(oid, {0, 4, 0, 127, 0, 15, 1, 1, 13, 0}, "XMSS"); 212| 0| case 0x478C4: ------------------ | Branch (212:7): [True: 0, False: 12.5k] ------------------ 213| 0| return if_match(oid, {1, 2, 410, 200004, 1, 4}, "SEED/CBC"); 214| 0| case 0x47D98: ------------------ | Branch (214:7): [True: 0, False: 12.5k] ------------------ 215| 0| return if_match(oid, {1, 2, 156, 10197, 1, 301}, "sm2p256v1"); 216| 0| case 0x47DFC: ------------------ | Branch (216:7): [True: 0, False: 12.5k] ------------------ 217| 0| return if_match(oid, {1, 2, 156, 10197, 1, 401}, "SM3"); 218| 0| case 0x47E60: ------------------ | Branch (218:7): [True: 0, False: 12.5k] ------------------ 219| 0| return if_match(oid, {1, 2, 156, 10197, 1, 501}, "SM2_Sig/SM3"); 220| 0| case 0x47E63: ------------------ | Branch (220:7): [True: 0, False: 12.5k] ------------------ 221| 0| return if_match(oid, {1, 2, 156, 10197, 1, 504}, "RSA/PKCS1v15(SM3)"); 222| 0| case 0x52B13: ------------------ | Branch (222:7): [True: 0, False: 12.5k] ------------------ 223| 0| return if_match(oid, {1, 2, 643, 3, 131, 1, 1}, "GOST.INN"); 224| 0| case 0x635AE: ------------------ | Branch (224:7): [True: 0, False: 12.5k] ------------------ 225| 0| return if_match(oid, {1, 2, 250, 1, 223, 101, 256, 1}, "frp256v1"); 226| 0| case 0x6A784: ------------------ | Branch (226:7): [True: 0, False: 12.5k] ------------------ 227| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 1}, "PKCS12.KeyBag"); 228| 0| case 0x6A785: ------------------ | Branch (228:7): [True: 0, False: 12.5k] ------------------ 229| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 2}, "PKCS12.PKCS8ShroudedKeyBag"); 230| 0| case 0x6A786: ------------------ | Branch (230:7): [True: 0, False: 12.5k] ------------------ 231| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 3}, "PKCS12.CertBag"); 232| 0| case 0x6A787: ------------------ | Branch (232:7): [True: 0, False: 12.5k] ------------------ 233| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 4}, "PKCS12.CRLBag"); 234| 0| case 0x6A788: ------------------ | Branch (234:7): [True: 0, False: 12.5k] ------------------ 235| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 5}, "PKCS12.SecretBag"); 236| 0| case 0x6A789: ------------------ | Branch (236:7): [True: 0, False: 12.5k] ------------------ 237| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 6}, "PKCS12.SafeContentsBag"); 238| 0| case 0x6EB86: ------------------ | Branch (238:7): [True: 0, False: 12.5k] ------------------ 239| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 6, 1}, "GOST-34.10-2012-256/SHA-256"); 240| 0| case 0x6EC47: ------------------ | Branch (240:7): [True: 0, False: 12.5k] ------------------ 241| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 1}, "Kyber-512-r3"); 242| 0| case 0x6EC48: ------------------ | Branch (242:7): [True: 0, False: 12.5k] ------------------ 243| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 2}, "Kyber-768-r3"); 244| 0| case 0x6EC49: ------------------ | Branch (244:7): [True: 0, False: 12.5k] ------------------ 245| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 3}, "Kyber-1024-r3"); 246| 0| case 0x6EDC9: ------------------ | Branch (246:7): [True: 0, False: 12.5k] ------------------ 247| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 1}, "Dilithium-4x4-r3"); 248| 0| case 0x6EDCA: ------------------ | Branch (248:7): [True: 0, False: 12.5k] ------------------ 249| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 2}, "Dilithium-6x5-r3"); 250| 0| case 0x6EDCB: ------------------ | Branch (250:7): [True: 0, False: 12.5k] ------------------ 251| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 3}, "Dilithium-8x7-r3"); 252| 0| case 0x6EE8A: ------------------ | Branch (252:7): [True: 0, False: 12.5k] ------------------ 253| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 1}, "Dilithium-4x4-AES-r3"); 254| 0| case 0x6EE8B: ------------------ | Branch (254:7): [True: 0, False: 12.5k] ------------------ 255| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 2}, "Dilithium-6x5-AES-r3"); 256| 0| case 0x6EE8C: ------------------ | Branch (256:7): [True: 0, False: 12.5k] ------------------ 257| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 3}, "Dilithium-8x7-AES-r3"); 258| 0| case 0x6EF4B: ------------------ | Branch (258:7): [True: 0, False: 12.5k] ------------------ 259| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 1}, "Kyber-512-90s-r3"); 260| 0| case 0x6EF4C: ------------------ | Branch (260:7): [True: 0, False: 12.5k] ------------------ 261| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 2}, "Kyber-768-90s-r3"); 262| 0| case 0x6EF4D: ------------------ | Branch (262:7): [True: 0, False: 12.5k] ------------------ 263| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 3}, "Kyber-1024-90s-r3"); 264| 0| case 0x6F18E: ------------------ | Branch (264:7): [True: 0, False: 12.5k] ------------------ 265| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 1}, "FrodoKEM-640-SHAKE"); 266| 0| case 0x6F18F: ------------------ | Branch (266:7): [True: 0, False: 12.5k] ------------------ 267| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 2}, "FrodoKEM-976-SHAKE"); 268| 0| case 0x6F190: ------------------ | Branch (268:7): [True: 0, False: 12.5k] ------------------ 269| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 3}, "FrodoKEM-1344-SHAKE"); 270| 0| case 0x6F24F: ------------------ | Branch (270:7): [True: 0, False: 12.5k] ------------------ 271| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 1}, "FrodoKEM-640-AES"); 272| 0| case 0x6F250: ------------------ | Branch (272:7): [True: 0, False: 12.5k] ------------------ 273| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 2}, "FrodoKEM-976-AES"); 274| 0| case 0x6F251: ------------------ | Branch (274:7): [True: 0, False: 12.5k] ------------------ 275| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 3}, "FrodoKEM-1344-AES"); 276| 0| case 0x6F310: ------------------ | Branch (276:7): [True: 0, False: 12.5k] ------------------ 277| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 1}, "eFrodoKEM-640-SHAKE"); 278| 0| case 0x6F311: ------------------ | Branch (278:7): [True: 0, False: 12.5k] ------------------ 279| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 2}, "eFrodoKEM-976-SHAKE"); 280| 0| case 0x6F312: ------------------ | Branch (280:7): [True: 0, False: 12.5k] ------------------ 281| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 3}, "eFrodoKEM-1344-SHAKE"); 282| 0| case 0x6F3D1: ------------------ | Branch (282:7): [True: 0, False: 12.5k] ------------------ 283| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 1}, "eFrodoKEM-640-AES"); 284| 0| case 0x6F3D2: ------------------ | Branch (284:7): [True: 0, False: 12.5k] ------------------ 285| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 2}, "eFrodoKEM-976-AES"); 286| 0| case 0x6F3D3: ------------------ | Branch (286:7): [True: 0, False: 12.5k] ------------------ 287| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 3}, "eFrodoKEM-1344-AES"); 288| 0| case 0x6F492: ------------------ | Branch (288:7): [True: 0, False: 12.5k] ------------------ 289| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 1}, "ClassicMcEliece_6688128pc"); 290| 0| case 0x6F493: ------------------ | Branch (290:7): [True: 0, False: 12.5k] ------------------ 291| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 2}, "ClassicMcEliece_6688128pcf"); 292| 0| case 0x6F494: ------------------ | Branch (292:7): [True: 0, False: 12.5k] ------------------ 293| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 3}, "ClassicMcEliece_6960119pc"); 294| 0| case 0x6F495: ------------------ | Branch (294:7): [True: 0, False: 12.5k] ------------------ 295| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 4}, "ClassicMcEliece_6960119pcf"); 296| 0| case 0x6F496: ------------------ | Branch (296:7): [True: 0, False: 12.5k] ------------------ 297| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 5}, "ClassicMcEliece_8192128pc"); 298| 0| case 0x6F497: ------------------ | Branch (298:7): [True: 0, False: 12.5k] ------------------ 299| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 6}, "ClassicMcEliece_8192128pcf"); 300| 0| case 0x6F79D: ------------------ | Branch (300:7): [True: 0, False: 12.5k] ------------------ 301| 0| return if_match(oid, {2, 16, 840, 1, 113730, 1, 13}, "Certificate Comment"); 302| 0| case 0x701A0: ------------------ | Branch (302:7): [True: 0, False: 12.5k] ------------------ 303| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 2, 1}, "ECGDSA"); 304| 0| case 0x70322: ------------------ | Branch (304:7): [True: 0, False: 12.5k] ------------------ 305| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 1}, "ECGDSA/RIPEMD-160"); 306| 0| case 0x70323: ------------------ | Branch (306:7): [True: 0, False: 12.5k] ------------------ 307| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 2}, "ECGDSA/SHA-1"); 308| 0| case 0x70324: ------------------ | Branch (308:7): [True: 0, False: 12.5k] ------------------ 309| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 3}, "ECGDSA/SHA-224"); 310| 0| case 0x70325: ------------------ | Branch (310:7): [True: 0, False: 12.5k] ------------------ 311| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 4}, "ECGDSA/SHA-256"); 312| 0| case 0x70326: ------------------ | Branch (312:7): [True: 0, False: 12.5k] ------------------ 313| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 5}, "ECGDSA/SHA-384"); 314| 0| case 0x70327: ------------------ | Branch (314:7): [True: 0, False: 12.5k] ------------------ 315| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 6}, "ECGDSA/SHA-512"); 316| 0| case 0x72B21: ------------------ | Branch (316:7): [True: 0, False: 12.5k] ------------------ 317| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 1, 1}, "GOST-34.10-2012-256"); 318| 0| case 0x72B22: ------------------ | Branch (318:7): [True: 0, False: 12.5k] ------------------ 319| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 1, 2}, "GOST-34.10-2012-512"); 320| 0| case 0x72BE3: ------------------ | Branch (320:7): [True: 0, False: 12.5k] ------------------ 321| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 2, 2}, "Streebog-256"); 322| 0| case 0x72BE4: ------------------ | Branch (322:7): [True: 0, False: 12.5k] ------------------ 323| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 2, 3}, "Streebog-512"); 324| 0| case 0x72CA4: ------------------ | Branch (324:7): [True: 0, False: 12.5k] ------------------ 325| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 3, 2}, "GOST-34.10-2012-256/Streebog-256"); 326| 0| case 0x72CA5: ------------------ | Branch (326:7): [True: 0, False: 12.5k] ------------------ 327| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 3, 3}, "GOST-34.10-2012-512/Streebog-512"); 328| 0| case 0x7C7C7: ------------------ | Branch (328:7): [True: 0, False: 12.5k] ------------------ 329| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 22, 1}, "PKCS9.X509Certificate"); 330| 0| case 0x7C7C8: ------------------ | Branch (330:7): [True: 0, False: 12.5k] ------------------ 331| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 22, 2}, "PKCS9.SDSICertificate"); 332| 0| case 0x7C888: ------------------ | Branch (332:7): [True: 0, False: 12.5k] ------------------ 333| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 23, 1}, "PKCS9.X509CRL"); 334| 0| case 0x7E10F: ------------------ | Branch (334:7): [True: 0, False: 12.5k] ------------------ 335| 0| return if_match(oid, {2, 5, 4, 3}, "X520.CommonName"); 336| 0| case 0x7E110: ------------------ | Branch (336:7): [True: 0, False: 12.5k] ------------------ 337| 0| return if_match(oid, {2, 5, 4, 4}, "X520.Surname"); 338| 0| case 0x7E111: ------------------ | Branch (338:7): [True: 0, False: 12.5k] ------------------ 339| 0| return if_match(oid, {2, 5, 4, 5}, "X520.SerialNumber"); 340| 0| case 0x7E112: ------------------ | Branch (340:7): [True: 0, False: 12.5k] ------------------ 341| 0| return if_match(oid, {2, 5, 4, 6}, "X520.Country"); 342| 0| case 0x7E113: ------------------ | Branch (342:7): [True: 0, False: 12.5k] ------------------ 343| 0| return if_match(oid, {2, 5, 4, 7}, "X520.Locality"); 344| 0| case 0x7E114: ------------------ | Branch (344:7): [True: 0, False: 12.5k] ------------------ 345| 0| return if_match(oid, {2, 5, 4, 8}, "X520.State"); 346| 0| case 0x7E115: ------------------ | Branch (346:7): [True: 0, False: 12.5k] ------------------ 347| 0| return if_match(oid, {2, 5, 4, 9}, "X520.StreetAddress"); 348| 0| case 0x7E116: ------------------ | Branch (348:7): [True: 0, False: 12.5k] ------------------ 349| 0| return if_match(oid, {2, 5, 4, 10}, "X520.Organization"); 350| 0| case 0x7E117: ------------------ | Branch (350:7): [True: 0, False: 12.5k] ------------------ 351| 0| return if_match(oid, {2, 5, 4, 11}, "X520.OrganizationalUnit"); 352| 0| case 0x7E118: ------------------ | Branch (352:7): [True: 0, False: 12.5k] ------------------ 353| 0| return if_match(oid, {2, 5, 4, 12}, "X520.Title"); 354| 0| case 0x7E136: ------------------ | Branch (354:7): [True: 0, False: 12.5k] ------------------ 355| 0| return if_match(oid, {2, 5, 4, 42}, "X520.GivenName"); 356| 0| case 0x7E137: ------------------ | Branch (356:7): [True: 0, False: 12.5k] ------------------ 357| 0| return if_match(oid, {2, 5, 4, 43}, "X520.Initials"); 358| 0| case 0x7E138: ------------------ | Branch (358:7): [True: 0, False: 12.5k] ------------------ 359| 0| return if_match(oid, {2, 5, 4, 44}, "X520.GenerationalQualifier"); 360| 0| case 0x7E13A: ------------------ | Branch (360:7): [True: 0, False: 12.5k] ------------------ 361| 0| return if_match(oid, {2, 5, 4, 46}, "X520.DNQualifier"); 362| 0| case 0x7E14D: ------------------ | Branch (362:7): [True: 0, False: 12.5k] ------------------ 363| 0| return if_match(oid, {2, 5, 4, 65}, "X520.Pseudonym"); 364| 0| case 0x7F3F3: ------------------ | Branch (364:7): [True: 0, False: 12.5k] ------------------ 365| 0| return if_match(oid, {2, 5, 29, 14}, "X509v3.SubjectKeyIdentifier"); 366| 0| case 0x7F3F4: ------------------ | Branch (366:7): [True: 0, False: 12.5k] ------------------ 367| 0| return if_match(oid, {2, 5, 29, 15}, "X509v3.KeyUsage"); 368| 0| case 0x7F3F5: ------------------ | Branch (368:7): [True: 0, False: 12.5k] ------------------ 369| 0| return if_match(oid, {2, 5, 29, 16}, "X509v3.PrivateKeyUsagePeriod"); 370| 0| case 0x7F3F6: ------------------ | Branch (370:7): [True: 0, False: 12.5k] ------------------ 371| 0| return if_match(oid, {2, 5, 29, 17}, "X509v3.SubjectAlternativeName"); 372| 0| case 0x7F3F7: ------------------ | Branch (372:7): [True: 0, False: 12.5k] ------------------ 373| 0| return if_match(oid, {2, 5, 29, 18}, "X509v3.IssuerAlternativeName"); 374| 0| case 0x7F3F8: ------------------ | Branch (374:7): [True: 0, False: 12.5k] ------------------ 375| 0| return if_match(oid, {2, 5, 29, 19}, "X509v3.BasicConstraints"); 376| 0| case 0x7F3F9: ------------------ | Branch (376:7): [True: 0, False: 12.5k] ------------------ 377| 0| return if_match(oid, {2, 5, 29, 20}, "X509v3.CRLNumber"); 378| 0| case 0x7F3FA: ------------------ | Branch (378:7): [True: 0, False: 12.5k] ------------------ 379| 0| return if_match(oid, {2, 5, 29, 21}, "X509v3.ReasonCode"); 380| 0| case 0x7F3FC: ------------------ | Branch (380:7): [True: 0, False: 12.5k] ------------------ 381| 0| return if_match(oid, {2, 5, 29, 23}, "X509v3.HoldInstructionCode"); 382| 0| case 0x7F3FD: ------------------ | Branch (382:7): [True: 0, False: 12.5k] ------------------ 383| 0| return if_match(oid, {2, 5, 29, 24}, "X509v3.InvalidityDate"); 384| 0| case 0x7F401: ------------------ | Branch (384:7): [True: 0, False: 12.5k] ------------------ 385| 0| return if_match(oid, {2, 5, 29, 28}, "X509v3.CRLIssuingDistributionPoint"); 386| 0| case 0x7F403: ------------------ | Branch (386:7): [True: 0, False: 12.5k] ------------------ 387| 0| return if_match(oid, {2, 5, 29, 30}, "X509v3.NameConstraints"); 388| 0| case 0x7F404: ------------------ | Branch (388:7): [True: 0, False: 12.5k] ------------------ 389| 0| return if_match(oid, {2, 5, 29, 31}, "X509v3.CRLDistributionPoints"); 390| 0| case 0x7F405: ------------------ | Branch (390:7): [True: 0, False: 12.5k] ------------------ 391| 0| return if_match(oid, {2, 5, 29, 32}, "X509v3.CertificatePolicies"); 392| 0| case 0x7F408: ------------------ | Branch (392:7): [True: 0, False: 12.5k] ------------------ 393| 0| return if_match(oid, {2, 5, 29, 35}, "X509v3.AuthorityKeyIdentifier"); 394| 0| case 0x7F409: ------------------ | Branch (394:7): [True: 0, False: 12.5k] ------------------ 395| 0| return if_match(oid, {2, 5, 29, 36}, "X509v3.PolicyConstraints"); 396| 0| case 0x7F40A: ------------------ | Branch (396:7): [True: 0, False: 12.5k] ------------------ 397| 0| return if_match(oid, {2, 5, 29, 37}, "X509v3.ExtendedKeyUsage"); 398| 0| case 0x7F41D: ------------------ | Branch (398:7): [True: 0, False: 12.5k] ------------------ 399| 0| return if_match(oid, {2, 5, 29, 56}, "X509v3.NoRevocationAvailable"); 400| 0| case 0x80B84: ------------------ | Branch (400:7): [True: 0, False: 12.5k] ------------------ 401| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 1}, "AES-128/OCB"); 402| 0| case 0x80B85: ------------------ | Branch (402:7): [True: 0, False: 12.5k] ------------------ 403| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 2}, "AES-192/OCB"); 404| 0| case 0x80B86: ------------------ | Branch (404:7): [True: 0, False: 12.5k] ------------------ 405| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 3}, "AES-256/OCB"); 406| 0| case 0x80B87: ------------------ | Branch (406:7): [True: 0, False: 12.5k] ------------------ 407| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 4}, "Serpent/OCB"); 408| 0| case 0x80B88: ------------------ | Branch (408:7): [True: 0, False: 12.5k] ------------------ 409| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 5}, "Twofish/OCB"); 410| 0| case 0x80B89: ------------------ | Branch (410:7): [True: 0, False: 12.5k] ------------------ 411| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 6}, "Camellia-128/OCB"); 412| 0| case 0x80B8A: ------------------ | Branch (412:7): [True: 0, False: 12.5k] ------------------ 413| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 7}, "Camellia-192/OCB"); 414| 0| case 0x80B8B: ------------------ | Branch (414:7): [True: 0, False: 12.5k] ------------------ 415| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 8}, "Camellia-256/OCB"); 416| 0| case 0x80D06: ------------------ | Branch (416:7): [True: 0, False: 12.5k] ------------------ 417| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 1}, "AES-128/SIV"); 418| 0| case 0x80D07: ------------------ | Branch (418:7): [True: 0, False: 12.5k] ------------------ 419| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 2}, "AES-192/SIV"); 420| 0| case 0x80D08: ------------------ | Branch (420:7): [True: 0, False: 12.5k] ------------------ 421| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 3}, "AES-256/SIV"); 422| 0| case 0x80D09: ------------------ | Branch (422:7): [True: 0, False: 12.5k] ------------------ 423| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 4}, "Serpent/SIV"); 424| 0| case 0x80D0A: ------------------ | Branch (424:7): [True: 0, False: 12.5k] ------------------ 425| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 5}, "Twofish/SIV"); 426| 0| case 0x80D0B: ------------------ | Branch (426:7): [True: 0, False: 12.5k] ------------------ 427| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 6}, "Camellia-128/SIV"); 428| 0| case 0x80D0C: ------------------ | Branch (428:7): [True: 0, False: 12.5k] ------------------ 429| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 7}, "Camellia-192/SIV"); 430| 0| case 0x80D0D: ------------------ | Branch (430:7): [True: 0, False: 12.5k] ------------------ 431| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 8}, "Camellia-256/SIV"); 432| 0| case 0x80D0E: ------------------ | Branch (432:7): [True: 0, False: 12.5k] ------------------ 433| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 9}, "SM4/SIV"); 434| 0| case 0x84C6A: ------------------ | Branch (434:7): [True: 0, False: 12.5k] ------------------ 435| 0| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 2}, "Camellia-128/CBC"); 436| 0| case 0x84C6B: ------------------ | Branch (436:7): [True: 0, False: 12.5k] ------------------ 437| 0| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 3}, "Camellia-192/CBC"); 438| 0| case 0x84C6C: ------------------ | Branch (438:7): [True: 0, False: 12.5k] ------------------ 439| 0| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 4}, "Camellia-256/CBC"); 440| 0| case 0x88CD3: ------------------ | Branch (440:7): [True: 0, False: 12.5k] ------------------ 441| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 6}, "KeyWrap.TripleDES"); 442| 0| case 0x88CD5: ------------------ | Branch (442:7): [True: 0, False: 12.5k] ------------------ 443| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 8}, "Compression.Zlib"); 444| 0| case 0x88CDE: ------------------ | Branch (444:7): [True: 0, False: 12.5k] ------------------ 445| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 17}, "HSS-LMS"); 446| 0| case 0x88CDF: ------------------ | Branch (446:7): [True: 0, False: 12.5k] ------------------ 447| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 18}, "ChaCha20Poly1305"); 448| 0| case 0x92296: ------------------ | Branch (448:7): [True: 0, False: 12.5k] ------------------ 449| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 2}, "AES-128/CBC"); 450| 0| case 0x92299: ------------------ | Branch (450:7): [True: 0, False: 12.5k] ------------------ 451| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 5}, "KeyWrap.AES-128"); 452| 0| case 0x9229A: ------------------ | Branch (452:7): [True: 0, False: 12.5k] ------------------ 453| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 6}, "AES-128/GCM"); 454| 0| case 0x9229B: ------------------ | Branch (454:7): [True: 0, False: 12.5k] ------------------ 455| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 7}, "AES-128/CCM"); 456| 0| case 0x922AA: ------------------ | Branch (456:7): [True: 0, False: 12.5k] ------------------ 457| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 22}, "AES-192/CBC"); 458| 0| case 0x922AD: ------------------ | Branch (458:7): [True: 0, False: 12.5k] ------------------ 459| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 25}, "KeyWrap.AES-192"); 460| 0| case 0x922AE: ------------------ | Branch (460:7): [True: 0, False: 12.5k] ------------------ 461| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 26}, "AES-192/GCM"); 462| 0| case 0x922AF: ------------------ | Branch (462:7): [True: 0, False: 12.5k] ------------------ 463| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 27}, "AES-192/CCM"); 464| 0| case 0x922BE: ------------------ | Branch (464:7): [True: 0, False: 12.5k] ------------------ 465| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 42}, "AES-256/CBC"); 466| 0| case 0x922C1: ------------------ | Branch (466:7): [True: 0, False: 12.5k] ------------------ 467| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 45}, "KeyWrap.AES-256"); 468| 0| case 0x922C2: ------------------ | Branch (468:7): [True: 0, False: 12.5k] ------------------ 469| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 46}, "AES-256/GCM"); 470| 0| case 0x922C3: ------------------ | Branch (470:7): [True: 0, False: 12.5k] ------------------ 471| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 47}, "AES-256/CCM"); 472| 0| case 0x92356: ------------------ | Branch (472:7): [True: 0, False: 12.5k] ------------------ 473| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 1}, "SHA-256"); 474| 0| case 0x92357: ------------------ | Branch (474:7): [True: 0, False: 12.5k] ------------------ 475| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 2}, "SHA-384"); 476| 0| case 0x92358: ------------------ | Branch (476:7): [True: 0, False: 12.5k] ------------------ 477| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 3}, "SHA-512"); 478| 0| case 0x92359: ------------------ | Branch (478:7): [True: 0, False: 12.5k] ------------------ 479| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 4}, "SHA-224"); 480| 0| case 0x9235B: ------------------ | Branch (480:7): [True: 0, False: 12.5k] ------------------ 481| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 6}, "SHA-512-256"); 482| 0| case 0x9235C: ------------------ | Branch (482:7): [True: 0, False: 12.5k] ------------------ 483| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 7}, "SHA-3(224)"); 484| 0| case 0x9235D: ------------------ | Branch (484:7): [True: 0, False: 12.5k] ------------------ 485| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 8}, "SHA-3(256)"); 486| 0| case 0x9235E: ------------------ | Branch (486:7): [True: 0, False: 12.5k] ------------------ 487| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 9}, "SHA-3(384)"); 488| 0| case 0x9235F: ------------------ | Branch (488:7): [True: 0, False: 12.5k] ------------------ 489| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 10}, "SHA-3(512)"); 490| 0| case 0x92360: ------------------ | Branch (490:7): [True: 0, False: 12.5k] ------------------ 491| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 11}, "SHAKE-128"); 492| 0| case 0x92361: ------------------ | Branch (492:7): [True: 0, False: 12.5k] ------------------ 493| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 12}, "SHAKE-256"); 494| 0| case 0x92417: ------------------ | Branch (494:7): [True: 0, False: 12.5k] ------------------ 495| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 1}, "DSA/SHA-224"); 496| 0| case 0x92418: ------------------ | Branch (496:7): [True: 0, False: 12.5k] ------------------ 497| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 2}, "DSA/SHA-256"); 498| 0| case 0x92419: ------------------ | Branch (498:7): [True: 0, False: 12.5k] ------------------ 499| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 3}, "DSA/SHA-384"); 500| 0| case 0x9241A: ------------------ | Branch (500:7): [True: 0, False: 12.5k] ------------------ 501| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 4}, "DSA/SHA-512"); 502| 0| case 0x9241B: ------------------ | Branch (502:7): [True: 0, False: 12.5k] ------------------ 503| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 5}, "DSA/SHA-3(224)"); 504| 0| case 0x9241C: ------------------ | Branch (504:7): [True: 0, False: 12.5k] ------------------ 505| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 6}, "DSA/SHA-3(256)"); 506| 0| case 0x9241D: ------------------ | Branch (506:7): [True: 0, False: 12.5k] ------------------ 507| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 7}, "DSA/SHA-3(384)"); 508| 0| case 0x9241E: ------------------ | Branch (508:7): [True: 0, False: 12.5k] ------------------ 509| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 8}, "DSA/SHA-3(512)"); 510| 0| case 0x9241F: ------------------ | Branch (510:7): [True: 0, False: 12.5k] ------------------ 511| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 9}, "ECDSA/SHA-3(224)"); 512| 0| case 0x92420: ------------------ | Branch (512:7): [True: 0, False: 12.5k] ------------------ 513| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 10}, "ECDSA/SHA-3(256)"); 514| 0| case 0x92421: ------------------ | Branch (514:7): [True: 0, False: 12.5k] ------------------ 515| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 11}, "ECDSA/SHA-3(384)"); 516| 0| case 0x92422: ------------------ | Branch (516:7): [True: 0, False: 12.5k] ------------------ 517| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 12}, "ECDSA/SHA-3(512)"); 518| 0| case 0x92423: ------------------ | Branch (518:7): [True: 0, False: 12.5k] ------------------ 519| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 13}, "RSA/PKCS1v15(SHA-3(224))"); 520| 0| case 0x92424: ------------------ | Branch (520:7): [True: 0, False: 12.5k] ------------------ 521| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 14}, "RSA/PKCS1v15(SHA-3(256))"); 522| 0| case 0x92425: ------------------ | Branch (522:7): [True: 0, False: 12.5k] ------------------ 523| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 15}, "RSA/PKCS1v15(SHA-3(384))"); 524| 0| case 0x92426: ------------------ | Branch (524:7): [True: 0, False: 12.5k] ------------------ 525| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 16}, "RSA/PKCS1v15(SHA-3(512))"); 526| 0| case 0x92427: ------------------ | Branch (526:7): [True: 0, False: 12.5k] ------------------ 527| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 17}, "ML-DSA-4x4"); 528| 0| case 0x92428: ------------------ | Branch (528:7): [True: 0, False: 12.5k] ------------------ 529| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 18}, "ML-DSA-6x5"); 530| 0| case 0x92429: ------------------ | Branch (530:7): [True: 0, False: 12.5k] ------------------ 531| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 19}, "ML-DSA-8x7"); 532| 0| case 0x9242A: ------------------ | Branch (532:7): [True: 0, False: 12.5k] ------------------ 533| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 20}, "SLH-DSA-SHA2-128s"); 534| 0| case 0x9242B: ------------------ | Branch (534:7): [True: 0, False: 12.5k] ------------------ 535| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 21}, "SLH-DSA-SHA2-128f"); 536| 0| case 0x9242C: ------------------ | Branch (536:7): [True: 0, False: 12.5k] ------------------ 537| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 22}, "SLH-DSA-SHA2-192s"); 538| 0| case 0x9242D: ------------------ | Branch (538:7): [True: 0, False: 12.5k] ------------------ 539| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 23}, "SLH-DSA-SHA2-192f"); 540| 0| case 0x9242E: ------------------ | Branch (540:7): [True: 0, False: 12.5k] ------------------ 541| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 24}, "SLH-DSA-SHA2-256s"); 542| 0| case 0x9242F: ------------------ | Branch (542:7): [True: 0, False: 12.5k] ------------------ 543| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 25}, "SLH-DSA-SHA2-256f"); 544| 0| case 0x92430: ------------------ | Branch (544:7): [True: 0, False: 12.5k] ------------------ 545| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 26}, "SLH-DSA-SHAKE-128s"); 546| 0| case 0x92431: ------------------ | Branch (546:7): [True: 0, False: 12.5k] ------------------ 547| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 27}, "SLH-DSA-SHAKE-128f"); 548| 0| case 0x92432: ------------------ | Branch (548:7): [True: 0, False: 12.5k] ------------------ 549| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 28}, "SLH-DSA-SHAKE-192s"); 550| 0| case 0x92433: ------------------ | Branch (550:7): [True: 0, False: 12.5k] ------------------ 551| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 29}, "SLH-DSA-SHAKE-192f"); 552| 0| case 0x92434: ------------------ | Branch (552:7): [True: 0, False: 12.5k] ------------------ 553| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 30}, "SLH-DSA-SHAKE-256s"); 554| 0| case 0x92435: ------------------ | Branch (554:7): [True: 0, False: 12.5k] ------------------ 555| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 31}, "SLH-DSA-SHAKE-256f"); 556| 0| case 0x924D8: ------------------ | Branch (556:7): [True: 0, False: 12.5k] ------------------ 557| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 1}, "ML-KEM-512"); 558| 0| case 0x924D9: ------------------ | Branch (558:7): [True: 0, False: 12.5k] ------------------ 559| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 2}, "ML-KEM-768"); 560| 0| case 0x924DA: ------------------ | Branch (560:7): [True: 0, False: 12.5k] ------------------ 561| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 3}, "ML-KEM-1024"); 562| 0| case 0x9479F: ------------------ | Branch (562:7): [True: 0, False: 12.5k] ------------------ 563| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 1}, "PKIX.AuthorityInformationAccess"); 564| 0| case 0x947A5: ------------------ | Branch (564:7): [True: 0, False: 12.5k] ------------------ 565| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 7}, "PKIX.IpAddrBlocks"); 566| 0| case 0x947A6: ------------------ | Branch (566:7): [True: 0, False: 12.5k] ------------------ 567| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 8}, "PKIX.AutonomousSysIds"); 568| 0| case 0x947B8: ------------------ | Branch (568:7): [True: 0, False: 12.5k] ------------------ 569| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 26}, "PKIX.TNAuthList"); 570| 0| case 0x94921: ------------------ | Branch (570:7): [True: 0, False: 12.5k] ------------------ 571| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 1}, "PKIX.ServerAuth"); 572| 0| case 0x94922: ------------------ | Branch (572:7): [True: 0, False: 12.5k] ------------------ 573| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 2}, "PKIX.ClientAuth"); 574| 0| case 0x94923: ------------------ | Branch (574:7): [True: 0, False: 12.5k] ------------------ 575| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 3}, "PKIX.CodeSigning"); 576| 0| case 0x94924: ------------------ | Branch (576:7): [True: 0, False: 12.5k] ------------------ 577| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 4}, "PKIX.EmailProtection"); 578| 0| case 0x94925: ------------------ | Branch (578:7): [True: 0, False: 12.5k] ------------------ 579| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 5}, "PKIX.IPsecEndSystem"); 580| 0| case 0x94926: ------------------ | Branch (580:7): [True: 0, False: 12.5k] ------------------ 581| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 6}, "PKIX.IPsecTunnel"); 582| 0| case 0x94927: ------------------ | Branch (582:7): [True: 0, False: 12.5k] ------------------ 583| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 7}, "PKIX.IPsecUser"); 584| 0| case 0x94928: ------------------ | Branch (584:7): [True: 0, False: 12.5k] ------------------ 585| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 8}, "PKIX.TimeStamping"); 586| 0| case 0x94929: ------------------ | Branch (586:7): [True: 0, False: 12.5k] ------------------ 587| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 9}, "PKIX.OCSPSigning"); 588| 0| case 0x94CEA: ------------------ | Branch (588:7): [True: 0, False: 12.5k] ------------------ 589| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 8, 5}, "PKIX.XMPPAddr"); 590| 0| case 0x94CEE: ------------------ | Branch (590:7): [True: 0, False: 12.5k] ------------------ 591| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 8, 9}, "PKIX.SmtpUTF8Mailbox"); 592| 0| case 0x954DB: ------------------ | Branch (592:7): [True: 0, False: 12.5k] ------------------ 593| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 311, 20, 2, 2}, "Microsoft SmartcardLogon"); 594| 0| case 0x954DC: ------------------ | Branch (594:7): [True: 0, False: 12.5k] ------------------ 595| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 311, 20, 2, 3}, "Microsoft UPN"); 596| 0| case 0x96B0E: ------------------ | Branch (596:7): [True: 0, False: 12.5k] ------------------ 597| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1}, "PKIX.OCSP"); 598| 0| case 0x96B0F: ------------------ | Branch (598:7): [True: 0, False: 12.5k] ------------------ 599| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 2}, "PKIX.CertificateAuthorityIssuers"); 600| 0| case 0x96C77: ------------------ | Branch (600:7): [True: 0, False: 12.5k] ------------------ 601| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 1, 3}, "PBE-SHA1-3DES"); 602| 0| case 0x96C78: ------------------ | Branch (602:7): [True: 0, False: 12.5k] ------------------ 603| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 1, 4}, "PBE-SHA1-2DES"); 604| 0| case 0x9A008: ------------------ | Branch (604:7): [True: 0, False: 12.5k] ------------------ 605| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 1}, "brainpool160r1"); 606| 0| case 0x9A00A: ------------------ | Branch (606:7): [True: 0, False: 12.5k] ------------------ 607| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 3}, "brainpool192r1"); 608| 0| case 0x9A00C: ------------------ | Branch (608:7): [True: 0, False: 12.5k] ------------------ 609| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 5}, "brainpool224r1"); 610| 1| case 0x9A00E: ------------------ | Branch (610:7): [True: 1, False: 12.5k] ------------------ 611| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 7}, "brainpool256r1"); 612| 0| case 0x9A010: ------------------ | Branch (612:7): [True: 0, False: 12.5k] ------------------ 613| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 9}, "brainpool320r1"); 614| 1| case 0x9A012: ------------------ | Branch (614:7): [True: 1, False: 12.5k] ------------------ 615| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 11}, "brainpool384r1"); 616| 1| case 0x9A014: ------------------ | Branch (616:7): [True: 1, False: 12.5k] ------------------ 617| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 13}, "brainpool512r1"); 618| 0| case 0xA0D61: ------------------ | Branch (618:7): [True: 0, False: 12.5k] ------------------ 619| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 3}, "McEliece"); 620| 0| case 0xA0D63: ------------------ | Branch (620:7): [True: 0, False: 12.5k] ------------------ 621| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 5}, "XMSS-draft6"); 622| 0| case 0xA0D66: ------------------ | Branch (622:7): [True: 0, False: 12.5k] ------------------ 623| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 8}, "XMSS-draft12"); 624| 0| case 0xA0D6B: ------------------ | Branch (624:7): [True: 0, False: 12.5k] ------------------ 625| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 13}, "HSS-LMS-Private-Key"); 626| 0| case 0xA0EE1: ------------------ | Branch (626:7): [True: 0, False: 12.5k] ------------------ 627| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 1}, "Serpent/CBC"); 628| 0| case 0xA0EE2: ------------------ | Branch (628:7): [True: 0, False: 12.5k] ------------------ 629| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2}, "Threefish-512/CBC"); 630| 0| case 0xA0EE3: ------------------ | Branch (630:7): [True: 0, False: 12.5k] ------------------ 631| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 3}, "Twofish/CBC"); 632| 0| case 0xA0F45: ------------------ | Branch (632:7): [True: 0, False: 12.5k] ------------------ 633| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 101}, "Serpent/GCM"); 634| 0| case 0xA0F46: ------------------ | Branch (634:7): [True: 0, False: 12.5k] ------------------ 635| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 102}, "Twofish/GCM"); 636| 0| case 0xA0FA2: ------------------ | Branch (636:7): [True: 0, False: 12.5k] ------------------ 637| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 1}, "numsp256d1"); 638| 0| case 0xA0FA3: ------------------ | Branch (638:7): [True: 0, False: 12.5k] ------------------ 639| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 2}, "numsp384d1"); 640| 0| case 0xA0FA4: ------------------ | Branch (640:7): [True: 0, False: 12.5k] ------------------ 641| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 3}, "numsp512d1"); 642| 0| case 0xA244B: ------------------ | Branch (642:7): [True: 0, False: 12.5k] ------------------ 643| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 1}, "ClassicMcEliece_348864"); 644| 0| case 0xA244C: ------------------ | Branch (644:7): [True: 0, False: 12.5k] ------------------ 645| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 2}, "ClassicMcEliece_348864f"); 646| 0| case 0xA244D: ------------------ | Branch (646:7): [True: 0, False: 12.5k] ------------------ 647| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 3}, "ClassicMcEliece_460896"); 648| 0| case 0xA244E: ------------------ | Branch (648:7): [True: 0, False: 12.5k] ------------------ 649| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 4}, "ClassicMcEliece_460896f"); 650| 0| case 0xA244F: ------------------ | Branch (650:7): [True: 0, False: 12.5k] ------------------ 651| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 5}, "ClassicMcEliece_6688128"); 652| 0| case 0xA2450: ------------------ | Branch (652:7): [True: 0, False: 12.5k] ------------------ 653| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 6}, "ClassicMcEliece_6688128f"); 654| 0| case 0xA2451: ------------------ | Branch (654:7): [True: 0, False: 12.5k] ------------------ 655| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 7}, "ClassicMcEliece_6960119"); 656| 0| case 0xA2452: ------------------ | Branch (656:7): [True: 0, False: 12.5k] ------------------ 657| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 8}, "ClassicMcEliece_6960119f"); 658| 0| case 0xA2453: ------------------ | Branch (658:7): [True: 0, False: 12.5k] ------------------ 659| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 9}, "ClassicMcEliece_8192128"); 660| 0| case 0xA2454: ------------------ | Branch (660:7): [True: 0, False: 12.5k] ------------------ 661| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 10}, "ClassicMcEliece_8192128f"); 662| 0| case 0xAF989: ------------------ | Branch (662:7): [True: 0, False: 12.5k] ------------------ 663| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 1}, "RSA"); 664| 0| case 0xAF98A: ------------------ | Branch (664:7): [True: 0, False: 12.5k] ------------------ 665| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 2}, "RSA/PKCS1v15(MD2)"); 666| 0| case 0xAF98C: ------------------ | Branch (666:7): [True: 0, False: 12.5k] ------------------ 667| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 4}, "RSA/PKCS1v15(MD5)"); 668| 0| case 0xAF98D: ------------------ | Branch (668:7): [True: 0, False: 12.5k] ------------------ 669| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 5}, "RSA/PKCS1v15(SHA-1)"); 670| 0| case 0xAF98F: ------------------ | Branch (670:7): [True: 0, False: 12.5k] ------------------ 671| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 7}, "RSA/OAEP"); 672| 0| case 0xAF990: ------------------ | Branch (672:7): [True: 0, False: 12.5k] ------------------ 673| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 8}, "MGF1"); 674| 0| case 0xAF992: ------------------ | Branch (674:7): [True: 0, False: 12.5k] ------------------ 675| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 10}, "RSA/PSS"); 676| 0| case 0xAF993: ------------------ | Branch (676:7): [True: 0, False: 12.5k] ------------------ 677| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 11}, "RSA/PKCS1v15(SHA-256)"); 678| 0| case 0xAF994: ------------------ | Branch (678:7): [True: 0, False: 12.5k] ------------------ 679| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 12}, "RSA/PKCS1v15(SHA-384)"); 680| 0| case 0xAF995: ------------------ | Branch (680:7): [True: 0, False: 12.5k] ------------------ 681| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 13}, "RSA/PKCS1v15(SHA-512)"); 682| 0| case 0xAF996: ------------------ | Branch (682:7): [True: 0, False: 12.5k] ------------------ 683| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 14}, "RSA/PKCS1v15(SHA-224)"); 684| 0| case 0xAF998: ------------------ | Branch (684:7): [True: 0, False: 12.5k] ------------------ 685| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 16}, "RSA/PKCS1v15(SHA-512-256)"); 686| 0| case 0xAFC98: ------------------ | Branch (686:7): [True: 0, False: 12.5k] ------------------ 687| 0| return if_match(oid, {1, 2, 840, 113549, 1, 5, 12}, "PKCS5.PBKDF2"); 688| 0| case 0xAFC99: ------------------ | Branch (688:7): [True: 0, False: 12.5k] ------------------ 689| 0| return if_match(oid, {1, 2, 840, 113549, 1, 5, 13}, "PBE-PKCS5v20"); 690| 0| case 0xAFE0F: ------------------ | Branch (690:7): [True: 0, False: 12.5k] ------------------ 691| 0| return if_match(oid, {1, 2, 840, 113549, 1, 7, 1}, "PKCS7.Data"); 692| 0| case 0xAFE14: ------------------ | Branch (692:7): [True: 0, False: 12.5k] ------------------ 693| 0| return if_match(oid, {1, 2, 840, 113549, 1, 7, 6}, "PKCS7.EncryptedData"); 694| 0| case 0xAFF91: ------------------ | Branch (694:7): [True: 0, False: 12.5k] ------------------ 695| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 1}, "PKCS9.EmailAddress"); 696| 0| case 0xAFF92: ------------------ | Branch (696:7): [True: 0, False: 12.5k] ------------------ 697| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 2}, "PKCS9.UnstructuredName"); 698| 0| case 0xAFF93: ------------------ | Branch (698:7): [True: 0, False: 12.5k] ------------------ 699| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 3}, "PKCS9.ContentType"); 700| 0| case 0xAFF94: ------------------ | Branch (700:7): [True: 0, False: 12.5k] ------------------ 701| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 4}, "PKCS9.MessageDigest"); 702| 0| case 0xAFF97: ------------------ | Branch (702:7): [True: 0, False: 12.5k] ------------------ 703| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 7}, "PKCS9.ChallengePassword"); 704| 0| case 0xAFF9E: ------------------ | Branch (704:7): [True: 0, False: 12.5k] ------------------ 705| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 14}, "PKCS9.ExtensionRequest"); 706| 0| case 0xAFFA4: ------------------ | Branch (706:7): [True: 0, False: 12.5k] ------------------ 707| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 20}, "PKCS9.FriendlyName"); 708| 0| case 0xAFFA5: ------------------ | Branch (708:7): [True: 0, False: 12.5k] ------------------ 709| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 21}, "PKCS9.LocalKeyId"); 710| 0| case 0xC0226: ------------------ | Branch (710:7): [True: 0, False: 12.5k] ------------------ 711| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 11591, 4, 11}, "Scrypt"); 712| 0| case 0xC0A67: ------------------ | Branch (712:7): [True: 0, False: 12.5k] ------------------ 713| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 11591, 15, 1}, "OpenPGP.Ed25519"); 714| 0| case 0xC4CE5: ------------------ | Branch (714:7): [True: 0, False: 12.5k] ------------------ 715| 0| return if_match(oid, {1, 2, 643, 100, 1}, "GOST.OGRN"); 716| 0| case 0xC4D53: ------------------ | Branch (716:7): [True: 0, False: 12.5k] ------------------ 717| 0| return if_match(oid, {1, 2, 643, 100, 111}, "GOST.SubjectSigningTool"); 718| 0| case 0xC4D54: ------------------ | Branch (718:7): [True: 0, False: 12.5k] ------------------ 719| 0| return if_match(oid, {1, 2, 643, 100, 112}, "GOST.IssuerSigningTool"); 720| 0| case 0xC9C50: ------------------ | Branch (720:7): [True: 0, False: 12.5k] ------------------ 721| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 1}, "secp192r1"); 722| 0| case 0xC9C51: ------------------ | Branch (722:7): [True: 0, False: 12.5k] ------------------ 723| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 2}, "x962_p192v2"); 724| 0| case 0xC9C52: ------------------ | Branch (724:7): [True: 0, False: 12.5k] ------------------ 725| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 3}, "x962_p192v3"); 726| 0| case 0xC9C53: ------------------ | Branch (726:7): [True: 0, False: 12.5k] ------------------ 727| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 4}, "x962_p239v1"); 728| 0| case 0xC9C54: ------------------ | Branch (728:7): [True: 0, False: 12.5k] ------------------ 729| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 5}, "x962_p239v2"); 730| 0| case 0xC9C55: ------------------ | Branch (730:7): [True: 0, False: 12.5k] ------------------ 731| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 6}, "x962_p239v3"); 732| 1| case 0xC9C56: ------------------ | Branch (732:7): [True: 1, False: 12.5k] ------------------ 733| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 7}, "secp256r1"); 734| 0| case 0xCFA13: ------------------ | Branch (734:7): [True: 0, False: 12.5k] ------------------ 735| 0| return if_match(oid, {1, 2, 840, 10040, 4, 1}, "DSA"); 736| 0| case 0xCFA15: ------------------ | Branch (736:7): [True: 0, False: 12.5k] ------------------ 737| 0| return if_match(oid, {1, 2, 840, 10040, 4, 3}, "DSA/SHA-1"); 738| 0| default: ------------------ | Branch (738:7): [True: 0, False: 12.5k] ------------------ 739| 0| return {}; 740| 12.5k| } 741| 12.5k|} _ZN5Botan7OID_Map22lookup_static_oid_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 744| 49.4k|std::optional OID_Map::lookup_static_oid_name(std::string_view req) { 745| 49.4k| const uint32_t hc = hash_oid_name(req); 746| | 747| 49.4k| switch(hc) { 748| 0| case 0x00545: ------------------ | Branch (748:7): [True: 0, False: 49.4k] ------------------ 749| 0| return if_match(req, "Twofish/GCM", {1, 3, 6, 1, 4, 1, 25258, 3, 102}); 750| 0| case 0x00CF3: ------------------ | Branch (750:7): [True: 0, False: 49.4k] ------------------ 751| 0| return if_match(req, "SphincsPlus-sha2-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4}); 752| 0| case 0x015FE: ------------------ | Branch (752:7): [True: 0, False: 49.4k] ------------------ 753| 0| return if_match(req, "FrodoKEM-640-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 1}); 754| 0| case 0x01F9E: ------------------ | Branch (754:7): [True: 0, False: 49.4k] ------------------ 755| 0| return if_match(req, "MD5", {1, 2, 840, 113549, 2, 5}); 756| 0| case 0x02293: ------------------ | Branch (756:7): [True: 0, False: 49.4k] ------------------ 757| 0| return if_match(req, "SphincsPlus-shake-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4}); 758| 0| case 0x02B93: ------------------ | Branch (758:7): [True: 0, False: 49.4k] ------------------ 759| 0| return if_match(req, "Microsoft SmartcardLogon", {1, 3, 6, 1, 4, 1, 311, 20, 2, 2}); 760| 0| case 0x041D5: ------------------ | Branch (760:7): [True: 0, False: 49.4k] ------------------ 761| 0| return if_match(req, "secp160k1", {1, 3, 132, 0, 9}); 762| 0| case 0x044B3: ------------------ | Branch (762:7): [True: 0, False: 49.4k] ------------------ 763| 0| return if_match(req, "Camellia-256/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 8}); 764| 0| case 0x048B2: ------------------ | Branch (764:7): [True: 0, False: 49.4k] ------------------ 765| 0| return if_match(req, "secp160r1", {1, 3, 132, 0, 8}); 766| 0| case 0x048B3: ------------------ | Branch (766:7): [True: 0, False: 49.4k] ------------------ 767| 0| return if_match(req, "secp160r2", {1, 3, 132, 0, 30}); 768| 0| case 0x05CDA: ------------------ | Branch (768:7): [True: 0, False: 49.4k] ------------------ 769| 0| return if_match(req, "X520.Country", {2, 5, 4, 6}); 770| 0| case 0x07783: ------------------ | Branch (770:7): [True: 0, False: 49.4k] ------------------ 771| 0| return if_match(req, "PKIX.ServerAuth", {1, 3, 6, 1, 5, 5, 7, 3, 1}); 772| 0| case 0x086C7: ------------------ | Branch (772:7): [True: 0, False: 49.4k] ------------------ 773| 0| return if_match(req, "numsp384d1", {1, 3, 6, 1, 4, 1, 25258, 4, 2}); 774| 118| case 0x08A92: ------------------ | Branch (774:7): [True: 118, False: 49.3k] ------------------ 775| 118| return if_match(req, "RSA/PKCS1v15(SHA-1)", {1, 2, 840, 113549, 1, 1, 5}); 776| 0| case 0x09EA0: ------------------ | Branch (776:7): [True: 0, False: 49.4k] ------------------ 777| 0| return if_match(req, "DES/CBC", {1, 3, 14, 3, 2, 7}); 778| 0| case 0x0B2D6: ------------------ | Branch (778:7): [True: 0, False: 49.4k] ------------------ 779| 0| return if_match(req, "ECDSA/SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 3, 12}); 780| 0| case 0x0BA72: ------------------ | Branch (780:7): [True: 0, False: 49.4k] ------------------ 781| 0| return if_match(req, "SphincsPlus-sha2-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1}); 782| 0| case 0x0BE23: ------------------ | Branch (782:7): [True: 0, False: 49.4k] ------------------ 783| 0| return if_match(req, "ECGDSA", {1, 3, 36, 3, 3, 2, 5, 2, 1}); 784| 0| case 0x0C109: ------------------ | Branch (784:7): [True: 0, False: 49.4k] ------------------ 785| 0| return if_match(req, "PKCS9.FriendlyName", {1, 2, 840, 113549, 1, 9, 20}); 786| 0| case 0x0D012: ------------------ | Branch (786:7): [True: 0, False: 49.4k] ------------------ 787| 0| return if_match(req, "SphincsPlus-shake-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1}); 788| 0| case 0x0DCE9: ------------------ | Branch (788:7): [True: 0, False: 49.4k] ------------------ 789| 0| return if_match(req, "ClassicMcEliece_8192128f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 10}); 790| 0| case 0x0E52A: ------------------ | Branch (790:7): [True: 0, False: 49.4k] ------------------ 791| 0| return if_match(req, "numsp512d1", {1, 3, 6, 1, 4, 1, 25258, 4, 3}); 792| 0| case 0x0F9CC: ------------------ | Branch (792:7): [True: 0, False: 49.4k] ------------------ 793| 0| return if_match(req, "PKCS9.UnstructuredName", {1, 2, 840, 113549, 1, 9, 2}); 794| 0| case 0x0FF45: ------------------ | Branch (794:7): [True: 0, False: 49.4k] ------------------ 795| 0| return if_match(req, "Camellia-256/GCM", {0, 3, 4401, 5, 3, 1, 9, 46}); 796| 0| case 0x1033D: ------------------ | Branch (796:7): [True: 0, False: 49.4k] ------------------ 797| 0| return if_match(req, "DSA/SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 3, 7}); 798| 0| case 0x1139D: ------------------ | Branch (798:7): [True: 0, False: 49.4k] ------------------ 799| 0| return if_match(req, "secp192k1", {1, 3, 132, 0, 31}); 800| 0| case 0x113D6: ------------------ | Branch (800:7): [True: 0, False: 49.4k] ------------------ 801| 0| return if_match(req, "X520.DNQualifier", {2, 5, 4, 46}); 802| 0| case 0x11A7A: ------------------ | Branch (802:7): [True: 0, False: 49.4k] ------------------ 803| 0| return if_match(req, "secp192r1", {1, 2, 840, 10045, 3, 1, 1}); 804| 0| case 0x12096: ------------------ | Branch (804:7): [True: 0, False: 49.4k] ------------------ 805| 0| return if_match(req, "SM2_Kex", {1, 2, 156, 10197, 1, 301, 2}); 806| 0| case 0x13FC1: ------------------ | Branch (806:7): [True: 0, False: 49.4k] ------------------ 807| 0| return if_match(req, "X520.GenerationalQualifier", {2, 5, 4, 44}); 808| 0| case 0x1445B: ------------------ | Branch (808:7): [True: 0, False: 49.4k] ------------------ 809| 0| return if_match(req, "PKCS5.PBKDF2", {1, 2, 840, 113549, 1, 5, 12}); 810| 0| case 0x1495D: ------------------ | Branch (810:7): [True: 0, False: 49.4k] ------------------ 811| 0| return if_match(req, "eFrodoKEM-1344-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 3}); 812| 0| case 0x14E30: ------------------ | Branch (812:7): [True: 0, False: 49.4k] ------------------ 813| 0| return if_match(req, "ClassicMcEliece_460896", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 3}); 814| 0| case 0x14FB1: ------------------ | Branch (814:7): [True: 0, False: 49.4k] ------------------ 815| 0| return if_match(req, "XMSS-draft12", {1, 3, 6, 1, 4, 1, 25258, 1, 8}); 816| 0| case 0x156E3: ------------------ | Branch (816:7): [True: 0, False: 49.4k] ------------------ 817| 0| return if_match(req, "Compression.Zlib", {1, 2, 840, 113549, 1, 9, 16, 3, 8}); 818| 0| case 0x1579E: ------------------ | Branch (818:7): [True: 0, False: 49.4k] ------------------ 819| 0| return if_match(req, "Streebog-512", {1, 2, 643, 7, 1, 1, 2, 3}); 820| 0| case 0x1701A: ------------------ | Branch (820:7): [True: 0, False: 49.4k] ------------------ 821| 0| return if_match(req, "X509v3.AnyExtendedKeyUsage", {2, 5, 29, 37, 0}); 822| 0| case 0x175EF: ------------------ | Branch (822:7): [True: 0, False: 49.4k] ------------------ 823| 0| return if_match(req, "Kyber-1024-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 3}); 824| 0| case 0x17709: ------------------ | Branch (824:7): [True: 0, False: 49.4k] ------------------ 825| 0| return if_match(req, "X520.GivenName", {2, 5, 4, 42}); 826| 0| case 0x17AD9: ------------------ | Branch (826:7): [True: 0, False: 49.4k] ------------------ 827| 0| return if_match(req, "RSA/PKCS1v15(SM3)", {1, 2, 156, 10197, 1, 504}); 828| 0| case 0x17CE2: ------------------ | Branch (828:7): [True: 0, False: 49.4k] ------------------ 829| 0| return if_match(req, "SLH-DSA-SHA2-256f", {2, 16, 840, 1, 101, 3, 4, 3, 25}); 830| 0| case 0x17CEF: ------------------ | Branch (830:7): [True: 0, False: 49.4k] ------------------ 831| 0| return if_match(req, "SLH-DSA-SHA2-256s", {2, 16, 840, 1, 101, 3, 4, 3, 24}); 832| 0| case 0x18618: ------------------ | Branch (832:7): [True: 0, False: 49.4k] ------------------ 833| 0| return if_match(req, "FrodoKEM-976-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 2}); 834| 0| case 0x19480: ------------------ | Branch (834:7): [True: 0, False: 49.4k] ------------------ 835| 0| return if_match(req, "eFrodoKEM-1344-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 3}); 836| 0| case 0x1958A: ------------------ | Branch (836:7): [True: 0, False: 49.4k] ------------------ 837| 0| return if_match(req, "X509v3.InvalidityDate", {2, 5, 29, 24}); 838| 0| case 0x19851: ------------------ | Branch (838:7): [True: 0, False: 49.4k] ------------------ 839| 0| return if_match(req, "DSA/SHA-1", {1, 2, 840, 10040, 4, 3}); 840| 0| case 0x1B2E7: ------------------ | Branch (840:7): [True: 0, False: 49.4k] ------------------ 841| 0| return if_match(req, "KeyWrap.AES-128", {2, 16, 840, 1, 101, 3, 4, 1, 5}); 842| 0| case 0x1B9BE: ------------------ | Branch (842:7): [True: 0, False: 49.4k] ------------------ 843| 0| return if_match(req, "KeyWrap.AES-192", {2, 16, 840, 1, 101, 3, 4, 1, 25}); 844| 0| case 0x1D439: ------------------ | Branch (844:7): [True: 0, False: 49.4k] ------------------ 845| 0| return if_match(req, "SphincsPlus-haraka-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4}); 846| 0| case 0x2065B: ------------------ | Branch (846:7): [True: 0, False: 49.4k] ------------------ 847| 0| return if_match(req, "KeyWrap.CAST-128", {1, 2, 840, 113533, 7, 66, 15}); 848| 0| case 0x216A0: ------------------ | Branch (848:7): [True: 0, False: 49.4k] ------------------ 849| 0| return if_match(req, "ML-KEM-512", {2, 16, 840, 1, 101, 3, 4, 4, 1}); 850| 0| case 0x2216B: ------------------ | Branch (850:7): [True: 0, False: 49.4k] ------------------ 851| 0| return if_match(req, "GOST-34.10-2012-512", {1, 2, 643, 7, 1, 1, 1, 2}); 852| 0| case 0x22C2C: ------------------ | Branch (852:7): [True: 0, False: 49.4k] ------------------ 853| 0| return if_match(req, "ElGamal", {1, 3, 6, 1, 4, 1, 3029, 1, 2, 1}); 854| 0| case 0x2559A: ------------------ | Branch (854:7): [True: 0, False: 49.4k] ------------------ 855| 0| return if_match(req, "X520.Initials", {2, 5, 4, 43}); 856| 0| case 0x271AC: ------------------ | Branch (856:7): [True: 0, False: 49.4k] ------------------ 857| 0| return if_match(req, "PKIX.AutonomousSysIds", {1, 3, 6, 1, 5, 5, 7, 1, 8}); 858| 0| case 0x2808B: ------------------ | Branch (858:7): [True: 0, False: 49.4k] ------------------ 859| 0| return if_match(req, "PKCS7.Data", {1, 2, 840, 113549, 1, 7, 1}); 860| 0| case 0x281B8: ------------------ | Branch (860:7): [True: 0, False: 49.4k] ------------------ 861| 0| return if_match(req, "SphincsPlus-haraka-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1}); 862| 0| case 0x282FE: ------------------ | Branch (862:7): [True: 0, False: 49.4k] ------------------ 863| 0| return if_match(req, "PKIX.OCSP.Nonce", {1, 3, 6, 1, 5, 5, 7, 48, 1, 2}); 864| 0| case 0x29999: ------------------ | Branch (864:7): [True: 0, False: 49.4k] ------------------ 865| 0| return if_match(req, "DSA/SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 3, 6}); 866| 0| case 0x2A83D: ------------------ | Branch (866:7): [True: 0, False: 49.4k] ------------------ 867| 0| return if_match(req, "SHA-224", {2, 16, 840, 1, 101, 3, 4, 2, 4}); 868| 7.00k| case 0x2AB30: ------------------ | Branch (868:7): [True: 7.00k, False: 42.4k] ------------------ 869| 7.00k| return if_match(req, "SHA-256", {2, 16, 840, 1, 101, 3, 4, 2, 1}); 870| 0| case 0x2ABEF: ------------------ | Branch (870:7): [True: 0, False: 49.4k] ------------------ 871| 0| return if_match(req, "KeyWrap.AES-256", {2, 16, 840, 1, 101, 3, 4, 1, 45}); 872| 0| case 0x2BAEF: ------------------ | Branch (872:7): [True: 0, False: 49.4k] ------------------ 873| 0| return if_match(req, "SM2_Sig/SM3", {1, 2, 156, 10197, 1, 501}); 874| 0| case 0x2C39A: ------------------ | Branch (874:7): [True: 0, False: 49.4k] ------------------ 875| 0| return if_match(req, "ECGDSA/RIPEMD-160", {1, 3, 36, 3, 3, 2, 5, 4, 1}); 876| 0| case 0x2C54F: ------------------ | Branch (876:7): [True: 0, False: 49.4k] ------------------ 877| 0| return if_match(req, "ECDSA/SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 3, 9}); 878| 0| case 0x2EEA6: ------------------ | Branch (878:7): [True: 0, False: 49.4k] ------------------ 879| 0| return if_match(req, "RSA/PKCS1v15(RIPEMD-160)", {1, 3, 36, 3, 3, 1, 2}); 880| 0| case 0x2EFBA: ------------------ | Branch (880:7): [True: 0, False: 49.4k] ------------------ 881| 0| return if_match(req, "Kyber-512-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 1}); 882| 0| case 0x2F0AD: ------------------ | Branch (882:7): [True: 0, False: 49.4k] ------------------ 883| 0| return if_match(req, "PKCS7.EncryptedData", {1, 2, 840, 113549, 1, 7, 6}); 884| 0| case 0x2F219: ------------------ | Branch (884:7): [True: 0, False: 49.4k] ------------------ 885| 0| return if_match(req, "PBE-SHA1-2DES", {1, 2, 840, 113549, 1, 12, 1, 4}); 886| 0| case 0x3133E: ------------------ | Branch (886:7): [True: 0, False: 49.4k] ------------------ 887| 0| return if_match(req, "SLH-DSA-SHA2-128f", {2, 16, 840, 1, 101, 3, 4, 3, 21}); 888| 0| case 0x3134B: ------------------ | Branch (888:7): [True: 0, False: 49.4k] ------------------ 889| 0| return if_match(req, "SLH-DSA-SHA2-128s", {2, 16, 840, 1, 101, 3, 4, 3, 20}); 890| 0| case 0x3160D: ------------------ | Branch (890:7): [True: 0, False: 49.4k] ------------------ 891| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(224))", {2, 16, 840, 1, 101, 3, 4, 3, 13}); 892| 0| case 0x319E0: ------------------ | Branch (892:7): [True: 0, False: 49.4k] ------------------ 893| 0| return if_match(req, "GOST-34.10-2012-256/Streebog-256", {1, 2, 643, 7, 1, 1, 3, 2}); 894| 0| case 0x31B3D: ------------------ | Branch (894:7): [True: 0, False: 49.4k] ------------------ 895| 0| return if_match(req, "HMAC(SHA-512)", {1, 2, 840, 113549, 2, 11}); 896| 505| case 0x31C6D: ------------------ | Branch (896:7): [True: 505, False: 48.9k] ------------------ 897| 505| return if_match(req, "secp384r1", {1, 3, 132, 0, 34}); 898| 0| case 0x32899: ------------------ | Branch (898:7): [True: 0, False: 49.4k] ------------------ 899| 0| return if_match(req, "TripleDES/CBC", {1, 2, 840, 113549, 3, 7}); 900| 0| case 0x33C9C: ------------------ | Branch (900:7): [True: 0, False: 49.4k] ------------------ 901| 0| return if_match(req, "PKIX.SmtpUTF8Mailbox", {1, 3, 6, 1, 5, 5, 7, 8, 9}); 902| 0| case 0x33D04: ------------------ | Branch (902:7): [True: 0, False: 49.4k] ------------------ 903| 0| return if_match(req, "PKCS12.SecretBag", {1, 2, 840, 113549, 1, 12, 10, 1, 5}); 904| 0| case 0x3615D: ------------------ | Branch (904:7): [True: 0, False: 49.4k] ------------------ 905| 0| return if_match(req, "FrodoKEM-976-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 2}); 906| 0| case 0x361B8: ------------------ | Branch (906:7): [True: 0, False: 49.4k] ------------------ 907| 0| return if_match(req, "Ed25519", {1, 3, 101, 112}); 908| 0| case 0x3649D: ------------------ | Branch (908:7): [True: 0, False: 49.4k] ------------------ 909| 0| return if_match(req, "SHAKE-128", {2, 16, 840, 1, 101, 3, 4, 2, 11}); 910| 0| case 0x36693: ------------------ | Branch (910:7): [True: 0, False: 49.4k] ------------------ 911| 0| return if_match(req, "ClassicMcEliece_348864", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 1}); 912| 0| case 0x373C7: ------------------ | Branch (912:7): [True: 0, False: 49.4k] ------------------ 913| 0| return if_match(req, "ML-DSA-4x4", {2, 16, 840, 1, 101, 3, 4, 3, 17}); 914| 0| case 0x3750B: ------------------ | Branch (914:7): [True: 0, False: 49.4k] ------------------ 915| 0| return if_match(req, "ClassicMcEliece_8192128", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 9}); 916| 0| case 0x39890: ------------------ | Branch (916:7): [True: 0, False: 49.4k] ------------------ 917| 0| return if_match(req, "Ed448", {1, 3, 101, 113}); 918| 3.12k| case 0x3A438: ------------------ | Branch (918:7): [True: 3.12k, False: 46.3k] ------------------ 919| 3.12k| return if_match(req, "SHA-384", {2, 16, 840, 1, 101, 3, 4, 2, 2}); 920| 0| case 0x3A963: ------------------ | Branch (920:7): [True: 0, False: 49.4k] ------------------ 921| 0| return if_match(req, "DH", {1, 2, 840, 10046, 2, 1}); 922| 10.3k| case 0x3AC83: ------------------ | Branch (922:7): [True: 10.3k, False: 39.0k] ------------------ 923| 10.3k| return if_match(req, "MGF1", {1, 2, 840, 113549, 1, 1, 8}); 924| 0| case 0x3ACBA: ------------------ | Branch (924:7): [True: 0, False: 49.4k] ------------------ 925| 0| return if_match(req, "X509v3.IssuerAlternativeName", {2, 5, 29, 18}); 926| 0| case 0x3B273: ------------------ | Branch (926:7): [True: 0, False: 49.4k] ------------------ 927| 0| return if_match(req, "KeyWrap.TripleDES", {1, 2, 840, 113549, 1, 9, 16, 3, 6}); 928| 0| case 0x3B91E: ------------------ | Branch (928:7): [True: 0, False: 49.4k] ------------------ 929| 0| return if_match(req, "X509v3.PrivateKeyUsagePeriod", {2, 5, 29, 16}); 930| 0| case 0x3BC8A: ------------------ | Branch (930:7): [True: 0, False: 49.4k] ------------------ 931| 0| return if_match(req, "SLH-DSA-SHAKE-192f", {2, 16, 840, 1, 101, 3, 4, 3, 29}); 932| 0| case 0x3BC97: ------------------ | Branch (932:7): [True: 0, False: 49.4k] ------------------ 933| 0| return if_match(req, "SLH-DSA-SHAKE-192s", {2, 16, 840, 1, 101, 3, 4, 3, 28}); 934| 0| case 0x3D127: ------------------ | Branch (934:7): [True: 0, False: 49.4k] ------------------ 935| 0| return if_match(req, "DSA", {1, 2, 840, 10040, 4, 1}); 936| 0| case 0x3E249: ------------------ | Branch (936:7): [True: 0, False: 49.4k] ------------------ 937| 0| return if_match(req, "HSS-LMS", {1, 2, 840, 113549, 1, 9, 16, 3, 17}); 938| 0| case 0x3E7D5: ------------------ | Branch (938:7): [True: 0, False: 49.4k] ------------------ 939| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(256))", {2, 16, 840, 1, 101, 3, 4, 3, 14}); 940| 0| case 0x3F748: ------------------ | Branch (940:7): [True: 0, False: 49.4k] ------------------ 941| 0| return if_match(req, "GOST.OGRN", {1, 2, 643, 100, 1}); 942| 0| case 0x3F99F: ------------------ | Branch (942:7): [True: 0, False: 49.4k] ------------------ 943| 0| return if_match(req, "X509v3.BasicConstraints", {2, 5, 29, 19}); 944| 0| case 0x40726: ------------------ | Branch (944:7): [True: 0, False: 49.4k] ------------------ 945| 0| return if_match(req, "SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 2, 10}); 946| 0| case 0x407BF: ------------------ | Branch (946:7): [True: 0, False: 49.4k] ------------------ 947| 0| return if_match(req, "ML-KEM-768", {2, 16, 840, 1, 101, 3, 4, 4, 2}); 948| 0| case 0x41334: ------------------ | Branch (948:7): [True: 0, False: 49.4k] ------------------ 949| 0| return if_match(req, "ECDSA/SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 3, 11}); 950| 0| case 0x42DF3: ------------------ | Branch (950:7): [True: 0, False: 49.4k] ------------------ 951| 0| return if_match(req, "X509v3.CRLDistributionPoints", {2, 5, 29, 31}); 952| 0| case 0x437FB: ------------------ | Branch (952:7): [True: 0, False: 49.4k] ------------------ 953| 0| return if_match(req, "brainpool160r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 1}); 954| 0| case 0x441F5: ------------------ | Branch (954:7): [True: 0, False: 49.4k] ------------------ 955| 0| return if_match(req, "gost_256A", {1, 2, 643, 7, 1, 2, 1, 1, 1}); 956| 0| case 0x441F6: ------------------ | Branch (956:7): [True: 0, False: 49.4k] ------------------ 957| 0| return if_match(req, "gost_256B", {1, 2, 643, 7, 1, 2, 1, 1, 2}); 958| 0| case 0x44221: ------------------ | Branch (958:7): [True: 0, False: 49.4k] ------------------ 959| 0| return if_match(req, "GOST-34.10-2012-512/Streebog-512", {1, 2, 643, 7, 1, 1, 3, 3}); 960| 0| case 0x44322: ------------------ | Branch (960:7): [True: 0, False: 49.4k] ------------------ 961| 0| return if_match(req, "ClassicMcEliece_6960119pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 3}); 962| 0| case 0x44973: ------------------ | Branch (962:7): [True: 0, False: 49.4k] ------------------ 963| 0| return if_match(req, "Kyber-512-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 1}); 964| 0| case 0x45C27: ------------------ | Branch (964:7): [True: 0, False: 49.4k] ------------------ 965| 0| return if_match(req, "RSA/PKCS1v15(SHA-512-256)", {1, 2, 840, 113549, 1, 1, 16}); 966| 0| case 0x45C85: ------------------ | Branch (966:7): [True: 0, False: 49.4k] ------------------ 967| 0| return if_match(req, "X509v3.ReasonCode", {2, 5, 29, 21}); 968| 0| case 0x45DA5: ------------------ | Branch (968:7): [True: 0, False: 49.4k] ------------------ 969| 0| return if_match(req, "SHAKE-256", {2, 16, 840, 1, 101, 3, 4, 2, 12}); 970| 0| case 0x4663C: ------------------ | Branch (970:7): [True: 0, False: 49.4k] ------------------ 971| 0| return if_match(req, "X509v3.PolicyConstraints", {2, 5, 29, 36}); 972| 0| case 0x480F7: ------------------ | Branch (972:7): [True: 0, False: 49.4k] ------------------ 973| 0| return if_match(req, "Serpent/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 4}); 974| 0| case 0x48627: ------------------ | Branch (974:7): [True: 0, False: 49.4k] ------------------ 975| 0| return if_match(req, "Dilithium-4x4-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 1}); 976| 0| case 0x48861: ------------------ | Branch (976:7): [True: 0, False: 49.4k] ------------------ 977| 0| return if_match(req, "ChaCha20Poly1305", {1, 2, 840, 113549, 1, 9, 16, 3, 18}); 978| 0| case 0x4A292: ------------------ | Branch (978:7): [True: 0, False: 49.4k] ------------------ 979| 0| return if_match(req, "frp256v1", {1, 2, 250, 1, 223, 101, 256, 1}); 980| 0| case 0x4A9EE: ------------------ | Branch (980:7): [True: 0, False: 49.4k] ------------------ 981| 0| return if_match(req, "ClassicMcEliece_6960119f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 8}); 982| 0| case 0x4BF87: ------------------ | Branch (982:7): [True: 0, False: 49.4k] ------------------ 983| 0| return if_match(req, "PKIX.TNAuthList", {1, 3, 6, 1, 5, 5, 7, 1, 26}); 984| 0| case 0x4C088: ------------------ | Branch (984:7): [True: 0, False: 49.4k] ------------------ 985| 0| return if_match(req, "eFrodoKEM-976-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 2}); 986| 0| case 0x4C513: ------------------ | Branch (986:7): [True: 0, False: 49.4k] ------------------ 987| 0| return if_match(req, "DSA/SHA-224", {2, 16, 840, 1, 101, 3, 4, 3, 1}); 988| 0| case 0x4C806: ------------------ | Branch (988:7): [True: 0, False: 49.4k] ------------------ 989| 0| return if_match(req, "DSA/SHA-256", {2, 16, 840, 1, 101, 3, 4, 3, 2}); 990| 0| case 0x4D740: ------------------ | Branch (990:7): [True: 0, False: 49.4k] ------------------ 991| 0| return if_match(req, "X509v3.AnyPolicy", {2, 5, 29, 32, 0}); 992| 174| case 0x4DE49: ------------------ | Branch (992:7): [True: 174, False: 49.2k] ------------------ 993| 174| return if_match(req, "RSA/PKCS1v15(SHA-512)", {1, 2, 840, 113549, 1, 1, 13}); 994| 0| case 0x4ED5D: ------------------ | Branch (994:7): [True: 0, False: 49.4k] ------------------ 995| 0| return if_match(req, "CAST-128/CBC", {1, 2, 840, 113533, 7, 66, 10}); 996| 0| case 0x4FCDC: ------------------ | Branch (996:7): [True: 0, False: 49.4k] ------------------ 997| 0| return if_match(req, "RSA", {1, 2, 840, 113549, 1, 1, 1}); 998| 0| case 0x501CB: ------------------ | Branch (998:7): [True: 0, False: 49.4k] ------------------ 999| 0| return if_match(req, "ECDSA/SHA-224", {1, 2, 840, 10045, 4, 3, 1}); 1000| 0| case 0x50395: ------------------ | Branch (1000:7): [True: 0, False: 49.4k] ------------------ 1001| 0| return if_match(req, "GOST-34.10/GOST-R-34.11-94", {1, 2, 643, 2, 2, 3}); 1002| 218| case 0x504BE: ------------------ | Branch (1002:7): [True: 218, False: 49.2k] ------------------ 1003| 218| return if_match(req, "ECDSA/SHA-256", {1, 2, 840, 10045, 4, 3, 2}); 1004| 0| case 0x509C3: ------------------ | Branch (1004:7): [True: 0, False: 49.4k] ------------------ 1005| 0| return if_match(req, "brainpool192r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 3}); 1006| 0| case 0x509F9: ------------------ | Branch (1006:7): [True: 0, False: 49.4k] ------------------ 1007| 0| return if_match(req, "PKCS9.ContentType", {1, 2, 840, 113549, 1, 9, 3}); 1008| 0| case 0x50B26: ------------------ | Branch (1008:7): [True: 0, False: 49.4k] ------------------ 1009| 0| return if_match(req, "FrodoKEM-640-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 1}); 1010| 0| case 0x50D78: ------------------ | Branch (1010:7): [True: 0, False: 49.4k] ------------------ 1011| 0| return if_match(req, "x962_p192v2", {1, 2, 840, 10045, 3, 1, 2}); 1012| 0| case 0x50D79: ------------------ | Branch (1012:7): [True: 0, False: 49.4k] ------------------ 1013| 0| return if_match(req, "x962_p192v3", {1, 2, 840, 10045, 3, 1, 3}); 1014| 0| case 0x51DC6: ------------------ | Branch (1014:7): [True: 0, False: 49.4k] ------------------ 1015| 0| return if_match(req, "AES-128/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 1}); 1016| 0| case 0x52DB6: ------------------ | Branch (1016:7): [True: 0, False: 49.4k] ------------------ 1017| 0| return if_match(req, "HMAC(SHA-224)", {1, 2, 840, 113549, 2, 8}); 1018| 0| case 0x53E11: ------------------ | Branch (1018:7): [True: 0, False: 49.4k] ------------------ 1019| 0| return if_match(req, "FrodoKEM-1344-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 3}); 1020| 0| case 0x54012: ------------------ | Branch (1020:7): [True: 0, False: 49.4k] ------------------ 1021| 0| return if_match(req, "PKIX.TimeStamping", {1, 3, 6, 1, 5, 5, 7, 3, 8}); 1022| 0| case 0x5407A: ------------------ | Branch (1022:7): [True: 0, False: 49.4k] ------------------ 1023| 0| return if_match(req, "Serpent/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 1}); 1024| 0| case 0x5576D: ------------------ | Branch (1024:7): [True: 0, False: 49.4k] ------------------ 1025| 0| return if_match(req, "SphincsPlus-sha2-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2}); 1026| 0| case 0x55EF6: ------------------ | Branch (1026:7): [True: 0, False: 49.4k] ------------------ 1027| 0| return if_match(req, "AES-192/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 2}); 1028| 0| case 0x55FFA: ------------------ | Branch (1028:7): [True: 0, False: 49.4k] ------------------ 1029| 0| return if_match(req, "ML-DSA-6x5", {2, 16, 840, 1, 101, 3, 4, 3, 18}); 1030| 0| case 0x56826: ------------------ | Branch (1030:7): [True: 0, False: 49.4k] ------------------ 1031| 0| return if_match(req, "brainpool320r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 9}); 1032| 0| case 0x56D0D: ------------------ | Branch (1032:7): [True: 0, False: 49.4k] ------------------ 1033| 0| return if_match(req, "SphincsPlus-shake-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2}); 1034| 0| case 0x57077: ------------------ | Branch (1034:7): [True: 0, False: 49.4k] ------------------ 1035| 0| return if_match(req, "XMSS-draft6", {1, 3, 6, 1, 4, 1, 25258, 1, 5}); 1036| 0| case 0x5818B: ------------------ | Branch (1036:7): [True: 0, False: 49.4k] ------------------ 1037| 0| return if_match(req, "ECGDSA/SHA-224", {1, 3, 36, 3, 3, 2, 5, 4, 3}); 1038| 0| case 0x5847E: ------------------ | Branch (1038:7): [True: 0, False: 49.4k] ------------------ 1039| 0| return if_match(req, "ECGDSA/SHA-256", {1, 3, 36, 3, 3, 2, 5, 4, 4}); 1040| 232| case 0x5898B: ------------------ | Branch (1040:7): [True: 232, False: 49.2k] ------------------ 1041| 232| return if_match(req, "SHA-512", {2, 16, 840, 1, 101, 3, 4, 2, 3}); 1042| 0| case 0x58991: ------------------ | Branch (1042:7): [True: 0, False: 49.4k] ------------------ 1043| 0| return if_match(req, "PKIX.OCSP.NoCheck", {1, 3, 6, 1, 5, 5, 7, 48, 1, 5}); 1044| 0| case 0x59717: ------------------ | Branch (1044:7): [True: 0, False: 49.4k] ------------------ 1045| 0| return if_match(req, "X509v3.SubjectKeyIdentifier", {2, 5, 29, 14}); 1046| 0| case 0x5A1E1: ------------------ | Branch (1046:7): [True: 0, False: 49.4k] ------------------ 1047| 0| return if_match(req, "PKCS12.KeyBag", {1, 2, 840, 113549, 1, 12, 10, 1, 1}); 1048| 0| case 0x5A570: ------------------ | Branch (1048:7): [True: 0, False: 49.4k] ------------------ 1049| 0| return if_match(req, "X520.CommonName", {2, 5, 4, 3}); 1050| 0| case 0x5A990: ------------------ | Branch (1050:7): [True: 0, False: 49.4k] ------------------ 1051| 0| return if_match(req, "ECDSA/SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 3, 10}); 1052| 0| case 0x5AB0E: ------------------ | Branch (1052:7): [True: 0, False: 49.4k] ------------------ 1053| 0| return if_match(req, "SphincsPlus-sha2-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5}); 1054| 0| case 0x5AC4A: ------------------ | Branch (1054:7): [True: 0, False: 49.4k] ------------------ 1055| 0| return if_match(req, "X520.Surname", {2, 5, 4, 4}); 1056| 0| case 0x5AF2C: ------------------ | Branch (1056:7): [True: 0, False: 49.4k] ------------------ 1057| 0| return if_match(req, "ClassicMcEliece_8192128pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 5}); 1058| 0| case 0x5BC39: ------------------ | Branch (1058:7): [True: 0, False: 49.4k] ------------------ 1059| 0| return if_match(req, "X509v3.KeyUsage", {2, 5, 29, 15}); 1060| 0| case 0x5BDDB: ------------------ | Branch (1060:7): [True: 0, False: 49.4k] ------------------ 1061| 0| return if_match(req, "numsp256d1", {1, 3, 6, 1, 4, 1, 25258, 4, 1}); 1062| 0| case 0x5C0AE: ------------------ | Branch (1062:7): [True: 0, False: 49.4k] ------------------ 1063| 0| return if_match(req, "SphincsPlus-shake-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5}); 1064| 0| case 0x5C10E: ------------------ | Branch (1064:7): [True: 0, False: 49.4k] ------------------ 1065| 0| return if_match(req, "DSA/SHA-384", {2, 16, 840, 1, 101, 3, 4, 3, 3}); 1066| 0| case 0x5CFE5: ------------------ | Branch (1066:7): [True: 0, False: 49.4k] ------------------ 1067| 0| return if_match(req, "PKCS9.X509Certificate", {1, 2, 840, 113549, 1, 9, 22, 1}); 1068| 0| case 0x5D1CF: ------------------ | Branch (1068:7): [True: 0, False: 49.4k] ------------------ 1069| 0| return if_match(req, "X520.SerialNumber", {2, 5, 4, 5}); 1070| 0| case 0x5D375: ------------------ | Branch (1070:7): [True: 0, False: 49.4k] ------------------ 1071| 0| return if_match(req, "SM4/OCB", {1, 2, 156, 10197, 1, 104, 100}); 1072| 0| case 0x5DD49: ------------------ | Branch (1072:7): [True: 0, False: 49.4k] ------------------ 1073| 0| return if_match(req, "AES-128/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 2}); 1074| 0| case 0x5DE4E: ------------------ | Branch (1074:7): [True: 0, False: 49.4k] ------------------ 1075| 0| return if_match(req, "AES-128/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 7}); 1076| 0| case 0x5DF23: ------------------ | Branch (1076:7): [True: 0, False: 49.4k] ------------------ 1077| 0| return if_match(req, "HMAC(SHA-512-256)", {1, 2, 840, 113549, 2, 13}); 1078| 0| case 0x5ED04: ------------------ | Branch (1078:7): [True: 0, False: 49.4k] ------------------ 1079| 0| return if_match(req, "SM2", {1, 2, 156, 10197, 1, 301, 1}); 1080| 0| case 0x5ED05: ------------------ | Branch (1080:7): [True: 0, False: 49.4k] ------------------ 1081| 0| return if_match(req, "SM3", {1, 2, 156, 10197, 1, 401}); 1082| 108| case 0x5FDC6: ------------------ | Branch (1082:7): [True: 108, False: 49.3k] ------------------ 1083| 108| return if_match(req, "ECDSA/SHA-384", {1, 2, 840, 10045, 4, 3, 3}); 1084| 0| case 0x6199F: ------------------ | Branch (1084:7): [True: 0, False: 49.4k] ------------------ 1085| 0| return if_match(req, "SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 2, 7}); 1086| 0| case 0x61E79: ------------------ | Branch (1086:7): [True: 0, False: 49.4k] ------------------ 1087| 0| return if_match(req, "AES-192/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 22}); 1088| 0| case 0x61F7E: ------------------ | Branch (1088:7): [True: 0, False: 49.4k] ------------------ 1089| 0| return if_match(req, "AES-192/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 27}); 1090| 0| case 0x64947: ------------------ | Branch (1090:7): [True: 0, False: 49.4k] ------------------ 1091| 0| return if_match(req, "OpenPGP.Ed25519", {1, 3, 6, 1, 4, 1, 11591, 15, 1}); 1092| 0| case 0x652E7: ------------------ | Branch (1092:7): [True: 0, False: 49.4k] ------------------ 1093| 0| return if_match(req, "sm2p256v1", {1, 2, 156, 10197, 1, 301}); 1094| 0| case 0x6697B: ------------------ | Branch (1094:7): [True: 0, False: 49.4k] ------------------ 1095| 0| return if_match(req, "FrodoKEM-1344-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 3}); 1096| 0| case 0x67B2C: ------------------ | Branch (1096:7): [True: 0, False: 49.4k] ------------------ 1097| 0| return if_match(req, "X520.State", {2, 5, 4, 8}); 1098| 0| case 0x67B9B: ------------------ | Branch (1098:7): [True: 0, False: 49.4k] ------------------ 1099| 0| return if_match(req, "HMAC(SHA-384)", {1, 2, 840, 113549, 2, 10}); 1100| 0| case 0x67D86: ------------------ | Branch (1100:7): [True: 0, False: 49.4k] ------------------ 1101| 0| return if_match(req, "ECGDSA/SHA-384", {1, 3, 36, 3, 3, 2, 5, 4, 5}); 1102| 0| case 0x68A0B: ------------------ | Branch (1102:7): [True: 0, False: 49.4k] ------------------ 1103| 0| return if_match(req, "Camellia-128/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 6}); 1104| 0| case 0x68E33: ------------------ | Branch (1104:7): [True: 0, False: 49.4k] ------------------ 1105| 0| return if_match(req, "PKCS9.ExtensionRequest", {1, 2, 840, 113549, 1, 9, 14}); 1106| 6.24k| case 0x69126: ------------------ | Branch (1106:7): [True: 6.24k, False: 43.1k] ------------------ 1107| 6.24k| return if_match(req, "X509v3.SubjectAlternativeName", {2, 5, 29, 17}); 1108| 0| case 0x692F8: ------------------ | Branch (1108:7): [True: 0, False: 49.4k] ------------------ 1109| 0| return if_match(req, "SM4/CBC", {1, 2, 156, 10197, 1, 104, 2}); 1110| 0| case 0x695E1: ------------------ | Branch (1110:7): [True: 0, False: 49.4k] ------------------ 1111| 0| return if_match(req, "Dilithium-4x4-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 1}); 1112| 0| case 0x696DC: ------------------ | Branch (1112:7): [True: 0, False: 49.4k] ------------------ 1113| 0| return if_match(req, "PKIX.IpAddrBlocks", {1, 3, 6, 1, 5, 5, 7, 1, 7}); 1114| 6.24k| case 0x6A7CA: ------------------ | Branch (1114:7): [True: 6.24k, False: 43.1k] ------------------ 1115| 6.24k| return if_match(req, "ECDSA", {1, 2, 840, 10045, 2, 1}); 1116| 0| case 0x6BD26: ------------------ | Branch (1116:7): [True: 0, False: 49.4k] ------------------ 1117| 0| return if_match(req, "GOST.INN", {1, 2, 643, 3, 131, 1, 1}); 1118| 0| case 0x6CB3B: ------------------ | Branch (1118:7): [True: 0, False: 49.4k] ------------------ 1119| 0| return if_match(req, "Camellia-192/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 7}); 1120| 0| case 0x6E602: ------------------ | Branch (1120:7): [True: 0, False: 49.4k] ------------------ 1121| 0| return if_match(req, "Dilithium-8x7-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 3}); 1122| 0| case 0x6F0C2: ------------------ | Branch (1122:7): [True: 0, False: 49.4k] ------------------ 1123| 0| return if_match(req, "RSA/PKCS1v15(SHA-224)", {1, 2, 840, 113549, 1, 1, 14}); 1124| 0| case 0x6F9F8: ------------------ | Branch (1124:7): [True: 0, False: 49.4k] ------------------ 1125| 0| return if_match(req, "PKCS12.SafeContentsBag", {1, 2, 840, 113549, 1, 12, 10, 1, 6}); 1126| 0| case 0x6FB26: ------------------ | Branch (1126:7): [True: 0, False: 49.4k] ------------------ 1127| 0| return if_match(req, "PKIX.AuthorityInformationAccess", {1, 3, 6, 1, 5, 5, 7, 1, 1}); 1128| 524| case 0x70BB6: ------------------ | Branch (1128:7): [True: 524, False: 48.9k] ------------------ 1129| 524| return if_match(req, "brainpool384r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 11}); 1130| 0| case 0x70EA6: ------------------ | Branch (1130:7): [True: 0, False: 49.4k] ------------------ 1131| 0| return if_match(req, "PKCS12.PKCS8ShroudedKeyBag", {1, 2, 840, 113549, 1, 12, 10, 1, 2}); 1132| 0| case 0x71EB3: ------------------ | Branch (1132:7): [True: 0, False: 49.4k] ------------------ 1133| 0| return if_match(req, "SphincsPlus-haraka-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2}); 1134| 0| case 0x7382C: ------------------ | Branch (1134:7): [True: 0, False: 49.4k] ------------------ 1135| 0| return if_match(req, "ML-KEM-1024", {2, 16, 840, 1, 101, 3, 4, 4, 3}); 1136| 0| case 0x743BD: ------------------ | Branch (1136:7): [True: 0, False: 49.4k] ------------------ 1137| 0| return if_match(req, "AES-256/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 3}); 1138| 0| case 0x7498E: ------------------ | Branch (1138:7): [True: 0, False: 49.4k] ------------------ 1139| 0| return if_match(req, "Camellia-128/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 2}); 1140| 0| case 0x74C2E: ------------------ | Branch (1140:7): [True: 0, False: 49.4k] ------------------ 1141| 0| return if_match(req, "ML-DSA-8x7", {2, 16, 840, 1, 101, 3, 4, 3, 19}); 1142| 0| case 0x7505F: ------------------ | Branch (1142:7): [True: 0, False: 49.4k] ------------------ 1143| 0| return if_match(req, "PKIX.XMPPAddr", {1, 3, 6, 1, 5, 5, 7, 8, 5}); 1144| 0| case 0x7517A: ------------------ | Branch (1144:7): [True: 0, False: 49.4k] ------------------ 1145| 0| return if_match(req, "RSA/PKCS1v15(MD2)", {1, 2, 840, 113549, 1, 1, 2}); 1146| 0| case 0x7546B: ------------------ | Branch (1146:7): [True: 0, False: 49.4k] ------------------ 1147| 0| return if_match(req, "RSA/PKCS1v15(MD5)", {1, 2, 840, 113549, 1, 1, 4}); 1148| 0| case 0x75921: ------------------ | Branch (1148:7): [True: 0, False: 49.4k] ------------------ 1149| 0| return if_match(req, "ClassicMcEliece_348864f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 2}); 1150| 0| case 0x76784: ------------------ | Branch (1150:7): [True: 0, False: 49.4k] ------------------ 1151| 0| return if_match(req, "SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 2, 9}); 1152| 0| case 0x768FD: ------------------ | Branch (1152:7): [True: 0, False: 49.4k] ------------------ 1153| 0| return if_match(req, "PKCS9.LocalKeyId", {1, 2, 840, 113549, 1, 9, 21}); 1154| 795| case 0x76A19: ------------------ | Branch (1154:7): [True: 795, False: 48.6k] ------------------ 1155| 795| return if_match(req, "brainpool512r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 13}); 1156| 0| case 0x77254: ------------------ | Branch (1156:7): [True: 0, False: 49.4k] ------------------ 1157| 0| return if_match(req, "SphincsPlus-haraka-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5}); 1158| 0| case 0x77ADC: ------------------ | Branch (1158:7): [True: 0, False: 49.4k] ------------------ 1159| 0| return if_match(req, "secp224k1", {1, 3, 132, 0, 32}); 1160| 0| case 0x781B9: ------------------ | Branch (1160:7): [True: 0, False: 49.4k] ------------------ 1161| 0| return if_match(req, "secp224r1", {1, 3, 132, 0, 33}); 1162| 0| case 0x78ABE: ------------------ | Branch (1162:7): [True: 0, False: 49.4k] ------------------ 1163| 0| return if_match(req, "Camellia-192/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 3}); 1164| 0| case 0x792F2: ------------------ | Branch (1164:7): [True: 0, False: 49.4k] ------------------ 1165| 0| return if_match(req, "ClassicMcEliece_6688128pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 1}); 1166| 0| case 0x7A661: ------------------ | Branch (1166:7): [True: 0, False: 49.4k] ------------------ 1167| 0| return if_match(req, "DSA/SHA-512", {2, 16, 840, 1, 101, 3, 4, 3, 4}); 1168| 0| case 0x7A977: ------------------ | Branch (1168:7): [True: 0, False: 49.4k] ------------------ 1169| 0| return if_match(req, "X509v3.ExtendedKeyUsage", {2, 5, 29, 37}); 1170| 0| case 0x7AE67: ------------------ | Branch (1170:7): [True: 0, False: 49.4k] ------------------ 1171| 0| return if_match(req, "SM2_Enc", {1, 2, 156, 10197, 1, 301, 3}); 1172| 0| case 0x7B602: ------------------ | Branch (1172:7): [True: 0, False: 49.4k] ------------------ 1173| 0| return if_match(req, "Twofish/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 5}); 1174| 0| case 0x7B9A1: ------------------ | Branch (1174:7): [True: 0, False: 49.4k] ------------------ 1175| 0| return if_match(req, "SphincsPlus-sha2-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3}); 1176| 0| case 0x7BB0A: ------------------ | Branch (1176:7): [True: 0, False: 49.4k] ------------------ 1177| 0| return if_match(req, "SLH-DSA-SHAKE-256f", {2, 16, 840, 1, 101, 3, 4, 3, 31}); 1178| 0| case 0x7BB17: ------------------ | Branch (1178:7): [True: 0, False: 49.4k] ------------------ 1179| 0| return if_match(req, "SLH-DSA-SHAKE-256s", {2, 16, 840, 1, 101, 3, 4, 3, 30}); 1180| 0| case 0x7BCF3: ------------------ | Branch (1180:7): [True: 0, False: 49.4k] ------------------ 1181| 0| return if_match(req, "PKIX.EmailProtection", {1, 3, 6, 1, 5, 5, 7, 3, 4}); 1182| 0| case 0x7CC2C: ------------------ | Branch (1182:7): [True: 0, False: 49.4k] ------------------ 1183| 0| return if_match(req, "SHA-512-256", {2, 16, 840, 1, 101, 3, 4, 2, 6}); 1184| 0| case 0x7CF41: ------------------ | Branch (1184:7): [True: 0, False: 49.4k] ------------------ 1185| 0| return if_match(req, "SphincsPlus-shake-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3}); 1186| 0| case 0x7DB91: ------------------ | Branch (1186:7): [True: 0, False: 49.4k] ------------------ 1187| 0| return if_match(req, "GOST-34.10", {1, 2, 643, 2, 2, 19}); 1188| 178| case 0x7E319: ------------------ | Branch (1188:7): [True: 178, False: 49.2k] ------------------ 1189| 178| return if_match(req, "ECDSA/SHA-512", {1, 2, 840, 10045, 4, 3, 4}); 1190| 0| case 0x7E874: ------------------ | Branch (1190:7): [True: 0, False: 49.4k] ------------------ 1191| 0| return if_match(req, "ClassicMcEliece_6688128f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 6}); 1192| 0| case 0x7EAAF: ------------------ | Branch (1192:7): [True: 0, False: 49.4k] ------------------ 1193| 0| return if_match(req, "eFrodoKEM-640-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 1}); 1194| 0| case 0x7F51F: ------------------ | Branch (1194:7): [True: 0, False: 49.4k] ------------------ 1195| 0| return if_match(req, "PKIX.IPsecTunnel", {1, 3, 6, 1, 5, 5, 7, 3, 6}); 1196| 0| case 0x80272: ------------------ | Branch (1196:7): [True: 0, False: 49.4k] ------------------ 1197| 0| return if_match(req, "X520.Organization", {2, 5, 4, 10}); 1198| 0| case 0x80340: ------------------ | Branch (1198:7): [True: 0, False: 49.4k] ------------------ 1199| 0| return if_match(req, "AES-256/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 42}); 1200| 0| case 0x80445: ------------------ | Branch (1200:7): [True: 0, False: 49.4k] ------------------ 1201| 0| return if_match(req, "AES-256/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 47}); 1202| 0| case 0x811F7: ------------------ | Branch (1202:7): [True: 0, False: 49.4k] ------------------ 1203| 0| return if_match(req, "HMAC(SHA-256)", {1, 2, 840, 113549, 2, 9}); 1204| 0| case 0x82434: ------------------ | Branch (1204:7): [True: 0, False: 49.4k] ------------------ 1205| 0| return if_match(req, "PKCS9.X509CRL", {1, 2, 840, 113549, 1, 9, 23, 1}); 1206| 0| case 0x82B47: ------------------ | Branch (1206:7): [True: 0, False: 49.4k] ------------------ 1207| 0| return if_match(req, "Threefish-512/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 2}); 1208| 166| case 0x83EA7: ------------------ | Branch (1208:7): [True: 166, False: 49.2k] ------------------ 1209| 166| return if_match(req, "RSA/PKCS1v15(SHA-384)", {1, 2, 840, 113549, 1, 1, 12}); 1210| 0| case 0x84596: ------------------ | Branch (1210:7): [True: 0, False: 49.4k] ------------------ 1211| 0| return if_match(req, "eFrodoKEM-640-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 1}); 1212| 0| case 0x8469F: ------------------ | Branch (1212:7): [True: 0, False: 49.4k] ------------------ 1213| 0| return if_match(req, "ClassicMcEliece_6960119pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 4}); 1214| 0| case 0x84CA4: ------------------ | Branch (1214:7): [True: 0, False: 49.4k] ------------------ 1215| 0| return if_match(req, "secp256k1", {1, 3, 132, 0, 10}); 1216| 705| case 0x85381: ------------------ | Branch (1216:7): [True: 705, False: 48.7k] ------------------ 1217| 705| return if_match(req, "secp256r1", {1, 2, 840, 10045, 3, 1, 7}); 1218| 0| case 0x854FC: ------------------ | Branch (1218:7): [True: 0, False: 49.4k] ------------------ 1219| 0| return if_match(req, "PKIX.IPsecUser", {1, 3, 6, 1, 5, 5, 7, 3, 7}); 1220| 0| case 0x85F51: ------------------ | Branch (1220:7): [True: 0, False: 49.4k] ------------------ 1221| 0| return if_match(req, "Serpent/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 4}); 1222| 0| case 0x862D9: ------------------ | Branch (1222:7): [True: 0, False: 49.4k] ------------------ 1223| 0| return if_match(req, "ECGDSA/SHA-512", {1, 3, 36, 3, 3, 2, 5, 4, 6}); 1224| 0| case 0x87585: ------------------ | Branch (1224:7): [True: 0, False: 49.4k] ------------------ 1225| 0| return if_match(req, "Twofish/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 3}); 1226| 0| case 0x877D1: ------------------ | Branch (1226:7): [True: 0, False: 49.4k] ------------------ 1227| 0| return if_match(req, "PKCS9.EmailAddress", {1, 2, 840, 113549, 1, 9, 1}); 1228| 0| case 0x87D27: ------------------ | Branch (1228:7): [True: 0, False: 49.4k] ------------------ 1229| 0| return if_match(req, "PKIX.CertificateAuthorityIssuers", {1, 3, 6, 1, 5, 5, 7, 48, 2}); 1230| 0| case 0x87E42: ------------------ | Branch (1230:7): [True: 0, False: 49.4k] ------------------ 1231| 0| return if_match(req, "X509v3.AuthorityKeyIdentifier", {2, 5, 29, 35}); 1232| 44| case 0x889B1: ------------------ | Branch (1232:7): [True: 44, False: 49.3k] ------------------ 1233| 44| return if_match(req, "ECDSA/SHA-1", {1, 2, 840, 10045, 4, 1}); 1234| 0| case 0x89658: ------------------ | Branch (1234:7): [True: 0, False: 49.4k] ------------------ 1235| 0| return if_match(req, "PBE-PKCS5v20", {1, 2, 840, 113549, 1, 5, 13}); 1236| 0| case 0x8976D: ------------------ | Branch (1236:7): [True: 0, False: 49.4k] ------------------ 1237| 0| return if_match(req, "PKCS9.MessageDigest", {1, 2, 840, 113549, 1, 9, 4}); 1238| 0| case 0x8B002: ------------------ | Branch (1238:7): [True: 0, False: 49.4k] ------------------ 1239| 0| return if_match(req, "Camellia-256/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 8}); 1240| 0| case 0x8B935: ------------------ | Branch (1240:7): [True: 0, False: 49.4k] ------------------ 1241| 0| return if_match(req, "ClassicMcEliece_6688128", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 5}); 1242| 0| case 0x8BB11: ------------------ | Branch (1242:7): [True: 0, False: 49.4k] ------------------ 1243| 0| return if_match(req, "X509v3.NoRevocationAvailable", {2, 5, 29, 56}); 1244| 0| case 0x8CE3D: ------------------ | Branch (1244:7): [True: 0, False: 49.4k] ------------------ 1245| 0| return if_match(req, "PKCS9.ChallengePassword", {1, 2, 840, 113549, 1, 9, 7}); 1246| 0| case 0x8D45C: ------------------ | Branch (1246:7): [True: 0, False: 49.4k] ------------------ 1247| 0| return if_match(req, "ECKCDSA", {1, 0, 14888, 3, 0, 5}); 1248| 0| case 0x8E0C1: ------------------ | Branch (1248:7): [True: 0, False: 49.4k] ------------------ 1249| 0| return if_match(req, "X509v3.CertificatePolicies", {2, 5, 29, 32}); 1250| 0| case 0x8E39A: ------------------ | Branch (1250:7): [True: 0, False: 49.4k] ------------------ 1251| 0| return if_match(req, "HSS-LMS-Private-Key", {1, 3, 6, 1, 4, 1, 25258, 1, 13}); 1252| 0| case 0x8EC51: ------------------ | Branch (1252:7): [True: 0, False: 49.4k] ------------------ 1253| 0| return if_match(req, "Kyber-768-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 2}); 1254| 0| case 0x8F94A: ------------------ | Branch (1254:7): [True: 0, False: 49.4k] ------------------ 1255| 0| return if_match(req, "Dilithium-6x5-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 2}); 1256| 0| case 0x8FC20: ------------------ | Branch (1256:7): [True: 0, False: 49.4k] ------------------ 1257| 0| return if_match(req, "AES-128/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 1}); 1258| 0| case 0x8FDE0: ------------------ | Branch (1258:7): [True: 0, False: 49.4k] ------------------ 1259| 0| return if_match(req, "SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 2, 8}); 1260| 0| case 0x919E3: ------------------ | Branch (1260:7): [True: 0, False: 49.4k] ------------------ 1261| 0| return if_match(req, "Serpent/GCM", {1, 3, 6, 1, 4, 1, 25258, 3, 101}); 1262| 0| case 0x91C1A: ------------------ | Branch (1262:7): [True: 0, False: 49.4k] ------------------ 1263| 0| return if_match(req, "X25519", {1, 3, 101, 110}); 1264| 0| case 0x91DC4: ------------------ | Branch (1264:7): [True: 0, False: 49.4k] ------------------ 1265| 0| return if_match(req, "McEliece", {1, 3, 6, 1, 4, 1, 25258, 1, 3}); 1266| 0| case 0x93467: ------------------ | Branch (1266:7): [True: 0, False: 49.4k] ------------------ 1267| 0| return if_match(req, "Dilithium-6x5-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 2}); 1268| 0| case 0x93D50: ------------------ | Branch (1268:7): [True: 0, False: 49.4k] ------------------ 1269| 0| return if_match(req, "AES-192/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 2}); 1270| 0| case 0x95166: ------------------ | Branch (1270:7): [True: 0, False: 49.4k] ------------------ 1271| 0| return if_match(req, "SLH-DSA-SHAKE-128f", {2, 16, 840, 1, 101, 3, 4, 3, 27}); 1272| 0| case 0x95173: ------------------ | Branch (1272:7): [True: 0, False: 49.4k] ------------------ 1273| 0| return if_match(req, "SLH-DSA-SHAKE-128s", {2, 16, 840, 1, 101, 3, 4, 3, 26}); 1274| 0| case 0x952D6: ------------------ | Branch (1274:7): [True: 0, False: 49.4k] ------------------ 1275| 0| return if_match(req, "PKIX.OCSP", {1, 3, 6, 1, 5, 5, 7, 48, 1}); 1276| 0| case 0x959B9: ------------------ | Branch (1276:7): [True: 0, False: 49.4k] ------------------ 1277| 0| return if_match(req, "PKIX.IPsecEndSystem", {1, 3, 6, 1, 5, 5, 7, 3, 5}); 1278| 0| case 0x96F85: ------------------ | Branch (1278:7): [True: 0, False: 49.4k] ------------------ 1279| 0| return if_match(req, "Camellia-256/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 4}); 1280| 0| case 0x97D5E: ------------------ | Branch (1280:7): [True: 0, False: 49.4k] ------------------ 1281| 0| return if_match(req, "HMAC(SHA-1)", {1, 2, 840, 113549, 2, 7}); 1282| 0| case 0x9805C: ------------------ | Branch (1282:7): [True: 0, False: 49.4k] ------------------ 1283| 0| return if_match(req, "SEED/CBC", {1, 2, 410, 200004, 1, 4}); 1284| 0| case 0x980E7: ------------------ | Branch (1284:7): [True: 0, False: 49.4k] ------------------ 1285| 0| return if_match(req, "SphincsPlus-haraka-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3}); 1286| 0| case 0x980F5: ------------------ | Branch (1286:7): [True: 0, False: 49.4k] ------------------ 1287| 0| return if_match(req, "GOST.SubjectSigningTool", {1, 2, 643, 100, 111}); 1288| 0| case 0x98B03: ------------------ | Branch (1288:7): [True: 0, False: 49.4k] ------------------ 1289| 0| return if_match(req, "XMSS", {0, 4, 0, 127, 0, 15, 1, 1, 13, 0}); 1290| 0| case 0x9A6B2: ------------------ | Branch (1290:7): [True: 0, False: 49.4k] ------------------ 1291| 0| return if_match(req, "ECKCDSA/SHA-1", {1, 2, 410, 200004, 1, 100, 4, 3}); 1292| 0| case 0x9B1CF: ------------------ | Branch (1292:7): [True: 0, False: 49.4k] ------------------ 1293| 0| return if_match(req, "SM4/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 9}); 1294| 0| case 0x9B6B2: ------------------ | Branch (1294:7): [True: 0, False: 49.4k] ------------------ 1295| 0| return if_match(req, "AES-128/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 6}); 1296| 0| case 0x9B6BB: ------------------ | Branch (1296:7): [True: 0, False: 49.4k] ------------------ 1297| 0| return if_match(req, "X520.OrganizationalUnit", {2, 5, 4, 11}); 1298| 0| case 0x9B851: ------------------ | Branch (1298:7): [True: 0, False: 49.4k] ------------------ 1299| 0| return if_match(req, "OpenPGP.Curve25519", {1, 3, 6, 1, 4, 1, 3029, 1, 5, 1}); 1300| 0| case 0x9C80B: ------------------ | Branch (1300:7): [True: 0, False: 49.4k] ------------------ 1301| 0| return if_match(req, "SLH-DSA-SHA2-192f", {2, 16, 840, 1, 101, 3, 4, 3, 23}); 1302| 0| case 0x9C818: ------------------ | Branch (1302:7): [True: 0, False: 49.4k] ------------------ 1303| 0| return if_match(req, "SLH-DSA-SHA2-192s", {2, 16, 840, 1, 101, 3, 4, 3, 22}); 1304| 0| case 0x9CD2B: ------------------ | Branch (1304:7): [True: 0, False: 49.4k] ------------------ 1305| 0| return if_match(req, "Scrypt", {1, 3, 6, 1, 4, 1, 11591, 4, 11}); 1306| 0| case 0x9CDE1: ------------------ | Branch (1306:7): [True: 0, False: 49.4k] ------------------ 1307| 0| return if_match(req, "GOST-34.10-2012-256/SHA-256", {1, 3, 6, 1, 4, 1, 25258, 1, 6, 1}); 1308| 0| case 0x9CF73: ------------------ | Branch (1308:7): [True: 0, False: 49.4k] ------------------ 1309| 0| return if_match(req, "ClassicMcEliece_460896f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 4}); 1310| 0| case 0x9D354: ------------------ | Branch (1310:7): [True: 0, False: 49.4k] ------------------ 1311| 0| return if_match(req, "RIPEMD-160", {1, 3, 36, 3, 2, 1}); 1312| 146| case 0x9D503: ------------------ | Branch (1312:7): [True: 146, False: 49.2k] ------------------ 1313| 146| return if_match(req, "RSA/PKCS1v15(SHA-256)", {1, 2, 840, 113549, 1, 1, 11}); 1314| 0| case 0x9EC88: ------------------ | Branch (1314:7): [True: 0, False: 49.4k] ------------------ 1315| 0| return if_match(req, "DSA/SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 3, 8}); 1316| 0| case 0x9EF36: ------------------ | Branch (1316:7): [True: 0, False: 49.4k] ------------------ 1317| 0| return if_match(req, "ClassicMcEliece_6960119", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 7}); 1318| 0| case 0x9F764: ------------------ | Branch (1318:7): [True: 0, False: 49.4k] ------------------ 1319| 0| return if_match(req, "X448", {1, 3, 101, 111}); 1320| 0| case 0x9F7E2: ------------------ | Branch (1320:7): [True: 0, False: 49.4k] ------------------ 1321| 0| return if_match(req, "AES-192/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 26}); 1322| 0| case 0x9F9C5: ------------------ | Branch (1322:7): [True: 0, False: 49.4k] ------------------ 1323| 0| return if_match(req, "ClassicMcEliece_6688128pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 2}); 1324| 0| case 0xA0805: ------------------ | Branch (1324:7): [True: 0, False: 49.4k] ------------------ 1325| 0| return if_match(req, "PKCS9.SDSICertificate", {1, 2, 840, 113549, 1, 9, 22, 2}); 1326| 0| case 0xA2B5B: ------------------ | Branch (1326:7): [True: 0, False: 49.4k] ------------------ 1327| 0| return if_match(req, "X509v3.CRLNumber", {2, 5, 29, 20}); 1328| 0| case 0xA3005: ------------------ | Branch (1328:7): [True: 0, False: 49.4k] ------------------ 1329| 0| return if_match(req, "X520.Title", {2, 5, 4, 12}); 1330| 0| case 0xA323F: ------------------ | Branch (1330:7): [True: 0, False: 49.4k] ------------------ 1331| 0| return if_match(req, "X509v3.NameConstraints", {2, 5, 29, 30}); 1332| 0| case 0xA3C55: ------------------ | Branch (1332:7): [True: 0, False: 49.4k] ------------------ 1333| 0| return if_match(req, "X520.Pseudonym", {2, 5, 4, 65}); 1334| 0| case 0xA4809: ------------------ | Branch (1334:7): [True: 0, False: 49.4k] ------------------ 1335| 0| return if_match(req, "SphincsPlus-sha2-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6}); 1336| 849| case 0xA57AF: ------------------ | Branch (1336:7): [True: 849, False: 48.5k] ------------------ 1337| 849| return if_match(req, "secp521r1", {1, 3, 132, 0, 35}); 1338| 0| case 0xA5DA9: ------------------ | Branch (1338:7): [True: 0, False: 49.4k] ------------------ 1339| 0| return if_match(req, "SphincsPlus-shake-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6}); 1340| 0| case 0xA6865: ------------------ | Branch (1340:7): [True: 0, False: 49.4k] ------------------ 1341| 0| return if_match(req, "Camellia-128/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 6}); 1342| 0| case 0xA6C61: ------------------ | Branch (1342:7): [True: 0, False: 49.4k] ------------------ 1343| 0| return if_match(req, "SM4/GCM", {1, 2, 156, 10197, 1, 104, 8}); 1344| 0| case 0xA8439: ------------------ | Branch (1344:7): [True: 0, False: 49.4k] ------------------ 1345| 0| return if_match(req, "PKCS12.CertBag", {1, 2, 840, 113549, 1, 12, 10, 1, 3}); 1346| 0| case 0xA9061: ------------------ | Branch (1346:7): [True: 0, False: 49.4k] ------------------ 1347| 0| return if_match(req, "Kyber-768-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 2}); 1348| 0| case 0xAA995: ------------------ | Branch (1348:7): [True: 0, False: 49.4k] ------------------ 1349| 0| return if_match(req, "Camellia-192/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 7}); 1350| 0| case 0xAAE2B: ------------------ | Branch (1350:7): [True: 0, False: 49.4k] ------------------ 1351| 0| return if_match(req, "Dilithium-8x7-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 3}); 1352| 0| case 0xABCED: ------------------ | Branch (1352:7): [True: 0, False: 49.4k] ------------------ 1353| 0| return if_match(req, "GOST.IssuerSigningTool", {1, 2, 643, 100, 112}); 1354| 0| case 0xABD24: ------------------ | Branch (1354:7): [True: 0, False: 49.4k] ------------------ 1355| 0| return if_match(req, "RSA/OAEP", {1, 2, 840, 113549, 1, 1, 7}); 1356| 0| case 0xAC2EC: ------------------ | Branch (1356:7): [True: 0, False: 49.4k] ------------------ 1357| 0| return if_match(req, "Streebog-256", {1, 2, 643, 7, 1, 1, 2, 2}); 1358| 0| case 0xAC3DD: ------------------ | Branch (1358:7): [True: 0, False: 49.4k] ------------------ 1359| 0| return if_match(req, "Certificate Comment", {2, 16, 840, 1, 113730, 1, 13}); 1360| 0| case 0xAC511: ------------------ | Branch (1360:7): [True: 0, False: 49.4k] ------------------ 1361| 0| return if_match(req, "PBE-SHA1-3DES", {1, 2, 840, 113549, 1, 12, 1, 3}); 1362| 0| case 0xAE6FE: ------------------ | Branch (1362:7): [True: 0, False: 49.4k] ------------------ 1363| 0| return if_match(req, "PKIX.ClientAuth", {1, 3, 6, 1, 5, 5, 7, 3, 2}); 1364| 0| case 0xAE8D3: ------------------ | Branch (1364:7): [True: 0, False: 49.4k] ------------------ 1365| 0| return if_match(req, "ClassicMcEliece_8192128pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 6}); 1366| 0| case 0xAF476: ------------------ | Branch (1366:7): [True: 0, False: 49.4k] ------------------ 1367| 0| return if_match(req, "ECDH", {1, 3, 132, 1, 12}); 1368| 0| case 0xAFA6A: ------------------ | Branch (1368:7): [True: 0, False: 49.4k] ------------------ 1369| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(384))", {2, 16, 840, 1, 101, 3, 4, 3, 15}); 1370| 0| case 0xB2217: ------------------ | Branch (1370:7): [True: 0, False: 49.4k] ------------------ 1371| 0| return if_match(req, "AES-256/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 3}); 1372| 0| case 0xB22F7: ------------------ | Branch (1372:7): [True: 0, False: 49.4k] ------------------ 1373| 0| return if_match(req, "Camellia-128/GCM", {0, 3, 4401, 5, 3, 1, 9, 6}); 1374| 0| case 0xB23DE: ------------------ | Branch (1374:7): [True: 0, False: 49.4k] ------------------ 1375| 0| return if_match(req, "X520.Locality", {2, 5, 4, 7}); 1376| 0| case 0xB2FBD: ------------------ | Branch (1376:7): [True: 0, False: 49.4k] ------------------ 1377| 0| return if_match(req, "ECKCDSA/SHA-224", {1, 2, 410, 200004, 1, 100, 4, 4}); 1378| 0| case 0xB32B0: ------------------ | Branch (1378:7): [True: 0, False: 49.4k] ------------------ 1379| 0| return if_match(req, "ECKCDSA/SHA-256", {1, 2, 410, 200004, 1, 100, 4, 5}); 1380| 0| case 0xB360E: ------------------ | Branch (1380:7): [True: 0, False: 49.4k] ------------------ 1381| 0| return if_match(req, "eFrodoKEM-976-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 2}); 1382| 0| case 0xB4368: ------------------ | Branch (1382:7): [True: 0, False: 49.4k] ------------------ 1383| 0| return if_match(req, "ECGDSA/SHA-1", {1, 3, 36, 3, 3, 2, 5, 4, 2}); 1384| 0| case 0xB58CD: ------------------ | Branch (1384:7): [True: 0, False: 49.4k] ------------------ 1385| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(512))", {2, 16, 840, 1, 101, 3, 4, 3, 16}); 1386| 0| case 0xB6427: ------------------ | Branch (1386:7): [True: 0, False: 49.4k] ------------------ 1387| 0| return if_match(req, "Camellia-192/GCM", {0, 3, 4401, 5, 3, 1, 9, 26}); 1388| 0| case 0xB7102: ------------------ | Branch (1388:7): [True: 0, False: 49.4k] ------------------ 1389| 0| return if_match(req, "brainpool224r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 5}); 1390| 0| case 0xB710D: ------------------ | Branch (1390:7): [True: 0, False: 49.4k] ------------------ 1391| 0| return if_match(req, "X509v3.CRLIssuingDistributionPoint", {2, 5, 29, 28}); 1392| 0| case 0xB72D4: ------------------ | Branch (1392:7): [True: 0, False: 49.4k] ------------------ 1393| 0| return if_match(req, "Microsoft UPN", {1, 3, 6, 1, 4, 1, 311, 20, 2, 3}); 1394| 10.3k| case 0xB73A5: ------------------ | Branch (1394:7): [True: 10.3k, False: 39.0k] ------------------ 1395| 10.3k| return if_match(req, "RSA/PSS", {1, 2, 840, 113549, 1, 1, 10}); 1396| 0| case 0xB84B3: ------------------ | Branch (1396:7): [True: 0, False: 49.4k] ------------------ 1397| 0| return if_match(req, "PKIX.CodeSigning", {1, 3, 6, 1, 5, 5, 7, 3, 3}); 1398| 0| case 0xB8CB9: ------------------ | Branch (1398:7): [True: 0, False: 49.4k] ------------------ 1399| 0| return if_match(req, "GOST-34.10-2012-256", {1, 2, 643, 7, 1, 1, 1, 1}); 1400| 0| case 0xB945C: ------------------ | Branch (1400:7): [True: 0, False: 49.4k] ------------------ 1401| 0| return if_match(req, "Twofish/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 5}); 1402| 0| case 0xB94E4: ------------------ | Branch (1402:7): [True: 0, False: 49.4k] ------------------ 1403| 0| return if_match(req, "gost_512A", {1, 2, 643, 7, 1, 2, 1, 2, 1}); 1404| 0| case 0xB94E5: ------------------ | Branch (1404:7): [True: 0, False: 49.4k] ------------------ 1405| 0| return if_match(req, "gost_512B", {1, 2, 643, 7, 1, 2, 1, 2, 2}); 1406| 0| case 0xBA1D8: ------------------ | Branch (1406:7): [True: 0, False: 49.4k] ------------------ 1407| 0| return if_match(req, "X520.StreetAddress", {2, 5, 4, 9}); 1408| 0| case 0xBCB45: ------------------ | Branch (1408:7): [True: 0, False: 49.4k] ------------------ 1409| 0| return if_match(req, "PKCS12.CRLBag", {1, 2, 840, 113549, 1, 12, 10, 1, 4}); 1410| 0| case 0xBCC82: ------------------ | Branch (1410:7): [True: 0, False: 49.4k] ------------------ 1411| 0| return if_match(req, "x962_p239v1", {1, 2, 840, 10045, 3, 1, 4}); 1412| 0| case 0xBCC83: ------------------ | Branch (1412:7): [True: 0, False: 49.4k] ------------------ 1413| 0| return if_match(req, "x962_p239v2", {1, 2, 840, 10045, 3, 1, 5}); 1414| 0| case 0xBCC84: ------------------ | Branch (1414:7): [True: 0, False: 49.4k] ------------------ 1415| 0| return if_match(req, "x962_p239v3", {1, 2, 840, 10045, 3, 1, 6}); 1416| 0| case 0xBD92B: ------------------ | Branch (1416:7): [True: 0, False: 49.4k] ------------------ 1417| 0| return if_match(req, "X509v3.HoldInstructionCode", {2, 5, 29, 23}); 1418| 0| case 0xBDCA9: ------------------ | Branch (1418:7): [True: 0, False: 49.4k] ------------------ 1419| 0| return if_match(req, "AES-256/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 46}); 1420| 0| case 0xBE48D: ------------------ | Branch (1420:7): [True: 0, False: 49.4k] ------------------ 1421| 0| return if_match(req, "PKIX.OCSP.BasicResponse", {1, 3, 6, 1, 5, 5, 7, 48, 1, 1}); 1422| 0| case 0xBF71E: ------------------ | Branch (1422:7): [True: 0, False: 49.4k] ------------------ 1423| 0| return if_match(req, "Kyber-1024-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 3}); 1424| 0| case 0xBFF01: ------------------ | Branch (1424:7): [True: 0, False: 49.4k] ------------------ 1425| 0| return if_match(req, "DSA/SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 3, 5}); 1426| 0| case 0xC0F4F: ------------------ | Branch (1426:7): [True: 0, False: 49.4k] ------------------ 1427| 0| return if_match(req, "SphincsPlus-haraka-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6}); 1428| 0| case 0xC1875: ------------------ | Branch (1428:7): [True: 0, False: 49.4k] ------------------ 1429| 0| return if_match(req, "SHA-1", {1, 3, 14, 3, 2, 26}); 1430| 0| case 0xC28D1: ------------------ | Branch (1430:7): [True: 0, False: 49.4k] ------------------ 1431| 0| return if_match(req, "PKIX.OCSPSigning", {1, 3, 6, 1, 5, 5, 7, 3, 9}); 1432| 1.33k| case 0xC42CA: ------------------ | Branch (1432:7): [True: 1.33k, False: 48.1k] ------------------ 1433| 1.33k| return if_match(req, "brainpool256r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 7}); 1434| 0| default: ------------------ | Branch (1434:7): [True: 0, False: 49.4k] ------------------ 1435| 0| return {}; 1436| 49.4k| } 1437| 49.4k|} _ZN5Botan7OID_Map16load_oid2str_mapEv: 1439| 1|std::unordered_map OID_Map::load_oid2str_map() { 1440| 1| return { 1441| 1| {OID{2, 5, 8, 1, 1}, "RSA"}, 1442| 1| {OID{1, 3, 6, 1, 4, 1, 8301, 3, 1, 2, 9, 0, 38}, "secp521r1"}, 1443| 1| {OID{1, 2, 643, 2, 2, 35, 1}, "gost_256A"}, 1444| 1| {OID{1, 2, 643, 2, 2, 36, 0}, "gost_256A"}, 1445| 1| }; 1446| 1|} _ZN5Botan7OID_Map16load_str2oid_mapEv: 1448| 1|std::unordered_map OID_Map::load_str2oid_map() { 1449| 1| return { 1450| 1| {"Curve25519", OID{1, 3, 101, 110}}, 1451| 1| {"SM2_Sig", OID{1, 2, 156, 10197, 1, 301, 1}}, 1452| 1| {"RSA/EMSA3(MD2)", OID{1, 2, 840, 113549, 1, 1, 2}}, 1453| 1| {"RSA/EMSA3(MD5)", OID{1, 2, 840, 113549, 1, 1, 4}}, 1454| 1| {"RSA/EMSA3(SHA-1)", OID{1, 2, 840, 113549, 1, 1, 5}}, 1455| 1| {"RSA/EMSA3(SHA-256)", OID{1, 2, 840, 113549, 1, 1, 11}}, 1456| 1| {"RSA/EMSA3(SHA-384)", OID{1, 2, 840, 113549, 1, 1, 12}}, 1457| 1| {"RSA/EMSA3(SHA-512)", OID{1, 2, 840, 113549, 1, 1, 13}}, 1458| 1| {"RSA/EMSA3(SHA-224)", OID{1, 2, 840, 113549, 1, 1, 14}}, 1459| 1| {"RSA/EMSA3(SHA-512-256)", OID{1, 2, 840, 113549, 1, 1, 16}}, 1460| 1| {"RSA/EMSA3(SHA-3(224))", OID{2, 16, 840, 1, 101, 3, 4, 3, 13}}, 1461| 1| {"RSA/EMSA3(SHA-3(256))", OID{2, 16, 840, 1, 101, 3, 4, 3, 14}}, 1462| 1| {"RSA/EMSA3(SHA-3(384))", OID{2, 16, 840, 1, 101, 3, 4, 3, 15}}, 1463| 1| {"RSA/EMSA3(SHA-3(512))", OID{2, 16, 840, 1, 101, 3, 4, 3, 16}}, 1464| 1| {"RSA/EMSA3(SM3)", OID{1, 2, 156, 10197, 1, 504}}, 1465| 1| {"RSA/EMSA3(RIPEMD-160)", OID{1, 3, 36, 3, 3, 1, 2}}, 1466| 1| {"RSA/EMSA4", OID{1, 2, 840, 113549, 1, 1, 10}}, 1467| 1| {"PBES2", OID{1, 2, 840, 113549, 1, 5, 13}}, 1468| 1| }; 1469| 1|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_18if_matchERKNS_3OIDESt16initializer_listIjENSt3__117basic_string_viewIcNS6_11char_traitsIcEEEE: 18| 12.5k|std::optional if_match(const OID& oid, std::initializer_list val, std::string_view name) { 19| 12.5k| if(oid.matches(val)) { ------------------ | Branch (19:7): [True: 12.5k, False: 0] ------------------ 20| 12.5k| return name; 21| 12.5k| } else { 22| 0| return {}; 23| 0| } 24| 12.5k|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_113hash_oid_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 34| 49.4k|uint32_t hash_oid_name(std::string_view s) { 35| 49.4k| uint64_t hash = 0x8188B31879A4879A; 36| | 37| 474k| for(const char c : s) { ------------------ | Branch (37:21): [True: 474k, False: 49.4k] ------------------ 38| 474k| hash *= 251; 39| 474k| hash += c; 40| 474k| } 41| | 42| 49.4k| return static_cast(hash % 805289); 43| 49.4k|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_18if_matchENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_St16initializer_listIjE: 26| 49.4k|std::optional if_match(std::string_view req, std::string_view actual, std::initializer_list oid) { 27| 49.4k| if(req == actual) { ------------------ | Branch (27:7): [True: 49.4k, False: 0] ------------------ 28| 49.4k| return OID(oid); 29| 49.4k| } else { 30| 0| return {}; 31| 0| } 32| 49.4k|} _ZN5Botan20Buffered_Computation5finalENSt3__14spanIhLm18446744073709551615EEE: 54| 58.9k|void Buffered_Computation::final(std::span out) { 55| 58.9k| BOTAN_ARG_CHECK(out.size() >= output_length(), "Output buffer has insufficient capacity"); ------------------ | | 35| 58.9k| do { \ | | 36| 58.9k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 58.9k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 58.9k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 58.9k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 58.9k] | | ------------------ ------------------ 56| | // Pass exactly output_length() bytes so that an oversized buffer has the 57| | // result written to its leading bytes with the remainder left untouched. 58| 58.9k| final_result(out.first(output_length())); 59| 58.9k|} _ZN5Botan18SymmetricAlgorithm7set_keyENSt3__14spanIKhLm18446744073709551615EEE: 22| 4.68k|void SymmetricAlgorithm::set_key(std::span key) { 23| 4.68k| if(!valid_keylength(key.size())) { ------------------ | Branch (23:7): [True: 0, False: 4.68k] ------------------ 24| 0| throw Invalid_Key_Length(name(), key.size()); 25| 0| } 26| 4.68k| key_schedule(key); 27| 4.68k|} _ZN5Botan11OctetStringC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 27| 2.15k|OctetString::OctetString(std::string_view hex_string) { 28| 2.15k| if(!hex_string.empty()) { ------------------ | Branch (28:7): [True: 0, False: 2.15k] ------------------ 29| 0| m_data.resize(1 + hex_string.length() / 2); 30| 0| m_data.resize(hex_decode(m_data.data(), hex_string)); 31| 0| } 32| 2.15k|} _ZNK5Botan7AES_12811parallelismEv: 807| 106|size_t AES_128::parallelism() const { 808| 106| return aes_parallelism(); 809| 106|} _ZNK5Botan7AES_25611parallelismEv: 815| 441|size_t AES_256::parallelism() const { 816| 441| return aes_parallelism(); 817| 441|} _ZNK5Botan7AES_12819has_keying_materialEv: 819| 4.33k|bool AES_128::has_keying_material() const { 820| 4.33k| return !m_EK.empty(); 821| 4.33k|} _ZNK5Botan7AES_25619has_keying_materialEv: 827| 2.21k|bool AES_256::has_keying_material() const { 828| 2.21k| return !m_EK.empty(); 829| 2.21k|} _ZNK5Botan7AES_1289encrypt_nEPKhPhm: 831| 3.99k|void AES_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 832| 3.99k| assert_key_material_set(); 833| | 834| 3.99k|#if defined(BOTAN_HAS_AES_VAES) 835| 3.99k| if(CPUID::has(CPUID::Feature::AVX2_AES)) { ------------------ | Branch (835:7): [True: 0, False: 3.99k] ------------------ 836| 0| return x86_vaes_encrypt_n(in, out, blocks); 837| 0| } 838| 3.99k|#endif 839| | 840| 3.99k|#if defined(BOTAN_HAS_HW_AES_SUPPORT) 841| 3.99k| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (841:7): [True: 3.99k, False: 0] ------------------ 842| 3.99k| return hw_aes_encrypt_n(in, out, blocks); 843| 3.99k| } 844| 0|#endif 845| | 846| 0|#if defined(BOTAN_HAS_AES_VPERM) 847| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (847:7): [True: 0, False: 0] ------------------ 848| 0| return vperm_encrypt_n(in, out, blocks); 849| 0| } 850| 0|#endif 851| | 852| 0| aes_encrypt_n(in, out, blocks, m_EK); 853| 0|} _ZNK5Botan7AES_1289decrypt_nEPKhPhm: 855| 141|void AES_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 856| 141| assert_key_material_set(); 857| | 858| 141|#if defined(BOTAN_HAS_AES_VAES) 859| 141| if(CPUID::has(CPUID::Feature::AVX2_AES)) { ------------------ | Branch (859:7): [True: 0, False: 141] ------------------ 860| 0| return x86_vaes_decrypt_n(in, out, blocks); 861| 0| } 862| 141|#endif 863| | 864| 141|#if defined(BOTAN_HAS_HW_AES_SUPPORT) 865| 141| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (865:7): [True: 141, False: 0] ------------------ 866| 141| return hw_aes_decrypt_n(in, out, blocks); 867| 141| } 868| 0|#endif 869| | 870| 0|#if defined(BOTAN_HAS_AES_VPERM) 871| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (871:7): [True: 0, False: 0] ------------------ 872| 0| return vperm_decrypt_n(in, out, blocks); 873| 0| } 874| 0|#endif 875| | 876| 0| aes_decrypt_n(in, out, blocks, m_DK); 877| 0|} _ZN5Botan7AES_12812key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 879| 131|void AES_128::key_schedule(std::span key) { 880| 131|#if defined(BOTAN_HAS_AES_NI) 881| 131| if(CPUID::has(CPUID::Feature::AESNI)) { ------------------ | Branch (881:7): [True: 131, False: 0] ------------------ 882| 131| return aesni_key_schedule(key.data(), key.size()); 883| 131| } 884| 0|#endif 885| | 886| 0|#if defined(BOTAN_HAS_AES_VAES) 887| 0| if(CPUID::has(CPUID::Feature::AVX2_AES)) { ------------------ | Branch (887:7): [True: 0, False: 0] ------------------ 888| 0| return aes_key_schedule(key.data(), key.size(), m_EK, m_DK, true); 889| 0| } 890| 0|#endif 891| | 892| 0|#if defined(BOTAN_HAS_HW_AES_SUPPORT) 893| 0| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (893:7): [True: 0, False: 0] ------------------ 894| 0| constexpr bool is_little_endian = std::endian::native == std::endian::little; 895| 0| return aes_key_schedule(key.data(), key.size(), m_EK, m_DK, is_little_endian); 896| 0| } 897| 0|#endif 898| | 899| 0|#if defined(BOTAN_HAS_AES_VPERM) 900| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (900:7): [True: 0, False: 0] ------------------ 901| 0| return vperm_key_schedule(key.data(), key.size()); 902| 0| } 903| 0|#endif 904| | 905| 0| aes_key_schedule(key.data(), key.size(), m_EK, m_DK); 906| 0|} _ZNK5Botan7AES_2569encrypt_nEPKhPhm: 995| 1.02k|void AES_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 996| 1.02k| assert_key_material_set(); 997| | 998| 1.02k|#if defined(BOTAN_HAS_AES_VAES) 999| 1.02k| if(CPUID::has(CPUID::Feature::AVX2_AES)) { ------------------ | Branch (999:7): [True: 0, False: 1.02k] ------------------ 1000| 0| return x86_vaes_encrypt_n(in, out, blocks); 1001| 0| } 1002| 1.02k|#endif 1003| | 1004| 1.02k|#if defined(BOTAN_HAS_HW_AES_SUPPORT) 1005| 1.02k| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (1005:7): [True: 1.02k, False: 0] ------------------ 1006| 1.02k| return hw_aes_encrypt_n(in, out, blocks); 1007| 1.02k| } 1008| 0|#endif 1009| | 1010| 0|#if defined(BOTAN_HAS_AES_VPERM) 1011| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (1011:7): [True: 0, False: 0] ------------------ 1012| 0| return vperm_encrypt_n(in, out, blocks); 1013| 0| } 1014| 0|#endif 1015| | 1016| 0| aes_encrypt_n(in, out, blocks, m_EK); 1017| 0|} _ZNK5Botan7AES_2569decrypt_nEPKhPhm: 1019| 448|void AES_256::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 1020| 448| assert_key_material_set(); 1021| | 1022| 448|#if defined(BOTAN_HAS_AES_VAES) 1023| 448| if(CPUID::has(CPUID::Feature::AVX2_AES)) { ------------------ | Branch (1023:7): [True: 0, False: 448] ------------------ 1024| 0| return x86_vaes_decrypt_n(in, out, blocks); 1025| 0| } 1026| 448|#endif 1027| | 1028| 448|#if defined(BOTAN_HAS_HW_AES_SUPPORT) 1029| 448| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (1029:7): [True: 448, False: 0] ------------------ 1030| 448| return hw_aes_decrypt_n(in, out, blocks); 1031| 448| } 1032| 0|#endif 1033| | 1034| 0|#if defined(BOTAN_HAS_AES_VPERM) 1035| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (1035:7): [True: 0, False: 0] ------------------ 1036| 0| return vperm_decrypt_n(in, out, blocks); 1037| 0| } 1038| 0|#endif 1039| | 1040| 0| aes_decrypt_n(in, out, blocks, m_DK); 1041| 0|} _ZN5Botan7AES_25612key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 1043| 237|void AES_256::key_schedule(std::span key) { 1044| 237|#if defined(BOTAN_HAS_AES_NI) 1045| 237| if(CPUID::has(CPUID::Feature::AESNI)) { ------------------ | Branch (1045:7): [True: 237, False: 0] ------------------ 1046| 237| return aesni_key_schedule(key.data(), key.size()); 1047| 237| } 1048| 0|#endif 1049| | 1050| 0|#if defined(BOTAN_HAS_AES_VAES) 1051| 0| if(CPUID::has(CPUID::Feature::AVX2_AES)) { ------------------ | Branch (1051:7): [True: 0, False: 0] ------------------ 1052| 0| return aes_key_schedule(key.data(), key.size(), m_EK, m_DK, true); 1053| 0| } 1054| 0|#endif 1055| | 1056| 0|#if defined(BOTAN_HAS_HW_AES_SUPPORT) 1057| 0| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (1057:7): [True: 0, False: 0] ------------------ 1058| 0| constexpr bool is_little_endian = std::endian::native == std::endian::little; 1059| 0| return aes_key_schedule(key.data(), key.size(), m_EK, m_DK, is_little_endian); 1060| 0| } 1061| 0|#endif 1062| | 1063| 0|#if defined(BOTAN_HAS_AES_VPERM) 1064| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (1064:7): [True: 0, False: 0] ------------------ 1065| 0| return vperm_key_schedule(key.data(), key.size()); 1066| 0| } 1067| 0|#endif 1068| | 1069| 0| aes_key_schedule(key.data(), key.size(), m_EK, m_DK); 1070| 0|} aes.cpp:_ZN5Botan12_GLOBAL__N_115aes_parallelismEv: 748| 547|size_t aes_parallelism() { 749| 547|#if defined(BOTAN_HAS_AES_VAES) 750| 547| if(CPUID::has(CPUID::Feature::AVX2_AES)) { ------------------ | Branch (750:7): [True: 0, False: 547] ------------------ 751| 0| return 8; // pipelined 752| 0| } 753| 547|#endif 754| | 755| 547|#if defined(BOTAN_HAS_HW_AES_SUPPORT) 756| 547| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (756:7): [True: 547, False: 0] ------------------ 757| 547| return 4; // pipelined 758| 547| } 759| 0|#endif 760| | 761| 0|#if defined(BOTAN_HAS_AES_VPERM) 762| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (762:7): [True: 0, False: 0] ------------------ 763| 0| return 2; // pipelined 764| 0| } 765| 0|#endif 766| | 767| | // bitsliced: 768| 0| return 2; 769| 0|} _ZNK5Botan7AES_12816hw_aes_encrypt_nEPKhPhm: 135| 3.99k|BOTAN_FN_ISA_AESNI void AES_128::hw_aes_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 136| 3.99k| const SIMD_4x32 K0 = SIMD_4x32::load_le(&m_EK[4 * 0]); 137| 3.99k| const SIMD_4x32 K1 = SIMD_4x32::load_le(&m_EK[4 * 1]); 138| 3.99k| const SIMD_4x32 K2 = SIMD_4x32::load_le(&m_EK[4 * 2]); 139| 3.99k| const SIMD_4x32 K3 = SIMD_4x32::load_le(&m_EK[4 * 3]); 140| 3.99k| const SIMD_4x32 K4 = SIMD_4x32::load_le(&m_EK[4 * 4]); 141| 3.99k| const SIMD_4x32 K5 = SIMD_4x32::load_le(&m_EK[4 * 5]); 142| 3.99k| const SIMD_4x32 K6 = SIMD_4x32::load_le(&m_EK[4 * 6]); 143| 3.99k| const SIMD_4x32 K7 = SIMD_4x32::load_le(&m_EK[4 * 7]); 144| 3.99k| const SIMD_4x32 K8 = SIMD_4x32::load_le(&m_EK[4 * 8]); 145| 3.99k| const SIMD_4x32 K9 = SIMD_4x32::load_le(&m_EK[4 * 9]); 146| 3.99k| const SIMD_4x32 K10 = SIMD_4x32::load_le(&m_EK[4 * 10]); 147| | 148| 4.64k| while(blocks >= 4) { ------------------ | Branch (148:10): [True: 652, False: 3.99k] ------------------ 149| 652| SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * 0); 150| 652| SIMD_4x32 B1 = SIMD_4x32::load_le(in + 16 * 1); 151| 652| SIMD_4x32 B2 = SIMD_4x32::load_le(in + 16 * 2); 152| 652| SIMD_4x32 B3 = SIMD_4x32::load_le(in + 16 * 3); 153| | 154| 652| keyxor(K0, B0, B1, B2, B3); 155| 652| aesenc(K1, B0, B1, B2, B3); 156| 652| aesenc(K2, B0, B1, B2, B3); 157| 652| aesenc(K3, B0, B1, B2, B3); 158| 652| aesenc(K4, B0, B1, B2, B3); 159| 652| aesenc(K5, B0, B1, B2, B3); 160| 652| aesenc(K6, B0, B1, B2, B3); 161| 652| aesenc(K7, B0, B1, B2, B3); 162| 652| aesenc(K8, B0, B1, B2, B3); 163| 652| aesenc(K9, B0, B1, B2, B3); 164| 652| aesenclast(K10, B0, B1, B2, B3); 165| | 166| 652| B0.store_le(out + 16 * 0); 167| 652| B1.store_le(out + 16 * 1); 168| 652| B2.store_le(out + 16 * 2); 169| 652| B3.store_le(out + 16 * 3); 170| | 171| 652| blocks -= 4; 172| 652| in += 4 * 16; 173| 652| out += 4 * 16; 174| 652| } 175| | 176| 7.82k| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (176:22): [True: 3.83k, False: 3.99k] ------------------ 177| 3.83k| SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * i); 178| | 179| 3.83k| B0 ^= K0; 180| 3.83k| aesenc(K1, B0); 181| 3.83k| aesenc(K2, B0); 182| 3.83k| aesenc(K3, B0); 183| 3.83k| aesenc(K4, B0); 184| 3.83k| aesenc(K5, B0); 185| 3.83k| aesenc(K6, B0); 186| 3.83k| aesenc(K7, B0); 187| 3.83k| aesenc(K8, B0); 188| 3.83k| aesenc(K9, B0); 189| 3.83k| aesenclast(K10, B0); 190| | 191| 3.83k| B0.store_le(out + 16 * i); 192| 3.83k| } 193| 3.99k|} _ZNK5Botan7AES_12816hw_aes_decrypt_nEPKhPhm: 198| 141|BOTAN_FN_ISA_AESNI void AES_128::hw_aes_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 199| 141| const SIMD_4x32 K0 = SIMD_4x32::load_le(&m_DK[4 * 0]); 200| 141| const SIMD_4x32 K1 = SIMD_4x32::load_le(&m_DK[4 * 1]); 201| 141| const SIMD_4x32 K2 = SIMD_4x32::load_le(&m_DK[4 * 2]); 202| 141| const SIMD_4x32 K3 = SIMD_4x32::load_le(&m_DK[4 * 3]); 203| 141| const SIMD_4x32 K4 = SIMD_4x32::load_le(&m_DK[4 * 4]); 204| 141| const SIMD_4x32 K5 = SIMD_4x32::load_le(&m_DK[4 * 5]); 205| 141| const SIMD_4x32 K6 = SIMD_4x32::load_le(&m_DK[4 * 6]); 206| 141| const SIMD_4x32 K7 = SIMD_4x32::load_le(&m_DK[4 * 7]); 207| 141| const SIMD_4x32 K8 = SIMD_4x32::load_le(&m_DK[4 * 8]); 208| 141| const SIMD_4x32 K9 = SIMD_4x32::load_le(&m_DK[4 * 9]); 209| 141| const SIMD_4x32 K10 = SIMD_4x32::load_le(&m_DK[4 * 10]); 210| | 211| 638| while(blocks >= 4) { ------------------ | Branch (211:10): [True: 497, False: 141] ------------------ 212| 497| SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * 0); 213| 497| SIMD_4x32 B1 = SIMD_4x32::load_le(in + 16 * 1); 214| 497| SIMD_4x32 B2 = SIMD_4x32::load_le(in + 16 * 2); 215| 497| SIMD_4x32 B3 = SIMD_4x32::load_le(in + 16 * 3); 216| | 217| 497| keyxor(K0, B0, B1, B2, B3); 218| 497| aesdec(K1, B0, B1, B2, B3); 219| 497| aesdec(K2, B0, B1, B2, B3); 220| 497| aesdec(K3, B0, B1, B2, B3); 221| 497| aesdec(K4, B0, B1, B2, B3); 222| 497| aesdec(K5, B0, B1, B2, B3); 223| 497| aesdec(K6, B0, B1, B2, B3); 224| 497| aesdec(K7, B0, B1, B2, B3); 225| 497| aesdec(K8, B0, B1, B2, B3); 226| 497| aesdec(K9, B0, B1, B2, B3); 227| 497| aesdeclast(K10, B0, B1, B2, B3); 228| | 229| 497| B0.store_le(out + 16 * 0); 230| 497| B1.store_le(out + 16 * 1); 231| 497| B2.store_le(out + 16 * 2); 232| 497| B3.store_le(out + 16 * 3); 233| | 234| 497| blocks -= 4; 235| 497| in += 4 * 16; 236| 497| out += 4 * 16; 237| 497| } 238| | 239| 181| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (239:22): [True: 40, False: 141] ------------------ 240| 40| SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * i); 241| | 242| 40| B0 ^= K0; 243| 40| aesdec(K1, B0); 244| 40| aesdec(K2, B0); 245| 40| aesdec(K3, B0); 246| 40| aesdec(K4, B0); 247| 40| aesdec(K5, B0); 248| 40| aesdec(K6, B0); 249| 40| aesdec(K7, B0); 250| 40| aesdec(K8, B0); 251| 40| aesdec(K9, B0); 252| 40| aesdeclast(K10, B0); 253| | 254| 40| B0.store_le(out + 16 * i); 255| 40| } 256| 141|} _ZN5Botan7AES_12818aesni_key_scheduleEPKhm: 261| 131|BOTAN_FN_ISA_AESNI void AES_128::aesni_key_schedule(const uint8_t key[], size_t /*length*/) { 262| 131| m_EK.resize(44); 263| 131| m_DK.resize(44); 264| | 265| 131| const SIMD_4x32 K0 = SIMD_4x32::load_le(key); 266| 131| const SIMD_4x32 K1 = aes_128_key_expansion<0x01>(K0, K0); 267| 131| const SIMD_4x32 K2 = aes_128_key_expansion<0x02>(K1, K1); 268| 131| const SIMD_4x32 K3 = aes_128_key_expansion<0x04>(K2, K2); 269| 131| const SIMD_4x32 K4 = aes_128_key_expansion<0x08>(K3, K3); 270| 131| const SIMD_4x32 K5 = aes_128_key_expansion<0x10>(K4, K4); 271| 131| const SIMD_4x32 K6 = aes_128_key_expansion<0x20>(K5, K5); 272| 131| const SIMD_4x32 K7 = aes_128_key_expansion<0x40>(K6, K6); 273| 131| const SIMD_4x32 K8 = aes_128_key_expansion<0x80>(K7, K7); 274| 131| const SIMD_4x32 K9 = aes_128_key_expansion<0x1B>(K8, K8); 275| 131| const SIMD_4x32 K10 = aes_128_key_expansion<0x36>(K9, K9); 276| | 277| 131| K0.store_le(&m_EK[4 * 0]); 278| 131| K1.store_le(&m_EK[4 * 1]); 279| 131| K2.store_le(&m_EK[4 * 2]); 280| 131| K3.store_le(&m_EK[4 * 3]); 281| 131| K4.store_le(&m_EK[4 * 4]); 282| 131| K5.store_le(&m_EK[4 * 5]); 283| 131| K6.store_le(&m_EK[4 * 6]); 284| 131| K7.store_le(&m_EK[4 * 7]); 285| 131| K8.store_le(&m_EK[4 * 8]); 286| 131| K9.store_le(&m_EK[4 * 9]); 287| 131| K10.store_le(&m_EK[4 * 10]); 288| | 289| | // Now generate decryption keys 290| 131| K10.store_le(&m_DK[4 * 0]); 291| 131| aesimc(K9).store_le(&m_DK[4 * 1]); 292| 131| aesimc(K8).store_le(&m_DK[4 * 2]); 293| 131| aesimc(K7).store_le(&m_DK[4 * 3]); 294| 131| aesimc(K6).store_le(&m_DK[4 * 4]); 295| 131| aesimc(K5).store_le(&m_DK[4 * 5]); 296| 131| aesimc(K4).store_le(&m_DK[4 * 6]); 297| 131| aesimc(K3).store_le(&m_DK[4 * 7]); 298| 131| aesimc(K2).store_le(&m_DK[4 * 8]); 299| 131| aesimc(K1).store_le(&m_DK[4 * 9]); 300| 131| K0.store_le(&m_DK[4 * 10]); 301| 131|} _ZNK5Botan7AES_25616hw_aes_encrypt_nEPKhPhm: 483| 1.02k|BOTAN_FN_ISA_AESNI void AES_256::hw_aes_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 484| 1.02k| const SIMD_4x32 K0 = SIMD_4x32::load_le(&m_EK[4 * 0]); 485| 1.02k| const SIMD_4x32 K1 = SIMD_4x32::load_le(&m_EK[4 * 1]); 486| 1.02k| const SIMD_4x32 K2 = SIMD_4x32::load_le(&m_EK[4 * 2]); 487| 1.02k| const SIMD_4x32 K3 = SIMD_4x32::load_le(&m_EK[4 * 3]); 488| 1.02k| const SIMD_4x32 K4 = SIMD_4x32::load_le(&m_EK[4 * 4]); 489| 1.02k| const SIMD_4x32 K5 = SIMD_4x32::load_le(&m_EK[4 * 5]); 490| 1.02k| const SIMD_4x32 K6 = SIMD_4x32::load_le(&m_EK[4 * 6]); 491| 1.02k| const SIMD_4x32 K7 = SIMD_4x32::load_le(&m_EK[4 * 7]); 492| 1.02k| const SIMD_4x32 K8 = SIMD_4x32::load_le(&m_EK[4 * 8]); 493| 1.02k| const SIMD_4x32 K9 = SIMD_4x32::load_le(&m_EK[4 * 9]); 494| 1.02k| const SIMD_4x32 K10 = SIMD_4x32::load_le(&m_EK[4 * 10]); 495| 1.02k| const SIMD_4x32 K11 = SIMD_4x32::load_le(&m_EK[4 * 11]); 496| 1.02k| const SIMD_4x32 K12 = SIMD_4x32::load_le(&m_EK[4 * 12]); 497| 1.02k| const SIMD_4x32 K13 = SIMD_4x32::load_le(&m_EK[4 * 13]); 498| 1.02k| const SIMD_4x32 K14 = SIMD_4x32::load_le(&m_EK[4 * 14]); 499| | 500| 2.84k| while(blocks >= 4) { ------------------ | Branch (500:10): [True: 1.82k, False: 1.02k] ------------------ 501| 1.82k| SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * 0); 502| 1.82k| SIMD_4x32 B1 = SIMD_4x32::load_le(in + 16 * 1); 503| 1.82k| SIMD_4x32 B2 = SIMD_4x32::load_le(in + 16 * 2); 504| 1.82k| SIMD_4x32 B3 = SIMD_4x32::load_le(in + 16 * 3); 505| | 506| 1.82k| keyxor(K0, B0, B1, B2, B3); 507| 1.82k| aesenc(K1, B0, B1, B2, B3); 508| 1.82k| aesenc(K2, B0, B1, B2, B3); 509| 1.82k| aesenc(K3, B0, B1, B2, B3); 510| 1.82k| aesenc(K4, B0, B1, B2, B3); 511| 1.82k| aesenc(K5, B0, B1, B2, B3); 512| 1.82k| aesenc(K6, B0, B1, B2, B3); 513| 1.82k| aesenc(K7, B0, B1, B2, B3); 514| 1.82k| aesenc(K8, B0, B1, B2, B3); 515| 1.82k| aesenc(K9, B0, B1, B2, B3); 516| 1.82k| aesenc(K10, B0, B1, B2, B3); 517| 1.82k| aesenc(K11, B0, B1, B2, B3); 518| 1.82k| aesenc(K12, B0, B1, B2, B3); 519| 1.82k| aesenc(K13, B0, B1, B2, B3); 520| 1.82k| aesenclast(K14, B0, B1, B2, B3); 521| | 522| 1.82k| B0.store_le(out + 16 * 0); 523| 1.82k| B1.store_le(out + 16 * 1); 524| 1.82k| B2.store_le(out + 16 * 2); 525| 1.82k| B3.store_le(out + 16 * 3); 526| | 527| 1.82k| blocks -= 4; 528| 1.82k| in += 4 * 16; 529| 1.82k| out += 4 * 16; 530| 1.82k| } 531| | 532| 1.58k| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (532:22): [True: 565, False: 1.02k] ------------------ 533| 565| SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * i); 534| | 535| 565| B0 ^= K0; 536| | 537| 565| aesenc(K1, B0); 538| 565| aesenc(K2, B0); 539| 565| aesenc(K3, B0); 540| 565| aesenc(K4, B0); 541| 565| aesenc(K5, B0); 542| 565| aesenc(K6, B0); 543| 565| aesenc(K7, B0); 544| 565| aesenc(K8, B0); 545| 565| aesenc(K9, B0); 546| 565| aesenc(K10, B0); 547| 565| aesenc(K11, B0); 548| 565| aesenc(K12, B0); 549| 565| aesenc(K13, B0); 550| 565| aesenclast(K14, B0); 551| | 552| 565| B0.store_le(out + 16 * i); 553| 565| } 554| 1.02k|} _ZNK5Botan7AES_25616hw_aes_decrypt_nEPKhPhm: 559| 448|BOTAN_FN_ISA_AESNI void AES_256::hw_aes_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 560| 448| const SIMD_4x32 K0 = SIMD_4x32::load_le(&m_DK[4 * 0]); 561| 448| const SIMD_4x32 K1 = SIMD_4x32::load_le(&m_DK[4 * 1]); 562| 448| const SIMD_4x32 K2 = SIMD_4x32::load_le(&m_DK[4 * 2]); 563| 448| const SIMD_4x32 K3 = SIMD_4x32::load_le(&m_DK[4 * 3]); 564| 448| const SIMD_4x32 K4 = SIMD_4x32::load_le(&m_DK[4 * 4]); 565| 448| const SIMD_4x32 K5 = SIMD_4x32::load_le(&m_DK[4 * 5]); 566| 448| const SIMD_4x32 K6 = SIMD_4x32::load_le(&m_DK[4 * 6]); 567| 448| const SIMD_4x32 K7 = SIMD_4x32::load_le(&m_DK[4 * 7]); 568| 448| const SIMD_4x32 K8 = SIMD_4x32::load_le(&m_DK[4 * 8]); 569| 448| const SIMD_4x32 K9 = SIMD_4x32::load_le(&m_DK[4 * 9]); 570| 448| const SIMD_4x32 K10 = SIMD_4x32::load_le(&m_DK[4 * 10]); 571| 448| const SIMD_4x32 K11 = SIMD_4x32::load_le(&m_DK[4 * 11]); 572| 448| const SIMD_4x32 K12 = SIMD_4x32::load_le(&m_DK[4 * 12]); 573| 448| const SIMD_4x32 K13 = SIMD_4x32::load_le(&m_DK[4 * 13]); 574| 448| const SIMD_4x32 K14 = SIMD_4x32::load_le(&m_DK[4 * 14]); 575| | 576| 2.02k| while(blocks >= 4) { ------------------ | Branch (576:10): [True: 1.58k, False: 448] ------------------ 577| 1.58k| SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * 0); 578| 1.58k| SIMD_4x32 B1 = SIMD_4x32::load_le(in + 16 * 1); 579| 1.58k| SIMD_4x32 B2 = SIMD_4x32::load_le(in + 16 * 2); 580| 1.58k| SIMD_4x32 B3 = SIMD_4x32::load_le(in + 16 * 3); 581| | 582| 1.58k| keyxor(K0, B0, B1, B2, B3); 583| 1.58k| aesdec(K1, B0, B1, B2, B3); 584| 1.58k| aesdec(K2, B0, B1, B2, B3); 585| 1.58k| aesdec(K3, B0, B1, B2, B3); 586| 1.58k| aesdec(K4, B0, B1, B2, B3); 587| 1.58k| aesdec(K5, B0, B1, B2, B3); 588| 1.58k| aesdec(K6, B0, B1, B2, B3); 589| 1.58k| aesdec(K7, B0, B1, B2, B3); 590| 1.58k| aesdec(K8, B0, B1, B2, B3); 591| 1.58k| aesdec(K9, B0, B1, B2, B3); 592| 1.58k| aesdec(K10, B0, B1, B2, B3); 593| 1.58k| aesdec(K11, B0, B1, B2, B3); 594| 1.58k| aesdec(K12, B0, B1, B2, B3); 595| 1.58k| aesdec(K13, B0, B1, B2, B3); 596| 1.58k| aesdeclast(K14, B0, B1, B2, B3); 597| | 598| 1.58k| B0.store_le(out + 16 * 0); 599| 1.58k| B1.store_le(out + 16 * 1); 600| 1.58k| B2.store_le(out + 16 * 2); 601| 1.58k| B3.store_le(out + 16 * 3); 602| | 603| 1.58k| blocks -= 4; 604| 1.58k| in += 4 * 16; 605| 1.58k| out += 4 * 16; 606| 1.58k| } 607| | 608| 583| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (608:22): [True: 135, False: 448] ------------------ 609| 135| SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * i); 610| | 611| 135| B0 ^= K0; 612| | 613| 135| aesdec(K1, B0); 614| 135| aesdec(K2, B0); 615| 135| aesdec(K3, B0); 616| 135| aesdec(K4, B0); 617| 135| aesdec(K5, B0); 618| 135| aesdec(K6, B0); 619| 135| aesdec(K7, B0); 620| 135| aesdec(K8, B0); 621| 135| aesdec(K9, B0); 622| 135| aesdec(K10, B0); 623| 135| aesdec(K11, B0); 624| 135| aesdec(K12, B0); 625| 135| aesdec(K13, B0); 626| 135| aesdeclast(K14, B0); 627| | 628| 135| B0.store_le(out + 16 * i); 629| 135| } 630| 448|} _ZN5Botan7AES_25618aesni_key_scheduleEPKhm: 635| 237|BOTAN_FN_ISA_AESNI void AES_256::aesni_key_schedule(const uint8_t key[], size_t /*length*/) { 636| 237| m_EK.resize(60); 637| 237| m_DK.resize(60); 638| | 639| 237| const SIMD_4x32 K0 = SIMD_4x32::load_le(key); 640| 237| const SIMD_4x32 K1 = SIMD_4x32::load_le(key + 16); 641| | 642| 237| const SIMD_4x32 K2 = aes_128_key_expansion<0x01>(K0, K1); 643| 237| const SIMD_4x32 K3 = aes_256_key_expansion(K1, K2); 644| | 645| 237| const SIMD_4x32 K4 = aes_128_key_expansion<0x02>(K2, K3); 646| 237| const SIMD_4x32 K5 = aes_256_key_expansion(K3, K4); 647| | 648| 237| const SIMD_4x32 K6 = aes_128_key_expansion<0x04>(K4, K5); 649| 237| const SIMD_4x32 K7 = aes_256_key_expansion(K5, K6); 650| | 651| 237| const SIMD_4x32 K8 = aes_128_key_expansion<0x08>(K6, K7); 652| 237| const SIMD_4x32 K9 = aes_256_key_expansion(K7, K8); 653| | 654| 237| const SIMD_4x32 K10 = aes_128_key_expansion<0x10>(K8, K9); 655| 237| const SIMD_4x32 K11 = aes_256_key_expansion(K9, K10); 656| | 657| 237| const SIMD_4x32 K12 = aes_128_key_expansion<0x20>(K10, K11); 658| 237| const SIMD_4x32 K13 = aes_256_key_expansion(K11, K12); 659| | 660| 237| const SIMD_4x32 K14 = aes_128_key_expansion<0x40>(K12, K13); 661| | 662| 237| K0.store_le(&m_EK[4 * 0]); 663| 237| K1.store_le(&m_EK[4 * 1]); 664| 237| K2.store_le(&m_EK[4 * 2]); 665| 237| K3.store_le(&m_EK[4 * 3]); 666| 237| K4.store_le(&m_EK[4 * 4]); 667| 237| K5.store_le(&m_EK[4 * 5]); 668| 237| K6.store_le(&m_EK[4 * 6]); 669| 237| K7.store_le(&m_EK[4 * 7]); 670| 237| K8.store_le(&m_EK[4 * 8]); 671| 237| K9.store_le(&m_EK[4 * 9]); 672| 237| K10.store_le(&m_EK[4 * 10]); 673| 237| K11.store_le(&m_EK[4 * 11]); 674| 237| K12.store_le(&m_EK[4 * 12]); 675| 237| K13.store_le(&m_EK[4 * 13]); 676| 237| K14.store_le(&m_EK[4 * 14]); 677| | 678| 237| K14.store_le(&m_DK[4 * 0]); 679| 237| aesimc(K13).store_le(&m_DK[4 * 1]); 680| 237| aesimc(K12).store_le(&m_DK[4 * 2]); 681| 237| aesimc(K11).store_le(&m_DK[4 * 3]); 682| 237| aesimc(K10).store_le(&m_DK[4 * 4]); 683| 237| aesimc(K9).store_le(&m_DK[4 * 5]); 684| 237| aesimc(K8).store_le(&m_DK[4 * 6]); 685| 237| aesimc(K7).store_le(&m_DK[4 * 7]); 686| 237| aesimc(K6).store_le(&m_DK[4 * 8]); 687| 237| aesimc(K5).store_le(&m_DK[4 * 9]); 688| 237| aesimc(K4).store_le(&m_DK[4 * 10]); 689| 237| aesimc(K3).store_le(&m_DK[4 * 11]); 690| 237| aesimc(K2).store_le(&m_DK[4 * 12]); 691| 237| aesimc(K1).store_le(&m_DK[4 * 13]); 692| 237| K0.store_le(&m_DK[4 * 14]); 693| 237|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16keyxorENS_9SIMD_4x32ERS1_S2_S2_S2_: 69| 4.55k| SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 70| 4.55k| B0 ^= K; 71| 4.55k| B1 ^= K; 72| 4.55k| B2 ^= K; 73| 4.55k| B3 ^= K; 74| 4.55k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesencENS_9SIMD_4x32ERS1_S2_S2_S2_: 81| 29.5k| SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 82| 29.5k| B0 = SIMD_4x32(_mm_aesenc_si128(B0.raw(), K.raw())); 83| 29.5k| B1 = SIMD_4x32(_mm_aesenc_si128(B1.raw(), K.raw())); 84| 29.5k| B2 = SIMD_4x32(_mm_aesenc_si128(B2.raw(), K.raw())); 85| 29.5k| B3 = SIMD_4x32(_mm_aesenc_si128(B3.raw(), K.raw())); 86| 29.5k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_110aesenclastENS_9SIMD_4x32ERS1_S2_S2_S2_: 93| 2.47k| SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 94| 2.47k| B0 = SIMD_4x32(_mm_aesenclast_si128(B0.raw(), K.raw())); 95| 2.47k| B1 = SIMD_4x32(_mm_aesenclast_si128(B1.raw(), K.raw())); 96| 2.47k| B2 = SIMD_4x32(_mm_aesenclast_si128(B2.raw(), K.raw())); 97| 2.47k| B3 = SIMD_4x32(_mm_aesenclast_si128(B3.raw(), K.raw())); 98| 2.47k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesencENS_9SIMD_4x32ERS1_: 76| 41.8k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_AESNI void aesenc(SIMD_4x32 K, SIMD_4x32& B) { 77| 41.8k| B = SIMD_4x32(_mm_aesenc_si128(B.raw(), K.raw())); 78| 41.8k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_110aesenclastENS_9SIMD_4x32ERS1_: 88| 4.39k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_AESNI void aesenclast(SIMD_4x32 K, SIMD_4x32& B) { 89| 4.39k| B = SIMD_4x32(_mm_aesenclast_si128(B.raw(), K.raw())); 90| 4.39k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesdecENS_9SIMD_4x32ERS1_S2_S2_S2_: 105| 25.0k| SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 106| 25.0k| B0 = SIMD_4x32(_mm_aesdec_si128(B0.raw(), K.raw())); 107| 25.0k| B1 = SIMD_4x32(_mm_aesdec_si128(B1.raw(), K.raw())); 108| 25.0k| B2 = SIMD_4x32(_mm_aesdec_si128(B2.raw(), K.raw())); 109| 25.0k| B3 = SIMD_4x32(_mm_aesdec_si128(B3.raw(), K.raw())); 110| 25.0k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_110aesdeclastENS_9SIMD_4x32ERS1_S2_S2_S2_: 117| 2.07k| SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 118| 2.07k| B0 = SIMD_4x32(_mm_aesdeclast_si128(B0.raw(), K.raw())); 119| 2.07k| B1 = SIMD_4x32(_mm_aesdeclast_si128(B1.raw(), K.raw())); 120| 2.07k| B2 = SIMD_4x32(_mm_aesdeclast_si128(B2.raw(), K.raw())); 121| 2.07k| B3 = SIMD_4x32(_mm_aesdeclast_si128(B3.raw(), K.raw())); 122| 2.07k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesdecENS_9SIMD_4x32ERS1_: 100| 2.11k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_AESNI void aesdec(SIMD_4x32 K, SIMD_4x32& B) { 101| 2.11k| B = SIMD_4x32(_mm_aesdec_si128(B.raw(), K.raw())); 102| 2.11k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_110aesdeclastENS_9SIMD_4x32ERS1_: 112| 175|BOTAN_FORCE_INLINE BOTAN_FN_ISA_AESNI void aesdeclast(SIMD_4x32 K, SIMD_4x32& B) { 113| 175| B = SIMD_4x32(_mm_aesdeclast_si128(B.raw(), K.raw())); 114| 175|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesimcENS_9SIMD_4x32E: 124| 4.26k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_AESNI SIMD_4x32 aesimc(SIMD_4x32 B) { 125| 4.26k| return SIMD_4x32(_mm_aesimc_si128(B.raw())); 126| 4.26k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_256_key_expansionENS_9SIMD_4x32ES1_: 57| 1.42k|BOTAN_FN_ISA_AESNI SIMD_4x32 aes_256_key_expansion(SIMD_4x32 key, SIMD_4x32 key2) { 58| 1.42k| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key2.raw(), 0x00); 59| 1.42k| key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(2, 2, 2, 2)); 60| | 61| 1.42k| key ^= key.shift_elems_left<1>(); 62| 1.42k| key ^= key.shift_elems_left<1>(); 63| 1.42k| key ^= key.shift_elems_left<1>(); 64| 1.42k| key ^= SIMD_4x32(key_with_rcon); 65| 1.42k| return key; 66| 1.42k|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh1EEENS_9SIMD_4x32ES2_S2_: 22| 368|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 368| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 368| key ^= key.shift_elems_left<1>(); 26| 368| key ^= key.shift_elems_left<1>(); 27| 368| key ^= key.shift_elems_left<1>(); 28| 368| key ^= SIMD_4x32(key_with_rcon); 29| 368| return key; 30| 368|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh2EEENS_9SIMD_4x32ES2_S2_: 22| 368|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 368| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 368| key ^= key.shift_elems_left<1>(); 26| 368| key ^= key.shift_elems_left<1>(); 27| 368| key ^= key.shift_elems_left<1>(); 28| 368| key ^= SIMD_4x32(key_with_rcon); 29| 368| return key; 30| 368|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh4EEENS_9SIMD_4x32ES2_S2_: 22| 368|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 368| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 368| key ^= key.shift_elems_left<1>(); 26| 368| key ^= key.shift_elems_left<1>(); 27| 368| key ^= key.shift_elems_left<1>(); 28| 368| key ^= SIMD_4x32(key_with_rcon); 29| 368| return key; 30| 368|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh8EEENS_9SIMD_4x32ES2_S2_: 22| 368|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 368| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 368| key ^= key.shift_elems_left<1>(); 26| 368| key ^= key.shift_elems_left<1>(); 27| 368| key ^= key.shift_elems_left<1>(); 28| 368| key ^= SIMD_4x32(key_with_rcon); 29| 368| return key; 30| 368|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh16EEENS_9SIMD_4x32ES2_S2_: 22| 368|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 368| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 368| key ^= key.shift_elems_left<1>(); 26| 368| key ^= key.shift_elems_left<1>(); 27| 368| key ^= key.shift_elems_left<1>(); 28| 368| key ^= SIMD_4x32(key_with_rcon); 29| 368| return key; 30| 368|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh32EEENS_9SIMD_4x32ES2_S2_: 22| 368|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 368| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 368| key ^= key.shift_elems_left<1>(); 26| 368| key ^= key.shift_elems_left<1>(); 27| 368| key ^= key.shift_elems_left<1>(); 28| 368| key ^= SIMD_4x32(key_with_rcon); 29| 368| return key; 30| 368|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh64EEENS_9SIMD_4x32ES2_S2_: 22| 368|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 368| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 368| key ^= key.shift_elems_left<1>(); 26| 368| key ^= key.shift_elems_left<1>(); 27| 368| key ^= key.shift_elems_left<1>(); 28| 368| key ^= SIMD_4x32(key_with_rcon); 29| 368| return key; 30| 368|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh128EEENS_9SIMD_4x32ES2_S2_: 22| 131|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 131| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 131| key ^= key.shift_elems_left<1>(); 26| 131| key ^= key.shift_elems_left<1>(); 27| 131| key ^= key.shift_elems_left<1>(); 28| 131| key ^= SIMD_4x32(key_with_rcon); 29| 131| return key; 30| 131|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh27EEENS_9SIMD_4x32ES2_S2_: 22| 131|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 131| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 131| key ^= key.shift_elems_left<1>(); 26| 131| key ^= key.shift_elems_left<1>(); 27| 131| key ^= key.shift_elems_left<1>(); 28| 131| key ^= SIMD_4x32(key_with_rcon); 29| 131| return key; 30| 131|} aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh54EEENS_9SIMD_4x32ES2_S2_: 22| 131|BOTAN_FN_ISA_AESNI inline SIMD_4x32 aes_128_key_expansion(SIMD_4x32 key, SIMD_4x32 key_getting_rcon) { 23| 131| __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon.raw(), RC); 24| | key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3)); 25| 131| key ^= key.shift_elems_left<1>(); 26| 131| key ^= key.shift_elems_left<1>(); 27| 131| key ^= key.shift_elems_left<1>(); 28| 131| key ^= SIMD_4x32(key_with_rcon); 29| 131| return key; 30| 131|} _ZNK5Botan8ARIA_1289encrypt_nEPKhPhm: 372| 5|void ARIA_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 373| 5| assert_key_material_set(); 374| | 375| 5|#if defined(BOTAN_HAS_ARIA_AVX512_GFNI) 376| 5| if(CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::GFNI)) { ------------------ | Branch (376:7): [True: 0, False: 5] ------------------ 377| 0| return aria_avx512_gfni_encrypt(in, out, blocks); 378| 0| } 379| 5|#endif 380| | 381| 5|#if defined(BOTAN_HAS_ARIA_HWAES) 382| 5| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (382:7): [True: 5, False: 0] ------------------ 383| 5| return aria_hwaes_encrypt(in, out, blocks); 384| 5| } 385| 0|#endif 386| | 387| 0| ARIA_F::transform(in, out, blocks, m_ERK); 388| 0|} _ZNK5Botan8ARIA_2569encrypt_nEPKhPhm: 408| 5|void ARIA_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 409| 5| assert_key_material_set(); 410| | 411| 5|#if defined(BOTAN_HAS_ARIA_AVX512_GFNI) 412| 5| if(CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::GFNI)) { ------------------ | Branch (412:7): [True: 0, False: 5] ------------------ 413| 0| return aria_avx512_gfni_encrypt(in, out, blocks); 414| 0| } 415| 5|#endif 416| | 417| 5|#if defined(BOTAN_HAS_ARIA_HWAES) 418| 5| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (418:7): [True: 5, False: 0] ------------------ 419| 5| return aria_hwaes_encrypt(in, out, blocks); 420| 5| } 421| 0|#endif 422| | 423| 0| ARIA_F::transform(in, out, blocks, m_ERK); 424| 0|} _ZNK5Botan8ARIA_12819has_keying_materialEv: 480| 14|bool ARIA_128::has_keying_material() const { 481| 14| return !m_ERK.empty(); 482| 14|} _ZNK5Botan8ARIA_25619has_keying_materialEv: 488| 14|bool ARIA_256::has_keying_material() const { 489| 14| return !m_ERK.empty(); 490| 14|} _ZNK5Botan8ARIA_12811parallelismEv: 528| 4|size_t ARIA_128::parallelism() const { 529| 4| return aria_parallelism(); 530| 4|} _ZNK5Botan8ARIA_25611parallelismEv: 544| 4|size_t ARIA_256::parallelism() const { 545| 4| return aria_parallelism(); 546| 4|} _ZN5Botan8ARIA_12812key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 552| 2|void ARIA_128::key_schedule(std::span key) { 553| 2| ARIA_F::key_schedule(m_ERK, m_DRK, key); 554| 2|} _ZN5Botan8ARIA_25612key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 560| 2|void ARIA_256::key_schedule(std::span key) { 561| 2| ARIA_F::key_schedule(m_ERK, m_DRK, key); 562| 2|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F7ARIA_FOERjS2_S2_S2_: 118| 8|inline void ARIA_FO(uint32_t& T0, uint32_t& T1, uint32_t& T2, uint32_t& T3) { 119| 8| T0 = ARIA_F1(T0); 120| 8| T1 = ARIA_F1(T1); 121| 8| T2 = ARIA_F1(T2); 122| 8| T3 = ARIA_F1(T3); 123| | 124| 8| T1 ^= T2; 125| 8| T2 ^= T3; 126| 8| T0 ^= T1; 127| 8| T3 ^= T1; 128| 8| T2 ^= T0; 129| 8| T1 ^= T2; 130| | 131| 8| T1 = ((T1 << 8) & 0xFF00FF00) | ((T1 >> 8) & 0x00FF00FF); 132| 8| T2 = rotr<16>(T2); 133| 8| T3 = reverse_bytes(T3); 134| | 135| 8| T1 ^= T2; 136| 8| T2 ^= T3; 137| 8| T0 ^= T1; 138| 8| T3 ^= T1; 139| 8| T2 ^= T0; 140| 8| T1 ^= T2; 141| 8|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F7ARIA_F1Ej: 100| 32|inline uint32_t ARIA_F1(uint32_t X) { 101| 32| const uint32_t M1 = 0x00010101; 102| 32| const uint32_t M2 = 0x01000101; 103| 32| const uint32_t M3 = 0x01010001; 104| 32| const uint32_t M4 = 0x01010100; 105| | 106| 32| return (S1[get_byte<0>(X)] * M1) ^ (S2[get_byte<1>(X)] * M2) ^ (X1[get_byte<2>(X)] * M3) ^ (X2[get_byte<3>(X)] * M4); 107| 32|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F7ARIA_FEERjS2_S2_S2_: 143| 4|inline void ARIA_FE(uint32_t& T0, uint32_t& T1, uint32_t& T2, uint32_t& T3) { 144| 4| T0 = ARIA_F2(T0); 145| 4| T1 = ARIA_F2(T1); 146| 4| T2 = ARIA_F2(T2); 147| 4| T3 = ARIA_F2(T3); 148| | 149| 4| T1 ^= T2; 150| 4| T2 ^= T3; 151| 4| T0 ^= T1; 152| 4| T3 ^= T1; 153| 4| T2 ^= T0; 154| 4| T1 ^= T2; 155| | 156| 4| T3 = ((T3 << 8) & 0xFF00FF00) | ((T3 >> 8) & 0x00FF00FF); 157| 4| T0 = rotr<16>(T0); 158| 4| T1 = reverse_bytes(T1); 159| | 160| 4| T1 ^= T2; 161| 4| T2 ^= T3; 162| 4| T0 ^= T1; 163| 4| T3 ^= T1; 164| 4| T2 ^= T0; 165| 4| T1 ^= T2; 166| 4|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F7ARIA_F2Ej: 109| 16|inline uint32_t ARIA_F2(uint32_t X) { 110| 16| const uint32_t M1 = 0x00010101; 111| 16| const uint32_t M2 = 0x01000101; 112| 16| const uint32_t M3 = 0x01010001; 113| 16| const uint32_t M4 = 0x01010100; 114| | 115| 16| return (X1[get_byte<0>(X)] * M3) ^ (X2[get_byte<1>(X)] * M4) ^ (S1[get_byte<2>(X)] * M1) ^ (S2[get_byte<3>(X)] * M2); 116| 16|} aria.cpp:_ZN5Botan12_GLOBAL__N_116aria_parallelismEv: 494| 8|size_t aria_parallelism() { 495| 8|#if defined(BOTAN_HAS_ARIA_AVX512_GFNI) 496| 8| if(CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::GFNI)) { ------------------ | Branch (496:7): [True: 0, False: 8] ------------------ 497| 0| return 16; 498| 0| } 499| 8|#endif 500| | 501| 8|#if defined(BOTAN_HAS_ARIA_HWAES) 502| 8| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (502:7): [True: 8, False: 0] ------------------ 503| 8| return 4; 504| 8| } 505| 0|#endif 506| | 507| 0| return 1; 508| 8|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F12key_scheduleERNSt3__16vectorIjNS_16secure_allocatorIjEEEES7_NS2_4spanIKhLm18446744073709551615EEE: 260| 4|void key_schedule(secure_vector& ERK, secure_vector& DRK, std::span key) { 261| 4| prefetch_arrays(S1, S2, X1, X2); 262| | 263| 4| const uint32_t KRK[3][4] = {{0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0}, 264| 4| {0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0}, 265| 4| {0xdb92371d, 0x2126e970, 0x03249775, 0x04e8c90e}}; 266| | 267| 4| const size_t CK0 = (key.size() / 8) - 2; 268| 4| const size_t CK1 = (CK0 + 1) % 3; 269| 4| const size_t CK2 = (CK1 + 1) % 3; 270| | 271| 4| uint32_t w0[4]; 272| 4| uint32_t w1[4]; 273| 4| uint32_t w2[4]; 274| 4| uint32_t w3[4]; 275| | 276| 4| w0[0] = load_be(key.data(), 0); 277| 4| w0[1] = load_be(key.data(), 1); 278| 4| w0[2] = load_be(key.data(), 2); 279| 4| w0[3] = load_be(key.data(), 3); 280| | 281| 4| w1[0] = w0[0] ^ KRK[CK0][0]; 282| 4| w1[1] = w0[1] ^ KRK[CK0][1]; 283| 4| w1[2] = w0[2] ^ KRK[CK0][2]; 284| 4| w1[3] = w0[3] ^ KRK[CK0][3]; 285| | 286| 4| ARIA_FO(w1[0], w1[1], w1[2], w1[3]); 287| | 288| 4| if(key.size() == 24 || key.size() == 32) { ------------------ | Branch (288:7): [True: 0, False: 4] | Branch (288:27): [True: 2, False: 2] ------------------ 289| 2| w1[0] ^= load_be(key.data(), 4); 290| 2| w1[1] ^= load_be(key.data(), 5); 291| 2| } 292| 4| if(key.size() == 32) { ------------------ | Branch (292:7): [True: 2, False: 2] ------------------ 293| 2| w1[2] ^= load_be(key.data(), 6); 294| 2| w1[3] ^= load_be(key.data(), 7); 295| 2| } 296| | 297| 4| w2[0] = w1[0] ^ KRK[CK1][0]; 298| 4| w2[1] = w1[1] ^ KRK[CK1][1]; 299| 4| w2[2] = w1[2] ^ KRK[CK1][2]; 300| 4| w2[3] = w1[3] ^ KRK[CK1][3]; 301| | 302| 4| ARIA_FE(w2[0], w2[1], w2[2], w2[3]); 303| | 304| 4| w2[0] ^= w0[0]; 305| 4| w2[1] ^= w0[1]; 306| 4| w2[2] ^= w0[2]; 307| 4| w2[3] ^= w0[3]; 308| | 309| 4| w3[0] = w2[0] ^ KRK[CK2][0]; 310| 4| w3[1] = w2[1] ^ KRK[CK2][1]; 311| 4| w3[2] = w2[2] ^ KRK[CK2][2]; 312| 4| w3[3] = w2[3] ^ KRK[CK2][3]; 313| | 314| 4| ARIA_FO(w3[0], w3[1], w3[2], w3[3]); 315| | 316| 4| w3[0] ^= w1[0]; 317| 4| w3[1] ^= w1[1]; 318| 4| w3[2] ^= w1[2]; 319| 4| w3[3] ^= w1[3]; 320| | 321| 4| if(key.size() == 16) { ------------------ | Branch (321:7): [True: 2, False: 2] ------------------ 322| 2| ERK.resize(4 * 13); 323| 2| } else if(key.size() == 24) { ------------------ | Branch (323:14): [True: 0, False: 2] ------------------ 324| 0| ERK.resize(4 * 15); 325| 2| } else if(key.size() == 32) { ------------------ | Branch (325:14): [True: 2, False: 0] ------------------ 326| 2| ERK.resize(4 * 17); 327| 2| } 328| | 329| 4| ARIA_ROL128<19>(w0, w1, &ERK[0]); // NOLINT(*-container-data-pointer) 330| 4| ARIA_ROL128<19>(w1, w2, &ERK[4]); 331| 4| ARIA_ROL128<19>(w2, w3, &ERK[8]); 332| 4| ARIA_ROL128<19>(w3, w0, &ERK[12]); 333| 4| ARIA_ROL128<31>(w0, w1, &ERK[16]); 334| 4| ARIA_ROL128<31>(w1, w2, &ERK[20]); 335| 4| ARIA_ROL128<31>(w2, w3, &ERK[24]); 336| 4| ARIA_ROL128<31>(w3, w0, &ERK[28]); 337| 4| ARIA_ROL128<67>(w0, w1, &ERK[32]); 338| 4| ARIA_ROL128<67>(w1, w2, &ERK[36]); 339| 4| ARIA_ROL128<67>(w2, w3, &ERK[40]); 340| 4| ARIA_ROL128<67>(w3, w0, &ERK[44]); 341| 4| ARIA_ROL128<97>(w0, w1, &ERK[48]); 342| | 343| 4| if(key.size() == 24 || key.size() == 32) { ------------------ | Branch (343:7): [True: 0, False: 4] | Branch (343:27): [True: 2, False: 2] ------------------ 344| 2| ARIA_ROL128<97>(w1, w2, &ERK[52]); 345| 2| ARIA_ROL128<97>(w2, w3, &ERK[56]); 346| | 347| 2| if(key.size() == 32) { ------------------ | Branch (347:10): [True: 2, False: 0] ------------------ 348| 2| ARIA_ROL128<97>(w3, w0, &ERK[60]); 349| 2| ARIA_ROL128<109>(w0, w1, &ERK[64]); 350| 2| } 351| 2| } 352| | 353| | // Now create the decryption key schedule 354| 4| DRK.resize(ERK.size()); 355| | 356| 64| for(size_t i = 0; i != DRK.size(); i += 4) { ------------------ | Branch (356:22): [True: 60, False: 4] ------------------ 357| 60| DRK[i] = ERK[ERK.size() - 4 - i]; 358| 60| DRK[i + 1] = ERK[ERK.size() - 3 - i]; 359| 60| DRK[i + 2] = ERK[ERK.size() - 2 - i]; 360| 60| DRK[i + 3] = ERK[ERK.size() - 1 - i]; 361| 60| } 362| | 363| 56| for(size_t i = 4; i != DRK.size() - 4; i += 4) { ------------------ | Branch (363:22): [True: 52, False: 4] ------------------ 364| 52| aria_ks_dk_transform(DRK[i + 0], DRK[i + 1], DRK[i + 2], DRK[i + 3]); 365| 52| } 366| 4|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm19EEEvPKjS4_Pj: 221| 16|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) { 222| | // MSVC is not generating a "rotate immediate". Constify to help it along. 223| 16| static const size_t Q = 4 - (N / 32); 224| 16| static const size_t R = N % 32; 225| 16| static_assert(R > 0 && R < 32, "Rotation in range for type"); 226| 16| KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R)); 227| 16| KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R)); 228| 16| KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R)); 229| 16| KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R)); 230| 16|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm31EEEvPKjS4_Pj: 221| 16|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) { 222| | // MSVC is not generating a "rotate immediate". Constify to help it along. 223| 16| static const size_t Q = 4 - (N / 32); 224| 16| static const size_t R = N % 32; 225| 16| static_assert(R > 0 && R < 32, "Rotation in range for type"); 226| 16| KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R)); 227| 16| KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R)); 228| 16| KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R)); 229| 16| KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R)); 230| 16|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm67EEEvPKjS4_Pj: 221| 16|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) { 222| | // MSVC is not generating a "rotate immediate". Constify to help it along. 223| 16| static const size_t Q = 4 - (N / 32); 224| 16| static const size_t R = N % 32; 225| 16| static_assert(R > 0 && R < 32, "Rotation in range for type"); 226| 16| KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R)); 227| 16| KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R)); 228| 16| KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R)); 229| 16| KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R)); 230| 16|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm97EEEvPKjS4_Pj: 221| 10|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) { 222| | // MSVC is not generating a "rotate immediate". Constify to help it along. 223| 10| static const size_t Q = 4 - (N / 32); 224| 10| static const size_t R = N % 32; 225| 10| static_assert(R > 0 && R < 32, "Rotation in range for type"); 226| 10| KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R)); 227| 10| KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R)); 228| 10| KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R)); 229| 10| KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R)); 230| 10|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm109EEEvPKjS4_Pj: 221| 2|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) { 222| | // MSVC is not generating a "rotate immediate". Constify to help it along. 223| 2| static const size_t Q = 4 - (N / 32); 224| 2| static const size_t R = N % 32; 225| 2| static_assert(R > 0 && R < 32, "Rotation in range for type"); 226| 2| KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R)); 227| 2| KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R)); 228| 2| KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R)); 229| 2| KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R)); 230| 2|} aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F20aria_ks_dk_transformERjS2_S2_S2_: 232| 52|void aria_ks_dk_transform(uint32_t& K0, uint32_t& K1, uint32_t& K2, uint32_t& K3) { 233| 52| K0 = rotr<8>(K0) ^ rotr<16>(K0) ^ rotr<24>(K0); 234| 52| K1 = rotr<8>(K1) ^ rotr<16>(K1) ^ rotr<24>(K1); 235| 52| K2 = rotr<8>(K2) ^ rotr<16>(K2) ^ rotr<24>(K2); 236| 52| K3 = rotr<8>(K3) ^ rotr<16>(K3) ^ rotr<24>(K3); 237| | 238| 52| K1 ^= K2; 239| 52| K2 ^= K3; 240| 52| K0 ^= K1; 241| 52| K3 ^= K1; 242| 52| K2 ^= K0; 243| 52| K1 ^= K2; 244| | 245| 52| K1 = ((K1 << 8) & 0xFF00FF00) | ((K1 >> 8) & 0x00FF00FF); 246| 52| K2 = rotr<16>(K2); 247| 52| K3 = reverse_bytes(K3); 248| | 249| 52| K1 ^= K2; 250| 52| K2 ^= K3; 251| 52| K0 ^= K1; 252| 52| K3 ^= K1; 253| 52| K2 ^= K0; 254| 52| K1 ^= K2; 255| 52|} _ZNK5Botan8ARIA_12818aria_hwaes_encryptEPKhPhm: 224| 5|void BOTAN_FN_ISA_HWAES ARIA_128::aria_hwaes_encrypt(const uint8_t in[], uint8_t out[], size_t blocks) const { 225| 5| ARIA_HWAES::aria_transform(in, out, blocks, m_ERK); 226| 5|} _ZNK5Botan8ARIA_25618aria_hwaes_encryptEPKhPhm: 240| 5|void BOTAN_FN_ISA_HWAES ARIA_256::aria_hwaes_encrypt(const uint8_t in[], uint8_t out[], size_t blocks) const { 241| 5| ARIA_HWAES::aria_transform(in, out, blocks, m_ERK); 242| 5|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_114aria_transformEPKhPhmNSt3__14spanIKjLm18446744073709551615EEE: 203| 10|void BOTAN_FN_ISA_HWAES aria_transform(const uint8_t in[], uint8_t out[], size_t blocks, std::span KS) { 204| 50| while(blocks >= 4) { ------------------ | Branch (204:10): [True: 40, False: 10] ------------------ 205| 40| transform_4(in, out, KS); 206| 40| in += 4 * 16; 207| 40| out += 4 * 16; 208| 40| blocks -= 4; 209| 40| } 210| | 211| 10| if(blocks > 0) { ------------------ | Branch (211:7): [True: 0, False: 10] ------------------ 212| 0| uint8_t ibuf[4 * 16] = {0}; 213| 0| uint8_t obuf[4 * 16] = {0}; 214| 0| copy_mem(ibuf, in, blocks * 16); 215| 0| transform_4(ibuf, obuf, KS); 216| 0| copy_mem(out, obuf, blocks * 16); 217| 0| } 218| 10|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_111transform_4EPKhPhNSt3__14spanIKjLm18446744073709551615EEE: 159| 40|BOTAN_FN_ISA_HWAES void transform_4(const uint8_t in[], uint8_t out[], std::span KS) { 160| 40| const size_t ROUNDS = (KS.size() / 4) - 1; 161| | 162| 40| auto B0 = SIMD_4x32::load_be(in); 163| 40| auto B1 = SIMD_4x32::load_be(in + 16); 164| 40| auto B2 = SIMD_4x32::load_be(in + 32); 165| 40| auto B3 = SIMD_4x32::load_be(in + 48); 166| | 167| 40| SIMD_4x32::transpose(B0, B1, B2, B3); 168| | 169| 320| for(size_t r = 0; r != ROUNDS; r += 2) { ------------------ | Branch (169:22): [True: 280, False: 40] ------------------ 170| 280| B0 ^= SIMD_4x32::splat(KS[4 * r]); 171| 280| B1 ^= SIMD_4x32::splat(KS[4 * r + 1]); 172| 280| B2 ^= SIMD_4x32::splat(KS[4 * r + 2]); 173| 280| B3 ^= SIMD_4x32::splat(KS[4 * r + 3]); 174| | 175| 280| aria_fo(B0, B1, B2, B3); 176| | 177| 280| B0 ^= SIMD_4x32::splat(KS[4 * r + 4]); 178| 280| B1 ^= SIMD_4x32::splat(KS[4 * r + 5]); 179| 280| B2 ^= SIMD_4x32::splat(KS[4 * r + 6]); 180| 280| B3 ^= SIMD_4x32::splat(KS[4 * r + 7]); 181| | 182| 280| if(r != ROUNDS - 2) { ------------------ | Branch (182:10): [True: 240, False: 40] ------------------ 183| 240| aria_fe(B0, B1, B2, B3); 184| 240| } 185| 280| } 186| | 187| | // Last half-round: FE sbox only 188| 40| aria_fe_sbox(B0, B1, B2, B3); 189| | 190| 40| B0 ^= SIMD_4x32::splat(KS[4 * ROUNDS]); 191| 40| B1 ^= SIMD_4x32::splat(KS[4 * ROUNDS + 1]); 192| 40| B2 ^= SIMD_4x32::splat(KS[4 * ROUNDS + 2]); 193| 40| B3 ^= SIMD_4x32::splat(KS[4 * ROUNDS + 3]); 194| | 195| 40| SIMD_4x32::transpose(B0, B1, B2, B3); 196| | 197| 40| B0.store_be(out); 198| 40| B1.store_be(out + 16); 199| 40| B2.store_be(out + 32); 200| 40| B3.store_be(out + 48); 201| 40|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_17aria_foERNS_9SIMD_4x32ES3_S3_S3_: 125| 280|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void aria_fo(SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 126| 280| aria_fo_sbox(B0, B1, B2, B3); 127| | 128| 280| B0 = aria_fo_m(B0); 129| 280| B1 = aria_fo_m(B1); 130| 280| B2 = aria_fo_m(B2); 131| 280| B3 = aria_fo_m(B3); 132| | 133| 280| aria_mix(B0, B1, B2, B3); 134| | 135| 280| B1 = swap_abcd_badc(B1); 136| 280| B2 = B2.rotl<16>(); 137| 280| B3 = B3.bswap(); 138| | 139| 280| aria_mix(B0, B1, B2, B3); 140| 280|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_112aria_fo_sboxERNS_9SIMD_4x32ES3_S3_S3_: 87| 280|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void aria_fo_sbox(SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 88| 280| B0 = byte_transpose(B0); 89| 280| B1 = byte_transpose(B1); 90| 280| B2 = byte_transpose(B2); 91| 280| B3 = byte_transpose(B3); 92| 280| SIMD_4x32::transpose(B0, B1, B2, B3); 93| | 94| 280| B3 = aria_s1(B3); 95| 280| B2 = aria_s2(B2); 96| 280| B1 = aria_x1(B1); 97| 280| B0 = aria_x2(B0); 98| | 99| 280| SIMD_4x32::transpose(B0, B1, B2, B3); 100| 280| B0 = byte_transpose(B0); 101| 280| B1 = byte_transpose(B1); 102| 280| B2 = byte_transpose(B2); 103| 280| B3 = byte_transpose(B3); 104| 280|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_114byte_transposeENS_9SIMD_4x32E: 82| 4.48k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 byte_transpose(SIMD_4x32 v) { 83| 4.48k| const SIMD_4x32 tbl(0x0C080400, 0x0D090501, 0x0E0A0602, 0x0F0B0703); 84| 4.48k| return SIMD_4x32::byte_shuffle(v, tbl); 85| 4.48k|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_17aria_s1ENS_9SIMD_4x32E: 21| 560|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 aria_s1(SIMD_4x32 v) { 22| 560| return hw_aes_sbox(v); 23| 560|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_17aria_s2ENS_9SIMD_4x32E: 25| 560|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 aria_s2(SIMD_4x32 v) { 26| 560| constexpr uint64_t AFF_S2 = gfni_matrix(R"( 27| 560| 0 1 0 1 0 1 1 1 28| 560| 0 0 1 1 1 1 1 1 29| 560| 1 1 1 0 1 1 0 1 30| 560| 1 1 0 0 0 0 1 1 31| 560| 0 1 0 0 0 0 1 1 32| 560| 1 1 0 0 1 1 1 0 33| 560| 0 1 1 0 0 0 1 1 34| 560| 1 1 1 1 0 1 1 0)"); 35| | 36| 560| constexpr auto POST_S2 = Gf2AffineTransformation::post_sbox(AFF_S2, 0xE2); 37| 560| return POST_S2.affine_transform(hw_aes_sbox(v)); 38| 560|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_17aria_x1ENS_9SIMD_4x32E: 41| 560|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 aria_x1(SIMD_4x32 v) { 42| 560| return hw_aes_inv_sbox(v); 43| 560|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_17aria_x2ENS_9SIMD_4x32E: 45| 560|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 aria_x2(SIMD_4x32 v) { 46| 560| constexpr uint64_t AFF_X2 = gfni_matrix(R"( 47| 560| 0 0 0 1 1 0 0 0 48| 560| 0 0 1 0 0 1 1 0 49| 560| 0 0 0 0 1 0 1 0 50| 560| 1 1 1 0 0 0 1 1 51| 560| 1 1 1 0 1 1 0 0 52| 560| 0 1 1 0 1 0 1 1 53| 560| 1 0 1 1 1 1 0 1 54| 560| 1 0 0 1 0 0 1 1)"); 55| 560| constexpr auto PRE_X2D = Gf2AffineTransformation::post_inv_sbox(AFF_X2, 0x2C); 56| | 57| 560| return hw_aes_inv_sbox(PRE_X2D.affine_transform(v)); 58| 560|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_19aria_fo_mENS_9SIMD_4x32E: 60| 1.12k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 aria_fo_m(SIMD_4x32 x) { 61| 1.12k| return x.rotl<8>() ^ x.rotl<16>() ^ x.rotl<24>(); 62| 1.12k|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_18aria_mixERNS_9SIMD_4x32ES3_S3_S3_: 68| 1.04k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void aria_mix(SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 69| 1.04k| B1 ^= B2; 70| 1.04k| B2 ^= B3; 71| 1.04k| B0 ^= B1; 72| 1.04k| B3 ^= B1; 73| 1.04k| B2 ^= B0; 74| 1.04k| B1 ^= B2; 75| 1.04k|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_114swap_abcd_badcENS_9SIMD_4x32E: 77| 520|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 swap_abcd_badc(SIMD_4x32 x) { 78| 520| const auto shuf = SIMD_4x32(0x02030001, 0x06070405, 0x0A0B0809, 0x0E0F0C0D); 79| 520| return SIMD_4x32::byte_shuffle(x, shuf); 80| 520|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_17aria_feERNS_9SIMD_4x32ES3_S3_S3_: 142| 240|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void aria_fe(SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 143| 240| aria_fe_sbox(B0, B1, B2, B3); 144| | 145| 240| B0 = aria_fe_m(B0); 146| 240| B1 = aria_fe_m(B1); 147| 240| B2 = aria_fe_m(B2); 148| 240| B3 = aria_fe_m(B3); 149| | 150| 240| aria_mix(B0, B1, B2, B3); 151| | 152| 240| B3 = swap_abcd_badc(B3); 153| 240| B0 = B0.rotl<16>(); 154| 240| B1 = B1.bswap(); 155| | 156| 240| aria_mix(B0, B1, B2, B3); 157| 240|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_19aria_fe_mENS_9SIMD_4x32E: 64| 960|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 aria_fe_m(SIMD_4x32 x) { 65| 960| return x ^ x.rotl<8>() ^ x.rotl<24>(); 66| 960|} aria_hwaes.cpp:_ZN5Botan10ARIA_HWAES12_GLOBAL__N_112aria_fe_sboxERNS_9SIMD_4x32ES3_S3_S3_: 106| 280|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void aria_fe_sbox(SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) { 107| 280| B0 = byte_transpose(B0); 108| 280| B1 = byte_transpose(B1); 109| 280| B2 = byte_transpose(B2); 110| 280| B3 = byte_transpose(B3); 111| 280| SIMD_4x32::transpose(B0, B1, B2, B3); 112| | 113| 280| B3 = aria_x1(B3); 114| 280| B2 = aria_x2(B2); 115| 280| B1 = aria_s1(B1); 116| 280| B0 = aria_s2(B0); 117| | 118| 280| SIMD_4x32::transpose(B0, B1, B2, B3); 119| 280| B0 = byte_transpose(B0); 120| 280| B1 = byte_transpose(B1); 121| 280| B2 = byte_transpose(B2); 122| 280| B3 = byte_transpose(B3); 123| 280|} _ZN5Botan11BlockCipher6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 96| 481|std::unique_ptr BlockCipher::create(std::string_view algo, std::string_view provider) { 97| |#if defined(BOTAN_HAS_COMMONCRYPTO) 98| | if(provider.empty() || provider == "commoncrypto") { 99| | if(auto bc = make_commoncrypto_block_cipher(algo)) 100| | return bc; 101| | 102| | if(!provider.empty()) 103| | return nullptr; 104| | } 105| |#endif 106| | 107| | // TODO: CryptoAPI 108| | // TODO: /dev/crypto 109| | 110| | // Only base providers from here on out 111| 481| if(provider.empty() == false && provider != "base") { ------------------ | Branch (111:7): [True: 0, False: 481] | Branch (111:36): [True: 0, False: 0] ------------------ 112| 0| return nullptr; 113| 0| } 114| | 115| 481|#if defined(BOTAN_HAS_AES) 116| 481| if(algo == "AES-128") { ------------------ | Branch (116:7): [True: 131, False: 350] ------------------ 117| 131| return std::make_unique(); 118| 131| } 119| | 120| 350| if(algo == "AES-192") { ------------------ | Branch (120:7): [True: 0, False: 350] ------------------ 121| 0| return std::make_unique(); 122| 0| } 123| | 124| 350| if(algo == "AES-256") { ------------------ | Branch (124:7): [True: 237, False: 113] ------------------ 125| 237| return std::make_unique(); 126| 237| } 127| 113|#endif 128| | 129| 113|#if defined(BOTAN_HAS_ARIA) 130| 113| if(algo == "ARIA-128") { ------------------ | Branch (130:7): [True: 2, False: 111] ------------------ 131| 2| return std::make_unique(); 132| 2| } 133| | 134| 111| if(algo == "ARIA-192") { ------------------ | Branch (134:7): [True: 0, False: 111] ------------------ 135| 0| return std::make_unique(); 136| 0| } 137| | 138| 111| if(algo == "ARIA-256") { ------------------ | Branch (138:7): [True: 2, False: 109] ------------------ 139| 2| return std::make_unique(); 140| 2| } 141| 109|#endif 142| | 143| 109|#if defined(BOTAN_HAS_SERPENT) 144| 109| if(algo == "Serpent") { ------------------ | Branch (144:7): [True: 0, False: 109] ------------------ 145| 0| return std::make_unique(); 146| 0| } 147| 109|#endif 148| | 149| 109|#if defined(BOTAN_HAS_SHACAL2) 150| 109| if(algo == "SHACAL2") { ------------------ | Branch (150:7): [True: 0, False: 109] ------------------ 151| 0| return std::make_unique(); 152| 0| } 153| 109|#endif 154| | 155| 109|#if defined(BOTAN_HAS_TWOFISH) 156| 109| if(algo == "Twofish") { ------------------ | Branch (156:7): [True: 0, False: 109] ------------------ 157| 0| return std::make_unique(); 158| 0| } 159| 109|#endif 160| | 161| 109|#if defined(BOTAN_HAS_THREEFISH_512) 162| 109| if(algo == "Threefish-512") { ------------------ | Branch (162:7): [True: 0, False: 109] ------------------ 163| 0| return std::make_unique(); 164| 0| } 165| 109|#endif 166| | 167| 109|#if defined(BOTAN_HAS_BLOWFISH) 168| 109| if(algo == "Blowfish") { ------------------ | Branch (168:7): [True: 0, False: 109] ------------------ 169| 0| return std::make_unique(); 170| 0| } 171| 109|#endif 172| | 173| 109|#if defined(BOTAN_HAS_CAMELLIA) 174| 109| if(algo == "Camellia-128") { ------------------ | Branch (174:7): [True: 1, False: 108] ------------------ 175| 1| return std::make_unique(); 176| 1| } 177| | 178| 108| if(algo == "Camellia-192") { ------------------ | Branch (178:7): [True: 0, False: 108] ------------------ 179| 0| return std::make_unique(); 180| 0| } 181| | 182| 108| if(algo == "Camellia-256") { ------------------ | Branch (182:7): [True: 3, False: 105] ------------------ 183| 3| return std::make_unique(); 184| 3| } 185| 105|#endif 186| | 187| 105|#if defined(BOTAN_HAS_DES) 188| 105| if(algo == "DES") { ------------------ | Branch (188:7): [True: 0, False: 105] ------------------ 189| 0| return std::make_unique(); 190| 0| } 191| | 192| 105| if(algo == "TripleDES" || algo == "3DES" || algo == "DES-EDE") { ------------------ | Branch (192:7): [True: 0, False: 105] | Branch (192:30): [True: 105, False: 0] | Branch (192:48): [True: 0, False: 0] ------------------ 193| 105| return std::make_unique(); 194| 105| } 195| 0|#endif 196| | 197| 0|#if defined(BOTAN_HAS_NOEKEON) 198| 0| if(algo == "Noekeon") { ------------------ | Branch (198:7): [True: 0, False: 0] ------------------ 199| 0| return std::make_unique(); 200| 0| } 201| 0|#endif 202| | 203| 0|#if defined(BOTAN_HAS_CAST_128) 204| 0| if(algo == "CAST-128" || algo == "CAST5") { ------------------ | Branch (204:7): [True: 0, False: 0] | Branch (204:29): [True: 0, False: 0] ------------------ 205| 0| return std::make_unique(); 206| 0| } 207| 0|#endif 208| | 209| 0|#if defined(BOTAN_HAS_IDEA) 210| 0| if(algo == "IDEA") { ------------------ | Branch (210:7): [True: 0, False: 0] ------------------ 211| 0| return std::make_unique(); 212| 0| } 213| 0|#endif 214| | 215| 0|#if defined(BOTAN_HAS_KUZNYECHIK) 216| 0| if(algo == "Kuznyechik") { ------------------ | Branch (216:7): [True: 0, False: 0] ------------------ 217| 0| return std::make_unique(); 218| 0| } 219| 0|#endif 220| | 221| 0|#if defined(BOTAN_HAS_SEED) 222| 0| if(algo == "SEED") { ------------------ | Branch (222:7): [True: 0, False: 0] ------------------ 223| 0| return std::make_unique(); 224| 0| } 225| 0|#endif 226| | 227| 0|#if defined(BOTAN_HAS_SM4) 228| 0| if(algo == "SM4") { ------------------ | Branch (228:7): [True: 0, False: 0] ------------------ 229| 0| return std::make_unique(); 230| 0| } 231| 0|#endif 232| | 233| 0| const SCAN_Name req(algo); 234| | 235| 0|#if defined(BOTAN_HAS_GOST_28147_89) 236| 0| if(req.algo_name() == "GOST-28147-89") { ------------------ | Branch (236:7): [True: 0, False: 0] ------------------ 237| 0| return std::make_unique(req.arg(0, "R3411_94_TestParam")); 238| 0| } 239| 0|#endif 240| | 241| 0|#if defined(BOTAN_HAS_CASCADE) 242| 0| if(req.algo_name() == "Cascade" && req.arg_count() == 2) { ------------------ | Branch (242:7): [True: 0, False: 0] | Branch (242:39): [True: 0, False: 0] ------------------ 243| 0| auto c1 = BlockCipher::create(req.arg(0)); 244| 0| auto c2 = BlockCipher::create(req.arg(1)); 245| | 246| 0| if(c1 && c2) { ------------------ | Branch (246:10): [True: 0, False: 0] | Branch (246:16): [True: 0, False: 0] ------------------ 247| 0| return std::make_unique(std::move(c1), std::move(c2)); 248| 0| } 249| 0| } 250| 0|#endif 251| | 252| 0|#if defined(BOTAN_HAS_LION) 253| 0| if(req.algo_name() == "Lion" && req.arg_count_between(2, 3)) { ------------------ | Branch (253:7): [True: 0, False: 0] | Branch (253:36): [True: 0, False: 0] ------------------ 254| 0| auto hash = HashFunction::create(req.arg(0)); 255| 0| auto stream = StreamCipher::create(req.arg(1)); 256| | 257| 0| if(hash && stream) { ------------------ | Branch (257:10): [True: 0, False: 0] | Branch (257:18): [True: 0, False: 0] ------------------ 258| 0| const size_t block_size = req.arg_as_integer(2, 1024); 259| 0| return std::make_unique(std::move(hash), std::move(stream), block_size); 260| 0| } 261| 0| } 262| 0|#endif 263| | 264| 0| BOTAN_UNUSED(req); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 265| 0| BOTAN_UNUSED(provider); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 266| | 267| 0| return nullptr; 268| 0|} _ZN5Botan11BlockCipher15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 271| 242|std::unique_ptr BlockCipher::create_or_throw(std::string_view algo, std::string_view provider) { 272| 242| if(auto bc = BlockCipher::create(algo, provider)) { ------------------ | Branch (272:12): [True: 242, False: 0] ------------------ 273| 242| return bc; 274| 242| } 275| 0| throw Lookup_Error("Block cipher", algo, provider); 276| 242|} _ZNK5Botan12Camellia_1289encrypt_nEPKhPhm: 431| 2|void Camellia_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 432| 2| assert_key_material_set(); 433| | 434| 2|#if defined(BOTAN_HAS_CAMELLIA_AVX512_GFNI) 435| 2| if(CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::GFNI)) { ------------------ | Branch (435:7): [True: 0, False: 2] ------------------ 436| 0| return avx512_gfni_encrypt(in, out, blocks, m_SK); 437| 0| } 438| 2|#endif 439| | 440| 2|#if defined(BOTAN_HAS_CAMELLIA_AVX2_GFNI) 441| 2| if(CPUID::has(CPUID::Feature::GFNI)) { ------------------ | Branch (441:7): [True: 0, False: 2] ------------------ 442| 0| return avx2_gfni_encrypt(in, out, blocks, m_SK); 443| 0| } 444| 2|#endif 445| | 446| 2|#if defined(BOTAN_HAS_CAMELLIA_HWAES) 447| 2| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (447:7): [True: 2, False: 0] ------------------ 448| 2| return hwaes_encrypt(in, out, blocks, m_SK); 449| 2| } 450| 0|#endif 451| | 452| 0| Camellia_F::encrypt(in, out, blocks, m_SK, 9); 453| 0|} _ZNK5Botan12Camellia_2569encrypt_nEPKhPhm: 479| 7|void Camellia_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 480| 7| assert_key_material_set(); 481| | 482| 7|#if defined(BOTAN_HAS_CAMELLIA_AVX512_GFNI) 483| 7| if(CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::GFNI)) { ------------------ | Branch (483:7): [True: 0, False: 7] ------------------ 484| 0| return avx512_gfni_encrypt(in, out, blocks, m_SK); 485| 0| } 486| 7|#endif 487| | 488| 7|#if defined(BOTAN_HAS_CAMELLIA_AVX2_GFNI) 489| 7| if(CPUID::has(CPUID::Feature::GFNI)) { ------------------ | Branch (489:7): [True: 0, False: 7] ------------------ 490| 0| return avx2_gfni_encrypt(in, out, blocks, m_SK); 491| 0| } 492| 7|#endif 493| | 494| 7|#if defined(BOTAN_HAS_CAMELLIA_HWAES) 495| 7| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (495:7): [True: 7, False: 0] ------------------ 496| 7| return hwaes_encrypt(in, out, blocks, m_SK); 497| 7| } 498| 0|#endif 499| | 500| 0| Camellia_F::encrypt(in, out, blocks, m_SK, 12); 501| 0|} _ZNK5Botan12Camellia_12819has_keying_materialEv: 575| 5|bool Camellia_128::has_keying_material() const { 576| 5| return !m_SK.empty(); 577| 5|} _ZNK5Botan12Camellia_25619has_keying_materialEv: 583| 19|bool Camellia_256::has_keying_material() const { 584| 19| return !m_SK.empty(); 585| 19|} _ZN5Botan12Camellia_12812key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 587| 1|void Camellia_128::key_schedule(std::span key) { 588| 1| Camellia_F::key_schedule(m_SK, key); 589| 1|} _ZN5Botan12Camellia_25612key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 595| 3|void Camellia_256::key_schedule(std::span key) { 596| 3| Camellia_F::key_schedule(m_SK, key); 597| 3|} _ZNK5Botan12Camellia_12811parallelismEv: 623| 2|size_t Camellia_128::parallelism() const { 624| 2| return Camellia_F::parallelism(); 625| 2|} _ZNK5Botan12Camellia_25611parallelismEv: 631| 6|size_t Camellia_256::parallelism() const { 632| 6| return Camellia_F::parallelism(); 633| 6|} camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F1PEhhhhhhhh: 96| 24|inline uint64_t P(uint8_t z1, uint8_t z2, uint8_t z3, uint8_t z4, uint8_t z5, uint8_t z6, uint8_t z7, uint8_t z8) { 97| 24| constexpr uint64_t M1 = 0x0101010001000001; 98| 24| constexpr uint64_t M2 = 0x0001010101010000; 99| 24| constexpr uint64_t M3 = 0x0100010100010100; 100| 24| constexpr uint64_t M4 = 0x0101000100000101; 101| 24| constexpr uint64_t M5 = 0x0001010100010101; 102| 24| constexpr uint64_t M6 = 0x0100010101000101; 103| 24| constexpr uint64_t M7 = 0x0101000101010001; 104| 24| constexpr uint64_t M8 = 0x0101010001010100; 105| | 106| 24| const uint64_t Z1 = M1 * z1; 107| 24| const uint64_t Z2 = M2 * z2; 108| 24| const uint64_t Z3 = M3 * z3; 109| 24| const uint64_t Z4 = M4 * z4; 110| 24| const uint64_t Z5 = M5 * z5; 111| 24| const uint64_t Z6 = M6 * z6; 112| 24| const uint64_t Z7 = M7 * z7; 113| 24| const uint64_t Z8 = M8 * z8; 114| | 115| 24| return Z1 ^ Z2 ^ Z3 ^ Z4 ^ Z5 ^ Z6 ^ Z7 ^ Z8; 116| 24|} camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F12key_scheduleERNSt3__16vectorImNS_16secure_allocatorImEEEENS2_4spanIKhLm18446744073709551615EEE: 263| 4|void key_schedule(secure_vector& SK, std::span key) { 264| 4| prefetch_arrays(SBOX1); 265| | 266| 4| constexpr uint64_t Sigma1 = 0xA09E667F3BCC908B; 267| 4| constexpr uint64_t Sigma2 = 0xB67AE8584CAA73B2; 268| 4| constexpr uint64_t Sigma3 = 0xC6EF372FE94F82BE; 269| 4| constexpr uint64_t Sigma4 = 0x54FF53A5F1D36F1C; 270| 4| constexpr uint64_t Sigma5 = 0x10E527FADE682D1D; 271| 4| constexpr uint64_t Sigma6 = 0xB05688C2B3E6C1FD; 272| | 273| 4| const uint64_t KL_H = load_be(key.data(), 0); 274| 4| const uint64_t KL_L = load_be(key.data(), 1); 275| | 276| 4| const uint64_t KR_H = (key.size() >= 24) ? load_be(key.data(), 2) : 0; ------------------ | Branch (276:26): [True: 3, False: 1] ------------------ 277| | 278| 4| const uint64_t KR_L = [&]() -> uint64_t { 279| 4| if(key.size() == 32) { 280| 4| return load_be(key.data(), 3); 281| 4| } else if(key.size() == 24) { 282| 4| return ~KR_H; 283| 4| } else { 284| 4| return 0; 285| 4| } 286| 4| }(); 287| | 288| 4| uint64_t D1 = KL_H ^ KR_H; 289| 4| uint64_t D2 = KL_L ^ KR_L; 290| 4| D2 ^= F_1tab(D1, Sigma1); 291| 4| D1 ^= F_1tab(D2, Sigma2); 292| 4| D1 ^= KL_H; 293| 4| D2 ^= KL_L; 294| 4| D2 ^= F_1tab(D1, Sigma3); 295| 4| D1 ^= F_1tab(D2, Sigma4); 296| | 297| 4| const uint64_t KA_H = D1; 298| 4| const uint64_t KA_L = D2; 299| | 300| 4| D1 = KA_H ^ KR_H; 301| 4| D2 = KA_L ^ KR_L; 302| 4| D2 ^= F_1tab(D1, Sigma5); 303| 4| D1 ^= F_1tab(D2, Sigma6); 304| | 305| 4| const uint64_t KB_H = D1; 306| 4| const uint64_t KB_L = D2; 307| | 308| 4| if(key.size() == 16) { ------------------ | Branch (308:7): [True: 1, False: 3] ------------------ 309| 1| SK.resize(26); 310| | 311| 1| SK[0] = KL_H; 312| 1| SK[1] = KL_L; 313| 1| SK[2] = KA_H; 314| 1| SK[3] = KA_L; 315| 1| SK[4] = left_rot_hi(KL_H, KL_L, 15); 316| 1| SK[5] = left_rot_lo(KL_H, KL_L, 15); 317| 1| SK[6] = left_rot_hi(KA_H, KA_L, 15); 318| 1| SK[7] = left_rot_lo(KA_H, KA_L, 15); 319| 1| SK[8] = left_rot_hi(KA_H, KA_L, 30); 320| 1| SK[9] = left_rot_lo(KA_H, KA_L, 30); 321| 1| SK[10] = left_rot_hi(KL_H, KL_L, 45); 322| 1| SK[11] = left_rot_lo(KL_H, KL_L, 45); 323| 1| SK[12] = left_rot_hi(KA_H, KA_L, 45); 324| 1| SK[13] = left_rot_lo(KL_H, KL_L, 60); 325| 1| SK[14] = left_rot_hi(KA_H, KA_L, 60); 326| 1| SK[15] = left_rot_lo(KA_H, KA_L, 60); 327| 1| SK[16] = left_rot_lo(KL_H, KL_L, 77); 328| 1| SK[17] = left_rot_hi(KL_H, KL_L, 77); 329| 1| SK[18] = left_rot_lo(KL_H, KL_L, 94); 330| 1| SK[19] = left_rot_hi(KL_H, KL_L, 94); 331| 1| SK[20] = left_rot_lo(KA_H, KA_L, 94); 332| 1| SK[21] = left_rot_hi(KA_H, KA_L, 94); 333| 1| SK[22] = left_rot_lo(KL_H, KL_L, 111); 334| 1| SK[23] = left_rot_hi(KL_H, KL_L, 111); 335| 1| SK[24] = left_rot_lo(KA_H, KA_L, 111); 336| 1| SK[25] = left_rot_hi(KA_H, KA_L, 111); 337| 3| } else { 338| 3| SK.resize(34); 339| | 340| 3| SK[0] = KL_H; 341| 3| SK[1] = KL_L; 342| 3| SK[2] = KB_H; 343| 3| SK[3] = KB_L; 344| | 345| 3| SK[4] = left_rot_hi(KR_H, KR_L, 15); 346| 3| SK[5] = left_rot_lo(KR_H, KR_L, 15); 347| 3| SK[6] = left_rot_hi(KA_H, KA_L, 15); 348| 3| SK[7] = left_rot_lo(KA_H, KA_L, 15); 349| | 350| 3| SK[8] = left_rot_hi(KR_H, KR_L, 30); 351| 3| SK[9] = left_rot_lo(KR_H, KR_L, 30); 352| 3| SK[10] = left_rot_hi(KB_H, KB_L, 30); 353| 3| SK[11] = left_rot_lo(KB_H, KB_L, 30); 354| | 355| 3| SK[12] = left_rot_hi(KL_H, KL_L, 45); 356| 3| SK[13] = left_rot_lo(KL_H, KL_L, 45); 357| 3| SK[14] = left_rot_hi(KA_H, KA_L, 45); 358| 3| SK[15] = left_rot_lo(KA_H, KA_L, 45); 359| | 360| 3| SK[16] = left_rot_hi(KL_H, KL_L, 60); 361| 3| SK[17] = left_rot_lo(KL_H, KL_L, 60); 362| 3| SK[18] = left_rot_hi(KR_H, KR_L, 60); 363| 3| SK[19] = left_rot_lo(KR_H, KR_L, 60); 364| 3| SK[20] = left_rot_hi(KB_H, KB_L, 60); 365| 3| SK[21] = left_rot_lo(KB_H, KB_L, 60); 366| | 367| 3| SK[22] = left_rot_lo(KL_H, KL_L, 77); 368| 3| SK[23] = left_rot_hi(KL_H, KL_L, 77); 369| 3| SK[24] = left_rot_lo(KA_H, KA_L, 77); 370| 3| SK[25] = left_rot_hi(KA_H, KA_L, 77); 371| | 372| 3| SK[26] = left_rot_lo(KR_H, KR_L, 94); 373| 3| SK[27] = left_rot_hi(KR_H, KR_L, 94); 374| 3| SK[28] = left_rot_lo(KA_H, KA_L, 94); 375| 3| SK[29] = left_rot_hi(KA_H, KA_L, 94); 376| 3| SK[30] = left_rot_lo(KL_H, KL_L, 111); 377| 3| SK[31] = left_rot_hi(KL_H, KL_L, 111); 378| 3| SK[32] = left_rot_lo(KB_H, KB_L, 111); 379| 3| SK[33] = left_rot_hi(KB_H, KB_L, 111); 380| 3| } 381| 4|} camellia.cpp:_ZZN5Botan12_GLOBAL__N_110Camellia_F12key_scheduleERNSt3__16vectorImNS_16secure_allocatorImEEEENS2_4spanIKhLm18446744073709551615EEEENK3$_0clEv: 278| 4| const uint64_t KR_L = [&]() -> uint64_t { 279| 4| if(key.size() == 32) { ------------------ | Branch (279:10): [True: 3, False: 1] ------------------ 280| 3| return load_be(key.data(), 3); 281| 3| } else if(key.size() == 24) { ------------------ | Branch (281:17): [True: 0, False: 1] ------------------ 282| 0| return ~KR_H; 283| 1| } else { 284| 1| return 0; 285| 1| } 286| 4| }(); camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F6F_1tabEmm: 131| 24|uint64_t F_1tab(uint64_t v, uint64_t K) { 132| 24| const uint64_t x = v ^ K; 133| | 134| 24| return P(SBOX1[get_byte<0>(x)], 135| 24| rotl<1>(SBOX1[get_byte<1>(x)]), 136| 24| rotl<7>(SBOX1[get_byte<2>(x)]), 137| 24| SBOX1[rotl<1>(get_byte<3>(x))], 138| 24| rotl<1>(SBOX1[get_byte<4>(x)]), 139| 24| rotl<7>(SBOX1[get_byte<5>(x)]), 140| 24| SBOX1[rotl<1>(get_byte<6>(x))], 141| 24| SBOX1[get_byte<7>(x)]); 142| 24|} camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F11left_rot_hiEmmm: 246| 56|inline uint64_t left_rot_hi(uint64_t h, uint64_t l, size_t shift) { 247| 56| if(shift >= 64) { ------------------ | Branch (247:7): [True: 23, False: 33] ------------------ 248| 23| shift -= 64; 249| 23| } 250| 56| return (h << shift) | (l >> (64 - shift)); 251| 56|} camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F11left_rot_loEmmm: 253| 56|inline uint64_t left_rot_lo(uint64_t h, uint64_t l, size_t shift) { 254| 56| if(shift >= 64) { ------------------ | Branch (254:7): [True: 23, False: 33] ------------------ 255| 23| shift -= 64; 256| 23| } 257| 56| return (h >> (64 - shift)) | (l << shift); 258| 56|} camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F11parallelismEv: 405| 8|size_t parallelism() { 406| 8|#if defined(BOTAN_HAS_CAMELLIA_AVX512_GFNI) 407| 8| if(CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::GFNI)) { ------------------ | Branch (407:7): [True: 0, False: 8] ------------------ 408| 0| return 16; 409| 0| } 410| 8|#endif 411| | 412| 8|#if defined(BOTAN_HAS_CAMELLIA_AVX2_GFNI) 413| 8| if(CPUID::has(CPUID::Feature::GFNI)) { ------------------ | Branch (413:7): [True: 0, False: 8] ------------------ 414| 0| return 4; 415| 0| } 416| 8|#endif 417| | 418| 8|#if defined(BOTAN_HAS_CAMELLIA_HWAES) 419| 8| if(CPUID::has(CPUID::Feature::HW_AES)) { ------------------ | Branch (419:7): [True: 8, False: 0] ------------------ 420| 8| return 2; 421| 8| } 422| 0|#endif 423| | 424| 0| return 1; 425| 8|} _ZN5Botan12Camellia_12813hwaes_encryptEPKhPhmNSt3__14spanIKmLm18446744073709551615EEE: 315| 2| std::span SK) { 316| 10| while(blocks >= 2) { ------------------ | Branch (316:10): [True: 8, False: 2] ------------------ 317| 8| Camellia_HWAES::camellia_encrypt_x2_18r(in, out, SK); 318| 8| in += 2 * 16; 319| 8| out += 2 * 16; 320| 8| blocks -= 2; 321| 8| } 322| | 323| 2| if(blocks > 0) { ------------------ | Branch (323:7): [True: 0, False: 2] ------------------ 324| 0| uint8_t ibuf[2 * 16] = {0}; 325| 0| uint8_t obuf[2 * 16] = {0}; 326| 0| copy_mem(ibuf, in, 16); 327| 0| Camellia_HWAES::camellia_encrypt_x2_18r(ibuf, obuf, SK); 328| 0| copy_mem(out, obuf, 16); 329| 0| } 330| 2|} _ZN5Botan12Camellia_25613hwaes_encryptEPKhPhmNSt3__14spanIKmLm18446744073709551615EEE: 399| 7| std::span SK) { 400| 35| while(blocks >= 2) { ------------------ | Branch (400:10): [True: 28, False: 7] ------------------ 401| 28| Camellia_HWAES::camellia_encrypt_x2_24r(in, out, SK); 402| 28| in += 2 * 16; 403| 28| out += 2 * 16; 404| 28| blocks -= 2; 405| 28| } 406| | 407| 7| if(blocks > 0) { ------------------ | Branch (407:7): [True: 0, False: 7] ------------------ 408| 0| uint8_t ibuf[2 * 16] = {0}; 409| 0| uint8_t obuf[2 * 16] = {0}; 410| 0| copy_mem(ibuf, in, 16); 411| 0| Camellia_HWAES::camellia_encrypt_x2_24r(ibuf, obuf, SK); 412| 0| copy_mem(out, obuf, 16); 413| 0| } 414| 7|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_123camellia_encrypt_x2_18rEPKhPhNSt3__14spanIKmLm18446744073709551615EEE: 213| 8|BOTAN_FN_ISA_HWAES void camellia_encrypt_x2_18r(const uint8_t in[], uint8_t out[], std::span SK) { 214| 8| SIMD_4x32 L; 215| 8| SIMD_4x32 R; 216| 8| load_and_deinterleave(in, L, R); 217| | 218| 8| L ^= splat64(SK[0]); 219| 8| R ^= splat64(SK[1]); 220| | 221| 8| six_e_rounds(L, R, &SK[2]); 222| 8| L = FL_2(L, SK[8]); 223| 8| R = FLINV_2(R, SK[9]); 224| 8| six_e_rounds(L, R, &SK[10]); 225| 8| L = FL_2(L, SK[16]); 226| 8| R = FLINV_2(R, SK[17]); 227| 8| six_e_rounds(L, R, &SK[18]); 228| | 229| 8| R ^= splat64(SK[24]); 230| 8| L ^= splat64(SK[25]); 231| | 232| 8| interleave_and_store(out, L, R); 233| 8|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_121load_and_deinterleaveEPKhRNS_9SIMD_4x32ES5_: 178| 36|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void load_and_deinterleave(const uint8_t in[], SIMD_4x32& L, SIMD_4x32& R) { 179| 36| auto A = load_be64(in); // block 0: [L0, R0] 180| 36| auto B = load_be64(in + 16); // block 1: [L1, R1] 181| 36| const auto mask_upper = SIMD_4x32(0x00000000, 0x00000000, 0xFFFFFFFF, 0xFFFFFFFF); 182| 36| L = SIMD_4x32::byte_blend(mask_upper, B.swap_halves(), A); // [L0, L1] 183| 36| R = SIMD_4x32::byte_blend(mask_upper, B, A.swap_halves()); // [R0, R1] 184| 36|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_19load_be64EPKh: 20| 72|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 load_be64(const uint8_t* in) { 21| 72| const auto bswap64 = SIMD_4x32(0x04050607, 0x00010203, 0x0C0D0E0F, 0x08090A0B); 22| 72| return SIMD_4x32::byte_shuffle(SIMD_4x32::load_le(in), bswap64); 23| 72|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_17splat64Em: 30| 960|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 splat64(uint64_t v) { 31| 960| const uint32_t lo = static_cast(v); 32| 960| const uint32_t hi = static_cast(v >> 32); 33| 960| return SIMD_4x32(lo, hi, lo, hi); 34| 960|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_112six_e_roundsERNS_9SIMD_4x32ES3_PKm: 195| 136|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void six_e_rounds(SIMD_4x32& L, SIMD_4x32& R, const uint64_t SK[]) { 196| 136| R ^= camellia_f(L ^ splat64(SK[0])); 197| 136| L ^= camellia_f(R ^ splat64(SK[1])); 198| 136| R ^= camellia_f(L ^ splat64(SK[2])); 199| 136| L ^= camellia_f(R ^ splat64(SK[3])); 200| 136| R ^= camellia_f(L ^ splat64(SK[4])); 201| 136| L ^= camellia_f(R ^ splat64(SK[5])); 202| 136|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_110camellia_fENS_9SIMD_4x32E: 37| 816|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 camellia_f(SIMD_4x32 x) { 38| | // Pre-affine shared by S1/S2/S3 39| 816| constexpr uint64_t pre123_a = gfni_matrix(R"( 40| 816| 1 1 1 0 1 1 0 1 41| 816| 0 0 1 1 0 0 1 0 42| 816| 1 1 0 1 0 0 0 0 43| 816| 1 0 1 1 0 0 1 1 44| 816| 0 0 0 0 1 1 0 0 45| 816| 1 0 1 0 0 1 0 0 46| 816| 0 0 1 0 1 1 0 0 47| 816| 1 0 0 0 0 1 1 0)"); 48| | 49| | // Pre-affine for S4 50| 816| constexpr uint64_t pre4_a = gfni_matrix(R"( 51| 816| 1 1 0 1 1 0 1 1 52| 816| 0 1 1 0 0 1 0 0 53| 816| 1 0 1 0 0 0 0 1 54| 816| 0 1 1 0 0 1 1 1 55| 816| 0 0 0 1 1 0 0 0 56| 816| 0 1 0 0 1 0 0 1 57| 816| 0 1 0 1 1 0 0 0 58| 816| 0 0 0 0 1 1 0 1)"); 59| | 60| 816| constexpr uint8_t pre_c = 0x45; 61| | 62| | // Post-affine for S1 and S4 63| 816| constexpr uint64_t post14_a = gfni_matrix(R"( 64| 816| 0 0 0 0 0 0 0 1 65| 816| 0 1 1 0 0 1 1 0 66| 816| 1 0 1 1 1 1 1 0 67| 816| 0 0 0 1 1 0 1 1 68| 816| 1 0 0 0 1 1 1 0 69| 816| 0 1 0 1 1 1 1 0 70| 816| 0 1 1 1 1 1 1 1 71| 816| 0 0 0 1 1 1 0 0)"); 72| 816| constexpr uint8_t post14_c = 0x6E; 73| | 74| | // Post-affine for S2 75| 816| constexpr uint64_t post2_a = gfni_matrix(R"( 76| 816| 0 0 0 1 1 1 0 0 77| 816| 0 0 0 0 0 0 0 1 78| 816| 0 1 1 0 0 1 1 0 79| 816| 1 0 1 1 1 1 1 0 80| 816| 0 0 0 1 1 0 1 1 81| 816| 1 0 0 0 1 1 1 0 82| 816| 0 1 0 1 1 1 1 0 83| 816| 0 1 1 1 1 1 1 1)"); 84| 816| constexpr uint8_t post2_c = 0xDC; 85| | 86| | // Post-affine for S3 87| 816| constexpr uint64_t post3_a = gfni_matrix(R"( 88| 816| 0 1 1 0 0 1 1 0 89| 816| 1 0 1 1 1 1 1 0 90| 816| 0 0 0 1 1 0 1 1 91| 816| 1 0 0 0 1 1 1 0 92| 816| 0 1 0 1 1 1 1 0 93| 816| 0 1 1 1 1 1 1 1 94| 816| 0 0 0 1 1 1 0 0 95| 816| 0 0 0 0 0 0 0 1)"); 96| 816| constexpr uint8_t post3_c = 0x37; 97| | 98| 816| constexpr auto PRE123 = Gf2AffineTransformation(pre123_a, pre_c); 99| 816| constexpr auto PRE4 = Gf2AffineTransformation(pre4_a, pre_c); 100| 816| constexpr auto POST14 = Gf2AffineTransformation::post_sbox(post14_a, post14_c); 101| 816| constexpr auto POST2 = Gf2AffineTransformation::post_sbox(post2_a, post2_c); 102| 816| constexpr auto POST3 = Gf2AffineTransformation::post_sbox(post3_a, post3_c); 103| | 104| 816| const auto mask_s2 = SIMD_4x32(0xFF000000, 0x00FF0000, 0xFF000000, 0x00FF0000); 105| 816| const auto mask_s3 = SIMD_4x32(0x00FF0000, 0x0000FF00, 0x00FF0000, 0x0000FF00); 106| 816| const auto mask_s4 = SIMD_4x32(0x0000FF00, 0x000000FF, 0x0000FF00, 0x000000FF); 107| | 108| 816| const auto pre123 = PRE123.affine_transform(x); 109| 816| const auto pre4 = PRE4.affine_transform(x); 110| | 111| 816| const auto sub = hw_aes_sbox(SIMD_4x32::byte_blend(mask_s4, pre4, pre123)); 112| | 113| 816| const auto s14 = POST14.affine_transform(sub); 114| 816| const auto s2 = POST2.affine_transform(sub); 115| 816| const auto s3 = POST3.affine_transform(sub); 116| | 117| | // Final merged Sbox output for all bytes 118| 816| const auto sbox = SIMD_4x32::byte_blend(mask_s3, s3, SIMD_4x32::byte_blend(mask_s2, s2, s14)); 119| | 120| | // The linear mixing step 121| 816| const auto P1 = SIMD_4x32(0x00000001, 0x00000001, 0x08080809, 0x08080809); 122| 816| const auto P2 = SIMD_4x32(0x01010202, 0x01010202, 0x09090A0A, 0x09090A0A); 123| 816| const auto P3 = SIMD_4x32(0x02030303, 0x02030303, 0x0A0B0B0B, 0x0A0B0B0B); 124| 816| const auto P4 = SIMD_4x32(0x06050404, 0x04040504, 0x0E0D0C0C, 0x0C0C0D0C); 125| 816| const auto P5 = SIMD_4x32(0x07060507, 0x05060605, 0x0F0E0D0F, 0x0D0E0E0D); 126| 816| const auto P6 = SIMD_4x32(0xFFFFFFFF, 0x07070706, 0xFFFFFFFF, 0x0F0F0F0E); 127| | 128| 816| const auto sxp1 = SIMD_4x32::byte_shuffle(sbox, P1); 129| 816| const auto sxp2 = SIMD_4x32::byte_shuffle(sbox, P2); 130| 816| const auto sxp3 = SIMD_4x32::byte_shuffle(sbox, P3); 131| 816| const auto sxp4 = SIMD_4x32::byte_shuffle(sbox, P4); 132| 816| const auto sxp5 = SIMD_4x32::byte_shuffle(sbox, P5); 133| 816| const auto sxp6 = SIMD_4x32::byte_shuffle(sbox, P6); 134| | 135| 816| return (sxp1 ^ sxp2 ^ sxp3 ^ sxp4 ^ sxp5 ^ sxp6); 136| 816|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_14FL_2ENS_9SIMD_4x32Em: 142| 100|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 FL_2(SIMD_4x32 v, uint64_t K) { 143| 100| const uint32_t k1 = static_cast(K >> 32); 144| 100| const uint32_t k2 = static_cast(K); 145| | 146| | // Broadcast upper/lower 32-bit halves of each 64-bit element 147| 100| const auto shuf_hi = SIMD_4x32(0x07060504, 0x07060504, 0x0F0E0D0C, 0x0F0E0D0C); 148| 100| const auto shuf_lo = SIMD_4x32(0x03020100, 0x03020100, 0x0B0A0908, 0x0B0A0908); 149| | 150| 100| auto x1 = SIMD_4x32::byte_shuffle(v, shuf_hi); 151| 100| auto x2 = SIMD_4x32::byte_shuffle(v, shuf_lo); 152| | 153| 100| x2 ^= (x1 & SIMD_4x32::splat(k1)).rotl<1>(); 154| 100| x1 ^= x2 | SIMD_4x32::splat(k2); 155| | 156| | // Recombine: lo from x2, hi from x1 157| 100| const auto mask_hi = SIMD_4x32(0x00000000, 0xFFFFFFFF, 0x00000000, 0xFFFFFFFF); 158| 100| return SIMD_4x32::byte_blend(mask_hi, x1, x2); 159| 100|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_17FLINV_2ENS_9SIMD_4x32Em: 161| 100|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES SIMD_4x32 FLINV_2(SIMD_4x32 v, uint64_t K) { 162| 100| const uint32_t k1 = static_cast(K >> 32); 163| 100| const uint32_t k2 = static_cast(K); 164| | 165| 100| const auto shuf_hi = SIMD_4x32(0x07060504, 0x07060504, 0x0F0E0D0C, 0x0F0E0D0C); 166| 100| const auto shuf_lo = SIMD_4x32(0x03020100, 0x03020100, 0x0B0A0908, 0x0B0A0908); 167| | 168| 100| auto x1 = SIMD_4x32::byte_shuffle(v, shuf_hi); 169| 100| auto x2 = SIMD_4x32::byte_shuffle(v, shuf_lo); 170| | 171| 100| x1 ^= x2 | SIMD_4x32::splat(k2); 172| 100| x2 ^= (x1 & SIMD_4x32::splat(k1)).rotl<1>(); 173| | 174| 100| const auto mask_hi = SIMD_4x32(0x00000000, 0xFFFFFFFF, 0x00000000, 0xFFFFFFFF); 175| 100| return SIMD_4x32::byte_blend(mask_hi, x1, x2); 176| 100|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_120interleave_and_storeEPhNS_9SIMD_4x32ES3_: 186| 36|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void interleave_and_store(uint8_t out[], SIMD_4x32 L, SIMD_4x32 R) { 187| | // Camellia output swaps L and R 188| 36| const auto mask_upper = SIMD_4x32(0x00000000, 0x00000000, 0xFFFFFFFF, 0xFFFFFFFF); 189| 36| auto A = SIMD_4x32::byte_blend(mask_upper, L.swap_halves(), R); // [R0, L0] 190| 36| auto B = SIMD_4x32::byte_blend(mask_upper, L, R.swap_halves()); // [R1, L1] 191| 36| store_be64(out, A); 192| 36| store_be64(out + 16, B); 193| 36|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_110store_be64EPhNS_9SIMD_4x32E: 25| 72|BOTAN_FORCE_INLINE BOTAN_FN_ISA_HWAES void store_be64(uint8_t* out, SIMD_4x32 v) { 26| 72| const auto bswap64 = SIMD_4x32(0x04050607, 0x00010203, 0x0C0D0E0F, 0x08090A0B); 27| 72| SIMD_4x32::byte_shuffle(v, bswap64).store_le(out); 28| 72|} camellia_hwaes.cpp:_ZN5Botan14Camellia_HWAES12_GLOBAL__N_123camellia_encrypt_x2_24rEPKhPhNSt3__14spanIKmLm18446744073709551615EEE: 257| 28|BOTAN_FN_ISA_HWAES void camellia_encrypt_x2_24r(const uint8_t in[], uint8_t out[], std::span SK) { 258| 28| SIMD_4x32 L; 259| 28| SIMD_4x32 R; 260| 28| load_and_deinterleave(in, L, R); 261| | 262| 28| L ^= splat64(SK[0]); 263| 28| R ^= splat64(SK[1]); 264| | 265| 28| six_e_rounds(L, R, &SK[2]); 266| 28| L = FL_2(L, SK[8]); 267| 28| R = FLINV_2(R, SK[9]); 268| 28| six_e_rounds(L, R, &SK[10]); 269| 28| L = FL_2(L, SK[16]); 270| 28| R = FLINV_2(R, SK[17]); 271| 28| six_e_rounds(L, R, &SK[18]); 272| 28| L = FL_2(L, SK[24]); 273| 28| R = FLINV_2(R, SK[25]); 274| 28| six_e_rounds(L, R, &SK[26]); 275| | 276| 28| R ^= splat64(SK[32]); 277| 28| L ^= splat64(SK[33]); 278| | 279| 28| interleave_and_store(out, L, R); 280| 28|} _ZNK5Botan9TripleDES9encrypt_nEPKhPhm: 769| 195|void TripleDES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 770| 195| assert_key_material_set(); 771| | 772| 195| const uint32_t* k1 = m_round_key.data(); 773| 195| const uint32_t* k2 = k1 + 16 * 48; 774| 195| const uint32_t* k3 = k2 + 16 * 48; 775| | 776| 195| uint32_t B[64]; 777| | 778| 195| while(blocks >= 32) { ------------------ | Branch (778:10): [True: 0, False: 195] ------------------ 779| 0| transpose_in(B, in, 32); 780| 0| des_encrypt(&B[0], &B[32], k1); 781| 0| des_decrypt(&B[32], &B[0], k2); 782| 0| des_encrypt(&B[0], &B[32], k3); 783| 0| transpose_out(out, B, 32); 784| | 785| 0| in += 32 * BLOCK_SIZE; 786| 0| out += 32 * BLOCK_SIZE; 787| 0| blocks -= 32; 788| 0| } 789| | 790| 195| if(blocks > 0) { ------------------ | Branch (790:7): [True: 195, False: 0] ------------------ 791| 195| transpose_in(B, in, blocks); 792| 195| des_encrypt(&B[0], &B[32], k1); 793| 195| des_decrypt(&B[32], &B[0], k2); 794| 195| des_encrypt(&B[0], &B[32], k3); 795| 195| transpose_out(out, B, blocks); 796| 195| } 797| 195|} _ZNK5Botan9TripleDES9decrypt_nEPKhPhm: 802| 169|void TripleDES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { 803| 169| assert_key_material_set(); 804| | 805| 169| const uint32_t* k1 = m_round_key.data(); 806| 169| const uint32_t* k2 = k1 + 16 * 48; 807| 169| const uint32_t* k3 = k2 + 16 * 48; 808| | 809| 169| uint32_t B[64]; 810| | 811| 680| while(blocks >= 32) { ------------------ | Branch (811:10): [True: 511, False: 169] ------------------ 812| 511| transpose_in(B, in, 32); 813| 511| des_decrypt(&B[0], &B[32], k3); 814| 511| des_encrypt(&B[32], &B[0], k2); 815| 511| des_decrypt(&B[0], &B[32], k1); 816| 511| transpose_out(out, B, 32); 817| | 818| 511| in += 32 * BLOCK_SIZE; 819| 511| out += 32 * BLOCK_SIZE; 820| 511| blocks -= 32; 821| 511| } 822| | 823| 169| if(blocks > 0) { ------------------ | Branch (823:7): [True: 55, False: 114] ------------------ 824| 55| transpose_in(B, in, blocks); 825| 55| des_decrypt(&B[0], &B[32], k3); 826| 55| des_encrypt(&B[32], &B[0], k2); 827| 55| des_decrypt(&B[0], &B[32], k1); 828| 55| transpose_out(out, B, blocks); 829| 55| } 830| 169|} _ZNK5Botan9TripleDES19has_keying_materialEv: 832| 364|bool TripleDES::has_keying_material() const { 833| 364| return !m_round_key.empty(); 834| 364|} _ZN5Botan9TripleDES12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 839| 105|void TripleDES::key_schedule(std::span key) { 840| 105| m_round_key.resize(3 * 16 * 48); 841| 105| des_key_schedule(m_round_key.data(), key.first(8).data()); 842| 105| des_key_schedule(m_round_key.data() + 16 * 48, key.subspan(8, 8).data()); 843| | 844| 105| if(key.size() == 24) { ------------------ | Branch (844:7): [True: 105, False: 0] ------------------ 845| 105| des_key_schedule(m_round_key.data() + 2 * 16 * 48, key.last(8).data()); 846| 105| } else { 847| 0| copy_mem(m_round_key.data() + 2 * 16 * 48, m_round_key.data(), 16 * 48); 848| 0| } 849| 105|} des.cpp:_ZN5Botan12_GLOBAL__N_112transpose_inEPjPKhm: 537| 761|void transpose_in(uint32_t B[64], const uint8_t in[], size_t n_blocks) { 538| 761| uint64_t M[32] = {}; 539| | 540| 761| load_be(M, in, n_blocks); 541| | 542| 761| des_transpose(M); 543| | 544| | // clang-format off 545| 761| static constexpr uint8_t IP[64] = { 546| 761| 57, 49, 41, 33, 25, 17, 9, 1, 547| 761| 59, 51, 43, 35, 27, 19, 11, 3, 548| 761| 61, 53, 45, 37, 29, 21, 13, 5, 549| 761| 63, 55, 47, 39, 31, 23, 15, 7, 550| 761| 56, 48, 40, 32, 24, 16, 8, 0, 551| 761| 58, 50, 42, 34, 26, 18, 10, 2, 552| 761| 60, 52, 44, 36, 28, 20, 12, 4, 553| 761| 62, 54, 46, 38, 30, 22, 14, 6 554| 761| }; 555| | // clang-format on 556| | 557| 49.4k| for(size_t i = 0; i < 64; ++i) { ------------------ | Branch (557:22): [True: 48.7k, False: 761] ------------------ 558| 48.7k| const uint8_t src = IP[i]; 559| 48.7k| if(src < 32) { ------------------ | Branch (559:10): [True: 24.3k, False: 24.3k] ------------------ 560| 24.3k| B[i] = static_cast(M[31 - src] >> 32); 561| 24.3k| } else { 562| 24.3k| B[i] = static_cast(M[63 - src]); 563| 24.3k| } 564| 48.7k| } 565| 761|} des.cpp:_ZN5Botan12_GLOBAL__N_113des_transposeEPm: 509| 1.52k|void des_transpose(uint64_t M[32]) { 510| 25.8k| for(size_t i = 0; i != 16; ++i) { ------------------ | Branch (510:22): [True: 24.3k, False: 1.52k] ------------------ 511| 24.3k| swap_bits(M[i], M[i + 16], 0x0000FFFF0000FFFF, 16); 512| 24.3k| } 513| | 514| 4.56k| for(size_t i = 0; i != 32; i += 16) { ------------------ | Branch (514:22): [True: 3.04k, False: 1.52k] ------------------ 515| 27.3k| for(size_t j = 0; j != 8; ++j) { ------------------ | Branch (515:25): [True: 24.3k, False: 3.04k] ------------------ 516| 24.3k| swap_bits(M[i + j], M[i + j + 8], 0x00FF00FF00FF00FF, 8); 517| 24.3k| } 518| 3.04k| } 519| | 520| 7.61k| for(size_t i = 0; i != 32; i += 8) { ------------------ | Branch (520:22): [True: 6.08k, False: 1.52k] ------------------ 521| 30.4k| for(size_t j = 0; j != 4; ++j) { ------------------ | Branch (521:25): [True: 24.3k, False: 6.08k] ------------------ 522| 24.3k| swap_bits(M[i + j + 0], M[i + j + 4], 0x0F0F0F0F0F0F0F0F, 4); 523| 24.3k| } 524| 6.08k| } 525| | 526| 13.6k| for(size_t i = 0; i != 32; i += 4) { ------------------ | Branch (526:22): [True: 12.1k, False: 1.52k] ------------------ 527| 36.5k| for(size_t j = 0; j != 2; ++j) { ------------------ | Branch (527:25): [True: 24.3k, False: 12.1k] ------------------ 528| 24.3k| swap_bits(M[i + j + 0], M[i + j + 2], 0x3333333333333333, 2); 529| 24.3k| } 530| 12.1k| } 531| | 532| 25.8k| for(size_t i = 0; i != 32; i += 2) { ------------------ | Branch (532:22): [True: 24.3k, False: 1.52k] ------------------ 533| 24.3k| swap_bits(M[i], M[i + 1], 0x5555555555555555, 1); 534| 24.3k| } 535| 1.52k|} des.cpp:_ZN5Botan12_GLOBAL__N_111des_encryptEPjS1_PKj: 638| 956|void des_encrypt(uint32_t L[32], uint32_t R[32], const uint32_t round_key[]) { 639| 8.60k| for(size_t round = 0; round < 16; round += 2) { ------------------ | Branch (639:26): [True: 7.64k, False: 956] ------------------ 640| 7.64k| des_round(L, R, &round_key[round * 48]); 641| 7.64k| des_round(R, L, &round_key[(round + 1) * 48]); 642| 7.64k| } 643| 956|} des.cpp:_ZN5Botan12_GLOBAL__N_19des_roundEPjPKjS3_: 602| 36.5k|void des_round(uint32_t L[32], const uint32_t R[32], const uint32_t RK[48]) { 603| | // clang-format off 604| 36.5k| SBox1(R[31] ^ RK[ 0], R[ 0] ^ RK[ 1], R[ 1] ^ RK[ 2], 605| 36.5k| R[ 2] ^ RK[ 3], R[ 3] ^ RK[ 4], R[ 4] ^ RK[ 5], 606| 36.5k| L[ 8], L[16], L[22], L[30]); 607| | 608| 36.5k| SBox2(R[ 3] ^ RK[ 6], R[ 4] ^ RK[ 7], R[ 5] ^ RK[ 8], 609| 36.5k| R[ 6] ^ RK[ 9], R[ 7] ^ RK[10], R[ 8] ^ RK[11], 610| 36.5k| L[12], L[27], L[ 1], L[17]); 611| | 612| 36.5k| SBox3(R[ 7] ^ RK[12], R[ 8] ^ RK[13], R[ 9] ^ RK[14], 613| 36.5k| R[10] ^ RK[15], R[11] ^ RK[16], R[12] ^ RK[17], 614| 36.5k| L[23], L[15], L[29], L[ 5]); 615| | 616| 36.5k| SBox4(R[11] ^ RK[18], R[12] ^ RK[19], R[13] ^ RK[20], 617| 36.5k| R[14] ^ RK[21], R[15] ^ RK[22], R[16] ^ RK[23], 618| 36.5k| L[25], L[19], L[ 9], L[ 0]); 619| | 620| 36.5k| SBox5(R[15] ^ RK[24], R[16] ^ RK[25], R[17] ^ RK[26], 621| 36.5k| R[18] ^ RK[27], R[19] ^ RK[28], R[20] ^ RK[29], 622| 36.5k| L[ 7], L[13], L[24], L[ 2]); 623| | 624| 36.5k| SBox6(R[19] ^ RK[30], R[20] ^ RK[31], R[21] ^ RK[32], 625| 36.5k| R[22] ^ RK[33], R[23] ^ RK[34], R[24] ^ RK[35], 626| 36.5k| L[ 3], L[28], L[10], L[18]); 627| | 628| 36.5k| SBox7(R[23] ^ RK[36], R[24] ^ RK[37], R[25] ^ RK[38], 629| 36.5k| R[26] ^ RK[39], R[27] ^ RK[40], R[28] ^ RK[41], 630| 36.5k| L[31], L[11], L[21], L[ 6]); 631| | 632| 36.5k| SBox8(R[27] ^ RK[42], R[28] ^ RK[43], R[29] ^ RK[44], 633| 36.5k| R[30] ^ RK[45], R[31] ^ RK[46], R[ 0] ^ RK[47], 634| 36.5k| L[ 4], L[26], L[14], L[20]); 635| | // clang-format on 636| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_15SBox1ITkNS0_9BitsliceTEjEEvT_S2_S2_S2_S2_S2_RS2_S3_S3_S3_: 38| 36.5k|BOTAN_FORCE_INLINE void SBox1(T a1, T a2, T a3, T a4, T a5, T a6, T& out1, T& out2, T& out3, T& out4) { 39| 36.5k| const T x1 = a1 & ~a5; 40| 36.5k| const T x2 = a4 ^ x1; 41| 36.5k| const T x3 = a3 | a6; 42| 36.5k| const T x4 = a1 ^ a3; 43| 36.5k| const T x5 = x3 & x4; 44| 36.5k| const T x6 = a4 ^ x5; 45| 36.5k| const T x7 = x6 & ~x2; 46| | 47| 36.5k| const T x8 = a5 ^ a6; 48| 36.5k| const T x9 = a3 ^ x8; 49| 36.5k| const T x10 = x2 & ~x9; 50| 36.5k| const T x11 = a6 | x5; 51| 36.5k| const T x12 = x10 ^ x11; 52| 36.5k| const T x13 = x12 & ~x7; 53| | 54| 36.5k| const T x14 = a1 | a6; 55| 36.5k| const T x15 = x12 | x14; 56| 36.5k| const T x16 = a5 & ~x6; 57| 36.5k| const T x17 = x15 ^ x16; 58| | 59| 36.5k| const T x18 = a4 & ~x14; 60| 36.5k| const T x19 = x16 ^ x18; 61| 36.5k| const T x20 = x8 & ~x4; 62| 36.5k| const T x21 = x19 | x20; 63| | 64| 36.5k| const T x22 = a3 & ~x1; 65| 36.5k| const T x23 = x2 ^ x15; 66| 36.5k| const T x24 = x23 & ~x22; 67| 36.5k| const T x25 = ~x24; 68| 36.5k| const T x26 = x3 & x12; 69| 36.5k| const T x27 = x25 ^ x26; 70| 36.5k| const T x28 = x17 & ~a2; 71| 36.5k| const T x29 = x28 ^ x27; 72| 36.5k| out3 ^= x29; 73| | 74| 36.5k| const T x30 = x8 ^ x24; 75| 36.5k| const T x31 = x16 | x30; 76| 36.5k| const T x32 = x3 ^ x31; 77| 36.5k| const T x33 = a1 ^ x32; 78| 36.5k| const T x34 = x27 ^ x33; 79| 36.5k| const T x35 = x7 | a2; 80| 36.5k| const T x36 = x35 ^ x34; 81| 36.5k| out1 ^= x36; 82| | 83| 36.5k| const T x37 = x2 & ~x21; 84| 36.5k| const T x38 = x30 ^ x37; 85| 36.5k| const T x39 = x16 ^ x32; 86| 36.5k| const T x40 = x34 & ~x39; 87| 36.5k| const T x41 = x38 ^ x40; 88| 36.5k| const T x42 = a2 & ~x13; 89| 36.5k| const T x43 = x42 ^ x41; 90| 36.5k| out2 ^= x43; 91| | 92| 36.5k| const T x44 = x9 ^ x20; 93| 36.5k| const T x45 = x14 ^ x40; 94| 36.5k| const T x46 = x45 & ~x44; 95| 36.5k| const T x47 = x41 ^ x46; 96| 36.5k| const T x48 = x47 | a2; 97| 36.5k| const T x49 = x48 ^ x21; 98| 36.5k| out4 ^= x49; 99| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_15SBox2ITkNS0_9BitsliceTEjEEvT_S2_S2_S2_S2_S2_RS2_S3_S3_S3_: 102| 36.5k|BOTAN_FORCE_INLINE void SBox2(T a1, T a2, T a3, T a4, T a5, T a6, T& out1, T& out2, T& out3, T& out4) { 103| 36.5k| const T x1 = a2 ^ a5; 104| | 105| 36.5k| const T x2 = a1 & ~a6; 106| 36.5k| const T x3 = a5 & ~x2; 107| 36.5k| const T x4 = a2 | x3; 108| | 109| 36.5k| const T x5 = x1 & ~a6; 110| 36.5k| const T x6 = a1 & x1; 111| 36.5k| const T x7 = a5 ^ x6; 112| 36.5k| const T x8 = x7 & ~x5; 113| | 114| 36.5k| const T x9 = a3 & a6; 115| 36.5k| const T x10 = x3 ^ x5; 116| 36.5k| const T x11 = x4 & x10; 117| 36.5k| const T x12 = x11 & ~x9; 118| | 119| 36.5k| const T x13 = a3 & x11; 120| 36.5k| const T x14 = ~a1; 121| 36.5k| const T x15 = x13 ^ x14; 122| 36.5k| const T x16 = a6 ^ x1; 123| 36.5k| const T x17 = x16 & ~x9; 124| 36.5k| const T x18 = x15 ^ x17; 125| 36.5k| const T x19 = a4 & ~x12; 126| 36.5k| const T x20 = x19 ^ x18; 127| 36.5k| out2 ^= x20; 128| | 129| 36.5k| const T x21 = a2 & ~x17; 130| 36.5k| const T x22 = x7 ^ x21; 131| 36.5k| const T x23 = x15 & ~x22; 132| 36.5k| const T x24 = a3 ^ x16; 133| 36.5k| const T x25 = x23 ^ x24; 134| 36.5k| const T x26 = x4 & ~a4; 135| 36.5k| const T x27 = x26 ^ x25; 136| 36.5k| out1 ^= x27; 137| | 138| 36.5k| const T x28 = a2 & ~x9; 139| 36.5k| const T x29 = x24 | x28; 140| 36.5k| const T x30 = x4 ^ x18; 141| 36.5k| const T x31 = x9 | x30; 142| 36.5k| const T x32 = x29 ^ x31; 143| | 144| 36.5k| const T x33 = x11 ^ x18; 145| 36.5k| const T x34 = x25 ^ x33; 146| 36.5k| const T x35 = x31 & x34; 147| 36.5k| const T x36 = x1 & x29; 148| 36.5k| const T x37 = x35 ^ x36; 149| 36.5k| const T x38 = x37 | a4; 150| 36.5k| const T x39 = x38 ^ x32; 151| 36.5k| out3 ^= x39; 152| | 153| 36.5k| const T x40 = x37 & ~x22; 154| 36.5k| const T x41 = x16 | x30; 155| 36.5k| const T x42 = x40 ^ x41; 156| 36.5k| const T x43 = x8 | a4; 157| 36.5k| const T x44 = x43 ^ x42; 158| 36.5k| out4 ^= x44; 159| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_15SBox3ITkNS0_9BitsliceTEjEEvT_S2_S2_S2_S2_S2_RS2_S3_S3_S3_: 162| 36.5k|BOTAN_FORCE_INLINE void SBox3(T a1, T a2, T a3, T a4, T a5, T a6, T& out1, T& out2, T& out3, T& out4) { 163| 36.5k| const T x1 = a1 & ~a2; 164| 36.5k| const T x2 = a3 ^ a6; 165| 36.5k| const T x3 = x1 | x2; 166| 36.5k| const T x4 = a4 ^ a6; 167| 36.5k| const T x5 = x4 & ~a1; 168| 36.5k| const T x6 = x3 ^ x5; 169| | 170| 36.5k| const T x7 = a2 ^ x2; 171| 36.5k| const T x8 = x7 & ~a6; 172| 36.5k| const T x9 = x3 ^ x8; 173| 36.5k| const T x10 = x6 & ~x9; 174| | 175| 36.5k| const T x11 = a6 & x6; 176| 36.5k| const T x12 = a4 | x11; 177| 36.5k| const T x13 = a1 & x12; 178| 36.5k| const T x14 = x7 ^ x13; 179| 36.5k| const T x15 = x6 & ~a5; 180| 36.5k| const T x16 = x15 ^ x14; 181| 36.5k| out4 ^= x16; 182| | 183| 36.5k| const T x17 = x2 & x4; 184| 36.5k| const T x18 = a1 ^ a4; 185| 36.5k| const T x19 = x9 ^ x18; 186| 36.5k| const T x20 = a3 | x19; 187| 36.5k| const T x21 = x20 & ~x17; 188| | 189| 36.5k| const T x22 = x5 | x18; 190| 36.5k| const T x23 = x14 & ~x22; 191| 36.5k| const T x24 = a4 & a6; 192| 36.5k| const T x25 = x24 & ~a2; 193| 36.5k| const T x26 = x23 ^ x25; 194| | 195| 36.5k| const T x27 = x9 & x26; 196| 36.5k| const T x28 = x7 | x24; 197| 36.5k| const T x29 = x28 & ~x27; 198| 36.5k| const T x30 = a1 ^ x29; 199| 36.5k| const T x31 = x21 & a5; 200| 36.5k| const T x32 = x31 ^ x30; 201| 36.5k| out2 ^= x32; 202| | 203| 36.5k| const T x33 = x6 & ~a2; 204| 36.5k| const T x34 = x33 & ~a3; 205| 36.5k| const T x35 = ~x7; 206| 36.5k| const T x36 = x22 ^ x35; 207| 36.5k| const T x37 = x34 ^ x36; 208| 36.5k| const T x38 = a5 & ~x10; 209| 36.5k| const T x39 = x38 ^ x37; 210| 36.5k| out1 ^= x39; 211| | 212| 36.5k| const T x40 = x34 | x36; 213| 36.5k| const T x41 = x5 | x33; 214| 36.5k| const T x42 = x40 ^ x41; 215| 36.5k| const T x43 = a4 & ~x6; 216| 36.5k| const T x44 = x42 | x43; 217| 36.5k| const T x45 = a5 & ~x26; 218| 36.5k| const T x46 = x45 ^ x44; 219| 36.5k| out3 ^= x46; 220| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_15SBox4ITkNS0_9BitsliceTEjEEvT_S2_S2_S2_S2_S2_RS2_S3_S3_S3_: 223| 36.5k|BOTAN_FORCE_INLINE void SBox4(T a1, T a2, T a3, T a4, T a5, T a6, T& out1, T& out2, T& out3, T& out4) { 224| 36.5k| const T x1 = a1 ^ a3; 225| 36.5k| const T x2 = a3 ^ a5; 226| 36.5k| const T x3 = a2 | a4; 227| 36.5k| const T x4 = a5 ^ x3; 228| 36.5k| const T x5 = x2 & ~x4; 229| 36.5k| const T x6 = x2 & ~a2; 230| 36.5k| const T x7 = a4 ^ x6; 231| 36.5k| const T x8 = x1 | x7; 232| 36.5k| const T x9 = x8 & ~x5; 233| 36.5k| const T x10 = a2 ^ x9; 234| | 235| 36.5k| const T x11 = x7 & x10; 236| 36.5k| const T x12 = x2 & ~x11; 237| 36.5k| const T x13 = x1 ^ x10; 238| 36.5k| const T x14 = x13 & ~x12; 239| 36.5k| const T x15 = x5 ^ x14; 240| | 241| 36.5k| const T x16 = a2 ^ a4; 242| 36.5k| const T x17 = a5 | x6; 243| 36.5k| const T x18 = x13 ^ x17; 244| 36.5k| const T x19 = x18 & ~x16; 245| 36.5k| const T x20 = x9 ^ x19; 246| 36.5k| const T x21 = a6 & ~x15; 247| 36.5k| const T x22 = x21 ^ x20; 248| 36.5k| out1 ^= x22; 249| | 250| 36.5k| const T x23 = ~x20; 251| 36.5k| const T x24 = x15 & ~a6; 252| 36.5k| const T x25 = x24 ^ x23; 253| 36.5k| out2 ^= x25; 254| | 255| 36.5k| const T x26 = x15 ^ x23; 256| 36.5k| const T x27 = x26 & ~x16; 257| 36.5k| const T x28 = x11 | x27; 258| 36.5k| const T x29 = x18 ^ x28; 259| 36.5k| const T x30 = x10 | a6; 260| 36.5k| const T x31 = x30 ^ x29; 261| 36.5k| out3 ^= x31; 262| | 263| 36.5k| const T x32 = a6 & x10; 264| 36.5k| const T x33 = x32 ^ x29; 265| 36.5k| out4 ^= x33; 266| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_15SBox5ITkNS0_9BitsliceTEjEEvT_S2_S2_S2_S2_S2_RS2_S3_S3_S3_: 269| 36.5k|BOTAN_FORCE_INLINE void SBox5(T a1, T a2, T a3, T a4, T a5, T a6, T& out1, T& out2, T& out3, T& out4) { 270| 36.5k| const T x1 = a1 | a3; 271| 36.5k| const T x2 = x1 & ~a6; 272| 36.5k| const T x3 = a1 ^ x2; 273| 36.5k| const T x4 = a3 ^ x3; 274| 36.5k| const T x5 = a4 | x4; 275| | 276| 36.5k| const T x6 = x2 & ~a4; 277| 36.5k| const T x7 = a3 ^ x6; 278| 36.5k| const T x8 = a5 & x7; 279| 36.5k| const T x9 = a1 | x4; 280| 36.5k| const T x10 = x8 ^ x9; 281| 36.5k| const T x11 = a4 ^ x10; 282| | 283| 36.5k| const T x12 = a6 ^ x11; 284| 36.5k| const T x13 = x3 | x12; 285| 36.5k| const T x14 = a5 & x13; 286| 36.5k| const T x15 = x3 ^ x14; 287| 36.5k| const T x16 = a4 & x9; 288| 36.5k| const T x17 = x15 ^ x16; 289| | 290| 36.5k| const T x18 = x13 & ~a1; 291| 36.5k| const T x19 = x7 ^ x18; 292| 36.5k| const T x20 = a5 ^ x5; 293| 36.5k| const T x21 = x20 & ~x19; 294| 36.5k| const T x22 = ~x21; 295| 36.5k| const T x23 = x22 & ~a2; 296| 36.5k| const T x24 = x23 ^ x11; 297| 36.5k| out3 ^= x24; 298| | 299| 36.5k| const T x25 = x7 & ~x14; 300| 36.5k| const T x26 = x18 ^ x20; 301| 36.5k| const T x27 = x17 | x26; 302| 36.5k| const T x28 = x27 & ~x25; 303| 36.5k| const T x29 = x5 & ~x28; 304| | 305| 36.5k| const T x30 = x12 & x28; 306| 36.5k| const T x31 = x20 ^ x30; 307| 36.5k| const T x32 = x7 & x9; 308| 36.5k| const T x33 = x31 | x32; 309| 36.5k| const T x34 = x14 ^ x33; 310| 36.5k| const T x35 = x34 & a2; 311| 36.5k| const T x36 = x35 ^ x17; 312| 36.5k| out4 ^= x36; 313| | 314| 36.5k| const T x37 = x1 ^ x28; 315| 36.5k| const T x38 = a1 ^ x37; 316| 36.5k| const T x39 = a4 & x31; 317| 36.5k| const T x40 = x38 ^ x39; 318| 36.5k| const T x41 = x29 | a2; 319| 36.5k| const T x42 = x41 ^ x40; 320| 36.5k| out1 ^= x42; 321| | 322| 36.5k| const T x43 = x5 ^ x7; 323| 36.5k| const T x44 = x43 & ~x40; 324| 36.5k| const T x45 = x3 ^ x31; 325| 36.5k| const T x46 = x44 ^ x45; 326| 36.5k| const T x47 = x5 & a2; 327| 36.5k| const T x48 = x47 ^ x46; 328| 36.5k| out2 ^= x48; 329| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_15SBox6ITkNS0_9BitsliceTEjEEvT_S2_S2_S2_S2_S2_RS2_S3_S3_S3_: 332| 36.5k|BOTAN_FORCE_INLINE void SBox6(T a1, T a2, T a3, T a4, T a5, T a6, T& out1, T& out2, T& out3, T& out4) { 333| 36.5k| const T x1 = a2 ^ a5; 334| | 335| 36.5k| const T x2 = a2 | a6; 336| 36.5k| const T x3 = a1 & x2; 337| 36.5k| const T x4 = x1 ^ x3; 338| 36.5k| const T x5 = a6 ^ x4; 339| 36.5k| const T x6 = a5 & ~x5; 340| | 341| 36.5k| const T x7 = a1 & x5; 342| 36.5k| const T x8 = a2 ^ x7; 343| 36.5k| const T x9 = a1 ^ a3; 344| 36.5k| const T x10 = x8 | x9; 345| 36.5k| const T x11 = x4 ^ x10; 346| | 347| 36.5k| const T x12 = a3 & x11; 348| 36.5k| const T x13 = x12 & ~a6; 349| 36.5k| const T x14 = x6 | x8; 350| 36.5k| const T x15 = x13 ^ x14; 351| 36.5k| const T x16 = x15 & a4; 352| 36.5k| const T x17 = x16 ^ x11; 353| 36.5k| out4 ^= x17; 354| | 355| 36.5k| const T x18 = a2 ^ x10; 356| 36.5k| const T x19 = a6 & ~x18; 357| 36.5k| const T x20 = a3 ^ x19; 358| 36.5k| const T x21 = a5 & ~x12; 359| 36.5k| const T x22 = x20 | x21; 360| | 361| 36.5k| const T x23 = a2 | x9; 362| 36.5k| const T x24 = x15 ^ x23; 363| 36.5k| const T x25 = x3 | x22; 364| 36.5k| const T x26 = x24 ^ x25; 365| | 366| 36.5k| const T x27 = a1 | x11; 367| 36.5k| const T x28 = x14 & x27; 368| 36.5k| const T x29 = x20 ^ x28; 369| 36.5k| const T x30 = x29 & ~x13; 370| 36.5k| const T x31 = x6 | a4; 371| 36.5k| const T x32 = x31 ^ x30; 372| 36.5k| out3 ^= x32; 373| | 374| 36.5k| const T x33 = x4 ^ x29; 375| 36.5k| const T x34 = a5 & ~x33; 376| 36.5k| const T x35 = ~x23; 377| 36.5k| const T x36 = x18 ^ x35; 378| 36.5k| const T x37 = x34 ^ x36; 379| 36.5k| const T x38 = x37 & ~a4; 380| 36.5k| const T x39 = x38 ^ x26; 381| 36.5k| out2 ^= x39; 382| | 383| 36.5k| const T x40 = a6 ^ x7; 384| 36.5k| const T x41 = a1 ^ x20; 385| 36.5k| const T x42 = x40 & x41; 386| 36.5k| const T x43 = x12 ^ x36; 387| 36.5k| const T x44 = x42 ^ x43; 388| 36.5k| const T x45 = x22 & ~a4; 389| 36.5k| const T x46 = x45 ^ x44; 390| 36.5k| out1 ^= x46; 391| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_15SBox7ITkNS0_9BitsliceTEjEEvT_S2_S2_S2_S2_S2_RS2_S3_S3_S3_: 394| 36.5k|BOTAN_FORCE_INLINE void SBox7(T a1, T a2, T a3, T a4, T a5, T a6, T& out1, T& out2, T& out3, T& out4) { 395| 36.5k| const T x1 = a4 ^ a5; 396| 36.5k| const T x2 = a3 ^ x1; 397| 36.5k| const T x3 = a6 & x2; 398| 36.5k| const T x4 = a4 & x1; 399| 36.5k| const T x5 = a2 ^ x4; 400| 36.5k| const T x6 = x3 & x5; 401| | 402| 36.5k| const T x7 = a6 & x4; 403| 36.5k| const T x8 = a3 ^ x7; 404| 36.5k| const T x9 = x5 | x8; 405| 36.5k| const T x10 = a6 ^ x1; 406| 36.5k| const T x11 = x9 ^ x10; 407| 36.5k| const T x12 = a1 & ~x6; 408| 36.5k| const T x13 = x12 ^ x11; 409| 36.5k| out4 ^= x13; 410| | 411| 36.5k| const T x14 = a5 & ~x2; 412| 36.5k| const T x15 = x5 | x14; 413| 36.5k| const T x16 = x3 ^ x8; 414| 36.5k| const T x17 = x15 ^ x16; 415| | 416| 36.5k| const T x18 = x3 ^ x10; 417| 36.5k| const T x19 = a4 & ~x18; 418| 36.5k| const T x20 = x5 & ~x19; 419| 36.5k| const T x21 = a5 ^ x16; 420| 36.5k| const T x22 = x20 ^ x21; 421| | 422| 36.5k| const T x23 = x18 & ~x7; 423| 36.5k| const T x24 = x19 | x23; 424| 36.5k| const T x25 = a2 ^ x9; 425| 36.5k| const T x26 = x22 & x25; 426| 36.5k| const T x27 = x24 ^ x26; 427| 36.5k| const T x28 = x27 & a1; 428| 36.5k| const T x29 = x28 ^ x22; 429| 36.5k| out3 ^= x29; 430| | 431| 36.5k| const T x30 = x5 & ~a3; 432| 36.5k| const T x31 = x23 | x30; 433| 36.5k| const T x32 = x4 | x22; 434| 36.5k| const T x33 = x31 & x32; 435| 36.5k| const T x34 = x27 ^ x33; 436| | 437| 36.5k| const T x35 = x17 | x24; 438| 36.5k| const T x36 = x14 ^ x35; 439| 36.5k| const T x37 = a6 & x36; 440| 36.5k| const T x38 = x33 ^ x37; 441| 36.5k| const T x39 = x38 & ~a1; 442| 36.5k| const T x40 = x39 ^ x17; 443| 36.5k| out1 ^= x40; 444| | 445| 36.5k| const T x41 = ~x37; 446| 36.5k| const T x42 = a2 | x41; 447| 36.5k| const T x43 = x17 ^ x33; 448| 36.5k| const T x44 = x42 ^ x43; 449| 36.5k| const T x45 = x34 | a1; 450| 36.5k| const T x46 = x45 ^ x44; 451| 36.5k| out2 ^= x46; 452| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_15SBox8ITkNS0_9BitsliceTEjEEvT_S2_S2_S2_S2_S2_RS2_S3_S3_S3_: 455| 36.5k|BOTAN_FORCE_INLINE void SBox8(T a1, T a2, T a3, T a4, T a5, T a6, T& out1, T& out2, T& out3, T& out4) { 456| 36.5k| const T x1 = a3 & ~a2; 457| 36.5k| const T x2 = a5 & ~a3; 458| 36.5k| const T x3 = a4 ^ x2; 459| 36.5k| const T x4 = a1 & x3; 460| 36.5k| const T x5 = x4 & ~x1; 461| | 462| 36.5k| const T x6 = a2 & ~x3; 463| 36.5k| const T x7 = a1 | x6; 464| 36.5k| const T x8 = a2 & ~a3; 465| 36.5k| const T x9 = a5 ^ x8; 466| 36.5k| const T x10 = x7 & x9; 467| 36.5k| const T x11 = x4 | x10; 468| | 469| 36.5k| const T x12 = ~x3; 470| 36.5k| const T x13 = x10 ^ x12; 471| 36.5k| const T x14 = a3 & ~x7; 472| 36.5k| const T x15 = x13 ^ x14; 473| 36.5k| const T x16 = x1 ^ x15; 474| 36.5k| const T x17 = x5 | a6; 475| 36.5k| const T x18 = x17 ^ x16; 476| 36.5k| out2 ^= x18; 477| | 478| 36.5k| const T x19 = a1 ^ x16; 479| 36.5k| const T x20 = a5 & x19; 480| 36.5k| const T x21 = a2 ^ x15; 481| 36.5k| const T x22 = x20 ^ x21; 482| 36.5k| const T x23 = x6 ^ x22; 483| | 484| 36.5k| const T x24 = x11 ^ x22; 485| 36.5k| const T x25 = a2 | x24; 486| 36.5k| const T x26 = a5 ^ x19; 487| 36.5k| const T x27 = x25 ^ x26; 488| 36.5k| const T x28 = x11 & a6; 489| 36.5k| const T x29 = x28 ^ x27; 490| 36.5k| out3 ^= x29; 491| | 492| 36.5k| const T x30 = x9 ^ x23; 493| 36.5k| const T x31 = a4 | x21; 494| 36.5k| const T x32 = x30 ^ x31; 495| 36.5k| const T x33 = a1 ^ x32; 496| 36.5k| const T x34 = x33 & a6; 497| 36.5k| const T x35 = x34 ^ x23; 498| 36.5k| out4 ^= x35; 499| | 500| 36.5k| const T x36 = x30 & ~a4; 501| 36.5k| const T x37 = x27 & x36; 502| 36.5k| const T x38 = x5 ^ x32; 503| 36.5k| const T x39 = x37 ^ x38; 504| 36.5k| const T x40 = x39 | a6; 505| 36.5k| const T x41 = x40 ^ x23; 506| 36.5k| out1 ^= x41; 507| 36.5k|} des.cpp:_ZN5Botan12_GLOBAL__N_113transpose_outEPhPKjm: 567| 761|void transpose_out(uint8_t out[], const uint32_t B[64], size_t n_blocks) { 568| | // clang-format off 569| 761| static constexpr uint8_t FP[64] = { 570| 761| 39, 7, 47, 15, 55, 23, 63, 31, 571| 761| 38, 6, 46, 14, 54, 22, 62, 30, 572| 761| 37, 5, 45, 13, 53, 21, 61, 29, 573| 761| 36, 4, 44, 12, 52, 20, 60, 28, 574| 761| 35, 3, 43, 11, 51, 19, 59, 27, 575| 761| 34, 2, 42, 10, 50, 18, 58, 26, 576| 761| 33, 1, 41, 9, 49, 17, 57, 25, 577| 761| 32, 0, 40, 8, 48, 16, 56, 24 578| 761| }; 579| | // clang-format on 580| | 581| 761| uint64_t M[32]; 582| 25.1k| for(size_t i = 0; i != 32; ++i) { ------------------ | Branch (582:22): [True: 24.3k, False: 761] ------------------ 583| | // XOR with 32 here absorbs the DES output swap into the FP 584| 24.3k| M[i] = (static_cast(B[FP[31 - i] ^ 32]) << 32) | B[FP[63 - i] ^ 32]; 585| 24.3k| } 586| | 587| 761| des_transpose(M); 588| | 589| 17.9k| for(size_t i = 0; i != n_blocks; ++i) { ------------------ | Branch (589:22): [True: 17.1k, False: 761] ------------------ 590| 17.1k| store_be(out + i * 8, M[i]); 591| 17.1k| } 592| 761|} des.cpp:_ZN5Botan12_GLOBAL__N_111des_decryptEPjS1_PKj: 645| 1.32k|void des_decrypt(uint32_t L[32], uint32_t R[32], const uint32_t round_key[]) { 646| 11.9k| for(size_t round = 16; round > 0; round -= 2) { ------------------ | Branch (646:27): [True: 10.6k, False: 1.32k] ------------------ 647| 10.6k| des_round(L, R, &round_key[(round - 1) * 48]); 648| 10.6k| des_round(R, L, &round_key[(round - 2) * 48]); 649| 10.6k| } 650| 1.32k|} des.cpp:_ZN5Botan12_GLOBAL__N_116des_key_scheduleEPjPKh: 656| 315|void des_key_schedule(uint32_t round_key[], const uint8_t key[8]) { 657| 315| static const uint8_t ROT[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1}; 658| | 659| 315| uint32_t C = ((key[7] & 0x80) << 20) | ((key[6] & 0x80) << 19) | ((key[5] & 0x80) << 18) | ((key[4] & 0x80) << 17) | 660| 315| ((key[3] & 0x80) << 16) | ((key[2] & 0x80) << 15) | ((key[1] & 0x80) << 14) | ((key[0] & 0x80) << 13) | 661| 315| ((key[7] & 0x40) << 13) | ((key[6] & 0x40) << 12) | ((key[5] & 0x40) << 11) | ((key[4] & 0x40) << 10) | 662| 315| ((key[3] & 0x40) << 9) | ((key[2] & 0x40) << 8) | ((key[1] & 0x40) << 7) | ((key[0] & 0x40) << 6) | 663| 315| ((key[7] & 0x20) << 6) | ((key[6] & 0x20) << 5) | ((key[5] & 0x20) << 4) | ((key[4] & 0x20) << 3) | 664| 315| ((key[3] & 0x20) << 2) | ((key[2] & 0x20) << 1) | ((key[1] & 0x20)) | ((key[0] & 0x20) >> 1) | 665| 315| ((key[7] & 0x10) >> 1) | ((key[6] & 0x10) >> 2) | ((key[5] & 0x10) >> 3) | ((key[4] & 0x10) >> 4); 666| 315| uint32_t D = ((key[7] & 0x02) << 26) | ((key[6] & 0x02) << 25) | ((key[5] & 0x02) << 24) | ((key[4] & 0x02) << 23) | 667| 315| ((key[3] & 0x02) << 22) | ((key[2] & 0x02) << 21) | ((key[1] & 0x02) << 20) | ((key[0] & 0x02) << 19) | 668| 315| ((key[7] & 0x04) << 17) | ((key[6] & 0x04) << 16) | ((key[5] & 0x04) << 15) | ((key[4] & 0x04) << 14) | 669| 315| ((key[3] & 0x04) << 13) | ((key[2] & 0x04) << 12) | ((key[1] & 0x04) << 11) | ((key[0] & 0x04) << 10) | 670| 315| ((key[7] & 0x08) << 8) | ((key[6] & 0x08) << 7) | ((key[5] & 0x08) << 6) | ((key[4] & 0x08) << 5) | 671| 315| ((key[3] & 0x08) << 4) | ((key[2] & 0x08) << 3) | ((key[1] & 0x08) << 2) | ((key[0] & 0x08) << 1) | 672| 315| ((key[3] & 0x10) >> 1) | ((key[2] & 0x10) >> 2) | ((key[1] & 0x10) >> 3) | ((key[0] & 0x10) >> 4); 673| | 674| 315| static const uint8_t PC2_C[24] = {13, 16, 10, 23, 0, 4, 2, 27, 14, 5, 20, 9, 675| 315| 22, 18, 11, 3, 25, 7, 15, 6, 26, 19, 12, 1}; 676| | 677| 315| static const uint8_t PC2_D[24] = {12, 23, 2, 8, 18, 26, 1, 11, 22, 16, 4, 19, 678| 315| 15, 20, 10, 27, 5, 24, 17, 13, 21, 7, 0, 3}; 679| | 680| 5.35k| for(size_t i = 0; i != 16; ++i) { ------------------ | Branch (680:22): [True: 5.04k, False: 315] ------------------ 681| 5.04k| C = ((C << ROT[i]) | (C >> (28 - ROT[i]))) & 0x0FFFFFFF; 682| 5.04k| D = ((D << ROT[i]) | (D >> (28 - ROT[i]))) & 0x0FFFFFFF; 683| | 684| 5.04k| uint32_t* rk = &round_key[i * 48]; 685| | 686| 126k| for(size_t j = 0; j < 24; ++j) { ------------------ | Branch (686:25): [True: 120k, False: 5.04k] ------------------ 687| 120k| const uint32_t bit = (C >> (27 - PC2_C[j])) & 1; 688| 120k| rk[j] = static_cast(0) - bit; 689| 120k| } 690| | 691| 126k| for(size_t j = 0; j < 24; ++j) { ------------------ | Branch (691:25): [True: 120k, False: 5.04k] ------------------ 692| 120k| const uint32_t bit = (D >> (27 - PC2_D[j])) & 1; 693| 120k| rk[24 + j] = static_cast(0) - bit; 694| 120k| } 695| 5.04k| } 696| 315|} _ZN5Botan13base64_decodeEPKcmb: 189| 12.4k|secure_vector base64_decode(const char input[], size_t input_length, bool ignore_ws) { 190| 12.4k| return base_decode_to_vec>(Base64(), input, input_length, ignore_ws); 191| 12.4k|} base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6417decode_max_outputEm: 43| 24.9k| static constexpr size_t decode_max_output(size_t input_length) { 44| | // Divide before multiply to avoid overflow; round_up makes the division exact. 45| 24.9k| return (round_up(input_length, m_encoding_bytes_out) / m_encoding_bytes_out) * m_encoding_bytes_in; 46| 24.9k| } base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6413bits_consumedEv: 34| 12.4k| static constexpr size_t bits_consumed() noexcept { return m_encoding_bits; } base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6419lookup_binary_valueEc: 112| 5.17M|uint8_t Base64::lookup_binary_value(char input) noexcept { 113| 5.17M| auto has_zero_byte = [](uint64_t v) { return ((v - 0x0101010101010101) & ~(v) & 0x8080808080808080); }; 114| | 115| | // Assumes each byte is either 0x00 or 0x80 116| 5.17M| auto index_of_first_set_byte = [](uint64_t v) { 117| 5.17M| return ((((v - 1) & 0x0101010101010101) * 0x0101010101010101) >> 56) - 1; 118| 5.17M| }; 119| | 120| 5.17M| constexpr uint64_t lo = 0x0101010101010101; 121| | 122| 5.17M| const uint8_t x = static_cast(input); 123| | 124| 5.17M| const uint64_t x8 = x * lo; 125| | 126| | // Defines the valid ASCII ranges of base64, except the special chars (below) 127| 5.17M| constexpr uint64_t val_l = make_uint64(0, 0, 0, 0, 0, 'A', 'a', '0'); 128| 5.17M| constexpr uint64_t val_u = make_uint64(0, 0, 0, 0, 0, 26, 26, 10); 129| | 130| | // If x is in one of the ranges return a mask. Otherwise we xor in at the 131| | // high word which will be our invalid marker 132| 5.17M| auto v_mask = swar_in_range(x8, val_l, val_u) ^ 0x80000000; 133| | 134| | // This is the offset added to x to get the value 135| 5.17M| const uint64_t val_v = 0xbfb904 ^ (0xFF000000 - (x << 24)); 136| | 137| 5.17M| const uint8_t z = x + static_cast(val_v >> (8 * index_of_first_set_byte(v_mask))); 138| | 139| | // Valid base64 special characters, and some whitespace chars 140| 5.17M| constexpr uint64_t specials_i = make_uint64(0, '+', '/', '=', ' ', '\n', '\t', '\r'); 141| | 142| 5.17M| const uint64_t specials_v = 0x3e3f8180808080 ^ (static_cast(z) << 56); 143| | 144| 5.17M| const uint64_t smask = has_zero_byte(x8 ^ specials_i) ^ 0x8000000000000000; 145| | 146| 5.17M| return static_cast(specials_v >> (8 * index_of_first_set_byte(smask))); 147| 5.17M|} base64.cpp:_ZZN5Botan12_GLOBAL__N_16Base6419lookup_binary_valueEcENK3$_0clEm: 116| 10.3M| auto index_of_first_set_byte = [](uint64_t v) { 117| 10.3M| return ((((v - 1) & 0x0101010101010101) * 0x0101010101010101) >> 56) - 1; 118| 10.3M| }; base64.cpp:_ZZN5Botan12_GLOBAL__N_16Base6419lookup_binary_valueEcENK3$_1clEm: 113| 5.17M| auto has_zero_byte = [](uint64_t v) { return ((v - 0x0101010101010101) & ~(v) & 0x8080808080808080); }; base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6414check_bad_charEhcb: 150| 5.17M|bool Base64::check_bad_char(uint8_t bin, char input, bool ignore_ws) { 151| 5.17M| if(bin <= 0x3F) { ------------------ | Branch (151:7): [True: 5.17M, False: 0] ------------------ 152| 5.17M| return true; 153| 5.17M| } else if(!(bin == 0x81 || (bin == 0x80 && ignore_ws))) { ------------------ | Branch (153:16): [True: 0, False: 0] | Branch (153:32): [True: 0, False: 0] | Branch (153:47): [True: 0, False: 0] ------------------ 154| 0| throw Invalid_Argument(fmt("base64_decode: invalid character '{}'", format_char_for_display(input))); 155| 0| } 156| 0| return false; 157| 5.17M|} base64.cpp:_ZN5Botan12_GLOBAL__N_16Base646decodeEPhPKh: 54| 1.29M| static void decode(uint8_t* out_ptr, const uint8_t decode_buf[4]) { 55| 1.29M| out_ptr[0] = (decode_buf[0] << 2) | (decode_buf[1] >> 4); 56| 1.29M| out_ptr[1] = (decode_buf[1] << 4) | (decode_buf[2] >> 2); 57| 1.29M| out_ptr[2] = (decode_buf[2] << 6) | decode_buf[3]; 58| 1.29M| } base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6415bytes_to_removeEm: 60| 12.4k| static size_t bytes_to_remove(size_t final_truncate) { return final_truncate; } _ZN5Botan10hex_encodeEPcPKhmb: 34| 12.4k|void hex_encode(char output[], const uint8_t input[], size_t input_length, bool uppercase) { 35| 337k| for(size_t i = 0; i != input_length; ++i) { ------------------ | Branch (35:22): [True: 324k, False: 12.4k] ------------------ 36| 324k| const uint16_t h = hex_encode_2nibble(input[i], uppercase); 37| 324k| output[2 * i] = get_byte<0>(h); 38| 324k| output[2 * i + 1] = get_byte<1>(h); 39| 324k| } 40| 12.4k|} _ZN5Botan10hex_encodeEPKhmb: 42| 12.4k|std::string hex_encode(const uint8_t input[], size_t input_length, bool uppercase) { 43| 12.4k| const size_t output_length = mul_or_throw(2, input_length, "Input too large to hex encode"); 44| 12.4k| std::string output(output_length, 0); 45| | 46| 12.4k| if(input_length > 0) { ------------------ | Branch (46:7): [True: 12.4k, False: 0] ------------------ 47| 12.4k| hex_encode(&output.front(), input, input_length, uppercase); 48| 12.4k| } 49| | 50| 12.4k| return output; 51| 12.4k|} _ZN5Botan10hex_decodeEPhPKcmRmb: 75| 2.86k|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, size_t& input_consumed, bool ignore_ws) { 76| 2.86k| uint8_t* out_ptr = output; 77| 2.86k| bool top_nibble = true; 78| 2.86k| uint8_t next = 0; 79| | 80| 2.86k| input_consumed = 0; 81| | 82| 2.86k| clear_mem(output, input_length / 2); 83| | 84| 96.6k| for(size_t i = 0; i != input_length; ++i) { ------------------ | Branch (84:22): [True: 93.7k, False: 2.86k] ------------------ 85| 93.7k| const uint8_t bin = hex_char_to_bin(input[i]); 86| | 87| 93.7k| if(bin >= 0x10) { ------------------ | Branch (87:10): [True: 0, False: 93.7k] ------------------ 88| 0| if(bin == 0x80 && ignore_ws) { ------------------ | Branch (88:13): [True: 0, False: 0] | Branch (88:28): [True: 0, False: 0] ------------------ 89| 0| continue; 90| 0| } 91| | 92| 0| throw Invalid_Argument(fmt("hex_decode: invalid character '{}'", format_char_for_display(input[i]))); 93| 0| } 94| | 95| 93.7k| if(top_nibble) { ------------------ | Branch (95:10): [True: 46.8k, False: 46.8k] ------------------ 96| 46.8k| next = bin << 4; 97| 46.8k| } else { 98| 46.8k| next |= bin; 99| 46.8k| *out_ptr = next; 100| 46.8k| } 101| | 102| 93.7k| top_nibble = !top_nibble; 103| 93.7k| if(top_nibble) { ------------------ | Branch (103:10): [True: 46.8k, False: 46.8k] ------------------ 104| 46.8k| ++out_ptr; 105| 46.8k| input_consumed = i + 1; 106| 46.8k| } 107| 93.7k| } 108| | 109| | /* 110| | * Consume trailing whitespace following the last full byte; a leftover 111| | * unpaired nibble (if any) stops the scan and is left unconsumed. 112| | */ 113| 2.86k| while(input_consumed < input_length && hex_char_to_bin(input[input_consumed]) == 0x80) { ------------------ | Branch (113:10): [True: 0, False: 2.86k] | Branch (113:43): [True: 0, False: 0] ------------------ 114| 0| ++input_consumed; 115| 0| } 116| | 117| 2.86k| return (out_ptr - output); 118| 2.86k|} _ZN5Botan10hex_decodeEPhPKcmb: 120| 2.86k|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, bool ignore_ws) { 121| 2.86k| size_t consumed = 0; 122| 2.86k| const size_t written = hex_decode(output, input, input_length, consumed, ignore_ws); 123| | 124| 2.86k| if(consumed != input_length) { ------------------ | Branch (124:7): [True: 0, False: 2.86k] ------------------ 125| 0| throw Invalid_Argument("hex_decode: input did not have full bytes"); 126| 0| } 127| | 128| 2.86k| return written; 129| 2.86k|} _ZN5Botan17hex_decode_lockedEPKcmb: 142| 2.86k|secure_vector hex_decode_locked(const char input[], size_t input_length, bool ignore_ws) { 143| 2.86k| secure_vector bin(1 + input_length / 2); 144| | 145| 2.86k| const size_t written = hex_decode(bin.data(), input, input_length, ignore_ws); 146| | 147| 2.86k| bin.resize(written); 148| 2.86k| return bin; 149| 2.86k|} _ZN5Botan17hex_decode_lockedENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEb: 151| 2.85k|secure_vector hex_decode_locked(std::string_view input, bool ignore_ws) { 152| 2.85k| return hex_decode_locked(input.data(), input.size(), ignore_ws); 153| 2.85k|} hex.cpp:_ZN5Botan12_GLOBAL__N_118hex_encode_2nibbleEhb: 21| 324k|uint16_t hex_encode_2nibble(uint8_t n8, bool uppercase) { 22| | // Offset for upper or lower case 'a' resp 23| 324k| const uint16_t a_mask = uppercase ? 0x0707 : 0x2727; ------------------ | Branch (23:28): [True: 324k, False: 0] ------------------ 24| | 25| 324k| const uint16_t n = (static_cast(n8 & 0xF0) << 4) | (n8 & 0x0F); 26| | // n >= 10? If so add offset 27| 324k| const uint16_t diff = swar_lt(0x0909, n) & a_mask; 28| | // Can't overflow between bytes, so don't need explicit SWAR addition: 29| 324k| return n + 0x3030 + diff; 30| 324k|} hex.cpp:_ZN5Botan12_GLOBAL__N_115hex_char_to_binEc: 55| 93.7k|uint8_t hex_char_to_bin(char input) { 56| | // Starts of valid value ranges (v_lo) and their lengths (v_range) 57| 93.7k| constexpr uint64_t v_lo = make_uint64(0, '0', 'a', 'A', ' ', '\n', '\t', '\r'); 58| 93.7k| constexpr uint64_t v_range = make_uint64(0, 10, 6, 6, 1, 1, 1, 1); 59| 93.7k| constexpr uint64_t expand8 = 0x0101010101010101; 60| 93.7k| constexpr uint64_t top64 = 0x8000000000000000; 61| | 62| 93.7k| const uint8_t x = static_cast(input); 63| 93.7k| const uint64_t x8 = x * expand8; 64| | 65| 93.7k| const uint64_t v_mask = swar_in_range(x8, v_lo, v_range) ^ top64; 66| | 67| | // This is the offset added to x to get the value we need 68| 93.7k| const uint64_t val_v = 0xd0a9c960767773 ^ static_cast(0xFF - x) << 56; 69| | 70| 93.7k| return x + static_cast(val_v >> (8 * index_of_first_set_byte(v_mask))); 71| 93.7k|} _ZN5Botan12HashFunction6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 111| 21.6k|std::unique_ptr HashFunction::create(std::string_view algo_spec, std::string_view provider) { 112| |#if defined(BOTAN_HAS_COMMONCRYPTO) 113| | if(provider.empty() || provider == "commoncrypto") { 114| | if(auto hash = make_commoncrypto_hash(algo_spec)) 115| | return hash; 116| | 117| | if(!provider.empty()) 118| | return nullptr; 119| | } 120| |#endif 121| | 122| 21.6k| if(provider.empty() == false && provider != "base") { ------------------ | Branch (122:7): [True: 0, False: 21.6k] | Branch (122:36): [True: 0, False: 0] ------------------ 123| 0| return nullptr; // unknown provider 124| 0| } 125| | 126| 21.6k|#if defined(BOTAN_HAS_SHA1) 127| 21.6k| if(algo_spec == "SHA-1") { ------------------ | Branch (127:7): [True: 6.38k, False: 15.2k] ------------------ 128| 6.38k| return std::make_unique(); 129| 6.38k| } 130| 15.2k|#endif 131| | 132| 15.2k|#if defined(BOTAN_HAS_SHA2_32) 133| 15.2k| if(algo_spec == "SHA-224") { ------------------ | Branch (133:7): [True: 0, False: 15.2k] ------------------ 134| 0| return std::make_unique(); 135| 0| } 136| | 137| 15.2k| if(algo_spec == "SHA-256") { ------------------ | Branch (137:7): [True: 14.2k, False: 970] ------------------ 138| 14.2k| return std::make_unique(); 139| 14.2k| } 140| 970|#endif 141| | 142| 970|#if defined(BOTAN_HAS_SHA2_64) 143| 970| if(algo_spec == "SHA-384") { ------------------ | Branch (143:7): [True: 970, False: 0] ------------------ 144| 970| return std::make_unique(); 145| 970| } 146| | 147| 0| if(algo_spec == "SHA-512") { ------------------ | Branch (147:7): [True: 0, False: 0] ------------------ 148| 0| return std::make_unique(); 149| 0| } 150| | 151| 0| if(algo_spec == "SHA-512-256") { ------------------ | Branch (151:7): [True: 0, False: 0] ------------------ 152| 0| return std::make_unique(); 153| 0| } 154| 0|#endif 155| | 156| 0|#if defined(BOTAN_HAS_RIPEMD_160) 157| 0| if(algo_spec == "RIPEMD-160") { ------------------ | Branch (157:7): [True: 0, False: 0] ------------------ 158| 0| return std::make_unique(); 159| 0| } 160| 0|#endif 161| | 162| 0|#if defined(BOTAN_HAS_WHIRLPOOL) 163| 0| if(algo_spec == "Whirlpool") { ------------------ | Branch (163:7): [True: 0, False: 0] ------------------ 164| 0| return std::make_unique(); 165| 0| } 166| 0|#endif 167| | 168| 0|#if defined(BOTAN_HAS_MD5) 169| 0| if(algo_spec == "MD5") { ------------------ | Branch (169:7): [True: 0, False: 0] ------------------ 170| 0| return std::make_unique(); 171| 0| } 172| 0|#endif 173| | 174| 0|#if defined(BOTAN_HAS_MD4) 175| 0| if(algo_spec == "MD4") { ------------------ | Branch (175:7): [True: 0, False: 0] ------------------ 176| 0| return std::make_unique(); 177| 0| } 178| 0|#endif 179| | 180| 0|#if defined(BOTAN_HAS_GOST_34_11) 181| 0| if(algo_spec == "GOST-R-34.11-94" || algo_spec == "GOST-34.11") { ------------------ | Branch (181:7): [True: 0, False: 0] | Branch (181:41): [True: 0, False: 0] ------------------ 182| 0| return std::make_unique(); 183| 0| } 184| 0|#endif 185| | 186| 0|#if defined(BOTAN_HAS_ADLER32) 187| 0| if(algo_spec == "Adler32") { ------------------ | Branch (187:7): [True: 0, False: 0] ------------------ 188| 0| return std::make_unique(); 189| 0| } 190| 0|#endif 191| | 192| 0|#if defined(BOTAN_HAS_ASCON_HASH256) 193| 0| if(algo_spec == "Ascon-Hash256") { ------------------ | Branch (193:7): [True: 0, False: 0] ------------------ 194| 0| return std::make_unique(); 195| 0| } 196| 0|#endif 197| | 198| 0|#if defined(BOTAN_HAS_CRC24) 199| 0| if(algo_spec == "CRC24") { ------------------ | Branch (199:7): [True: 0, False: 0] ------------------ 200| 0| return std::make_unique(); 201| 0| } 202| 0|#endif 203| | 204| 0|#if defined(BOTAN_HAS_CRC32) 205| 0| if(algo_spec == "CRC32") { ------------------ | Branch (205:7): [True: 0, False: 0] ------------------ 206| 0| return std::make_unique(); 207| 0| } 208| 0|#endif 209| | 210| 0|#if defined(BOTAN_HAS_STREEBOG) 211| 0| if(algo_spec == "Streebog-256") { ------------------ | Branch (211:7): [True: 0, False: 0] ------------------ 212| 0| return std::make_unique(256); 213| 0| } 214| 0| if(algo_spec == "Streebog-512") { ------------------ | Branch (214:7): [True: 0, False: 0] ------------------ 215| 0| return std::make_unique(512); 216| 0| } 217| 0|#endif 218| | 219| 0|#if defined(BOTAN_HAS_SM3) 220| 0| if(algo_spec == "SM3") { ------------------ | Branch (220:7): [True: 0, False: 0] ------------------ 221| 0| return std::make_unique(); 222| 0| } 223| 0|#endif 224| | 225| 0| const SCAN_Name req(algo_spec); 226| | 227| 0|#if defined(BOTAN_HAS_SKEIN_512) 228| 0| if(req.algo_name() == "Skein-512") { ------------------ | Branch (228:7): [True: 0, False: 0] ------------------ 229| 0| return std::make_unique(req.arg_as_integer(0, 512), req.arg(1, "")); 230| 0| } 231| 0|#endif 232| | 233| 0|#if defined(BOTAN_HAS_BLAKE2B) 234| 0| if(req.algo_name() == "Blake2b" || req.algo_name() == "BLAKE2b") { ------------------ | Branch (234:7): [True: 0, False: 0] | Branch (234:39): [True: 0, False: 0] ------------------ 235| 0| return std::make_unique(req.arg_as_integer(0, 512)); 236| 0| } 237| 0|#endif 238| | 239| 0|#if defined(BOTAN_HAS_BLAKE2S) 240| 0| if(req.algo_name() == "Blake2s" || req.algo_name() == "BLAKE2s") { ------------------ | Branch (240:7): [True: 0, False: 0] | Branch (240:39): [True: 0, False: 0] ------------------ 241| 0| return std::make_unique(req.arg_as_integer(0, 256)); 242| 0| } 243| 0|#endif 244| | 245| 0|#if defined(BOTAN_HAS_KECCAK) 246| 0| if(req.algo_name() == "Keccak-1600") { ------------------ | Branch (246:7): [True: 0, False: 0] ------------------ 247| 0| return std::make_unique(req.arg_as_integer(0, 512)); 248| 0| } 249| 0|#endif 250| | 251| 0|#if defined(BOTAN_HAS_SHA3) 252| 0| if(req.algo_name() == "SHA-3") { ------------------ | Branch (252:7): [True: 0, False: 0] ------------------ 253| 0| return std::make_unique(req.arg_as_integer(0, 512)); 254| 0| } 255| 0|#endif 256| | 257| 0|#if defined(BOTAN_HAS_SHAKE) 258| 0| if(req.algo_name() == "SHAKE-128" && req.arg_count() == 1) { ------------------ | Branch (258:7): [True: 0, False: 0] | Branch (258:41): [True: 0, False: 0] ------------------ 259| 0| return std::make_unique(req.arg_as_integer(0)); 260| 0| } 261| 0| if(req.algo_name() == "SHAKE-256" && req.arg_count() == 1) { ------------------ | Branch (261:7): [True: 0, False: 0] | Branch (261:41): [True: 0, False: 0] ------------------ 262| 0| return std::make_unique(req.arg_as_integer(0)); 263| 0| } 264| 0|#endif 265| | 266| 0|#if defined(BOTAN_HAS_PARALLEL_HASH) 267| 0| if(req.algo_name() == "Parallel") { ------------------ | Branch (267:7): [True: 0, False: 0] ------------------ 268| 0| std::vector> hashes; 269| | 270| 0| for(size_t i = 0; i != req.arg_count(); ++i) { ------------------ | Branch (270:25): [True: 0, False: 0] ------------------ 271| 0| auto h = HashFunction::create(req.arg(i)); 272| 0| if(!h) { ------------------ | Branch (272:13): [True: 0, False: 0] ------------------ 273| 0| return nullptr; 274| 0| } 275| 0| hashes.push_back(std::move(h)); 276| 0| } 277| | 278| 0| return std::make_unique(hashes); 279| 0| } 280| 0|#endif 281| | 282| 0|#if defined(BOTAN_HAS_TRUNCATED_HASH) 283| 0| if(req.algo_name() == "Truncated" && req.arg_count() == 2) { ------------------ | Branch (283:7): [True: 0, False: 0] | Branch (283:41): [True: 0, False: 0] ------------------ 284| 0| auto hash = HashFunction::create(req.arg(0)); 285| 0| if(!hash) { ------------------ | Branch (285:10): [True: 0, False: 0] ------------------ 286| 0| return nullptr; 287| 0| } 288| | 289| 0| return std::make_unique(std::move(hash), req.arg_as_integer(1)); 290| 0| } 291| 0|#endif 292| | 293| 0|#if defined(BOTAN_HAS_COMB4P) 294| 0| if(req.algo_name() == "Comb4P" && req.arg_count() == 2) { ------------------ | Branch (294:7): [True: 0, False: 0] | Branch (294:38): [True: 0, False: 0] ------------------ 295| 0| auto h1 = HashFunction::create(req.arg(0)); 296| 0| auto h2 = HashFunction::create(req.arg(1)); 297| | 298| 0| if(h1 && h2) { ------------------ | Branch (298:10): [True: 0, False: 0] | Branch (298:16): [True: 0, False: 0] ------------------ 299| 0| return std::make_unique(std::move(h1), std::move(h2)); 300| 0| } 301| 0| } 302| 0|#endif 303| | 304| 0| return nullptr; 305| 0|} _ZN5Botan12HashFunction15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 308| 13.5k|std::unique_ptr HashFunction::create_or_throw(std::string_view algo, std::string_view provider) { 309| 13.5k| if(auto hash = HashFunction::create(algo, provider)) { ------------------ | Branch (309:12): [True: 13.5k, False: 0] ------------------ 310| 13.5k| return hash; 311| 13.5k| } 312| 0| throw Lookup_Error("Hash", algo, provider); 313| 13.5k|} _ZN5Botan5SHA_110compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm: 24| 50.7k|void SHA_1::compress_n(digest_type& digest, std::span input, size_t blocks) { 25| 50.7k| using namespace SHA1_F; 26| | 27| 50.7k|#if defined(BOTAN_HAS_SHA1_X86_SHA_NI) 28| 50.7k| if(CPUID::has(CPUID::Feature::SHA)) { ------------------ | Branch (28:7): [True: 0, False: 50.7k] ------------------ 29| 0| return sha1_compress_x86(digest, input, blocks); 30| 0| } 31| 50.7k|#endif 32| | 33| |#if defined(BOTAN_HAS_SHA1_ARMV8) 34| | if(CPUID::has(CPUID::Feature::SHA1)) { 35| | return sha1_armv8_compress_n(digest, input, blocks); 36| | } 37| |#endif 38| | 39| 50.7k|#if defined(BOTAN_HAS_SHA1_AVX2) 40| 50.7k| if(CPUID::has(CPUID::Feature::AVX2, CPUID::Feature::BMI)) { ------------------ | Branch (40:7): [True: 50.7k, False: 0] ------------------ 41| 50.7k| return avx2_compress_n(digest, input, blocks); 42| 50.7k| } 43| 0|#endif 44| | 45| 0|#if defined(BOTAN_HAS_SHA1_SIMD_4X32) 46| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (46:7): [True: 0, False: 0] ------------------ 47| 0| return simd_compress_n(digest, input, blocks); 48| 0| } 49| 0|#endif 50| | 51| 0| uint32_t A = digest[0]; 52| 0| uint32_t B = digest[1]; 53| 0| uint32_t C = digest[2]; 54| 0| uint32_t D = digest[3]; 55| 0| uint32_t E = digest[4]; 56| 0| std::array W{}; 57| 0| auto W_in = std::span{W}.first(); 58| | 59| 0| BufferSlicer in(input); 60| | 61| 0| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (61:22): [True: 0, False: 0] ------------------ 62| 0| load_be(W_in, in.take()); 63| | 64| | // clang-format off 65| | 66| 0| for(size_t j = 16; j != 80; j += 8) { ------------------ | Branch (66:26): [True: 0, False: 0] ------------------ 67| 0| W[j + 0] = rotl<1>(W[j - 3] ^ W[j - 8] ^ W[j - 14] ^ W[j - 16]); 68| 0| W[j + 1] = rotl<1>(W[j - 2] ^ W[j - 7] ^ W[j - 13] ^ W[j - 15]); 69| 0| W[j + 2] = rotl<1>(W[j - 1] ^ W[j - 6] ^ W[j - 12] ^ W[j - 14]); 70| 0| W[j + 3] = rotl<1>(W[j ] ^ W[j - 5] ^ W[j - 11] ^ W[j - 13]); 71| 0| W[j + 4] = rotl<1>(W[j + 1] ^ W[j - 4] ^ W[j - 10] ^ W[j - 12]); 72| 0| W[j + 5] = rotl<1>(W[j + 2] ^ W[j - 3] ^ W[j - 9] ^ W[j - 11]); 73| 0| W[j + 6] = rotl<1>(W[j + 3] ^ W[j - 2] ^ W[j - 8] ^ W[j - 10]); 74| 0| W[j + 7] = rotl<1>(W[j + 4] ^ W[j - 1] ^ W[j - 7] ^ W[j - 9]); 75| 0| } 76| | 77| | // clang-format on 78| | 79| 0| F1(A, B, C, D, E, W[0] + K1); 80| 0| F1(E, A, B, C, D, W[1] + K1); 81| 0| F1(D, E, A, B, C, W[2] + K1); 82| 0| F1(C, D, E, A, B, W[3] + K1); 83| 0| F1(B, C, D, E, A, W[4] + K1); 84| 0| F1(A, B, C, D, E, W[5] + K1); 85| 0| F1(E, A, B, C, D, W[6] + K1); 86| 0| F1(D, E, A, B, C, W[7] + K1); 87| 0| F1(C, D, E, A, B, W[8] + K1); 88| 0| F1(B, C, D, E, A, W[9] + K1); 89| 0| F1(A, B, C, D, E, W[10] + K1); 90| 0| F1(E, A, B, C, D, W[11] + K1); 91| 0| F1(D, E, A, B, C, W[12] + K1); 92| 0| F1(C, D, E, A, B, W[13] + K1); 93| 0| F1(B, C, D, E, A, W[14] + K1); 94| 0| F1(A, B, C, D, E, W[15] + K1); 95| 0| F1(E, A, B, C, D, W[16] + K1); 96| 0| F1(D, E, A, B, C, W[17] + K1); 97| 0| F1(C, D, E, A, B, W[18] + K1); 98| 0| F1(B, C, D, E, A, W[19] + K1); 99| | 100| 0| F2(A, B, C, D, E, W[20] + K2); 101| 0| F2(E, A, B, C, D, W[21] + K2); 102| 0| F2(D, E, A, B, C, W[22] + K2); 103| 0| F2(C, D, E, A, B, W[23] + K2); 104| 0| F2(B, C, D, E, A, W[24] + K2); 105| 0| F2(A, B, C, D, E, W[25] + K2); 106| 0| F2(E, A, B, C, D, W[26] + K2); 107| 0| F2(D, E, A, B, C, W[27] + K2); 108| 0| F2(C, D, E, A, B, W[28] + K2); 109| 0| F2(B, C, D, E, A, W[29] + K2); 110| 0| F2(A, B, C, D, E, W[30] + K2); 111| 0| F2(E, A, B, C, D, W[31] + K2); 112| 0| F2(D, E, A, B, C, W[32] + K2); 113| 0| F2(C, D, E, A, B, W[33] + K2); 114| 0| F2(B, C, D, E, A, W[34] + K2); 115| 0| F2(A, B, C, D, E, W[35] + K2); 116| 0| F2(E, A, B, C, D, W[36] + K2); 117| 0| F2(D, E, A, B, C, W[37] + K2); 118| 0| F2(C, D, E, A, B, W[38] + K2); 119| 0| F2(B, C, D, E, A, W[39] + K2); 120| | 121| 0| F3(A, B, C, D, E, W[40] + K3); 122| 0| F3(E, A, B, C, D, W[41] + K3); 123| 0| F3(D, E, A, B, C, W[42] + K3); 124| 0| F3(C, D, E, A, B, W[43] + K3); 125| 0| F3(B, C, D, E, A, W[44] + K3); 126| 0| F3(A, B, C, D, E, W[45] + K3); 127| 0| F3(E, A, B, C, D, W[46] + K3); 128| 0| F3(D, E, A, B, C, W[47] + K3); 129| 0| F3(C, D, E, A, B, W[48] + K3); 130| 0| F3(B, C, D, E, A, W[49] + K3); 131| 0| F3(A, B, C, D, E, W[50] + K3); 132| 0| F3(E, A, B, C, D, W[51] + K3); 133| 0| F3(D, E, A, B, C, W[52] + K3); 134| 0| F3(C, D, E, A, B, W[53] + K3); 135| 0| F3(B, C, D, E, A, W[54] + K3); 136| 0| F3(A, B, C, D, E, W[55] + K3); 137| 0| F3(E, A, B, C, D, W[56] + K3); 138| 0| F3(D, E, A, B, C, W[57] + K3); 139| 0| F3(C, D, E, A, B, W[58] + K3); 140| 0| F3(B, C, D, E, A, W[59] + K3); 141| | 142| 0| F4(A, B, C, D, E, W[60] + K4); 143| 0| F4(E, A, B, C, D, W[61] + K4); 144| 0| F4(D, E, A, B, C, W[62] + K4); 145| 0| F4(C, D, E, A, B, W[63] + K4); 146| 0| F4(B, C, D, E, A, W[64] + K4); 147| 0| F4(A, B, C, D, E, W[65] + K4); 148| 0| F4(E, A, B, C, D, W[66] + K4); 149| 0| F4(D, E, A, B, C, W[67] + K4); 150| 0| F4(C, D, E, A, B, W[68] + K4); 151| 0| F4(B, C, D, E, A, W[69] + K4); 152| 0| F4(A, B, C, D, E, W[70] + K4); 153| 0| F4(E, A, B, C, D, W[71] + K4); 154| 0| F4(D, E, A, B, C, W[72] + K4); 155| 0| F4(C, D, E, A, B, W[73] + K4); 156| 0| F4(B, C, D, E, A, W[74] + K4); 157| 0| F4(A, B, C, D, E, W[75] + K4); 158| 0| F4(E, A, B, C, D, W[76] + K4); 159| 0| F4(D, E, A, B, C, W[77] + K4); 160| 0| F4(C, D, E, A, B, W[78] + K4); 161| 0| F4(B, C, D, E, A, W[79] + K4); 162| | 163| 0| A = (digest[0] += A); 164| 0| B = (digest[1] += B); 165| 0| C = (digest[2] += C); 166| 0| D = (digest[3] += D); 167| 0| E = (digest[4] += E); 168| 0| } 169| 0|} _ZN5Botan5SHA_14initERNSt3__16vectorIjNS_16secure_allocatorIjEEEE: 174| 31.7k|void SHA_1::init(digest_type& digest) { 175| 31.7k| digest.assign({0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0}); 176| 31.7k|} _ZN5Botan5SHA_18add_dataENSt3__14spanIKhLm18446744073709551615EEE: 214| 25.8k|void SHA_1::add_data(std::span input) { 215| 25.8k| m_md.update(input); 216| 25.8k|} _ZN5Botan5SHA_112final_resultENSt3__14spanIhLm18446744073709551615EEE: 218| 25.2k|void SHA_1::final_result(std::span output) { 219| 25.2k| m_md.final(output); 220| 25.2k|} _ZN5Botan5SHA_115avx2_compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm: 144| 50.7k|void BOTAN_FN_ISA_AVX2_BMI2 SHA_1::avx2_compress_n(digest_type& digest, std::span input, size_t blocks) { 145| 50.7k| using namespace SHA1_F; 146| | 147| 50.7k| const SIMD_8x32 K11 = SIMD_8x32::splat(K1); 148| 50.7k| const SIMD_8x32 K22 = SIMD_8x32::splat(K2); 149| 50.7k| const SIMD_8x32 K33 = SIMD_8x32::splat(K3); 150| 50.7k| const SIMD_8x32 K44 = SIMD_8x32::splat(K4); 151| | 152| 50.7k| const SIMD_8x32 K12(K1, K1, K1, K1, K2, K2, K2, K2); 153| 50.7k| const SIMD_8x32 K34(K3, K3, K3, K3, K4, K4, K4, K4); 154| | 155| 50.7k| uint32_t A = digest[0]; 156| 50.7k| uint32_t B = digest[1]; 157| 50.7k| uint32_t C = digest[2]; 158| 50.7k| uint32_t D = digest[3]; 159| 50.7k| uint32_t E = digest[4]; 160| | 161| 50.7k| BufferSlicer in(input); 162| | 163| 70.6k| while(blocks >= 2) { ------------------ | Branch (163:10): [True: 19.8k, False: 50.7k] ------------------ 164| 19.8k| const auto block = in.take(2 * block_bytes); 165| 19.8k| blocks -= 2; 166| | 167| 19.8k| uint32_t W2[80] = {0}; 168| | 169| 19.8k| uint32_t PT[4]; 170| | 171| | // NOLINTNEXTLINE(*-container-data-pointer) 172| 19.8k| SIMD_8x32 XW0 = SIMD_8x32::load_be128(&block[0], &block[64]); 173| 19.8k| SIMD_8x32 XW1 = SIMD_8x32::load_be128(&block[16], &block[80]); 174| 19.8k| SIMD_8x32 XW2 = SIMD_8x32::load_be128(&block[32], &block[96]); 175| 19.8k| SIMD_8x32 XW3 = SIMD_8x32::load_be128(&block[48], &block[112]); 176| | 177| 19.8k| SIMD_8x32 P0 = XW0 + SIMD_8x32::splat(K1); 178| 19.8k| SIMD_8x32 P1 = XW1 + SIMD_8x32::splat(K1); 179| 19.8k| SIMD_8x32 P2 = XW2 + SIMD_8x32::splat(K1); 180| 19.8k| SIMD_8x32 P3 = XW3 + SIMD_8x32::splat(K1); 181| | 182| | // NOLINTBEGIN(readability-suspicious-call-argument) XW rotation 183| | 184| 19.8k| P0.store_le128(PT, &W2[0]); 185| 19.8k| P0 = sha1_avx2_next_w(XW0, XW1, XW2, XW3) + SIMD_8x32::splat(K1); 186| 19.8k| F1(A, B, C, D, E, PT[0]); 187| 19.8k| F1(E, A, B, C, D, PT[1]); 188| 19.8k| F1(D, E, A, B, C, PT[2]); 189| 19.8k| F1(C, D, E, A, B, PT[3]); 190| | 191| 19.8k| P1.store_le128(PT, &W2[4]); 192| 19.8k| P1 = sha1_avx2_next_w(XW1, XW2, XW3, XW0) + SIMD_8x32::splat(K2); 193| 19.8k| F1(B, C, D, E, A, PT[0]); 194| 19.8k| F1(A, B, C, D, E, PT[1]); 195| 19.8k| F1(E, A, B, C, D, PT[2]); 196| 19.8k| F1(D, E, A, B, C, PT[3]); 197| | 198| 19.8k| P2.store_le128(PT, &W2[8]); 199| 19.8k| P2 = sha1_avx2_next_w(XW2, XW3, XW0, XW1) + SIMD_8x32::splat(K2); 200| 19.8k| F1(C, D, E, A, B, PT[0]); 201| 19.8k| F1(B, C, D, E, A, PT[1]); 202| 19.8k| F1(A, B, C, D, E, PT[2]); 203| 19.8k| F1(E, A, B, C, D, PT[3]); 204| | 205| 19.8k| P3.store_le128(PT, &W2[12]); 206| 19.8k| P3 = sha1_avx2_next_w(XW3, XW0, XW1, XW2) + SIMD_8x32::splat(K2); 207| 19.8k| F1(D, E, A, B, C, PT[0]); 208| 19.8k| F1(C, D, E, A, B, PT[1]); 209| 19.8k| F1(B, C, D, E, A, PT[2]); 210| 19.8k| F1(A, B, C, D, E, PT[3]); 211| | 212| 19.8k| P0.store_le128(PT, &W2[16]); 213| 19.8k| P0 = sha1_avx2_next_w(XW0, XW1, XW2, XW3) + SIMD_8x32::splat(K2); 214| 19.8k| F1(E, A, B, C, D, PT[0]); 215| 19.8k| F1(D, E, A, B, C, PT[1]); 216| 19.8k| F1(C, D, E, A, B, PT[2]); 217| 19.8k| F1(B, C, D, E, A, PT[3]); 218| | 219| 19.8k| P1.store_le128(PT, &W2[20]); 220| 19.8k| P1 = sha1_avx2_next_w(XW1, XW2, XW3, XW0) + SIMD_8x32::splat(K2); 221| 19.8k| F2(A, B, C, D, E, PT[0]); 222| 19.8k| F2(E, A, B, C, D, PT[1]); 223| 19.8k| F2(D, E, A, B, C, PT[2]); 224| 19.8k| F2(C, D, E, A, B, PT[3]); 225| | 226| 19.8k| P2.store_le128(PT, &W2[24]); 227| 19.8k| P2 = sha1_avx2_next_w(XW2, XW3, XW0, XW1) + SIMD_8x32::splat(K3); 228| 19.8k| F2(B, C, D, E, A, PT[0]); 229| 19.8k| F2(A, B, C, D, E, PT[1]); 230| 19.8k| F2(E, A, B, C, D, PT[2]); 231| 19.8k| F2(D, E, A, B, C, PT[3]); 232| | 233| 19.8k| P3.store_le128(PT, &W2[28]); 234| 19.8k| P3 = sha1_avx2_next_w(XW3, XW0, XW1, XW2) + SIMD_8x32::splat(K3); 235| 19.8k| F2(C, D, E, A, B, PT[0]); 236| 19.8k| F2(B, C, D, E, A, PT[1]); 237| 19.8k| F2(A, B, C, D, E, PT[2]); 238| 19.8k| F2(E, A, B, C, D, PT[3]); 239| | 240| 19.8k| P0.store_le128(PT, &W2[32]); 241| 19.8k| P0 = sha1_avx2_next_w(XW0, XW1, XW2, XW3) + SIMD_8x32::splat(K3); 242| 19.8k| F2(D, E, A, B, C, PT[0]); 243| 19.8k| F2(C, D, E, A, B, PT[1]); 244| 19.8k| F2(B, C, D, E, A, PT[2]); 245| 19.8k| F2(A, B, C, D, E, PT[3]); 246| | 247| 19.8k| P1.store_le128(PT, &W2[36]); 248| 19.8k| P1 = sha1_avx2_next_w(XW1, XW2, XW3, XW0) + SIMD_8x32::splat(K3); 249| 19.8k| F2(E, A, B, C, D, PT[0]); 250| 19.8k| F2(D, E, A, B, C, PT[1]); 251| 19.8k| F2(C, D, E, A, B, PT[2]); 252| 19.8k| F2(B, C, D, E, A, PT[3]); 253| | 254| 19.8k| P2.store_le128(PT, &W2[40]); 255| 19.8k| P2 = sha1_avx2_next_w(XW2, XW3, XW0, XW1) + SIMD_8x32::splat(K3); 256| 19.8k| F3(A, B, C, D, E, PT[0]); 257| 19.8k| F3(E, A, B, C, D, PT[1]); 258| 19.8k| F3(D, E, A, B, C, PT[2]); 259| 19.8k| F3(C, D, E, A, B, PT[3]); 260| | 261| 19.8k| P3.store_le128(PT, &W2[44]); 262| 19.8k| P3 = sha1_avx2_next_w(XW3, XW0, XW1, XW2) + SIMD_8x32::splat(K4); 263| 19.8k| F3(B, C, D, E, A, PT[0]); 264| 19.8k| F3(A, B, C, D, E, PT[1]); 265| 19.8k| F3(E, A, B, C, D, PT[2]); 266| 19.8k| F3(D, E, A, B, C, PT[3]); 267| | 268| 19.8k| P0.store_le128(PT, &W2[48]); 269| 19.8k| P0 = sha1_avx2_next_w(XW0, XW1, XW2, XW3) + SIMD_8x32::splat(K4); 270| 19.8k| F3(C, D, E, A, B, PT[0]); 271| 19.8k| F3(B, C, D, E, A, PT[1]); 272| 19.8k| F3(A, B, C, D, E, PT[2]); 273| 19.8k| F3(E, A, B, C, D, PT[3]); 274| | 275| 19.8k| P1.store_le128(PT, &W2[52]); 276| 19.8k| P1 = sha1_avx2_next_w(XW1, XW2, XW3, XW0) + SIMD_8x32::splat(K4); 277| 19.8k| F3(D, E, A, B, C, PT[0]); 278| 19.8k| F3(C, D, E, A, B, PT[1]); 279| 19.8k| F3(B, C, D, E, A, PT[2]); 280| 19.8k| F3(A, B, C, D, E, PT[3]); 281| | 282| 19.8k| P2.store_le128(PT, &W2[56]); 283| 19.8k| P2 = sha1_avx2_next_w(XW2, XW3, XW0, XW1) + SIMD_8x32::splat(K4); 284| 19.8k| F3(E, A, B, C, D, PT[0]); 285| 19.8k| F3(D, E, A, B, C, PT[1]); 286| 19.8k| F3(C, D, E, A, B, PT[2]); 287| 19.8k| F3(B, C, D, E, A, PT[3]); 288| | 289| 19.8k| P3.store_le128(PT, &W2[60]); 290| 19.8k| P3 = sha1_avx2_next_w(XW3, XW0, XW1, XW2) + SIMD_8x32::splat(K4); 291| 19.8k| F4(A, B, C, D, E, PT[0]); 292| 19.8k| F4(E, A, B, C, D, PT[1]); 293| 19.8k| F4(D, E, A, B, C, PT[2]); 294| 19.8k| F4(C, D, E, A, B, PT[3]); 295| | 296| 19.8k| P0.store_le128(PT, &W2[64]); 297| 19.8k| F4(B, C, D, E, A, PT[0]); 298| 19.8k| F4(A, B, C, D, E, PT[1]); 299| 19.8k| F4(E, A, B, C, D, PT[2]); 300| 19.8k| F4(D, E, A, B, C, PT[3]); 301| | 302| 19.8k| P1.store_le128(PT, &W2[68]); 303| 19.8k| F4(C, D, E, A, B, PT[0]); 304| 19.8k| F4(B, C, D, E, A, PT[1]); 305| 19.8k| F4(A, B, C, D, E, PT[2]); 306| 19.8k| F4(E, A, B, C, D, PT[3]); 307| | 308| 19.8k| P2.store_le128(PT, &W2[72]); 309| 19.8k| F4(D, E, A, B, C, PT[0]); 310| 19.8k| F4(C, D, E, A, B, PT[1]); 311| 19.8k| F4(B, C, D, E, A, PT[2]); 312| 19.8k| F4(A, B, C, D, E, PT[3]); 313| | 314| 19.8k| P3.store_le128(PT, &W2[76]); 315| 19.8k| F4(E, A, B, C, D, PT[0]); 316| 19.8k| F4(D, E, A, B, C, PT[1]); 317| 19.8k| F4(C, D, E, A, B, PT[2]); 318| 19.8k| F4(B, C, D, E, A, PT[3]); 319| | 320| | // NOLINTEND(readability-suspicious-call-argument) 321| | 322| 19.8k| A = (digest[0] += A); 323| 19.8k| B = (digest[1] += B); 324| 19.8k| C = (digest[2] += C); 325| 19.8k| D = (digest[3] += D); 326| 19.8k| E = (digest[4] += E); 327| | 328| | // Second block with pre-expanded message 329| 19.8k| F1(A, B, C, D, E, W2[0]); 330| 19.8k| F1(E, A, B, C, D, W2[1]); 331| 19.8k| F1(D, E, A, B, C, W2[2]); 332| 19.8k| F1(C, D, E, A, B, W2[3]); 333| 19.8k| F1(B, C, D, E, A, W2[4]); 334| 19.8k| F1(A, B, C, D, E, W2[5]); 335| 19.8k| F1(E, A, B, C, D, W2[6]); 336| 19.8k| F1(D, E, A, B, C, W2[7]); 337| 19.8k| F1(C, D, E, A, B, W2[8]); 338| 19.8k| F1(B, C, D, E, A, W2[9]); 339| 19.8k| F1(A, B, C, D, E, W2[10]); 340| 19.8k| F1(E, A, B, C, D, W2[11]); 341| 19.8k| F1(D, E, A, B, C, W2[12]); 342| 19.8k| F1(C, D, E, A, B, W2[13]); 343| 19.8k| F1(B, C, D, E, A, W2[14]); 344| 19.8k| F1(A, B, C, D, E, W2[15]); 345| 19.8k| F1(E, A, B, C, D, W2[16]); 346| 19.8k| F1(D, E, A, B, C, W2[17]); 347| 19.8k| F1(C, D, E, A, B, W2[18]); 348| 19.8k| F1(B, C, D, E, A, W2[19]); 349| 19.8k| F2(A, B, C, D, E, W2[20]); 350| 19.8k| F2(E, A, B, C, D, W2[21]); 351| 19.8k| F2(D, E, A, B, C, W2[22]); 352| 19.8k| F2(C, D, E, A, B, W2[23]); 353| 19.8k| F2(B, C, D, E, A, W2[24]); 354| 19.8k| F2(A, B, C, D, E, W2[25]); 355| 19.8k| F2(E, A, B, C, D, W2[26]); 356| 19.8k| F2(D, E, A, B, C, W2[27]); 357| 19.8k| F2(C, D, E, A, B, W2[28]); 358| 19.8k| F2(B, C, D, E, A, W2[29]); 359| 19.8k| F2(A, B, C, D, E, W2[30]); 360| 19.8k| F2(E, A, B, C, D, W2[31]); 361| 19.8k| F2(D, E, A, B, C, W2[32]); 362| 19.8k| F2(C, D, E, A, B, W2[33]); 363| 19.8k| F2(B, C, D, E, A, W2[34]); 364| 19.8k| F2(A, B, C, D, E, W2[35]); 365| 19.8k| F2(E, A, B, C, D, W2[36]); 366| 19.8k| F2(D, E, A, B, C, W2[37]); 367| 19.8k| F2(C, D, E, A, B, W2[38]); 368| 19.8k| F2(B, C, D, E, A, W2[39]); 369| 19.8k| F3(A, B, C, D, E, W2[40]); 370| 19.8k| F3(E, A, B, C, D, W2[41]); 371| 19.8k| F3(D, E, A, B, C, W2[42]); 372| 19.8k| F3(C, D, E, A, B, W2[43]); 373| 19.8k| F3(B, C, D, E, A, W2[44]); 374| 19.8k| F3(A, B, C, D, E, W2[45]); 375| 19.8k| F3(E, A, B, C, D, W2[46]); 376| 19.8k| F3(D, E, A, B, C, W2[47]); 377| 19.8k| F3(C, D, E, A, B, W2[48]); 378| 19.8k| F3(B, C, D, E, A, W2[49]); 379| 19.8k| F3(A, B, C, D, E, W2[50]); 380| 19.8k| F3(E, A, B, C, D, W2[51]); 381| 19.8k| F3(D, E, A, B, C, W2[52]); 382| 19.8k| F3(C, D, E, A, B, W2[53]); 383| 19.8k| F3(B, C, D, E, A, W2[54]); 384| 19.8k| F3(A, B, C, D, E, W2[55]); 385| 19.8k| F3(E, A, B, C, D, W2[56]); 386| 19.8k| F3(D, E, A, B, C, W2[57]); 387| 19.8k| F3(C, D, E, A, B, W2[58]); 388| 19.8k| F3(B, C, D, E, A, W2[59]); 389| 19.8k| F4(A, B, C, D, E, W2[60]); 390| 19.8k| F4(E, A, B, C, D, W2[61]); 391| 19.8k| F4(D, E, A, B, C, W2[62]); 392| 19.8k| F4(C, D, E, A, B, W2[63]); 393| 19.8k| F4(B, C, D, E, A, W2[64]); 394| 19.8k| F4(A, B, C, D, E, W2[65]); 395| 19.8k| F4(E, A, B, C, D, W2[66]); 396| 19.8k| F4(D, E, A, B, C, W2[67]); 397| 19.8k| F4(C, D, E, A, B, W2[68]); 398| 19.8k| F4(B, C, D, E, A, W2[69]); 399| 19.8k| F4(A, B, C, D, E, W2[70]); 400| 19.8k| F4(E, A, B, C, D, W2[71]); 401| 19.8k| F4(D, E, A, B, C, W2[72]); 402| 19.8k| F4(C, D, E, A, B, W2[73]); 403| 19.8k| F4(B, C, D, E, A, W2[74]); 404| 19.8k| F4(A, B, C, D, E, W2[75]); 405| 19.8k| F4(E, A, B, C, D, W2[76]); 406| 19.8k| F4(D, E, A, B, C, W2[77]); 407| 19.8k| F4(C, D, E, A, B, W2[78]); 408| 19.8k| F4(B, C, D, E, A, W2[79]); 409| | 410| 19.8k| A = (digest[0] += A); 411| 19.8k| B = (digest[1] += B); 412| 19.8k| C = (digest[2] += C); 413| 19.8k| D = (digest[3] += D); 414| 19.8k| E = (digest[4] += E); 415| 19.8k| } 416| | 417| 101k| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (417:22): [True: 50.7k, False: 50.7k] ------------------ 418| 50.7k| uint32_t PT[8]; 419| | 420| 50.7k| const auto block = in.take(block_bytes); 421| | 422| 50.7k| SIMD_8x32 W0 = SIMD_8x32::load_be(&block[0]); // NOLINT(*-container-data-pointer) 423| 50.7k| SIMD_8x32 W2 = SIMD_8x32::load_be(&block[32]); 424| | 425| 50.7k| SIMD_8x32 P0 = W0 + K11; 426| 50.7k| SIMD_8x32 P2 = W2 + K11; 427| | 428| 50.7k| P0.store_le(PT); 429| 50.7k| P0 = sha1_avx2_next_w2(W0, W2) + K12; 430| | 431| 50.7k| F1(A, B, C, D, E, PT[0]); 432| 50.7k| F1(E, A, B, C, D, PT[1]); 433| 50.7k| F1(D, E, A, B, C, PT[2]); 434| 50.7k| F1(C, D, E, A, B, PT[3]); 435| 50.7k| F1(B, C, D, E, A, PT[4]); 436| 50.7k| F1(A, B, C, D, E, PT[5]); 437| 50.7k| F1(E, A, B, C, D, PT[6]); 438| 50.7k| F1(D, E, A, B, C, PT[7]); 439| | 440| 50.7k| P2.store_le(PT); 441| 50.7k| P2 = sha1_avx2_next_w2(W2, W0) + K22; 442| | 443| 50.7k| F1(C, D, E, A, B, PT[0]); 444| 50.7k| F1(B, C, D, E, A, PT[1]); 445| 50.7k| F1(A, B, C, D, E, PT[2]); 446| 50.7k| F1(E, A, B, C, D, PT[3]); 447| 50.7k| F1(D, E, A, B, C, PT[4]); 448| 50.7k| F1(C, D, E, A, B, PT[5]); 449| 50.7k| F1(B, C, D, E, A, PT[6]); 450| 50.7k| F1(A, B, C, D, E, PT[7]); 451| | 452| 50.7k| P0.store_le(PT); 453| 50.7k| P0 = sha1_avx2_next_w2(W0, W2) + K22; 454| | 455| 50.7k| F1(E, A, B, C, D, PT[0]); 456| 50.7k| F1(D, E, A, B, C, PT[1]); 457| 50.7k| F1(C, D, E, A, B, PT[2]); 458| 50.7k| F1(B, C, D, E, A, PT[3]); 459| 50.7k| F2(A, B, C, D, E, PT[4]); 460| 50.7k| F2(E, A, B, C, D, PT[5]); 461| 50.7k| F2(D, E, A, B, C, PT[6]); 462| 50.7k| F2(C, D, E, A, B, PT[7]); 463| | 464| 50.7k| P2.store_le(PT); 465| 50.7k| P2 = sha1_avx2_next_w2(W2, W0) + K33; 466| | 467| 50.7k| F2(B, C, D, E, A, PT[0]); 468| 50.7k| F2(A, B, C, D, E, PT[1]); 469| 50.7k| F2(E, A, B, C, D, PT[2]); 470| 50.7k| F2(D, E, A, B, C, PT[3]); 471| 50.7k| F2(C, D, E, A, B, PT[4]); 472| 50.7k| F2(B, C, D, E, A, PT[5]); 473| 50.7k| F2(A, B, C, D, E, PT[6]); 474| 50.7k| F2(E, A, B, C, D, PT[7]); 475| | 476| 50.7k| P0.store_le(PT); 477| 50.7k| P0 = sha1_avx2_next_w2(W0, W2) + K33; 478| | 479| 50.7k| F2(D, E, A, B, C, PT[0]); 480| 50.7k| F2(C, D, E, A, B, PT[1]); 481| 50.7k| F2(B, C, D, E, A, PT[2]); 482| 50.7k| F2(A, B, C, D, E, PT[3]); 483| 50.7k| F2(E, A, B, C, D, PT[4]); 484| 50.7k| F2(D, E, A, B, C, PT[5]); 485| 50.7k| F2(C, D, E, A, B, PT[6]); 486| 50.7k| F2(B, C, D, E, A, PT[7]); 487| | 488| 50.7k| P2.store_le(PT); 489| 50.7k| P2 = sha1_avx2_next_w2(W2, W0) + K34; 490| | 491| 50.7k| F3(A, B, C, D, E, PT[0]); 492| 50.7k| F3(E, A, B, C, D, PT[1]); 493| 50.7k| F3(D, E, A, B, C, PT[2]); 494| 50.7k| F3(C, D, E, A, B, PT[3]); 495| 50.7k| F3(B, C, D, E, A, PT[4]); 496| 50.7k| F3(A, B, C, D, E, PT[5]); 497| 50.7k| F3(E, A, B, C, D, PT[6]); 498| 50.7k| F3(D, E, A, B, C, PT[7]); 499| | 500| 50.7k| P0.store_le(PT); 501| 50.7k| P0 = sha1_avx2_next_w2(W0, W2) + K44; 502| | 503| 50.7k| F3(C, D, E, A, B, PT[0]); 504| 50.7k| F3(B, C, D, E, A, PT[1]); 505| 50.7k| F3(A, B, C, D, E, PT[2]); 506| 50.7k| F3(E, A, B, C, D, PT[3]); 507| 50.7k| F3(D, E, A, B, C, PT[4]); 508| 50.7k| F3(C, D, E, A, B, PT[5]); 509| 50.7k| F3(B, C, D, E, A, PT[6]); 510| 50.7k| F3(A, B, C, D, E, PT[7]); 511| | 512| 50.7k| P2.store_le(PT); 513| 50.7k| P2 = sha1_avx2_next_w2(W2, W0) + K44; 514| | 515| 50.7k| F3(E, A, B, C, D, PT[0]); 516| 50.7k| F3(D, E, A, B, C, PT[1]); 517| 50.7k| F3(C, D, E, A, B, PT[2]); 518| 50.7k| F3(B, C, D, E, A, PT[3]); 519| 50.7k| F4(A, B, C, D, E, PT[4]); 520| 50.7k| F4(E, A, B, C, D, PT[5]); 521| 50.7k| F4(D, E, A, B, C, PT[6]); 522| 50.7k| F4(C, D, E, A, B, PT[7]); 523| | 524| 50.7k| P0.store_le(PT); 525| | 526| 50.7k| F4(B, C, D, E, A, PT[0]); 527| 50.7k| F4(A, B, C, D, E, PT[1]); 528| 50.7k| F4(E, A, B, C, D, PT[2]); 529| 50.7k| F4(D, E, A, B, C, PT[3]); 530| 50.7k| F4(C, D, E, A, B, PT[4]); 531| 50.7k| F4(B, C, D, E, A, PT[5]); 532| 50.7k| F4(A, B, C, D, E, PT[6]); 533| 50.7k| F4(E, A, B, C, D, PT[7]); 534| | 535| 50.7k| P2.store_le(PT); 536| | 537| 50.7k| F4(D, E, A, B, C, PT[0]); 538| 50.7k| F4(C, D, E, A, B, PT[1]); 539| 50.7k| F4(B, C, D, E, A, PT[2]); 540| 50.7k| F4(A, B, C, D, E, PT[3]); 541| 50.7k| F4(E, A, B, C, D, PT[4]); 542| 50.7k| F4(D, E, A, B, C, PT[5]); 543| 50.7k| F4(C, D, E, A, B, PT[6]); 544| 50.7k| F4(B, C, D, E, A, PT[7]); 545| | 546| 50.7k| A = (digest[0] += A); 547| 50.7k| B = (digest[1] += B); 548| 50.7k| C = (digest[2] += C); 549| 50.7k| D = (digest[3] += D); 550| 50.7k| E = (digest[4] += E); 551| 50.7k| } 552| 50.7k|} sha1_avx2.cpp:_ZN5Botan12_GLOBAL__N_116sha1_avx2_next_wERNS_9SIMD_8x32ES1_S1_S1_: 27| 317k| SIMD_8x32 XW3) { 28| 317k| SIMD_8x32 T0 = XW0; // W[t-16..t-13] 29| 317k| T0 ^= SIMD_8x32(_mm256_alignr_epi8(XW1.raw(), XW0.raw(), 8)); 30| 317k| T0 ^= XW2; // W[t-8..t-5] 31| 317k| T0 ^= SIMD_8x32(_mm256_srli_si256(XW3.raw(), 4)); // W[t-3..t-1] || 0 32| | 33| | /* unrotated W[t]..W[t+2] in T0 ... still need W[t+3] */ 34| | 35| | // Extract w[t+0] into T2 36| 317k| auto T2 = SIMD_8x32(_mm256_slli_si256(T0.raw(), 3 * 4)); 37| | 38| | // Main rotation 39| 317k| T0 = T0.rotl<1>(); 40| | 41| | // Rotation of W[t+3] has rot by 2 to account for us working on non-rotated words 42| 317k| T2 = T2.rotl<2>(); 43| | 44| | // Merge rol(W[t+0], 1) into W[t+3] 45| 317k| T0 ^= T2; 46| | 47| 317k| XW0 = T0; 48| 317k| return T0; 49| 317k|} sha1_avx2.cpp:_ZN5Botan12_GLOBAL__N_117sha1_avx2_next_w2ERNS_9SIMD_8x32ES1_: 115| 406k|BOTAN_FN_ISA_AVX2_BMI2 BOTAN_FORCE_INLINE SIMD_8x32 sha1_avx2_next_w2(SIMD_8x32& W0, SIMD_8x32 W2) { 116| | // W[j-16..j-9] ^ W[j-8...j-1] 117| 406k| auto WN = W0 ^ W2; 118| | 119| | // XOR in W[j-3..j-1] || 0 || 0 || 0 || W[j-8...j-7] 120| 406k| WN ^= permute_words<5, 6, 7, -1, -1, -1, 0, 1>(W2); 121| | 122| | // XOR in W[j-14...j-9] || 0 || 0 123| 406k| WN ^= permute_words<2, 3, 4, 5, 6, 7, -1, -1>(W0); 124| | 125| | // Extract W[j...j+2], rotate, and XOR into W[j+3...j+5] 126| 406k| auto T0 = permute_words<-1, -1, -1, 0, 1, 2, -1, -1>(WN).rotl<2>(); 127| 406k| WN = WN.rotl<1>(); // main block rotation 128| | 129| 406k| WN ^= T0; 130| | 131| | // Extract W[j+3...j+4], rotate, and XOR into W[j+6...j+7] 132| 406k| WN ^= permute_words<-1, -1, -1, -1, -1, -1, 3, 4>(WN).rotl<1>(); 133| | 134| 406k| W0 = WN; 135| 406k| return WN; 136| 406k|} sha1_avx2.cpp:_ZN5Botan12_GLOBAL__N_113permute_wordsILi5ELi6ELi7ELin1ELin1ELin1ELi0ELi1EEENS_9SIMD_8x32ES2_: 58| 406k|BOTAN_FN_ISA_AVX2_BMI2 BOTAN_FORCE_INLINE SIMD_8x32 permute_words(SIMD_8x32 v) { 59| 406k| const __m256i tbl = _mm256_setr_epi32(I0, I1, I2, I3, I4, I5, I6, I7); 60| 406k| const __m256i mask = _mm256_setr_epi32(I0 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (60:43): [True: 406k, Folded] ------------------ 61| 406k| I1 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (61:43): [True: 406k, Folded] ------------------ 62| 406k| I2 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (62:43): [True: 406k, Folded] ------------------ 63| 406k| I3 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (63:43): [Folded, False: 406k] ------------------ 64| 406k| I4 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (64:43): [Folded, False: 406k] ------------------ 65| 406k| I5 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (65:43): [Folded, False: 406k] ------------------ 66| 406k| I6 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (66:43): [True: 406k, Folded] ------------------ 67| 406k| I7 >= 0 ? 0xFFFFFFFF : 0); ------------------ | Branch (67:43): [True: 406k, Folded] ------------------ 68| | 69| 406k| return SIMD_8x32(_mm256_and_si256(mask, _mm256_permutevar8x32_epi32(v.raw(), tbl))); 70| 406k|} sha1_avx2.cpp:_ZN5Botan12_GLOBAL__N_113permute_wordsILi2ELi3ELi4ELi5ELi6ELi7ELin1ELin1EEENS_9SIMD_8x32ES2_: 58| 406k|BOTAN_FN_ISA_AVX2_BMI2 BOTAN_FORCE_INLINE SIMD_8x32 permute_words(SIMD_8x32 v) { 59| 406k| const __m256i tbl = _mm256_setr_epi32(I0, I1, I2, I3, I4, I5, I6, I7); 60| 406k| const __m256i mask = _mm256_setr_epi32(I0 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (60:43): [True: 406k, Folded] ------------------ 61| 406k| I1 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (61:43): [True: 406k, Folded] ------------------ 62| 406k| I2 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (62:43): [True: 406k, Folded] ------------------ 63| 406k| I3 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (63:43): [True: 406k, Folded] ------------------ 64| 406k| I4 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (64:43): [True: 406k, Folded] ------------------ 65| 406k| I5 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (65:43): [True: 406k, Folded] ------------------ 66| 406k| I6 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (66:43): [Folded, False: 406k] ------------------ 67| 406k| I7 >= 0 ? 0xFFFFFFFF : 0); ------------------ | Branch (67:43): [Folded, False: 406k] ------------------ 68| | 69| 406k| return SIMD_8x32(_mm256_and_si256(mask, _mm256_permutevar8x32_epi32(v.raw(), tbl))); 70| 406k|} sha1_avx2.cpp:_ZN5Botan12_GLOBAL__N_113permute_wordsILin1ELin1ELin1ELi0ELi1ELi2ELin1ELin1EEENS_9SIMD_8x32ES2_: 58| 406k|BOTAN_FN_ISA_AVX2_BMI2 BOTAN_FORCE_INLINE SIMD_8x32 permute_words(SIMD_8x32 v) { 59| 406k| const __m256i tbl = _mm256_setr_epi32(I0, I1, I2, I3, I4, I5, I6, I7); 60| 406k| const __m256i mask = _mm256_setr_epi32(I0 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (60:43): [Folded, False: 406k] ------------------ 61| 406k| I1 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (61:43): [Folded, False: 406k] ------------------ 62| 406k| I2 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (62:43): [Folded, False: 406k] ------------------ 63| 406k| I3 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (63:43): [True: 406k, Folded] ------------------ 64| 406k| I4 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (64:43): [True: 406k, Folded] ------------------ 65| 406k| I5 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (65:43): [True: 406k, Folded] ------------------ 66| 406k| I6 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (66:43): [Folded, False: 406k] ------------------ 67| 406k| I7 >= 0 ? 0xFFFFFFFF : 0); ------------------ | Branch (67:43): [Folded, False: 406k] ------------------ 68| | 69| 406k| return SIMD_8x32(_mm256_and_si256(mask, _mm256_permutevar8x32_epi32(v.raw(), tbl))); 70| 406k|} sha1_avx2.cpp:_ZN5Botan12_GLOBAL__N_113permute_wordsILin1ELin1ELin1ELin1ELin1ELin1ELi3ELi4EEENS_9SIMD_8x32ES2_: 58| 406k|BOTAN_FN_ISA_AVX2_BMI2 BOTAN_FORCE_INLINE SIMD_8x32 permute_words(SIMD_8x32 v) { 59| 406k| const __m256i tbl = _mm256_setr_epi32(I0, I1, I2, I3, I4, I5, I6, I7); 60| 406k| const __m256i mask = _mm256_setr_epi32(I0 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (60:43): [Folded, False: 406k] ------------------ 61| 406k| I1 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (61:43): [Folded, False: 406k] ------------------ 62| 406k| I2 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (62:43): [Folded, False: 406k] ------------------ 63| 406k| I3 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (63:43): [Folded, False: 406k] ------------------ 64| 406k| I4 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (64:43): [Folded, False: 406k] ------------------ 65| 406k| I5 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (65:43): [Folded, False: 406k] ------------------ 66| 406k| I6 >= 0 ? 0xFFFFFFFF : 0, ------------------ | Branch (66:43): [True: 406k, Folded] ------------------ 67| 406k| I7 >= 0 ? 0xFFFFFFFF : 0); ------------------ | Branch (67:43): [True: 406k, Folded] ------------------ 68| | 69| 406k| return SIMD_8x32(_mm256_and_si256(mask, _mm256_permutevar8x32_epi32(v.raw(), tbl))); 70| 406k|} _ZN5Botan7SHA_25615compress_digestERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm: 59| 109k| size_t blocks) { 60| 109k|#if defined(BOTAN_HAS_SHA2_32_X86) 61| 109k| if(CPUID::has(CPUID::Feature::SHA)) { ------------------ | Branch (61:7): [True: 0, False: 109k] ------------------ 62| 0| return SHA_256::compress_digest_x86(digest, input, blocks); 63| 0| } 64| 109k|#endif 65| | 66| |#if defined(BOTAN_HAS_SHA2_32_ARMV8) 67| | if(CPUID::has(CPUID::Feature::SHA2)) { 68| | return SHA_256::compress_digest_armv8(digest, input, blocks); 69| | } 70| |#endif 71| | 72| 109k|#if defined(BOTAN_HAS_SHA2_32_X86_AVX2) 73| 109k| if(CPUID::has(CPUID::Feature::AVX2, CPUID::Feature::BMI)) { ------------------ | Branch (73:7): [True: 109k, False: 0] ------------------ 74| 109k| return SHA_256::compress_digest_x86_avx2(digest, input, blocks); 75| 109k| } 76| 0|#endif 77| | 78| 0|#if defined(BOTAN_HAS_SHA2_32_SIMD) 79| 0| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (79:7): [True: 0, False: 0] ------------------ 80| 0| return SHA_256::compress_digest_x86_simd(digest, input, blocks); 81| 0| } 82| 0|#endif 83| | 84| 0| uint32_t A = digest[0]; 85| 0| uint32_t B = digest[1]; 86| 0| uint32_t C = digest[2]; 87| 0| uint32_t D = digest[3]; 88| 0| uint32_t E = digest[4]; 89| 0| uint32_t F = digest[5]; 90| 0| uint32_t G = digest[6]; 91| 0| uint32_t H = digest[7]; 92| | 93| 0| std::array W{}; 94| | 95| 0| BufferSlicer in(input); 96| | 97| 0| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (97:22): [True: 0, False: 0] ------------------ 98| 0| load_be(W, in.take()); 99| | 100| | // clang-format off 101| | 102| 0| SHA2_32_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0x428A2F98); 103| 0| SHA2_32_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0x71374491); 104| 0| SHA2_32_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0xB5C0FBCF); 105| 0| SHA2_32_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0xE9B5DBA5); 106| 0| SHA2_32_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x3956C25B); 107| 0| SHA2_32_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x59F111F1); 108| 0| SHA2_32_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x923F82A4); 109| 0| SHA2_32_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0xAB1C5ED5); 110| 0| SHA2_32_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0xD807AA98); 111| 0| SHA2_32_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0x12835B01); 112| 0| SHA2_32_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0x243185BE); 113| 0| SHA2_32_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0x550C7DC3); 114| 0| SHA2_32_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0x72BE5D74); 115| 0| SHA2_32_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0x80DEB1FE); 116| 0| SHA2_32_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0x9BDC06A7); 117| 0| SHA2_32_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0xC19BF174); 118| | 119| 0| SHA2_32_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0xE49B69C1); 120| 0| SHA2_32_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0xEFBE4786); 121| 0| SHA2_32_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0x0FC19DC6); 122| 0| SHA2_32_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0x240CA1CC); 123| 0| SHA2_32_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x2DE92C6F); 124| 0| SHA2_32_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x4A7484AA); 125| 0| SHA2_32_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x5CB0A9DC); 126| 0| SHA2_32_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0x76F988DA); 127| 0| SHA2_32_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0x983E5152); 128| 0| SHA2_32_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0xA831C66D); 129| 0| SHA2_32_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0xB00327C8); 130| 0| SHA2_32_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0xBF597FC7); 131| 0| SHA2_32_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0xC6E00BF3); 132| 0| SHA2_32_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0xD5A79147); 133| 0| SHA2_32_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0x06CA6351); 134| 0| SHA2_32_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0x14292967); 135| | 136| 0| SHA2_32_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0x27B70A85); 137| 0| SHA2_32_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0x2E1B2138); 138| 0| SHA2_32_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0x4D2C6DFC); 139| 0| SHA2_32_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0x53380D13); 140| 0| SHA2_32_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x650A7354); 141| 0| SHA2_32_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x766A0ABB); 142| 0| SHA2_32_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x81C2C92E); 143| 0| SHA2_32_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0x92722C85); 144| 0| SHA2_32_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0xA2BFE8A1); 145| 0| SHA2_32_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0xA81A664B); 146| 0| SHA2_32_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0xC24B8B70); 147| 0| SHA2_32_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0xC76C51A3); 148| 0| SHA2_32_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0xD192E819); 149| 0| SHA2_32_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0xD6990624); 150| 0| SHA2_32_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0xF40E3585); 151| 0| SHA2_32_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0x106AA070); 152| | 153| 0| SHA2_32_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0x19A4C116); 154| 0| SHA2_32_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0x1E376C08); 155| 0| SHA2_32_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0x2748774C); 156| 0| SHA2_32_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0x34B0BCB5); 157| 0| SHA2_32_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x391C0CB3); 158| 0| SHA2_32_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x4ED8AA4A); 159| 0| SHA2_32_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x5B9CCA4F); 160| 0| SHA2_32_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0x682E6FF3); 161| 0| SHA2_32_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0x748F82EE); 162| 0| SHA2_32_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0x78A5636F); 163| 0| SHA2_32_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0x84C87814); 164| 0| SHA2_32_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0x8CC70208); 165| 0| SHA2_32_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0x90BEFFFA); 166| 0| SHA2_32_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0xA4506CEB); 167| 0| SHA2_32_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0xBEF9A3F7); 168| 0| SHA2_32_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0xC67178F2); 169| | 170| | // clang-format on 171| | 172| 0| A = (digest[0] += A); 173| 0| B = (digest[1] += B); 174| 0| C = (digest[2] += C); 175| 0| D = (digest[3] += D); 176| 0| E = (digest[4] += E); 177| 0| F = (digest[5] += F); 178| 0| G = (digest[6] += G); 179| 0| H = (digest[7] += H); 180| 0| } 181| 0|} _ZN5Botan7SHA_25610compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm: 215| 109k|void SHA_256::compress_n(digest_type& digest, std::span input, size_t blocks) { 216| 109k| SHA_256::compress_digest(digest, input, blocks); 217| 109k|} _ZN5Botan7SHA_2564initERNSt3__16vectorIjNS_16secure_allocatorIjEEEE: 219| 69.7k|void SHA_256::init(digest_type& digest) { 220| 69.7k| digest.assign({0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19}); 221| 69.7k|} _ZN5Botan7SHA_2568add_dataENSt3__14spanIKhLm18446744073709551615EEE: 231| 87.3k|void SHA_256::add_data(std::span input) { 232| 87.3k| m_md.update(input); 233| 87.3k|} _ZN5Botan7SHA_25612final_resultENSt3__14spanIhLm18446744073709551615EEE: 235| 53.3k|void SHA_256::final_result(std::span output) { 236| 53.3k| m_md.final(output); 237| 53.3k|} _ZN5Botan7SHA_25624compress_digest_x86_avx2ERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm: 100| 109k| digest_type& digest, std::span input, size_t blocks) { 101| | // clang-format off 102| | 103| 109k| alignas(64) const uint32_t K[64] = { 104| 109k| 0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5, 0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5, 105| 109k| 0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3, 0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174, 106| 109k| 0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC, 0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA, 107| 109k| 0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7, 0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967, 108| 109k| 0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13, 0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85, 109| 109k| 0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3, 0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070, 110| 109k| 0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5, 0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3, 111| 109k| 0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208, 0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2}; 112| | 113| | // clang-format on 114| | 115| 109k| alignas(64) uint32_t W[16]; 116| 109k| alignas(64) uint32_t W2[64]; 117| | 118| 109k| uint32_t A = digest[0]; 119| 109k| uint32_t B = digest[1]; 120| 109k| uint32_t C = digest[2]; 121| 109k| uint32_t D = digest[3]; 122| 109k| uint32_t E = digest[4]; 123| 109k| uint32_t F = digest[5]; 124| 109k| uint32_t G = digest[6]; 125| 109k| uint32_t H = digest[7]; 126| | 127| 109k| const uint8_t* data = input.data(); 128| | 129| 131k| while(blocks >= 2) { ------------------ | Branch (129:10): [True: 21.8k, False: 109k] ------------------ 130| 21.8k| SIMD_8x32 WS[4]; 131| | 132| 109k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (132:25): [True: 87.2k, False: 21.8k] ------------------ 133| 87.2k| WS[i] = SIMD_8x32::load_be128(&data[16 * i], &data[64 + 16 * i]); 134| 87.2k| auto WK = WS[i] + SIMD_8x32::load_le128(&K[4 * i]); 135| 87.2k| WK.store_le128(&W[4 * i], &W2[4 * i]); 136| 87.2k| } 137| | 138| 21.8k| data += 2 * 64; 139| 21.8k| blocks -= 2; 140| | 141| 87.2k| for(size_t r = 0; r != 48; r += 16) { ------------------ | Branch (141:25): [True: 65.4k, False: 21.8k] ------------------ 142| 65.4k| auto w = next_w(WS) + SIMD_8x32::load_le128(&K[r + 16]); 143| | 144| 65.4k| SHA2_32_F(A, B, C, D, E, F, G, H, W[0]); 145| 65.4k| SHA2_32_F(H, A, B, C, D, E, F, G, W[1]); 146| 65.4k| SHA2_32_F(G, H, A, B, C, D, E, F, W[2]); 147| 65.4k| SHA2_32_F(F, G, H, A, B, C, D, E, W[3]); 148| | 149| 65.4k| w.store_le128(&W[0], &W2[r + 16]); 150| | 151| 65.4k| w = next_w(WS) + SIMD_8x32::load_le128(&K[r + 20]); 152| | 153| 65.4k| SHA2_32_F(E, F, G, H, A, B, C, D, W[4]); 154| 65.4k| SHA2_32_F(D, E, F, G, H, A, B, C, W[5]); 155| 65.4k| SHA2_32_F(C, D, E, F, G, H, A, B, W[6]); 156| 65.4k| SHA2_32_F(B, C, D, E, F, G, H, A, W[7]); 157| | 158| 65.4k| w.store_le128(&W[4], &W2[r + 20]); 159| | 160| 65.4k| w = next_w(WS) + SIMD_8x32::load_le128(&K[r + 24]); 161| | 162| 65.4k| SHA2_32_F(A, B, C, D, E, F, G, H, W[8]); 163| 65.4k| SHA2_32_F(H, A, B, C, D, E, F, G, W[9]); 164| 65.4k| SHA2_32_F(G, H, A, B, C, D, E, F, W[10]); 165| 65.4k| SHA2_32_F(F, G, H, A, B, C, D, E, W[11]); 166| | 167| 65.4k| w.store_le128(&W[8], &W2[r + 24]); 168| | 169| 65.4k| w = next_w(WS) + SIMD_8x32::load_le128(&K[r + 28]); 170| | 171| 65.4k| SHA2_32_F(E, F, G, H, A, B, C, D, W[12]); 172| 65.4k| SHA2_32_F(D, E, F, G, H, A, B, C, W[13]); 173| 65.4k| SHA2_32_F(C, D, E, F, G, H, A, B, W[14]); 174| 65.4k| SHA2_32_F(B, C, D, E, F, G, H, A, W[15]); 175| | 176| 65.4k| w.store_le128(&W[12], &W2[r + 28]); 177| 65.4k| } 178| | 179| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W[0]); 180| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W[1]); 181| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W[2]); 182| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W[3]); 183| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W[4]); 184| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W[5]); 185| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W[6]); 186| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W[7]); 187| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W[8]); 188| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W[9]); 189| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W[10]); 190| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W[11]); 191| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W[12]); 192| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W[13]); 193| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W[14]); 194| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W[15]); 195| | 196| 21.8k| A = (digest[0] += A); 197| 21.8k| B = (digest[1] += B); 198| 21.8k| C = (digest[2] += C); 199| 21.8k| D = (digest[3] += D); 200| 21.8k| E = (digest[4] += E); 201| 21.8k| F = (digest[5] += F); 202| 21.8k| G = (digest[6] += G); 203| 21.8k| H = (digest[7] += H); 204| | 205| | // Now the second block, with already expanded message 206| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W2[0]); 207| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W2[1]); 208| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W2[2]); 209| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W2[3]); 210| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W2[4]); 211| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W2[5]); 212| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W2[6]); 213| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W2[7]); 214| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W2[8]); 215| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W2[9]); 216| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W2[10]); 217| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W2[11]); 218| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W2[12]); 219| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W2[13]); 220| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W2[14]); 221| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W2[15]); 222| | 223| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W2[16]); 224| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W2[17]); 225| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W2[18]); 226| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W2[19]); 227| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W2[20]); 228| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W2[21]); 229| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W2[22]); 230| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W2[23]); 231| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W2[24]); 232| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W2[25]); 233| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W2[26]); 234| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W2[27]); 235| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W2[28]); 236| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W2[29]); 237| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W2[30]); 238| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W2[31]); 239| | 240| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W2[32]); 241| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W2[33]); 242| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W2[34]); 243| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W2[35]); 244| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W2[36]); 245| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W2[37]); 246| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W2[38]); 247| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W2[39]); 248| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W2[40]); 249| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W2[41]); 250| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W2[42]); 251| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W2[43]); 252| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W2[44]); 253| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W2[45]); 254| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W2[46]); 255| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W2[47]); 256| | 257| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W2[48]); 258| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W2[49]); 259| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W2[50]); 260| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W2[51]); 261| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W2[52]); 262| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W2[53]); 263| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W2[54]); 264| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W2[55]); 265| 21.8k| SHA2_32_F(A, B, C, D, E, F, G, H, W2[56]); 266| 21.8k| SHA2_32_F(H, A, B, C, D, E, F, G, W2[57]); 267| 21.8k| SHA2_32_F(G, H, A, B, C, D, E, F, W2[58]); 268| 21.8k| SHA2_32_F(F, G, H, A, B, C, D, E, W2[59]); 269| 21.8k| SHA2_32_F(E, F, G, H, A, B, C, D, W2[60]); 270| 21.8k| SHA2_32_F(D, E, F, G, H, A, B, C, W2[61]); 271| 21.8k| SHA2_32_F(C, D, E, F, G, H, A, B, W2[62]); 272| 21.8k| SHA2_32_F(B, C, D, E, F, G, H, A, W2[63]); 273| | 274| 21.8k| A = (digest[0] += A); 275| 21.8k| B = (digest[1] += B); 276| 21.8k| C = (digest[2] += C); 277| 21.8k| D = (digest[3] += D); 278| 21.8k| E = (digest[4] += E); 279| 21.8k| F = (digest[5] += F); 280| 21.8k| G = (digest[6] += G); 281| 21.8k| H = (digest[7] += H); 282| 21.8k| } 283| | 284| 219k| while(blocks > 0) { ------------------ | Branch (284:10): [True: 109k, False: 109k] ------------------ 285| 109k| SIMD_4x32 WS[4]; 286| | 287| 548k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (287:25): [True: 438k, False: 109k] ------------------ 288| 438k| WS[i] = SIMD_4x32::load_be(&data[16 * i]); 289| 438k| auto WK = WS[i] + SIMD_4x32::load_le(&K[4 * i]); 290| 438k| WK.store_le(&W[4 * i]); 291| 438k| } 292| | 293| 109k| data += 64; 294| 109k| blocks -= 1; 295| | 296| 438k| for(size_t r = 0; r != 48; r += 16) { ------------------ | Branch (296:25): [True: 329k, False: 109k] ------------------ 297| 329k| auto w = next_w(WS) + SIMD_4x32::load_le(&K[r + 16]); 298| | 299| 329k| SHA2_32_F(A, B, C, D, E, F, G, H, W[0]); 300| 329k| SHA2_32_F(H, A, B, C, D, E, F, G, W[1]); 301| 329k| SHA2_32_F(G, H, A, B, C, D, E, F, W[2]); 302| 329k| SHA2_32_F(F, G, H, A, B, C, D, E, W[3]); 303| | 304| 329k| w.store_le(&W[0]); 305| | 306| 329k| w = next_w(WS) + SIMD_4x32::load_le(&K[r + 20]); 307| | 308| 329k| SHA2_32_F(E, F, G, H, A, B, C, D, W[4]); 309| 329k| SHA2_32_F(D, E, F, G, H, A, B, C, W[5]); 310| 329k| SHA2_32_F(C, D, E, F, G, H, A, B, W[6]); 311| 329k| SHA2_32_F(B, C, D, E, F, G, H, A, W[7]); 312| | 313| 329k| w.store_le(&W[4]); 314| | 315| 329k| w = next_w(WS) + SIMD_4x32::load_le(&K[r + 24]); 316| | 317| 329k| SHA2_32_F(A, B, C, D, E, F, G, H, W[8]); 318| 329k| SHA2_32_F(H, A, B, C, D, E, F, G, W[9]); 319| 329k| SHA2_32_F(G, H, A, B, C, D, E, F, W[10]); 320| 329k| SHA2_32_F(F, G, H, A, B, C, D, E, W[11]); 321| | 322| 329k| w.store_le(&W[8]); 323| | 324| 329k| w = next_w(WS) + SIMD_4x32::load_le(&K[r + 28]); 325| | 326| 329k| SHA2_32_F(E, F, G, H, A, B, C, D, W[12]); 327| 329k| SHA2_32_F(D, E, F, G, H, A, B, C, W[13]); 328| 329k| SHA2_32_F(C, D, E, F, G, H, A, B, W[14]); 329| 329k| SHA2_32_F(B, C, D, E, F, G, H, A, W[15]); 330| | 331| 329k| w.store_le(&W[12]); 332| 329k| } 333| | 334| 109k| SHA2_32_F(A, B, C, D, E, F, G, H, W[0]); 335| 109k| SHA2_32_F(H, A, B, C, D, E, F, G, W[1]); 336| 109k| SHA2_32_F(G, H, A, B, C, D, E, F, W[2]); 337| 109k| SHA2_32_F(F, G, H, A, B, C, D, E, W[3]); 338| 109k| SHA2_32_F(E, F, G, H, A, B, C, D, W[4]); 339| 109k| SHA2_32_F(D, E, F, G, H, A, B, C, W[5]); 340| 109k| SHA2_32_F(C, D, E, F, G, H, A, B, W[6]); 341| 109k| SHA2_32_F(B, C, D, E, F, G, H, A, W[7]); 342| 109k| SHA2_32_F(A, B, C, D, E, F, G, H, W[8]); 343| 109k| SHA2_32_F(H, A, B, C, D, E, F, G, W[9]); 344| 109k| SHA2_32_F(G, H, A, B, C, D, E, F, W[10]); 345| 109k| SHA2_32_F(F, G, H, A, B, C, D, E, W[11]); 346| 109k| SHA2_32_F(E, F, G, H, A, B, C, D, W[12]); 347| 109k| SHA2_32_F(D, E, F, G, H, A, B, C, W[13]); 348| 109k| SHA2_32_F(C, D, E, F, G, H, A, B, W[14]); 349| 109k| SHA2_32_F(B, C, D, E, F, G, H, A, W[15]); 350| | 351| 109k| A = (digest[0] += A); 352| 109k| B = (digest[1] += B); 353| 109k| C = (digest[2] += C); 354| 109k| D = (digest[3] += D); 355| 109k| E = (digest[4] += E); 356| 109k| F = (digest[5] += F); 357| 109k| G = (digest[6] += G); 358| 109k| H = (digest[7] += H); 359| 109k| } 360| 109k|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_16next_wINS_9SIMD_8x32EEET_PS3_: 50| 261k|BOTAN_FN_ISA_AVX2_BMI2 BOTAN_FORCE_INLINE SIMD_T next_w(SIMD_T x[4]) { 51| 261k| constexpr size_t sigma0_0 = 7; 52| 261k| constexpr size_t sigma0_1 = 18; 53| 261k| constexpr size_t sigma0_2 = 3; 54| 261k| constexpr size_t sigma1_0 = 17; 55| 261k| constexpr size_t sigma1_1 = 19; 56| 261k| constexpr size_t sigma1_2 = 10; 57| | 58| 261k| const SIMD_T lo_mask = SIMD_T(0x03020100, 0x0b0a0908, 0x80808080, 0x80808080); 59| 261k| const SIMD_T hi_mask = SIMD_T(0x80808080, 0x80808080, 0x03020100, 0x0b0a0908); 60| | 61| 261k| auto t0 = alignr4(x[1], x[0]); 62| 261k| x[0] += alignr4(x[3], x[2]); 63| | 64| 261k| auto t1 = t0.template shl<32 - sigma0_1>(); 65| 261k| auto t2 = t0.template shr(); 66| 261k| auto t3 = t0.template shr(); 67| 261k| t0 = t3 ^ t2; 68| | 69| 261k| t3 = shuffle_32<0b11111010>(x[3]); 70| 261k| t2 = t2.template shr(); 71| 261k| t0 ^= t1 ^ t2; 72| 261k| t1 = t1.template shl(); 73| 261k| t2 = t3.template shr(); 74| 261k| t3 = shr64(t3); 75| 261k| x[0] += t0 ^ t1; 76| | 77| 261k| t2 ^= t3; 78| 261k| t3 = shr64(t3); 79| 261k| x[0] += SIMD_T::byte_shuffle(t2 ^ t3, lo_mask); 80| | 81| 261k| t3 = shuffle_32<0b01010000>(x[0]); 82| 261k| t2 = t3.template shr(); 83| 261k| t3 = shr64(t3); 84| 261k| t2 ^= t3; 85| 261k| t3 = shr64(t3); 86| 261k| x[0] += SIMD_T::byte_shuffle(t2 ^ t3, hi_mask); 87| | 88| 261k| const auto tmp = x[0]; 89| 261k| x[0] = x[1]; 90| 261k| x[1] = x[2]; 91| 261k| x[2] = x[3]; 92| 261k| x[3] = tmp; 93| | 94| 261k| return x[3]; 95| 261k|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_17alignr4ERKNS_9SIMD_8x32ES3_: 35| 523k|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_8x32 alignr4(const SIMD_8x32& a, const SIMD_8x32& b) { 36| | return SIMD_8x32(_mm256_alignr_epi8(a.raw(), b.raw(), 4)); 37| 523k|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_110shuffle_32ILh250EEENS_9SIMD_8x32ERKS2_: 45| 261k|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_8x32 shuffle_32(const SIMD_8x32& a) { 46| | return SIMD_8x32(_mm256_shuffle_epi32(a.raw(), S)); 47| 261k|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_15shr64ILm17EEENS_9SIMD_8x32ERKS2_: 40| 523k|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_8x32 shr64(const SIMD_8x32& a) { 41| 523k| return SIMD_8x32(_mm256_srli_epi64(a.raw(), S)); 42| 523k|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_15shr64ILm2EEENS_9SIMD_8x32ERKS2_: 40| 523k|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_8x32 shr64(const SIMD_8x32& a) { 41| 523k| return SIMD_8x32(_mm256_srli_epi64(a.raw(), S)); 42| 523k|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_110shuffle_32ILh80EEENS_9SIMD_8x32ERKS2_: 45| 261k|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_8x32 shuffle_32(const SIMD_8x32& a) { 46| | return SIMD_8x32(_mm256_shuffle_epi32(a.raw(), S)); 47| 261k|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_16next_wINS_9SIMD_4x32EEET_PS3_: 50| 1.31M|BOTAN_FN_ISA_AVX2_BMI2 BOTAN_FORCE_INLINE SIMD_T next_w(SIMD_T x[4]) { 51| 1.31M| constexpr size_t sigma0_0 = 7; 52| 1.31M| constexpr size_t sigma0_1 = 18; 53| 1.31M| constexpr size_t sigma0_2 = 3; 54| 1.31M| constexpr size_t sigma1_0 = 17; 55| 1.31M| constexpr size_t sigma1_1 = 19; 56| 1.31M| constexpr size_t sigma1_2 = 10; 57| | 58| 1.31M| const SIMD_T lo_mask = SIMD_T(0x03020100, 0x0b0a0908, 0x80808080, 0x80808080); 59| 1.31M| const SIMD_T hi_mask = SIMD_T(0x80808080, 0x80808080, 0x03020100, 0x0b0a0908); 60| | 61| 1.31M| auto t0 = alignr4(x[1], x[0]); 62| 1.31M| x[0] += alignr4(x[3], x[2]); 63| | 64| 1.31M| auto t1 = t0.template shl<32 - sigma0_1>(); 65| 1.31M| auto t2 = t0.template shr(); 66| 1.31M| auto t3 = t0.template shr(); 67| 1.31M| t0 = t3 ^ t2; 68| | 69| 1.31M| t3 = shuffle_32<0b11111010>(x[3]); 70| 1.31M| t2 = t2.template shr(); 71| 1.31M| t0 ^= t1 ^ t2; 72| 1.31M| t1 = t1.template shl(); 73| 1.31M| t2 = t3.template shr(); 74| 1.31M| t3 = shr64(t3); 75| 1.31M| x[0] += t0 ^ t1; 76| | 77| 1.31M| t2 ^= t3; 78| 1.31M| t3 = shr64(t3); 79| 1.31M| x[0] += SIMD_T::byte_shuffle(t2 ^ t3, lo_mask); 80| | 81| 1.31M| t3 = shuffle_32<0b01010000>(x[0]); 82| 1.31M| t2 = t3.template shr(); 83| 1.31M| t3 = shr64(t3); 84| 1.31M| t2 ^= t3; 85| 1.31M| t3 = shr64(t3); 86| 1.31M| x[0] += SIMD_T::byte_shuffle(t2 ^ t3, hi_mask); 87| | 88| 1.31M| const auto tmp = x[0]; 89| 1.31M| x[0] = x[1]; 90| 1.31M| x[1] = x[2]; 91| 1.31M| x[2] = x[3]; 92| 1.31M| x[3] = tmp; 93| | 94| 1.31M| return x[3]; 95| 1.31M|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_17alignr4ERKNS_9SIMD_4x32ES3_: 21| 2.63M|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_4x32 alignr4(const SIMD_4x32& a, const SIMD_4x32& b) { 22| | return SIMD_4x32(_mm_alignr_epi8(a.raw(), b.raw(), 4)); 23| 2.63M|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_110shuffle_32ILh250EEENS_9SIMD_4x32ERKS2_: 31| 1.31M|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_4x32 shuffle_32(const SIMD_4x32& a) { 32| | return SIMD_4x32(_mm_shuffle_epi32(a.raw(), S)); 33| 1.31M|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_15shr64ILm17EEENS_9SIMD_4x32ERKS2_: 26| 2.63M|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_4x32 shr64(const SIMD_4x32& a) { 27| 2.63M| return SIMD_4x32(_mm_srli_epi64(a.raw(), S)); 28| 2.63M|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_15shr64ILm2EEENS_9SIMD_4x32ERKS2_: 26| 2.63M|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_4x32 shr64(const SIMD_4x32& a) { 27| 2.63M| return SIMD_4x32(_mm_srli_epi64(a.raw(), S)); 28| 2.63M|} sha2_32_avx2.cpp:_ZN5Botan12_GLOBAL__N_110shuffle_32ILh80EEENS_9SIMD_4x32ERKS2_: 31| 1.31M|BOTAN_FN_ISA_AVX2_BMI2 inline SIMD_4x32 shuffle_32(const SIMD_4x32& a) { 32| | return SIMD_4x32(_mm_shuffle_epi32(a.raw(), S)); 33| 1.31M|} _ZN5Botan7SHA_51215compress_digestERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm: 56| 15.9k|void SHA_512::compress_digest(digest_type& digest, std::span input, size_t blocks) { 57| 15.9k|#if defined(BOTAN_HAS_SHA2_64_X86) 58| 15.9k| if(CPUID::has(CPUID::Feature::SHA512)) { ------------------ | Branch (58:7): [True: 0, False: 15.9k] ------------------ 59| 0| return compress_digest_x86(digest, input, blocks); 60| 0| } 61| 15.9k|#endif 62| | 63| |#if defined(BOTAN_HAS_SHA2_64_ARMV8) 64| | if(CPUID::has(CPUID::Feature::SHA2_512)) { 65| | return compress_digest_armv8(digest, input, blocks); 66| | } 67| |#endif 68| | 69| 15.9k|#if defined(BOTAN_HAS_SHA2_64_X86_AVX512) 70| 15.9k| if(CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::BMI)) { ------------------ | Branch (70:7): [True: 0, False: 15.9k] ------------------ 71| 0| return compress_digest_x86_avx512(digest, input, blocks); 72| 0| } 73| 15.9k|#endif 74| | 75| 15.9k|#if defined(BOTAN_HAS_SHA2_64_X86_AVX2) 76| 15.9k| if(CPUID::has(CPUID::Feature::AVX2, CPUID::Feature::BMI)) { ------------------ | Branch (76:7): [True: 15.9k, False: 0] ------------------ 77| 15.9k| return compress_digest_x86_avx2(digest, input, blocks); 78| 15.9k| } 79| 0|#endif 80| | 81| 0| uint64_t A = digest[0]; 82| 0| uint64_t B = digest[1]; 83| 0| uint64_t C = digest[2]; 84| 0| uint64_t D = digest[3]; 85| 0| uint64_t E = digest[4]; 86| 0| uint64_t F = digest[5]; 87| 0| uint64_t G = digest[6]; 88| 0| uint64_t H = digest[7]; 89| | 90| 0| std::array W{}; 91| | 92| 0| BufferSlicer in(input); 93| | 94| 0| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (94:22): [True: 0, False: 0] ------------------ 95| 0| load_be(W, in.take()); 96| | 97| | // clang-format off 98| | 99| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0x428A2F98D728AE22); 100| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0x7137449123EF65CD); 101| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0xB5C0FBCFEC4D3B2F); 102| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0xE9B5DBA58189DBBC); 103| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x3956C25BF348B538); 104| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x59F111F1B605D019); 105| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x923F82A4AF194F9B); 106| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0xAB1C5ED5DA6D8118); 107| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0xD807AA98A3030242); 108| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0x12835B0145706FBE); 109| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0x243185BE4EE4B28C); 110| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0x550C7DC3D5FFB4E2); 111| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0x72BE5D74F27B896F); 112| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0x80DEB1FE3B1696B1); 113| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0x9BDC06A725C71235); 114| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0xC19BF174CF692694); 115| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0xE49B69C19EF14AD2); 116| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0xEFBE4786384F25E3); 117| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0x0FC19DC68B8CD5B5); 118| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0x240CA1CC77AC9C65); 119| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x2DE92C6F592B0275); 120| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x4A7484AA6EA6E483); 121| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x5CB0A9DCBD41FBD4); 122| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0x76F988DA831153B5); 123| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0x983E5152EE66DFAB); 124| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0xA831C66D2DB43210); 125| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0xB00327C898FB213F); 126| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0xBF597FC7BEEF0EE4); 127| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0xC6E00BF33DA88FC2); 128| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0xD5A79147930AA725); 129| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0x06CA6351E003826F); 130| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0x142929670A0E6E70); 131| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0x27B70A8546D22FFC); 132| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0x2E1B21385C26C926); 133| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0x4D2C6DFC5AC42AED); 134| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0x53380D139D95B3DF); 135| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x650A73548BAF63DE); 136| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x766A0ABB3C77B2A8); 137| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x81C2C92E47EDAEE6); 138| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0x92722C851482353B); 139| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0xA2BFE8A14CF10364); 140| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0xA81A664BBC423001); 141| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0xC24B8B70D0F89791); 142| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0xC76C51A30654BE30); 143| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0xD192E819D6EF5218); 144| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0xD69906245565A910); 145| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0xF40E35855771202A); 146| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0x106AA07032BBD1B8); 147| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0x19A4C116B8D2D0C8); 148| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0x1E376C085141AB53); 149| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0x2748774CDF8EEB99); 150| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0x34B0BCB5E19B48A8); 151| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x391C0CB3C5C95A63); 152| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x4ED8AA4AE3418ACB); 153| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x5B9CCA4F7763E373); 154| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0x682E6FF3D6B2B8A3); 155| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0x748F82EE5DEFB2FC); 156| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0x78A5636F43172F60); 157| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0x84C87814A1F0AB72); 158| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0x8CC702081A6439EC); 159| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0x90BEFFFA23631E28); 160| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0xA4506CEBDE82BDE9); 161| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0xBEF9A3F7B2C67915); 162| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0xC67178F2E372532B); 163| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], 0xCA273ECEEA26619C); 164| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], 0xD186B8C721C0C207); 165| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], 0xEADA7DD6CDE0EB1E); 166| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], 0xF57D4F7FEE6ED178); 167| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], 0x06F067AA72176FBA); 168| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], 0x0A637DC5A2C898A6); 169| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], 0x113F9804BEF90DAE); 170| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], 0x1B710B35131C471B); 171| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], 0x28DB77F523047D84); 172| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], 0x32CAAB7B40C72493); 173| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], 0x3C9EBE0A15C9BEBC); 174| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], 0x431D67C49C100D4C); 175| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], 0x4CC5D4BECB3E42B6); 176| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], 0x597F299CFC657E2A); 177| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], 0x5FCB6FAB3AD6FAEC); 178| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], 0x6C44198C4A475817); 179| | 180| | // clang-format on 181| | 182| 0| A = (digest[0] += A); 183| 0| B = (digest[1] += B); 184| 0| C = (digest[2] += C); 185| 0| D = (digest[3] += D); 186| 0| E = (digest[4] += E); 187| 0| F = (digest[5] += F); 188| 0| G = (digest[6] += G); 189| 0| H = (digest[7] += H); 190| 0| } 191| 0|} _ZN5Botan7SHA_38410compress_nERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm: 209| 15.9k|void SHA_384::compress_n(digest_type& digest, std::span input, size_t blocks) { 210| 15.9k| SHA_512::compress_digest(digest, input, blocks); 211| 15.9k|} _ZN5Botan7SHA_3844initERNSt3__16vectorImNS_16secure_allocatorImEEEE: 228| 8.60k|void SHA_384::init(digest_type& digest) { 229| 8.60k| digest.assign({0xCBBB9D5DC1059ED8, 230| 8.60k| 0x629A292A367CD507, 231| 8.60k| 0x9159015A3070DD17, 232| 8.60k| 0x152FECD8F70E5939, 233| 8.60k| 0x67332667FFC00B31, 234| 8.60k| 0x8EB44A8768581511, 235| 8.60k| 0xDB0C2E0D64F98FA7, 236| 8.60k| 0x47B5481DBEFA4FA4}); 237| 8.60k|} _ZN5Botan7SHA_3848add_dataENSt3__14spanIKhLm18446744073709551615EEE: 274| 17.1k|void SHA_384::add_data(std::span input) { 275| 17.1k| m_md.update(input); 276| 17.1k|} _ZN5Botan7SHA_38412final_resultENSt3__14spanIhLm18446744073709551615EEE: 286| 6.73k|void SHA_384::final_result(std::span output) { 287| 6.73k| m_md.final(output); 288| 6.73k|} _ZN5Botan7SHA_51224compress_digest_x86_avx2ERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm: 44| 15.9k| size_t blocks) { 45| | // clang-format off 46| 15.9k| alignas(64) const uint64_t K[80] = { 47| 15.9k| 0x428A2F98D728AE22, 0x7137449123EF65CD, 0xB5C0FBCFEC4D3B2F, 0xE9B5DBA58189DBBC, 48| 15.9k| 0x3956C25BF348B538, 0x59F111F1B605D019, 0x923F82A4AF194F9B, 0xAB1C5ED5DA6D8118, 49| 15.9k| 0xD807AA98A3030242, 0x12835B0145706FBE, 0x243185BE4EE4B28C, 0x550C7DC3D5FFB4E2, 50| 15.9k| 0x72BE5D74F27B896F, 0x80DEB1FE3B1696B1, 0x9BDC06A725C71235, 0xC19BF174CF692694, 51| 15.9k| 0xE49B69C19EF14AD2, 0xEFBE4786384F25E3, 0x0FC19DC68B8CD5B5, 0x240CA1CC77AC9C65, 52| 15.9k| 0x2DE92C6F592B0275, 0x4A7484AA6EA6E483, 0x5CB0A9DCBD41FBD4, 0x76F988DA831153B5, 53| 15.9k| 0x983E5152EE66DFAB, 0xA831C66D2DB43210, 0xB00327C898FB213F, 0xBF597FC7BEEF0EE4, 54| 15.9k| 0xC6E00BF33DA88FC2, 0xD5A79147930AA725, 0x06CA6351E003826F, 0x142929670A0E6E70, 55| 15.9k| 0x27B70A8546D22FFC, 0x2E1B21385C26C926, 0x4D2C6DFC5AC42AED, 0x53380D139D95B3DF, 56| 15.9k| 0x650A73548BAF63DE, 0x766A0ABB3C77B2A8, 0x81C2C92E47EDAEE6, 0x92722C851482353B, 57| 15.9k| 0xA2BFE8A14CF10364, 0xA81A664BBC423001, 0xC24B8B70D0F89791, 0xC76C51A30654BE30, 58| 15.9k| 0xD192E819D6EF5218, 0xD69906245565A910, 0xF40E35855771202A, 0x106AA07032BBD1B8, 59| 15.9k| 0x19A4C116B8D2D0C8, 0x1E376C085141AB53, 0x2748774CDF8EEB99, 0x34B0BCB5E19B48A8, 60| 15.9k| 0x391C0CB3C5C95A63, 0x4ED8AA4AE3418ACB, 0x5B9CCA4F7763E373, 0x682E6FF3D6B2B8A3, 61| 15.9k| 0x748F82EE5DEFB2FC, 0x78A5636F43172F60, 0x84C87814A1F0AB72, 0x8CC702081A6439EC, 62| 15.9k| 0x90BEFFFA23631E28, 0xA4506CEBDE82BDE9, 0xBEF9A3F7B2C67915, 0xC67178F2E372532B, 63| 15.9k| 0xCA273ECEEA26619C, 0xD186B8C721C0C207, 0xEADA7DD6CDE0EB1E, 0xF57D4F7FEE6ED178, 64| 15.9k| 0x06F067AA72176FBA, 0x0A637DC5A2C898A6, 0x113F9804BEF90DAE, 0x1B710B35131C471B, 65| 15.9k| 0x28DB77F523047D84, 0x32CAAB7B40C72493, 0x3C9EBE0A15C9BEBC, 0x431D67C49C100D4C, 66| 15.9k| 0x4CC5D4BECB3E42B6, 0x597F299CFC657E2A, 0x5FCB6FAB3AD6FAEC, 0x6C44198C4A475817, 67| 15.9k| }; 68| | // clang-format on 69| | 70| 15.9k| alignas(64) uint64_t W[16] = {0}; 71| 15.9k| alignas(64) uint64_t W2[80]; 72| | 73| 15.9k| uint64_t A = digest[0]; 74| 15.9k| uint64_t B = digest[1]; 75| 15.9k| uint64_t C = digest[2]; 76| 15.9k| uint64_t D = digest[3]; 77| 15.9k| uint64_t E = digest[4]; 78| 15.9k| uint64_t F = digest[5]; 79| 15.9k| uint64_t G = digest[6]; 80| 15.9k| uint64_t H = digest[7]; 81| | 82| 15.9k| const uint8_t* data = input.data(); 83| | 84| 16.6k| while(blocks >= 2) { ------------------ | Branch (84:10): [True: 655, False: 15.9k] ------------------ 85| 655| SIMD_4x64 WS[8]; 86| | 87| 5.89k| for(size_t i = 0; i < 8; i++) { ------------------ | Branch (87:25): [True: 5.24k, False: 655] ------------------ 88| 5.24k| WS[i] = SIMD_4x64::load_be2(&data[16 * i], &data[128 + 16 * i]); 89| 5.24k| auto WK = WS[i] + SIMD_4x64::broadcast_2x64(&K[2 * i]); 90| 5.24k| WK.store_le2(&W[2 * i], &W2[2 * i]); 91| 5.24k| } 92| | 93| 655| data += 2 * 128; 94| 655| blocks -= 2; 95| | 96| | // First 64 rounds of SHA-512 97| 3.27k| for(size_t r = 0; r != 64; r += 16) { ------------------ | Branch (97:25): [True: 2.62k, False: 655] ------------------ 98| 2.62k| auto w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&K[r + 16]); 99| 2.62k| SHA2_64_F(A, B, C, D, E, F, G, H, W[0]); 100| 2.62k| SHA2_64_F(H, A, B, C, D, E, F, G, W[1]); 101| 2.62k| w.store_le2(&W[0], &W2[r + 16]); 102| | 103| 2.62k| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&K[r + 18]); 104| 2.62k| SHA2_64_F(G, H, A, B, C, D, E, F, W[2]); 105| 2.62k| SHA2_64_F(F, G, H, A, B, C, D, E, W[3]); 106| 2.62k| w.store_le2(&W[2], &W2[r + 18]); 107| | 108| 2.62k| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&K[r + 20]); 109| 2.62k| SHA2_64_F(E, F, G, H, A, B, C, D, W[4]); 110| 2.62k| SHA2_64_F(D, E, F, G, H, A, B, C, W[5]); 111| 2.62k| w.store_le2(&W[4], &W2[r + 20]); 112| | 113| 2.62k| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&K[r + 22]); 114| 2.62k| SHA2_64_F(C, D, E, F, G, H, A, B, W[6]); 115| 2.62k| SHA2_64_F(B, C, D, E, F, G, H, A, W[7]); 116| 2.62k| w.store_le2(&W[6], &W2[r + 22]); 117| | 118| 2.62k| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&K[r + 24]); 119| 2.62k| SHA2_64_F(A, B, C, D, E, F, G, H, W[8]); 120| 2.62k| SHA2_64_F(H, A, B, C, D, E, F, G, W[9]); 121| 2.62k| w.store_le2(&W[8], &W2[r + 24]); 122| | 123| 2.62k| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&K[r + 26]); 124| 2.62k| SHA2_64_F(G, H, A, B, C, D, E, F, W[10]); 125| 2.62k| SHA2_64_F(F, G, H, A, B, C, D, E, W[11]); 126| 2.62k| w.store_le2(&W[10], &W2[r + 26]); 127| | 128| 2.62k| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&K[r + 28]); 129| 2.62k| SHA2_64_F(E, F, G, H, A, B, C, D, W[12]); 130| 2.62k| SHA2_64_F(D, E, F, G, H, A, B, C, W[13]); 131| 2.62k| w.store_le2(&W[12], &W2[r + 28]); 132| | 133| 2.62k| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&K[r + 30]); 134| 2.62k| SHA2_64_F(C, D, E, F, G, H, A, B, W[14]); 135| 2.62k| SHA2_64_F(B, C, D, E, F, G, H, A, W[15]); 136| 2.62k| w.store_le2(&W[14], &W2[r + 30]); 137| 2.62k| } 138| | 139| | // Final 16 rounds of SHA-512 140| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W[0]); 141| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W[1]); 142| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W[2]); 143| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W[3]); 144| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W[4]); 145| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W[5]); 146| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W[6]); 147| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W[7]); 148| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W[8]); 149| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W[9]); 150| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W[10]); 151| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W[11]); 152| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W[12]); 153| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W[13]); 154| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W[14]); 155| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W[15]); 156| | 157| 655| A = (digest[0] += A); 158| 655| B = (digest[1] += B); 159| 655| C = (digest[2] += C); 160| 655| D = (digest[3] += D); 161| 655| E = (digest[4] += E); 162| 655| F = (digest[5] += F); 163| 655| G = (digest[6] += G); 164| 655| H = (digest[7] += H); 165| | 166| | // Second block of SHA-512 compression, with pre-expanded message 167| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[0]); 168| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[1]); 169| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[2]); 170| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[3]); 171| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[4]); 172| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[5]); 173| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[6]); 174| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[7]); 175| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[8]); 176| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[9]); 177| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[10]); 178| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[11]); 179| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[12]); 180| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[13]); 181| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[14]); 182| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[15]); 183| | 184| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[16]); 185| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[17]); 186| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[18]); 187| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[19]); 188| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[20]); 189| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[21]); 190| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[22]); 191| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[23]); 192| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[24]); 193| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[25]); 194| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[26]); 195| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[27]); 196| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[28]); 197| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[29]); 198| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[30]); 199| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[31]); 200| | 201| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[32]); 202| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[33]); 203| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[34]); 204| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[35]); 205| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[36]); 206| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[37]); 207| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[38]); 208| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[39]); 209| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[40]); 210| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[41]); 211| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[42]); 212| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[43]); 213| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[44]); 214| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[45]); 215| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[46]); 216| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[47]); 217| | 218| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[48]); 219| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[49]); 220| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[50]); 221| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[51]); 222| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[52]); 223| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[53]); 224| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[54]); 225| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[55]); 226| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[56]); 227| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[57]); 228| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[58]); 229| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[59]); 230| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[60]); 231| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[61]); 232| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[62]); 233| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[63]); 234| | 235| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[64]); 236| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[65]); 237| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[66]); 238| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[67]); 239| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[68]); 240| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[69]); 241| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[70]); 242| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[71]); 243| 655| SHA2_64_F(A, B, C, D, E, F, G, H, W2[72]); 244| 655| SHA2_64_F(H, A, B, C, D, E, F, G, W2[73]); 245| 655| SHA2_64_F(G, H, A, B, C, D, E, F, W2[74]); 246| 655| SHA2_64_F(F, G, H, A, B, C, D, E, W2[75]); 247| 655| SHA2_64_F(E, F, G, H, A, B, C, D, W2[76]); 248| 655| SHA2_64_F(D, E, F, G, H, A, B, C, W2[77]); 249| 655| SHA2_64_F(C, D, E, F, G, H, A, B, W2[78]); 250| 655| SHA2_64_F(B, C, D, E, F, G, H, A, W2[79]); 251| | 252| 655| A = (digest[0] += A); 253| 655| B = (digest[1] += B); 254| 655| C = (digest[2] += C); 255| 655| D = (digest[3] += D); 256| 655| E = (digest[4] += E); 257| 655| F = (digest[5] += F); 258| 655| G = (digest[6] += G); 259| 655| H = (digest[7] += H); 260| 655| } 261| | 262| 31.6k| while(blocks > 0) { ------------------ | Branch (262:10): [True: 15.6k, False: 15.9k] ------------------ 263| 15.6k| SIMD_2x64 WS[8]; 264| | 265| 141k| for(size_t i = 0; i < 8; i++) { ------------------ | Branch (265:25): [True: 125k, False: 15.6k] ------------------ 266| 125k| WS[i] = SIMD_2x64::load_be(&data[16 * i]); 267| 125k| auto WK = WS[i] + SIMD_2x64::load_le(&K[2 * i]); 268| 125k| WK.store_le(&W[2 * i]); 269| 125k| } 270| | 271| 15.6k| data += 128; 272| 15.6k| blocks -= 1; 273| | 274| | // First 64 rounds of SHA-512 275| 78.4k| for(size_t r = 0; r != 64; r += 16) { ------------------ | Branch (275:25): [True: 62.7k, False: 15.6k] ------------------ 276| 62.7k| auto w = sha512_next_w(WS) + SIMD_2x64::load_le(&K[r + 16]); 277| 62.7k| SHA2_64_F(A, B, C, D, E, F, G, H, W[0]); 278| 62.7k| SHA2_64_F(H, A, B, C, D, E, F, G, W[1]); 279| 62.7k| w.store_le(&W[0]); 280| | 281| 62.7k| w = sha512_next_w(WS) + SIMD_2x64::load_le(&K[r + 18]); 282| 62.7k| SHA2_64_F(G, H, A, B, C, D, E, F, W[2]); 283| 62.7k| SHA2_64_F(F, G, H, A, B, C, D, E, W[3]); 284| 62.7k| w.store_le(&W[2]); 285| | 286| 62.7k| w = sha512_next_w(WS) + SIMD_2x64::load_le(&K[r + 20]); 287| 62.7k| SHA2_64_F(E, F, G, H, A, B, C, D, W[4]); 288| 62.7k| SHA2_64_F(D, E, F, G, H, A, B, C, W[5]); 289| 62.7k| w.store_le(&W[4]); 290| | 291| 62.7k| w = sha512_next_w(WS) + SIMD_2x64::load_le(&K[r + 22]); 292| 62.7k| SHA2_64_F(C, D, E, F, G, H, A, B, W[6]); 293| 62.7k| SHA2_64_F(B, C, D, E, F, G, H, A, W[7]); 294| 62.7k| w.store_le(&W[6]); 295| | 296| 62.7k| w = sha512_next_w(WS) + SIMD_2x64::load_le(&K[r + 24]); 297| 62.7k| SHA2_64_F(A, B, C, D, E, F, G, H, W[8]); 298| 62.7k| SHA2_64_F(H, A, B, C, D, E, F, G, W[9]); 299| 62.7k| w.store_le(&W[8]); 300| | 301| 62.7k| w = sha512_next_w(WS) + SIMD_2x64::load_le(&K[r + 26]); 302| 62.7k| SHA2_64_F(G, H, A, B, C, D, E, F, W[10]); 303| 62.7k| SHA2_64_F(F, G, H, A, B, C, D, E, W[11]); 304| 62.7k| w.store_le(&W[10]); 305| | 306| 62.7k| w = sha512_next_w(WS) + SIMD_2x64::load_le(&K[r + 28]); 307| 62.7k| SHA2_64_F(E, F, G, H, A, B, C, D, W[12]); 308| 62.7k| SHA2_64_F(D, E, F, G, H, A, B, C, W[13]); 309| 62.7k| w.store_le(&W[12]); 310| | 311| 62.7k| w = sha512_next_w(WS) + SIMD_2x64::load_le(&K[r + 30]); 312| 62.7k| SHA2_64_F(C, D, E, F, G, H, A, B, W[14]); 313| 62.7k| SHA2_64_F(B, C, D, E, F, G, H, A, W[15]); 314| 62.7k| w.store_le(&W[14]); 315| 62.7k| } 316| | 317| | // Final 16 rounds of SHA-512 318| 15.6k| SHA2_64_F(A, B, C, D, E, F, G, H, W[0]); 319| 15.6k| SHA2_64_F(H, A, B, C, D, E, F, G, W[1]); 320| 15.6k| SHA2_64_F(G, H, A, B, C, D, E, F, W[2]); 321| 15.6k| SHA2_64_F(F, G, H, A, B, C, D, E, W[3]); 322| 15.6k| SHA2_64_F(E, F, G, H, A, B, C, D, W[4]); 323| 15.6k| SHA2_64_F(D, E, F, G, H, A, B, C, W[5]); 324| 15.6k| SHA2_64_F(C, D, E, F, G, H, A, B, W[6]); 325| 15.6k| SHA2_64_F(B, C, D, E, F, G, H, A, W[7]); 326| 15.6k| SHA2_64_F(A, B, C, D, E, F, G, H, W[8]); 327| 15.6k| SHA2_64_F(H, A, B, C, D, E, F, G, W[9]); 328| 15.6k| SHA2_64_F(G, H, A, B, C, D, E, F, W[10]); 329| 15.6k| SHA2_64_F(F, G, H, A, B, C, D, E, W[11]); 330| 15.6k| SHA2_64_F(E, F, G, H, A, B, C, D, W[12]); 331| 15.6k| SHA2_64_F(D, E, F, G, H, A, B, C, W[13]); 332| 15.6k| SHA2_64_F(C, D, E, F, G, H, A, B, W[14]); 333| 15.6k| SHA2_64_F(B, C, D, E, F, G, H, A, W[15]); 334| | 335| 15.6k| A = (digest[0] += A); 336| 15.6k| B = (digest[1] += B); 337| 15.6k| C = (digest[2] += C); 338| 15.6k| D = (digest[3] += D); 339| 15.6k| E = (digest[4] += E); 340| 15.6k| F = (digest[5] += F); 341| 15.6k| G = (digest[6] += G); 342| 15.6k| H = (digest[7] += H); 343| 15.6k| } 344| 15.9k|} sha2_64_avx2.cpp:_ZN5Botan12_GLOBAL__N_113sha512_next_wINS_9SIMD_4x64EEET_PS3_: 19| 20.9k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_BMI2 SIMD_T sha512_next_w(SIMD_T x[8]) { 20| 20.9k| auto t0 = SIMD_T::alignr8(x[1], x[0]); 21| 20.9k| auto t1 = SIMD_T::alignr8(x[5], x[4]); 22| | 23| 20.9k| auto s0 = t0.template rotr<1>() ^ t0.template rotr<8>() ^ t0.template shr<7>(); 24| 20.9k| auto s1 = x[7].template rotr<19>() ^ x[7].template rotr<61>() ^ x[7].template shr<6>(); 25| | 26| 20.9k| auto nx = x[0] + s0 + s1 + t1; 27| | 28| 20.9k| x[0] = x[1]; 29| 20.9k| x[1] = x[2]; 30| 20.9k| x[2] = x[3]; 31| 20.9k| x[3] = x[4]; 32| 20.9k| x[4] = x[5]; 33| 20.9k| x[5] = x[6]; 34| 20.9k| x[6] = x[7]; 35| 20.9k| x[7] = nx; 36| | 37| 20.9k| return x[7]; 38| 20.9k|} sha2_64_avx2.cpp:_ZN5Botan12_GLOBAL__N_113sha512_next_wINS_9SIMD_2x64EEET_PS3_: 19| 502k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_BMI2 SIMD_T sha512_next_w(SIMD_T x[8]) { 20| 502k| auto t0 = SIMD_T::alignr8(x[1], x[0]); 21| 502k| auto t1 = SIMD_T::alignr8(x[5], x[4]); 22| | 23| 502k| auto s0 = t0.template rotr<1>() ^ t0.template rotr<8>() ^ t0.template shr<7>(); 24| 502k| auto s1 = x[7].template rotr<19>() ^ x[7].template rotr<61>() ^ x[7].template shr<6>(); 25| | 26| 502k| auto nx = x[0] + s0 + s1 + t1; 27| | 28| 502k| x[0] = x[1]; 29| 502k| x[1] = x[2]; 30| 502k| x[2] = x[3]; 31| 502k| x[3] = x[4]; 32| 502k| x[4] = x[5]; 33| 502k| x[5] = x[6]; 34| 502k| x[6] = x[7]; 35| 502k| x[7] = nx; 36| | 37| 502k| return x[7]; 38| 502k|} _ZN5Botan3KDF6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 73| 1.59k|std::unique_ptr KDF::create(std::string_view algo_spec, std::string_view provider) { 74| 1.59k| const SCAN_Name req(algo_spec); 75| | 76| 1.59k|#if defined(BOTAN_HAS_HKDF) 77| 1.59k| if(req.algo_name() == "HKDF" && req.arg_count() == 1) { ------------------ | Branch (77:7): [True: 0, False: 1.59k] | Branch (77:36): [True: 0, False: 0] ------------------ 78| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (78:10): [True: 0, False: 0] | Branch (78:30): [True: 0, False: 0] ------------------ 79| 0| return kdf_create_mac_or_hash(req.arg(0)); 80| 0| } 81| 0| } 82| | 83| 1.59k| if(req.algo_name() == "HKDF-Extract" && req.arg_count() == 1) { ------------------ | Branch (83:7): [True: 0, False: 1.59k] | Branch (83:44): [True: 0, False: 0] ------------------ 84| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (84:10): [True: 0, False: 0] | Branch (84:30): [True: 0, False: 0] ------------------ 85| 0| return kdf_create_mac_or_hash(req.arg(0)); 86| 0| } 87| 0| } 88| | 89| 1.59k| if(req.algo_name() == "HKDF-Expand" && req.arg_count() == 1) { ------------------ | Branch (89:7): [True: 0, False: 1.59k] | Branch (89:43): [True: 0, False: 0] ------------------ 90| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (90:10): [True: 0, False: 0] | Branch (90:30): [True: 0, False: 0] ------------------ 91| 0| return kdf_create_mac_or_hash(req.arg(0)); 92| 0| } 93| 0| } 94| 1.59k|#endif 95| | 96| 1.59k|#if defined(BOTAN_HAS_KDF2) 97| 1.59k| if(req.algo_name() == "KDF2" && req.arg_count() == 1) { ------------------ | Branch (97:7): [True: 0, False: 1.59k] | Branch (97:36): [True: 0, False: 0] ------------------ 98| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (98:10): [True: 0, False: 0] | Branch (98:30): [True: 0, False: 0] ------------------ 99| 0| if(auto hash = HashFunction::create(req.arg(0))) { ------------------ | Branch (99:18): [True: 0, False: 0] ------------------ 100| 0| return std::make_unique(std::move(hash)); 101| 0| } 102| 0| } 103| 0| } 104| 1.59k|#endif 105| | 106| 1.59k|#if defined(BOTAN_HAS_KDF1_18033) 107| 1.59k| if(req.algo_name() == "KDF1-18033" && req.arg_count() == 1) { ------------------ | Branch (107:7): [True: 0, False: 1.59k] | Branch (107:42): [True: 0, False: 0] ------------------ 108| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (108:10): [True: 0, False: 0] | Branch (108:30): [True: 0, False: 0] ------------------ 109| 0| if(auto hash = HashFunction::create(req.arg(0))) { ------------------ | Branch (109:18): [True: 0, False: 0] ------------------ 110| 0| return std::make_unique(std::move(hash)); 111| 0| } 112| 0| } 113| 0| } 114| 1.59k|#endif 115| | 116| 1.59k|#if defined(BOTAN_HAS_KDF1) 117| 1.59k| if(req.algo_name() == "KDF1" && req.arg_count() == 1) { ------------------ | Branch (117:7): [True: 0, False: 1.59k] | Branch (117:36): [True: 0, False: 0] ------------------ 118| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (118:10): [True: 0, False: 0] | Branch (118:30): [True: 0, False: 0] ------------------ 119| 0| if(auto hash = HashFunction::create(req.arg(0))) { ------------------ | Branch (119:18): [True: 0, False: 0] ------------------ 120| 0| return std::make_unique(std::move(hash)); 121| 0| } 122| 0| } 123| 0| } 124| 1.59k|#endif 125| | 126| 1.59k|#if defined(BOTAN_HAS_TLS_V12_PRF) 127| 1.59k| if(req.algo_name() == "TLS-12-PRF" && req.arg_count() == 1) { ------------------ | Branch (127:7): [True: 1.59k, False: 0] | Branch (127:42): [True: 1.59k, False: 0] ------------------ 128| 1.59k| if(provider.empty() || provider == "base") { ------------------ | Branch (128:10): [True: 1.59k, False: 0] | Branch (128:30): [True: 0, False: 0] ------------------ 129| 1.59k| return kdf_create_mac_or_hash(req.arg(0)); 130| 1.59k| } 131| 1.59k| } 132| 0|#endif 133| | 134| 0|#if defined(BOTAN_HAS_X942_PRF) 135| 0| if(req.algo_name() == "X9.42-PRF" && req.arg_count() == 1) { ------------------ | Branch (135:7): [True: 0, False: 0] | Branch (135:41): [True: 0, False: 0] ------------------ 136| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (136:10): [True: 0, False: 0] | Branch (136:30): [True: 0, False: 0] ------------------ 137| 0| return std::make_unique(req.arg(0)); 138| 0| } 139| 0| } 140| 0|#endif 141| | 142| 0|#if defined(BOTAN_HAS_SP800_108) 143| 0| if(req.algo_name() == "SP800-108-Counter" && req.arg_count_between(1, 3)) { ------------------ | Branch (143:7): [True: 0, False: 0] | Branch (143:49): [True: 0, False: 0] ------------------ 144| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (144:10): [True: 0, False: 0] | Branch (144:30): [True: 0, False: 0] ------------------ 145| 0| return kdf_create_mac_or_hash( 146| 0| req.arg(0), req.arg_as_integer(1, 32), req.arg_as_integer(2, 32)); 147| 0| } 148| 0| } 149| | 150| 0| if(req.algo_name() == "SP800-108-Feedback" && req.arg_count_between(1, 3)) { ------------------ | Branch (150:7): [True: 0, False: 0] | Branch (150:50): [True: 0, False: 0] ------------------ 151| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (151:10): [True: 0, False: 0] | Branch (151:30): [True: 0, False: 0] ------------------ 152| 0| return kdf_create_mac_or_hash( 153| 0| req.arg(0), req.arg_as_integer(1, 32), req.arg_as_integer(2, 32)); 154| 0| } 155| 0| } 156| | 157| 0| if(req.algo_name() == "SP800-108-Pipeline" && req.arg_count_between(1, 3)) { ------------------ | Branch (157:7): [True: 0, False: 0] | Branch (157:50): [True: 0, False: 0] ------------------ 158| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (158:10): [True: 0, False: 0] | Branch (158:30): [True: 0, False: 0] ------------------ 159| 0| return kdf_create_mac_or_hash( 160| 0| req.arg(0), req.arg_as_integer(1, 32), req.arg_as_integer(2, 32)); 161| 0| } 162| 0| } 163| 0|#endif 164| | 165| 0|#if defined(BOTAN_HAS_SP800_56A) 166| 0| if(req.algo_name() == "SP800-56A" && req.arg_count() == 1) { ------------------ | Branch (166:7): [True: 0, False: 0] | Branch (166:41): [True: 0, False: 0] ------------------ 167| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (167:10): [True: 0, False: 0] | Branch (167:30): [True: 0, False: 0] ------------------ 168| 0| if(auto hash = HashFunction::create(req.arg(0))) { ------------------ | Branch (168:18): [True: 0, False: 0] ------------------ 169| 0| return std::make_unique(std::move(hash)); 170| 0| } 171| 0| if(req.arg(0) == "KMAC-128") { ------------------ | Branch (171:13): [True: 0, False: 0] ------------------ 172| 0| return std::make_unique(); 173| 0| } 174| 0| if(req.arg(0) == "KMAC-256") { ------------------ | Branch (174:13): [True: 0, False: 0] ------------------ 175| 0| return std::make_unique(); 176| 0| } 177| 0| if(auto mac = MessageAuthenticationCode::create(req.arg(0))) { ------------------ | Branch (177:18): [True: 0, False: 0] ------------------ 178| 0| return std::make_unique(std::move(mac)); 179| 0| } 180| 0| } 181| 0| } 182| 0|#endif 183| | 184| 0|#if defined(BOTAN_HAS_SP800_56C) 185| 0| if(req.algo_name() == "SP800-56C" && req.arg_count() == 1) { ------------------ | Branch (185:7): [True: 0, False: 0] | Branch (185:41): [True: 0, False: 0] ------------------ 186| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (186:10): [True: 0, False: 0] | Branch (186:30): [True: 0, False: 0] ------------------ 187| 0| std::unique_ptr exp(kdf_create_mac_or_hash(req.arg(0), 32, 32)); 188| 0| if(exp) { ------------------ | Branch (188:13): [True: 0, False: 0] ------------------ 189| 0| if(auto mac = MessageAuthenticationCode::create(fmt("HMAC({})", req.arg(0)))) { ------------------ | Branch (189:21): [True: 0, False: 0] ------------------ 190| 0| return std::make_unique(std::move(mac), std::move(exp)); 191| 0| } 192| | 193| 0| if(auto mac = MessageAuthenticationCode::create(req.arg(0))) { ------------------ | Branch (193:21): [True: 0, False: 0] ------------------ 194| 0| return std::make_unique(std::move(mac), std::move(exp)); 195| 0| } 196| 0| } 197| 0| } 198| 0| } 199| 0|#endif 200| | 201| 0| BOTAN_UNUSED(req); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 202| 0| BOTAN_UNUSED(provider); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 203| | 204| 0| return nullptr; 205| 0|} _ZN5Botan3KDF15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 208| 1.59k|std::unique_ptr KDF::create_or_throw(std::string_view algo, std::string_view provider) { 209| 1.59k| if(auto kdf = KDF::create(algo, provider)) { ------------------ | Branch (209:12): [True: 1.59k, False: 0] ------------------ 210| 1.59k| return kdf; 211| 1.59k| } 212| 0| throw Lookup_Error("KDF", algo, provider); 213| 1.59k|} kdf.cpp:_ZN5Botan12_GLOBAL__N_122kdf_create_mac_or_hashINS_10TLS_12_PRFEJEEENSt3__110unique_ptrINS_3KDFENS3_14default_deleteIS5_EEEENS3_17basic_string_viewIcNS3_11char_traitsIcEEEEDpOT0_: 59| 1.59k|std::unique_ptr kdf_create_mac_or_hash(std::string_view nm, ParamTs&&... params) { 60| 1.59k| if(auto mac = MessageAuthenticationCode::create(fmt("HMAC({})", nm))) { ------------------ | Branch (60:12): [True: 1.59k, False: 0] ------------------ 61| 1.59k| return std::make_unique(std::move(mac), std::forward(params)...); 62| 1.59k| } 63| | 64| 0| if(auto mac = MessageAuthenticationCode::create(nm)) { ------------------ | Branch (64:12): [True: 0, False: 0] ------------------ 65| 0| return std::make_unique(std::move(mac), std::forward(params)...); 66| 0| } 67| | 68| 0| return nullptr; 69| 0|} _ZNK5Botan10TLS_12_PRF11perform_kdfENSt3__14spanIhLm18446744073709551615EEENS2_IKhLm18446744073709551615EEES5_S5_: 25| 3.00k| std::span label) const { 26| 3.00k| try { 27| 3.00k| m_mac->set_key(secret); 28| 3.00k| } catch(Invalid_Key_Length&) { 29| 0| throw Internal_Error(fmt("The premaster secret of {} bytes is too long for TLS-PRF", secret.size())); 30| 0| } 31| | 32| 3.00k| auto A = concat>(label, salt); 33| 3.00k| secure_vector h; 34| | 35| 3.00k| BufferStuffer o(key); 36| 9.79k| while(!o.full()) { ------------------ | Branch (36:10): [True: 6.79k, False: 3.00k] ------------------ 37| 6.79k| A = m_mac->process(A); 38| | 39| 6.79k| m_mac->update(A); 40| 6.79k| m_mac->update(label); 41| 6.79k| m_mac->update(salt); 42| 6.79k| m_mac->final(h); 43| | 44| 6.79k| const size_t writing = std::min(h.size(), o.remaining_capacity()); 45| 6.79k| o.append(std::span{h}.first(writing)); 46| 6.79k| } 47| 3.00k|} _ZN5Botan4HMAC8add_dataENSt3__14spanIKhLm18446744073709551615EEE: 21| 27.7k|void HMAC::add_data(std::span input) { 22| 27.7k| assert_key_material_set(); 23| 27.7k| m_hash->update(input); 24| 27.7k|} _ZN5Botan4HMAC12final_resultENSt3__14spanIhLm18446744073709551615EEE: 29| 13.8k|void HMAC::final_result(std::span mac) { 30| 13.8k| assert_key_material_set(); 31| 13.8k| m_hash->final(mac); 32| 13.8k| m_hash->update(m_okey); 33| 13.8k| m_hash->update(mac.first(m_hash_output_length)); 34| 13.8k| m_hash->final(mac); 35| 13.8k| m_hash->update(m_ikey); 36| 13.8k|} _ZNK5Botan4HMAC8key_specEv: 48| 3.49k|Key_Length_Specification HMAC::key_spec() const { 49| | // Support very long lengths for things like PBKDF2 and the TLS PRF 50| 3.49k| return Key_Length_Specification(0, 8192); 51| 3.49k|} _ZNK5Botan4HMAC13output_lengthEv: 53| 14.0k|size_t HMAC::output_length() const { 54| 14.0k| return m_hash_output_length; 55| 14.0k|} _ZNK5Botan4HMAC19has_keying_materialEv: 57| 41.6k|bool HMAC::has_keying_material() const { 58| 41.6k| return !m_okey.empty(); 59| 41.6k|} _ZN5Botan4HMAC12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 64| 3.24k|void HMAC::key_schedule(std::span key) { 65| 3.24k| const uint8_t ipad = 0x36; 66| 3.24k| const uint8_t opad = 0x5C; 67| | 68| 3.24k| m_hash->clear(); 69| | 70| 3.24k| m_ikey.resize(m_hash_block_size); 71| 3.24k| m_okey.resize(m_hash_block_size); 72| | 73| 3.24k| clear_mem(m_ikey.data(), m_ikey.size()); 74| 3.24k| clear_mem(m_okey.data(), m_okey.size()); 75| | 76| | /* 77| | * Sometimes the HMAC key length itself is sensitive, as with PBKDF2 where it 78| | * reveals the length of the passphrase. Make some attempt to hide this to 79| | * side channels. Clearly if the secret is longer than the block size then the 80| | * branch to hash first reveals that. In addition, counting the number of 81| | * compression functions executed reveals the size at the granularity of the 82| | * hash function's block size. 83| | * 84| | * The greater concern is for smaller keys; being able to detect when a 85| | * passphrase is say 4 bytes may assist choosing weaker targets. Even though 86| | * the loop bounds are constant, we can only actually read key[0..length] so 87| | * it doesn't seem possible to make this computation truly constant time. 88| | * 89| | * We don't mind leaking if the length is exactly zero since that's 90| | * trivial to simply check. 91| | */ 92| | 93| 3.24k| if(key.size() > m_hash_block_size) { ------------------ | Branch (93:7): [True: 396, False: 2.85k] ------------------ 94| 396| m_hash->update(key); 95| 396| m_hash->final(m_ikey.data()); 96| 2.85k| } else if(key.size() >= 20) { ------------------ | Branch (96:14): [True: 2.85k, False: 0] ------------------ 97| | // For long keys we just leak the length either it is a cryptovariable 98| | // or a long enough password that just the length is not a useful signal 99| 2.85k| copy_mem(std::span{m_ikey}.first(key.size()), key); 100| 2.85k| } else if(!key.empty()) { ------------------ | Branch (100:14): [True: 0, False: 0] ------------------ 101| 0| for(size_t i = 0, i_mod_length = 0; i != m_hash_block_size; ++i) { ------------------ | Branch (101:43): [True: 0, False: 0] ------------------ 102| | /* 103| | access key[i % length] but avoiding division due to variable 104| | time computation on some processors. 105| | */ 106| 0| auto needs_reduction = CT::Mask::is_lte(key.size(), i_mod_length); 107| 0| i_mod_length = needs_reduction.select(0, i_mod_length); 108| 0| const uint8_t kb = key[i_mod_length]; 109| | 110| 0| auto in_range = CT::Mask::is_lt(i, key.size()); 111| 0| m_ikey[i] = static_cast(in_range.if_set_return(kb)); 112| 0| i_mod_length += 1; 113| 0| } 114| 0| } 115| | 116| 268k| for(size_t i = 0; i != m_hash_block_size; ++i) { ------------------ | Branch (116:22): [True: 265k, False: 3.24k] ------------------ 117| 265k| m_ikey[i] ^= ipad; 118| 265k| m_okey[i] = m_ikey[i] ^ ipad ^ opad; 119| 265k| } 120| | 121| 3.24k| m_hash->update(m_ikey); 122| 3.24k|} _ZNK5Botan4HMAC4nameEv: 136| 369|std::string HMAC::name() const { 137| 369| return fmt("HMAC({})", m_hash->name()); 138| 369|} _ZN5Botan4HMACC2ENSt3__110unique_ptrINS_12HashFunctionENS1_14default_deleteIS3_EEEE: 151| 1.84k| m_hash(std::move(hash)), 152| 1.84k| m_hash_output_length(m_hash->output_length()), 153| 1.84k| m_hash_block_size(m_hash->hash_block_size()) { 154| 1.84k| BOTAN_ARG_CHECK(m_hash_output_length >= 8, "HMAC is not compatible with this hash function"); ------------------ | | 35| 1.84k| do { \ | | 36| 1.84k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.84k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.84k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.84k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.84k] | | ------------------ ------------------ 155| 1.84k| BOTAN_ARG_CHECK(m_hash_block_size >= m_hash_output_length, "HMAC is not compatible with this hash function"); ------------------ | | 35| 1.84k| do { \ | | 36| 1.84k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.84k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.84k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.84k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.84k] | | ------------------ ------------------ 156| 1.84k|} _ZN5Botan25MessageAuthenticationCode6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 51| 1.84k| std::string_view provider) { 52| 1.84k| const SCAN_Name req(algo_spec); 53| | 54| 1.84k|#if defined(BOTAN_HAS_BLAKE2BMAC) 55| 1.84k| if(req.algo_name() == "Blake2b" || req.algo_name() == "BLAKE2b") { ------------------ | Branch (55:7): [True: 0, False: 1.84k] | Branch (55:39): [True: 0, False: 1.84k] ------------------ 56| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (56:10): [True: 0, False: 0] | Branch (56:30): [True: 0, False: 0] ------------------ 57| 0| return std::make_unique(req.arg_as_integer(0, 512)); 58| 0| } 59| 0| } 60| 1.84k|#endif 61| | 62| 1.84k|#if defined(BOTAN_HAS_GMAC) 63| 1.84k| if(req.algo_name() == "GMAC" && req.arg_count() == 1) { ------------------ | Branch (63:7): [True: 0, False: 1.84k] | Branch (63:36): [True: 0, False: 0] ------------------ 64| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (64:10): [True: 0, False: 0] | Branch (64:30): [True: 0, False: 0] ------------------ 65| 0| if(auto bc = BlockCipher::create(req.arg(0))) { ------------------ | Branch (65:18): [True: 0, False: 0] ------------------ 66| 0| return std::make_unique(std::move(bc)); 67| 0| } 68| 0| } 69| 0| } 70| 1.84k|#endif 71| | 72| 1.84k|#if defined(BOTAN_HAS_HMAC) 73| 1.84k| if(req.algo_name() == "HMAC" && req.arg_count() == 1) { ------------------ | Branch (73:7): [True: 1.84k, False: 0] | Branch (73:36): [True: 1.84k, False: 0] ------------------ 74| 1.84k| if(provider.empty() || provider == "base") { ------------------ | Branch (74:10): [True: 1.84k, False: 0] | Branch (74:30): [True: 0, False: 0] ------------------ 75| 1.84k| if(auto hash = HashFunction::create(req.arg(0))) { ------------------ | Branch (75:18): [True: 1.84k, False: 0] ------------------ 76| 1.84k| return std::make_unique(std::move(hash)); 77| 1.84k| } 78| 1.84k| } 79| 1.84k| } 80| 0|#endif 81| | 82| 0|#if defined(BOTAN_HAS_POLY1305) 83| 0| if(req.algo_name() == "Poly1305" && req.arg_count() == 0) { ------------------ | Branch (83:7): [True: 0, False: 0] | Branch (83:40): [True: 0, False: 0] ------------------ 84| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (84:10): [True: 0, False: 0] | Branch (84:30): [True: 0, False: 0] ------------------ 85| 0| return std::make_unique(); 86| 0| } 87| 0| } 88| 0|#endif 89| | 90| 0|#if defined(BOTAN_HAS_SIPHASH) 91| 0| if(req.algo_name() == "SipHash") { ------------------ | Branch (91:7): [True: 0, False: 0] ------------------ 92| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (92:10): [True: 0, False: 0] | Branch (92:30): [True: 0, False: 0] ------------------ 93| 0| return std::make_unique(req.arg_as_integer(0, 2), req.arg_as_integer(1, 4)); 94| 0| } 95| 0| } 96| 0|#endif 97| | 98| 0|#if defined(BOTAN_HAS_CMAC) 99| 0| if((req.algo_name() == "CMAC" || req.algo_name() == "OMAC") && req.arg_count() == 1) { ------------------ | Branch (99:8): [True: 0, False: 0] | Branch (99:37): [True: 0, False: 0] | Branch (99:67): [True: 0, False: 0] ------------------ 100| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (100:10): [True: 0, False: 0] | Branch (100:30): [True: 0, False: 0] ------------------ 101| 0| if(auto bc = BlockCipher::create(req.arg(0))) { ------------------ | Branch (101:18): [True: 0, False: 0] ------------------ 102| 0| return std::make_unique(std::move(bc)); 103| 0| } 104| 0| } 105| 0| } 106| 0|#endif 107| | 108| 0|#if defined(BOTAN_HAS_ANSI_X919_MAC) 109| 0| if(req.algo_name() == "X9.19-MAC") { ------------------ | Branch (109:7): [True: 0, False: 0] ------------------ 110| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (110:10): [True: 0, False: 0] | Branch (110:30): [True: 0, False: 0] ------------------ 111| 0| return std::make_unique(); 112| 0| } 113| 0| } 114| 0|#endif 115| | 116| 0|#if defined(BOTAN_HAS_KMAC) 117| 0| if(req.algo_name() == "KMAC-128") { ------------------ | Branch (117:7): [True: 0, False: 0] ------------------ 118| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (118:10): [True: 0, False: 0] | Branch (118:30): [True: 0, False: 0] ------------------ 119| 0| if(req.arg_count() != 1) { ------------------ | Branch (119:13): [True: 0, False: 0] ------------------ 120| 0| throw Invalid_Argument( 121| 0| "invalid algorithm specification for KMAC-128: need exactly one argument for output bit length"); 122| 0| } 123| 0| return std::make_unique(req.arg_as_integer(0)); 124| 0| } 125| 0| } 126| | 127| 0| if(req.algo_name() == "KMAC-256") { ------------------ | Branch (127:7): [True: 0, False: 0] ------------------ 128| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (128:10): [True: 0, False: 0] | Branch (128:30): [True: 0, False: 0] ------------------ 129| 0| if(req.arg_count() != 1) { ------------------ | Branch (129:13): [True: 0, False: 0] ------------------ 130| 0| throw Invalid_Argument( 131| 0| "invalid algorithm specification for KMAC-256: need exactly one argument for output bit length"); 132| 0| } 133| 0| return std::make_unique(req.arg_as_integer(0)); 134| 0| } 135| 0| } 136| 0|#endif 137| | 138| 0| BOTAN_UNUSED(req); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 139| 0| BOTAN_UNUSED(provider); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 140| | 141| 0| return nullptr; 142| 0|} _ZN5Botan25MessageAuthenticationCode15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 150| 243| std::string_view provider) { 151| 243| if(auto mac = MessageAuthenticationCode::create(algo, provider)) { ------------------ | Branch (151:12): [True: 243, False: 0] ------------------ 152| 243| return mac; 153| 243| } 154| 0| throw Lookup_Error("MAC", algo, provider); 155| 243|} _ZN5Botan6BigInt17from_radix_digitsENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEm: 125| 36|BigInt BigInt::from_radix_digits(std::string_view digits, size_t radix) { 126| 36| if(radix == 16) { ------------------ | Branch (126:7): [True: 36, False: 0] ------------------ 127| 36| secure_vector binary; 128| | 129| 36| if(digits.size() % 2 == 1) { ------------------ | Branch (129:10): [True: 5, False: 31] ------------------ 130| | // Handle lack of leading 0 131| 5| const char buf0_with_leading_0[2] = {'0', digits[0]}; 132| | 133| 5| binary = hex_decode_locked(buf0_with_leading_0, 2); 134| | 135| 5| if(digits.size() > 1) { ------------------ | Branch (135:13): [True: 5, False: 0] ------------------ 136| 5| binary += hex_decode_locked(&digits[1], digits.size() - 1, false); 137| 5| } 138| 31| } else { 139| 31| binary = hex_decode_locked(digits, false); 140| 31| } 141| | 142| 36| return BigInt::from_bytes(binary); 143| 36| } else if(radix == 10) { ------------------ | Branch (143:14): [True: 0, False: 0] ------------------ 144| | // Use the largest power of 10 that fits in a word, accumulating 145| | // groups of digits into word-sized chunks to minimize the number 146| | // of multiprecision multiplications. 147| 0| constexpr word conversion_radix = decimal_conversion_radix(); 148| 0| constexpr size_t radix_digits = decimal_conversion_radix_digits(); 149| | 150| 0| BigInt r; 151| | 152| | // Handle the initial partial block (if digit count is not a multiple of radix_digits) 153| 0| const size_t partial_block = digits.size() % radix_digits; 154| | 155| 0| if(partial_block > 0) { ------------------ | Branch (155:10): [True: 0, False: 0] ------------------ 156| 0| word acc = 0; 157| 0| for(size_t i = 0; i < partial_block; ++i) { ------------------ | Branch (157:28): [True: 0, False: 0] ------------------ 158| 0| const char c = digits[i]; 159| 0| BOTAN_ARG_CHECK(c >= '0' && c <= '9', "Invalid decimal character"); ------------------ | | 35| 0| do { \ | | 36| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 0| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 0| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 0] | | ------------------ ------------------ 160| 0| acc = acc * 10 + static_cast(c - '0'); 161| 0| } 162| 0| r += acc; 163| 0| } 164| | 165| | // Process full blocks of radix_digits 166| 0| for(size_t i = partial_block; i != digits.size(); i += radix_digits) { ------------------ | Branch (166:37): [True: 0, False: 0] ------------------ 167| 0| word acc = 0; 168| 0| for(size_t j = 0; j < radix_digits; ++j) { ------------------ | Branch (168:28): [True: 0, False: 0] ------------------ 169| 0| const char c = digits[i + j]; 170| 0| BOTAN_ARG_CHECK(c >= '0' && c <= '9', "Invalid decimal character"); ------------------ | | 35| 0| do { \ | | 36| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 0| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 0| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 0] | | ------------------ ------------------ 171| 0| acc = acc * 10 + static_cast(c - '0'); 172| 0| } 173| 0| r *= conversion_radix; 174| 0| r += acc; 175| 0| } 176| | 177| 0| return r; 178| 0| } else { 179| 0| throw Invalid_Argument("BigInt::from_radix_digits unknown radix"); 180| 0| } 181| 36|} _ZN5Botan6BigIntmIERKS0_: 23| 101|BigInt& BigInt::operator-=(const BigInt& y) { 24| 101| if(&y == this) { ------------------ | Branch (24:7): [True: 0, False: 101] ------------------ 25| 0| this->clear(); 26| 0| this->set_sign(Positive); 27| 0| return *this; 28| 0| } 29| 101| return sub(y._data(), y.sig_words(), y.sign()); 30| 101|} _ZN5Botan6BigInt3addEPKmmNS0_4SignE: 32| 101|BigInt& BigInt::add(const word y[], size_t y_words, Sign y_sign) { 33| 101| const size_t x_sw = sig_words(); 34| | 35| 101| grow_to(std::max(x_sw, y_words) + 1); 36| | 37| 101| if(sign() == y_sign) { ------------------ | Branch (37:7): [True: 0, False: 101] ------------------ 38| 0| const word carry = bigint_add2(mutable_data(), size() - 1, y, y_words); 39| 0| mutable_data()[size() - 1] += carry; 40| 101| } else { 41| 101| const int32_t relative_size = bigint_cmp(_data(), x_sw, y, y_words); 42| | 43| 101| if(relative_size >= 0) { ------------------ | Branch (43:10): [True: 101, False: 0] ------------------ 44| | // *this >= y 45| 101| bigint_sub2(mutable_data(), x_sw, y, y_words); 46| 101| } else { 47| | // *this < y: compute *this = y - *this 48| 0| bigint_sub2_rev(mutable_data(), y, y_words); 49| 0| } 50| | 51| 101| if(relative_size < 0) { ------------------ | Branch (51:10): [True: 0, False: 101] ------------------ 52| 0| set_sign(y_sign); 53| 101| } else if(relative_size == 0) { ------------------ | Branch (53:17): [True: 0, False: 101] ------------------ 54| 0| set_sign(Positive); 55| 0| } 56| 101| } 57| | 58| 101| return (*this); 59| 101|} _ZN5Botan6BigIntlSEm: 269| 3|BigInt& BigInt::operator<<=(size_t shift) { 270| 3| if(shift >= 65536) { ------------------ | Branch (270:7): [True: 0, False: 3] ------------------ 271| 0| throw Invalid_Argument("BigInt left shift count too large"); 272| 0| } 273| | 274| 3| const size_t sw = sig_words(); 275| 3| const size_t new_size = sw + (shift + WordInfo::bits - 1) / WordInfo::bits; 276| | 277| 3| m_data.grow_to(new_size); 278| | 279| 3| bigint_shl1(m_data.mutable_data(), new_size, sw, shift); 280| | 281| 3| return (*this); 282| 3|} _ZN5Botan6BigIntrSEm: 287| 129|BigInt& BigInt::operator>>=(size_t shift) { 288| 129| bigint_shr1(m_data.mutable_data(), m_data.size(), shift); 289| | 290| 129| if(sig_words() == 0 && m_signedness == Negative) { ------------------ | Branch (290:7): [True: 0, False: 129] | Branch (290:27): [True: 0, False: 0] ------------------ 291| 0| m_signedness = Positive; 292| 0| } 293| | 294| 129| return (*this); 295| 129|} _ZN5Botan6BigInt4add2ERKS0_PKmmNS0_4SignE: 20| 18|BigInt BigInt::add2(const BigInt& x, const word y[], size_t y_size, BigInt::Sign y_sign) { 21| 18| const size_t x_sw = x.sig_words(); 22| | 23| 18| BigInt z = BigInt::with_capacity(std::max(x_sw, y_size) + 1); 24| | 25| 18| if(x.sign() == y_sign) { ------------------ | Branch (25:7): [True: 12, False: 6] ------------------ 26| 12| const word carry = bigint_add3(z.mutable_data(), x._data(), x_sw, y, y_size); 27| 12| z.mutable_data()[std::max(x_sw, y_size)] += carry; 28| 12| z.set_sign(x.sign()); 29| 12| } else { 30| 6| const int32_t relative_size = bigint_cmp(x.data(), x_sw, y, y_size); 31| | 32| 6| if(relative_size < 0) { ------------------ | Branch (32:10): [True: 0, False: 6] ------------------ 33| | // x < y so z = abs(y - x) 34| | // NOLINTNEXTLINE(*-suspicious-call-argument) intentionally swapping x and y here 35| 0| bigint_sub3(z.mutable_data(), y, y_size, x.data(), x_sw); 36| 0| z.set_sign(y_sign); 37| 6| } else if(relative_size == 0) { ------------------ | Branch (37:17): [True: 0, False: 6] ------------------ 38| | // Positive zero (nothing to do in this case) 39| 6| } else { 40| | /* 41| | * We know at this point that x >= y so if y_size is larger than 42| | * x_sw, we are guaranteed they are just leading zeros which can 43| | * be ignored 44| | */ 45| 6| y_size = std::min(x_sw, y_size); 46| 6| bigint_sub3(z.mutable_data(), x.data(), x_sw, y, y_size); 47| 6| z.set_sign(x.sign()); 48| 6| } 49| 6| } 50| | 51| 18| return z; 52| 18|} _ZN5BotanmlERKNS_6BigIntEm: 90| 84|BigInt operator*(const BigInt& x, word y) { 91| 84| const size_t x_sw = x.sig_words(); 92| | 93| 84| BigInt z = BigInt::with_capacity(x_sw + 1); 94| | 95| 84| if(x_sw > 0 && y > 0) { ------------------ | Branch (95:7): [True: 84, False: 0] | Branch (95:19): [True: 84, False: 0] ------------------ 96| 84| bigint_linmul3(z.mutable_data(), x._data(), x_sw, y); 97| 84| z.set_sign(x.sign()); 98| 84| } 99| | 100| 84| return z; 101| 84|} _ZN5BotanlsERKNS_6BigIntEm: 188| 18|BigInt operator<<(const BigInt& x, size_t shift) { 189| 18| if(shift >= 65536) { ------------------ | Branch (189:7): [True: 0, False: 18] ------------------ 190| 0| throw Invalid_Argument("BigInt left shift count too large"); 191| 0| } 192| | 193| 18| if(x.is_zero()) { ------------------ | Branch (193:7): [True: 0, False: 18] ------------------ 194| 0| return BigInt::zero(); 195| 0| } 196| | 197| 18| const size_t x_sw = x.sig_words(); 198| | 199| 18| const size_t new_size = x_sw + shift / WordInfo::bits + 1; 200| 18| BigInt y = BigInt::with_capacity(new_size); 201| 18| bigint_shl2(y.mutable_data(), new_size, x._data(), x_sw, shift); 202| 18| y.set_sign(x.sign()); 203| 18| return y; 204| 18|} _ZN5Botan6BigIntC2Em: 20| 10.3k|BigInt::BigInt(uint64_t n) { 21| 10.3k| if constexpr(sizeof(word) == 8) { 22| 10.3k| m_data.set_word_at(0, static_cast(n)); 23| | } else { 24| | m_data.set_word_at(1, static_cast(n >> 32)); 25| | m_data.set_word_at(0, static_cast(n)); 26| | } 27| 10.3k|} _ZN5Botan6BigInt8from_u64Em: 30| 10.3k|BigInt BigInt::from_u64(uint64_t n) { 31| 10.3k| return BigInt(n); 32| 10.3k|} _ZN5Botan6BigInt13with_capacityEm: 51| 132|BigInt BigInt::with_capacity(size_t size) { 52| 132| BigInt bn; 53| 132| bn.grow_to(size); 54| 132| return bn; 55| 132|} _ZN5Botan6BigInt11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 57| 36|BigInt BigInt::from_string(std::string_view str) { 58| 36| size_t prefix_bytes = 0; 59| 36| bool negative = false; 60| 36| size_t radix = 10; 61| | 62| 36| if(!str.empty() && str[0] == '-') { ------------------ | Branch (62:7): [True: 36, False: 0] | Branch (62:23): [True: 0, False: 36] ------------------ 63| 0| prefix_bytes += 1; 64| 0| negative = true; 65| 0| } 66| | 67| 36| if(str.length() > prefix_bytes + 2 && str[prefix_bytes] == '0' && str[prefix_bytes + 1] == 'x') { ------------------ | Branch (67:7): [True: 36, False: 0] | Branch (67:42): [True: 36, False: 0] | Branch (67:70): [True: 36, False: 0] ------------------ 68| 36| prefix_bytes += 2; 69| 36| radix = 16; 70| 36| } 71| | 72| 36| BigInt r = BigInt::from_radix_digits(str.substr(prefix_bytes), radix); 73| | 74| 36| if(negative) { ------------------ | Branch (74:7): [True: 0, False: 36] ------------------ 75| 0| r.set_sign(Negative); 76| 36| } else { 77| 36| r.set_sign(Positive); 78| 36| } 79| | 80| 36| return r; 81| 36|} _ZN5Botan6BigInt10from_bytesENSt3__14spanIKhLm18446744073709551615EEE: 83| 29.9k|BigInt BigInt::from_bytes(std::span input) { 84| 29.9k| BigInt r; 85| 29.9k| r.assign_from_bytes(input); 86| 29.9k| return r; 87| 29.9k|} _ZNK5Botan6BigInt7byte_atEm: 118| 74.9k|uint8_t BigInt::byte_at(size_t n) const { 119| 74.9k| return get_byte_var(sizeof(word) - (n % sizeof(word)) - 1, word_at(n / sizeof(word))); 120| 74.9k|} _ZNK5Botan6BigInt8cmp_wordEm: 122| 37.6k|int32_t BigInt::cmp_word(word other) const { 123| 37.6k| if(signum() < 0) { ------------------ | Branch (123:7): [True: 23, False: 37.6k] ------------------ 124| 23| return -1; // other is positive ... 125| 23| } 126| | 127| 37.6k| const size_t sw = this->sig_words(); 128| 37.6k| if(sw > 1) { ------------------ | Branch (128:7): [True: 27.2k, False: 10.4k] ------------------ 129| 27.2k| return 1; // must be larger since other is just one word ... 130| 27.2k| } 131| | 132| 10.4k| return bigint_cmp(this->_data(), sw, &other, 1); 133| 37.6k|} _ZNK5Botan6BigInt3cmpERKS0_b: 138| 21.0k|int32_t BigInt::cmp(const BigInt& other, bool check_signs) const { 139| 21.0k| if(check_signs) { ------------------ | Branch (139:7): [True: 21.0k, False: 0] ------------------ 140| 21.0k| if(other.signum() >= 0 && this->signum() < 0) { ------------------ | Branch (140:10): [True: 21.0k, False: 0] | Branch (140:33): [True: 0, False: 21.0k] ------------------ 141| 0| return -1; 142| 0| } 143| | 144| 21.0k| if(other.signum() < 0 && this->signum() >= 0) { ------------------ | Branch (144:10): [True: 0, False: 21.0k] | Branch (144:32): [True: 0, False: 0] ------------------ 145| 0| return 1; 146| 0| } 147| | 148| 21.0k| if(other.signum() < 0 && this->signum() < 0) { ------------------ | Branch (148:10): [True: 0, False: 21.0k] | Branch (148:32): [True: 0, False: 0] ------------------ 149| 0| return (-bigint_cmp(this->_data(), this->size(), other._data(), other.size())); 150| 0| } 151| 21.0k| } 152| | 153| 21.0k| return bigint_cmp(this->_data(), this->size(), other._data(), other.size()); 154| 21.0k|} _ZNK5Botan6BigInt8is_equalERKS0_: 156| 12|bool BigInt::is_equal(const BigInt& other) const { 157| 12| if(this->sign() != other.sign()) { ------------------ | Branch (157:7): [True: 0, False: 12] ------------------ 158| 0| return false; 159| 0| } 160| | 161| 12| return bigint_ct_is_eq(this->_data(), this->size(), other._data(), other.size()).as_bool(); 162| 12|} _ZNK5Botan6BigInt12is_less_thanERKS0_: 164| 6|bool BigInt::is_less_than(const BigInt& other) const { 165| 6| if(this->signum() < 0 && other.signum() >= 0) { ------------------ | Branch (165:7): [True: 0, False: 6] | Branch (165:29): [True: 0, False: 0] ------------------ 166| 0| return true; 167| 0| } 168| | 169| 6| if(this->signum() >= 0 && other.signum() < 0) { ------------------ | Branch (169:7): [True: 6, False: 0] | Branch (169:30): [True: 0, False: 6] ------------------ 170| 0| return false; 171| 0| } 172| | 173| 6| if(other.signum() < 0 && this->signum() < 0) { ------------------ | Branch (173:7): [True: 0, False: 6] | Branch (173:29): [True: 0, False: 0] ------------------ 174| 0| return bigint_ct_is_lt(other._data(), other.size(), this->_data(), this->size()).as_bool(); 175| 0| } 176| | 177| 6| return bigint_ct_is_lt(this->_data(), this->size(), other._data(), other.size()).as_bool(); 178| 6|} _ZN5Botan6BigInt4Data11set_to_zeroEv: 191| 54.9k|void BigInt::Data::set_to_zero() { 192| 54.9k| m_reg.resize(m_reg.capacity()); 193| 54.9k| clear_mem(m_reg.data(), m_reg.size()); 194| 54.9k| m_sig_words = 0; 195| 54.9k|} _ZNK5Botan6BigInt4Data14calc_sig_wordsEv: 215| 56.8k|size_t BigInt::Data::calc_sig_words() const { 216| 56.8k| const size_t sz = m_reg.size(); 217| 56.8k| size_t sig = sz; 218| | 219| 56.8k| word sub = 1; 220| | 221| 528k| for(size_t i = 0; i != sz; ++i) { ------------------ | Branch (221:22): [True: 471k, False: 56.8k] ------------------ 222| 471k| const word w = m_reg[sz - i - 1]; 223| 471k| sub &= ct_is_zero(w); 224| 471k| sig -= sub; 225| 471k| } 226| | 227| | /* 228| | * This depends on the data so is poisoned, but unpoison it here as 229| | * later conditionals are made on the size. 230| | */ 231| 56.8k| CT::unpoison(sig); 232| | 233| 56.8k| return sig; 234| 56.8k|} _ZNK5Botan6BigInt5bytesEv: 294| 33.3k|size_t BigInt::bytes() const { 295| 33.3k| return round_up(bits(), 8) / 8; 296| 33.3k|} _ZNK5Botan6BigInt13top_bits_freeEv: 298| 45.8k|size_t BigInt::top_bits_free() const { 299| 45.8k| const size_t words = sig_words(); 300| | 301| 45.8k| const word top_word = word_at(words - 1); 302| 45.8k| const size_t bits_used = high_bit(CT::value_barrier(top_word)); 303| 45.8k| CT::unpoison(bits_used); 304| 45.8k| return WordInfo::bits - bits_used; 305| 45.8k|} _ZNK5Botan6BigInt4bitsEv: 307| 52.0k|size_t BigInt::bits() const { 308| 52.0k| const size_t words = sig_words(); 309| | 310| 52.0k| if(words == 0) { ------------------ | Branch (310:7): [True: 6.24k, False: 45.8k] ------------------ 311| 6.24k| return 0; 312| 6.24k| } 313| | 314| 45.8k| const size_t full_words = (words - 1) * WordInfo::bits; 315| 45.8k| const size_t top_bits = WordInfo::bits - top_bits_free(); 316| | 317| 45.8k| return full_words + top_bits; 318| 52.0k|} _ZN5Botan6BigInt12reduce_belowERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 329| 18|size_t BigInt::reduce_below(const BigInt& p, secure_vector& ws) { 330| 18| if(p.signum() < 0 || this->signum() < 0) { ------------------ | Branch (330:7): [True: 0, False: 18] | Branch (330:25): [True: 0, False: 18] ------------------ 331| 0| throw Invalid_Argument("BigInt::reduce_below both values must be positive"); 332| 0| } 333| | 334| 18| const size_t p_words = p.sig_words(); 335| | 336| 18| if(size() < p_words + 1) { ------------------ | Branch (336:7): [True: 0, False: 18] ------------------ 337| 0| grow_to(p_words + 1); 338| 0| } 339| | 340| 18| if(ws.size() < p_words + 1) { ------------------ | Branch (340:7): [True: 18, False: 0] ------------------ 341| 18| ws.resize(p_words + 1); 342| 18| } 343| | 344| 18| clear_mem(ws.data(), ws.size()); 345| | 346| 18| size_t reductions = 0; 347| | 348| 18| for(;;) { 349| 18| const word borrow = bigint_sub3(ws.data(), _data(), p_words + 1, p._data(), p_words); 350| 18| if(borrow > 0) { ------------------ | Branch (350:10): [True: 18, False: 0] ------------------ 351| 18| break; 352| 18| } 353| | 354| 0| ++reductions; 355| 0| swap_reg(ws); 356| 0| } 357| | 358| 18| return reductions; 359| 18|} _ZNK5Botan6BigInt12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 395| 16.6k|void BigInt::serialize_to(std::span output) const { 396| 16.6k| BOTAN_ARG_CHECK(this->bytes() <= output.size(), "Insufficient output space"); ------------------ | | 35| 16.6k| do { \ | | 36| 16.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 16.6k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 16.6k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 16.6k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 16.6k] | | ------------------ ------------------ 397| | 398| 16.6k| this->binary_encode(output.data(), output.size()); 399| 16.6k|} _ZNK5Botan6BigInt13binary_encodeEPhm: 404| 16.6k|void BigInt::binary_encode(uint8_t output[], size_t len) const { 405| 16.6k| const size_t full_words = len / sizeof(word); 406| 16.6k| const size_t extra_bytes = len % sizeof(word); 407| | 408| 29.1k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (408:22): [True: 12.4k, False: 16.6k] ------------------ 409| 12.4k| const word w = word_at(i); 410| 12.4k| store_be(w, output + (len - (i + 1) * sizeof(word))); 411| 12.4k| } 412| | 413| 16.6k| if(extra_bytes > 0) { ------------------ | Branch (413:7): [True: 16.6k, False: 0] ------------------ 414| 16.6k| const word w = word_at(full_words); 415| | 416| 43.8k| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (416:25): [True: 27.1k, False: 16.6k] ------------------ 417| 27.1k| output[extra_bytes - i - 1] = get_byte_var(sizeof(word) - i - 1, w); 418| 27.1k| } 419| 16.6k| } 420| 16.6k|} _ZN5Botan6BigInt17assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE: 425| 54.9k|void BigInt::assign_from_bytes(std::span bytes) { 426| 54.9k| clear(); 427| | 428| 54.9k| const size_t length = bytes.size(); 429| 54.9k| const size_t full_words = length / sizeof(word); 430| 54.9k| const size_t extra_bytes = length % sizeof(word); 431| | 432| 54.9k| secure_vector reg((round_up(full_words + (extra_bytes > 0 ? 1 : 0), 8))); ------------------ | Branch (432:52): [True: 27.0k, False: 27.8k] ------------------ 433| | 434| 207k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (434:22): [True: 152k, False: 54.9k] ------------------ 435| 152k| reg[i] = load_be(bytes.last()); 436| 152k| bytes = bytes.first(bytes.size() - sizeof(word)); 437| 152k| } 438| | 439| 54.9k| if(!bytes.empty()) { ------------------ | Branch (439:7): [True: 27.0k, False: 27.8k] ------------------ 440| 27.0k| BOTAN_ASSERT_NOMSG(extra_bytes == bytes.size()); ------------------ | | 77| 27.0k| do { \ | | 78| 27.0k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 27.0k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 27.0k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 27.0k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 27.0k] | | ------------------ ------------------ 441| 27.0k| std::array last_partial_word = {0}; 442| 27.0k| copy_mem(std::span{last_partial_word}.last(extra_bytes), bytes); 443| 27.0k| reg[full_words] = load_be(last_partial_word); 444| 27.0k| } 445| | 446| 54.9k| m_data.swap(reg); 447| 54.9k|} _ZNK5Botan6BigInt20_const_time_unpoisonEv: 559| 153k|void BigInt::_const_time_unpoison() const { 560| 153k| CT::unpoison(m_data.const_data(), m_data.size()); 561| 153k|} _ZN5Botan20vartime_divide_pow2kEmRKNS_6BigIntE: 232| 18|BigInt vartime_divide_pow2k(size_t k, const BigInt& y_arg) { 233| 18| constexpr size_t WB = WordInfo::bits; 234| | 235| 18| BOTAN_ARG_CHECK(y_arg.signum() != 0, "Cannot divide by zero"); ------------------ | | 35| 18| do { \ | | 36| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18] | | ------------------ ------------------ 236| 18| BOTAN_ARG_CHECK(y_arg.signum() >= 0, "Negative divisor not supported"); ------------------ | | 35| 18| do { \ | | 36| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18] | | ------------------ ------------------ 237| 18| BOTAN_ARG_CHECK(k > 1, "Invalid k"); ------------------ | | 35| 18| do { \ | | 36| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18] | | ------------------ ------------------ 238| | 239| 18| BigInt y = y_arg; 240| | 241| 18| const size_t y_words = y.sig_words(); 242| | 243| 18| BOTAN_ASSERT_NOMSG(y_words > 0); ------------------ | | 77| 18| do { \ | | 78| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 18| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 18] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 18| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 18] | | ------------------ ------------------ 244| | 245| | // Calculate shifts needed to normalize y with high bit set 246| 18| const size_t shifts = y.top_bits_free(); 247| | 248| 18| if(shifts > 0) { ------------------ | Branch (248:7): [True: 3, False: 15] ------------------ 249| 3| y <<= shifts; 250| 3| } 251| | 252| 18| BigInt r; 253| 18| r.set_bit(k + shifts); // (2^k) << shifts 254| | 255| | // we know y has not changed size, since we only shifted up to set high bit 256| 18| const size_t t = y_words - 1; 257| 18| const size_t n = std::max(y_words, r.sig_words()) - 1; 258| | 259| 18| BOTAN_ASSERT_NOMSG(n >= t); ------------------ | | 77| 18| do { \ | | 78| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 18| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 18] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 18| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 18] | | ------------------ ------------------ 260| | 261| 18| BigInt q = BigInt::zero(); 262| 18| q.grow_to(n - t + 1); 263| | 264| 18| word* q_words = q.mutable_data(); 265| | 266| 18| BigInt shifted_y = y << (WB * (n - t)); 267| | 268| | // Set q_{n-t} to number of times r > shifted_y 269| 18| secure_vector ws; 270| 18| q_words[n - t] = r.reduce_below(shifted_y, ws); 271| | 272| 18| const word y_t0 = y.word_at(t); 273| 18| const word y_t1 = y.word_at(t - 1); 274| 18| BOTAN_DEBUG_ASSERT((y_t0 >> (WB - 1)) == 1); ------------------ | | 130| 18| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 18| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 18] | | ------------------ ------------------ 275| | 276| 18| const divide_precomp div_y_t0(y_t0); 277| | 278| 147| for(size_t i = n; i != t; --i) { ------------------ | Branch (278:22): [True: 129, False: 18] ------------------ 279| 129| const word x_i0 = r.word_at(i); 280| 129| const word x_i1 = r.word_at(i - 1); 281| 129| const word x_i2 = r.word_at(i - 2); 282| | 283| 129| word qit = (x_i0 == y_t0) ? WordInfo::max : div_y_t0.vartime_div_2to1(x_i0, x_i1); ------------------ | Branch (283:18): [True: 0, False: 129] ------------------ 284| | 285| | // Per HAC 14.23, this operation is required at most twice 286| 141| for(size_t j = 0; j != 2; ++j) { ------------------ | Branch (286:25): [True: 141, False: 0] ------------------ 287| 141| if(division_check_vartime(qit, y_t0, y_t1, x_i0, x_i1, x_i2)) { ------------------ | Branch (287:13): [True: 12, False: 129] ------------------ 288| 12| BOTAN_ASSERT_NOMSG(qit > 0); ------------------ | | 77| 12| do { \ | | 78| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 12| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 12] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 12| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 12] | | ------------------ ------------------ 289| 12| qit--; 290| 129| } else { 291| 129| break; 292| 129| } 293| 141| } 294| | 295| 129| shifted_y >>= WB; 296| | // Now shifted_y == y << (WB * (i-t-1)) 297| | 298| | /* 299| | * Special case qit == 0 and qit == 1 which occurs relatively often here due to a 300| | * combination of the fixed 2^k and in many cases the typical structure of 301| | * public moduli (as this function is called by Barrett_Reduction::for_public_modulus). 302| | * 303| | * Over the test suite, about 5% of loop iterations have qit == 1 and 10% have qit == 0 304| | */ 305| | 306| 129| if(qit != 0) { ------------------ | Branch (306:10): [True: 101, False: 28] ------------------ 307| 101| if(qit == 1) { ------------------ | Branch (307:13): [True: 17, False: 84] ------------------ 308| 17| r -= shifted_y; 309| 84| } else { 310| 84| r -= qit * shifted_y; 311| 84| } 312| | 313| 101| if(r.signum() < 0) { ------------------ | Branch (313:13): [True: 0, False: 101] ------------------ 314| 0| BOTAN_ASSERT_NOMSG(qit > 0); ------------------ | | 77| 0| do { \ | | 78| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 0| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 0| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 0] | | ------------------ ------------------ 315| 0| qit--; 316| 0| r += shifted_y; 317| 0| BOTAN_ASSERT_NOMSG(r.signum() >= 0); ------------------ | | 77| 0| do { \ | | 78| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 0| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 0| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 0] | | ------------------ ------------------ 318| 0| } 319| 101| } 320| | 321| 129| q_words[i - t - 1] = qit; 322| 129| } 323| | 324| 18| return q; 325| 18|} divide.cpp:_ZN5Botan12_GLOBAL__N_122division_check_vartimeEmmmmmm: 34| 141|inline bool division_check_vartime(word q, word y2, word y1, word x3, word x2, word x1) { 35| | /* 36| | Compute (y3,y2,y1) = (y2,y1) * q 37| | and return true if (y3,y2,y1) > (x3,x2,x1) 38| | */ 39| | 40| 141| word y3 = 0; 41| 141| y1 = word_madd2(q, y1, &y3); 42| 141| y2 = word_madd2(q, y2, &y3); 43| | 44| 141| if(x3 != y3) { ------------------ | Branch (44:7): [True: 62, False: 79] ------------------ 45| 62| return (y3 > x3); 46| 62| } 47| 79| if(x2 != y2) { ------------------ | Branch (47:7): [True: 57, False: 22] ------------------ 48| 57| return (y2 > x2); 49| 57| } 50| 22| return (y1 > x1); 51| 79|} _ZN5Botan17bigint_comba_sqr4EPmPKm: 17| 2.19M|void bigint_comba_sqr4(word z[8], const word x[4]) { 18| 2.19M| word3 accum; 19| | 20| 2.19M| accum.mul(x[0], x[0]); 21| 2.19M| z[0] = accum.extract(); 22| 2.19M| accum.mul_x2(x[0], x[1]); 23| 2.19M| z[1] = accum.extract(); 24| 2.19M| accum.mul_x2(x[0], x[2]); 25| 2.19M| accum.mul(x[1], x[1]); 26| 2.19M| z[2] = accum.extract(); 27| 2.19M| accum.mul_x2(x[0], x[3]); 28| 2.19M| accum.mul_x2(x[1], x[2]); 29| 2.19M| z[3] = accum.extract(); 30| 2.19M| accum.mul_x2(x[1], x[3]); 31| 2.19M| accum.mul(x[2], x[2]); 32| 2.19M| z[4] = accum.extract(); 33| 2.19M| accum.mul_x2(x[2], x[3]); 34| 2.19M| z[5] = accum.extract(); 35| 2.19M| accum.mul(x[3], x[3]); 36| 2.19M| z[6] = accum.extract(); 37| 2.19M| z[7] = accum.extract(); 38| 2.19M|} _ZN5Botan17bigint_comba_mul4EPmPKmS2_: 43| 2.00M|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) { 44| 2.00M| word3 accum; 45| | 46| 2.00M| accum.mul(x[0], y[0]); 47| 2.00M| z[0] = accum.extract(); 48| 2.00M| accum.mul(x[0], y[1]); 49| 2.00M| accum.mul(x[1], y[0]); 50| 2.00M| z[1] = accum.extract(); 51| 2.00M| accum.mul(x[0], y[2]); 52| 2.00M| accum.mul(x[1], y[1]); 53| 2.00M| accum.mul(x[2], y[0]); 54| 2.00M| z[2] = accum.extract(); 55| 2.00M| accum.mul(x[0], y[3]); 56| 2.00M| accum.mul(x[1], y[2]); 57| 2.00M| accum.mul(x[2], y[1]); 58| 2.00M| accum.mul(x[3], y[0]); 59| 2.00M| z[3] = accum.extract(); 60| 2.00M| accum.mul(x[1], y[3]); 61| 2.00M| accum.mul(x[2], y[2]); 62| 2.00M| accum.mul(x[3], y[1]); 63| 2.00M| z[4] = accum.extract(); 64| 2.00M| accum.mul(x[2], y[3]); 65| 2.00M| accum.mul(x[3], y[2]); 66| 2.00M| z[5] = accum.extract(); 67| 2.00M| accum.mul(x[3], y[3]); 68| 2.00M| z[6] = accum.extract(); 69| 2.00M| z[7] = accum.extract(); 70| 2.00M|} _ZN5Botan17bigint_comba_sqr6EPmPKm: 75| 1.60M|void bigint_comba_sqr6(word z[12], const word x[6]) { 76| 1.60M| word3 accum; 77| | 78| 1.60M| accum.mul(x[0], x[0]); 79| 1.60M| z[0] = accum.extract(); 80| 1.60M| accum.mul_x2(x[0], x[1]); 81| 1.60M| z[1] = accum.extract(); 82| 1.60M| accum.mul_x2(x[0], x[2]); 83| 1.60M| accum.mul(x[1], x[1]); 84| 1.60M| z[2] = accum.extract(); 85| 1.60M| accum.mul_x2(x[0], x[3]); 86| 1.60M| accum.mul_x2(x[1], x[2]); 87| 1.60M| z[3] = accum.extract(); 88| 1.60M| accum.mul_x2(x[0], x[4]); 89| 1.60M| accum.mul_x2(x[1], x[3]); 90| 1.60M| accum.mul(x[2], x[2]); 91| 1.60M| z[4] = accum.extract(); 92| 1.60M| accum.mul_x2(x[0], x[5]); 93| 1.60M| accum.mul_x2(x[1], x[4]); 94| 1.60M| accum.mul_x2(x[2], x[3]); 95| 1.60M| z[5] = accum.extract(); 96| 1.60M| accum.mul_x2(x[1], x[5]); 97| 1.60M| accum.mul_x2(x[2], x[4]); 98| 1.60M| accum.mul(x[3], x[3]); 99| 1.60M| z[6] = accum.extract(); 100| 1.60M| accum.mul_x2(x[2], x[5]); 101| 1.60M| accum.mul_x2(x[3], x[4]); 102| 1.60M| z[7] = accum.extract(); 103| 1.60M| accum.mul_x2(x[3], x[5]); 104| 1.60M| accum.mul(x[4], x[4]); 105| 1.60M| z[8] = accum.extract(); 106| 1.60M| accum.mul_x2(x[4], x[5]); 107| 1.60M| z[9] = accum.extract(); 108| 1.60M| accum.mul(x[5], x[5]); 109| 1.60M| z[10] = accum.extract(); 110| 1.60M| z[11] = accum.extract(); 111| 1.60M|} _ZN5Botan17bigint_comba_mul6EPmPKmS2_: 116| 1.40M|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) { 117| 1.40M| word3 accum; 118| | 119| 1.40M| accum.mul(x[0], y[0]); 120| 1.40M| z[0] = accum.extract(); 121| 1.40M| accum.mul(x[0], y[1]); 122| 1.40M| accum.mul(x[1], y[0]); 123| 1.40M| z[1] = accum.extract(); 124| 1.40M| accum.mul(x[0], y[2]); 125| 1.40M| accum.mul(x[1], y[1]); 126| 1.40M| accum.mul(x[2], y[0]); 127| 1.40M| z[2] = accum.extract(); 128| 1.40M| accum.mul(x[0], y[3]); 129| 1.40M| accum.mul(x[1], y[2]); 130| 1.40M| accum.mul(x[2], y[1]); 131| 1.40M| accum.mul(x[3], y[0]); 132| 1.40M| z[3] = accum.extract(); 133| 1.40M| accum.mul(x[0], y[4]); 134| 1.40M| accum.mul(x[1], y[3]); 135| 1.40M| accum.mul(x[2], y[2]); 136| 1.40M| accum.mul(x[3], y[1]); 137| 1.40M| accum.mul(x[4], y[0]); 138| 1.40M| z[4] = accum.extract(); 139| 1.40M| accum.mul(x[0], y[5]); 140| 1.40M| accum.mul(x[1], y[4]); 141| 1.40M| accum.mul(x[2], y[3]); 142| 1.40M| accum.mul(x[3], y[2]); 143| 1.40M| accum.mul(x[4], y[1]); 144| 1.40M| accum.mul(x[5], y[0]); 145| 1.40M| z[5] = accum.extract(); 146| 1.40M| accum.mul(x[1], y[5]); 147| 1.40M| accum.mul(x[2], y[4]); 148| 1.40M| accum.mul(x[3], y[3]); 149| 1.40M| accum.mul(x[4], y[2]); 150| 1.40M| accum.mul(x[5], y[1]); 151| 1.40M| z[6] = accum.extract(); 152| 1.40M| accum.mul(x[2], y[5]); 153| 1.40M| accum.mul(x[3], y[4]); 154| 1.40M| accum.mul(x[4], y[3]); 155| 1.40M| accum.mul(x[5], y[2]); 156| 1.40M| z[7] = accum.extract(); 157| 1.40M| accum.mul(x[3], y[5]); 158| 1.40M| accum.mul(x[4], y[4]); 159| 1.40M| accum.mul(x[5], y[3]); 160| 1.40M| z[8] = accum.extract(); 161| 1.40M| accum.mul(x[4], y[5]); 162| 1.40M| accum.mul(x[5], y[4]); 163| 1.40M| z[9] = accum.extract(); 164| 1.40M| accum.mul(x[5], y[5]); 165| 1.40M| z[10] = accum.extract(); 166| 1.40M| z[11] = accum.extract(); 167| 1.40M|} _ZN5Botan17bigint_comba_sqr7EPmPKm: 172| 33.5k|void bigint_comba_sqr7(word z[14], const word x[7]) { 173| 33.5k| word3 accum; 174| | 175| 33.5k| accum.mul(x[0], x[0]); 176| 33.5k| z[0] = accum.extract(); 177| 33.5k| accum.mul_x2(x[0], x[1]); 178| 33.5k| z[1] = accum.extract(); 179| 33.5k| accum.mul_x2(x[0], x[2]); 180| 33.5k| accum.mul(x[1], x[1]); 181| 33.5k| z[2] = accum.extract(); 182| 33.5k| accum.mul_x2(x[0], x[3]); 183| 33.5k| accum.mul_x2(x[1], x[2]); 184| 33.5k| z[3] = accum.extract(); 185| 33.5k| accum.mul_x2(x[0], x[4]); 186| 33.5k| accum.mul_x2(x[1], x[3]); 187| 33.5k| accum.mul(x[2], x[2]); 188| 33.5k| z[4] = accum.extract(); 189| 33.5k| accum.mul_x2(x[0], x[5]); 190| 33.5k| accum.mul_x2(x[1], x[4]); 191| 33.5k| accum.mul_x2(x[2], x[3]); 192| 33.5k| z[5] = accum.extract(); 193| 33.5k| accum.mul_x2(x[0], x[6]); 194| 33.5k| accum.mul_x2(x[1], x[5]); 195| 33.5k| accum.mul_x2(x[2], x[4]); 196| 33.5k| accum.mul(x[3], x[3]); 197| 33.5k| z[6] = accum.extract(); 198| 33.5k| accum.mul_x2(x[1], x[6]); 199| 33.5k| accum.mul_x2(x[2], x[5]); 200| 33.5k| accum.mul_x2(x[3], x[4]); 201| 33.5k| z[7] = accum.extract(); 202| 33.5k| accum.mul_x2(x[2], x[6]); 203| 33.5k| accum.mul_x2(x[3], x[5]); 204| 33.5k| accum.mul(x[4], x[4]); 205| 33.5k| z[8] = accum.extract(); 206| 33.5k| accum.mul_x2(x[3], x[6]); 207| 33.5k| accum.mul_x2(x[4], x[5]); 208| 33.5k| z[9] = accum.extract(); 209| 33.5k| accum.mul_x2(x[4], x[6]); 210| 33.5k| accum.mul(x[5], x[5]); 211| 33.5k| z[10] = accum.extract(); 212| 33.5k| accum.mul_x2(x[5], x[6]); 213| 33.5k| z[11] = accum.extract(); 214| 33.5k| accum.mul(x[6], x[6]); 215| 33.5k| z[12] = accum.extract(); 216| 33.5k| z[13] = accum.extract(); 217| 33.5k|} _ZN5Botan17bigint_comba_mul7EPmPKmS2_: 222| 33.8k|void bigint_comba_mul7(word z[14], const word x[7], const word y[7]) { 223| 33.8k| word3 accum; 224| | 225| 33.8k| accum.mul(x[0], y[0]); 226| 33.8k| z[0] = accum.extract(); 227| 33.8k| accum.mul(x[0], y[1]); 228| 33.8k| accum.mul(x[1], y[0]); 229| 33.8k| z[1] = accum.extract(); 230| 33.8k| accum.mul(x[0], y[2]); 231| 33.8k| accum.mul(x[1], y[1]); 232| 33.8k| accum.mul(x[2], y[0]); 233| 33.8k| z[2] = accum.extract(); 234| 33.8k| accum.mul(x[0], y[3]); 235| 33.8k| accum.mul(x[1], y[2]); 236| 33.8k| accum.mul(x[2], y[1]); 237| 33.8k| accum.mul(x[3], y[0]); 238| 33.8k| z[3] = accum.extract(); 239| 33.8k| accum.mul(x[0], y[4]); 240| 33.8k| accum.mul(x[1], y[3]); 241| 33.8k| accum.mul(x[2], y[2]); 242| 33.8k| accum.mul(x[3], y[1]); 243| 33.8k| accum.mul(x[4], y[0]); 244| 33.8k| z[4] = accum.extract(); 245| 33.8k| accum.mul(x[0], y[5]); 246| 33.8k| accum.mul(x[1], y[4]); 247| 33.8k| accum.mul(x[2], y[3]); 248| 33.8k| accum.mul(x[3], y[2]); 249| 33.8k| accum.mul(x[4], y[1]); 250| 33.8k| accum.mul(x[5], y[0]); 251| 33.8k| z[5] = accum.extract(); 252| 33.8k| accum.mul(x[0], y[6]); 253| 33.8k| accum.mul(x[1], y[5]); 254| 33.8k| accum.mul(x[2], y[4]); 255| 33.8k| accum.mul(x[3], y[3]); 256| 33.8k| accum.mul(x[4], y[2]); 257| 33.8k| accum.mul(x[5], y[1]); 258| 33.8k| accum.mul(x[6], y[0]); 259| 33.8k| z[6] = accum.extract(); 260| 33.8k| accum.mul(x[1], y[6]); 261| 33.8k| accum.mul(x[2], y[5]); 262| 33.8k| accum.mul(x[3], y[4]); 263| 33.8k| accum.mul(x[4], y[3]); 264| 33.8k| accum.mul(x[5], y[2]); 265| 33.8k| accum.mul(x[6], y[1]); 266| 33.8k| z[7] = accum.extract(); 267| 33.8k| accum.mul(x[2], y[6]); 268| 33.8k| accum.mul(x[3], y[5]); 269| 33.8k| accum.mul(x[4], y[4]); 270| 33.8k| accum.mul(x[5], y[3]); 271| 33.8k| accum.mul(x[6], y[2]); 272| 33.8k| z[8] = accum.extract(); 273| 33.8k| accum.mul(x[3], y[6]); 274| 33.8k| accum.mul(x[4], y[5]); 275| 33.8k| accum.mul(x[5], y[4]); 276| 33.8k| accum.mul(x[6], y[3]); 277| 33.8k| z[9] = accum.extract(); 278| 33.8k| accum.mul(x[4], y[6]); 279| 33.8k| accum.mul(x[5], y[5]); 280| 33.8k| accum.mul(x[6], y[4]); 281| 33.8k| z[10] = accum.extract(); 282| 33.8k| accum.mul(x[5], y[6]); 283| 33.8k| accum.mul(x[6], y[5]); 284| 33.8k| z[11] = accum.extract(); 285| 33.8k| accum.mul(x[6], y[6]); 286| 33.8k| z[12] = accum.extract(); 287| 33.8k| z[13] = accum.extract(); 288| 33.8k|} _ZN5Botan17bigint_comba_sqr8EPmPKm: 293| 1.43M|void bigint_comba_sqr8(word z[16], const word x[8]) { 294| 1.43M| word3 accum; 295| | 296| 1.43M| accum.mul(x[0], x[0]); 297| 1.43M| z[0] = accum.extract(); 298| 1.43M| accum.mul_x2(x[0], x[1]); 299| 1.43M| z[1] = accum.extract(); 300| 1.43M| accum.mul_x2(x[0], x[2]); 301| 1.43M| accum.mul(x[1], x[1]); 302| 1.43M| z[2] = accum.extract(); 303| 1.43M| accum.mul_x2(x[0], x[3]); 304| 1.43M| accum.mul_x2(x[1], x[2]); 305| 1.43M| z[3] = accum.extract(); 306| 1.43M| accum.mul_x2(x[0], x[4]); 307| 1.43M| accum.mul_x2(x[1], x[3]); 308| 1.43M| accum.mul(x[2], x[2]); 309| 1.43M| z[4] = accum.extract(); 310| 1.43M| accum.mul_x2(x[0], x[5]); 311| 1.43M| accum.mul_x2(x[1], x[4]); 312| 1.43M| accum.mul_x2(x[2], x[3]); 313| 1.43M| z[5] = accum.extract(); 314| 1.43M| accum.mul_x2(x[0], x[6]); 315| 1.43M| accum.mul_x2(x[1], x[5]); 316| 1.43M| accum.mul_x2(x[2], x[4]); 317| 1.43M| accum.mul(x[3], x[3]); 318| 1.43M| z[6] = accum.extract(); 319| 1.43M| accum.mul_x2(x[0], x[7]); 320| 1.43M| accum.mul_x2(x[1], x[6]); 321| 1.43M| accum.mul_x2(x[2], x[5]); 322| 1.43M| accum.mul_x2(x[3], x[4]); 323| 1.43M| z[7] = accum.extract(); 324| 1.43M| accum.mul_x2(x[1], x[7]); 325| 1.43M| accum.mul_x2(x[2], x[6]); 326| 1.43M| accum.mul_x2(x[3], x[5]); 327| 1.43M| accum.mul(x[4], x[4]); 328| 1.43M| z[8] = accum.extract(); 329| 1.43M| accum.mul_x2(x[2], x[7]); 330| 1.43M| accum.mul_x2(x[3], x[6]); 331| 1.43M| accum.mul_x2(x[4], x[5]); 332| 1.43M| z[9] = accum.extract(); 333| 1.43M| accum.mul_x2(x[3], x[7]); 334| 1.43M| accum.mul_x2(x[4], x[6]); 335| 1.43M| accum.mul(x[5], x[5]); 336| 1.43M| z[10] = accum.extract(); 337| 1.43M| accum.mul_x2(x[4], x[7]); 338| 1.43M| accum.mul_x2(x[5], x[6]); 339| 1.43M| z[11] = accum.extract(); 340| 1.43M| accum.mul_x2(x[5], x[7]); 341| 1.43M| accum.mul(x[6], x[6]); 342| 1.43M| z[12] = accum.extract(); 343| 1.43M| accum.mul_x2(x[6], x[7]); 344| 1.43M| z[13] = accum.extract(); 345| 1.43M| accum.mul(x[7], x[7]); 346| 1.43M| z[14] = accum.extract(); 347| 1.43M| z[15] = accum.extract(); 348| 1.43M|} _ZN5Botan17bigint_comba_mul8EPmPKmS2_: 353| 1.30M|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) { 354| 1.30M| word3 accum; 355| | 356| 1.30M| accum.mul(x[0], y[0]); 357| 1.30M| z[0] = accum.extract(); 358| 1.30M| accum.mul(x[0], y[1]); 359| 1.30M| accum.mul(x[1], y[0]); 360| 1.30M| z[1] = accum.extract(); 361| 1.30M| accum.mul(x[0], y[2]); 362| 1.30M| accum.mul(x[1], y[1]); 363| 1.30M| accum.mul(x[2], y[0]); 364| 1.30M| z[2] = accum.extract(); 365| 1.30M| accum.mul(x[0], y[3]); 366| 1.30M| accum.mul(x[1], y[2]); 367| 1.30M| accum.mul(x[2], y[1]); 368| 1.30M| accum.mul(x[3], y[0]); 369| 1.30M| z[3] = accum.extract(); 370| 1.30M| accum.mul(x[0], y[4]); 371| 1.30M| accum.mul(x[1], y[3]); 372| 1.30M| accum.mul(x[2], y[2]); 373| 1.30M| accum.mul(x[3], y[1]); 374| 1.30M| accum.mul(x[4], y[0]); 375| 1.30M| z[4] = accum.extract(); 376| 1.30M| accum.mul(x[0], y[5]); 377| 1.30M| accum.mul(x[1], y[4]); 378| 1.30M| accum.mul(x[2], y[3]); 379| 1.30M| accum.mul(x[3], y[2]); 380| 1.30M| accum.mul(x[4], y[1]); 381| 1.30M| accum.mul(x[5], y[0]); 382| 1.30M| z[5] = accum.extract(); 383| 1.30M| accum.mul(x[0], y[6]); 384| 1.30M| accum.mul(x[1], y[5]); 385| 1.30M| accum.mul(x[2], y[4]); 386| 1.30M| accum.mul(x[3], y[3]); 387| 1.30M| accum.mul(x[4], y[2]); 388| 1.30M| accum.mul(x[5], y[1]); 389| 1.30M| accum.mul(x[6], y[0]); 390| 1.30M| z[6] = accum.extract(); 391| 1.30M| accum.mul(x[0], y[7]); 392| 1.30M| accum.mul(x[1], y[6]); 393| 1.30M| accum.mul(x[2], y[5]); 394| 1.30M| accum.mul(x[3], y[4]); 395| 1.30M| accum.mul(x[4], y[3]); 396| 1.30M| accum.mul(x[5], y[2]); 397| 1.30M| accum.mul(x[6], y[1]); 398| 1.30M| accum.mul(x[7], y[0]); 399| 1.30M| z[7] = accum.extract(); 400| 1.30M| accum.mul(x[1], y[7]); 401| 1.30M| accum.mul(x[2], y[6]); 402| 1.30M| accum.mul(x[3], y[5]); 403| 1.30M| accum.mul(x[4], y[4]); 404| 1.30M| accum.mul(x[5], y[3]); 405| 1.30M| accum.mul(x[6], y[2]); 406| 1.30M| accum.mul(x[7], y[1]); 407| 1.30M| z[8] = accum.extract(); 408| 1.30M| accum.mul(x[2], y[7]); 409| 1.30M| accum.mul(x[3], y[6]); 410| 1.30M| accum.mul(x[4], y[5]); 411| 1.30M| accum.mul(x[5], y[4]); 412| 1.30M| accum.mul(x[6], y[3]); 413| 1.30M| accum.mul(x[7], y[2]); 414| 1.30M| z[9] = accum.extract(); 415| 1.30M| accum.mul(x[3], y[7]); 416| 1.30M| accum.mul(x[4], y[6]); 417| 1.30M| accum.mul(x[5], y[5]); 418| 1.30M| accum.mul(x[6], y[4]); 419| 1.30M| accum.mul(x[7], y[3]); 420| 1.30M| z[10] = accum.extract(); 421| 1.30M| accum.mul(x[4], y[7]); 422| 1.30M| accum.mul(x[5], y[6]); 423| 1.30M| accum.mul(x[6], y[5]); 424| 1.30M| accum.mul(x[7], y[4]); 425| 1.30M| z[11] = accum.extract(); 426| 1.30M| accum.mul(x[5], y[7]); 427| 1.30M| accum.mul(x[6], y[6]); 428| 1.30M| accum.mul(x[7], y[5]); 429| 1.30M| z[12] = accum.extract(); 430| 1.30M| accum.mul(x[6], y[7]); 431| 1.30M| accum.mul(x[7], y[6]); 432| 1.30M| z[13] = accum.extract(); 433| 1.30M| accum.mul(x[7], y[7]); 434| 1.30M| z[14] = accum.extract(); 435| 1.30M| z[15] = accum.extract(); 436| 1.30M|} _ZN5Botan17bigint_comba_sqr9EPmPKm: 441| 1.84M|void bigint_comba_sqr9(word z[18], const word x[9]) { 442| 1.84M| word3 accum; 443| | 444| 1.84M| accum.mul(x[0], x[0]); 445| 1.84M| z[0] = accum.extract(); 446| 1.84M| accum.mul_x2(x[0], x[1]); 447| 1.84M| z[1] = accum.extract(); 448| 1.84M| accum.mul_x2(x[0], x[2]); 449| 1.84M| accum.mul(x[1], x[1]); 450| 1.84M| z[2] = accum.extract(); 451| 1.84M| accum.mul_x2(x[0], x[3]); 452| 1.84M| accum.mul_x2(x[1], x[2]); 453| 1.84M| z[3] = accum.extract(); 454| 1.84M| accum.mul_x2(x[0], x[4]); 455| 1.84M| accum.mul_x2(x[1], x[3]); 456| 1.84M| accum.mul(x[2], x[2]); 457| 1.84M| z[4] = accum.extract(); 458| 1.84M| accum.mul_x2(x[0], x[5]); 459| 1.84M| accum.mul_x2(x[1], x[4]); 460| 1.84M| accum.mul_x2(x[2], x[3]); 461| 1.84M| z[5] = accum.extract(); 462| 1.84M| accum.mul_x2(x[0], x[6]); 463| 1.84M| accum.mul_x2(x[1], x[5]); 464| 1.84M| accum.mul_x2(x[2], x[4]); 465| 1.84M| accum.mul(x[3], x[3]); 466| 1.84M| z[6] = accum.extract(); 467| 1.84M| accum.mul_x2(x[0], x[7]); 468| 1.84M| accum.mul_x2(x[1], x[6]); 469| 1.84M| accum.mul_x2(x[2], x[5]); 470| 1.84M| accum.mul_x2(x[3], x[4]); 471| 1.84M| z[7] = accum.extract(); 472| 1.84M| accum.mul_x2(x[0], x[8]); 473| 1.84M| accum.mul_x2(x[1], x[7]); 474| 1.84M| accum.mul_x2(x[2], x[6]); 475| 1.84M| accum.mul_x2(x[3], x[5]); 476| 1.84M| accum.mul(x[4], x[4]); 477| 1.84M| z[8] = accum.extract(); 478| 1.84M| accum.mul_x2(x[1], x[8]); 479| 1.84M| accum.mul_x2(x[2], x[7]); 480| 1.84M| accum.mul_x2(x[3], x[6]); 481| 1.84M| accum.mul_x2(x[4], x[5]); 482| 1.84M| z[9] = accum.extract(); 483| 1.84M| accum.mul_x2(x[2], x[8]); 484| 1.84M| accum.mul_x2(x[3], x[7]); 485| 1.84M| accum.mul_x2(x[4], x[6]); 486| 1.84M| accum.mul(x[5], x[5]); 487| 1.84M| z[10] = accum.extract(); 488| 1.84M| accum.mul_x2(x[3], x[8]); 489| 1.84M| accum.mul_x2(x[4], x[7]); 490| 1.84M| accum.mul_x2(x[5], x[6]); 491| 1.84M| z[11] = accum.extract(); 492| 1.84M| accum.mul_x2(x[4], x[8]); 493| 1.84M| accum.mul_x2(x[5], x[7]); 494| 1.84M| accum.mul(x[6], x[6]); 495| 1.84M| z[12] = accum.extract(); 496| 1.84M| accum.mul_x2(x[5], x[8]); 497| 1.84M| accum.mul_x2(x[6], x[7]); 498| 1.84M| z[13] = accum.extract(); 499| 1.84M| accum.mul_x2(x[6], x[8]); 500| 1.84M| accum.mul(x[7], x[7]); 501| 1.84M| z[14] = accum.extract(); 502| 1.84M| accum.mul_x2(x[7], x[8]); 503| 1.84M| z[15] = accum.extract(); 504| 1.84M| accum.mul(x[8], x[8]); 505| 1.84M| z[16] = accum.extract(); 506| 1.84M| z[17] = accum.extract(); 507| 1.84M|} _ZN5Botan17bigint_comba_mul9EPmPKmS2_: 512| 1.48M|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) { 513| 1.48M| word3 accum; 514| | 515| 1.48M| accum.mul(x[0], y[0]); 516| 1.48M| z[0] = accum.extract(); 517| 1.48M| accum.mul(x[0], y[1]); 518| 1.48M| accum.mul(x[1], y[0]); 519| 1.48M| z[1] = accum.extract(); 520| 1.48M| accum.mul(x[0], y[2]); 521| 1.48M| accum.mul(x[1], y[1]); 522| 1.48M| accum.mul(x[2], y[0]); 523| 1.48M| z[2] = accum.extract(); 524| 1.48M| accum.mul(x[0], y[3]); 525| 1.48M| accum.mul(x[1], y[2]); 526| 1.48M| accum.mul(x[2], y[1]); 527| 1.48M| accum.mul(x[3], y[0]); 528| 1.48M| z[3] = accum.extract(); 529| 1.48M| accum.mul(x[0], y[4]); 530| 1.48M| accum.mul(x[1], y[3]); 531| 1.48M| accum.mul(x[2], y[2]); 532| 1.48M| accum.mul(x[3], y[1]); 533| 1.48M| accum.mul(x[4], y[0]); 534| 1.48M| z[4] = accum.extract(); 535| 1.48M| accum.mul(x[0], y[5]); 536| 1.48M| accum.mul(x[1], y[4]); 537| 1.48M| accum.mul(x[2], y[3]); 538| 1.48M| accum.mul(x[3], y[2]); 539| 1.48M| accum.mul(x[4], y[1]); 540| 1.48M| accum.mul(x[5], y[0]); 541| 1.48M| z[5] = accum.extract(); 542| 1.48M| accum.mul(x[0], y[6]); 543| 1.48M| accum.mul(x[1], y[5]); 544| 1.48M| accum.mul(x[2], y[4]); 545| 1.48M| accum.mul(x[3], y[3]); 546| 1.48M| accum.mul(x[4], y[2]); 547| 1.48M| accum.mul(x[5], y[1]); 548| 1.48M| accum.mul(x[6], y[0]); 549| 1.48M| z[6] = accum.extract(); 550| 1.48M| accum.mul(x[0], y[7]); 551| 1.48M| accum.mul(x[1], y[6]); 552| 1.48M| accum.mul(x[2], y[5]); 553| 1.48M| accum.mul(x[3], y[4]); 554| 1.48M| accum.mul(x[4], y[3]); 555| 1.48M| accum.mul(x[5], y[2]); 556| 1.48M| accum.mul(x[6], y[1]); 557| 1.48M| accum.mul(x[7], y[0]); 558| 1.48M| z[7] = accum.extract(); 559| 1.48M| accum.mul(x[0], y[8]); 560| 1.48M| accum.mul(x[1], y[7]); 561| 1.48M| accum.mul(x[2], y[6]); 562| 1.48M| accum.mul(x[3], y[5]); 563| 1.48M| accum.mul(x[4], y[4]); 564| 1.48M| accum.mul(x[5], y[3]); 565| 1.48M| accum.mul(x[6], y[2]); 566| 1.48M| accum.mul(x[7], y[1]); 567| 1.48M| accum.mul(x[8], y[0]); 568| 1.48M| z[8] = accum.extract(); 569| 1.48M| accum.mul(x[1], y[8]); 570| 1.48M| accum.mul(x[2], y[7]); 571| 1.48M| accum.mul(x[3], y[6]); 572| 1.48M| accum.mul(x[4], y[5]); 573| 1.48M| accum.mul(x[5], y[4]); 574| 1.48M| accum.mul(x[6], y[3]); 575| 1.48M| accum.mul(x[7], y[2]); 576| 1.48M| accum.mul(x[8], y[1]); 577| 1.48M| z[9] = accum.extract(); 578| 1.48M| accum.mul(x[2], y[8]); 579| 1.48M| accum.mul(x[3], y[7]); 580| 1.48M| accum.mul(x[4], y[6]); 581| 1.48M| accum.mul(x[5], y[5]); 582| 1.48M| accum.mul(x[6], y[4]); 583| 1.48M| accum.mul(x[7], y[3]); 584| 1.48M| accum.mul(x[8], y[2]); 585| 1.48M| z[10] = accum.extract(); 586| 1.48M| accum.mul(x[3], y[8]); 587| 1.48M| accum.mul(x[4], y[7]); 588| 1.48M| accum.mul(x[5], y[6]); 589| 1.48M| accum.mul(x[6], y[5]); 590| 1.48M| accum.mul(x[7], y[4]); 591| 1.48M| accum.mul(x[8], y[3]); 592| 1.48M| z[11] = accum.extract(); 593| 1.48M| accum.mul(x[4], y[8]); 594| 1.48M| accum.mul(x[5], y[7]); 595| 1.48M| accum.mul(x[6], y[6]); 596| 1.48M| accum.mul(x[7], y[5]); 597| 1.48M| accum.mul(x[8], y[4]); 598| 1.48M| z[12] = accum.extract(); 599| 1.48M| accum.mul(x[5], y[8]); 600| 1.48M| accum.mul(x[6], y[7]); 601| 1.48M| accum.mul(x[7], y[6]); 602| 1.48M| accum.mul(x[8], y[5]); 603| 1.48M| z[13] = accum.extract(); 604| 1.48M| accum.mul(x[6], y[8]); 605| 1.48M| accum.mul(x[7], y[7]); 606| 1.48M| accum.mul(x[8], y[6]); 607| 1.48M| z[14] = accum.extract(); 608| 1.48M| accum.mul(x[7], y[8]); 609| 1.48M| accum.mul(x[8], y[7]); 610| 1.48M| z[15] = accum.extract(); 611| 1.48M| accum.mul(x[8], y[8]); 612| 1.48M| z[16] = accum.extract(); 613| 1.48M| z[17] = accum.extract(); 614| 1.48M|} _ZN5Botan12basecase_mulEPmmPKmmS2_m: 20| 16|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) { 21| 16| if(z_size < x_size + y_size) { ------------------ | Branch (21:7): [True: 0, False: 16] ------------------ 22| 0| throw Invalid_Argument("basecase_mul z_size too small"); 23| 0| } 24| | 25| 16| const size_t x_size_8 = x_size - (x_size % 8); 26| | 27| 16| zeroize_buffer(z, z_size); 28| | 29| 168| for(size_t i = 0; i != y_size; ++i) { ------------------ | Branch (29:22): [True: 152, False: 16] ------------------ 30| 152| const word y_i = y[i]; 31| | 32| 152| word carry = 0; 33| | 34| 304| for(size_t j = 0; j != x_size_8; j += 8) { ------------------ | Branch (34:25): [True: 152, False: 152] ------------------ 35| 152| carry = word8_madd3(z + i + j, x + j, y_i, carry); 36| 152| } 37| | 38| 456| for(size_t j = x_size_8; j != x_size; ++j) { ------------------ | Branch (38:32): [True: 304, False: 152] ------------------ 39| 304| z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry); 40| 304| } 41| | 42| 152| z[x_size + i] = carry; 43| 152| } 44| 16|} _ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m: 292| 21.1k| size_t ws_size) { 293| 21.1k| zeroize_buffer(z, z_size); 294| | 295| 21.1k| if(x_sw == 1) { ------------------ | Branch (295:7): [True: 0, False: 21.1k] ------------------ 296| 0| bigint_linmul3(z, y, y_sw, x[0]); 297| 21.1k| } else if(y_sw == 1) { ------------------ | Branch (297:14): [True: 0, False: 21.1k] ------------------ 298| 0| bigint_linmul3(z, x, x_sw, y[0]); 299| 21.1k| } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (299:14): [True: 16.2k, False: 4.90k] ------------------ 300| 16.2k| bigint_comba_mul4(z, x, y); 301| 16.2k| } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (301:14): [True: 1.94k, False: 2.96k] ------------------ 302| 1.94k| bigint_comba_mul6(z, x, y); 303| 2.96k| } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (303:14): [True: 1.36k, False: 1.59k] ------------------ 304| 1.36k| bigint_comba_mul8(z, x, y); 305| 1.59k| } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (305:14): [True: 1.58k, False: 16] ------------------ 306| 1.58k| bigint_comba_mul9(z, x, y); 307| 1.58k| } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (307:14): [True: 0, False: 16] ------------------ 308| 0| bigint_comba_mul16(z, x, y); 309| 16| } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (309:14): [True: 0, False: 16] ------------------ 310| 0| bigint_comba_mul24(z, x, y); 311| 16| } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || workspace == nullptr) { ------------------ | Branch (311:14): [True: 16, False: 0] | Branch (311:53): [True: 0, False: 0] | Branch (311:92): [True: 0, False: 0] ------------------ 312| 16| basecase_mul(z, z_size, x, x_sw, y, y_sw); 313| 16| } else { 314| 0| const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw); 315| | 316| 0| if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) { ------------------ | Branch (316:10): [True: 0, False: 0] | Branch (316:19): [True: 0, False: 0] | Branch (316:38): [True: 0, False: 0] ------------------ 317| 0| karatsuba_mul(z, x, y, N, workspace); 318| 0| } else { 319| 0| basecase_mul(z, z_size, x, x_sw, y, y_sw); 320| 0| } 321| 0| } 322| 21.1k|} _ZN5Botan10bigint_sqrEPmmPKmmmS0_m: 327| 18|void bigint_sqr(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size) { 328| 18| zeroize_buffer(z, z_size); 329| | 330| 18| BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient"); ------------------ | | 64| 18| do { \ | | 65| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 18| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 18] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 18| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 18] | | ------------------ ------------------ 331| | 332| 18| if(x_sw == 1) { ------------------ | Branch (332:7): [True: 0, False: 18] ------------------ 333| 0| bigint_linmul3(z, x, x_sw, x[0]); 334| 18| } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) { ------------------ | Branch (334:14): [True: 6, False: 12] ------------------ 335| 6| bigint_comba_sqr4(z, x); 336| 12| } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) { ------------------ | Branch (336:14): [True: 6, False: 6] ------------------ 337| 6| bigint_comba_sqr6(z, x); 338| 6| } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) { ------------------ | Branch (338:14): [True: 3, False: 3] ------------------ 339| 3| bigint_comba_sqr8(z, x); 340| 3| } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) { ------------------ | Branch (340:14): [True: 3, False: 0] ------------------ 341| 3| bigint_comba_sqr9(z, x); 342| 3| } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) { ------------------ | Branch (342:14): [True: 0, False: 0] ------------------ 343| 0| bigint_comba_sqr16(z, x); 344| 0| } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) { ------------------ | Branch (344:14): [True: 0, False: 0] ------------------ 345| 0| bigint_comba_sqr24(z, x); 346| 0| } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || workspace == nullptr) { ------------------ | Branch (346:14): [True: 0, False: 0] | Branch (346:53): [True: 0, False: 0] ------------------ 347| 0| basecase_sqr(z, z_size, x, x_sw); 348| 0| } else { 349| 0| const size_t N = karatsuba_size(z_size, x_size, x_sw); 350| | 351| 0| if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) { ------------------ | Branch (351:10): [True: 0, False: 0] | Branch (351:19): [True: 0, False: 0] | Branch (351:38): [True: 0, False: 0] ------------------ 352| 0| karatsuba_sqr(z, x, N, workspace); 353| 0| } else { 354| 0| basecase_sqr(z, z_size, x, x_sw); 355| 0| } 356| 0| } 357| 18|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm: 272| 21.1k|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 21.1k| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 16.2k, False: 4.90k] | Branch (273:26): [True: 16.2k, False: 0] | Branch (273:42): [True: 16.2k, False: 0] | Branch (273:56): [True: 16.2k, False: 0] | Branch (273:72): [True: 16.2k, False: 0] ------------------ 274| 21.1k|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm: 272| 4.90k|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 4.90k| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 1.94k, False: 2.96k] | Branch (273:26): [True: 1.94k, False: 0] | Branch (273:42): [True: 1.94k, False: 0] | Branch (273:56): [True: 1.94k, False: 0] | Branch (273:72): [True: 1.94k, False: 0] ------------------ 274| 4.90k|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm: 272| 2.96k|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 2.96k| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 1.36k, False: 1.59k] | Branch (273:26): [True: 1.36k, False: 0] | Branch (273:42): [True: 1.36k, False: 0] | Branch (273:56): [True: 1.36k, False: 0] | Branch (273:72): [True: 1.36k, False: 0] ------------------ 274| 2.96k|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm: 272| 1.59k|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 1.59k| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 1.58k, False: 16] | Branch (273:26): [True: 1.58k, False: 0] | Branch (273:42): [True: 1.58k, False: 0] | Branch (273:56): [True: 1.58k, False: 0] | Branch (273:72): [True: 1.58k, False: 0] ------------------ 274| 1.59k|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm: 272| 16|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 16| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 16, False: 0] | Branch (273:26): [True: 8, False: 8] | Branch (273:42): [True: 8, False: 0] | Branch (273:56): [True: 8, False: 0] | Branch (273:72): [True: 0, False: 8] ------------------ 274| 16|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm: 272| 16|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 16| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 16, False: 0] | Branch (273:26): [True: 0, False: 16] | Branch (273:42): [True: 0, False: 0] | Branch (273:56): [True: 0, False: 0] | Branch (273:72): [True: 0, False: 0] ------------------ 274| 16|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm4EEEbmmm: 277| 18|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 18| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 6, False: 12] | Branch (278:26): [True: 6, False: 0] | Branch (278:42): [True: 6, False: 0] ------------------ 279| 18|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm6EEEbmmm: 277| 12|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 12| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 6, False: 6] | Branch (278:26): [True: 6, False: 0] | Branch (278:42): [True: 6, False: 0] ------------------ 279| 12|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm8EEEbmmm: 277| 6|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 6| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 3, False: 3] | Branch (278:26): [True: 3, False: 0] | Branch (278:42): [True: 3, False: 0] ------------------ 279| 6|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm9EEEbmmm: 277| 3|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 3| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 3, False: 0] | Branch (278:26): [True: 3, False: 0] | Branch (278:42): [True: 3, False: 0] ------------------ 279| 3|} _ZN5Botan25bigint_monty_redc_genericEPmPKmmS2_mmS0_: 91| 1.56k| word r[], const word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[]) { 92| 1.56k| BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic"); ------------------ | | 35| 1.56k| do { \ | | 36| 1.56k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 3.12k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 1.56k, False: 0] | | | Branch (37:12): [True: 1.56k, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.56k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.56k] | | ------------------ ------------------ 93| | 94| 1.56k| word3 accum; 95| | 96| 1.56k| accum.add(z[0]); 97| | 98| 1.56k| ws[0] = accum.monty_step(p[0], p_dash); 99| | 100| 14.0k| for(size_t i = 1; i != p_size; ++i) { ------------------ | Branch (100:22): [True: 12.5k, False: 1.56k] ------------------ 101| 12.5k| mul_rev_range(accum, ws, p, i); 102| 12.5k| accum.add(z[i]); 103| 12.5k| ws[i] = accum.monty_step(p[0], p_dash); 104| 12.5k| } 105| | 106| 14.0k| for(size_t i = 0; i != p_size - 1; ++i) { ------------------ | Branch (106:22): [True: 12.5k, False: 1.56k] ------------------ 107| 12.5k| mul_rev_range(accum, &ws[i + 1], &p[i], p_size - (i + 1)); 108| 12.5k| accum.add(z[p_size + i]); 109| 12.5k| ws[i] = accum.extract(); 110| 12.5k| } 111| | 112| 1.56k| accum.add(z[2 * p_size - 1]); 113| | 114| 1.56k| ws[p_size - 1] = accum.extract(); 115| | // w1 is the final part, which is not stored in the workspace 116| 1.56k| const word w1 = accum.extract(); 117| | 118| | /* 119| | * The result might need to be reduced mod p. To avoid a timing 120| | * channel, always perform the subtraction. If in the computation 121| | * of x - p a borrow is required then x was already < p. 122| | * 123| | * x starts at ws[0] and is p_size bytes long plus a possible high 124| | * digit left over in w1. 125| | * 126| | * x - p starts at z[0] and is also p_size bytes long 127| | * 128| | * If borrow was set after the subtraction, then x was already less 129| | * than p and the subtraction was not needed. In that case overwrite 130| | * z[0:p_size] with the original x in ws[0:p_size]. 131| | * 132| | * We only copy out p_size in the final step because we know 133| | * the Montgomery result is < P 134| | */ 135| | 136| 1.56k| bigint_monty_maybe_sub(p_size, r, w1, ws, p); 137| 1.56k|} mp_monty.cpp:_ZN5Botan12_GLOBAL__N_113mul_rev_rangeERNS_5word3ImEEPKmS5_m: 18| 25.0k|BOTAN_FORCE_INLINE void mul_rev_range(word3& accum, const word ws[], const word p[], size_t bound) { 19| | /* 20| | Unrolled version of: 21| | 22| | for(size_t i = 0; i < bound; ++i) { 23| | accum.mul(ws[i], p[bound - i]); 24| | } 25| | */ 26| | 27| 25.0k| size_t lower = 0; 28| 65.6k| while(lower < bound) { ------------------ | Branch (28:10): [True: 40.6k, False: 25.0k] ------------------ 29| 40.6k| const size_t upper = bound - lower; 30| | 31| 40.6k| if(upper >= 16) { ------------------ | Branch (31:10): [True: 0, False: 40.6k] ------------------ 32| 0| accum.mul(ws[lower], p[upper]); 33| 0| accum.mul(ws[lower + 1], p[upper - 1]); 34| 0| accum.mul(ws[lower + 2], p[upper - 2]); 35| 0| accum.mul(ws[lower + 3], p[upper - 3]); 36| 0| accum.mul(ws[lower + 4], p[upper - 4]); 37| 0| accum.mul(ws[lower + 5], p[upper - 5]); 38| 0| accum.mul(ws[lower + 6], p[upper - 6]); 39| 0| accum.mul(ws[lower + 7], p[upper - 7]); 40| 0| accum.mul(ws[lower + 8], p[upper - 8]); 41| 0| accum.mul(ws[lower + 9], p[upper - 9]); 42| 0| accum.mul(ws[lower + 10], p[upper - 10]); 43| 0| accum.mul(ws[lower + 11], p[upper - 11]); 44| 0| accum.mul(ws[lower + 12], p[upper - 12]); 45| 0| accum.mul(ws[lower + 13], p[upper - 13]); 46| 0| accum.mul(ws[lower + 14], p[upper - 14]); 47| 0| accum.mul(ws[lower + 15], p[upper - 15]); 48| 0| lower += 16; 49| 40.6k| } else if(upper >= 8) { ------------------ | Branch (49:17): [True: 3.12k, False: 37.5k] ------------------ 50| 3.12k| accum.mul(ws[lower], p[upper]); 51| 3.12k| accum.mul(ws[lower + 1], p[upper - 1]); 52| 3.12k| accum.mul(ws[lower + 2], p[upper - 2]); 53| 3.12k| accum.mul(ws[lower + 3], p[upper - 3]); 54| 3.12k| accum.mul(ws[lower + 4], p[upper - 4]); 55| 3.12k| accum.mul(ws[lower + 5], p[upper - 5]); 56| 3.12k| accum.mul(ws[lower + 6], p[upper - 6]); 57| 3.12k| accum.mul(ws[lower + 7], p[upper - 7]); 58| 3.12k| lower += 8; 59| 37.5k| } else if(upper >= 4) { ------------------ | Branch (59:17): [True: 12.5k, False: 25.0k] ------------------ 60| 12.5k| accum.mul(ws[lower], p[upper]); 61| 12.5k| accum.mul(ws[lower + 1], p[upper - 1]); 62| 12.5k| accum.mul(ws[lower + 2], p[upper - 2]); 63| 12.5k| accum.mul(ws[lower + 3], p[upper - 3]); 64| 12.5k| lower += 4; 65| 25.0k| } else if(upper >= 2) { ------------------ | Branch (65:17): [True: 12.5k, False: 12.5k] ------------------ 66| 12.5k| accum.mul(ws[lower], p[upper]); 67| 12.5k| accum.mul(ws[lower + 1], p[upper - 1]); 68| 12.5k| lower += 2; 69| 12.5k| } else { 70| 12.5k| accum.mul(ws[lower], p[upper]); 71| 12.5k| lower += 1; 72| 12.5k| } 73| 40.6k| } 74| 25.0k|} _ZN5Botan19bigint_monty_redc_4EPmPKmS2_mS0_: 12| 2.69M|void bigint_monty_redc_4(word r[4], const word z[8], const word p[4], word p_dash, word ws[4]) { 13| 2.69M| word3 accum; 14| 2.69M| accum.add(z[0]); 15| 2.69M| ws[0] = accum.monty_step(p[0], p_dash); 16| 2.69M| accum.mul(ws[0], p[1]); 17| 2.69M| accum.add(z[1]); 18| 2.69M| ws[1] = accum.monty_step(p[0], p_dash); 19| 2.69M| accum.mul(ws[0], p[2]); 20| 2.69M| accum.mul(ws[1], p[1]); 21| 2.69M| accum.add(z[2]); 22| 2.69M| ws[2] = accum.monty_step(p[0], p_dash); 23| 2.69M| accum.mul(ws[0], p[3]); 24| 2.69M| accum.mul(ws[1], p[2]); 25| 2.69M| accum.mul(ws[2], p[1]); 26| 2.69M| accum.add(z[3]); 27| 2.69M| ws[3] = accum.monty_step(p[0], p_dash); 28| 2.69M| accum.mul(ws[1], p[3]); 29| 2.69M| accum.mul(ws[2], p[2]); 30| 2.69M| accum.mul(ws[3], p[1]); 31| 2.69M| accum.add(z[4]); 32| 2.69M| ws[0] = accum.extract(); 33| 2.69M| accum.mul(ws[2], p[3]); 34| 2.69M| accum.mul(ws[3], p[2]); 35| 2.69M| accum.add(z[5]); 36| 2.69M| ws[1] = accum.extract(); 37| 2.69M| accum.mul(ws[3], p[3]); 38| 2.69M| accum.add(z[6]); 39| 2.69M| ws[2] = accum.extract(); 40| 2.69M| accum.add(z[7]); 41| 2.69M| ws[3] = accum.extract(); 42| 2.69M| const word w1 = accum.extract(); 43| 2.69M| bigint_monty_maybe_sub<4>(r, w1, ws, p); 44| 2.69M|} _ZN5Botan19bigint_monty_redc_6EPmPKmS2_mS0_: 46| 1.39M|void bigint_monty_redc_6(word r[6], const word z[12], const word p[6], word p_dash, word ws[6]) { 47| 1.39M| word3 accum; 48| 1.39M| accum.add(z[0]); 49| 1.39M| ws[0] = accum.monty_step(p[0], p_dash); 50| 1.39M| accum.mul(ws[0], p[1]); 51| 1.39M| accum.add(z[1]); 52| 1.39M| ws[1] = accum.monty_step(p[0], p_dash); 53| 1.39M| accum.mul(ws[0], p[2]); 54| 1.39M| accum.mul(ws[1], p[1]); 55| 1.39M| accum.add(z[2]); 56| 1.39M| ws[2] = accum.monty_step(p[0], p_dash); 57| 1.39M| accum.mul(ws[0], p[3]); 58| 1.39M| accum.mul(ws[1], p[2]); 59| 1.39M| accum.mul(ws[2], p[1]); 60| 1.39M| accum.add(z[3]); 61| 1.39M| ws[3] = accum.monty_step(p[0], p_dash); 62| 1.39M| accum.mul(ws[0], p[4]); 63| 1.39M| accum.mul(ws[1], p[3]); 64| 1.39M| accum.mul(ws[2], p[2]); 65| 1.39M| accum.mul(ws[3], p[1]); 66| 1.39M| accum.add(z[4]); 67| 1.39M| ws[4] = accum.monty_step(p[0], p_dash); 68| 1.39M| accum.mul(ws[0], p[5]); 69| 1.39M| accum.mul(ws[1], p[4]); 70| 1.39M| accum.mul(ws[2], p[3]); 71| 1.39M| accum.mul(ws[3], p[2]); 72| 1.39M| accum.mul(ws[4], p[1]); 73| 1.39M| accum.add(z[5]); 74| 1.39M| ws[5] = accum.monty_step(p[0], p_dash); 75| 1.39M| accum.mul(ws[1], p[5]); 76| 1.39M| accum.mul(ws[2], p[4]); 77| 1.39M| accum.mul(ws[3], p[3]); 78| 1.39M| accum.mul(ws[4], p[2]); 79| 1.39M| accum.mul(ws[5], p[1]); 80| 1.39M| accum.add(z[6]); 81| 1.39M| ws[0] = accum.extract(); 82| 1.39M| accum.mul(ws[2], p[5]); 83| 1.39M| accum.mul(ws[3], p[4]); 84| 1.39M| accum.mul(ws[4], p[3]); 85| 1.39M| accum.mul(ws[5], p[2]); 86| 1.39M| accum.add(z[7]); 87| 1.39M| ws[1] = accum.extract(); 88| 1.39M| accum.mul(ws[3], p[5]); 89| 1.39M| accum.mul(ws[4], p[4]); 90| 1.39M| accum.mul(ws[5], p[3]); 91| 1.39M| accum.add(z[8]); 92| 1.39M| ws[2] = accum.extract(); 93| 1.39M| accum.mul(ws[4], p[5]); 94| 1.39M| accum.mul(ws[5], p[4]); 95| 1.39M| accum.add(z[9]); 96| 1.39M| ws[3] = accum.extract(); 97| 1.39M| accum.mul(ws[5], p[5]); 98| 1.39M| accum.add(z[10]); 99| 1.39M| ws[4] = accum.extract(); 100| 1.39M| accum.add(z[11]); 101| 1.39M| ws[5] = accum.extract(); 102| 1.39M| const word w1 = accum.extract(); 103| 1.39M| bigint_monty_maybe_sub<6>(r, w1, ws, p); 104| 1.39M|} _ZN5Botan19bigint_monty_redc_8EPmPKmS2_mS0_: 106| 2.74M|void bigint_monty_redc_8(word r[8], const word z[16], const word p[8], word p_dash, word ws[8]) { 107| 2.74M| word3 accum; 108| 2.74M| accum.add(z[0]); 109| 2.74M| ws[0] = accum.monty_step(p[0], p_dash); 110| 2.74M| accum.mul(ws[0], p[1]); 111| 2.74M| accum.add(z[1]); 112| 2.74M| ws[1] = accum.monty_step(p[0], p_dash); 113| 2.74M| accum.mul(ws[0], p[2]); 114| 2.74M| accum.mul(ws[1], p[1]); 115| 2.74M| accum.add(z[2]); 116| 2.74M| ws[2] = accum.monty_step(p[0], p_dash); 117| 2.74M| accum.mul(ws[0], p[3]); 118| 2.74M| accum.mul(ws[1], p[2]); 119| 2.74M| accum.mul(ws[2], p[1]); 120| 2.74M| accum.add(z[3]); 121| 2.74M| ws[3] = accum.monty_step(p[0], p_dash); 122| 2.74M| accum.mul(ws[0], p[4]); 123| 2.74M| accum.mul(ws[1], p[3]); 124| 2.74M| accum.mul(ws[2], p[2]); 125| 2.74M| accum.mul(ws[3], p[1]); 126| 2.74M| accum.add(z[4]); 127| 2.74M| ws[4] = accum.monty_step(p[0], p_dash); 128| 2.74M| accum.mul(ws[0], p[5]); 129| 2.74M| accum.mul(ws[1], p[4]); 130| 2.74M| accum.mul(ws[2], p[3]); 131| 2.74M| accum.mul(ws[3], p[2]); 132| 2.74M| accum.mul(ws[4], p[1]); 133| 2.74M| accum.add(z[5]); 134| 2.74M| ws[5] = accum.monty_step(p[0], p_dash); 135| 2.74M| accum.mul(ws[0], p[6]); 136| 2.74M| accum.mul(ws[1], p[5]); 137| 2.74M| accum.mul(ws[2], p[4]); 138| 2.74M| accum.mul(ws[3], p[3]); 139| 2.74M| accum.mul(ws[4], p[2]); 140| 2.74M| accum.mul(ws[5], p[1]); 141| 2.74M| accum.add(z[6]); 142| 2.74M| ws[6] = accum.monty_step(p[0], p_dash); 143| 2.74M| accum.mul(ws[0], p[7]); 144| 2.74M| accum.mul(ws[1], p[6]); 145| 2.74M| accum.mul(ws[2], p[5]); 146| 2.74M| accum.mul(ws[3], p[4]); 147| 2.74M| accum.mul(ws[4], p[3]); 148| 2.74M| accum.mul(ws[5], p[2]); 149| 2.74M| accum.mul(ws[6], p[1]); 150| 2.74M| accum.add(z[7]); 151| 2.74M| ws[7] = accum.monty_step(p[0], p_dash); 152| 2.74M| accum.mul(ws[1], p[7]); 153| 2.74M| accum.mul(ws[2], p[6]); 154| 2.74M| accum.mul(ws[3], p[5]); 155| 2.74M| accum.mul(ws[4], p[4]); 156| 2.74M| accum.mul(ws[5], p[3]); 157| 2.74M| accum.mul(ws[6], p[2]); 158| 2.74M| accum.mul(ws[7], p[1]); 159| 2.74M| accum.add(z[8]); 160| 2.74M| ws[0] = accum.extract(); 161| 2.74M| accum.mul(ws[2], p[7]); 162| 2.74M| accum.mul(ws[3], p[6]); 163| 2.74M| accum.mul(ws[4], p[5]); 164| 2.74M| accum.mul(ws[5], p[4]); 165| 2.74M| accum.mul(ws[6], p[3]); 166| 2.74M| accum.mul(ws[7], p[2]); 167| 2.74M| accum.add(z[9]); 168| 2.74M| ws[1] = accum.extract(); 169| 2.74M| accum.mul(ws[3], p[7]); 170| 2.74M| accum.mul(ws[4], p[6]); 171| 2.74M| accum.mul(ws[5], p[5]); 172| 2.74M| accum.mul(ws[6], p[4]); 173| 2.74M| accum.mul(ws[7], p[3]); 174| 2.74M| accum.add(z[10]); 175| 2.74M| ws[2] = accum.extract(); 176| 2.74M| accum.mul(ws[4], p[7]); 177| 2.74M| accum.mul(ws[5], p[6]); 178| 2.74M| accum.mul(ws[6], p[5]); 179| 2.74M| accum.mul(ws[7], p[4]); 180| 2.74M| accum.add(z[11]); 181| 2.74M| ws[3] = accum.extract(); 182| 2.74M| accum.mul(ws[5], p[7]); 183| 2.74M| accum.mul(ws[6], p[6]); 184| 2.74M| accum.mul(ws[7], p[5]); 185| 2.74M| accum.add(z[12]); 186| 2.74M| ws[4] = accum.extract(); 187| 2.74M| accum.mul(ws[6], p[7]); 188| 2.74M| accum.mul(ws[7], p[6]); 189| 2.74M| accum.add(z[13]); 190| 2.74M| ws[5] = accum.extract(); 191| 2.74M| accum.mul(ws[7], p[7]); 192| 2.74M| accum.add(z[14]); 193| 2.74M| ws[6] = accum.extract(); 194| 2.74M| accum.add(z[15]); 195| 2.74M| ws[7] = accum.extract(); 196| 2.74M| const word w1 = accum.extract(); 197| 2.74M| bigint_monty_maybe_sub<8>(r, w1, ws, p); 198| 2.74M|} _ZN5Botan17Barrett_ReductionC2ERKNS_6BigIntES1_m: 17| 18| m_modulus(m), m_mu(std::move(mu)), m_mod_words(mw), m_modulus_bits(m.bits()) { 18| | // Give some extra space for Karatsuba 19| 18| m_modulus.grow_to(m_mod_words + 8); 20| 18| m_mu.grow_to(m_mod_words + 8); 21| 18|} _ZN5Botan17Barrett_Reduction18for_public_modulusERKNS_6BigIntE: 33| 18|Barrett_Reduction Barrett_Reduction::for_public_modulus(const BigInt& mod) { 34| 18| BOTAN_ARG_CHECK(mod.signum() > 0, "Modulus must be positive"); ------------------ | | 35| 18| do { \ | | 36| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18] | | ------------------ ------------------ 35| | 36| 18| const size_t mod_words = mod.sig_words(); 37| | 38| | // Compute mu = floor(2^{2k} / m) 39| 18| const size_t mu_bits = 2 * WordInfo::bits * mod_words; 40| 18| return Barrett_Reduction(mod, vartime_divide_pow2k(mu_bits, mod), mod_words); 41| 18|} _ZNK5Botan17Barrett_Reduction8multiplyERKNS_6BigIntES3_: 159| 18|BigInt Barrett_Reduction::multiply(const BigInt& x, const BigInt& y) const { 160| 18| BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett multiply"); ------------------ | | 35| 18| do { \ | | 36| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18] | | ------------------ ------------------ 161| 18| BOTAN_ARG_CHECK(acceptable_barrett_input(y, m_modulus).as_bool(), "Invalid y param for Barrett multiply"); ------------------ | | 35| 18| do { \ | | 36| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18] | | ------------------ ------------------ 162| | 163| 18| secure_vector ws(2 * (m_mod_words + 2)); 164| 18| secure_vector xy(2 * m_mod_words); 165| | 166| 18| bigint_mul(xy.data(), 167| 18| xy.size(), 168| 18| x._data(), 169| 18| x.size(), 170| 18| std::min(x.size(), m_mod_words), 171| 18| y._data(), 172| 18| y.size(), 173| 18| std::min(y.size(), m_mod_words), 174| 18| ws.data(), 175| 18| ws.size()); 176| | 177| 18| return barrett_reduce(m_mod_words, m_modulus, m_mu, xy, ws); 178| 18|} _ZNK5Botan17Barrett_Reduction6squareERKNS_6BigIntE: 180| 18|BigInt Barrett_Reduction::square(const BigInt& x) const { 181| 18| BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett square"); ------------------ | | 35| 18| do { \ | | 36| 18| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18] | | ------------------ ------------------ 182| | 183| 18| secure_vector ws(2 * (m_mod_words + 2)); 184| 18| secure_vector x2(2 * m_mod_words); 185| | 186| 18| bigint_sqr(x2.data(), x2.size(), x._data(), x.size(), std::min(x.size(), m_mod_words), ws.data(), ws.size()); 187| | 188| 18| return barrett_reduce(m_mod_words, m_modulus, m_mu, x2, ws); 189| 18|} _ZNK5Botan17Barrett_Reduction6reduceERKNS_6BigIntE: 191| 12|BigInt Barrett_Reduction::reduce(const BigInt& x) const { 192| 12| BOTAN_ARG_CHECK(x.signum() >= 0, "Argument must be non-negative"); ------------------ | | 35| 12| do { \ | | 36| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 12| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 12] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 12| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 12] | | ------------------ ------------------ 193| | 194| 12| const size_t x_sw = x.sig_words(); 195| 12| BOTAN_ARG_CHECK(x_sw <= 2 * m_mod_words, "Argument is too large for Barrett reduction"); ------------------ | | 35| 12| do { \ | | 36| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 12| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 12] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 12| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 12] | | ------------------ ------------------ 196| | 197| 12| x.grow_to(2 * m_mod_words); 198| | 199| 12| secure_vector ws; 200| 12| return barrett_reduce(m_mod_words, m_modulus, m_mu, x._as_span(), ws); 201| 12|} barrett.cpp:_ZN5Botan12_GLOBAL__N_124acceptable_barrett_inputERKNS_6BigIntES3_: 151| 54|CT::Choice acceptable_barrett_input(const BigInt& x, const BigInt& modulus) { 152| 54| auto x_is_positive = CT::Choice::from_int(static_cast(x.signum() >= 0)); 153| 54| auto x_lt_mod = bigint_ct_is_lt(x._data(), x.size(), modulus._data(), modulus.sig_words()).as_choice(); 154| 54| return x_is_positive && x_lt_mod; 155| 54|} barrett.cpp:_ZN5Botan12_GLOBAL__N_114barrett_reduceEmRKNS_6BigIntES3_NSt3__14spanIKmLm18446744073709551615EEERNS4_6vectorImNS_16secure_allocatorImEEEE: 54| 48| size_t mod_words, const BigInt& modulus, const BigInt& mu, std::span x_words, secure_vector& ws) { 55| 48| BOTAN_ASSERT_NOMSG(modulus.sig_words() == mod_words); ------------------ | | 77| 48| do { \ | | 78| 48| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 48| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 48] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 48| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 48] | | ------------------ ------------------ 56| | 57| | // Caller must expand input to be at least this size 58| 48| BOTAN_ASSERT_NOMSG(x_words.size() >= 2 * mod_words); ------------------ | | 77| 48| do { \ | | 78| 48| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 48| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 48] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 48| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 48] | | ------------------ ------------------ 59| | 60| | // Normally mod_words + 1 but can be + 2 if the modulus is a power of 2 61| 48| const size_t mu_words = mu.sig_words(); 62| 48| BOTAN_ASSERT_NOMSG(mu_words <= mod_words + 2); ------------------ | | 77| 48| do { \ | | 78| 48| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 48| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 48] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 48| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 48] | | ------------------ ------------------ 63| | 64| 48| if(ws.size() < 2 * (mod_words + 2)) { ------------------ | Branch (64:7): [True: 12, False: 36] ------------------ 65| 12| ws.resize(2 * (mod_words + 2)); 66| 12| } 67| | 68| 48| CT::poison(x_words); 69| | 70| | /* 71| | * Following the notation of Handbook of Applied Cryptography 72| | * Algorithm 14.42 "Barrett modular reduction", page 604 73| | * 74| | * 75| | * Using `mu` for μ in the code 76| | */ 77| | 78| | // Compute q1 = floor(x / 2^(k - 1)) which is equivalent to ignoring the low (k-1) words 79| | 80| | // 2 * mod_words + 1 is sufficient, extra is to enable Karatsuba 81| 48| secure_vector r(2 * mu_words + 2); 82| | 83| 48| copy_mem(r.data(), x_words.data() + (mod_words - 1), mod_words + 1); 84| | 85| | // Now compute q2 = q1 * μ 86| | 87| | // We allocate more size than required since this allows Karatsuba more often; 88| | // just `mu_words + (mod_words + 1)` is sufficient 89| 48| const size_t q2_size = 2 * mu_words + 2; 90| | 91| 48| secure_vector q2(q2_size); 92| | 93| 48| bigint_mul( 94| 48| q2.data(), q2.size(), r.data(), r.size(), mod_words + 1, mu._data(), mu.size(), mu_words, ws.data(), ws.size()); 95| | 96| | // Compute r2 = (floor(q2 / b^(k+1)) * m) mod 2^(k+1) 97| | // The division/floor is again effected by just ignoring the low k + 1 words 98| 48| bigint_mul(r.data(), 99| 48| r.size(), 100| 48| &q2[mod_words + 1], // ignoring the low mod_words + 1 words of the first product 101| 48| q2.size() - (mod_words + 1), 102| 48| mod_words + 1, 103| 48| modulus._data(), 104| 48| modulus.size(), 105| 48| mod_words, 106| 48| ws.data(), 107| 48| ws.size()); 108| | 109| | // Clear the high words of the product, equivalent to computing mod 2^(k+1) 110| | // TODO add masked mul to avoid computing high bits at all 111| 48| clear_mem(std::span{r}.subspan(mod_words + 1)); 112| | 113| | // Compute r = r1 - r2 114| | 115| | // The return value of bigint_sub_abs isn't quite right for what we need here so first compare 116| 48| const int32_t relative_size = bigint_cmp(r.data(), mod_words + 1, x_words.data(), mod_words + 1); 117| | 118| 48| bigint_sub_abs(r.data(), r.data(), x_words.data(), mod_words + 1, ws.data()); 119| | 120| | /* 121| | If r is negative then we have to set r to r + 2^(k+1) 122| | 123| | However for r negative computing this sum is equivalent to computing 2^(k+1) - abs(r) 124| | */ 125| 48| clear_mem(ws.data(), mod_words + 2); 126| 48| ws[mod_words + 1] = 1; 127| 48| bigint_sub2(ws.data(), mod_words + 2, r.data(), mod_words + 2); 128| | 129| | // If relative_size > 0 then assign r to 2^(k+1) - r 130| 48| CT::Mask::is_equal(static_cast(relative_size), 1).select_n(r.data(), ws.data(), r.data(), mod_words + 2); 131| | 132| | /* 133| | * Per HAC Note 14.44 (ii) "step 4 is repeated at most twice since 0 ≤ r < 3m" 134| | */ 135| 48| const size_t bound = 2; 136| | 137| 48| BOTAN_ASSERT_NOMSG(r.size() >= mod_words + 1); ------------------ | | 77| 48| do { \ | | 78| 48| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 48| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 48] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 48| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 48] | | ------------------ ------------------ 138| 144| for(size_t i = 0; i != bound; ++i) { ------------------ | Branch (138:22): [True: 96, False: 48] ------------------ 139| 96| const word borrow = bigint_sub3(ws.data(), r.data(), mod_words + 1, modulus._data(), mod_words); 140| 96| CT::Mask::is_zero(borrow).select_n(r.data(), ws.data(), r.data(), mod_words + 1); 141| 96| } 142| | 143| 48| CT::unpoison(q2); 144| 48| CT::unpoison(r); 145| 48| CT::unpoison(ws); 146| 48| CT::unpoison(x_words); 147| | 148| 48| return BigInt::_from_words(r); 149| 48|} _ZN5Botan17Montgomery_Params4DataC2ERKNS_6BigIntERKNS_17Barrett_ReductionE: 40| 6|Montgomery_Params::Data::Data(const BigInt& p, const Barrett_Reduction& mod_p) { 41| 6| if(p.is_even() || p < 3) { ------------------ | Branch (41:7): [True: 0, False: 6] | Branch (41:22): [True: 0, False: 6] ------------------ 42| 0| throw Invalid_Argument("Montgomery_Params invalid modulus"); 43| 0| } 44| | 45| 6| m_p = p; 46| 6| m_p_words = m_p.sig_words(); 47| 6| m_p_dash = monty_inverse(m_p.word_at(0)); 48| | 49| 6| const BigInt r = BigInt::power_of_2(m_p_words * WordInfo::bits); 50| | 51| 6| m_r1 = mod_p.reduce(r); 52| 6| m_r2 = mod_p.square(m_r1); 53| 6| m_r3 = mod_p.multiply(m_r1, m_r2); 54| | 55| | // Barrett should be at least zero prefixing up to modulus size 56| 6| BOTAN_ASSERT_NOMSG(m_r1.size() >= m_p_words); ------------------ | | 77| 6| do { \ | | 78| 6| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 6| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 6] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 6| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 6] | | ------------------ ------------------ 57| 6| BOTAN_ASSERT_NOMSG(m_r2.size() >= m_p_words); ------------------ | | 77| 6| do { \ | | 78| 6| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 6| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 6] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 6| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 6] | | ------------------ ------------------ 58| 6| BOTAN_ASSERT_NOMSG(m_r3.size() >= m_p_words); ------------------ | | 77| 6| do { \ | | 78| 6| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 6| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 6] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 6| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 6] | | ------------------ ------------------ 59| 6|} _ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntERKNS_17Barrett_ReductionE: 62| 6| m_data(std::make_shared(p, mod_p)) {} _ZNK5Botan17Montgomery_Params3mulERKNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 90| 12|BigInt Montgomery_Params::mul(const BigInt& x, const BigInt& y, secure_vector& ws) const { 91| 12| const size_t p_size = this->p_words(); 92| 12| BigInt z = BigInt::with_capacity(2 * p_size); 93| 12| this->mul(z, x, y, ws); 94| 12| return z; 95| 12|} _ZNK5Botan17Montgomery_Params3mulERNS_6BigIntERKS1_S4_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 97| 12|void Montgomery_Params::mul(BigInt& z, const BigInt& x, const BigInt& y, secure_vector& ws) const { 98| 12| BOTAN_ARG_CHECK(&z != &x && &z != &y, "Montgomery_Params::mul output must not alias inputs"); ------------------ | | 35| 12| do { \ | | 36| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 24| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 12, False: 0] | | | Branch (37:12): [True: 12, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 12| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 12] | | ------------------ ------------------ 99| | 100| 12| const size_t p_size = this->p_words(); 101| | 102| 12| if(ws.size() < 2 * p_size) { ------------------ | Branch (102:7): [True: 6, False: 6] ------------------ 103| 6| ws.resize(2 * p_size); 104| 6| } 105| | 106| 12| BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size); ------------------ | | 130| 12| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 12| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 12] | | ------------------ ------------------ 107| 12| BOTAN_DEBUG_ASSERT(y.sig_words() <= p_size); ------------------ | | 130| 12| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 12| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 12] | | ------------------ ------------------ 108| | 109| 12| if(z.size() < 2 * p_size) { ------------------ | Branch (109:7): [True: 0, False: 12] ------------------ 110| 0| z.grow_to(2 * p_size); 111| 0| } 112| | 113| 12| bigint_mul(z.mutable_data(), 114| 12| z.size(), 115| 12| x._data(), 116| 12| x.size(), 117| 12| std::min(p_size, x.size()), 118| 12| y._data(), 119| 12| y.size(), 120| 12| std::min(p_size, y.size()), 121| 12| ws.data(), 122| 12| ws.size()); 123| | 124| 12| bigint_monty_redc_inplace(z.mutable_data(), this->p()._data(), p_size, this->p_dash(), ws.data(), ws.size()); 125| 12|} _ZNK5Botan17Montgomery_Params6mul_byERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 157| 21.0k|void Montgomery_Params::mul_by(BigInt& x, const BigInt& y, secure_vector& ws) const { 158| 21.0k| const size_t p_size = this->p_words(); 159| | 160| 21.0k| if(ws.size() < 4 * p_size) { ------------------ | Branch (160:7): [True: 10.5k, False: 10.5k] ------------------ 161| 10.5k| ws.resize(4 * p_size); 162| 10.5k| } 163| | 164| 21.0k| word* z_data = ws.data(); 165| 21.0k| word* ws_data = &ws[2 * p_size]; 166| | 167| 21.0k| BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size); ------------------ | | 130| 21.0k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 21.0k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 21.0k] | | ------------------ ------------------ 168| | 169| 21.0k| bigint_mul(z_data, 170| 21.0k| 2 * p_size, 171| 21.0k| x._data(), 172| 21.0k| x.size(), 173| 21.0k| std::min(p_size, x.size()), 174| 21.0k| y._data(), 175| 21.0k| y.size(), 176| 21.0k| std::min(p_size, y.size()), 177| 21.0k| ws_data, 178| 21.0k| 2 * p_size); 179| | 180| 21.0k| bigint_monty_redc_inplace(z_data, this->p()._data(), p_size, this->p_dash(), ws_data, 2 * p_size); 181| | 182| 21.0k| if(x.size() < 2 * p_size) { ------------------ | Branch (182:7): [True: 4.79k, False: 16.2k] ------------------ 183| 4.79k| x.grow_to(2 * p_size); 184| 4.79k| } 185| 21.0k| copy_mem(x.mutable_data(), z_data, 2 * p_size); 186| 21.0k|} _ZN5Botan6PCurve15PrimeOrderCurve6Scalar8_zeroizeEv: 16| 57.4k|void PrimeOrderCurve::Scalar::_zeroize() { 17| 57.4k| secure_zeroize_buffer(m_value.data(), m_value.size() * sizeof(word)); 18| 57.4k|} _ZN5Botan6PCurve15PrimeOrderCurve15for_named_curveENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 32| 6|std::shared_ptr PrimeOrderCurve::for_named_curve(std::string_view name) { 33| 6|#if defined(BOTAN_HAS_PCURVES_SECP256R1) 34| 6| if(name == "secp256r1") { ------------------ | Branch (34:7): [True: 1, False: 5] ------------------ 35| 1| return PCurveInstance::secp256r1(); 36| 1| } 37| 5|#endif 38| | 39| 5|#if defined(BOTAN_HAS_PCURVES_SECP384R1) 40| 5| if(name == "secp384r1") { ------------------ | Branch (40:7): [True: 1, False: 4] ------------------ 41| 1| return PCurveInstance::secp384r1(); 42| 1| } 43| 4|#endif 44| | 45| 4|#if defined(BOTAN_HAS_PCURVES_SECP521R1) 46| 4| if(name == "secp521r1") { ------------------ | Branch (46:7): [True: 1, False: 3] ------------------ 47| 1| return PCurveInstance::secp521r1(); 48| 1| } 49| 3|#endif 50| | 51| 3|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL256R1) 52| 3| if(name == "brainpool256r1") { ------------------ | Branch (52:7): [True: 1, False: 2] ------------------ 53| 1| return PCurveInstance::brainpool256r1(); 54| 1| } 55| 2|#endif 56| | 57| 2|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL384R1) 58| 2| if(name == "brainpool384r1") { ------------------ | Branch (58:7): [True: 1, False: 1] ------------------ 59| 1| return PCurveInstance::brainpool384r1(); 60| 1| } 61| 1|#endif 62| | 63| 1|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL512R1) 64| 1| if(name == "brainpool512r1") { ------------------ | Branch (64:7): [True: 1, False: 0] ------------------ 65| 1| return PCurveInstance::brainpool512r1(); 66| 1| } 67| 0|#endif 68| | 69| 0|#if defined(BOTAN_HAS_PCURVES_FRP256V1) 70| 0| if(name == "frp256v1") { ------------------ | Branch (70:7): [True: 0, False: 0] ------------------ 71| 0| return PCurveInstance::frp256v1(); 72| 0| } 73| 0|#endif 74| | 75| 0|#if defined(BOTAN_HAS_PCURVES_SECP192R1) 76| 0| if(name == "secp192r1") { ------------------ | Branch (76:7): [True: 0, False: 0] ------------------ 77| 0| return PCurveInstance::secp192r1(); 78| 0| } 79| 0|#endif 80| | 81| 0|#if defined(BOTAN_HAS_PCURVES_SECP224R1) 82| 0| if(name == "secp224r1") { ------------------ | Branch (82:7): [True: 0, False: 0] ------------------ 83| 0| return PCurveInstance::secp224r1(); 84| 0| } 85| 0|#endif 86| | 87| 0|#if defined(BOTAN_HAS_PCURVES_SECP256K1) 88| 0| if(name == "secp256k1") { ------------------ | Branch (88:7): [True: 0, False: 0] ------------------ 89| 0| return PCurveInstance::secp256k1(); 90| 0| } 91| 0|#endif 92| | 93| 0|#if defined(BOTAN_HAS_PCURVES_SM2P256V1) 94| 0| if(name == "sm2p256v1") { ------------------ | Branch (94:7): [True: 0, False: 0] ------------------ 95| 0| return PCurveInstance::sm2p256v1(); 96| 0| } 97| 0|#endif 98| | 99| 0|#if defined(BOTAN_HAS_PCURVES_NUMSP512D1) 100| 0| if(name == "numsp512d1") { ------------------ | Branch (100:7): [True: 0, False: 0] ------------------ 101| 0| return PCurveInstance::numsp512d1(); 102| 0| } 103| 0|#endif 104| | 105| 0| BOTAN_UNUSED(name); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 106| 0| return {}; 107| 0|} _ZN5Botan6PCurve14PCurveInstance14brainpool256r1Ev: 37| 1|std::shared_ptr PCurveInstance::brainpool256r1() { 38| 1| return PrimeOrderCurveImpl::instance(); 39| 1|} _ZN5Botan6PCurve14PCurveInstance14brainpool384r1Ev: 37| 1|std::shared_ptr PCurveInstance::brainpool384r1() { 38| 1| return PrimeOrderCurveImpl::instance(); 39| 1|} _ZN5Botan6PCurve14PCurveInstance14brainpool512r1Ev: 37| 1|std::shared_ptr PCurveInstance::brainpool512r1() { 38| 1| return PrimeOrderCurveImpl::instance(); 39| 1|} _ZN5Botan6PCurve14PCurveInstance9secp256r1Ev: 268| 1|std::shared_ptr PCurveInstance::secp256r1() { 269| 1| return PrimeOrderCurveImpl::instance(); 270| 1|} pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE3oneEv: 77| 38.5k| constexpr static std::array one() { return std::array{1}; } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 27| 1.52M| constexpr static std::array redc(const std::array& z) { 28| 1.52M| const int64_t X00 = get_uint32(z.data(), 0); 29| 1.52M| const int64_t X01 = get_uint32(z.data(), 1); 30| 1.52M| const int64_t X02 = get_uint32(z.data(), 2); 31| 1.52M| const int64_t X03 = get_uint32(z.data(), 3); 32| 1.52M| const int64_t X04 = get_uint32(z.data(), 4); 33| 1.52M| const int64_t X05 = get_uint32(z.data(), 5); 34| 1.52M| const int64_t X06 = get_uint32(z.data(), 6); 35| 1.52M| const int64_t X07 = get_uint32(z.data(), 7); 36| 1.52M| const int64_t X08 = get_uint32(z.data(), 8); 37| 1.52M| const int64_t X09 = get_uint32(z.data(), 9); 38| 1.52M| const int64_t X10 = get_uint32(z.data(), 10); 39| 1.52M| const int64_t X11 = get_uint32(z.data(), 11); 40| 1.52M| const int64_t X12 = get_uint32(z.data(), 12); 41| 1.52M| const int64_t X13 = get_uint32(z.data(), 13); 42| 1.52M| const int64_t X14 = get_uint32(z.data(), 14); 43| 1.52M| const int64_t X15 = get_uint32(z.data(), 15); 44| | 45| | // See SP 800-186 section G.1.2 46| 1.52M| const int64_t S0 = P256_4[0] + X00 + X08 + X09 - (X11 + X12 + X13 + X14); 47| 1.52M| const int64_t S1 = P256_4[1] + X01 + X09 + X10 - (X12 + X13 + X14 + X15); 48| 1.52M| const int64_t S2 = P256_4[2] + X02 + X10 + X11 - (X13 + X14 + X15); 49| 1.52M| const int64_t S3 = P256_4[3] + X03 + 2 * (X11 + X12) + X13 - (X15 + X08 + X09); 50| 1.52M| const int64_t S4 = P256_4[4] + X04 + 2 * (X12 + X13) + X14 - (X09 + X10); 51| 1.52M| const int64_t S5 = P256_4[5] + X05 + 2 * (X13 + X14) + X15 - (X10 + X11); 52| 1.52M| const int64_t S6 = P256_4[6] + X06 + X13 + X14 * 3 + X15 * 2 - (X08 + X09); 53| 1.52M| const int64_t S7 = P256_4[7] + X07 + X15 * 3 + X08 - (X10 + X11 + X12 + X13); 54| 1.52M| const int64_t S8 = P256_4[8]; 55| | 56| 1.52M| std::array r = {}; 57| | 58| 1.52M| SolinasAccum sum(r); 59| | 60| 1.52M| sum.accum(S0); 61| 1.52M| sum.accum(S1); 62| 1.52M| sum.accum(S2); 63| 1.52M| sum.accum(S3); 64| 1.52M| sum.accum(S4); 65| 1.52M| sum.accum(S5); 66| 1.52M| sum.accum(S6); 67| 1.52M| sum.accum(S7); 68| 1.52M| const auto S = sum.final_carry(S8); 69| | 70| 1.52M| BOTAN_DEBUG_ASSERT(S <= 8); ------------------ | | 130| 1.52M| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 1.52M| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 1.52M] | | ------------------ ------------------ 71| | 72| 1.52M| solinas_correct_redc(r, P, p256_mul_mod_256(S)); 73| | 74| 1.52M| return r; 75| 1.52M| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE16p256_mul_mod_256Em: 89| 1.52M| constexpr static std::array p256_mul_mod_256(W i) { 90| 1.52M| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 91| | 92| | // For small i, multiples of P-256 have a simple structure so it's faster to 93| | // compute the value directly vs a (constant time) table lookup 94| | 95| 1.52M| auto r = P; 96| | if constexpr(WordInfo::bits == 32) { 97| | r[7] -= i; 98| | r[6] += i; 99| | r[3] += i; 100| | r[0] -= i; 101| 1.52M| } else { 102| 1.52M| const uint64_t i32 = static_cast(i) << 32; 103| 1.52M| r[3] -= i32; 104| 1.52M| r[3] += i; 105| 1.52M| r[1] += i32; 106| 1.52M| r[0] -= i; 107| 1.52M| } 108| 1.52M| return r; 109| 1.52M| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256r15Curve10fe_invert2ERKNS_6IntModINS1_12Secp256r1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 131| 968| static constexpr FieldElement fe_invert2(const FieldElement& x) { 132| | // Generated using https://github.com/mmcloughlin/addchain 133| | 134| 968| auto z = x.square(); 135| 968| z *= x; 136| 968| z = z.square(); 137| 968| z *= x; 138| 968| auto t0 = z; 139| 968| t0.square_n(3); 140| 968| t0 *= z; 141| 968| auto t1 = t0; 142| 968| t1.square_n(6); 143| 968| t0 *= t1; 144| 968| t0.square_n(3); 145| 968| z *= t0; 146| 968| t0 = z.square(); 147| 968| t0 *= x; 148| 968| t1 = t0; 149| 968| t1.square_n(16); 150| 968| t0 *= t1; 151| 968| t0.square_n(15); 152| 968| z *= t0; 153| 968| t0.square_n(17); 154| 968| t0 *= x; 155| 968| t0.square_n(143); 156| 968| t0 *= z; 157| 968| t0.square_n(47); 158| 968| z *= t0; 159| 968| z.square_n(2); 160| | 161| 968| return z; 162| 968| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 83| 16.1k| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 79| 16.1k| constexpr static std::array to_rep(const std::array& x) { return x; } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256r15Curve7fe_sqrtERKNS_6IntModINS1_12Secp256r1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 165| 289| static constexpr FieldElement fe_sqrt(const FieldElement& x) { 166| | // Generated using addchain 167| 289| auto z = x.square(); 168| 289| z *= x; 169| 289| auto t0 = z; 170| 289| t0.square_n(2); 171| 289| z *= t0; 172| 289| t0 = z; 173| 289| t0.square_n(4); 174| 289| z *= t0; 175| 289| t0 = z; 176| 289| t0.square_n(8); 177| 289| z *= t0; 178| 289| t0 = z; 179| 289| t0.square_n(16); 180| 289| z *= t0; 181| 289| z.square_n(32); 182| 289| z *= x; 183| 289| z.square_n(96); 184| 289| z *= x; 185| 289| z.square_n(94); 186| 289| return z; 187| 289| } _ZN5Botan6PCurve14PCurveInstance9secp384r1Ev: 343| 1|std::shared_ptr PCurveInstance::secp384r1() { 344| 1| return PrimeOrderCurveImpl::instance(); 345| 1|} pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE3oneEv: 88| 40.7k| constexpr static std::array one() { return std::array{1}; } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE4redcERKNSt3__15arrayImLm12EEE: 23| 1.60M| constexpr static std::array redc(const std::array& z) { 24| 1.60M| const int64_t X00 = get_uint32(z.data(), 0); 25| 1.60M| const int64_t X01 = get_uint32(z.data(), 1); 26| 1.60M| const int64_t X02 = get_uint32(z.data(), 2); 27| 1.60M| const int64_t X03 = get_uint32(z.data(), 3); 28| 1.60M| const int64_t X04 = get_uint32(z.data(), 4); 29| 1.60M| const int64_t X05 = get_uint32(z.data(), 5); 30| 1.60M| const int64_t X06 = get_uint32(z.data(), 6); 31| 1.60M| const int64_t X07 = get_uint32(z.data(), 7); 32| 1.60M| const int64_t X08 = get_uint32(z.data(), 8); 33| 1.60M| const int64_t X09 = get_uint32(z.data(), 9); 34| 1.60M| const int64_t X10 = get_uint32(z.data(), 10); 35| 1.60M| const int64_t X11 = get_uint32(z.data(), 11); 36| 1.60M| const int64_t X12 = get_uint32(z.data(), 12); 37| 1.60M| const int64_t X13 = get_uint32(z.data(), 13); 38| 1.60M| const int64_t X14 = get_uint32(z.data(), 14); 39| 1.60M| const int64_t X15 = get_uint32(z.data(), 15); 40| 1.60M| const int64_t X16 = get_uint32(z.data(), 16); 41| 1.60M| const int64_t X17 = get_uint32(z.data(), 17); 42| 1.60M| const int64_t X18 = get_uint32(z.data(), 18); 43| 1.60M| const int64_t X19 = get_uint32(z.data(), 19); 44| 1.60M| const int64_t X20 = get_uint32(z.data(), 20); 45| 1.60M| const int64_t X21 = get_uint32(z.data(), 21); 46| 1.60M| const int64_t X22 = get_uint32(z.data(), 22); 47| 1.60M| const int64_t X23 = get_uint32(z.data(), 23); 48| | 49| | // One copy of P-384 is added to prevent underflow 50| 1.60M| const int64_t S0 = 0xFFFFFFFF + X00 + X12 + X20 + X21 - X23; 51| 1.60M| const int64_t S1 = 0x00000000 + X01 + X13 + X22 + X23 - X12 - X20; 52| 1.60M| const int64_t S2 = 0x00000000 + X02 + X14 + X23 - X13 - X21; 53| 1.60M| const int64_t S3 = 0xFFFFFFFF + X03 + X12 + X15 + X20 + X21 - X14 - X22 - X23; 54| 1.60M| const int64_t S4 = 0xFFFFFFFE + X04 + X12 + X13 + X16 + X20 + X21 * 2 + X22 - X15 - X23 * 2; 55| 1.60M| const int64_t S5 = 0xFFFFFFFF + X05 + X13 + X14 + X17 + X21 + X22 * 2 + X23 - X16; 56| 1.60M| const int64_t S6 = 0xFFFFFFFF + X06 + X14 + X15 + X18 + X22 + X23 * 2 - X17; 57| 1.60M| const int64_t S7 = 0xFFFFFFFF + X07 + X15 + X16 + X19 + X23 - X18; 58| 1.60M| const int64_t S8 = 0xFFFFFFFF + X08 + X16 + X17 + X20 - X19; 59| 1.60M| const int64_t S9 = 0xFFFFFFFF + X09 + X17 + X18 + X21 - X20; 60| 1.60M| const int64_t SA = 0xFFFFFFFF + X10 + X18 + X19 + X22 - X21; 61| 1.60M| const int64_t SB = 0xFFFFFFFF + X11 + X19 + X20 + X23 - X22; 62| | 63| 1.60M| std::array r = {}; 64| | 65| 1.60M| SolinasAccum sum(r); 66| | 67| 1.60M| sum.accum(S0); 68| 1.60M| sum.accum(S1); 69| 1.60M| sum.accum(S2); 70| 1.60M| sum.accum(S3); 71| 1.60M| sum.accum(S4); 72| 1.60M| sum.accum(S5); 73| 1.60M| sum.accum(S6); 74| 1.60M| sum.accum(S7); 75| 1.60M| sum.accum(S8); 76| 1.60M| sum.accum(S9); 77| 1.60M| sum.accum(SA); 78| 1.60M| sum.accum(SB); 79| 1.60M| const auto S = sum.final_carry(0); 80| | 81| 1.60M| BOTAN_DEBUG_ASSERT(S <= 4); ------------------ | | 130| 1.60M| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 1.60M| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 1.60M] | | ------------------ ------------------ 82| | 83| 1.60M| solinas_correct_redc(r, P, p384_mul_mod_384(S)); 84| | 85| 1.60M| return r; 86| 1.60M| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE16p384_mul_mod_384Em: 100| 1.60M| constexpr static std::array p384_mul_mod_384(W i) { 101| 1.60M| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 102| | 103| | // For small i, multiples of P-384 have a simple structure so it's faster to 104| | // compute the value directly vs a (constant time) table lookup 105| | 106| 1.60M| auto r = P; 107| | if constexpr(WordInfo::bits == 32) { 108| | r[4] -= i; 109| | r[3] -= i; 110| | r[1] += i; 111| | r[0] -= i; 112| 1.60M| } else { 113| 1.60M| const uint64_t i32 = static_cast(i) << 32; 114| 1.60M| r[2] -= i; 115| 1.60M| r[1] -= i32; 116| 1.60M| r[0] += i32; 117| 1.60M| r[0] -= i; 118| 1.60M| } 119| 1.60M| return r; 120| 1.60M| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp384r15Curve10fe_invert2ERKNS_6IntModINS1_12Secp384r1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 142| 698| static constexpr FieldElement fe_invert2(const FieldElement& x) { 143| | // From https://briansmith.org/ecc-inversion-addition-chains-01 144| | 145| 698| FieldElement r = x.square(); 146| 698| r *= x; 147| 698| const auto x2 = r; 148| 698| r = r.square(); 149| 698| r *= x; 150| 698| const auto x3 = r; 151| 698| r.square_n(3); 152| 698| r *= x3; 153| 698| auto rl = r; 154| 698| r.square_n(6); 155| 698| r *= rl; 156| 698| r.square_n(3); 157| 698| r *= x3; 158| 698| const auto x15 = r; 159| 698| r.square_n(15); 160| 698| r *= x15; 161| 698| const auto x30 = r; 162| 698| r.square_n(30); 163| 698| r *= x30; 164| 698| rl = r; 165| 698| r.square_n(60); 166| 698| r *= rl; 167| 698| rl = r; 168| 698| r.square_n(120); 169| 698| r *= rl; 170| 698| r.square_n(15); 171| 698| r *= x15; 172| 698| r.square_n(31); 173| 698| r *= x30; 174| 698| r.square_n(2); 175| 698| r *= x2; 176| 698| r.square_n(94); 177| 698| r *= x30; 178| 698| r.square_n(2); 179| | 180| 698| return r; 181| 698| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE8from_repERKNSt3__15arrayImLm6EEE: 94| 2.62k| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE6to_repERKNSt3__15arrayImLm6EEE: 90| 2.59k| constexpr static std::array to_rep(const std::array& x) { return x; } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp384r15Curve7fe_sqrtERKNS_6IntModINS1_12Secp384r1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 183| 208| static constexpr FieldElement fe_sqrt(const FieldElement& x) { 184| | // Generated using https://github.com/mmcloughlin/addchain 185| | 186| 208| auto z = x.square(); 187| 208| z *= x; 188| 208| z = z.square(); 189| 208| auto t0 = x * z; 190| 208| z = t0; 191| 208| z.square_n(3); 192| 208| auto t1 = t0 * z; 193| 208| auto t2 = t1.square(); 194| 208| z = t2 * x; 195| 208| t2.square_n(5); 196| 208| t1 *= t2; 197| 208| t2 = t1; 198| 208| t2.square_n(12); 199| 208| t1 *= t2; 200| 208| t1.square_n(7); 201| 208| t1 *= z; 202| 208| z = t1.square(); 203| 208| z *= x; 204| 208| t2 = z; 205| 208| t2.square_n(31); 206| 208| t1 *= t2; 207| 208| t2 = t1; 208| 208| t2.square_n(63); 209| 208| t1 *= t2; 210| 208| t2 = t1; 211| 208| t2.square_n(126); 212| 208| t1 *= t2; 213| 208| t1.square_n(3); 214| 208| t0 *= t1; 215| 208| t0.square_n(33); 216| 208| z *= t0; 217| 208| z.square_n(64); 218| 208| z *= x; 219| 208| z.square_n(30); 220| 208| return z; 221| 208| } _ZN5Botan6PCurve14PCurveInstance9secp521r1Ev: 291| 1|std::shared_ptr PCurveInstance::secp521r1() { 292| 1| return PrimeOrderCurveImpl::instance(); 293| 1|} pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 24| 84.6k| constexpr static std::array one() { return std::array{1}; } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm18EEE: 26| 3.32M| constexpr static std::array redc(const std::array& z) { 27| | // Regardless of word size (32 or 64) the top word is 9 bits long 28| 3.32M| constexpr W TOP_BITS = static_cast(0x1FF); 29| | // The 23 or 55 bits that should be cleared in the top word 30| 3.32M| constexpr W CLEARED_TOP_BITS = WordInfo::max ^ TOP_BITS; 31| | 32| | /* 33| | * Extract the high part of z (z >> 521) 34| | */ 35| 3.32M| std::array t; // NOLINT(*-member-init) 36| | 37| 33.2M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (37:28): [True: 29.9M, False: 3.32M] ------------------ 38| 29.9M| t[i] = z[(N - 1) + i] >> 9; 39| 29.9M| } 40| | 41| 29.9M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (41:28): [True: 26.6M, False: 3.32M] ------------------ 42| 26.6M| t[i] |= z[(N - 1) + i + 1] << (WordInfo::bits - 9); 43| 26.6M| } 44| | 45| | // Now t += z & (2**521-1) 46| 3.32M| W carry = 0; 47| 29.9M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (47:28): [True: 26.6M, False: 3.32M] ------------------ 48| 26.6M| t[i] = word_add(t[i], z[i], &carry); 49| 26.6M| } 50| | 51| | // Now add the (partial) top words; this can't carry out 52| | // since both inputs are at most 2**9-1 53| 3.32M| t[N - 1] += (z[N - 1] & TOP_BITS) + carry; 54| | 55| | /* 56| | Since the modulus P is exactly 2**521 - 1 the only way the computed 57| | result can be larger than P is if the top word is larger than TOP_BITS 58| | 59| | Since TOP_BITS has the low 9 bits set, we can check if t[N - 1] > TOP_BITS 60| | by checking if t[N - 1] >> 9 has any bits set. Doing it this way is 61| | faster than a standard comparison since CT::Mask::is_gt requires 62| | several bit operations. 63| | */ 64| | 65| 3.32M| const W is_over_p521 = ~CT::Mask::is_zero(t[N - 1] >> 9).value(); 66| | 67| | /* 68| | * Also must detect/handle x == P 69| | */ 70| 3.32M| const W is_eq_p521 = [&]() { 71| 3.32M| W sum = WordInfo::max; 72| 3.32M| for(size_t i = 0; i != N - 1; ++i) { 73| 3.32M| sum &= t[i]; 74| 3.32M| } 75| 3.32M| sum &= (CLEARED_TOP_BITS | t[N - 1]); 76| | 77| 3.32M| return CT::Mask::is_zero(sum ^ WordInfo::max).value(); 78| 3.32M| }(); 79| | 80| 3.32M| const W need_sub = is_over_p521 | is_eq_p521; 81| | 82| 3.32M| W borrow = 0; 83| 29.9M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (83:28): [True: 26.6M, False: 3.32M] ------------------ 84| 26.6M| t[i] = word_sub(t[i], need_sub & WordInfo::max, &borrow); 85| 26.6M| } 86| 3.32M| t[N - 1] = word_sub(t[N - 1], need_sub & TOP_BITS, &borrow); 87| | 88| 3.32M| return t; 89| 3.32M| } pcurves_secp521r1.cpp:_ZZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm18EEEENKUlvE_clEv: 70| 3.32M| const W is_eq_p521 = [&]() { 71| 3.32M| W sum = WordInfo::max; 72| 29.9M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (72:31): [True: 26.6M, False: 3.32M] ------------------ 73| 26.6M| sum &= t[i]; 74| 26.6M| } 75| 3.32M| sum &= (CLEARED_TOP_BITS | t[N - 1]); 76| | 77| 3.32M| return CT::Mask::is_zero(sum ^ WordInfo::max).value(); 78| 3.32M| }(); pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r15Curve10fe_invert2ERKNS_6IntModINS2_7P521RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 115| 1.10k| static constexpr FieldElement fe_invert2(const FieldElement& x) { 116| | // Addition chain from https://eprint.iacr.org/2014/852.pdf page 6 117| | 118| 1.10k| FieldElement r = x.square(); 119| 1.10k| r *= x; 120| 1.10k| r = r.square(); 121| 1.10k| r *= x; 122| 1.10k| FieldElement rl = r; 123| 1.10k| r.square_n(3); 124| 1.10k| r *= rl; 125| 1.10k| r.square_n(1); 126| 1.10k| r *= x; 127| 1.10k| const auto a7 = r; 128| 1.10k| r.square_n(1); 129| 1.10k| r *= x; 130| 1.10k| rl = r; 131| 1.10k| r.square_n(8); 132| 1.10k| r *= rl; 133| 1.10k| rl = r; 134| 1.10k| r.square_n(16); 135| 1.10k| r *= rl; 136| 1.10k| rl = r; 137| 1.10k| r.square_n(32); 138| 1.10k| r *= rl; 139| 1.10k| rl = r; 140| 1.10k| r.square_n(64); 141| 1.10k| r *= rl; 142| 1.10k| rl = r; 143| 1.10k| r.square_n(128); 144| 1.10k| r *= rl; 145| 1.10k| rl = r; 146| 1.10k| r.square_n(256); 147| 1.10k| r *= rl; 148| 1.10k| r.square_n(7); 149| 1.10k| r *= a7; 150| 1.10k| r.square_n(2); 151| | 152| 1.10k| return r; 153| 1.10k| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm9EEE: 95| 4.13k| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm9EEE: 91| 4.20k| constexpr static std::array to_rep(const std::array& x) { return x; } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r15Curve7fe_sqrtERKNS_6IntModINS2_7P521RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 155| 327| static constexpr FieldElement fe_sqrt(const FieldElement& x) { 156| 327| auto z = x; 157| 327| z.square_n(519); 158| 327| return z; 159| 327| } _ZN5Botan9AEAD_Mode15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_10Cipher_DirES5_: 55| 239| std::string_view provider) { 56| 239| if(auto aead = AEAD_Mode::create(algo, dir, provider)) { ------------------ | Branch (56:12): [True: 239, False: 0] ------------------ 57| 239| return aead; 58| 239| } 59| | 60| 0| throw Lookup_Error("AEAD", algo, provider); 61| 239|} _ZN5Botan9AEAD_Mode6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_10Cipher_DirES5_: 63| 478|std::unique_ptr AEAD_Mode::create(std::string_view algo, Cipher_Dir dir, std::string_view provider) { 64| 478| BOTAN_UNUSED(provider); ------------------ | | 144| 478|#define BOTAN_UNUSED Botan::ignore_params ------------------ 65| 478|#if defined(BOTAN_HAS_AEAD_CHACHA20_POLY1305) 66| 478| if(algo == "ChaCha20Poly1305") { ------------------ | Branch (66:7): [True: 0, False: 478] ------------------ 67| 0| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (67:10): [True: 0, False: 0] ------------------ 68| 0| return std::make_unique(); 69| 0| } else { 70| 0| return std::make_unique(); 71| 0| } 72| 0| } 73| 478|#endif 74| | 75| 478|#if defined(BOTAN_HAS_ASCON_AEAD128) 76| 478| if(algo == "Ascon-AEAD128") { ------------------ | Branch (76:7): [True: 0, False: 478] ------------------ 77| 0| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (77:10): [True: 0, False: 0] ------------------ 78| 0| return std::make_unique(); 79| 0| } else { 80| 0| return std::make_unique(); 81| 0| } 82| 0| } 83| 478|#endif 84| | 85| 478| if(algo.find('/') != std::string::npos) { ------------------ | Branch (85:7): [True: 239, False: 239] ------------------ 86| 239| const std::vector algo_parts = split_on(algo, '/'); 87| 239| if(algo_parts.size() < 2) { ------------------ | Branch (87:10): [True: 0, False: 239] ------------------ 88| 0| return std::unique_ptr(); 89| 0| } 90| 239| const std::string_view cipher_name = algo_parts[0]; 91| 239| const std::vector mode_info = parse_algorithm_name(algo_parts[1]); 92| | 93| 239| if(mode_info.empty()) { ------------------ | Branch (93:10): [True: 0, False: 239] ------------------ 94| 0| return std::unique_ptr(); 95| 0| } 96| | 97| 239| std::ostringstream mode_name; 98| | 99| 239| mode_name << mode_info[0] << '(' << cipher_name; 100| 346| for(size_t i = 1; i < mode_info.size(); ++i) { ------------------ | Branch (100:25): [True: 107, False: 239] ------------------ 101| 107| mode_name << ',' << mode_info[i]; 102| 107| } 103| 239| for(size_t i = 2; i < algo_parts.size(); ++i) { ------------------ | Branch (103:25): [True: 0, False: 239] ------------------ 104| 0| mode_name << ',' << algo_parts[i]; 105| 0| } 106| 239| mode_name << ')'; 107| | 108| 239| return AEAD_Mode::create(mode_name.str(), dir); 109| 239| } 110| | 111| 239|#if defined(BOTAN_HAS_BLOCK_CIPHER) 112| | 113| 239| const SCAN_Name req(algo); 114| | 115| 239| if(req.arg_count() == 0) { ------------------ | Branch (115:7): [True: 0, False: 239] ------------------ 116| 0| return std::unique_ptr(); 117| 0| } 118| | 119| 239| auto bc = BlockCipher::create(req.arg(0), provider); 120| | 121| 239| if(!bc) { ------------------ | Branch (121:7): [True: 0, False: 239] ------------------ 122| 0| return std::unique_ptr(); 123| 0| } 124| | 125| 239| #if defined(BOTAN_HAS_AEAD_CCM) 126| 239| if(req.algo_name() == "CCM") { ------------------ | Branch (126:7): [True: 47, False: 192] ------------------ 127| 47| const size_t tag_len = req.arg_as_integer(1, 16); 128| 47| const size_t L_len = req.arg_as_integer(2, 3); 129| 47| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (129:10): [True: 3, False: 44] ------------------ 130| 3| return std::make_unique(std::move(bc), tag_len, L_len); 131| 44| } else { 132| 44| return std::make_unique(std::move(bc), tag_len, L_len); 133| 44| } 134| 47| } 135| 192| #endif 136| | 137| 192| #if defined(BOTAN_HAS_AEAD_GCM) 138| 192| if(req.algo_name() == "GCM") { ------------------ | Branch (138:7): [True: 114, False: 78] ------------------ 139| 114| const size_t tag_len = req.arg_as_integer(1, 16); 140| 114| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (140:10): [True: 18, False: 96] ------------------ 141| 18| return std::make_unique(std::move(bc), tag_len); 142| 96| } else { 143| 96| return std::make_unique(std::move(bc), tag_len); 144| 96| } 145| 114| } 146| 78| #endif 147| | 148| 78| #if defined(BOTAN_HAS_AEAD_GCM_SIV) 149| 78| if(req.algo_name() == "GCM-SIV") { ------------------ | Branch (149:7): [True: 0, False: 78] ------------------ 150| | // Unlike GCM the tag length is fixed, so reject eg "AES-128/GCM-SIV(12)" 151| 0| if(req.arg_count() != 1) { ------------------ | Branch (151:10): [True: 0, False: 0] ------------------ 152| 0| return std::unique_ptr(); 153| 0| } 154| 0| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (154:10): [True: 0, False: 0] ------------------ 155| 0| return std::make_unique(std::move(bc)); 156| 0| } else { 157| 0| return std::make_unique(std::move(bc)); 158| 0| } 159| 0| } 160| 78| #endif 161| | 162| 78| #if defined(BOTAN_HAS_AEAD_OCB) 163| 78| if(req.algo_name() == "OCB") { ------------------ | Branch (163:7): [True: 78, False: 0] ------------------ 164| 78| const size_t tag_len = req.arg_as_integer(1, 16); 165| 78| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (165:10): [True: 12, False: 66] ------------------ 166| 12| return std::make_unique(std::move(bc), tag_len); 167| 66| } else { 168| 66| return std::make_unique(std::move(bc), tag_len); 169| 66| } 170| 78| } 171| 0| #endif 172| | 173| 0| #if defined(BOTAN_HAS_AEAD_EAX) 174| 0| if(req.algo_name() == "EAX") { ------------------ | Branch (174:7): [True: 0, False: 0] ------------------ 175| 0| const size_t tag_len = req.arg_as_integer(1, bc->block_size()); 176| 0| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (176:10): [True: 0, False: 0] ------------------ 177| 0| return std::make_unique(std::move(bc), tag_len); 178| 0| } else { 179| 0| return std::make_unique(std::move(bc), tag_len); 180| 0| } 181| 0| } 182| 0| #endif 183| | 184| 0| #if defined(BOTAN_HAS_AEAD_SIV) 185| 0| if(req.algo_name() == "SIV") { ------------------ | Branch (185:7): [True: 0, False: 0] ------------------ 186| 0| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (186:10): [True: 0, False: 0] ------------------ 187| 0| return std::make_unique(std::move(bc)); 188| 0| } else { 189| 0| return std::make_unique(std::move(bc)); 190| 0| } 191| 0| } 192| 0| #endif 193| | 194| 0|#endif 195| | 196| 0| return std::unique_ptr(); 197| 0|} _ZN5Botan8CCM_ModeC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEmm: 27| 47| m_tag_size(tag_size), m_L(L), m_cipher(std::move(cipher)) { 28| 47| if(m_cipher->block_size() != CCM_BS) { ------------------ | Branch (28:7): [True: 0, False: 47] ------------------ 29| 0| throw Invalid_Argument(m_cipher->name() + " cannot be used with CCM mode"); 30| 0| } 31| | 32| 47| if(L < 2 || L > 8) { ------------------ | Branch (32:7): [True: 0, False: 47] | Branch (32:16): [True: 0, False: 47] ------------------ 33| 0| throw Invalid_Argument(fmt("Invalid CCM L value {}", L)); 34| 0| } 35| | 36| 47| if(tag_size < 4 || tag_size > 16 || tag_size % 2 != 0) { ------------------ | Branch (36:7): [True: 0, False: 47] | Branch (36:23): [True: 0, False: 47] | Branch (36:40): [True: 0, False: 47] ------------------ 37| 0| throw Invalid_Argument(fmt("Invalid CCM tag length {}", tag_size)); 38| 0| } 39| 47|} _ZN5Botan8CCM_Mode5resetEv: 47| 85|void CCM_Mode::reset() { 48| 85| m_nonce.clear(); 49| 85| m_msg_buf.clear(); 50| 85|} _ZNK5Botan8CCM_Mode18valid_nonce_lengthEm: 56| 38|bool CCM_Mode::valid_nonce_length(size_t length) const { 57| 38| return (length == (15 - L())); 58| 38|} _ZNK5Botan8CCM_Mode8key_specEv: 77| 47|Key_Length_Specification CCM_Mode::key_spec() const { 78| 47| return m_cipher->key_spec(); 79| 47|} _ZN5Botan8CCM_Mode12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 85| 47|void CCM_Mode::key_schedule(std::span key) { 86| 47| m_cipher->set_key(key); 87| | // Clear any per-message state; AD is preserved per AEAD contract 88| | // (CCM advertises associated_data_requires_key() == false). 89| 47| reset(); 90| 47|} _ZN5Botan8CCM_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE: 92| 38|void CCM_Mode::set_associated_data_n(size_t idx, std::span ad) { 93| 38| BOTAN_ARG_CHECK(idx == 0, "CCM: cannot handle non-zero index in set_associated_data_n"); ------------------ | | 35| 38| do { \ | | 36| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 38| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 38] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 38| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 38] | | ------------------ ------------------ 94| 38| BOTAN_STATE_CHECK(m_nonce.empty()); ------------------ | | 51| 38| do { \ | | 52| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 38| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 38] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 38| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 38] | | ------------------ ------------------ 95| | 96| 38| m_ad_buf.clear(); 97| | 98| 38| if(!ad.empty()) { ------------------ | Branch (98:7): [True: 38, False: 0] ------------------ 99| | // FIXME: support larger AD using length encoding rules 100| 38| BOTAN_ARG_CHECK(ad.size() < (0xFFFF - 0xFF), "Supported CCM AD length"); ------------------ | | 35| 38| do { \ | | 36| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 38| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 38] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 38| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 38] | | ------------------ ------------------ 101| | 102| 38| m_ad_buf.push_back(get_byte<0>(static_cast(ad.size()))); 103| 38| m_ad_buf.push_back(get_byte<1>(static_cast(ad.size()))); 104| 38| m_ad_buf.insert(m_ad_buf.end(), ad.begin(), ad.end()); 105| 76| while(m_ad_buf.size() % CCM_BS != 0) { ------------------ | Branch (105:13): [True: 38, False: 38] ------------------ 106| 38| m_ad_buf.push_back(0); // pad with zeros to full block size 107| 38| } 108| 38| } 109| 38|} _ZN5Botan8CCM_Mode9start_msgEPKhm: 111| 38|void CCM_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) { 112| 38| BOTAN_STATE_CHECK(m_nonce.empty()); ------------------ | | 51| 38| do { \ | | 52| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 38| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 38] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 38| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 38] | | ------------------ ------------------ 113| | 114| 38| if(!valid_nonce_length(nonce_len)) { ------------------ | Branch (114:7): [True: 0, False: 38] ------------------ 115| 0| throw Invalid_IV_Length(name(), nonce_len); 116| 0| } 117| | 118| 38| m_nonce.assign(nonce, nonce + nonce_len); 119| 38| m_msg_buf.clear(); 120| 38|} _ZN5Botan8CCM_Mode13encode_lengthEmPh: 137| 38|void CCM_Mode::encode_length(uint64_t len, uint8_t out[]) { 138| 38| const size_t len_bytes = L(); 139| | 140| 38| BOTAN_ASSERT_NOMSG(len_bytes >= 2 && len_bytes <= 8); ------------------ | | 77| 38| do { \ | | 78| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 76| if(!(expr)) { \ | | ------------------ | | | Branch (79:12): [True: 38, False: 0] | | | Branch (79:12): [True: 38, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 38| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 38] | | ------------------ ------------------ 141| | 142| 152| for(size_t i = 0; i != len_bytes; ++i) { ------------------ | Branch (142:22): [True: 114, False: 38] ------------------ 143| 114| out[len_bytes - 1 - i] = get_byte_var(sizeof(uint64_t) - 1 - i, len); 144| 114| } 145| | 146| 38| if(len_bytes < 8 && (len >> (len_bytes * 8)) > 0) { ------------------ | Branch (146:7): [True: 38, False: 0] | Branch (146:24): [True: 0, False: 38] ------------------ 147| 0| throw Encoding_Error("CCM message length too long to encode in L field"); 148| 0| } 149| 38|} _ZN5Botan8CCM_Mode3incERNSt3__16vectorIhNS_16secure_allocatorIhEEEE: 151| 1.86k|void CCM_Mode::inc(secure_vector& C) { 152| 1.86k| for(size_t i = 0; i != C.size(); ++i) { ------------------ | Branch (152:22): [True: 1.86k, False: 0] ------------------ 153| 1.86k| uint8_t& b = C[C.size() - i - 1]; 154| 1.86k| b += 1; 155| 1.86k| if(b > 0) { ------------------ | Branch (155:10): [True: 1.86k, False: 3] ------------------ 156| 1.86k| break; 157| 1.86k| } 158| 1.86k| } 159| 1.86k|} _ZN5Botan8CCM_Mode9format_b0Em: 161| 38|secure_vector CCM_Mode::format_b0(size_t sz) { 162| 38| if(m_nonce.size() != 15 - L()) { ------------------ | Branch (162:7): [True: 0, False: 38] ------------------ 163| 0| throw Invalid_State("CCM mode must set nonce"); 164| 0| } 165| 38| secure_vector B0(CCM_BS); 166| | 167| 38| const uint8_t b_flags = 168| 38| static_cast((!m_ad_buf.empty() ? 64 : 0) + (((tag_size() / 2) - 1) << 3) + (L() - 1)); ------------------ | Branch (168:29): [True: 38, False: 0] ------------------ 169| | 170| 38| B0[0] = b_flags; 171| 38| copy_mem(&B0[1], m_nonce.data(), m_nonce.size()); 172| 38| encode_length(sz, &B0[m_nonce.size() + 1]); 173| | 174| 38| return B0; 175| 38|} _ZN5Botan8CCM_Mode9format_c0Ev: 177| 38|secure_vector CCM_Mode::format_c0() { 178| 38| if(m_nonce.size() != 15 - L()) { ------------------ | Branch (178:7): [True: 0, False: 38] ------------------ 179| 0| throw Invalid_State("CCM mode must set nonce"); 180| 0| } 181| 38| secure_vector C(CCM_BS); 182| | 183| 38| const uint8_t a_flags = static_cast(L() - 1); 184| | 185| 38| C[0] = a_flags; 186| 38| copy_mem(&C[1], m_nonce.data(), m_nonce.size()); 187| | 188| 38| return C; 189| 38|} _ZNK5Botan14CCM_Encryption13output_lengthEm: 191| 5|size_t CCM_Encryption::output_length(size_t input_length) const { 192| 5| return add_or_throw(input_length, tag_size(), "CCM input too large"); 193| 5|} _ZN5Botan14CCM_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 195| 5|void CCM_Encryption::finish_msg(secure_vector& buffer, size_t offset) { 196| 5| BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range"); ------------------ | | 35| 5| do { \ | | 36| 5| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 5| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 5] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 5| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 5] | | ------------------ ------------------ 197| | 198| 5| buffer.insert(buffer.begin() + offset, msg_buf().begin(), msg_buf().end()); 199| | 200| 5| const size_t sz = buffer.size() - offset; 201| 5| uint8_t* buf = buffer.data() + offset; 202| | 203| 5| const secure_vector& ad = ad_buf(); 204| 5| BOTAN_ARG_CHECK(ad.size() % CCM_BS == 0, "AD is block size multiple"); ------------------ | | 35| 5| do { \ | | 36| 5| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 5| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 5] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 5| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 5] | | ------------------ ------------------ 205| | 206| 5| const BlockCipher& E = cipher(); 207| | 208| 5| secure_vector T(CCM_BS); 209| 5| E.encrypt(format_b0(sz), T); 210| | 211| 10| for(size_t i = 0; i != ad.size(); i += CCM_BS) { ------------------ | Branch (211:22): [True: 5, False: 5] ------------------ 212| 5| xor_buf(T.data(), &ad[i], CCM_BS); 213| 5| E.encrypt(T); 214| 5| } 215| | 216| 5| secure_vector C = format_c0(); 217| 5| secure_vector S0(CCM_BS); 218| 5| E.encrypt(C, S0); 219| 5| inc(C); 220| | 221| 5| secure_vector X(CCM_BS); 222| | 223| 5| const uint8_t* buf_end = &buf[sz]; 224| | 225| 10| while(buf != buf_end) { ------------------ | Branch (225:10): [True: 5, False: 5] ------------------ 226| 5| const size_t to_proc = std::min(CCM_BS, buf_end - buf); 227| | 228| 5| xor_buf(T.data(), buf, to_proc); 229| 5| E.encrypt(T); 230| | 231| 5| E.encrypt(C, X); 232| 5| xor_buf(buf, X.data(), to_proc); 233| 5| inc(C); 234| | 235| 5| buf += to_proc; 236| 5| } 237| | 238| 5| T ^= S0; 239| | 240| 5| buffer += std::make_pair(T.data(), tag_size()); 241| | 242| 5| reset(); 243| 5|} _ZNK5Botan14CCM_Decryption13output_lengthEm: 245| 33|size_t CCM_Decryption::output_length(size_t input_length) const { 246| 33| BOTAN_ARG_CHECK(input_length >= tag_size(), "Message too short to be valid"); ------------------ | | 35| 33| do { \ | | 36| 33| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 33| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 33] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 33| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 33] | | ------------------ ------------------ 247| 33| return input_length - tag_size(); 248| 33|} _ZN5Botan14CCM_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 250| 33|void CCM_Decryption::finish_msg(secure_vector& buffer, size_t offset) { 251| 33| BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range"); ------------------ | | 35| 33| do { \ | | 36| 33| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 33| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 33] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 33| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 33] | | ------------------ ------------------ 252| | 253| 33| buffer.insert(buffer.begin() + offset, msg_buf().begin(), msg_buf().end()); 254| | 255| 33| const size_t sz = buffer.size() - offset; 256| 33| uint8_t* buf = buffer.data() + offset; 257| | 258| 33| BOTAN_ARG_CHECK(sz >= tag_size(), "input did not include the tag"); ------------------ | | 35| 33| do { \ | | 36| 33| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 33| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 33] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 33| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 33] | | ------------------ ------------------ 259| | 260| 33| const secure_vector& ad = ad_buf(); 261| 33| BOTAN_ARG_CHECK(ad.size() % CCM_BS == 0, "AD is block size multiple"); ------------------ | | 35| 33| do { \ | | 36| 33| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 33| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 33] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 33| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 33] | | ------------------ ------------------ 262| | 263| 33| const BlockCipher& E = cipher(); 264| | 265| 33| secure_vector T(CCM_BS); 266| 33| E.encrypt(format_b0(sz - tag_size()), T); 267| | 268| 66| for(size_t i = 0; i != ad.size(); i += CCM_BS) { ------------------ | Branch (268:22): [True: 33, False: 33] ------------------ 269| 33| xor_buf(T.data(), &ad[i], CCM_BS); 270| 33| E.encrypt(T); 271| 33| } 272| | 273| 33| secure_vector C = format_c0(); 274| | 275| 33| secure_vector S0(CCM_BS); 276| 33| E.encrypt(C, S0); 277| 33| inc(C); 278| | 279| 33| secure_vector X(CCM_BS); 280| | 281| 33| const uint8_t* buf_end = &buf[sz - tag_size()]; 282| | 283| 1.85k| while(buf != buf_end) { ------------------ | Branch (283:10): [True: 1.82k, False: 33] ------------------ 284| 1.82k| const size_t to_proc = std::min(CCM_BS, buf_end - buf); 285| | 286| 1.82k| E.encrypt(C, X); 287| 1.82k| xor_buf(buf, X.data(), to_proc); 288| 1.82k| inc(C); 289| | 290| 1.82k| xor_buf(T.data(), buf, to_proc); 291| 1.82k| E.encrypt(T); 292| | 293| 1.82k| buf += to_proc; 294| 1.82k| } 295| | 296| 33| T ^= S0; 297| | 298| 33| if(!CT::is_equal(T.data(), buf_end, tag_size()).as_bool()) { ------------------ | Branch (298:7): [True: 33, False: 0] ------------------ 299| 33| clear_mem(std::span{buffer}.subspan(offset, sz - tag_size())); 300| | // Reset on the failure path too, matching GCM/SIV/ChaCha20Poly1305, so a 301| | // failed decryptor is reusable rather than stuck in a partial state. 302| 33| reset(); 303| 33| throw Invalid_Authentication_Tag("CCM tag check failed"); 304| 33| } 305| | 306| 0| buffer.resize(buffer.size() - tag_size()); 307| | 308| 0| reset(); 309| 0|} _ZN5Botan8GCM_ModeC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm: 27| 114| m_tag_size(tag_size), m_cipher_name(cipher->name()) { 28| 114| if(cipher->block_size() != GCM_BS) { ------------------ | Branch (28:7): [True: 0, False: 114] ------------------ 29| 0| throw Invalid_Argument("Invalid block cipher for GCM"); 30| 0| } 31| | 32| | /* We allow any of the values 128, 120, 112, 104, or 96 bits as a tag size */ 33| | /* 64 bit tag is still supported but deprecated and will be removed in the future */ 34| 114| if(m_tag_size != 8 && (m_tag_size < 12 || m_tag_size > 16)) { ------------------ | Branch (34:7): [True: 114, False: 0] | Branch (34:27): [True: 0, False: 114] | Branch (34:46): [True: 0, False: 114] ------------------ 35| 0| throw Invalid_Argument(fmt("{} cannot use a tag of {} bytes", name(), m_tag_size)); 36| 0| } 37| | 38| 114| m_ctr = std::make_unique(std::move(cipher), 4); 39| 114| m_ghash = std::make_unique(); 40| 114|} _ZN5Botan8GCM_ModeD2Ev: 42| 114|GCM_Mode::~GCM_Mode() = default; _ZN5Botan8GCM_Mode5resetEv: 50| 114|void GCM_Mode::reset() { 51| 114| m_ghash->reset_state(); 52| 114| m_in_msg = false; 53| 114|} _ZNK5Botan8GCM_Mode18valid_nonce_lengthEm: 71| 109|bool GCM_Mode::valid_nonce_length(size_t len) const { 72| | // GCM does not support empty nonces 73| 109| return (len > 0); 74| 109|} _ZNK5Botan8GCM_Mode8key_specEv: 76| 114|Key_Length_Specification GCM_Mode::key_spec() const { 77| 114| return m_ctr->key_spec(); 78| 114|} _ZN5Botan8GCM_Mode12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 84| 114|void GCM_Mode::key_schedule(std::span key) { 85| 114| reset(); 86| 114| m_ctr->set_key(key); 87| | 88| 114| std::array zeros{}; 89| 114| m_ctr->set_iv(zeros); 90| | 91| 114| uint8_t H[GCM_BS] = {0}; 92| 114| m_ctr->encipher(H); 93| 114| m_ghash->set_key(H); 94| 114|} _ZN5Botan8GCM_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE: 96| 109|void GCM_Mode::set_associated_data_n(size_t idx, std::span ad) { 97| 109| BOTAN_ARG_CHECK(idx == 0, "GCM: cannot handle non-zero index in set_associated_data_n"); ------------------ | | 35| 109| do { \ | | 36| 109| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 109| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 109] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 109| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 109] | | ------------------ ------------------ 98| 109| m_ghash->set_associated_data(ad); 99| 109|} _ZN5Botan8GCM_Mode9start_msgEPKhm: 101| 109|void GCM_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) { 102| 109| BOTAN_STATE_CHECK(!m_in_msg); ------------------ | | 51| 109| do { \ | | 52| 109| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 109| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 109] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 109| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 109] | | ------------------ ------------------ 103| | 104| 109| if(!valid_nonce_length(nonce_len)) { ------------------ | Branch (104:7): [True: 0, False: 109] ------------------ 105| 0| throw Invalid_IV_Length(name(), nonce_len); 106| 0| } 107| | 108| 109| std::array y0 = {}; 109| | 110| 109| if(nonce_len == 12) { ------------------ | Branch (110:7): [True: 109, False: 0] ------------------ 111| 109| copy_mem(y0.data(), nonce, nonce_len); 112| 109| y0[15] = 1; 113| 109| } else { 114| 0| m_ghash->nonce_hash(std::span(y0), {nonce, nonce_len}); 115| 0| } 116| | 117| 109| m_ctr->set_iv(y0.data(), y0.size()); 118| | 119| 109| clear_mem(y0.data(), y0.size()); 120| 109| m_ctr->encipher(y0); 121| | 122| 109| m_ghash->start(y0); 123| 109| secure_scrub_memory(y0); 124| 109| m_in_msg = true; 125| 109|} _ZNK5Botan14GCM_Encryption13output_lengthEm: 127| 33|size_t GCM_Encryption::output_length(size_t input_length) const { 128| 33| return add_or_throw(input_length, tag_size(), "GCM input too large"); 129| 33|} _ZN5Botan14GCM_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 139| 33|void GCM_Encryption::finish_msg(secure_vector& buffer, size_t offset) { 140| 33| BOTAN_STATE_CHECK(m_in_msg); ------------------ | | 51| 33| do { \ | | 52| 33| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 33| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 33] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 33| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 33] | | ------------------ ------------------ 141| 33| BOTAN_ARG_CHECK(offset <= buffer.size(), "Invalid offset"); ------------------ | | 35| 33| do { \ | | 36| 33| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 33| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 33] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 33| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 33] | | ------------------ ------------------ 142| 33| const size_t sz = buffer.size() - offset; 143| 33| uint8_t* buf = buffer.data() + offset; 144| | 145| 33| m_ctr->cipher(buf, buf, sz); 146| 33| m_ghash->update({buf, sz}); 147| | 148| 33| std::array mac = {0}; 149| 33| m_ghash->final(std::span(mac).first(tag_size())); 150| 33| buffer += std::make_pair(mac.data(), tag_size()); 151| 33| m_in_msg = false; 152| 33|} _ZNK5Botan14GCM_Decryption13output_lengthEm: 154| 76|size_t GCM_Decryption::output_length(size_t input_length) const { 155| 76| BOTAN_ARG_CHECK(input_length >= tag_size(), "Message too short to be valid"); ------------------ | | 35| 76| do { \ | | 36| 76| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 76| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 76] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 76| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 76] | | ------------------ ------------------ 156| 76| return input_length - tag_size(); 157| 76|} _ZN5Botan14GCM_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 167| 76|void GCM_Decryption::finish_msg(secure_vector& buffer, size_t offset) { 168| 76| BOTAN_STATE_CHECK(m_in_msg); ------------------ | | 51| 76| do { \ | | 52| 76| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 76| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 76] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 76| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 76] | | ------------------ ------------------ 169| 76| BOTAN_ARG_CHECK(offset <= buffer.size(), "Invalid offset"); ------------------ | | 35| 76| do { \ | | 36| 76| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 76| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 76] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 76| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 76] | | ------------------ ------------------ 170| 76| const size_t sz = buffer.size() - offset; 171| 76| uint8_t* buf = buffer.data() + offset; 172| | 173| 76| BOTAN_ARG_CHECK(sz >= tag_size(), "input did not include the tag"); ------------------ | | 35| 76| do { \ | | 36| 76| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 76| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 76] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 76| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 76] | | ------------------ ------------------ 174| | 175| 76| const size_t remaining = sz - tag_size(); 176| | 177| | // handle any final input before the tag 178| 76| if(remaining > 0) { ------------------ | Branch (178:7): [True: 75, False: 1] ------------------ 179| 75| m_ghash->update({buf, remaining}); 180| 75| m_ctr->cipher(buf, buf, remaining); 181| 75| } 182| | 183| 76| std::array mac = {0}; 184| 76| m_ghash->final(std::span(mac).first(tag_size())); 185| | 186| 76| const uint8_t* included_tag = &buffer[remaining + offset]; 187| | 188| 76| m_in_msg = false; 189| | 190| 76| if(!CT::is_equal(mac.data(), included_tag, tag_size()).as_bool()) { ------------------ | Branch (190:7): [True: 76, False: 0] ------------------ 191| 76| clear_mem(std::span{buffer}.subspan(offset, remaining)); 192| 76| throw Invalid_Authentication_Tag("GCM tag check failed"); 193| 76| } 194| | 195| 0| buffer.resize(offset + remaining); 196| 0|} _ZN5Botan8OCB_ModeC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm: 166| 78| m_cipher(std::move(cipher)), 167| 78| m_checksum(m_cipher->parallel_bytes()), 168| 78| m_ad_hash(m_cipher->block_size()), 169| 78| m_tag_size(tag_size), 170| 78| m_block_size(m_cipher->block_size()), 171| 78| m_par_blocks(m_cipher->parallel_bytes() / m_block_size) { 172| 78| const size_t BS = block_size(); 173| | 174| | /* 175| | * draft-krovetz-ocb-wide-d1 specifies OCB for several other block 176| | * sizes but only 128, 192, 256 and 512 bit are currently supported 177| | * by this implementation. 178| | */ 179| 78| BOTAN_ARG_CHECK(BS == 16 || BS == 24 || BS == 32 || BS == 64, "Invalid block size for OCB"); ------------------ | | 35| 78| do { \ | | 36| 78| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 234| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 78, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 78| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 78] | | ------------------ ------------------ 180| | 181| 78| BOTAN_ARG_CHECK(m_tag_size % 4 == 0 && m_tag_size >= 8 && m_tag_size <= BS && m_tag_size <= 32, ------------------ | | 35| 78| do { \ | | 36| 78| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 468| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 78, False: 0] | | | Branch (37:12): [True: 78, False: 0] | | | Branch (37:12): [True: 78, False: 0] | | | Branch (37:12): [True: 78, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 78| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 78] | | ------------------ ------------------ 182| 78| "Invalid OCB tag length"); 183| 78|} _ZN5Botan8OCB_ModeD2Ev: 185| 78|OCB_Mode::~OCB_Mode() = default; _ZN5Botan8OCB_Mode5resetEv: 194| 156|void OCB_Mode::reset() { 195| 156| m_block_index = 0; 196| 156| zeroise(m_checksum); 197| 156| m_last_nonce.clear(); 198| 156| m_stretch.clear(); 199| 156| zeroise(m_nonce_buf); 200| 156| zeroise(m_offset); 201| 156| if(m_L) { ------------------ | Branch (201:7): [True: 156, False: 0] ------------------ 202| 156| m_L->reset(); 203| 156| } 204| 156|} _ZNK5Botan8OCB_Mode18valid_nonce_lengthEm: 206| 78|bool OCB_Mode::valid_nonce_length(size_t length) const { 207| 78| if(length == 0) { ------------------ | Branch (207:7): [True: 0, False: 78] ------------------ 208| 0| return false; 209| 0| } 210| 78| if(block_size() == 16) { ------------------ | Branch (210:7): [True: 78, False: 0] ------------------ 211| 78| return length < 16; 212| 78| } else { 213| 0| return length < (block_size() - 1); 214| 0| } 215| 78|} _ZNK5Botan8OCB_Mode8key_specEv: 229| 78|Key_Length_Specification OCB_Mode::key_spec() const { 230| 78| return m_cipher->key_spec(); 231| 78|} _ZNK5Botan8OCB_Mode19has_keying_materialEv: 233| 310|bool OCB_Mode::has_keying_material() const { 234| 310| return m_cipher->has_keying_material(); 235| 310|} _ZN5Botan8OCB_Mode12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 237| 78|void OCB_Mode::key_schedule(std::span key) { 238| 78| m_cipher->set_key(key); 239| 78| m_L = std::make_unique(*m_cipher); 240| | 241| | // Drop all key-dependent per-message state: m_last_nonce/m_stretch are 242| | // cached for the update_nonce() fast path and would otherwise allow a 243| | // start_msg() with a same-valued nonce under the new key to silently 244| | // reuse the stretch computed under the previous key. 245| 78| reset(); 246| | 247| | // m_ad_hash was precomputed against the previous L values and cipher 248| | // key. Re-keying invalidates it; AD must be re-set after set_key. 249| 78| zeroise(m_ad_hash); 250| 78|} _ZN5Botan8OCB_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE: 252| 78|void OCB_Mode::set_associated_data_n(size_t idx, std::span ad) { 253| 78| BOTAN_ARG_CHECK(idx == 0, "OCB: cannot handle non-zero index in set_associated_data_n"); ------------------ | | 35| 78| do { \ | | 36| 78| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 78| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 78] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 78| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 78] | | ------------------ ------------------ 254| 78| assert_key_material_set(); 255| 78| BOTAN_STATE_CHECK(!m_L->initialized()); ------------------ | | 51| 78| do { \ | | 52| 78| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 78| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 78] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 78| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 78] | | ------------------ ------------------ 256| 78| m_ad_hash = ocb_hash(*m_L, *m_cipher, ad.data(), ad.size()); 257| 78|} _ZN5Botan8OCB_Mode12update_nonceEPKhm: 259| 78|const secure_vector& OCB_Mode::update_nonce(const uint8_t nonce[], size_t nonce_len) { 260| 78| const size_t BS = block_size(); 261| | 262| 78| BOTAN_ASSERT(BS == 16 || BS == 24 || BS == 32 || BS == 64, "OCB block size is supported"); ------------------ | | 64| 78| do { \ | | 65| 78| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 234| if(!(expr)) { \ | | ------------------ | | | Branch (66:12): [True: 78, False: 0] | | | Branch (66:12): [True: 0, False: 0] | | | Branch (66:12): [True: 0, False: 0] | | | Branch (66:12): [True: 0, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 78| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 78] | | ------------------ ------------------ 263| | 264| | // NOLINTNEXTLINE(readability-avoid-nested-conditional-operator) 265| 78| const size_t MASKLEN = (BS == 16 ? 6 : ((BS == 24) ? 7 : 8)); ------------------ | Branch (265:28): [True: 78, False: 0] | Branch (265:44): [True: 0, False: 0] ------------------ 266| | 267| 78| const uint8_t BOTTOM_MASK = static_cast((static_cast(1) << MASKLEN) - 1); 268| | 269| 78| m_nonce_buf.resize(BS); 270| 78| clear_mem(m_nonce_buf.data(), m_nonce_buf.size()); 271| | 272| 78| copy_mem(&m_nonce_buf[BS - nonce_len], nonce, nonce_len); 273| 78| m_nonce_buf[0] = static_cast(((tag_size() * 8) % (BS * 8)) << (BS <= 16 ? 1 : 0)); ------------------ | Branch (273:76): [True: 78, False: 0] ------------------ 274| | 275| 78| m_nonce_buf[BS - nonce_len - 1] ^= 1; 276| | 277| 78| const uint8_t bottom = m_nonce_buf[BS - 1] & BOTTOM_MASK; 278| 78| m_nonce_buf[BS - 1] &= ~BOTTOM_MASK; 279| | 280| 78| const bool need_new_stretch = (m_last_nonce != m_nonce_buf); 281| | 282| 78| if(need_new_stretch) { ------------------ | Branch (282:7): [True: 78, False: 0] ------------------ 283| 78| m_last_nonce = m_nonce_buf; 284| | 285| 78| m_cipher->encrypt(m_nonce_buf); 286| | 287| | /* 288| | The loop bounds (BS vs BS/2) are derived from the relation 289| | between the block size and the MASKLEN. Using the terminology 290| | of draft-krovetz-ocb-wide, we have to derive enough bits in 291| | ShiftedKtop to read up to BLOCKLEN+bottom bits from Stretch. 292| | 293| | +----------+---------+-------+---------+ 294| | | BLOCKLEN | RESIDUE | SHIFT | MASKLEN | 295| | +----------+---------+-------+---------+ 296| | | 32 | 141 | 17 | 4 | 297| | | 64 | 27 | 25 | 5 | 298| | | 96 | 1601 | 33 | 6 | 299| | | 128 | 135 | 8 | 6 | 300| | | 192 | 135 | 40 | 7 | 301| | | 256 | 1061 | 1 | 8 | 302| | | 384 | 4109 | 80 | 8 | 303| | | 512 | 293 | 176 | 8 | 304| | | 1024 | 524355 | 352 | 9 | 305| | +----------+---------+-------+---------+ 306| | */ 307| 78| if(BS == 16) { ------------------ | Branch (307:10): [True: 78, False: 0] ------------------ 308| 702| for(size_t i = 0; i != BS / 2; ++i) { ------------------ | Branch (308:28): [True: 624, False: 78] ------------------ 309| 624| m_nonce_buf.push_back(m_nonce_buf[i] ^ m_nonce_buf[i + 1]); 310| 624| } 311| 78| } else if(BS == 24) { ------------------ | Branch (311:17): [True: 0, False: 0] ------------------ 312| 0| for(size_t i = 0; i != 16; ++i) { ------------------ | Branch (312:28): [True: 0, False: 0] ------------------ 313| 0| m_nonce_buf.push_back(m_nonce_buf[i] ^ m_nonce_buf[i + 5]); 314| 0| } 315| 0| } else if(BS == 32) { ------------------ | Branch (315:17): [True: 0, False: 0] ------------------ 316| 0| for(size_t i = 0; i != BS; ++i) { ------------------ | Branch (316:28): [True: 0, False: 0] ------------------ 317| 0| m_nonce_buf.push_back(m_nonce_buf[i] ^ (m_nonce_buf[i] << 1) ^ (m_nonce_buf[i + 1] >> 7)); 318| 0| } 319| 0| } else if(BS == 64) { ------------------ | Branch (319:17): [True: 0, False: 0] ------------------ 320| 0| for(size_t i = 0; i != BS / 2; ++i) { ------------------ | Branch (320:28): [True: 0, False: 0] ------------------ 321| 0| m_nonce_buf.push_back(m_nonce_buf[i] ^ m_nonce_buf[i + 22]); 322| 0| } 323| 0| } 324| | 325| 78| m_stretch = m_nonce_buf; 326| 78| } 327| | 328| | // now set the offset from stretch and bottom 329| 78| const size_t shift_bytes = bottom / 8; 330| 78| const size_t shift_bits = bottom % 8; 331| | 332| 78| BOTAN_ASSERT(m_stretch.size() >= BS + shift_bytes + 1, "Size ok"); ------------------ | | 64| 78| do { \ | | 65| 78| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 78| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 78] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 78| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 78] | | ------------------ ------------------ 333| | 334| 78| m_offset.resize(BS); 335| 1.32k| for(size_t i = 0; i != BS; ++i) { ------------------ | Branch (335:22): [True: 1.24k, False: 78] ------------------ 336| 1.24k| m_offset[i] = (m_stretch[i + shift_bytes] << shift_bits); 337| 1.24k| m_offset[i] |= (m_stretch[i + shift_bytes + 1] >> (8 - shift_bits)); 338| 1.24k| } 339| | 340| 78| return m_offset; 341| 78|} _ZN5Botan8OCB_Mode9start_msgEPKhm: 343| 78|void OCB_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) { 344| 78| if(!valid_nonce_length(nonce_len)) { ------------------ | Branch (344:7): [True: 0, False: 78] ------------------ 345| 0| throw Invalid_IV_Length(name(), nonce_len); 346| 0| } 347| | 348| 78| assert_key_material_set(); 349| 78| BOTAN_STATE_CHECK(!m_L->initialized()); ------------------ | | 51| 78| do { \ | | 52| 78| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 78| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 78] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 78| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 78] | | ------------------ ------------------ 350| | 351| 78| m_L->init(update_nonce(nonce, nonce_len)); 352| 78| zeroise(m_checksum); 353| 78| m_block_index = 0; 354| 78|} _ZNK5Botan14OCB_Encryption13output_lengthEm: 356| 23|size_t OCB_Encryption::output_length(size_t input_length) const { 357| 23| return add_or_throw(input_length, tag_size(), "OCB input too large"); 358| 23|} _ZN5Botan14OCB_Encryption7encryptEPhm: 360| 23|void OCB_Encryption::encrypt(uint8_t buffer[], size_t blocks) { 361| 23| assert_key_material_set(); 362| 23| BOTAN_STATE_CHECK(m_L->initialized()); ------------------ | | 51| 23| do { \ | | 52| 23| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 23| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 23] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 23| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 23] | | ------------------ ------------------ 363| | 364| 23| const size_t BS = block_size(); 365| | 366| 35| while(blocks > 0) { ------------------ | Branch (366:10): [True: 12, False: 23] ------------------ 367| 12| const size_t proc_blocks = std::min(blocks, par_blocks()); 368| 12| const size_t proc_bytes = proc_blocks * BS; 369| | 370| 12| const uint8_t* offsets = m_L->compute_offsets(m_block_index, proc_blocks); 371| | 372| 12| xor_buf(m_checksum.data(), buffer, proc_bytes); 373| | 374| 12| xor_buf(buffer, offsets, proc_bytes); 375| 12| m_cipher->encrypt_n(buffer, buffer, proc_blocks); 376| 12| xor_buf(buffer, offsets, proc_bytes); 377| | 378| 12| buffer += proc_bytes; 379| 12| blocks -= proc_blocks; 380| 12| m_block_index += proc_blocks; 381| 12| } 382| 23|} _ZN5Botan14OCB_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 390| 23|void OCB_Encryption::finish_msg(secure_vector& buffer, size_t offset) { 391| 23| assert_key_material_set(); 392| 23| BOTAN_STATE_CHECK(m_L->initialized()); ------------------ | | 51| 23| do { \ | | 52| 23| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 23| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 23] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 23| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 23] | | ------------------ ------------------ 393| | 394| 23| const size_t BS = block_size(); 395| | 396| 23| BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range"); ------------------ | | 35| 23| do { \ | | 36| 23| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 23| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 23] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 23| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 23] | | ------------------ ------------------ 397| 23| const size_t sz = buffer.size() - offset; 398| 23| uint8_t* buf = buffer.data() + offset; 399| | 400| 23| secure_vector mac(BS); 401| | 402| 23| if(sz > 0) { ------------------ | Branch (402:7): [True: 23, False: 0] ------------------ 403| 23| const size_t final_full_blocks = sz / BS; 404| 23| const size_t remainder_bytes = sz - (final_full_blocks * BS); 405| | 406| 23| encrypt(buf, final_full_blocks); 407| 23| mac = m_L->offset(); 408| | 409| 23| if(remainder_bytes > 0) { ------------------ | Branch (409:10): [True: 11, False: 12] ------------------ 410| 11| BOTAN_ASSERT(remainder_bytes < BS, "Only a partial block left"); ------------------ | | 64| 11| do { \ | | 65| 11| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 11| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 11] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 11| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 11] | | ------------------ ------------------ 411| 11| uint8_t* remainder = &buf[sz - remainder_bytes]; 412| | 413| 11| xor_buf(m_checksum.data(), remainder, remainder_bytes); 414| 11| m_checksum[remainder_bytes] ^= 0x80; 415| | 416| | // Offset_* 417| 11| mac ^= m_L->star(); 418| | 419| 11| secure_vector pad(BS); 420| 11| m_cipher->encrypt(mac, pad); 421| 11| xor_buf(remainder, pad.data(), remainder_bytes); 422| 11| } 423| 23| } else { 424| 0| mac = m_L->offset(); 425| 0| } 426| | 427| | // now compute the tag 428| | 429| | // fold checksum 430| 391| for(size_t i = 0; i != m_checksum.size(); i += BS) { ------------------ | Branch (430:22): [True: 368, False: 23] ------------------ 431| 368| xor_buf(mac.data(), m_checksum.data() + i, BS); 432| 368| } 433| | 434| 23| xor_buf(mac.data(), m_L->dollar().data(), BS); 435| 23| m_cipher->encrypt(mac); 436| 23| xor_buf(mac.data(), m_ad_hash.data(), BS); 437| | 438| 23| buffer += std::make_pair(mac.data(), tag_size()); 439| | 440| 23| reset(); 441| 23|} _ZNK5Botan14OCB_Decryption13output_lengthEm: 443| 55|size_t OCB_Decryption::output_length(size_t input_length) const { 444| 55| BOTAN_ARG_CHECK(input_length >= tag_size(), "Message too short to be valid"); ------------------ | | 35| 55| do { \ | | 36| 55| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 55| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 55] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 55| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 55] | | ------------------ ------------------ 445| 55| return input_length - tag_size(); 446| 55|} _ZN5Botan14OCB_Decryption7decryptEPhm: 448| 53|void OCB_Decryption::decrypt(uint8_t buffer[], size_t blocks) { 449| 53| assert_key_material_set(); 450| 53| BOTAN_STATE_CHECK(m_L->initialized()); ------------------ | | 51| 53| do { \ | | 52| 53| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 53| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 53] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 53| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 53] | | ------------------ ------------------ 451| | 452| 53| const size_t BS = block_size(); 453| | 454| 256| while(blocks > 0) { ------------------ | Branch (454:10): [True: 203, False: 53] ------------------ 455| 203| const size_t proc_blocks = std::min(blocks, par_blocks()); 456| 203| const size_t proc_bytes = proc_blocks * BS; 457| | 458| 203| const uint8_t* offsets = m_L->compute_offsets(m_block_index, proc_blocks); 459| | 460| 203| xor_buf(buffer, offsets, proc_bytes); 461| 203| m_cipher->decrypt_n(buffer, buffer, proc_blocks); 462| 203| xor_buf(buffer, offsets, proc_bytes); 463| | 464| 203| xor_buf(m_checksum.data(), buffer, proc_bytes); 465| | 466| 203| buffer += proc_bytes; 467| 203| blocks -= proc_blocks; 468| 203| m_block_index += proc_blocks; 469| 203| } 470| 53|} _ZN5Botan14OCB_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 478| 55|void OCB_Decryption::finish_msg(secure_vector& buffer, size_t offset) { 479| 55| assert_key_material_set(); 480| 55| BOTAN_STATE_CHECK(m_L->initialized()); ------------------ | | 51| 55| do { \ | | 52| 55| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 55| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 55] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 55| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 55] | | ------------------ ------------------ 481| | 482| 55| const size_t BS = block_size(); 483| | 484| 55| BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range"); ------------------ | | 35| 55| do { \ | | 36| 55| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 55| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 55] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 55| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 55] | | ------------------ ------------------ 485| 55| const size_t sz = buffer.size() - offset; 486| 55| uint8_t* buf = buffer.data() + offset; 487| | 488| 55| BOTAN_ARG_CHECK(sz >= tag_size(), "input did not include the tag"); ------------------ | | 35| 55| do { \ | | 36| 55| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 55| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 55] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 55| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 55] | | ------------------ ------------------ 489| | 490| 55| const size_t remaining = sz - tag_size(); 491| | 492| 55| secure_vector mac(BS); 493| | 494| 55| if(remaining > 0) { ------------------ | Branch (494:7): [True: 53, False: 2] ------------------ 495| 53| const size_t final_full_blocks = remaining / BS; 496| 53| const size_t final_bytes = remaining - (final_full_blocks * BS); 497| | 498| 53| decrypt(buf, final_full_blocks); 499| 53| mac ^= m_L->offset(); 500| | 501| 53| if(final_bytes > 0) { ------------------ | Branch (501:10): [True: 49, False: 4] ------------------ 502| 49| BOTAN_ASSERT(final_bytes < BS, "Only a partial block left"); ------------------ | | 64| 49| do { \ | | 65| 49| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 49| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 49] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 49| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 49] | | ------------------ ------------------ 503| | 504| 49| uint8_t* remainder = &buf[remaining - final_bytes]; 505| | 506| 49| mac ^= m_L->star(); 507| 49| secure_vector pad(BS); 508| 49| m_cipher->encrypt(mac, pad); // P_* 509| 49| xor_buf(remainder, pad.data(), final_bytes); 510| | 511| 49| xor_buf(m_checksum.data(), remainder, final_bytes); 512| 49| m_checksum[final_bytes] ^= 0x80; 513| 49| } 514| 53| } else { 515| 2| mac = m_L->offset(); 516| 2| } 517| | 518| | // compute the mac 519| | 520| | // fold checksum 521| 935| for(size_t i = 0; i != m_checksum.size(); i += BS) { ------------------ | Branch (521:22): [True: 880, False: 55] ------------------ 522| 880| xor_buf(mac.data(), m_checksum.data() + i, BS); 523| 880| } 524| | 525| 55| mac ^= m_L->dollar(); 526| 55| m_cipher->encrypt(mac); 527| 55| mac ^= m_ad_hash; 528| | 529| 55| reset(); 530| | 531| | // compare mac 532| 55| const uint8_t* included_tag = &buf[remaining]; 533| | 534| 55| if(!CT::is_equal(mac.data(), included_tag, tag_size()).as_bool()) { ------------------ | Branch (534:7): [True: 55, False: 0] ------------------ 535| 55| clear_mem(std::span{buffer}.subspan(offset, remaining)); 536| 55| throw Invalid_Authentication_Tag("OCB tag check failed"); 537| 55| } 538| | 539| | // remove tag from end of message 540| 0| buffer.resize(remaining + offset); 541| 0|} _ZN5Botan10L_computer5resetEv: 51| 156| void reset() { m_offset.clear(); } _ZNK5Botan10L_computer11initializedEv: 53| 310| bool initialized() const { return !m_offset.empty(); } ocb.cpp:_ZN5Botan12_GLOBAL__N_18ocb_hashERKNS_10L_computerERKNS_11BlockCipherEPKhm: 132| 78|secure_vector ocb_hash(const L_computer& L, const BlockCipher& cipher, const uint8_t ad[], size_t ad_len) { 133| 78| const size_t BS = cipher.block_size(); 134| 78| secure_vector sum(BS); 135| 78| secure_vector offset(BS); 136| | 137| 78| secure_vector buf(BS); 138| | 139| 78| const size_t ad_blocks = (ad_len / BS); 140| 78| const size_t ad_remainder = (ad_len % BS); 141| | 142| 78| for(size_t i = 0; i != ad_blocks; ++i) { ------------------ | Branch (142:22): [True: 0, False: 78] ------------------ 143| | // this loop could run in parallel 144| 0| offset ^= L.get(var_ctz64(i + 1)); 145| 0| buf = offset; 146| 0| xor_buf(buf.data(), &ad[BS * i], BS); 147| 0| cipher.encrypt(buf); 148| 0| sum ^= buf; 149| 0| } 150| | 151| 78| if(ad_remainder > 0) { ------------------ | Branch (151:7): [True: 78, False: 0] ------------------ 152| 78| offset ^= L.star(); 153| 78| buf = offset; 154| 78| xor_buf(buf.data(), &ad[BS * ad_blocks], ad_remainder); 155| 78| buf[ad_remainder] ^= 0x80; 156| 78| cipher.encrypt(buf); 157| 78| sum ^= buf; 158| 78| } 159| | 160| 78| return sum; 161| 78|} _ZNK5Botan10L_computer3getEm: 61| 1.21k| const secure_vector& get(size_t i) const { 62| 1.21k| while(m_L.size() <= i) { ------------------ | Branch (62:16): [True: 2, False: 1.21k] ------------------ 63| 2| m_L.push_back(poly_double(m_L.back())); 64| 2| } 65| | 66| 1.21k| return m_L[i]; 67| 1.21k| } _ZN5Botan10L_computer11poly_doubleERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE: 114| 704| static secure_vector poly_double(const secure_vector& in) { 115| 704| secure_vector out(in.size()); 116| 704| poly_double_n(out.data(), in.data(), out.size()); 117| 704| return out; 118| 704| } _ZN5Botan10L_computer4initERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE: 49| 78| void init(const secure_vector& offset) { m_offset = offset; } _ZN5Botan10L_computer15compute_offsetsEmm: 69| 215| const uint8_t* compute_offsets(uint64_t block_index, size_t blocks) { 70| 215| BOTAN_ASSERT(blocks <= m_max_blocks, "OCB offsets"); ------------------ | | 64| 215| do { \ | | 65| 215| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 215| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 215] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 215| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 215] | | ------------------ ------------------ 71| | 72| 215| uint8_t* offsets = m_offset_buf.data(); 73| | 74| 215| if(block_index % 4 == 0) { ------------------ | Branch (74:13): [True: 215, False: 0] ------------------ 75| 215| const secure_vector& L0 = get(0); 76| 215| const secure_vector& L1 = get(1); 77| | 78| 910| while(blocks >= 4) { ------------------ | Branch (78:19): [True: 695, False: 215] ------------------ 79| | // ntz(4*i+1) == 0 80| | // ntz(4*i+2) == 1 81| | // ntz(4*i+3) == 0 82| 695| block_index += 4; 83| 695| const size_t ntz4 = var_ctz64(block_index); 84| | 85| 695| xor_buf(offsets, m_offset.data(), L0.data(), m_BS); 86| 695| offsets += m_BS; 87| | 88| 695| xor_buf(offsets, offsets - m_BS, L1.data(), m_BS); 89| 695| offsets += m_BS; 90| | 91| 695| xor_buf(m_offset.data(), L1.data(), m_BS); 92| 695| copy_mem(offsets, m_offset.data(), m_BS); 93| 695| offsets += m_BS; 94| | 95| 695| xor_buf(m_offset.data(), get(ntz4).data(), m_BS); 96| 695| copy_mem(offsets, m_offset.data(), m_BS); 97| 695| offsets += m_BS; 98| | 99| 695| blocks -= 4; 100| 695| } 101| 215| } 102| | 103| 307| for(size_t i = 0; i != blocks; ++i) { // could be done in parallel ------------------ | Branch (103:28): [True: 92, False: 215] ------------------ 104| 92| const size_t ntz = var_ctz64(block_index + i + 1); 105| 92| xor_buf(m_offset.data(), get(ntz).data(), m_BS); 106| 92| copy_mem(offsets, m_offset.data(), m_BS); 107| 92| offsets += m_BS; 108| 92| } 109| | 110| 215| return m_offset_buf.data(); 111| 215| } _ZNK5Botan10L_computer6offsetEv: 59| 78| const secure_vector& offset() const { return m_offset; } _ZNK5Botan10L_computer4starEv: 55| 216| const secure_vector& star() const { return m_L_star; } _ZNK5Botan10L_computer6dollarEv: 57| 156| const secure_vector& dollar() const { return m_L_dollar; } _ZN5Botan10L_computerC2ERKNS_11BlockCipherE: 25| 78| m_BS(cipher.block_size()), m_max_blocks(cipher.parallel_bytes() / m_BS) { 26| 78| m_L_star.resize(m_BS); 27| 78| cipher.encrypt(m_L_star); 28| 78| m_L_dollar = poly_double(star()); 29| | 30| | // Preallocate the m_L vector to the maximum expected size to avoid 31| | // re-allocations during runtime. This had caused a use-after-free in 32| | // earlier versions, due to references into this buffer becoming stale 33| | // in `compute_offset()`, after calling `get()` in the hot path. 34| | // 35| | // Note, that the list member won't be pre-allocated, so the expected 36| | // memory overhead is negligible. 37| | // 38| | // See also https://github.com/randombit/botan/issues/3812 39| 78| m_L.reserve(65); 40| 78| m_L.push_back(poly_double(dollar())); 41| | 42| 624| while(m_L.size() < 8) { ------------------ | Branch (42:16): [True: 546, False: 78] ------------------ 43| 546| m_L.push_back(poly_double(m_L.back())); 44| 546| } 45| | 46| 78| m_offset_buf.resize(m_BS * m_max_blocks); 47| 78| } _ZN5Botan8CBC_ModeC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEENS2_INS_28BlockCipherModePaddingMethodENS4_IS7_EEEE: 21| 242| m_cipher(std::move(cipher)), m_padding(std::move(padding)), m_block_size(m_cipher->block_size()) { 22| 242| if(m_padding && !m_padding->valid_blocksize(m_block_size)) { ------------------ | Branch (22:7): [True: 242, False: 0] | Branch (22:20): [True: 0, False: 242] ------------------ 23| 0| throw Invalid_Argument(fmt("Padding {} cannot be used with {} in CBC mode", m_padding->name(), m_cipher->name())); 24| 0| } 25| 242|} _ZNK5Botan8CBC_Mode17ideal_granularityEv: 48| 179|size_t CBC_Mode::ideal_granularity() const { 49| 179| return cipher().parallel_bytes(); 50| 179|} _ZNK5Botan8CBC_Mode8key_specEv: 52| 242|Key_Length_Specification CBC_Mode::key_spec() const { 53| 242| return cipher().key_spec(); 54| 242|} _ZNK5Botan8CBC_Mode18valid_nonce_lengthEm: 60| 240|bool CBC_Mode::valid_nonce_length(size_t n) const { 61| 240| return (n == 0 || n == block_size()); ------------------ | Branch (61:12): [True: 0, False: 240] | Branch (61:22): [True: 240, False: 0] ------------------ 62| 240|} _ZN5Botan8CBC_Mode12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 68| 242|void CBC_Mode::key_schedule(std::span key) { 69| 242| m_cipher->set_key(key); 70| 242| m_state.clear(); 71| 242|} _ZN5Botan8CBC_Mode9start_msgEPKhm: 73| 240|void CBC_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) { 74| 240| if(!valid_nonce_length(nonce_len)) { ------------------ | Branch (74:7): [True: 0, False: 240] ------------------ 75| 0| throw Invalid_IV_Length(name(), nonce_len); 76| 0| } 77| | 78| | /* 79| | * A nonce of zero length means carry the last ciphertext value over 80| | * as the new IV, as unfortunately some protocols require this. If 81| | * this is the first message then we use an IV of all zeros. 82| | */ 83| 240| if(nonce_len > 0) { ------------------ | Branch (83:7): [True: 240, False: 0] ------------------ 84| 240| m_state.assign(nonce, nonce + nonce_len); 85| 240| } else if(m_state.empty()) { ------------------ | Branch (85:14): [True: 0, False: 0] ------------------ 86| 0| m_state.resize(m_cipher->block_size()); 87| 0| } 88| | // else leave the state alone 89| 240|} _ZN5Botan14CBC_Encryption11process_msgEPhm: 99| 113|size_t CBC_Encryption::process_msg(uint8_t buf[], size_t sz) { 100| 113| BOTAN_STATE_CHECK(state().empty() == false); ------------------ | | 51| 113| do { \ | | 52| 113| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 113| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 113] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 113| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 113] | | ------------------ ------------------ 101| 113| const size_t BS = block_size(); 102| | 103| 113| BOTAN_ARG_CHECK(sz % BS == 0, "CBC input is not full blocks"); ------------------ | | 35| 113| do { \ | | 36| 113| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 113| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 113] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 113| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 113] | | ------------------ ------------------ 104| 113| const size_t blocks = sz / BS; 105| | 106| 113| if(blocks > 0) { ------------------ | Branch (106:7): [True: 113, False: 0] ------------------ 107| 113| xor_buf(&buf[0], state_ptr(), BS); 108| 113| cipher().encrypt(&buf[0]); 109| | 110| 442| for(size_t i = 1; i != blocks; ++i) { ------------------ | Branch (110:25): [True: 329, False: 113] ------------------ 111| 329| xor_buf(&buf[BS * i], &buf[BS * (i - 1)], BS); 112| 329| cipher().encrypt(&buf[BS * i]); 113| 329| } 114| | 115| 113| state().assign(&buf[BS * (blocks - 1)], &buf[BS * blocks]); 116| 113| } 117| | 118| 113| return sz; 119| 113|} _ZN5Botan14CBC_Decryption11process_msgEPhm: 202| 127|size_t CBC_Decryption::process_msg(uint8_t buf[], size_t sz) { 203| 127| BOTAN_STATE_CHECK(state().empty() == false); ------------------ | | 51| 127| do { \ | | 52| 127| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 127| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 127] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 127| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 127] | | ------------------ ------------------ 204| | 205| 127| const size_t BS = block_size(); 206| | 207| 127| BOTAN_ARG_CHECK(sz % BS == 0, "Input is not full blocks"); ------------------ | | 35| 127| do { \ | | 36| 127| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 127| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 127] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 127| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 127] | | ------------------ ------------------ 208| 127| size_t blocks = sz / BS; 209| | 210| 682| while(blocks > 0) { ------------------ | Branch (210:10): [True: 555, False: 127] ------------------ 211| 555| const size_t to_proc = std::min(BS * blocks, m_tempbuf.size()); 212| | 213| 555| cipher().decrypt_n(buf, m_tempbuf.data(), to_proc / BS); 214| | 215| 555| xor_buf(m_tempbuf.data(), state_ptr(), BS); 216| 555| xor_buf(&m_tempbuf[BS], buf, to_proc - BS); 217| 555| copy_mem(state_ptr(), buf + (to_proc - BS), BS); 218| | 219| 555| copy_mem(buf, m_tempbuf.data(), to_proc); 220| | 221| 555| buf += to_proc; 222| 555| blocks -= to_proc / BS; 223| 555| } 224| | 225| 127| return sz; 226| 127|} _ZN5Botan9Gf448ElemC2ENSt3__14spanIKhLm56EEE: 356| 30|Gf448Elem::Gf448Elem(std::span x) /* NOLINT(*-member-init) */ { 357| 30| load_le(m_x, x); 358| 30|} _ZN5Botan9Gf448ElemC2Em: 360| 121k|Gf448Elem::Gf448Elem(uint64_t least_sig_word) /* NOLINT(*-member-init) */ { 361| 121k| clear_mem(m_x); 362| 121k| m_x[0] = least_sig_word; 363| 121k|} _ZNK5Botan9Gf448Elem8to_bytesENSt3__14spanIhLm56EEE: 365| 15|void Gf448Elem::to_bytes(std::span out) const { 366| 15| store_le(out, to_canonical(m_x)); 367| 15|} _ZNK5Botan9Gf448Elem8to_bytesEv: 369| 15|std::array Gf448Elem::to_bytes() const { 370| 15| std::array bytes{}; 371| 15| to_bytes(bytes); 372| 15| return bytes; 373| 15|} _ZN5Botan9Gf448Elem12ct_cond_swapENS_2CT4MaskImEERS0_: 375| 13.4k|void Gf448Elem::ct_cond_swap(CT::Mask mask, Gf448Elem& other) { 376| 107k| for(size_t i = 0; i < WORDS_448; ++i) { ------------------ | Branch (376:22): [True: 94.2k, False: 13.4k] ------------------ 377| 94.2k| mask.conditional_swap(m_x[i], other.m_x[i]); 378| 94.2k| } 379| 13.4k|} _ZNK5Botan9Gf448ElemplERKS0_: 385| 26.8k|Gf448Elem Gf448Elem::operator+(const Gf448Elem& other) const { 386| 26.8k| Gf448Elem res(0); 387| 26.8k| gf_add(res.m_x, m_x, other.m_x); 388| 26.8k| return res; 389| 26.8k|} _ZNK5Botan9Gf448ElemmiERKS0_: 391| 26.8k|Gf448Elem Gf448Elem::operator-(const Gf448Elem& other) const { 392| 26.8k| Gf448Elem res(0); 393| 26.8k| gf_sub(res.m_x, m_x, other.m_x); 394| 26.8k| return res; 395| 26.8k|} _ZNK5Botan9Gf448ElemmlERKS0_: 403| 33.6k|Gf448Elem Gf448Elem::operator*(const Gf448Elem& other) const { 404| 33.6k| Gf448Elem res(0); 405| 33.6k| gf_mul(res.m_x, m_x, other.m_x); 406| 33.6k| return res; 407| 33.6k|} _ZNK5Botan9Gf448ElemdvERKS0_: 409| 15|Gf448Elem Gf448Elem::operator/(const Gf448Elem& other) const { 410| 15| Gf448Elem res(0); 411| 15| gf_inv(res.m_x, other.m_x); 412| 15| gf_mul(res.m_x, m_x, res.m_x); 413| 15| return res; 414| 15|} _ZN5Botan7mul_a24ERKNS_9Gf448ElemE: 439| 6.72k|Gf448Elem mul_a24(const Gf448Elem& a) { 440| 6.72k| Gf448Elem res(0); 441| 6.72k| gf_mul_a24(res.words(), a.words()); 442| 6.72k| return res; 443| 6.72k|} _ZN5Botan6squareERKNS_9Gf448ElemE: 445| 26.8k|Gf448Elem square(const Gf448Elem& elem) { 446| 26.8k| Gf448Elem res(0); 447| 26.8k| gf_square(res.words(), elem.words()); 448| 26.8k| return res; 449| 26.8k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_112to_canonicalENSt3__14spanIKmLm7EEE: 335| 15|std::array to_canonical(std::span in) { 336| 15| const std::array p = {0xffffffffffffffff, 337| 15| 0xffffffffffffffff, 338| 15| 0xffffffffffffffff, 339| 15| 0xfffffffeffffffff, 340| 15| 0xffffffffffffffff, 341| 15| 0xffffffffffffffff, 342| 15| 0xffffffffffffffff}; 343| | 344| 15| std::array in_minus_p; // NOLINT(*-member-init) 345| 15| uint64_t borrow = 0; 346| 120| for(size_t i = 0; i < WORDS_448; ++i) { ------------------ | Branch (346:22): [True: 105, False: 15] ------------------ 347| 105| in_minus_p[i] = word_sub(in[i], p[i], &borrow); 348| 105| } 349| 15| std::array out; // NOLINT(*-member-init) 350| 15| CT::Mask::expand(borrow).select_n(out.data(), in.data(), in_minus_p.data(), WORDS_448); 351| 15| return out; 352| 15|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_16gf_addENSt3__14spanImLm7EEENS2_IKmLm7EEES5_: 155| 26.8k| std::span b) { 156| 26.8k| std::array ws; // NOLINT(*-member-init) 157| | 158| 26.8k| uint64_t carry = 0; 159| 26.8k| ws[0] = word_add(a[0], b[0], &carry); 160| 26.8k| ws[1] = word_add(a[1], b[1], &carry); 161| 26.8k| ws[2] = word_add(a[2], b[2], &carry); 162| 26.8k| ws[3] = word_add(a[3], b[3], &carry); 163| 26.8k| ws[4] = word_add(a[4], b[4], &carry); 164| 26.8k| ws[5] = word_add(a[5], b[5], &carry); 165| 26.8k| ws[6] = word_add(a[6], b[6], &carry); 166| 26.8k| ws[7] = carry; 167| | 168| 26.8k| reduce_after_add(out, ws); 169| 26.8k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_116reduce_after_addENSt3__14spanImLm7EEENS2_IKmLm8EEE: 27| 100k|void reduce_after_add(std::span h_3, std::span h_1) { 28| 100k| std::array h_2; /* NOLINT(*-member-init) */ 29| 100k| uint64_t carry = 0; 30| | 31| 100k| constexpr uint64_t zero = 0; 32| | 33| | // Line 27+ (of the paper's algorithm 1) 34| 100k| h_2[0] = word_add(h_1[0], h_1[7], &carry); 35| 100k| h_2[1] = word_add(h_1[1], zero, &carry); 36| 100k| h_2[2] = word_add(h_1[2], zero, &carry); 37| | 38| | // Line 30 39| 100k| h_2[3] = word_add(h_1[3], h_1[7] << 32, &carry); 40| | 41| | // Line 31+ 42| 100k| h_2[4] = word_add(h_1[4], zero, &carry); 43| 100k| h_2[5] = word_add(h_1[5], zero, &carry); 44| 100k| h_2[6] = word_add(h_1[6], zero, &carry); 45| | 46| 100k| h_2[7] = carry; 47| | 48| 100k| carry = 0; 49| 100k| h_3[0] = word_add(h_2[0], h_2[7], &carry); 50| 100k| h_3[1] = word_add(h_2[1], zero, &carry); 51| 100k| h_3[2] = word_add(h_2[2], zero, &carry); 52| | // Line 37 53| 100k| h_3[3] = h_2[3] + (h_2[7] << 32) + carry; 54| | 55| | // Line 38 56| 100k| h_3[4] = h_2[4]; 57| 100k| h_3[5] = h_2[5]; 58| 100k| h_3[6] = h_2[6]; 59| 100k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_16gf_subENSt3__14spanImLm7EEENS2_IKmLm7EEES5_: 178| 26.8k| std::span b) { 179| 26.8k| std::array h_0; // NOLINT(*-member-init) 180| 26.8k| std::array h_1; // NOLINT(*-member-init) 181| | 182| 26.8k| uint64_t borrow = 0; 183| 26.8k| h_0[0] = word_sub(a[0], b[0], &borrow); 184| 26.8k| h_0[1] = word_sub(a[1], b[1], &borrow); 185| 26.8k| h_0[2] = word_sub(a[2], b[2], &borrow); 186| 26.8k| h_0[3] = word_sub(a[3], b[3], &borrow); 187| 26.8k| h_0[4] = word_sub(a[4], b[4], &borrow); 188| 26.8k| h_0[5] = word_sub(a[5], b[5], &borrow); 189| 26.8k| h_0[6] = word_sub(a[6], b[6], &borrow); 190| 26.8k| uint64_t delta = borrow; 191| 26.8k| uint64_t delta_p = delta << 32; 192| 26.8k| borrow = 0; 193| | 194| 26.8k| constexpr uint64_t zero = 0; 195| | 196| 26.8k| h_1[0] = word_sub(h_0[0], delta, &borrow); 197| 26.8k| h_1[1] = word_sub(h_0[1], zero, &borrow); 198| 26.8k| h_1[2] = word_sub(h_0[2], zero, &borrow); 199| 26.8k| h_1[3] = word_sub(h_0[3], delta_p, &borrow); 200| 26.8k| h_1[4] = word_sub(h_0[4], zero, &borrow); 201| 26.8k| h_1[5] = word_sub(h_0[5], zero, &borrow); 202| 26.8k| h_1[6] = word_sub(h_0[6], zero, &borrow); 203| | 204| 26.8k| delta = borrow; 205| 26.8k| delta_p = delta << 32; 206| 26.8k| borrow = 0; 207| | 208| 26.8k| out[0] = word_sub(h_1[0], delta, &borrow); 209| 26.8k| out[1] = word_sub(h_1[1], zero, &borrow); 210| 26.8k| out[2] = word_sub(h_1[2], zero, &borrow); 211| 26.8k| out[3] = word_sub(h_1[3], delta_p, &borrow); 212| 26.8k| out[4] = h_1[4]; 213| 26.8k| out[5] = h_1[5]; 214| 26.8k| out[6] = h_1[6]; 215| 26.8k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_16gf_mulENSt3__14spanImLm7EEENS2_IKmLm7EEES5_: 141| 33.8k| std::span b) { 142| 33.8k| std::array ws; // NOLINT(*-member-init) 143| 33.8k| comba_mul<7>(ws.data(), a.data(), b.data()); 144| 33.8k| reduce_after_mul(out, ws); 145| 33.8k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_116reduce_after_mulENSt3__14spanImLm7EEENS2_IKmLm14EEE: 66| 67.3k|void reduce_after_mul(std::span out, std::span in) { 67| 67.3k| std::array r; // NOLINT(*-member-init) 68| 67.3k| std::array s; // NOLINT(*-member-init) 69| 67.3k| std::array t_0; // NOLINT(*-member-init) 70| 67.3k| std::array h_1; // NOLINT(*-member-init) 71| | 72| 67.3k| uint64_t carry = 0; 73| | 74| | // Line 4 (of the paper's algorithm 1) 75| 67.3k| r[0] = word_add(in[0], in[7], &carry); 76| | 77| | // Line 5-7 78| 67.3k| r[1] = word_add(in[1], in[1 + 7], &carry); 79| 67.3k| r[2] = word_add(in[2], in[2 + 7], &carry); 80| 67.3k| r[3] = word_add(in[3], in[3 + 7], &carry); 81| 67.3k| r[4] = word_add(in[4], in[4 + 7], &carry); 82| 67.3k| r[5] = word_add(in[5], in[5 + 7], &carry); 83| 67.3k| r[6] = word_add(in[6], in[6 + 7], &carry); 84| 67.3k| r[7] = carry; 85| 67.3k| s[0] = r[0]; 86| 67.3k| s[1] = r[1]; 87| 67.3k| s[2] = r[2]; 88| | // Line 10 89| 67.3k| carry = 0; 90| 67.3k| s[3] = word_add(r[3], in[10] & 0xFFFFFFFF00000000, &carry); 91| | // Line 11-13 92| 67.3k| s[4] = word_add(r[4], in[4 + 7], &carry); 93| 67.3k| s[5] = word_add(r[5], in[5 + 7], &carry); 94| 67.3k| s[6] = word_add(r[6], in[6 + 7], &carry); 95| 67.3k| s[7] = r[7] + carry; 96| | 97| | // Line 15-17 98| 67.3k| t_0[0] = (in[0 + 11] << 32) | (in[0 + 10] >> 32); 99| 67.3k| t_0[1] = (in[1 + 11] << 32) | (in[1 + 10] >> 32); 100| 67.3k| t_0[2] = (in[2 + 11] << 32) | (in[2 + 10] >> 32); 101| | // Line 18 102| 67.3k| t_0[3] = (in[7] << 32) | (in[13] >> 32); 103| | // Line 19-21 104| 67.3k| t_0[4] = (in[4 + 4] << 32) | (in[4 + 3] >> 32); 105| 67.3k| t_0[5] = (in[5 + 4] << 32) | (in[5 + 3] >> 32); 106| 67.3k| t_0[6] = (in[6 + 4] << 32) | (in[6 + 3] >> 32); 107| 67.3k| carry = 0; 108| | // Line 23-25 109| 67.3k| h_1[0] = word_add(s[0], t_0[0], &carry); 110| 67.3k| h_1[1] = word_add(s[1], t_0[1], &carry); 111| 67.3k| h_1[2] = word_add(s[2], t_0[2], &carry); 112| 67.3k| h_1[3] = word_add(s[3], t_0[3], &carry); 113| 67.3k| h_1[4] = word_add(s[4], t_0[4], &carry); 114| 67.3k| h_1[5] = word_add(s[5], t_0[5], &carry); 115| 67.3k| h_1[6] = word_add(s[6], t_0[6], &carry); 116| 67.3k| h_1[7] = s[7] + carry; 117| | 118| 67.3k| reduce_after_add(out, h_1); 119| 67.3k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_16gf_invENSt3__14spanImLm7EEENS2_IKmLm7EEE: 316| 15|void gf_inv(std::span out, std::span a) { 317| 15| std::array x222; // NOLINT(*-member-init) 318| 15| std::array x223; // NOLINT(*-member-init) 319| 15| gf_pow_2_222m1(x222, x223, a); 320| | 321| | // (x223 << 223 + x222) << 2 + 1 322| 15| std::array t; // NOLINT(*-member-init) 323| 15| gf_sqr_n(t, x223, 223); 324| 15| gf_mul(t, t, x222); 325| 15| gf_sqr_n(t, t, 2); 326| 15| gf_mul(out, t, a); 327| 15|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_110gf_mul_a24ENSt3__14spanImLm7EEENS2_IKmLm7EEE: 124| 6.72k|void gf_mul_a24(std::span out, std::span a) { 125| 6.72k| constexpr uint64_t A24 = 39081; 126| 6.72k| std::array ws; // NOLINT(*-member-init) 127| 6.72k| uint64_t carry = 0; 128| 6.72k| ws[0] = word_madd2(a[0], A24, &carry); 129| 6.72k| ws[1] = word_madd2(a[1], A24, &carry); 130| 6.72k| ws[2] = word_madd2(a[2], A24, &carry); 131| 6.72k| ws[3] = word_madd2(a[3], A24, &carry); 132| 6.72k| ws[4] = word_madd2(a[4], A24, &carry); 133| 6.72k| ws[5] = word_madd2(a[5], A24, &carry); 134| 6.72k| ws[6] = word_madd2(a[6], A24, &carry); 135| 6.72k| ws[7] = carry; 136| 6.72k| reduce_after_add(out, ws); 137| 6.72k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_19gf_squareENSt3__14spanImLm7EEENS2_IKmLm7EEE: 147| 33.5k|void gf_square(std::span out, std::span a) { 148| 33.5k| std::array ws; // NOLINT(*-member-init) 149| 33.5k| comba_sqr<7>(ws.data(), a.data()); 150| 33.5k| reduce_after_mul(out, ws); 151| 33.5k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_114gf_pow_2_222m1ENSt3__14spanImLm7EEES3_NS2_IKmLm7EEE: 245| 15| std::span a) { 246| 15| std::array t; // NOLINT(*-member-init) 247| | 248| | // _10 = a^2 249| 15| std::array a2; // NOLINT(*-member-init) 250| 15| gf_square(a2, a); 251| | 252| | // _11 = a^3 253| 15| std::array a3; // NOLINT(*-member-init) 254| 15| gf_mul(a3, a, a2); 255| | 256| | // _111 = a^7 257| 15| std::array a7; // NOLINT(*-member-init) 258| 15| gf_square(t, a3); 259| 15| gf_mul(a7, a, t); 260| | 261| | // _111111 = a^63 262| 15| std::array a63; // NOLINT(*-member-init) 263| 15| gf_sqr_n(t, a7, 3); 264| 15| gf_mul(a63, a7, t); 265| | 266| | // x12 = a^(2^12 - 1) 267| 15| std::array x12; // NOLINT(*-member-init) 268| 15| gf_sqr_n(t, a63, 6); 269| 15| gf_mul(x12, a63, t); 270| | 271| | // x24 = a^(2^24 - 1) 272| 15| std::array x24; // NOLINT(*-member-init) 273| 15| gf_sqr_n(t, x12, 12); 274| 15| gf_mul(x24, x12, t); 275| | 276| | // i34 = x24 << 6 = a^((2^24 - 1) * 2^6) 277| 15| std::array i34; // NOLINT(*-member-init) 278| 15| gf_sqr_n(i34, x24, 6); 279| | 280| | // x30 = a^(2^30 - 1) 281| 15| std::array x30; // NOLINT(*-member-init) 282| 15| gf_mul(x30, a63, i34); 283| | 284| | // x48 = a^(2^48 - 1) 285| 15| std::array x48; // NOLINT(*-member-init) 286| 15| gf_sqr_n(t, i34, 18); 287| 15| gf_mul(x48, x24, t); 288| | 289| | // x96 = a^(2^96 - 1) 290| 15| std::array x96; // NOLINT(*-member-init) 291| 15| gf_sqr_n(t, x48, 48); 292| 15| gf_mul(x96, x48, t); 293| | 294| | // x192 = a^(2^192 - 1) 295| 15| std::array x192; // NOLINT(*-member-init) 296| 15| gf_sqr_n(t, x96, 96); 297| 15| gf_mul(x192, x96, t); 298| | 299| | // x222 = a^(2^222 - 1) 300| 15| gf_sqr_n(t, x192, 30); 301| 15| gf_mul(x222, x30, t); 302| | 303| | // x223 = a^(2^223 - 1) 304| 15| gf_square(t, x222); 305| 15| gf_mul(x223, a, t); 306| 15|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_18gf_sqr_nENSt3__14spanImLm7EEENS2_IKmLm7EEEm: 218| 150|void gf_sqr_n(std::span out, std::span a, size_t n) { 219| 150| gf_square(out, a); 220| 6.66k| for(size_t i = 1; i < n; ++i) { ------------------ | Branch (220:22): [True: 6.51k, False: 150] ------------------ 221| 6.51k| gf_square(out, out); 222| 6.51k| } 223| 150|} _ZNK5Botan14X448_PublicKey19raw_public_key_bitsEv: 88| 15|std::vector X448_PublicKey::raw_public_key_bits() const { 89| 15| const auto& pub = m_public->key(); 90| 15| return {pub.begin(), pub.end()}; 91| 15|} _ZN5Botan14X448_PublicKeyC1ENSt3__14spanIKhLm18446744073709551615EEE: 109| 3|X448_PublicKey::X448_PublicKey(std::span pub) { 110| 3| BOTAN_ARG_CHECK(pub.size() == X448_LEN, "Invalid size for X448 public key"); ------------------ | | 35| 3| do { \ | | 36| 3| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 3| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 1, False: 2] | | ------------------ | | 38| 1| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 1| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 1| } \ | | 41| 3| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 3] | | ------------------ ------------------ 111| 3| std::array pub_arr{}; 112| 3| copy_mem(pub_arr, pub); 113| 3| m_public = std::make_shared(pub_arr); 114| 3|} _ZN5Botan15X448_PrivateKeyC1ENSt3__14spanIKhLm18446744073709551615EEE: 124| 13|X448_PrivateKey::X448_PrivateKey(std::span secret_key) { 125| 13| BOTAN_ARG_CHECK(secret_key.size() == X448_LEN, "Invalid size for X448 private key"); ------------------ | | 35| 13| do { \ | | 36| 13| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 13| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 13] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 13| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 13] | | ------------------ ------------------ 126| 13| load_x448_keypair(secure_vector(secret_key.begin(), secret_key.end()), m_public, m_private); 127| 13|} _ZN5Botan15X448_PrivateKeyC1ERNS_21RandomNumberGeneratorE: 129| 13|X448_PrivateKey::X448_PrivateKey(RandomNumberGenerator& rng) : X448_PrivateKey(rng.random_vec(X448_LEN)) {} _ZNK5Botan15X448_PrivateKey23create_key_agreement_opERNS_21RandomNumberGeneratorENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEES7_: 201| 2| std::string_view provider) const { 202| 2| if(provider == "base" || provider.empty()) { ------------------ | Branch (202:7): [True: 0, False: 2] | Branch (202:29): [True: 2, False: 0] ------------------ 203| 2| return std::make_unique(m_private, params); 204| 2| } 205| 0| throw Provider_Not_Found(algo_name(), provider); 206| 2|} _ZNK5Botan20X448_PrivateKey_Data3keyEv: 35| 2| const secure_vector& key() const { return m_key; } _ZNK5Botan19X448_PublicKey_Data3keyEv: 25| 15| const std::array& key() const { return m_key; } x448.cpp:_ZN5Botan12_GLOBAL__N_117load_x448_keypairENSt3__16vectorIhNS_16secure_allocatorIhEEEERNS1_10shared_ptrIKNS_19X448_PublicKey_DataEEERNS6_IKNS_20X448_PrivateKey_DataEEE: 66| 13| std::shared_ptr& sk_out) { 67| 13| BOTAN_ASSERT_NOMSG(secret.size() == X448_LEN); ------------------ | | 77| 13| do { \ | | 78| 13| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 13| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 13] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 13| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 13] | | ------------------ ------------------ 68| 13| std::array pub{}; 69| 13| { 70| 13| auto scope = CT::scoped_poison(secret); 71| 13| x448_basepoint_from_data(pub, std::span(secret).first()); 72| 13| CT::unpoison(pub); 73| 13| } 74| 13| pk_out = std::make_shared(pub); 75| 13| sk_out = std::make_shared(std::move(secret)); 76| 13|} _ZN5Botan20X448_PrivateKey_DataC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 33| 13| explicit X448_PrivateKey_Data(secure_vector key) : m_key(std::move(key)) {} x448.cpp:_ZN5Botan12_GLOBAL__N_124x448_basepoint_from_dataENSt3__14spanIhLm56EEENS2_IKhLm56EEE: 47| 13|void x448_basepoint_from_data(std::span mypublic, std::span secret) { 48| 13| auto bp = x448_basepoint(decode_scalar(secret)); 49| 13| auto bp_bytes = encode_point(bp); 50| 13| copy_mem(mypublic, bp_bytes); 51| 13|} _ZN5Botan19X448_PublicKey_DataC2ENSt3__15arrayIhLm56EEE: 23| 15| explicit X448_PublicKey_Data(std::array key) : m_key(key) {} x448.cpp:_ZN5Botan12_GLOBAL__N_117X448_KA_OperationC2ENSt3__110shared_ptrIKNS_20X448_PrivateKey_DataEEENS2_17basic_string_viewIcNS2_11char_traitsIcEEEE: 157| 2| PK_Ops::Key_Agreement_with_KDF(kdf), m_key(std::move(key)) {} x448.cpp:_ZN5Botan12_GLOBAL__N_117X448_KA_Operation9raw_agreeEPKhm: 161| 2| secure_vector raw_agree(const uint8_t w_data[], size_t w_len) override { 162| 2| const auto& sk = m_key->key(); 163| 2| BOTAN_ASSERT_NOMSG(sk.size() == X448_LEN); ------------------ | | 77| 2| do { \ | | 78| 2| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 2| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 2] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 2| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 2] | | ------------------ ------------------ 164| 2| auto scope = CT::scoped_poison(sk); 165| | 166| 2| const std::span w(w_data, w_len); 167| 2| if(w.size() != X448_LEN) { ------------------ | Branch (167:13): [True: 0, False: 2] ------------------ 168| 0| throw Decoding_Error("Invalid size for X448 public key"); 169| 0| } 170| 2| const auto k = decode_scalar(sk); 171| 2| const auto u = decode_point(w); 172| | 173| 2| auto shared_secret = encode_point(x448(k, u)); 174| 2| CT::unpoison(shared_secret); 175| | 176| | // RFC 7748 Section 6.2 177| | // As with X25519, both sides MAY check, without leaking extra 178| | // information about the value of K, whether the resulting shared K 179| | // is the all-zero value and abort if so. 180| | // 181| | // TODO: once the generic Key Agreement operation creation is equipped 182| | // with a more flexible parameterization, this check could be 183| | // made optional. 184| | // For instance: `sk->agree().with_optional_sanity_checks(true)`. 185| | // See also: https://github.com/randombit/botan/pull/4318 186| 2| if(CT::all_zeros(shared_secret.data(), shared_secret.size()).as_bool()) { ------------------ | Branch (186:13): [True: 1, False: 1] ------------------ 187| 1| throw Invalid_Argument("X448 public point appears to be of low order"); 188| 1| } 189| | 190| 1| return shared_secret; 191| 2| } _ZN5Botan12encode_pointERKNS_6StrongINSt3__15arrayIhLm56EEENS_9Point448_EJEEE: 21| 15|secure_vector encode_point(const Point448& p) { 22| 15| return {p.begin(), p.end()}; 23| 15|} _ZN5Botan12decode_pointENSt3__14spanIKhLm18446744073709551615EEE: 25| 2|Point448 decode_point(std::span p_bytes) { 26| 2| BOTAN_ARG_CHECK(p_bytes.size() == X448_LEN, "Invalid size for X448 point"); ------------------ | | 35| 2| do { \ | | 36| 2| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 2| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 2] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 2| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 2] | | ------------------ ------------------ 27| 2| return typecast_copy(p_bytes); 28| 2|} _ZN5Botan13decode_scalarENSt3__14spanIKhLm18446744073709551615EEE: 30| 15|ScalarX448 decode_scalar(std::span scalar_bytes) { 31| 15| BOTAN_ARG_CHECK(scalar_bytes.size() == X448_LEN, "Invalid size for X448 scalar"); ------------------ | | 35| 15| do { \ | | 36| 15| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 15| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 15] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 15| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 15] | | ------------------ ------------------ 32| 15| auto buf = typecast_copy(scalar_bytes); 33| | 34| 15| buf[0] &= 0xfc; 35| 15| buf[55] |= 0x80; 36| | 37| 15| return buf; 38| 15|} _ZN5Botan14x448_basepointERKNS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEE: 41| 13|Point448 x448_basepoint(const ScalarX448& k) { 42| 13| const Point448 u({5}); 43| 13| return x448(k, u); 44| 13|} _ZN5Botan4x448ERKNS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEERKNS0_IS3_NS_9Point448_EJEEE: 48| 15|Point448 x448(const ScalarX448& k, const Point448& u) { 49| 15| const Gf448Elem x_1 = Gf448Elem(u.get()); 50| 15| Gf448Elem x_2 = Gf448Elem::one(); 51| 15| Gf448Elem z_2 = Gf448Elem::zero(); 52| 15| Gf448Elem x_3 = Gf448Elem(u.get()); 53| 15| Gf448Elem z_3 = Gf448Elem::one(); 54| 15| auto swap = CT::Mask::cleared(); 55| | 56| 6.73k| for(int16_t t = 448 - 1; t >= 0; --t) { ------------------ | Branch (56:29): [True: 6.72k, False: 15] ------------------ 57| 6.72k| auto k_t = CT::Mask::expand(get_bit(k, t)); 58| 6.72k| swap ^= k_t; 59| | 60| 6.72k| x_2.ct_cond_swap(swap, x_3); 61| 6.72k| z_2.ct_cond_swap(swap, z_3); 62| 6.72k| swap = k_t; 63| | 64| 6.72k| const auto A = x_2 + z_2; 65| 6.72k| const auto AA = square(A); 66| 6.72k| const auto B = x_2 - z_2; 67| 6.72k| const auto BB = square(B); 68| 6.72k| const auto E = AA - BB; 69| 6.72k| const auto C = x_3 + z_3; 70| 6.72k| const auto D = x_3 - z_3; 71| 6.72k| const auto DA = D * A; 72| 6.72k| const auto CB = C * B; 73| 6.72k| x_3 = square(DA + CB); 74| 6.72k| z_3 = x_1 * square(DA - CB); 75| 6.72k| x_2 = AA * BB; 76| 6.72k| z_2 = E * (AA + mul_a24(E)); 77| 6.72k| } 78| | 79| 15| x_2.ct_cond_swap(swap, x_3); 80| 15| z_2.ct_cond_swap(swap, z_3); 81| | 82| 15| const auto res = x_2 / z_2; 83| | 84| 15| return Point448(res.to_bytes()); 85| 15|} x448_internal.cpp:_ZN5Botan12_GLOBAL__N_17get_bitERKNS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEEm: 16| 6.72k|uint64_t get_bit(const ScalarX448& scalar, size_t bit) { 17| 6.72k| return (scalar[bit / 8] >> (bit % 8)) & 1; 18| 6.72k|} _ZN5Botan14EC_AffinePointC2ENSt3__110unique_ptrINS_19EC_AffinePoint_DataENS1_14default_deleteIS3_EEEE: 16| 12.1k|EC_AffinePoint::EC_AffinePoint(std::unique_ptr point) : m_point(std::move(point)) { 17| 12.1k| BOTAN_ASSERT_NONNULL(m_point); ------------------ | | 116| 12.1k| do { \ | | 117| 12.1k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 12.1k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 12.1k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 12.1k] | | ------------------ ------------------ 18| 12.1k|} _ZN5Botan14EC_AffinePointC2ERKS0_: 20| 3.27k|EC_AffinePoint::EC_AffinePoint(const EC_AffinePoint& other) : m_point(other.inner().clone()) {} _ZN5Botan14EC_AffinePointC2EOS0_: 22| 30.5k|EC_AffinePoint::EC_AffinePoint(EC_AffinePoint&& other) noexcept : m_point(std::move(other.m_point)) {} _ZNK5Botan14EC_AffinePoint15to_legacy_pointEv: 46| 10.5k|EC_Point EC_AffinePoint::to_legacy_point() const { 47| 10.5k| return m_point->to_legacy_point(); 48| 10.5k|} _ZNK5Botan14EC_AffinePoint19field_element_bytesEv: 110| 4.25k|size_t EC_AffinePoint::field_element_bytes() const { 111| 4.25k| return inner().field_element_bytes(); 112| 4.25k|} _ZNK5Botan14EC_AffinePoint11is_identityEv: 114| 16.4k|bool EC_AffinePoint::is_identity() const { 115| 16.4k| return inner().is_identity(); 116| 16.4k|} _ZN5Botan14EC_AffinePointD2Ev: 148| 45.9k|EC_AffinePoint::~EC_AffinePoint() = default; _ZN5Botan14EC_AffinePoint11deserializeERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 150| 1.63k|std::optional EC_AffinePoint::deserialize(const EC_Group& group, std::span bytes) { 151| 1.63k| if(bytes.empty()) { ------------------ | Branch (151:7): [True: 0, False: 1.63k] ------------------ 152| 0| return {}; 153| 0| } 154| | 155| 1.63k| switch(bytes[0]) { 156| 0| case 0x00: ------------------ | Branch (156:7): [True: 0, False: 1.63k] ------------------ 157| | // The identity element (see SEC1 section 2.3.4) 158| | // TODO(Botan4) remove this - we should reject the identity encoding 159| 0| if(bytes.size() == 1) { ------------------ | Branch (159:13): [True: 0, False: 0] ------------------ 160| 0| return EC_AffinePoint::identity(group); 161| 0| } else { 162| 0| return {}; 163| 0| } 164| 0| case 0x02: ------------------ | Branch (164:7): [True: 0, False: 1.63k] ------------------ 165| 0| case 0x03: ------------------ | Branch (165:7): [True: 0, False: 1.63k] ------------------ 166| 0| return EC_AffinePoint::deserialize_compressed(group, bytes); 167| 1.63k| case 0x04: ------------------ | Branch (167:7): [True: 1.63k, False: 0] ------------------ 168| 1.63k| return EC_AffinePoint::deserialize_uncompressed(group, bytes); 169| 0| case 0x06: ------------------ | Branch (169:7): [True: 0, False: 1.63k] ------------------ 170| 0| case 0x07: { ------------------ | Branch (170:7): [True: 0, False: 1.63k] ------------------ 171| | // The deprecated "hybrid" point format 172| | // TODO(Botan4) remove this 173| 0| const bool hdr_y_is_even = bytes[0] == 0x06; 174| 0| const bool y_is_even = (bytes.back() & 0x01) == 0; 175| | 176| 0| if(hdr_y_is_even == y_is_even) { ------------------ | Branch (176:13): [True: 0, False: 0] ------------------ 177| 0| std::vector sec1(bytes.begin(), bytes.end()); 178| 0| sec1[0] = 0x04; 179| 0| return EC_AffinePoint::deserialize_uncompressed(group, sec1); 180| 0| } else { 181| 0| return {}; 182| 0| } 183| 0| } 184| 0| default: ------------------ | Branch (184:7): [True: 0, False: 1.63k] ------------------ 185| 0| return {}; 186| 1.63k| } 187| 1.63k|} _ZN5Botan14EC_AffinePoint22deserialize_compressedERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 190| 2.09k| std::span bytes) { 191| 2.09k| if(auto pt = group._data()->point_deserialize_compressed(bytes)) { ------------------ | Branch (191:12): [True: 1.63k, False: 456] ------------------ 192| 1.63k| return EC_AffinePoint(std::move(pt)); 193| 1.63k| } else { 194| 456| return {}; 195| 456| } 196| 2.09k|} _ZN5Botan14EC_AffinePoint24deserialize_uncompressedERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 199| 9.98k| std::span bytes) { 200| 9.98k| if(auto pt = group._data()->point_deserialize_uncompressed(bytes)) { ------------------ | Branch (200:12): [True: 7.88k, False: 2.09k] ------------------ 201| 7.88k| return EC_AffinePoint(std::move(pt)); 202| 7.88k| } else { 203| 2.09k| return {}; 204| 2.09k| } 205| 9.98k|} _ZN5Botan14EC_AffinePoint5g_mulERKNS_9EC_ScalarERNS_21RandomNumberGeneratorE: 207| 2.61k|EC_AffinePoint EC_AffinePoint::g_mul(const EC_Scalar& scalar, RandomNumberGenerator& rng) { 208| 2.61k| auto pt = scalar._inner().group()->point_g_mul(scalar.inner(), rng); 209| 2.61k| return EC_AffinePoint(std::move(pt)); 210| 2.61k|} _ZNK5Botan14EC_AffinePoint10mul_x_onlyERKNS_9EC_ScalarERNS_21RandomNumberGeneratorE: 216| 1.63k|secure_vector EC_AffinePoint::mul_x_only(const EC_Scalar& scalar, RandomNumberGenerator& rng) const { 217| 1.63k| return inner().mul_x_only(scalar._inner(), rng); 218| 1.63k|} _ZNK5Botan14EC_AffinePoint9serializeENS_15EC_Point_FormatE: 243| 4.25k|std::vector EC_AffinePoint::serialize(EC_Point_Format format) const { 244| 4.25k| if(format == EC_Point_Format::Compressed) { ------------------ | Branch (244:7): [True: 53, False: 4.20k] ------------------ 245| 53| return this->serialize_compressed(); 246| 4.20k| } else if(format == EC_Point_Format::Uncompressed) { ------------------ | Branch (246:14): [True: 4.20k, False: 0] ------------------ 247| 4.20k| return this->serialize_uncompressed(); 248| 4.20k| } else { 249| | // The deprecated "hybrid" point encoding 250| | // TODO(Botan4) Remove this 251| 0| auto enc = this->serialize_uncompressed(); 252| 0| const bool y_is_odd = (enc[enc.size() - 1] & 0x01) == 0x01; 253| 0| enc.front() = y_is_odd ? 0x07 : 0x06; ------------------ | Branch (253:21): [True: 0, False: 0] ------------------ 254| 0| return enc; 255| 0| } 256| 4.25k|} _ZNK5Botan14EC_AffinePoint23serialize_compressed_toENSt3__14spanIhLm18446744073709551615EEE: 273| 53|void EC_AffinePoint::serialize_compressed_to(std::span bytes) const { 274| 53| BOTAN_STATE_CHECK(!this->is_identity()); ------------------ | | 51| 53| do { \ | | 52| 53| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 53| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 53] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 53| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 53] | | ------------------ ------------------ 275| 53| m_point->serialize_compressed_to(bytes); 276| 53|} _ZNK5Botan14EC_AffinePoint25serialize_uncompressed_toENSt3__14spanIhLm18446744073709551615EEE: 278| 4.20k|void EC_AffinePoint::serialize_uncompressed_to(std::span bytes) const { 279| 4.20k| BOTAN_STATE_CHECK(!this->is_identity()); ------------------ | | 51| 4.20k| do { \ | | 52| 4.20k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 4.20k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 4.20k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 4.20k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 4.20k] | | ------------------ ------------------ 280| 4.20k| m_point->serialize_uncompressed_to(bytes); 281| 4.20k|} _ZN5Botan8EC_Group13ec_group_dataEv: 231| 10.9k|EC_Group_Data_Map& EC_Group::ec_group_data() { 232| | /* 233| | * This exists purely to ensure the allocator is constructed before g_ec_data, 234| | * which ensures that its destructor runs after ~g_ec_data is complete. 235| | */ 236| | 237| 10.9k| static const Allocator_Initializer g_init_allocator; 238| 10.9k| static EC_Group_Data_Map g_ec_data; 239| 10.9k| return g_ec_data; 240| 10.9k|} _ZN5Botan8EC_Group18load_EC_group_infoEPKcS2_S2_S2_S2_S2_RKNS_3OIDE: 254| 6| const OID& oid) { 255| 6| BOTAN_ARG_CHECK(oid.has_value(), "EC_Group::load_EC_group_info OID must be set"); ------------------ | | 35| 6| do { \ | | 36| 6| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 6| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 6] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 6| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 6] | | ------------------ ------------------ 256| | 257| 6| const BigInt p(p_str); 258| 6| const BigInt a(a_str); 259| 6| const BigInt b(b_str); 260| 6| const BigInt g_x(g_x_str); 261| 6| const BigInt g_y(g_y_str); 262| 6| const BigInt order(order_str); 263| 6| const BigInt cofactor(1); // implicit 264| | 265| 6| return EC_Group_Data::create(p, a, b, g_x, g_y, order, cofactor, oid, EC_Group_Source::Builtin); 266| 6|} _ZN5Botan8EC_Group19DER_decode_EC_groupENSt3__14spanIKhLm18446744073709551615EEENS_15EC_Group_SourceE: 270| 6.24k| EC_Group_Source source) { 271| 6.24k| BER_Decoder dec(der, BER_Decoder::Limits::DER()); 272| | 273| 6.24k| auto next_obj_type = dec.peek_next_object().type_tag(); 274| | 275| 6.24k| if(next_obj_type == ASN1_Type::ObjectId) { ------------------ | Branch (275:7): [True: 6.24k, False: 0] ------------------ 276| 6.24k| OID oid; 277| 6.24k| dec.decode(oid).verify_end(); 278| | 279| 6.24k| auto data = ec_group_data().lookup(oid); 280| 6.24k| if(!data) { ------------------ | Branch (280:10): [True: 0, False: 6.24k] ------------------ 281| 0| throw Decoding_Error(fmt("Unknown namedCurve OID '{}'", oid.to_string())); 282| 0| } 283| | 284| 6.24k| return std::make_pair(data, false); 285| 6.24k| } else if(next_obj_type == ASN1_Type::Sequence) { ------------------ | Branch (285:14): [True: 0, False: 0] ------------------ 286| 0| BigInt p; 287| 0| BigInt a; 288| 0| BigInt b; 289| 0| BigInt order; 290| 0| BigInt cofactor; 291| 0| std::vector base_pt; 292| 0| std::vector seed; 293| | 294| 0| dec.start_sequence() 295| 0| .decode_and_check(1, "Unknown ECC param version code") 296| 0| .start_sequence() 297| 0| .decode_and_check(OID({1, 2, 840, 10045, 1, 1}), "Only prime ECC fields supported") 298| 0| .decode(p) 299| 0| .end_cons() 300| 0| .start_sequence() 301| 0| .decode_octet_string_bigint(a) 302| 0| .decode_octet_string_bigint(b) 303| 0| .decode_optional_string(seed, ASN1_Type::BitString, ASN1_Type::BitString, ASN1_Class::Universal) 304| 0| .end_cons() 305| 0| .decode(base_pt, ASN1_Type::OctetString) 306| 0| .decode(order) 307| 0| .decode(cofactor) 308| 0| .end_cons() 309| 0| .verify_end(); 310| | 311| | // TODO(Botan4) Require cofactor == 1 312| 0| if(cofactor <= 0 || cofactor >= 16) { ------------------ | Branch (312:10): [True: 0, False: 0] | Branch (312:27): [True: 0, False: 0] ------------------ 313| 0| throw Decoding_Error("Invalid ECC cofactor parameter"); 314| 0| } 315| | 316| 0| if(p.bits() < 112 || p.bits() > 521 || p.signum() < 0) { ------------------ | Branch (316:10): [True: 0, False: 0] | Branch (316:28): [True: 0, False: 0] | Branch (316:46): [True: 0, False: 0] ------------------ 317| 0| throw Decoding_Error("ECC p parameter is invalid size"); 318| 0| } 319| | 320| | // A can be zero 321| 0| if(a.signum() < 0 || a >= p) { ------------------ | Branch (321:10): [True: 0, False: 0] | Branch (321:28): [True: 0, False: 0] ------------------ 322| 0| throw Decoding_Error("Invalid ECC a parameter"); 323| 0| } 324| | 325| | // B must be > 0 326| 0| if(b.signum() <= 0 || b >= p) { ------------------ | Branch (326:10): [True: 0, False: 0] | Branch (326:29): [True: 0, False: 0] ------------------ 327| 0| throw Decoding_Error("Invalid ECC b parameter"); 328| 0| } 329| | 330| 0| if(order.signum() <= 0 || order >= 2 * p) { ------------------ | Branch (330:10): [True: 0, False: 0] | Branch (330:10): [True: 0, False: 0] | Branch (330:33): [True: 0, False: 0] ------------------ 331| 0| throw Decoding_Error("Invalid ECC group order"); 332| 0| } 333| | 334| 0| if(auto data = ec_group_data().lookup_from_params(p, a, b, base_pt, order, cofactor)) { ------------------ | Branch (334:15): [True: 0, False: 0] ------------------ 335| 0| return std::make_pair(data, true); 336| 0| } 337| | 338| | /* 339| | TODO(Botan4) the remaining code is used only to handle the case of decoding an EC_Group 340| | which is neither a builtin group nor a group that was registered by the application. 341| | It can all be removed and replaced with a throw 342| | */ 343| | 344| 0| auto mod_p = Barrett_Reduction::for_public_modulus(p); 345| 0| if(!is_bailie_psw_probable_prime(p, mod_p)) { ------------------ | Branch (345:10): [True: 0, False: 0] ------------------ 346| 0| throw Decoding_Error("ECC p parameter is not a prime"); 347| 0| } 348| | 349| 0| auto mod_order = Barrett_Reduction::for_public_modulus(order); 350| 0| if(!is_bailie_psw_probable_prime(order, mod_order)) { ------------------ | Branch (350:10): [True: 0, False: 0] ------------------ 351| 0| throw Decoding_Error("Invalid ECC order parameter"); 352| 0| } 353| | 354| 0| const size_t p_bytes = p.bytes(); 355| 0| if(base_pt.size() != 1 + p_bytes && base_pt.size() != 1 + 2 * p_bytes) { ------------------ | Branch (355:10): [True: 0, False: 0] | Branch (355:43): [True: 0, False: 0] ------------------ 356| 0| throw Decoding_Error("Invalid ECC base point encoding"); 357| 0| } 358| | 359| 0| auto [g_x, g_y] = [&]() { 360| 0| const uint8_t hdr = base_pt[0]; 361| | 362| 0| if(hdr == 0x04 && base_pt.size() == 1 + 2 * p_bytes) { 363| 0| const BigInt x = BigInt::from_bytes(std::span{base_pt}.subspan(1, p_bytes)); 364| 0| const BigInt y = BigInt::from_bytes(std::span{base_pt}.subspan(1 + p_bytes, p_bytes)); 365| | 366| 0| if(x < p && y < p) { 367| 0| return std::make_pair(x, y); 368| 0| } 369| 0| } else if((hdr == 0x02 || hdr == 0x03) && base_pt.size() == 1 + p_bytes) { 370| | // TODO(Botan4) remove this branch; we won't support compressed points 371| 0| const BigInt x = BigInt::from_bytes(std::span{base_pt}.subspan(1, p_bytes)); 372| 0| BigInt y = sqrt_modulo_prime(((x * x + a) * x + b) % p, p); 373| | 374| 0| if(x < p && y >= 0) { 375| 0| const bool y_mod_2 = (hdr & 0x01) == 1; 376| 0| if(y.get_bit(0) != y_mod_2) { 377| 0| y = p - y; 378| 0| } 379| | 380| 0| return std::make_pair(x, y); 381| 0| } 382| 0| } 383| | 384| 0| throw Decoding_Error("Invalid ECC base point encoding"); 385| 0| }(); 386| | 387| | // TODO(Botan4) we can remove this check since we'll only accept pre-registered groups 388| 0| auto y2 = mod_p.square(g_y); 389| 0| auto x3_ax_b = mod_p.reduce(mod_p.cube(g_x) + mod_p.multiply(a, g_x) + b); 390| 0| if(y2 != x3_ax_b) { ------------------ | Branch (390:10): [True: 0, False: 0] ------------------ 391| 0| throw Decoding_Error("Invalid ECC base point"); 392| 0| } 393| | 394| | /* 395| | * Create the group data without registering it in the global map. 396| | * 397| | * Applications that need persistent custom groups should register them 398| | * via the relevant EC_Group constructor 399| | */ 400| 0| auto data = EC_Group_Data::create(p, a, b, g_x, g_y, order, cofactor, OID(), source); 401| 0| return std::make_pair(data, true); 402| 0| } else if(next_obj_type == ASN1_Type::Null) { ------------------ | Branch (402:14): [True: 0, False: 0] ------------------ 403| 0| throw Decoding_Error("Decoding ImplicitCA ECC parameters is not supported"); 404| 0| } else { 405| 0| throw Decoding_Error( 406| 0| fmt("Unexpected tag {} while decoding ECC domain params", asn1_tag_to_string(next_obj_type))); 407| 0| } 408| 6.24k|} _ZN5Botan8EC_GroupD2Ev: 412| 51.3k|EC_Group::~EC_Group() = default; _ZN5Botan8EC_GroupC2ERKS0_: 414| 21.0k|EC_Group::EC_Group(const EC_Group&) = default; _ZN5Botan8EC_GroupC2EONSt3__110shared_ptrINS_13EC_Group_DataEEE: 419| 4.71k|EC_Group::EC_Group(std::shared_ptr&& data) : m_data(std::move(data)) {} _ZN5Botan8EC_Group9from_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 478| 4.71k|EC_Group EC_Group::from_name(std::string_view name) { 479| 4.71k| std::shared_ptr data; 480| | 481| 4.71k| if(auto oid = OID::from_name(name)) { ------------------ | Branch (481:12): [True: 4.71k, False: 0] ------------------ 482| 4.71k| data = ec_group_data().lookup(oid.value()); 483| 4.71k| } 484| | 485| 4.71k| if(!data) { ------------------ | Branch (485:7): [True: 0, False: 4.71k] ------------------ 486| 0| throw Invalid_Argument(fmt("Unknown EC_Group '{}'", name)); 487| 0| } 488| | 489| 4.71k| return EC_Group(std::move(data)); 490| 4.71k|} _ZN5Botan8EC_GroupC2ENSt3__14spanIKhLm18446744073709551615EEE: 636| 6.24k|EC_Group::EC_Group(std::span der) { 637| 6.24k| auto data = DER_decode_EC_group(der, EC_Group_Source::ExternalSource); 638| 6.24k| m_data = data.first; 639| 6.24k| m_explicit_encoding = data.second; 640| 6.24k|} _ZNK5Botan8EC_Group4dataEv: 647| 21.6k|const EC_Group_Data& EC_Group::data() const { 648| 21.6k| if(m_data == nullptr) { ------------------ | Branch (648:7): [True: 0, False: 21.6k] ------------------ 649| 0| throw Invalid_State("EC_Group uninitialized"); 650| 0| } 651| 21.6k| return *m_data; 652| 21.6k|} _ZNK5Botan8EC_Group10get_p_bitsEv: 654| 1.63k|size_t EC_Group::get_p_bits() const { 655| 1.63k| return data().p_bits(); 656| 1.63k|} _ZNK5Botan8EC_Group15get_order_bytesEv: 666| 6.24k|size_t EC_Group::get_order_bytes() const { 667| 6.24k| return data().order_bytes(); 668| 6.24k|} _ZNK5Botan8EC_Group12has_cofactorEv: 734| 3.27k|bool EC_Group::has_cofactor() const { 735| 3.27k| return data().has_cofactor(); 736| 3.27k|} _ZNK5Botan8EC_Group13get_curve_oidEv: 738| 10.5k|const OID& EC_Group::get_curve_oid() const { 739| 10.5k| return data().oid(); 740| 10.5k|} _ZN5Botan17EC_Group_Data_Map6lookupERKNS_3OIDE: 54| 10.9k| std::shared_ptr lookup(const OID& oid) { 55| 10.9k| const lock_guard_type lock(m_mutex); 56| | 57| 24.3k| for(auto i : m_registered_curves) { ------------------ | Branch (57:21): [True: 24.3k, False: 6] ------------------ 58| 24.3k| if(i->oid() == oid) { ------------------ | Branch (58:16): [True: 10.9k, False: 13.4k] ------------------ 59| 10.9k| return i; 60| 10.9k| } 61| 24.3k| } 62| | 63| | // Not found, check hardcoded data 64| 6| std::shared_ptr data = EC_Group::EC_group_info(oid); 65| | 66| 6| if(data) { ------------------ | Branch (66:13): [True: 6, False: 0] ------------------ 67| | // The requested OID may be an alias for a curve whose canonical OID differs 68| | // TODO(Botan4) remove this once we require exactly one canonical OID per curve 69| 6| if(data->oid() != oid) { ------------------ | Branch (69:16): [True: 0, False: 6] ------------------ 70| 0| for(const auto& i : m_registered_curves) { ------------------ | Branch (70:34): [True: 0, False: 0] ------------------ 71| 0| if(i->oid() == data->oid()) { ------------------ | Branch (71:22): [True: 0, False: 0] ------------------ 72| 0| return i; 73| 0| } 74| 0| } 75| 0| } 76| | 77| 6| m_registered_curves.push_back(data); 78| 6| return data; 79| 6| } 80| | 81| | // Nope, unknown curve 82| 0| return std::shared_ptr(); 83| 6| } _ZN5Botan13EC_Group_DataD2Ev: 28| 6|EC_Group_Data::~EC_Group_Data() = default; _ZN5Botan13EC_Group_DataC2ERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE: 40| 6| m_p(p), 41| 6| m_a(a), 42| 6| m_b(b), 43| 6| m_g_x(g_x), 44| 6| m_g_y(g_y), 45| 6| m_order(order), 46| 6| m_cofactor(cofactor), 47| |#if defined(BOTAN_HAS_LEGACY_EC_POINT) 48| 6| m_mod_field(Barrett_Reduction::for_public_modulus(p)), 49| 6| m_mod_order(Barrett_Reduction::for_public_modulus(order)), 50| 6| m_monty(m_p, m_mod_field), 51| |#endif 52| 6| m_oid(oid), 53| 6| m_p_words(p.sig_words()), 54| 6| m_p_bits(p.bits()), 55| 6| m_order_bits(order.bits()), 56| 6| m_order_bytes((m_order_bits + 7) / 8), 57| 6| m_a_is_minus_3(a == p - 3), 58| 6| m_a_is_zero(a.is_zero()), 59| 6| m_has_cofactor(m_cofactor != 1), 60| 6| m_order_is_less_than_p(m_order < p), 61| 6| m_source(source) { 62| | // Verify the generator (x, y) satisfies y^2 = x^3 + a*x + b (mod p) 63| 6| auto mod_p = Barrett_Reduction::for_public_modulus(p); 64| 6| const BigInt y2 = mod_p.square(g_y); 65| 6| const BigInt x3_ax_b = mod_p.reduce(mod_p.cube(g_x) + mod_p.multiply(a, g_x) + b); 66| 6| if(y2 != x3_ax_b) { ------------------ | Branch (66:7): [True: 0, False: 6] ------------------ 67| 0| throw Invalid_Argument("EC_Group generator is not on the curve"); 68| 0| } 69| | 70| | // TODO(Botan4) we can assume/assert the OID is set 71| 6| if(!m_oid.empty()) { ------------------ | Branch (71:7): [True: 6, False: 0] ------------------ 72| 6| DER_Encoder der(m_der_named_curve); 73| 6| der.encode(m_oid); 74| | 75| 6| if(const auto name = m_oid.registered_name()) { ------------------ | Branch (75:21): [True: 6, False: 0] ------------------ 76| | // returns nullptr if unknown or not supported 77| 6| m_pcurve = PCurve::PrimeOrderCurve::for_named_curve(*name); 78| 6| } 79| 6| if(m_pcurve) { ------------------ | Branch (79:10): [True: 6, False: 0] ------------------ 80| 6| m_engine = EC_Group_Engine::Optimized; 81| 6| } 82| 6| } 83| | 84| | // Try a generic pcurves instance 85| 6| if(!m_pcurve && !m_has_cofactor) { ------------------ | Branch (85:7): [True: 0, False: 6] | Branch (85:20): [True: 0, False: 0] ------------------ 86| 0| m_pcurve = PCurve::PrimeOrderCurve::from_params(p, a, b, g_x, g_y, order); 87| 0| if(m_pcurve) { ------------------ | Branch (87:10): [True: 0, False: 0] ------------------ 88| 0| m_engine = EC_Group_Engine::Generic; 89| 0| } 90| | // possibly still null here, if parameters unsuitable or if the 91| | // pcurves_generic module wasn't included in the build 92| 0| } 93| | 94| 6|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 95| 6| secure_vector ws; 96| 6| m_a_r = m_monty.mul(a, m_monty.R2(), ws); 97| 6| m_b_r = m_monty.mul(b, m_monty.R2(), ws); 98| 6| if(!m_pcurve) { ------------------ | Branch (98:7): [True: 0, False: 6] ------------------ 99| 0| m_engine = EC_Group_Engine::Legacy; 100| 0| } 101| |#else 102| | if(!m_pcurve) { 103| | if(m_oid.empty()) { 104| | throw Not_Implemented("EC_Group this group is not supported in this build configuration"); 105| | } else { 106| | throw Not_Implemented( 107| | fmt("EC_Group the group {} is not supported in this build configuration", oid.to_string())); 108| | } 109| | } 110| |#endif 111| 6|} _ZN5Botan13EC_Group_Data6createERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE: 121| 6| EC_Group_Source source) { 122| 6| auto group = std::make_shared(p, a, b, g_x, g_y, order, cofactor, oid, source); 123| | 124| 6|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 125| 6| group->m_curve = CurveGFp(group.get()); 126| 6| group->m_base_point = EC_Point(group->m_curve, g_x, g_y); 127| 6| if(!group->m_pcurve) { ------------------ | Branch (127:7): [True: 0, False: 6] ------------------ 128| 0| group->m_base_mult = std::make_unique(group->m_base_point, group->m_mod_order); 129| 0| } 130| 6|#endif 131| | 132| 6| return group; 133| 6|} _ZNK5Botan13EC_Group_Data13scalar_randomERNS_21RandomNumberGeneratorE: 293| 2.61k|std::unique_ptr EC_Group_Data::scalar_random(RandomNumberGenerator& rng) const { 294| 2.61k| if(m_pcurve) { ------------------ | Branch (294:7): [True: 2.61k, False: 0] ------------------ 295| 2.61k| return std::make_unique(shared_from_this(), m_pcurve->random_scalar(rng)); 296| 2.61k| } else { 297| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 298| 0| return std::make_unique(shared_from_this(), 299| 0| BigInt::random_integer(rng, BigInt::one(), m_order)); 300| |#else 301| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 302| |#endif 303| 0| } 304| 2.61k|} _ZNK5Botan13EC_Group_Data18scalar_deserializeENSt3__14spanIKhLm18446744073709551615EEE: 358| 6.24k|std::unique_ptr EC_Group_Data::scalar_deserialize(std::span bytes) const { 359| 6.24k| if(bytes.size() != m_order_bytes) { ------------------ | Branch (359:7): [True: 0, False: 6.24k] ------------------ 360| 0| return nullptr; 361| 0| } 362| | 363| 6.24k| if(m_pcurve) { ------------------ | Branch (363:7): [True: 6.24k, False: 0] ------------------ 364| 6.24k| if(auto s = m_pcurve->deserialize_scalar(bytes)) { ------------------ | Branch (364:15): [True: 6.24k, False: 0] ------------------ 365| 6.24k| return std::make_unique(shared_from_this(), *s); 366| 6.24k| } else { 367| 0| return nullptr; 368| 0| } 369| 6.24k| } else { 370| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 371| 0| BigInt r(bytes); 372| | 373| 0| if(r.is_zero() || r >= m_order) { ------------------ | Branch (373:10): [True: 0, False: 0] | Branch (373:25): [True: 0, False: 0] ------------------ 374| 0| return nullptr; 375| 0| } 376| | 377| 0| return std::make_unique(shared_from_this(), std::move(r)); 378| |#else 379| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 380| |#endif 381| 0| } 382| 6.24k|} _ZNK5Botan13EC_Group_Data30point_deserialize_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 385| 9.98k| std::span bytes) const { 386| 9.98k| if(bytes.size() != 1 + 2 * p_bytes() || bytes[0] != 0x04) { ------------------ | Branch (386:7): [True: 1.85k, False: 8.12k] | Branch (386:44): [True: 1, False: 8.12k] ------------------ 387| 1.85k| return {}; 388| 1.85k| } 389| | 390| 8.12k| if(m_pcurve) { ------------------ | Branch (390:7): [True: 8.12k, False: 0] ------------------ 391| 8.12k| if(auto pt = m_pcurve->deserialize_point_uncompressed(bytes)) { ------------------ | Branch (391:15): [True: 7.88k, False: 237] ------------------ 392| 7.88k| return std::make_unique(shared_from_this(), std::move(*pt)); 393| 7.88k| } else { 394| 237| return {}; 395| 237| } 396| 8.12k| } else { 397| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 398| 0| try { 399| 0| auto pt = Botan::OS2ECP(bytes, m_curve); 400| 0| return std::make_unique(shared_from_this(), std::move(pt)); 401| 0| } catch(...) { 402| 0| return {}; 403| 0| } 404| |#else 405| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 406| |#endif 407| 0| } 408| 8.12k|} _ZNK5Botan13EC_Group_Data28point_deserialize_compressedENSt3__14spanIKhLm18446744073709551615EEE: 410| 2.09k|std::unique_ptr EC_Group_Data::point_deserialize_compressed(std::span bytes) const { 411| 2.09k| if(bytes.size() != 1 + p_bytes() || (bytes[0] != 0x02 && bytes[0] != 0x03)) { ------------------ | Branch (411:7): [True: 254, False: 1.84k] | Branch (411:41): [True: 919, False: 922] | Branch (411:61): [True: 6, False: 913] ------------------ 412| 260| return {}; 413| 260| } 414| | 415| 1.83k| if(m_pcurve) { ------------------ | Branch (415:7): [True: 1.83k, False: 0] ------------------ 416| 1.83k| if(auto pt = m_pcurve->deserialize_point_compressed(bytes)) { ------------------ | Branch (416:15): [True: 1.63k, False: 196] ------------------ 417| 1.63k| return std::make_unique(shared_from_this(), std::move(*pt)); 418| 1.63k| } else { 419| 196| return {}; 420| 196| } 421| 1.83k| } else { 422| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 423| 0| try { 424| 0| auto pt = Botan::OS2ECP(bytes, m_curve); 425| 0| return std::make_unique(shared_from_this(), std::move(pt)); 426| 0| } catch(...) { 427| 0| return {}; 428| 0| } 429| |#else 430| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 431| |#endif 432| 0| } 433| 1.83k|} _ZNK5Botan13EC_Group_Data11point_g_mulERKNS_14EC_Scalar_DataERNS_21RandomNumberGeneratorE: 539| 2.61k| RandomNumberGenerator& rng) const { 540| 2.61k| if(m_pcurve) { ------------------ | Branch (540:7): [True: 2.61k, False: 0] ------------------ 541| 2.61k| const auto& k = EC_Scalar_Data_PC::checked_ref(scalar); 542| 2.61k| auto pt = m_pcurve->point_to_affine(m_pcurve->mul_by_g(k.value(), rng)); 543| 2.61k| return std::make_unique(shared_from_this(), std::move(pt)); 544| 2.61k| } else { 545| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 546| 0| const auto& group = scalar.group(); 547| 0| const auto& bn = EC_Scalar_Data_BN::checked_ref(scalar); 548| | 549| 0| BOTAN_STATE_CHECK(group->m_base_mult != nullptr); ------------------ | | 51| 0| do { \ | | 52| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 0| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 0] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 0| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 0] | | ------------------ ------------------ 550| 0| std::vector ws; 551| 0| auto pt = group->m_base_mult->mul(bn.value(), rng, m_order, ws); 552| 0| return std::make_unique(shared_from_this(), std::move(pt)); 553| |#else 554| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 555| |#endif 556| 0| } 557| 2.61k|} _ZN5Botan17EC_Scalar_Data_PC11checked_refERKNS_14EC_Scalar_DataE: 14| 4.25k|const EC_Scalar_Data_PC& EC_Scalar_Data_PC::checked_ref(const EC_Scalar_Data& data) { 15| 4.25k| const auto* p = dynamic_cast(&data); 16| 4.25k| if(p == nullptr) { ------------------ | Branch (16:7): [True: 0, False: 4.25k] ------------------ 17| 0| throw Invalid_State("Failed conversion to EC_Scalar_Data_PC"); 18| 0| } 19| 4.25k| return *p; 20| 4.25k|} _ZNK5Botan17EC_Scalar_Data_PC5groupEv: 22| 29.8k|const std::shared_ptr& EC_Scalar_Data_PC::group() const { 23| 29.8k| return m_group; 24| 29.8k|} _ZNK5Botan17EC_Scalar_Data_PC5bytesEv: 26| 8.86k|size_t EC_Scalar_Data_PC::bytes() const { 27| 8.86k| return this->group()->order_bytes(); 28| 8.86k|} _ZNK5Botan17EC_Scalar_Data_PC5cloneEv: 30| 7.88k|std::unique_ptr EC_Scalar_Data_PC::clone() const { 31| 7.88k| return std::make_unique(this->group(), this->value()); 32| 7.88k|} _ZNK5Botan17EC_Scalar_Data_PC7is_zeroEv: 34| 8.86k|bool EC_Scalar_Data_PC::is_zero() const { 35| 8.86k| const auto& pcurve = this->group()->pcurve(); 36| 8.86k| return pcurve.scalar_is_zero(m_v); 37| 8.86k|} _ZN5Botan17EC_Scalar_Data_PC7zeroizeEv: 49| 8.86k|void EC_Scalar_Data_PC::zeroize() { 50| 8.86k| m_v._zeroize(); 51| 8.86k|} _ZNK5Botan17EC_Scalar_Data_PC12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 82| 8.86k|void EC_Scalar_Data_PC::serialize_to(std::span bytes) const { 83| 8.86k| BOTAN_ARG_CHECK(bytes.size() == m_group->order_bytes(), "Invalid output length"); ------------------ | | 35| 8.86k| do { \ | | 36| 8.86k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 8.86k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 8.86k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 8.86k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 8.86k] | | ------------------ ------------------ 84| 8.86k| m_group->pcurve().serialize_scalar(bytes, m_v); 85| 8.86k|} _ZN5Botan22EC_AffinePoint_Data_PCC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEENS_6PCurve15PrimeOrderCurve11AffinePointE: 89| 15.4k| m_group(std::move(group)), m_pt(std::move(pt)) { 90| 15.4k| const auto& pcurve = m_group->pcurve(); 91| | 92| 15.4k| if(!pcurve.affine_point_is_identity(m_pt)) { ------------------ | Branch (92:7): [True: 15.4k, False: 0] ------------------ 93| 15.4k| m_xy.resize(1 + 2 * field_element_bytes()); 94| 15.4k| pcurve.serialize_point(m_xy, m_pt); 95| 15.4k| } 96| 15.4k|} _ZNK5Botan22EC_AffinePoint_Data_PC5cloneEv: 106| 3.27k|std::unique_ptr EC_AffinePoint_Data_PC::clone() const { 107| 3.27k| return std::make_unique(m_group, m_pt); 108| 3.27k|} _ZNK5Botan22EC_AffinePoint_Data_PC10mul_x_onlyERKNS_14EC_Scalar_DataERNS_21RandomNumberGeneratorE: 124| 1.63k| RandomNumberGenerator& rng) const { 125| 1.63k| BOTAN_ARG_CHECK(scalar.group() == m_group, "Curve mismatch"); ------------------ | | 35| 1.63k| do { \ | | 36| 1.63k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.63k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.63k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.63k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.63k] | | ------------------ ------------------ 126| 1.63k| const auto& k = EC_Scalar_Data_PC::checked_ref(scalar).value(); 127| 1.63k| return m_group->pcurve().mul_x_only(m_pt, k, rng); 128| 1.63k|} _ZNK5Botan22EC_AffinePoint_Data_PC19field_element_bytesEv: 130| 34.4k|size_t EC_AffinePoint_Data_PC::field_element_bytes() const { 131| 34.4k| return m_group->pcurve().field_element_bytes(); 132| 34.4k|} _ZNK5Botan22EC_AffinePoint_Data_PC11is_identityEv: 134| 31.2k|bool EC_AffinePoint_Data_PC::is_identity() const { 135| 31.2k| return m_xy.empty(); 136| 31.2k|} _ZNK5Botan22EC_AffinePoint_Data_PC14serialize_x_toENSt3__14spanIhLm18446744073709551615EEE: 138| 53|void EC_AffinePoint_Data_PC::serialize_x_to(std::span bytes) const { 139| 53| BOTAN_STATE_CHECK(!this->is_identity()); ------------------ | | 51| 53| do { \ | | 52| 53| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 53| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 53] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 53| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 53] | | ------------------ ------------------ 140| 53| const size_t fe_bytes = this->field_element_bytes(); 141| 53| BOTAN_ARG_CHECK(bytes.size() == fe_bytes, "Invalid output size"); ------------------ | | 35| 53| do { \ | | 36| 53| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 53| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 53] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 53| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 53] | | ------------------ ------------------ 142| 53| copy_mem(bytes, std::span{m_xy}.subspan(1, fe_bytes)); 143| 53|} _ZNK5Botan22EC_AffinePoint_Data_PC23serialize_compressed_toENSt3__14spanIhLm18446744073709551615EEE: 159| 53|void EC_AffinePoint_Data_PC::serialize_compressed_to(std::span bytes) const { 160| 53| BOTAN_STATE_CHECK(!this->is_identity()); ------------------ | | 51| 53| do { \ | | 52| 53| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 53| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 53] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 53| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 53] | | ------------------ ------------------ 161| 53| const size_t fe_bytes = this->field_element_bytes(); 162| 53| BOTAN_ARG_CHECK(bytes.size() == 1 + fe_bytes, "Invalid output size"); ------------------ | | 35| 53| do { \ | | 36| 53| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 53| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 53] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 53| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 53] | | ------------------ ------------------ 163| 53| const bool y_is_odd = (m_xy.back() & 0x01) == 0x01; 164| | 165| 53| BufferStuffer stuffer(bytes); 166| 53| stuffer.append(y_is_odd ? 0x03 : 0x02); ------------------ | Branch (166:19): [True: 24, False: 29] ------------------ 167| 53| this->serialize_x_to(stuffer.next(fe_bytes)); 168| 53|} _ZNK5Botan22EC_AffinePoint_Data_PC25serialize_uncompressed_toENSt3__14spanIhLm18446744073709551615EEE: 170| 4.20k|void EC_AffinePoint_Data_PC::serialize_uncompressed_to(std::span bytes) const { 171| 4.20k| BOTAN_STATE_CHECK(!this->is_identity()); ------------------ | | 51| 4.20k| do { \ | | 52| 4.20k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 4.20k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 4.20k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 4.20k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 4.20k] | | ------------------ ------------------ 172| 4.20k| const size_t fe_bytes = this->field_element_bytes(); 173| 4.20k| BOTAN_ARG_CHECK(bytes.size() == 1 + 2 * fe_bytes, "Invalid output size"); ------------------ | | 35| 4.20k| do { \ | | 36| 4.20k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 4.20k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 4.20k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 4.20k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 4.20k] | | ------------------ ------------------ 174| 4.20k| copy_mem(bytes, m_xy); 175| 4.20k|} _ZNK5Botan22EC_AffinePoint_Data_PC15to_legacy_pointEv: 178| 10.5k|EC_Point EC_AffinePoint_Data_PC::to_legacy_point() const { 179| 10.5k| if(this->is_identity()) { ------------------ | Branch (179:7): [True: 0, False: 10.5k] ------------------ 180| 0| return EC_Point(m_group->curve()); 181| 10.5k| } else { 182| 10.5k| const size_t fe_bytes = this->field_element_bytes(); 183| 10.5k| return EC_Point(m_group->curve(), 184| 10.5k| BigInt::from_bytes(std::span{m_xy}.subspan(1, fe_bytes)), 185| 10.5k| BigInt::from_bytes(std::span{m_xy}.last(fe_bytes))); 186| 10.5k| } 187| 10.5k|} _ZN5Botan8EC_Group13EC_group_infoERKNS_3OIDE: 16| 6|std::shared_ptr EC_Group::EC_group_info(const OID& oid) { 17| | // secp256r1 18| 6| if(oid == OID{1, 2, 840, 10045, 3, 1, 7}) { ------------------ | Branch (18:7): [True: 1, False: 5] ------------------ 19| 1| return load_EC_group_info( 20| 1| "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", 21| 1| "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", 22| 1| "0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", 23| 1| "0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296", 24| 1| "0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", 25| 1| "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551", 26| 1| oid); 27| 1| } 28| | 29| | // secp384r1 30| 5| if(oid == OID{1, 3, 132, 0, 34}) { ------------------ | Branch (30:7): [True: 1, False: 4] ------------------ 31| 1| return load_EC_group_info( 32| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF", 33| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC", 34| 1| "0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF", 35| 1| "0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7", 36| 1| "0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F", 37| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973", 38| 1| oid); 39| 1| } 40| | 41| | // secp521r1 42| 4| if(oid == OID{1, 3, 132, 0, 35}) { ------------------ | Branch (42:7): [True: 1, False: 3] ------------------ 43| 1| return load_EC_group_info( 44| 1| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", 45| 1| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC", 46| 1| "0x51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00", 47| 1| "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66", 48| 1| "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650", 49| 1| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409", 50| 1| oid); 51| 1| } 52| | 53| | // brainpool160r1 54| 3| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 1}) { ------------------ | Branch (54:7): [True: 0, False: 3] ------------------ 55| 0| return load_EC_group_info( 56| 0| "0xE95E4A5F737059DC60DFC7AD95B3D8139515620F", 57| 0| "0x340E7BE2A280EB74E2BE61BADA745D97E8F7C300", 58| 0| "0x1E589A8595423412134FAA2DBDEC95C8D8675E58", 59| 0| "0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3", 60| 0| "0x1667CB477A1A8EC338F94741669C976316DA6321", 61| 0| "0xE95E4A5F737059DC60DF5991D45029409E60FC09", 62| 0| oid); 63| 0| } 64| | 65| | // brainpool192r1 66| 3| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 3}) { ------------------ | Branch (66:7): [True: 0, False: 3] ------------------ 67| 0| return load_EC_group_info( 68| 0| "0xC302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297", 69| 0| "0x6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF", 70| 0| "0x469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9", 71| 0| "0xC0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6", 72| 0| "0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F", 73| 0| "0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1", 74| 0| oid); 75| 0| } 76| | 77| | // brainpool224r1 78| 3| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 5}) { ------------------ | Branch (78:7): [True: 0, False: 3] ------------------ 79| 0| return load_EC_group_info( 80| 0| "0xD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF", 81| 0| "0x68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43", 82| 0| "0x2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B", 83| 0| "0xD9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D", 84| 0| "0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD", 85| 0| "0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F", 86| 0| oid); 87| 0| } 88| | 89| | // brainpool256r1 90| 3| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 7}) { ------------------ | Branch (90:7): [True: 1, False: 2] ------------------ 91| 1| return load_EC_group_info( 92| 1| "0xA9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", 93| 1| "0x7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", 94| 1| "0x26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", 95| 1| "0x8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262", 96| 1| "0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", 97| 1| "0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7", 98| 1| oid); 99| 1| } 100| | 101| | // brainpool320r1 102| 2| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 9}) { ------------------ | Branch (102:7): [True: 0, False: 2] ------------------ 103| 0| return load_EC_group_info( 104| 0| "0xD35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27", 105| 0| "0x3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4", 106| 0| "0x520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6", 107| 0| "0x43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611", 108| 0| "0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1", 109| 0| "0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311", 110| 0| oid); 111| 0| } 112| | 113| | // brainpool384r1 114| 2| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 11}) { ------------------ | Branch (114:7): [True: 1, False: 1] ------------------ 115| 1| return load_EC_group_info( 116| 1| "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53", 117| 1| "0x7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826", 118| 1| "0x4A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11", 119| 1| "0x1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E", 120| 1| "0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315", 121| 1| "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565", 122| 1| oid); 123| 1| } 124| | 125| | // brainpool512r1 126| 1| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 13}) { ------------------ | Branch (126:7): [True: 1, False: 0] ------------------ 127| 1| return load_EC_group_info( 128| 1| "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3", 129| 1| "0x7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA", 130| 1| "0x3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723", 131| 1| "0x81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822", 132| 1| "0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892", 133| 1| "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069", 134| 1| oid); 135| 1| } 136| | 137| | // frp256v1 138| 0| if(oid == OID{1, 2, 250, 1, 223, 101, 256, 1}) { ------------------ | Branch (138:7): [True: 0, False: 0] ------------------ 139| 0| return load_EC_group_info( 140| 0| "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C03", 141| 0| "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C00", 142| 0| "0xEE353FCA5428A9300D4ABA754A44C00FDFEC0C9AE4B1A1803075ED967B7BB73F", 143| 0| "0xB6B3D4C356C139EB31183D4749D423958C27D2DCAF98B70164C97A2DD98F5CFF", 144| 0| "0x6142E0F7C8B204911F9271F0F3ECEF8C2701C307E8E4C9E183115A1554062CFB", 145| 0| "0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1", 146| 0| oid); 147| 0| } 148| | 149| | // gost_256A 150| 0| if(oid == OID{1, 2, 643, 7, 1, 2, 1, 1, 1} || oid == OID{1, 2, 643, 2, 2, 35, 1} || oid == OID{1, 2, 643, 2, 2, 36, 0}) { ------------------ | Branch (150:7): [True: 0, False: 0] | Branch (150:7): [True: 0, False: 0] | Branch (150:50): [True: 0, False: 0] | Branch (150:88): [True: 0, False: 0] ------------------ 151| 0| return load_EC_group_info( 152| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97", 153| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94", 154| 0| "0xA6", 155| 0| "0x1", 156| 0| "0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14", 157| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893", 158| 0| OID{1, 2, 643, 7, 1, 2, 1, 1, 1}); 159| 0| } 160| | 161| | // gost_512A 162| 0| if(oid == OID{1, 2, 643, 7, 1, 2, 1, 2, 1}) { ------------------ | Branch (162:7): [True: 0, False: 0] ------------------ 163| 0| return load_EC_group_info( 164| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7", 165| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4", 166| 0| "0xE8C2505DEDFC86DDC1BD0B2B6667F1DA34B82574761CB0E879BD081CFD0B6265EE3CB090F30D27614CB4574010DA90DD862EF9D4EBEE4761503190785A71C760", 167| 0| "0x3", 168| 0| "0x7503CFE87A836AE3A61B8816E25450E6CE5E1C93ACF1ABC1778064FDCBEFA921DF1626BE4FD036E93D75E6A50E3A41E98028FE5FC235F5B889A589CB5215F2A4", 169| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2B85DCACDB1411F10B275", 170| 0| oid); 171| 0| } 172| | 173| | // secp160k1 174| 0| if(oid == OID{1, 3, 132, 0, 9}) { ------------------ | Branch (174:7): [True: 0, False: 0] ------------------ 175| 0| return load_EC_group_info( 176| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", 177| 0| "0x0", 178| 0| "0x7", 179| 0| "0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB", 180| 0| "0x938CF935318FDCED6BC28286531733C3F03C4FEE", 181| 0| "0x100000000000000000001B8FA16DFAB9ACA16B6B3", 182| 0| oid); 183| 0| } 184| | 185| | // secp160r1 186| 0| if(oid == OID{1, 3, 132, 0, 8}) { ------------------ | Branch (186:7): [True: 0, False: 0] ------------------ 187| 0| return load_EC_group_info( 188| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF", 189| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC", 190| 0| "0x1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45", 191| 0| "0x4A96B5688EF573284664698968C38BB913CBFC82", 192| 0| "0x23A628553168947D59DCC912042351377AC5FB32", 193| 0| "0x100000000000000000001F4C8F927AED3CA752257", 194| 0| oid); 195| 0| } 196| | 197| | // secp160r2 198| 0| if(oid == OID{1, 3, 132, 0, 30}) { ------------------ | Branch (198:7): [True: 0, False: 0] ------------------ 199| 0| return load_EC_group_info( 200| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", 201| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70", 202| 0| "0xB4E134D3FB59EB8BAB57274904664D5AF50388BA", 203| 0| "0x52DCB034293A117E1F4FF11B30F7199D3144CE6D", 204| 0| "0xFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E", 205| 0| "0x100000000000000000000351EE786A818F3A1A16B", 206| 0| oid); 207| 0| } 208| | 209| | // secp192k1 210| 0| if(oid == OID{1, 3, 132, 0, 31}) { ------------------ | Branch (210:7): [True: 0, False: 0] ------------------ 211| 0| return load_EC_group_info( 212| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37", 213| 0| "0x0", 214| 0| "0x3", 215| 0| "0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D", 216| 0| "0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D", 217| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D", 218| 0| oid); 219| 0| } 220| | 221| | // secp192r1 222| 0| if(oid == OID{1, 2, 840, 10045, 3, 1, 1}) { ------------------ | Branch (222:7): [True: 0, False: 0] ------------------ 223| 0| return load_EC_group_info( 224| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 225| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 226| 0| "0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1", 227| 0| "0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012", 228| 0| "0x7192B95FFC8DA78631011ED6B24CDD573F977A11E794811", 229| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831", 230| 0| oid); 231| 0| } 232| | 233| | // secp224k1 234| 0| if(oid == OID{1, 3, 132, 0, 32}) { ------------------ | Branch (234:7): [True: 0, False: 0] ------------------ 235| 0| return load_EC_group_info( 236| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D", 237| 0| "0x0", 238| 0| "0x5", 239| 0| "0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C", 240| 0| "0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5", 241| 0| "0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7", 242| 0| oid); 243| 0| } 244| | 245| | // secp224r1 246| 0| if(oid == OID{1, 3, 132, 0, 33}) { ------------------ | Branch (246:7): [True: 0, False: 0] ------------------ 247| 0| return load_EC_group_info( 248| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001", 249| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE", 250| 0| "0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4", 251| 0| "0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21", 252| 0| "0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34", 253| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D", 254| 0| oid); 255| 0| } 256| | 257| | // secp256k1 258| 0| if(oid == OID{1, 3, 132, 0, 10}) { ------------------ | Branch (258:7): [True: 0, False: 0] ------------------ 259| 0| return load_EC_group_info( 260| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F", 261| 0| "0x0", 262| 0| "0x7", 263| 0| "0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", 264| 0| "0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", 265| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", 266| 0| oid); 267| 0| } 268| | 269| | // sm2p256v1 270| 0| if(oid == OID{1, 2, 156, 10197, 1, 301}) { ------------------ | Branch (270:7): [True: 0, False: 0] ------------------ 271| 0| return load_EC_group_info( 272| 0| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF", 273| 0| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC", 274| 0| "0x28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93", 275| 0| "0x32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7", 276| 0| "0xBC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0", 277| 0| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123", 278| 0| oid); 279| 0| } 280| | 281| | // x962_p192v2 282| 0| if(oid == OID{1, 2, 840, 10045, 3, 1, 2}) { ------------------ | Branch (282:7): [True: 0, False: 0] ------------------ 283| 0| return load_EC_group_info( 284| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 285| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 286| 0| "0xCC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953", 287| 0| "0xEEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A", 288| 0| "0x6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15", 289| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31", 290| 0| oid); 291| 0| } 292| | 293| | // x962_p192v3 294| 0| if(oid == OID{1, 2, 840, 10045, 3, 1, 3}) { ------------------ | Branch (294:7): [True: 0, False: 0] ------------------ 295| 0| return load_EC_group_info( 296| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 297| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 298| 0| "0x22123DC2395A05CAA7423DAECCC94760A7D462256BD56916", 299| 0| "0x7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896", 300| 0| "0x38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0", 301| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13", 302| 0| oid); 303| 0| } 304| | 305| | // x962_p239v1 306| 0| if(oid == OID{1, 2, 840, 10045, 3, 1, 4}) { ------------------ | Branch (306:7): [True: 0, False: 0] ------------------ 307| 0| return load_EC_group_info( 308| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 309| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 310| 0| "0x6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A", 311| 0| "0xFFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF", 312| 0| "0x7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE", 313| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B", 314| 0| oid); 315| 0| } 316| | 317| | // x962_p239v2 318| 0| if(oid == OID{1, 2, 840, 10045, 3, 1, 5}) { ------------------ | Branch (318:7): [True: 0, False: 0] ------------------ 319| 0| return load_EC_group_info( 320| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 321| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 322| 0| "0x617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C", 323| 0| "0x38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7", 324| 0| "0x5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA", 325| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063", 326| 0| oid); 327| 0| } 328| | 329| | // x962_p239v3 330| 0| if(oid == OID{1, 2, 840, 10045, 3, 1, 6}) { ------------------ | Branch (330:7): [True: 0, False: 0] ------------------ 331| 0| return load_EC_group_info( 332| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 333| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 334| 0| "0x255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E", 335| 0| "0x6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A", 336| 0| "0x1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3", 337| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551", 338| 0| oid); 339| 0| } 340| | 341| | // numsp512d1 342| 0| if(oid == OID{1, 3, 6, 1, 4, 1, 25258, 4, 3}) { ------------------ | Branch (342:7): [True: 0, False: 0] ------------------ 343| 0| return load_EC_group_info( 344| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7", 345| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4", 346| 0| "0x1D99B", 347| 0| "0x2", 348| 0| "0x1C282EB23327F9711952C250EA61AD53FCC13031CF6DD336E0B9328433AFBDD8CC5A1C1F0C716FDC724DDE537C2B0ADB00BB3D08DC83755B205CC30D7F83CF28", 349| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5B3CA4FB94E7831B4FC258ED97D0BDC63B568B36607CD243CE153F390433555D", 350| 0| oid); 351| 0| } 352| | 353| 0| return std::shared_ptr(); 354| 0|} _ZN5Botan9EC_ScalarC2ENSt3__110unique_ptrINS_14EC_Scalar_DataENS1_14default_deleteIS3_EEEE: 19| 8.86k|EC_Scalar::EC_Scalar(std::unique_ptr scalar) : m_scalar(std::move(scalar)) { 20| 8.86k| BOTAN_ASSERT_NONNULL(m_scalar); ------------------ | | 116| 8.86k| do { \ | | 117| 8.86k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 8.86k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 8.86k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 8.86k] | | ------------------ ------------------ 21| 8.86k|} _ZN5Botan9EC_ScalarC2ERKS0_: 23| 7.88k|EC_Scalar::EC_Scalar(const EC_Scalar& other) : m_scalar(other.inner().clone()) {} _ZN5Botan9EC_ScalarC2EOS0_: 25| 17.7k|EC_Scalar::EC_Scalar(EC_Scalar&& other) noexcept : m_scalar(std::move(other.m_scalar)) {} _ZN5Botan9EC_ScalarD2Ev: 46| 34.4k|EC_Scalar::~EC_Scalar() = default; _ZN5Botan9EC_Scalar6randomERKNS_8EC_GroupERNS_21RandomNumberGeneratorE: 64| 2.61k|EC_Scalar EC_Scalar::random(const EC_Group& group, RandomNumberGenerator& rng) { 65| 2.61k| return EC_Scalar(group._data()->scalar_random(rng)); 66| 2.61k|} _ZNK5Botan9EC_Scalar9to_bigintEv: 80| 8.86k|BigInt EC_Scalar::to_bigint() const { 81| 8.86k| secure_vector bytes(m_scalar->bytes()); 82| 8.86k| m_scalar->serialize_to(bytes); 83| 8.86k| return BigInt::from_bytes(bytes); 84| 8.86k|} _ZN5Botan9EC_Scalar11deserializeERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 122| 6.24k|std::optional EC_Scalar::deserialize(const EC_Group& group, std::span bytes) { 123| 6.24k| if(auto v = group._data()->scalar_deserialize(bytes)) { ------------------ | Branch (123:12): [True: 6.24k, False: 0] ------------------ 124| 6.24k| return EC_Scalar(std::move(v)); 125| 6.24k| } else { 126| 0| return {}; 127| 0| } 128| 6.24k|} _ZNK5Botan9EC_Scalar7is_zeroEv: 137| 8.86k|bool EC_Scalar::is_zero() const { 138| 8.86k| return inner().is_zero(); 139| 8.86k|} _ZN5Botan9EC_Scalar7zeroizeEv: 182| 8.86k|void EC_Scalar::zeroize() { 183| 8.86k| m_scalar->zeroize(); 184| 8.86k|} _ZN5Botan8CurveGFpC2EPKNS_13EC_Group_DataE: 28| 6|CurveGFp::CurveGFp(const EC_Group_Data* group) : m_group(group) { 29| 6| BOTAN_ASSERT_NONNULL(m_group); ------------------ | | 116| 6| do { \ | | 117| 6| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 6] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 6| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 6] | | ------------------ ------------------ 30| 6|} _ZNK5Botan8CurveGFp5groupEv: 32| 21.0k|const EC_Group_Data& CurveGFp::group() const { 33| 21.0k| BOTAN_ASSERT_NONNULL(m_group); ------------------ | | 116| 21.0k| do { \ | | 117| 21.0k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 21.0k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 21.0k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 21.0k] | | ------------------ ------------------ 34| 21.0k| return *m_group; 35| 21.0k|} _ZN5Botan8EC_PointC2ERKNS_8CurveGFpENS_6BigIntES4_: 115| 10.5k| m_curve(curve), m_x(std::move(x)), m_y(std::move(y)), m_z(m_curve.group().monty().R1()) { 116| 10.5k| const auto& group = m_curve.group(); 117| | 118| 10.5k| if(m_x < 0 || m_x >= group.p()) { ------------------ | Branch (118:7): [True: 0, False: 10.5k] | Branch (118:18): [True: 0, False: 10.5k] ------------------ 119| 0| throw Invalid_Argument("Invalid EC_Point affine x"); 120| 0| } 121| 10.5k| if(m_y < 0 || m_y >= group.p()) { ------------------ | Branch (121:7): [True: 0, False: 10.5k] | Branch (121:18): [True: 0, False: 10.5k] ------------------ 122| 0| throw Invalid_Argument("Invalid EC_Point affine y"); 123| 0| } 124| | 125| 10.5k| secure_vector monty_ws(monty_ws_size(group)); 126| | 127| 10.5k| to_rep(group, m_x, monty_ws); 128| 10.5k| to_rep(group, m_y, monty_ws); 129| 10.5k|} _ZN5Botan8EC_Point4swapERS0_: 792| 10.5k|void EC_Point::swap(EC_Point& other) noexcept { 793| 10.5k| m_curve.swap(other.m_curve); 794| 10.5k| m_x.swap(other.m_x); 795| 10.5k| m_y.swap(other.m_y); 796| 10.5k| m_z.swap(other.m_z); 797| 10.5k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_113monty_ws_sizeERKNS_13EC_Group_DataE: 102| 10.5k|size_t monty_ws_size(const EC_Group_Data& group) { 103| 10.5k| return 2 * group.p_words(); 104| 10.5k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16to_repERKNS_13EC_Group_DataERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE: 55| 21.0k|void to_rep(const EC_Group_Data& group, BigInt& x, secure_vector& ws) { 56| 21.0k| group.monty().mul_by(x, group.monty().R2(), ws); 57| 21.0k|} _ZN5Botan17EC_PublicKey_DataC2ERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 38| 6.24k| EC_PublicKey_Data(group, decode_ec_public_key_point(group, bytes)) {} _ZN5Botan17EC_PublicKey_DataC2ENS_8EC_GroupENS_14EC_AffinePointE: 41| 10.5k| m_group(std::move(group)), m_point(std::move(pt)) { 42| 10.5k|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 43| 10.5k| m_legacy_point = m_point.to_legacy_point(); 44| 10.5k|#endif 45| | 46| | // Checking that the point lies on the curve is done in the deserialization 47| | // of EC_AffinePoint. 48| 10.5k| BOTAN_ARG_CHECK(!m_point.is_identity(), "ECC public key cannot be point at infinity"); ------------------ | | 35| 10.5k| do { \ | | 36| 10.5k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.5k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.5k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.5k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.5k] | | ------------------ ------------------ 49| 10.5k|} _ZN5Botan18EC_PrivateKey_DataC2ENS_8EC_GroupENS_9EC_ScalarE: 52| 8.86k| m_group(std::move(group)), m_scalar(std::move(x)), m_legacy_x(m_scalar.to_bigint()) { 53| | // Checking that the scalar is lower than the group order is ensured in the 54| | // deserialization of the EC_Scalar or during the random generation respectively. 55| 8.86k| BOTAN_ARG_CHECK(m_scalar.is_nonzero(), "ECC private key cannot be zero"); ------------------ | | 35| 8.86k| do { \ | | 36| 8.86k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 8.86k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 8.86k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 8.86k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 8.86k] | | ------------------ ------------------ 56| 8.86k|} _ZN5Botan18EC_PrivateKey_DataC2ERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 88| 6.24k| Botan::EC_PrivateKey_Data(group, decode_ec_secret_key_scalar(group, bytes)) {} _ZN5Botan18EC_PrivateKey_DataD2Ev: 90| 8.86k|EC_PrivateKey_Data::~EC_PrivateKey_Data() { 91| 8.86k| m_scalar.zeroize(); 92| 8.86k|} _ZNK5Botan18EC_PrivateKey_Data10public_keyERNS_21RandomNumberGeneratorEb: 95| 2.61k| bool with_modular_inverse) const { 96| 2.61k| auto public_point = [&] { 97| 2.61k| if(with_modular_inverse) { 98| 2.61k| return EC_AffinePoint::g_mul(m_scalar.invert(), rng); 99| 2.61k| } else { 100| 2.61k| return EC_AffinePoint::g_mul(m_scalar, rng); 101| 2.61k| } 102| 2.61k| }; 103| | 104| 2.61k| return std::make_shared(m_group, public_point()); 105| 2.61k|} ec_key_data.cpp:_ZN5Botan12_GLOBAL__N_126decode_ec_public_key_pointERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 17| 6.24k|EC_AffinePoint decode_ec_public_key_point(const EC_Group& group, std::span bytes) { 18| | /* 19| | * RFC 5480 section 2.2: 20| | * The first octet of the OCTET STRING indicates whether the key is 21| | * compressed or uncompressed. The uncompressed form is indicated 22| | * by 0x04 and the compressed form is indicated by either 0x02 or 23| | * 0x03 (see 2.3.3 in [SEC1]). The public key MUST be rejected if 24| | * any other value is included in the first octet. 25| | */ 26| 6.24k| if(auto pt_uncompressed = EC_AffinePoint::deserialize_uncompressed(group, bytes)) { ------------------ | Branch (26:12): [True: 6.24k, False: 0] ------------------ 27| 6.24k| return std::move(pt_uncompressed).value(); 28| 6.24k| } else if(auto pt_compressed = EC_AffinePoint::deserialize_compressed(group, bytes)) { ------------------ | Branch (28:19): [True: 0, False: 0] ------------------ 29| 0| return std::move(pt_compressed).value(); 30| 0| } else { 31| 0| throw Decoding_Error("Failed to deserialize elliptic curve point"); 32| 0| } 33| 6.24k|} ec_key_data.cpp:_ZN5Botan12_GLOBAL__N_127decode_ec_secret_key_scalarERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 60| 6.24k|EC_Scalar decode_ec_secret_key_scalar(const EC_Group& group, std::span bytes) { 61| 6.24k| const size_t order_bytes = group.get_order_bytes(); 62| | 63| 6.24k| if(bytes.size() < order_bytes) { ------------------ | Branch (63:7): [True: 0, False: 6.24k] ------------------ 64| | /* 65| | * Older versions had a bug which caused secret keys to not be encoded to 66| | * the full byte length of the order if there were leading zero bytes. This 67| | * was particularly a problem for P-521, where on average half of keys do 68| | * not have their high bit set and so can be encoded in 65 bytes, vs 66 69| | * bytes for the full order. 70| | * 71| | * To accommodate this, zero prefix the key if we see such a short input 72| | */ 73| 0| secure_vector padded_sk(order_bytes); 74| 0| copy_mem(std::span{padded_sk}.last(bytes.size()), bytes); 75| 0| return decode_ec_secret_key_scalar(group, padded_sk); 76| 0| } 77| | 78| 6.24k| if(auto s = EC_Scalar::deserialize(group, bytes)) { ------------------ | Branch (78:12): [True: 6.24k, False: 0] ------------------ 79| 6.24k| return s.value(); 80| 6.24k| } else { 81| 0| throw Decoding_Error("EC private key is invalid for this group"); 82| 0| } 83| 6.24k|} ec_key_data.cpp:_ZZNK5Botan18EC_PrivateKey_Data10public_keyERNS_21RandomNumberGeneratorEbENK3$_0clEv: 96| 2.61k| auto public_point = [&] { 97| 2.61k| if(with_modular_inverse) { ------------------ | Branch (97:10): [True: 0, False: 2.61k] ------------------ 98| 0| return EC_AffinePoint::g_mul(m_scalar.invert(), rng); 99| 2.61k| } else { 100| 2.61k| return EC_AffinePoint::g_mul(m_scalar, rng); 101| 2.61k| } 102| 2.61k| }; _ZNK5Botan12EC_PublicKey10key_lengthEv: 28| 1.63k|size_t EC_PublicKey::key_length() const { 29| 1.63k| return domain().get_p_bits(); 30| 1.63k|} _ZN5Botan12EC_PublicKey27assert_algorithm_identifierERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEE: 49| 6.24k| std::string_view alg_name) { 50| 6.24k| if(alg_id.oid() != OID::from_string(alg_name)) { ------------------ | Branch (50:7): [True: 0, False: 6.24k] ------------------ 51| 0| throw Decoding_Error( 52| 0| fmt("Unexpected AlgorithmIdentifier OID {} in association with {} key", alg_id.oid(), alg_name)); 53| 0| } 54| | 55| 6.24k| return alg_id; // NOLINT(*-return-const-ref-from-parameter) 56| 6.24k|} _ZN5Botan12EC_PublicKeyC2ERKNS_8EC_GroupERKNS_14EC_AffinePointE: 66| 1.63k|EC_PublicKey::EC_PublicKey(const EC_Group& group, const EC_AffinePoint& pub_point) { 67| 1.63k| m_public_key = std::make_shared(group, pub_point); 68| 1.63k| m_domain_encoding = default_encoding_for(domain()); // NOLINT(*-prefer-member-initializer) 69| 1.63k|} _ZNK5Botan12EC_PublicKey6domainEv: 76| 13.7k|const EC_Group& EC_PublicKey::domain() const { 77| 13.7k| BOTAN_STATE_CHECK(m_public_key != nullptr); ------------------ | | 51| 13.7k| do { \ | | 52| 13.7k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 13.7k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 13.7k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 13.7k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 13.7k] | | ------------------ ------------------ 78| 13.7k| return m_public_key->group(); 79| 13.7k|} _ZNK5Botan12EC_PublicKey16_public_ec_pointEv: 88| 4.25k|const EC_AffinePoint& EC_PublicKey::_public_ec_point() const { 89| 4.25k| BOTAN_STATE_CHECK(m_public_key != nullptr); ------------------ | | 51| 4.25k| do { \ | | 52| 4.25k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 4.25k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 4.25k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 4.25k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 4.25k] | | ------------------ ------------------ 90| 4.25k| return m_public_key->public_key(); 91| 4.25k|} _ZNK5Botan12EC_PublicKey19raw_public_key_bitsEv: 102| 4.25k|std::vector EC_PublicKey::raw_public_key_bits() const { 103| 4.25k| return _public_ec_point().serialize(point_encoding()); 104| 4.25k|} _ZN5Botan12EC_PublicKey18set_point_encodingENS_15EC_Point_FormatE: 114| 5.23k|void EC_PublicKey::set_point_encoding(EC_Point_Format enc) { 115| 5.23k| if(enc != EC_Point_Format::Compressed && enc != EC_Point_Format::Uncompressed && enc != EC_Point_Format::Hybrid) { ------------------ | Branch (115:7): [True: 5.18k, False: 53] | Branch (115:45): [True: 0, False: 5.18k] | Branch (115:85): [True: 0, False: 0] ------------------ 116| 0| throw Invalid_Argument("Invalid point encoding for EC_PublicKey"); 117| 0| } 118| | 119| 5.23k| m_point_encoding = enc; 120| 5.23k|} _ZNK5Botan13EC_PrivateKey12_private_keyEv: 135| 1.63k|const EC_Scalar& EC_PrivateKey::_private_key() const { 136| 1.63k| BOTAN_STATE_CHECK(m_private_key != nullptr); ------------------ | | 51| 1.63k| do { \ | | 52| 1.63k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 1.63k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 1.63k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 1.63k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 1.63k] | | ------------------ ------------------ 137| 1.63k| return m_private_key->private_key(); 138| 1.63k|} _ZN5Botan13EC_PrivateKeyC2ERNS_21RandomNumberGeneratorERKNS_8EC_GroupEb: 155| 2.61k| m_with_modular_inverse(with_modular_inverse) { 156| 2.61k| auto scalar = EC_Scalar::random(ec_group, rng); 157| 2.61k| m_private_key = std::make_shared(ec_group, std::move(scalar)); 158| 2.61k| m_public_key = m_private_key->public_key(rng, with_modular_inverse); 159| 2.61k| m_domain_encoding = default_encoding_for(domain()); 160| 2.61k|} _ZN5Botan13EC_PrivateKeyC2ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEEb: 191| 6.24k| m_with_modular_inverse(with_modular_inverse) { 192| 6.24k| OID key_parameters; 193| 6.24k| secure_vector private_key_bits; 194| 6.24k| secure_vector public_key_bits; 195| | 196| 6.24k| BER_Decoder(key_bits, BER_Decoder::Limits::DER()) 197| 6.24k| .start_sequence() 198| 6.24k| .decode_and_check(1, "Unknown version code for ECC key") 199| 6.24k| .decode(private_key_bits, ASN1_Type::OctetString) 200| 6.24k| .decode_optional(key_parameters, ASN1_Type(0), ASN1_Class::ExplicitContextSpecific) 201| 6.24k| .decode_optional_octet_aligned_bitstring(public_key_bits, 1, ASN1_Class::ExplicitContextSpecific) 202| 6.24k| .end_cons() 203| 6.24k| .verify_end(); 204| | 205| 6.24k| std::unique_ptr group; 206| | 207| 6.24k| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (207:7): [True: 6.24k, False: 0] ------------------ 208| 6.24k| group = std::make_unique(alg_id.parameters()); 209| 6.24k| } 210| 6.24k| if(!key_parameters.empty()) { ------------------ | Branch (210:7): [True: 0, False: 6.24k] ------------------ 211| 0| if(group) { ------------------ | Branch (211:10): [True: 0, False: 0] ------------------ 212| 0| if(EC_Group(key_parameters) != *group) { ------------------ | Branch (212:13): [True: 0, False: 0] ------------------ 213| 0| throw Invalid_Argument( 214| 0| "Domain parameters supplied AlgorithmIdentifier does not match the ECC private key's domain parameters in EC_PrivateKey construction"); 215| 0| } 216| 0| } else { 217| 0| group = std::make_unique(key_parameters); 218| 0| } 219| 0| } 220| 6.24k| if(!group) { ------------------ | Branch (220:7): [True: 0, False: 6.24k] ------------------ 221| 0| throw Invalid_Argument("Domain parameters are not supplied in EC_PrivateKey construction"); 222| 0| } 223| | 224| 6.24k| m_private_key = std::make_shared(*group, private_key_bits); 225| | 226| 6.24k| if(public_key_bits.empty()) { ------------------ | Branch (226:7): [True: 0, False: 6.24k] ------------------ 227| 0| m_public_key = m_private_key->public_key(with_modular_inverse); 228| 6.24k| } else { 229| 6.24k| m_public_key = std::make_shared(*group, public_key_bits); 230| 6.24k| } 231| | 232| 6.24k| m_domain_encoding = default_encoding_for(domain()); 233| 6.24k|} ecc_key.cpp:_ZN5Botan12_GLOBAL__N_120default_encoding_forERKNS_8EC_GroupE: 38| 10.5k|EC_Group_Encoding default_encoding_for(const EC_Group& group) { 39| 10.5k| if(group.get_curve_oid().empty()) { ------------------ | Branch (39:7): [True: 0, False: 10.5k] ------------------ 40| 0| return EC_Group_Encoding::Explicit; 41| 10.5k| } else { 42| 10.5k| return EC_Group_Encoding::NamedCurve; 43| 10.5k| } 44| 10.5k|} _ZNK5Botan15ECDH_PrivateKey23create_key_agreement_opERNS_21RandomNumberGeneratorENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEES7_: 97| 1.63k| std::string_view provider) const { 98| 1.63k| if(provider == "base" || provider.empty()) { ------------------ | Branch (98:7): [True: 0, False: 1.63k] | Branch (98:29): [True: 1.63k, False: 0] ------------------ 99| 1.63k| return std::make_unique(*this, params, rng); 100| 1.63k| } 101| | 102| 0| throw Provider_Not_Found(algo_name(), provider); 103| 1.63k|} ecdh.cpp:_ZN5Botan12_GLOBAL__N_117ECDH_KA_OperationC2ERKNS_15ECDH_PrivateKeyENSt3__117basic_string_viewIcNS5_11char_traitsIcEEEERNS_21RandomNumberGeneratorE: 30| 1.63k| PK_Ops::Key_Agreement_with_KDF(kdf), 31| 1.63k| m_group(key.domain()), 32| 1.63k| m_l_times_priv(mul_cofactor_inv(m_group, key._private_key())), 33| 1.63k| m_rng(rng) {} ecdh.cpp:_ZN5Botan12_GLOBAL__N_117ECDH_KA_Operation16mul_cofactor_invERKNS_8EC_GroupERKNS_9EC_ScalarE: 68| 1.63k| static EC_Scalar mul_cofactor_inv(const EC_Group& group, const EC_Scalar& x) { 69| | // We implement BSI TR-03111 ECKAEG which only matters in the (rare/deprecated) 70| | // case of a curve with cofactor. 71| | 72| 1.63k| if(group.has_cofactor()) { ------------------ | Branch (72:13): [True: 0, False: 1.63k] ------------------ 73| | // We could precompute this but cofactors are rare 74| 0| return x * EC_Scalar::from_bigint(group, group.get_cofactor()).invert_vartime(); 75| 1.63k| } else { 76| 1.63k| return x; 77| 1.63k| } 78| 1.63k| } ecdh.cpp:_ZN5Botan12_GLOBAL__N_117ECDH_KA_Operation9raw_agreeEPKhm: 37| 1.63k| secure_vector raw_agree(const uint8_t w[], size_t w_len) override { 38| 1.63k| const auto input_point = [&] { 39| 1.63k| if(m_group.has_cofactor()) { 40| 1.63k|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 41| 1.63k| return EC_AffinePoint(m_group, m_group.get_cofactor() * m_group.OS2ECP(w, w_len)); 42| |#else 43| | throw Not_Implemented( 44| | "Support for DH with cofactor adjustment not available in this build configuration"); 45| |#endif 46| 1.63k| } else { 47| 1.63k| if(auto point = EC_AffinePoint::deserialize(m_group, {w, w_len})) { 48| 1.63k| return *point; 49| 1.63k| } else { 50| 1.63k| throw Decoding_Error("ECDH - Invalid elliptic curve point: not on curve"); 51| 1.63k| } 52| 1.63k| } 53| 1.63k| }(); 54| | 55| | // Typical specs (such as BSI's TR-03111 Section 4.3.1) require that 56| | // we check the resulting point of the multiplication to not be the 57| | // point at infinity. However, since we ensure that our ECC private 58| | // scalar can never be zero, checking the peer's input point is 59| | // equivalent. 60| 1.63k| if(input_point.is_identity()) { ------------------ | Branch (60:13): [True: 0, False: 1.63k] ------------------ 61| 0| throw Decoding_Error("ECDH - Invalid elliptic curve point: identity"); 62| 0| } 63| | 64| 1.63k| return input_point.mul_x_only(m_l_times_priv, m_rng); 65| 1.63k| } ecdh.cpp:_ZZN5Botan12_GLOBAL__N_117ECDH_KA_Operation9raw_agreeEPKhmENKUlvE_clEv: 38| 1.63k| const auto input_point = [&] { 39| 1.63k| if(m_group.has_cofactor()) { ------------------ | Branch (39:16): [True: 0, False: 1.63k] ------------------ 40| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 41| 0| return EC_AffinePoint(m_group, m_group.get_cofactor() * m_group.OS2ECP(w, w_len)); 42| |#else 43| | throw Not_Implemented( 44| | "Support for DH with cofactor adjustment not available in this build configuration"); 45| |#endif 46| 1.63k| } else { 47| 1.63k| if(auto point = EC_AffinePoint::deserialize(m_group, {w, w_len})) { ------------------ | Branch (47:24): [True: 1.63k, False: 0] ------------------ 48| 1.63k| return *point; 49| 1.63k| } else { 50| 0| throw Decoding_Error("ECDH - Invalid elliptic curve point: not on curve"); 51| 0| } 52| 1.63k| } 53| 1.63k| }(); _ZN5Botan8PEM_Code6decodeERNS_10DataSourceERNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEE: 62| 12.5k|secure_vector decode(DataSource& source, std::string& label) { 63| 12.5k| const size_t RANDOM_CHAR_LIMIT = 8; 64| | 65| 12.5k| label.clear(); 66| | 67| 12.5k| const std::string PEM_HEADER1 = "-----BEGIN "; 68| 12.5k| const std::string PEM_HEADER2 = "-----"; 69| 12.5k| size_t position = 0; 70| | 71| 152k| while(position != PEM_HEADER1.length()) { ------------------ | Branch (71:10): [True: 140k, False: 12.4k] ------------------ 72| 140k| auto b = source.read_byte(); 73| | 74| 140k| if(!b) { ------------------ | Branch (74:10): [True: 37, False: 140k] ------------------ 75| 37| throw Decoding_Error("PEM: No PEM header found"); 76| 37| } 77| 140k| if(static_cast(*b) == PEM_HEADER1[position]) { ------------------ | Branch (77:10): [True: 137k, False: 2.65k] ------------------ 78| 137k| ++position; 79| 137k| } else if(position >= RANDOM_CHAR_LIMIT) { ------------------ | Branch (79:17): [True: 1, False: 2.65k] ------------------ 80| 1| throw Decoding_Error("PEM: Malformed PEM header"); 81| 2.65k| } else { 82| 2.65k| position = 0; 83| 2.65k| } 84| 140k| } 85| 12.4k| position = 0; 86| 212k| while(position != PEM_HEADER2.length()) { ------------------ | Branch (86:10): [True: 199k, False: 12.4k] ------------------ 87| 199k| auto b = source.read_byte(); 88| | 89| 199k| if(!b) { ------------------ | Branch (89:10): [True: 0, False: 199k] ------------------ 90| 0| throw Decoding_Error("PEM: No PEM header found"); 91| 0| } 92| 199k| if(static_cast(*b) == PEM_HEADER2[position]) { ------------------ | Branch (92:10): [True: 62.4k, False: 137k] ------------------ 93| 62.4k| ++position; 94| 137k| } else if(position > 0) { ------------------ | Branch (94:17): [True: 0, False: 137k] ------------------ 95| 0| throw Decoding_Error("PEM: Malformed PEM header"); 96| 0| } 97| | 98| 199k| if(position == 0) { ------------------ | Branch (98:10): [True: 137k, False: 62.4k] ------------------ 99| 137k| if(label.size() >= 128) { ------------------ | Branch (99:13): [True: 0, False: 137k] ------------------ 100| 0| throw Decoding_Error("PEM: Label too long"); 101| 0| } 102| 137k| label += static_cast(*b); 103| 137k| } 104| 199k| } 105| | 106| 12.4k| std::vector b64; 107| | 108| 12.4k| const std::string PEM_TRAILER = fmt("-----END {}-----", label); 109| 12.4k| position = 0; 110| 5.49M| while(position != PEM_TRAILER.length()) { ------------------ | Branch (110:10): [True: 5.48M, False: 12.4k] ------------------ 111| 5.48M| auto b = source.read_byte(); 112| | 113| 5.48M| if(!b) { ------------------ | Branch (113:10): [True: 0, False: 5.48M] ------------------ 114| 0| throw Decoding_Error("PEM: No PEM trailer found"); 115| 0| } 116| 5.48M| if(static_cast(*b) == PEM_TRAILER[position]) { ------------------ | Branch (116:10): [True: 312k, False: 5.17M] ------------------ 117| 312k| ++position; 118| 5.17M| } else if(position > 0) { ------------------ | Branch (118:17): [True: 0, False: 5.17M] ------------------ 119| 0| throw Decoding_Error("PEM: Malformed PEM trailer"); 120| 0| } 121| | 122| 5.48M| if(position == 0) { ------------------ | Branch (122:10): [True: 5.17M, False: 312k] ------------------ 123| 5.17M| b64.push_back(*b); 124| 5.17M| } 125| 5.48M| } 126| | 127| 12.4k| return base64_decode(b64.data(), b64.size()); 128| 12.4k|} _ZN5Botan8PEM_Code7matchesERNS_10DataSourceENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEm: 143| 451|bool matches(DataSource& source, std::string_view extra, size_t search_range) { 144| 451| const std::string PEM_HEADER = fmt("-----BEGIN {}", extra); 145| | 146| 451| secure_vector search_buf(search_range); 147| 451| const size_t got = source.peek(search_buf.data(), search_buf.size(), 0); 148| | 149| 451| if(got < PEM_HEADER.length()) { ------------------ | Branch (149:7): [True: 70, False: 381] ------------------ 150| 70| return false; 151| 70| } 152| | 153| 381| size_t index = 0; 154| | 155| 17.8k| for(size_t j = 0; j != got; ++j) { ------------------ | Branch (155:22): [True: 17.5k, False: 381] ------------------ 156| 17.5k| if(static_cast(search_buf[j]) == PEM_HEADER[index]) { ------------------ | Branch (156:10): [True: 328, False: 17.1k] ------------------ 157| 328| ++index; 158| 17.1k| } else { 159| 17.1k| index = 0; 160| 17.1k| } 161| | 162| 17.5k| if(index == PEM_HEADER.size()) { ------------------ | Branch (162:10): [True: 0, False: 17.5k] ------------------ 163| 0| return true; 164| 0| } 165| 17.5k| } 166| | 167| 381| return false; 168| 381|} _ZN5Botan16load_private_keyERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 298| 6.24k| [[maybe_unused]] std::span key_bits) { 299| 6.24k| const std::string alg_name = [&]() -> std::string { 300| 6.24k| if(const auto name = alg_id.oid().registered_name()) { 301| 6.24k| const std::vector alg_info = split_on(*name, '/'); 302| 6.24k| if(!alg_info.empty()) { 303| 6.24k| return alg_info[0]; 304| 6.24k| } 305| 6.24k| } 306| | 307| 6.24k| throw Decoding_Error( 308| 6.24k| fmt("Private key decoding failed, no algorithm associated with {}", alg_id.oid().to_string())); 309| 6.24k| }(); 310| | 311| 6.24k|#if defined(BOTAN_HAS_RSA) 312| 6.24k| if(alg_name == "RSA") { ------------------ | Branch (312:7): [True: 0, False: 6.24k] ------------------ 313| 0| return std::make_unique(alg_id, key_bits); 314| 0| } 315| 6.24k|#endif 316| | 317| 6.24k|#if defined(BOTAN_HAS_X25519) 318| 6.24k| if(alg_name == "X25519" || alg_name == "Curve25519") { ------------------ | Branch (318:7): [True: 0, False: 6.24k] | Branch (318:31): [True: 0, False: 6.24k] ------------------ 319| 0| return std::make_unique(alg_id, key_bits); 320| 0| } 321| 6.24k|#endif 322| | 323| 6.24k|#if defined(BOTAN_HAS_X448) 324| 6.24k| if(alg_name == "X448") { ------------------ | Branch (324:7): [True: 0, False: 6.24k] ------------------ 325| 0| return std::make_unique(alg_id, key_bits); 326| 0| } 327| 6.24k|#endif 328| | 329| 6.24k|#if defined(BOTAN_HAS_ECDSA) 330| 6.24k| if(alg_name == "ECDSA") { ------------------ | Branch (330:7): [True: 6.24k, False: 0] ------------------ 331| 6.24k| return std::make_unique(alg_id, key_bits); 332| 6.24k| } 333| 0|#endif 334| | 335| 0|#if defined(BOTAN_HAS_ECDH) 336| 0| if(alg_name == "ECDH") { ------------------ | Branch (336:7): [True: 0, False: 0] ------------------ 337| 0| return std::make_unique(alg_id, key_bits); 338| 0| } 339| 0|#endif 340| | 341| 0|#if defined(BOTAN_HAS_DIFFIE_HELLMAN) 342| 0| if(alg_name == "DH") { ------------------ | Branch (342:7): [True: 0, False: 0] ------------------ 343| 0| return std::make_unique(alg_id, key_bits); 344| 0| } 345| 0|#endif 346| | 347| 0|#if defined(BOTAN_HAS_DSA) 348| 0| if(alg_name == "DSA") { ------------------ | Branch (348:7): [True: 0, False: 0] ------------------ 349| 0| return std::make_unique(alg_id, key_bits); 350| 0| } 351| 0|#endif 352| | 353| 0|#if defined(BOTAN_HAS_FRODOKEM) 354| 0| if(alg_name == "FrodoKEM" || alg_name.starts_with("FrodoKEM-") || alg_name.starts_with("eFrodoKEM-")) { ------------------ | Branch (354:7): [True: 0, False: 0] | Branch (354:33): [True: 0, False: 0] | Branch (354:70): [True: 0, False: 0] ------------------ 355| 0| return std::make_unique(alg_id, key_bits); 356| 0| } 357| 0|#endif 358| | 359| 0|#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S) 360| 0| if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) { ------------------ | Branch (360:7): [True: 0, False: 0] | Branch (360:30): [True: 0, False: 0] ------------------ 361| 0| return std::make_unique(alg_id, key_bits); 362| 0| } 363| 0|#endif 364| | 365| 0|#if defined(BOTAN_HAS_ML_KEM) 366| 0| if(alg_name.starts_with("ML-KEM-")) { ------------------ | Branch (366:7): [True: 0, False: 0] ------------------ 367| 0| return std::make_unique(alg_id, key_bits); 368| 0| } 369| 0|#endif 370| | 371| 0|#if defined(BOTAN_HAS_MCELIECE) 372| 0| if(alg_name == "McEliece") { ------------------ | Branch (372:7): [True: 0, False: 0] ------------------ 373| 0| return std::make_unique(alg_id, key_bits); 374| 0| } 375| 0|#endif 376| | 377| 0|#if defined(BOTAN_HAS_ECGDSA) 378| 0| if(alg_name == "ECGDSA") { ------------------ | Branch (378:7): [True: 0, False: 0] ------------------ 379| 0| return std::make_unique(alg_id, key_bits); 380| 0| } 381| 0|#endif 382| | 383| 0|#if defined(BOTAN_HAS_ECKCDSA) 384| 0| if(alg_name == "ECKCDSA") { ------------------ | Branch (384:7): [True: 0, False: 0] ------------------ 385| 0| return std::make_unique(alg_id, key_bits); 386| 0| } 387| 0|#endif 388| | 389| 0|#if defined(BOTAN_HAS_ED25519) 390| 0| if(alg_name == "Ed25519") { ------------------ | Branch (390:7): [True: 0, False: 0] ------------------ 391| 0| return std::make_unique(alg_id, key_bits); 392| 0| } 393| 0|#endif 394| | 395| 0|#if defined(BOTAN_HAS_ED448) 396| 0| if(alg_name == "Ed448") { ------------------ | Branch (396:7): [True: 0, False: 0] ------------------ 397| 0| return std::make_unique(alg_id, key_bits); 398| 0| } 399| 0|#endif 400| | 401| 0|#if defined(BOTAN_HAS_GOST_34_10_2001) 402| 0| if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") { ------------------ | Branch (402:7): [True: 0, False: 0] | Branch (402:35): [True: 0, False: 0] | Branch (402:72): [True: 0, False: 0] ------------------ 403| 0| return std::make_unique(alg_id, key_bits); 404| 0| } 405| 0|#endif 406| | 407| 0|#if defined(BOTAN_HAS_SM2) 408| 0| if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") { ------------------ | Branch (408:7): [True: 0, False: 0] | Branch (408:28): [True: 0, False: 0] | Branch (408:53): [True: 0, False: 0] ------------------ 409| 0| return std::make_unique(alg_id, key_bits); 410| 0| } 411| 0|#endif 412| | 413| 0|#if defined(BOTAN_HAS_ELGAMAL) 414| 0| if(alg_name == "ElGamal") { ------------------ | Branch (414:7): [True: 0, False: 0] ------------------ 415| 0| return std::make_unique(alg_id, key_bits); 416| 0| } 417| 0|#endif 418| | 419| 0|#if defined(BOTAN_HAS_XMSS_RFC8391) 420| 0| if(alg_name == "XMSS") { ------------------ | Branch (420:7): [True: 0, False: 0] ------------------ 421| 0| return std::make_unique(alg_id, key_bits); 422| 0| } 423| 0|#endif 424| | 425| 0|#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES) 426| 0| if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) { ------------------ | Branch (426:7): [True: 0, False: 0] | Branch (426:34): [True: 0, False: 0] ------------------ 427| 0| return std::make_unique(alg_id, key_bits); 428| 0| } 429| 0|#endif 430| | 431| 0|#if defined(BOTAN_HAS_ML_DSA) 432| 0| if(alg_name.starts_with("ML-DSA-")) { ------------------ | Branch (432:7): [True: 0, False: 0] ------------------ 433| 0| return std::make_unique(alg_id, key_bits); 434| 0| } 435| 0|#endif 436| | 437| 0|#if defined(BOTAN_HAS_HSS_LMS) 438| 0| if(alg_name == "HSS-LMS-Private-Key") { ------------------ | Branch (438:7): [True: 0, False: 0] ------------------ 439| 0| return std::make_unique(alg_id, key_bits); 440| 0| } 441| 0|#endif 442| | 443| 0|#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE) 444| 0| if(alg_name == "SPHINCS+" || alg_name.starts_with("SphincsPlus-")) { ------------------ | Branch (444:7): [True: 0, False: 0] | Branch (444:33): [True: 0, False: 0] ------------------ 445| 0| return std::make_unique(alg_id, key_bits); 446| 0| } 447| 0|#endif 448| | 449| 0|#if defined(BOTAN_HAS_SLH_DSA_WITH_SHA2) || defined(BOTAN_HAS_SLH_DSA_WITH_SHAKE) 450| 0| if(alg_name.starts_with("SLH-DSA-") || alg_name.starts_with("Hash-SLH-DSA-")) { ------------------ | Branch (450:7): [True: 0, False: 0] | Branch (450:43): [True: 0, False: 0] ------------------ 451| 0| return std::make_unique(alg_id, key_bits); 452| 0| } 453| 0|#endif 454| | 455| 0|#if defined(BOTAN_HAS_CLASSICMCELIECE) 456| 0| if(alg_name.starts_with("ClassicMcEliece")) { ------------------ | Branch (456:7): [True: 0, False: 0] ------------------ 457| 0| return std::make_unique(alg_id, key_bits); 458| 0| } 459| 0|#endif 460| | 461| 0| throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name)); 462| 0|} pk_algs.cpp:_ZZN5Botan16load_private_keyERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEEENK3$_0clEv: 299| 6.24k| const std::string alg_name = [&]() -> std::string { 300| 6.24k| if(const auto name = alg_id.oid().registered_name()) { ------------------ | Branch (300:21): [True: 6.24k, False: 0] ------------------ 301| 6.24k| const std::vector alg_info = split_on(*name, '/'); 302| 6.24k| if(!alg_info.empty()) { ------------------ | Branch (302:13): [True: 6.24k, False: 0] ------------------ 303| 6.24k| return alg_info[0]; 304| 6.24k| } 305| 6.24k| } 306| | 307| 0| throw Decoding_Error( 308| 0| fmt("Private key decoding failed, no algorithm associated with {}", alg_id.oid().to_string())); 309| 6.24k| }(); _ZN5Botan22format_hex_fingerprintENSt3__14spanIKhLm18446744073709551615EEE: 45| 12.4k|std::string format_hex_fingerprint(std::span bits) { 46| 12.4k| const std::string hex = hex_encode(bits); 47| | 48| 12.4k| std::string fprint; 49| 12.4k| fprint.reserve(3 * bits.size()); 50| | 51| 337k| for(size_t i = 0; i != hex.size(); i += 2) { ------------------ | Branch (51:22): [True: 324k, False: 12.4k] ------------------ 52| 324k| if(i != 0) { ------------------ | Branch (52:10): [True: 312k, False: 12.4k] ------------------ 53| 312k| fprint.push_back(':'); 54| 312k| } 55| | 56| 324k| fprint.push_back(hex[i]); 57| 324k| fprint.push_back(hex[i + 1]); 58| 324k| } 59| | 60| 12.4k| return fprint; 61| 12.4k|} _ZN5Botan6PK_Ops22Key_Agreement_with_KDFC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 77| 1.64k|PK_Ops::Key_Agreement_with_KDF::Key_Agreement_with_KDF(std::string_view kdf) { 78| 1.64k| if(kdf != "Raw") { ------------------ | Branch (78:7): [True: 0, False: 1.64k] ------------------ 79| 0| m_kdf = KDF::create_or_throw(kdf); 80| 0| } 81| 1.64k|} _ZN5Botan6PK_Ops22Key_Agreement_with_KDFD2Ev: 83| 1.64k|PK_Ops::Key_Agreement_with_KDF::~Key_Agreement_with_KDF() = default; _ZN5Botan6PK_Ops22Key_Agreement_with_KDF5agreeEmNSt3__14spanIKhLm18446744073709551615EEES5_: 87| 1.64k| std::span salt) { 88| 1.64k| if(!salt.empty() && m_kdf == nullptr) { ------------------ | Branch (88:7): [True: 0, False: 1.64k] | Branch (88:24): [True: 0, False: 0] ------------------ 89| 0| throw Invalid_Argument("PK_Key_Agreement::derive_key requires a KDF to use a salt"); 90| 0| } 91| | 92| 1.64k| secure_vector z = raw_agree(other_key.data(), other_key.size()); 93| 1.64k| if(m_kdf) { ------------------ | Branch (93:7): [True: 0, False: 1.64k] ------------------ 94| 0| return m_kdf->derive_key(key_len, z, salt.data(), salt.size()); 95| 0| } 96| 1.64k| return z; 97| 1.64k|} _ZN5Botan5PKCS88load_keyERNS_10DataSourceE: 350| 6.24k|std::unique_ptr load_key(DataSource& source) { 351| 6.24k| auto fail_fn = []() -> std::string { 352| 6.24k| throw PKCS8_Exception("Internal error: Attempt to read password for unencrypted key"); 353| 6.24k| }; 354| | 355| 6.24k| return load_key(source, fail_fn, false); 356| 6.24k|} pkcs8.cpp:_ZN5Botan5PKCS812_GLOBAL__N_18load_keyERNS_10DataSourceERKNSt3__18functionIFNS4_12basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEvEEEb: 303| 6.24k| bool is_encrypted) { 304| 6.24k| AlgorithmIdentifier alg_id; 305| 6.24k| secure_vector pkcs8_key = PKCS8_decode(source, get_pass, alg_id, is_encrypted); 306| | 307| 6.24k| if(const auto alg_name = alg_id.oid().registered_name()) { ------------------ | Branch (307:18): [True: 6.24k, False: 0] ------------------ 308| 6.24k| return load_private_key(alg_id, pkcs8_key); 309| 6.24k| } else { 310| 0| throw PKCS8_Exception(fmt("Unknown algorithm OID {}", alg_id.oid())); 311| 0| } 312| 6.24k|} pkcs8.cpp:_ZN5Botan5PKCS812_GLOBAL__N_112PKCS8_decodeERNS_10DataSourceERKNSt3__18functionIFNS4_12basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEvEEERNS_19AlgorithmIdentifierEb: 50| 6.24k| bool is_encrypted) { 51| 6.24k| AlgorithmIdentifier pbe_alg_id; 52| 6.24k| secure_vector key_data; 53| 6.24k| secure_vector key; 54| | 55| 6.24k| try { 56| 6.24k| if(ASN1::maybe_BER(source) && !PEM_Code::matches(source)) { ------------------ | Branch (56:10): [True: 0, False: 6.24k] | Branch (56:37): [True: 0, False: 0] ------------------ 57| 0| if(is_encrypted) { ------------------ | Branch (57:13): [True: 0, False: 0] ------------------ 58| 0| key_data = PKCS8_extract(source, pbe_alg_id); 59| 0| } else { 60| | // todo read more efficiently 61| 0| while(auto b = source.read_byte()) { ------------------ | Branch (61:24): [True: 0, False: 0] ------------------ 62| 0| key_data.push_back(*b); 63| 0| } 64| 0| } 65| 6.24k| } else { 66| 6.24k| std::string label; 67| 6.24k| key_data = PEM_Code::decode(source, label); 68| | 69| | // todo remove autodetect for pem as well? 70| 6.24k| if(label == "PRIVATE KEY") { ------------------ | Branch (70:13): [True: 6.24k, False: 0] ------------------ 71| 6.24k| is_encrypted = false; 72| 6.24k| } else if(label == "ENCRYPTED PRIVATE KEY") { ------------------ | Branch (72:20): [True: 0, False: 0] ------------------ 73| 0| DataSource_Memory key_source(key_data); 74| 0| key_data = PKCS8_extract(key_source, pbe_alg_id); 75| 0| } else { 76| 0| throw PKCS8_Exception(fmt("Unknown PEM label '{}'", label)); 77| 0| } 78| 6.24k| } 79| | 80| 6.24k| if(key_data.empty()) { ------------------ | Branch (80:10): [True: 0, False: 6.24k] ------------------ 81| 0| throw PKCS8_Exception("No key data found"); 82| 0| } 83| 6.24k| } catch(Decoding_Error& e) { 84| 0| throw Decoding_Error("PKCS #8 private key decoding", e); 85| 0| } 86| | 87| 6.24k| try { 88| 6.24k| if(is_encrypted) { ------------------ | Branch (88:10): [True: 0, False: 6.24k] ------------------ 89| 0| if(pbe_alg_id.oid().registered_name() != "PBE-PKCS5v20") { ------------------ | Branch (89:13): [True: 0, False: 0] ------------------ 90| 0| throw PKCS8_Exception(fmt("Unknown PBE type {}", pbe_alg_id.oid())); 91| 0| } 92| | 93| 0|#if defined(BOTAN_HAS_PKCS5_PBES2) 94| 0| key = pbes2_decrypt(key_data, get_passphrase(), pbe_alg_id.parameters()); 95| |#else 96| | BOTAN_UNUSED(get_passphrase); 97| | throw Decoding_Error("Private key is encrypted but PBES2 was disabled in build"); 98| |#endif 99| 6.24k| } else { 100| 6.24k| key = key_data; 101| 6.24k| } 102| | 103| 6.24k| BER_Decoder(key, BER_Decoder::Limits::DER()) 104| 6.24k| .start_sequence() 105| 6.24k| .decode_and_check(0, "Unknown PKCS #8 version number") 106| 6.24k| .decode(pk_alg_id) 107| 6.24k| .decode(key, ASN1_Type::OctetString) 108| 6.24k| .discard_remaining() 109| 6.24k| .end_cons() 110| 6.24k| .verify_end(); 111| 6.24k| } catch(std::exception& e) { 112| 0| throw Decoding_Error("PKCS #8 private key decoding", e); 113| 0| } 114| 6.24k| return key; 115| 6.24k|} _ZN5Botan16PK_Key_AgreementC2ERKNS_11Private_KeyERNS_21RandomNumberGeneratorENSt3__117basic_string_viewIcNS6_11char_traitsIcEEEESA_: 220| 1.64k| std::string_view provider) { 221| 1.64k| m_op = key.create_key_agreement_op(rng, kdf, provider); 222| 1.64k| if(!m_op) { ------------------ | Branch (222:7): [True: 0, False: 1.64k] ------------------ 223| 0| throw Invalid_Argument(fmt("Key type {} does not support key agreement", key.algo_name())); 224| 0| } 225| 1.64k|} _ZN5Botan16PK_Key_AgreementD2Ev: 227| 1.64k|PK_Key_Agreement::~PK_Key_Agreement() = default; _ZNK5Botan16PK_Key_Agreement10derive_keyEmNSt3__14spanIKhLm18446744073709551615EEENS1_17basic_string_viewIcNS1_11char_traitsIcEEEE: 245| 1.64k| std::string_view salt) const { 246| 1.64k| return this->derive_key(key_len, peer_key, as_span_of_bytes(salt)); 247| 1.64k|} _ZNK5Botan16PK_Key_Agreement10derive_keyEmNSt3__14spanIKhLm18446744073709551615EEES4_: 251| 1.64k| std::span salt) const { 252| 1.64k| return SymmetricKey(m_op->agree(key_len, peer_key, salt)); 253| 1.64k|} _ZN5Botan16curve25519_donnaEPhPKhS2_: 453| 16|void curve25519_donna(uint8_t mypublic[32], const uint8_t secret[32], const uint8_t basepoint[32]) { 454| 16| CT::poison(secret, 32); 455| 16| CT::poison(basepoint, 32); 456| | 457| 16| uint64_t bp[5]; 458| 16| uint64_t x[5]; 459| 16| uint64_t z[5]; 460| 16| uint64_t zmone[5]; 461| 16| uint8_t e[32]; 462| | 463| 16| copy_mem(e, secret, 32); 464| 16| e[0] &= 248; 465| 16| e[31] &= 127; 466| 16| e[31] |= 64; 467| | 468| 16| fexpand(bp, basepoint); 469| 16| cmult(x, z, e, bp); 470| 16| crecip(zmone, z); 471| 16| fmul(z, x, zmone); 472| 16| fcontract(mypublic, z); 473| | 474| 16| CT::unpoison(secret, 32); 475| 16| CT::unpoison(basepoint, 32); 476| 16| CT::unpoison(mypublic, 32); 477| 16|} donna.cpp:_ZN5Botan12_GLOBAL__N_17fexpandEPmPKh: 217| 16|inline void fexpand(uint64_t* out, const uint8_t* in) { 218| 16| out[0] = load_le(in, 0) & MASK_63; 219| 16| out[1] = (load_le(in + 6, 0) >> 3) & MASK_63; 220| 16| out[2] = (load_le(in + 12, 0) >> 6) & MASK_63; 221| 16| out[3] = (load_le(in + 19, 0) >> 1) & MASK_63; 222| 16| out[4] = (load_le(in + 24, 0) >> 12) & MASK_63; 223| 16|} donna.cpp:_ZN5Botan12_GLOBAL__N_15cmultEPmS1_PKhPKm: 364| 16|void cmult(uint64_t resultx[5], uint64_t resultz[5], const uint8_t n[32], const uint64_t q[5]) { 365| 16| uint64_t a[5] = {0}; // nqpqx 366| 16| uint64_t b[5] = {1}; // npqpz 367| 16| uint64_t c[5] = {1}; // nqx 368| 16| uint64_t d[5] = {0}; // nqz 369| 16| uint64_t e[5] = {0}; // npqqx2 370| 16| uint64_t f[5] = {1}; // npqqz2 371| 16| uint64_t g[5] = {0}; // nqx2 372| 16| uint64_t h[5] = {1}; // nqz2 373| | 374| 16| copy_mem(a, q, 5); 375| | 376| 528| for(size_t i = 0; i < 32; ++i) { ------------------ | Branch (376:22): [True: 512, False: 16] ------------------ 377| 512| const uint64_t si = n[31 - i]; 378| 512| const auto bit0 = CT::Mask::expand_bit(si, 7); 379| 512| const auto bit1 = CT::Mask::expand_bit(si, 6); 380| 512| const auto bit2 = CT::Mask::expand_bit(si, 5); 381| 512| const auto bit3 = CT::Mask::expand_bit(si, 4); 382| 512| const auto bit4 = CT::Mask::expand_bit(si, 3); 383| 512| const auto bit5 = CT::Mask::expand_bit(si, 2); 384| 512| const auto bit6 = CT::Mask::expand_bit(si, 1); 385| 512| const auto bit7 = CT::Mask::expand_bit(si, 0); 386| | 387| 512| swap_conditional(c, a, d, b, bit0); 388| 512| fmonty(g, h, e, f, c, d, a, b, q); 389| | 390| 512| swap_conditional(g, e, h, f, bit0 ^ bit1); 391| 512| fmonty(c, d, a, b, g, h, e, f, q); 392| | 393| 512| swap_conditional(c, a, d, b, bit1 ^ bit2); 394| 512| fmonty(g, h, e, f, c, d, a, b, q); 395| | 396| 512| swap_conditional(g, e, h, f, bit2 ^ bit3); 397| 512| fmonty(c, d, a, b, g, h, e, f, q); 398| | 399| 512| swap_conditional(c, a, d, b, bit3 ^ bit4); 400| 512| fmonty(g, h, e, f, c, d, a, b, q); 401| | 402| 512| swap_conditional(g, e, h, f, bit4 ^ bit5); 403| 512| fmonty(c, d, a, b, g, h, e, f, q); 404| | 405| 512| swap_conditional(c, a, d, b, bit5 ^ bit6); 406| 512| fmonty(g, h, e, f, c, d, a, b, q); 407| | 408| 512| swap_conditional(g, e, h, f, bit6 ^ bit7); 409| 512| fmonty(c, d, a, b, g, h, e, f, q); 410| | 411| 512| swap_conditional(c, a, d, b, bit7); 412| 512| } 413| | 414| 16| copy_mem(resultx, c, 5); 415| 16| copy_mem(resultz, d, 5); 416| 16|} donna.cpp:_ZN5Botan12_GLOBAL__N_116swap_conditionalEPmS1_S1_S1_NS_2CT4MaskImEE: 346| 4.60k|inline void swap_conditional(uint64_t a[5], uint64_t b[5], uint64_t c[5], uint64_t d[5], CT::Mask swap) { 347| 27.6k| for(size_t i = 0; i < 5; ++i) { ------------------ | Branch (347:22): [True: 23.0k, False: 4.60k] ------------------ 348| 23.0k| const uint64_t x0 = swap.if_set_return(a[i] ^ b[i]); 349| 23.0k| a[i] ^= x0; 350| 23.0k| b[i] ^= x0; 351| | 352| 23.0k| const uint64_t x1 = swap.if_set_return(c[i] ^ d[i]); 353| 23.0k| c[i] ^= x1; 354| 23.0k| d[i] ^= x1; 355| 23.0k| } 356| 4.60k|} donna.cpp:_ZN5Botan12_GLOBAL__N_16fmontyEPmS1_S1_S1_S1_S1_S1_S1_PKm: 308| 4.09k| const uint64_t q_minus_q_dash[5]) { 309| 4.09k| uint64_t zzz[5]; 310| 4.09k| uint64_t xx[5]; 311| 4.09k| uint64_t zz[5]; 312| 4.09k| uint64_t xxprime[5]; 313| 4.09k| uint64_t zzprime[5]; 314| 4.09k| uint64_t zzzprime[5]; 315| | 316| 4.09k| fadd_sub(in_q_z, in_q_x); 317| 4.09k| fadd_sub(in_q_dash_z, in_q_dash_x); 318| | 319| 4.09k| fmul(xxprime, in_q_dash_x, in_q_z); 320| 4.09k| fmul(zzprime, in_q_dash_z, in_q_x); 321| | 322| 4.09k| fadd_sub(zzprime, xxprime); 323| | 324| 4.09k| fsquare(result_q_plus_q_dash_x, xxprime); 325| 4.09k| fsquare(zzzprime, zzprime); 326| 4.09k| fmul(result_q_plus_q_dash_z, zzzprime, q_minus_q_dash); 327| | 328| 4.09k| fsquare(xx, in_q_x); 329| 4.09k| fsquare(zz, in_q_z); 330| 4.09k| fmul(result_two_q_x, xx, zz); 331| | 332| 4.09k| fdifference_backwards(zz, xx); // does zz = xx - zz 333| 4.09k| fscalar_product(zzz, zz, 121665); 334| 4.09k| fsum(zzz, xx); 335| | 336| 4.09k| fmul(result_two_q_z, zz, zzz); 337| 4.09k|} donna.cpp:_ZN5Botan12_GLOBAL__N_18fadd_subEPmS1_: 76| 12.2k|inline void fadd_sub(uint64_t x[5], uint64_t y[5]) { 77| | // TODO merge these and avoid the tmp array 78| 12.2k| uint64_t tmp[5]; 79| 12.2k| copy_mem(tmp, y, 5); 80| 12.2k| fsum(y, x); 81| 12.2k| fdifference_backwards(x, tmp); // does x - z 82| 12.2k|} donna.cpp:_ZN5Botan12_GLOBAL__N_17fsquareEPmPKmm: 169| 16.5k|inline void fsquare(uint64_t out[5], const uint64_t in[5], size_t count = 1) { 170| 16.5k| uint64_t r0 = in[0]; 171| 16.5k| uint64_t r1 = in[1]; 172| 16.5k| uint64_t r2 = in[2]; 173| 16.5k| uint64_t r3 = in[3]; 174| 16.5k| uint64_t r4 = in[4]; 175| | 176| 37.0k| for(size_t i = 0; i != count; ++i) { ------------------ | Branch (176:22): [True: 20.4k, False: 16.5k] ------------------ 177| 20.4k| const uint64_t d0 = r0 * 2; 178| 20.4k| const uint64_t d1 = r1 * 2; 179| 20.4k| const uint64_t d2 = r2 * 2 * 19; 180| 20.4k| const uint64_t d419 = r4 * 19; 181| 20.4k| const uint64_t d4 = d419 * 2; 182| | 183| 20.4k| const uint128_t t0 = uint128_t(r0) * r0 + uint128_t(d4) * r1 + uint128_t(d2) * (r3); 184| 20.4k| uint128_t t1 = uint128_t(d0) * r1 + uint128_t(d4) * r2 + uint128_t(r3) * (r3 * 19); 185| 20.4k| uint128_t t2 = uint128_t(d0) * r2 + uint128_t(r1) * r1 + uint128_t(d4) * (r3); 186| 20.4k| uint128_t t3 = uint128_t(d0) * r3 + uint128_t(d1) * r2 + uint128_t(r4) * (d419); 187| 20.4k| uint128_t t4 = uint128_t(d0) * r4 + uint128_t(d1) * r3 + uint128_t(r2) * (r2); 188| | 189| 20.4k| r0 = t0 & MASK_63; 190| 20.4k| t1 += carry_shift(t0, 51); 191| 20.4k| r1 = t1 & MASK_63; 192| 20.4k| t2 += carry_shift(t1, 51); 193| 20.4k| r2 = t2 & MASK_63; 194| 20.4k| t3 += carry_shift(t2, 51); 195| 20.4k| r3 = t3 & MASK_63; 196| 20.4k| t4 += carry_shift(t3, 51); 197| 20.4k| r4 = t4 & MASK_63; 198| 20.4k| uint64_t c = carry_shift(t4, 51); 199| | 200| 20.4k| r0 += c * 19; 201| 20.4k| c = r0 >> 51U; 202| 20.4k| r0 = r0 & MASK_63; 203| 20.4k| r1 += c; 204| 20.4k| c = r1 >> 51U; 205| 20.4k| r1 = r1 & MASK_63; 206| 20.4k| r2 += c; 207| 20.4k| } 208| | 209| 16.5k| out[0] = r0; 210| 16.5k| out[1] = r1; 211| 16.5k| out[2] = r2; 212| 16.5k| out[3] = r3; 213| 16.5k| out[4] = r4; 214| 16.5k|} donna.cpp:_ZN5Botan12_GLOBAL__N_121fdifference_backwardsEPmPKm: 64| 16.3k|inline void fdifference_backwards(uint64_t out[5], const uint64_t in[5]) { 65| | /* 152 is 19 << 3 */ 66| 16.3k| const uint64_t two54m152 = (static_cast(1) << 54) - 152; 67| 16.3k| const uint64_t two54m8 = (static_cast(1) << 54) - 8; 68| | 69| 16.3k| out[0] = in[0] + two54m152 - out[0]; 70| 16.3k| out[1] = in[1] + two54m8 - out[1]; 71| 16.3k| out[2] = in[2] + two54m8 - out[2]; 72| 16.3k| out[3] = in[3] + two54m8 - out[3]; 73| 16.3k| out[4] = in[4] + two54m8 - out[4]; 74| 16.3k|} donna.cpp:_ZN5Botan12_GLOBAL__N_115fscalar_productEPmPKmm: 87| 4.09k|inline void fscalar_product(uint64_t out[5], const uint64_t in[5], const uint64_t scalar) { 88| 4.09k| uint128_t a = uint128_t(in[0]) * scalar; 89| 4.09k| out[0] = a & MASK_63; 90| | 91| 4.09k| a = uint128_t(in[1]) * scalar + carry_shift(a, 51); 92| 4.09k| out[1] = a & MASK_63; 93| | 94| 4.09k| a = uint128_t(in[2]) * scalar + carry_shift(a, 51); 95| 4.09k| out[2] = a & MASK_63; 96| | 97| 4.09k| a = uint128_t(in[3]) * scalar + carry_shift(a, 51); 98| 4.09k| out[3] = a & MASK_63; 99| | 100| 4.09k| a = uint128_t(in[4]) * scalar + carry_shift(a, 51); 101| 4.09k| out[4] = a & MASK_63; 102| | 103| 4.09k| out[0] += carry_shift(a, 51) * 19; 104| 4.09k|} donna.cpp:_ZN5Botan12_GLOBAL__N_14fsumEPmPKm: 50| 16.3k|inline void fsum(uint64_t out[5], const uint64_t in[5]) { 51| 16.3k| out[0] += in[0]; 52| 16.3k| out[1] += in[1]; 53| 16.3k| out[2] += in[2]; 54| 16.3k| out[3] += in[3]; 55| 16.3k| out[4] += in[4]; 56| 16.3k|} donna.cpp:_ZN5Botan12_GLOBAL__N_16crecipEPmPKm: 421| 16|void crecip(uint64_t out[5], const uint64_t z[5]) { 422| 16| uint64_t a[5]; 423| 16| uint64_t b[5]; 424| 16| uint64_t c[5]; 425| 16| uint64_t t0[5]; 426| | 427| 16| fsquare(a, z); // 2 428| 16| fsquare(t0, a, 2); // 8 429| 16| fmul(b, t0, z); // 9 430| 16| fmul(a, b, a); // 11 431| 16| fsquare(t0, a); // 22 432| 16| fmul(b, t0, b); // 2^5 - 2^0 = 31 433| 16| fsquare(t0, b, 5); // 2^10 - 2^5 434| 16| fmul(b, t0, b); // 2^10 - 2^0 435| 16| fsquare(t0, b, 10); // 2^20 - 2^10 436| 16| fmul(c, t0, b); // 2^20 - 2^0 437| 16| fsquare(t0, c, 20); // 2^40 - 2^20 438| 16| fmul(t0, t0, c); // 2^40 - 2^0 439| 16| fsquare(t0, t0, 10); // 2^50 - 2^10 440| 16| fmul(b, t0, b); // 2^50 - 2^0 441| 16| fsquare(t0, b, 50); // 2^100 - 2^50 442| 16| fmul(c, t0, b); // 2^100 - 2^0 443| 16| fsquare(t0, c, 100); // 2^200 - 2^100 444| 16| fmul(t0, t0, c); // 2^200 - 2^0 445| 16| fsquare(t0, t0, 50); // 2^250 - 2^50 446| 16| fmul(t0, t0, b); // 2^250 - 2^0 447| 16| fsquare(t0, t0, 5); // 2^255 - 2^5 448| 16| fmul(out, t0, a); // 2^255 - 21 449| 16|} donna.cpp:_ZN5Botan12_GLOBAL__N_14fmulEPmPKmS3_: 114| 20.6k|inline void fmul(uint64_t out[5], const uint64_t in[5], const uint64_t in2[5]) { 115| 20.6k| const auto s0 = uint128_t(in2[0]); 116| 20.6k| const auto s1 = uint128_t(in2[1]); 117| 20.6k| const auto s2 = uint128_t(in2[2]); 118| 20.6k| const auto s3 = uint128_t(in2[3]); 119| 20.6k| const auto s4 = uint128_t(in2[4]); 120| | 121| 20.6k| uint64_t r0 = in[0]; 122| 20.6k| uint64_t r1 = in[1]; 123| 20.6k| uint64_t r2 = in[2]; 124| 20.6k| uint64_t r3 = in[3]; 125| 20.6k| uint64_t r4 = in[4]; 126| | 127| 20.6k| uint128_t t0 = r0 * s0; 128| 20.6k| uint128_t t1 = r0 * s1 + r1 * s0; 129| 20.6k| uint128_t t2 = r0 * s2 + r2 * s0 + r1 * s1; 130| 20.6k| uint128_t t3 = r0 * s3 + r3 * s0 + r1 * s2 + r2 * s1; 131| 20.6k| uint128_t t4 = r0 * s4 + r4 * s0 + r3 * s1 + r1 * s3 + r2 * s2; 132| | 133| 20.6k| r4 *= 19; 134| 20.6k| r1 *= 19; 135| 20.6k| r2 *= 19; 136| 20.6k| r3 *= 19; 137| | 138| 20.6k| t0 += r4 * s1 + r1 * s4 + r2 * s3 + r3 * s2; 139| 20.6k| t1 += r4 * s2 + r2 * s4 + r3 * s3; 140| 20.6k| t2 += r4 * s3 + r3 * s4; 141| 20.6k| t3 += r4 * s4; 142| | 143| 20.6k| r0 = t0 & MASK_63; 144| 20.6k| t1 += carry_shift(t0, 51); 145| 20.6k| r1 = t1 & MASK_63; 146| 20.6k| t2 += carry_shift(t1, 51); 147| 20.6k| r2 = t2 & MASK_63; 148| 20.6k| t3 += carry_shift(t2, 51); 149| 20.6k| r3 = t3 & MASK_63; 150| 20.6k| t4 += carry_shift(t3, 51); 151| 20.6k| r4 = t4 & MASK_63; 152| 20.6k| uint64_t c = carry_shift(t4, 51); 153| | 154| 20.6k| r0 += c * 19; 155| 20.6k| c = r0 >> 51U; 156| 20.6k| r0 = r0 & MASK_63; 157| 20.6k| r1 += c; 158| 20.6k| c = r1 >> 51U; 159| 20.6k| r1 = r1 & MASK_63; 160| 20.6k| r2 += c; 161| | 162| 20.6k| out[0] = r0; 163| 20.6k| out[1] = r1; 164| 20.6k| out[2] = r2; 165| 20.6k| out[3] = r3; 166| 20.6k| out[4] = r4; 167| 20.6k|} donna.cpp:_ZN5Botan12_GLOBAL__N_19fcontractEPhPKm: 228| 16|inline void fcontract(uint8_t* out, const uint64_t input[5]) { 229| 16| auto t0 = uint128_t(input[0]); 230| 16| auto t1 = uint128_t(input[1]); 231| 16| auto t2 = uint128_t(input[2]); 232| 16| auto t3 = uint128_t(input[3]); 233| 16| auto t4 = uint128_t(input[4]); 234| | 235| 48| for(size_t i = 0; i != 2; ++i) { ------------------ | Branch (235:22): [True: 32, False: 16] ------------------ 236| 32| t1 += t0 >> 51U; 237| 32| t0 &= MASK_63; 238| 32| t2 += t1 >> 51U; 239| 32| t1 &= MASK_63; 240| 32| t3 += t2 >> 51U; 241| 32| t2 &= MASK_63; 242| 32| t4 += t3 >> 51U; 243| 32| t3 &= MASK_63; 244| 32| t0 += (t4 >> 51U) * 19; 245| 32| t4 &= MASK_63; 246| 32| } 247| | 248| | /* now t is between 0 and 2^255-1, properly carried. */ 249| | /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */ 250| | 251| 16| t0 += 19; 252| | 253| 16| t1 += t0 >> 51U; 254| 16| t0 &= MASK_63; 255| 16| t2 += t1 >> 51U; 256| 16| t1 &= MASK_63; 257| 16| t3 += t2 >> 51U; 258| 16| t2 &= MASK_63; 259| 16| t4 += t3 >> 51U; 260| 16| t3 &= MASK_63; 261| 16| t0 += (t4 >> 51U) * 19; 262| 16| t4 &= MASK_63; 263| | 264| | /* now between 19 and 2^255-1 in both cases, and offset by 19. */ 265| | 266| 16| t0 += 0x8000000000000 - 19; 267| 16| t1 += 0x8000000000000 - 1; 268| 16| t2 += 0x8000000000000 - 1; 269| 16| t3 += 0x8000000000000 - 1; 270| 16| t4 += 0x8000000000000 - 1; 271| | 272| | /* now between 2^255 and 2^256-20, and offset by 2^255. */ 273| | 274| 16| t1 += t0 >> 51U; 275| 16| t0 &= MASK_63; 276| 16| t2 += t1 >> 51U; 277| 16| t1 &= MASK_63; 278| 16| t3 += t2 >> 51U; 279| 16| t2 &= MASK_63; 280| 16| t4 += t3 >> 51U; 281| 16| t3 &= MASK_63; 282| 16| t4 &= MASK_63; 283| | 284| 16| store_le(out, 285| 16| combine_lower(t0, 0, t1, 51), 286| 16| combine_lower(t1, 13, t2, 38), 287| 16| combine_lower(t2, 26, t3, 25), 288| 16| combine_lower(t3, 39, t4, 12)); 289| 16|} _ZN5Botan20curve25519_basepointEPhPKh: 47| 13|void curve25519_basepoint(uint8_t mypublic[32], const uint8_t secret[32]) { 48| 13| const uint8_t basepoint[32] = {9}; 49| 13| curve25519_donna(mypublic, secret, basepoint); 50| 13|} _ZN5Botan16X25519_PublicKeyC1ENSt3__14spanIKhLm18446744073709551615EEE: 96| 6|X25519_PublicKey::X25519_PublicKey(std::span pub) { 97| 6| size_check(pub.size(), "public key"); 98| 6| m_public = std::make_shared(std::vector(pub.begin(), pub.end())); 99| 6|} _ZNK5Botan16X25519_PublicKey19raw_public_key_bitsEv: 101| 16|std::vector X25519_PublicKey::raw_public_key_bits() const { 102| 16| return m_public->key(); 103| 16|} _ZN5Botan17X25519_PrivateKeyC1ERNS_21RandomNumberGeneratorE: 121| 13|X25519_PrivateKey::X25519_PrivateKey(RandomNumberGenerator& rng) { 122| 13| load_x25519_keypair(rng.random_vec(32), m_public, m_private); 123| 13|} _ZNK5Botan17X25519_PrivateKey23create_key_agreement_opERNS_21RandomNumberGeneratorENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEES7_: 197| 3| std::string_view provider) const { 198| 3| if(provider == "base" || provider.empty()) { ------------------ | Branch (198:7): [True: 0, False: 3] | Branch (198:29): [True: 3, False: 0] ------------------ 199| 3| return std::make_unique(m_private, params); 200| 3| } 201| 0| throw Provider_Not_Found(algo_name(), provider); 202| 3|} _ZNK5Botan22X25519_PrivateKey_Data3keyEv: 33| 3| const secure_vector& key() const { return m_key; } x25519.cpp:_ZN5Botan12_GLOBAL__N_110size_checkEmPKc: 54| 9|void size_check(size_t size, const char* thing) { 55| 9| if(size != 32) { ------------------ | Branch (55:7): [True: 3, False: 6] ------------------ 56| 3| throw Decoding_Error(fmt("Invalid size {} for X25519 {}", size, thing)); 57| 3| } 58| 9|} _ZNK5Botan21X25519_PublicKey_Data3keyEv: 23| 16| const std::vector& key() const { return m_key; } x25519.cpp:_ZN5Botan12_GLOBAL__N_119load_x25519_keypairENSt3__16vectorIhNS_16secure_allocatorIhEEEERNS1_10shared_ptrIKNS_21X25519_PublicKey_DataEEERNS6_IKNS_22X25519_PrivateKey_DataEEE: 70| 13| std::shared_ptr& sk_out) { 71| 13| BOTAN_ASSERT_NOMSG(secret.size() == 32); ------------------ | | 77| 13| do { \ | | 78| 13| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 13| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 13] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 13| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 13] | | ------------------ ------------------ 72| 13| std::vector pub(32); 73| 13| curve25519_basepoint(pub.data(), secret.data()); 74| 13| pk_out = std::make_shared(std::move(pub)); 75| 13| sk_out = std::make_shared(std::move(secret)); 76| 13|} _ZN5Botan22X25519_PrivateKey_DataC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 31| 13| explicit X25519_PrivateKey_Data(secure_vector key) : m_key(std::move(key)) {} x25519.cpp:_ZN5Botan12_GLOBAL__N_110curve25519ERKNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKh: 60| 3|secure_vector curve25519(const secure_vector& secret, const uint8_t pubval[32]) { 61| 3| secure_vector out(32); 62| 3| curve25519_donna(out.data(), secret.data(), pubval); 63| 3| return out; 64| 3|} _ZN5Botan21X25519_PublicKey_DataC2ENSt3__16vectorIhNS1_9allocatorIhEEEE: 21| 16| explicit X25519_PublicKey_Data(std::vector key) : m_key(std::move(key)) {} x25519.cpp:_ZN5Botan12_GLOBAL__N_119X25519_KA_OperationC2ENSt3__110shared_ptrIKNS_22X25519_PrivateKey_DataEEENS2_17basic_string_viewIcNS2_11char_traitsIcEEEE: 165| 3| PK_Ops::Key_Agreement_with_KDF(kdf), m_key(std::move(key)) {} x25519.cpp:_ZN5Botan12_GLOBAL__N_119X25519_KA_Operation9raw_agreeEPKhm: 169| 3| secure_vector raw_agree(const uint8_t w[], size_t w_len) override { 170| 3| size_check(w_len, "public value"); 171| 3| auto shared_key = curve25519(m_key->key(), w); 172| | 173| | // RFC 7748 Section 6.1 174| | // Both [parties] MAY check, without leaking extra information about 175| | // the value of K, whether K is the all-zero value and abort if so. 176| | // 177| | // TODO: once the generic Key Agreement operation creation is equipped 178| | // with a more flexible parameterization, this check could be 179| | // made optional. 180| | // For instance: `sk->agree().with_optional_sanity_checks(true)`. 181| | // See also: https://github.com/randombit/botan/pull/4318 182| 3| if(CT::all_zeros(shared_key.data(), shared_key.size()).as_bool()) { ------------------ | Branch (182:13): [True: 1, False: 2] ------------------ 183| 1| throw Invalid_Argument("X25519 public point appears to be of low order"); 184| 1| } 185| | 186| 2| return shared_key; 187| 3| } _ZN5Botan10ChaCha_RNGC2ENSt3__14spanIKhLm18446744073709551615EEE: 20| 1|ChaCha_RNG::ChaCha_RNG(std::span seed) { 21| 1| m_hmac = MessageAuthenticationCode::create_or_throw("HMAC(SHA-256)"); 22| 1| m_chacha = StreamCipher::create_or_throw("ChaCha(20)"); 23| 1| clear(); 24| 1| add_entropy(seed); 25| 1|} _ZN5Botan10ChaCha_RNG11clear_stateEv: 50| 1|void ChaCha_RNG::clear_state() { 51| 1| m_hmac->set_key(std::vector(m_hmac->output_length(), 0x00)); 52| 1| m_chacha->set_key(m_hmac->final()); 53| 1|} _ZN5Botan10ChaCha_RNG15generate_outputENSt3__14spanIhLm18446744073709551615EEENS2_IKhLm18446744073709551615EEE: 55| 35.6k|void ChaCha_RNG::generate_output(std::span output, std::span input) { 56| 35.6k| BOTAN_ASSERT_NOMSG(!output.empty()); ------------------ | | 77| 35.6k| do { \ | | 78| 35.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 35.6k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 35.6k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 35.6k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 35.6k] | | ------------------ ------------------ 57| | 58| 35.6k| if(!input.empty()) { ------------------ | Branch (58:7): [True: 0, False: 35.6k] ------------------ 59| 0| update(input); 60| 0| } 61| | 62| 35.6k| m_chacha->write_keystream(output); 63| 35.6k|} _ZN5Botan10ChaCha_RNG6updateENSt3__14spanIKhLm18446744073709551615EEE: 65| 1|void ChaCha_RNG::update(std::span input) { 66| 1| m_hmac->update(input); 67| 1| m_chacha->set_key(m_hmac->final()); 68| 1| const auto mac_key = m_chacha->keystream_bytes(m_hmac->output_length()); 69| 1| m_hmac->set_key(mac_key); 70| 1|} _ZNK5Botan10ChaCha_RNG14security_levelEv: 72| 1|size_t ChaCha_RNG::security_level() const { 73| 1| return 256; 74| 1|} _ZN5Botan12Stateful_RNG5clearEv: 15| 1|void Stateful_RNG::clear() { 16| 1| const lock_guard_type lock(m_mutex); 17| 1| m_reseed_counter = 0; 18| 1| m_last_pid = 0; 19| 1| clear_state(); 20| 1|} _ZNK5Botan12Stateful_RNG9is_seededEv: 27| 56.9k|bool Stateful_RNG::is_seeded() const { 28| 56.9k| const lock_guard_type lock(m_mutex); 29| 56.9k| return m_reseed_counter > 0; 30| 56.9k|} _ZN5Botan12Stateful_RNG23generate_batched_outputENSt3__14spanIhLm18446744073709551615EEENS2_IKhLm18446744073709551615EEE: 39| 35.6k|void Stateful_RNG::generate_batched_output(std::span output, std::span input) { 40| 35.6k| BOTAN_ASSERT_NOMSG(!output.empty()); ------------------ | | 77| 35.6k| do { \ | | 78| 35.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 35.6k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 35.6k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 35.6k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 35.6k] | | ------------------ ------------------ 41| | 42| 35.6k| const size_t max_per_request = max_number_of_bytes_per_request(); 43| | 44| 35.6k| if(max_per_request == 0) { ------------------ | Branch (44:7): [True: 35.6k, False: 0] ------------------ 45| | // no limit 46| 35.6k| reseed_check(); 47| 35.6k| this->generate_output(output, input); 48| 35.6k| } else { 49| 0| while(!output.empty()) { ------------------ | Branch (49:13): [True: 0, False: 0] ------------------ 50| 0| const size_t this_req = std::min(max_per_request, output.size()); 51| | 52| 0| reseed_check(); 53| 0| this->generate_output(output.subspan(0, this_req), input); 54| | 55| | // only include the input for the first iteration 56| 0| input = {}; 57| | 58| 0| output = output.subspan(this_req); 59| 0| } 60| 0| } 61| 35.6k|} _ZN5Botan12Stateful_RNG21fill_bytes_with_inputENSt3__14spanIhLm18446744073709551615EEENS2_IKhLm18446744073709551615EEE: 63| 35.6k|void Stateful_RNG::fill_bytes_with_input(std::span output, std::span input) { 64| 35.6k| const lock_guard_type lock(m_mutex); 65| | 66| 35.6k| if(output.empty()) { ------------------ | Branch (66:7): [True: 1, False: 35.6k] ------------------ 67| | // Special case for exclusively adding entropy to the stateful RNG. 68| 1| this->update(input); 69| | 70| 1| if(8 * input.size() >= security_level()) { ------------------ | Branch (70:10): [True: 1, False: 0] ------------------ 71| 1| reset_reseed_counter(); 72| 1| } 73| 35.6k| } else { 74| 35.6k| generate_batched_output(output, input); 75| 35.6k| } 76| 35.6k|} _ZN5Botan12Stateful_RNG20reset_reseed_counterEv: 100| 1|void Stateful_RNG::reset_reseed_counter() { 101| | // Lock is held whenever this function is called 102| 1| m_reseed_counter = 1; 103| 1| m_last_pid = OS::get_process_id(); 104| 1|} _ZN5Botan12Stateful_RNG12reseed_checkEv: 106| 35.6k|void Stateful_RNG::reseed_check() { 107| | // Lock is held whenever this function is called 108| | 109| 35.6k| const uint32_t cur_pid = OS::get_process_id(); 110| | 111| 35.6k| const bool fork_detected = (m_last_pid > 0) && (cur_pid != m_last_pid); ------------------ | Branch (111:31): [True: 35.6k, False: 0] | Branch (111:51): [True: 0, False: 35.6k] ------------------ 112| | 113| 35.6k| if(is_seeded() == false || fork_detected || (m_reseed_interval > 0 && m_reseed_counter >= m_reseed_interval)) { ------------------ | Branch (113:7): [True: 0, False: 35.6k] | Branch (113:31): [True: 0, False: 35.6k] | Branch (113:49): [True: 0, False: 35.6k] | Branch (113:74): [True: 0, False: 0] ------------------ 114| 0| m_reseed_counter = 0; 115| 0| m_last_pid = cur_pid; 116| | 117| 0| if(m_underlying_rng != nullptr) { ------------------ | Branch (117:10): [True: 0, False: 0] ------------------ 118| 0| reseed_from_rng(*m_underlying_rng, security_level()); 119| 0| } 120| | 121| 0| if(m_entropy_sources != nullptr) { ------------------ | Branch (121:10): [True: 0, False: 0] ------------------ 122| 0| reseed_from_sources(*m_entropy_sources, security_level()); 123| 0| } 124| | 125| 0| if(!is_seeded()) { ------------------ | Branch (125:10): [True: 0, False: 0] ------------------ 126| 0| if(fork_detected) { ------------------ | Branch (126:13): [True: 0, False: 0] ------------------ 127| 0| throw Invalid_State("Detected use of fork but cannot reseed DRBG"); 128| 0| } else { 129| 0| throw PRNG_Unseeded(name()); 130| 0| } 131| 0| } 132| 35.6k| } else { 133| 35.6k| BOTAN_ASSERT(m_reseed_counter != 0, "RNG is seeded"); ------------------ | | 64| 35.6k| do { \ | | 65| 35.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 35.6k| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 35.6k] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 35.6k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 35.6k] | | ------------------ ------------------ 134| 35.6k| m_reseed_counter += 1; 135| 35.6k| } 136| 35.6k|} _ZN5Botan6ChaChaC2Em: 92| 1|ChaCha::ChaCha(size_t rounds) : m_rounds(rounds) { 93| 1| BOTAN_ARG_CHECK(m_rounds == 8 || m_rounds == 12 || m_rounds == 20, "ChaCha only supports 8, 12 or 20 rounds"); ------------------ | | 35| 1| do { \ | | 36| 1| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 4| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 1] | | | Branch (37:12): [True: 0, False: 1] | | | Branch (37:12): [True: 1, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1] | | ------------------ ------------------ 94| 1|} _ZN5Botan6ChaCha11parallelismEv: 96| 2|size_t ChaCha::parallelism() { 97| 2|#if defined(BOTAN_HAS_CHACHA_AVX512) 98| 2| if(CPUID::has(CPUID::Feature::AVX512)) { ------------------ | Branch (98:7): [True: 0, False: 2] ------------------ 99| 0| return 16; 100| 0| } 101| 2|#endif 102| | 103| 2|#if defined(BOTAN_HAS_CHACHA_AVX2) 104| 2| if(CPUID::has(CPUID::Feature::AVX2)) { ------------------ | Branch (104:7): [True: 2, False: 0] ------------------ 105| 2| return 8; 106| 2| } 107| 0|#endif 108| | 109| 0| return 4; 110| 2|} _ZN5Botan6ChaCha6chachaEPhmPjm: 134| 2.75k|void ChaCha::chacha(uint8_t output[], size_t output_blocks, uint32_t state[16], size_t rounds) { 135| 2.75k| BOTAN_ASSERT(rounds % 2 == 0, "Valid rounds"); ------------------ | | 64| 2.75k| do { \ | | 65| 2.75k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 2.75k| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 2.75k] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 2.75k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 2.75k] | | ------------------ ------------------ 136| | 137| 2.75k|#if defined(BOTAN_HAS_CHACHA_AVX512) 138| 2.75k| if(CPUID::has(CPUID::Feature::AVX512)) { ------------------ | Branch (138:7): [True: 0, False: 2.75k] ------------------ 139| 0| while(output_blocks >= 16) { ------------------ | Branch (139:13): [True: 0, False: 0] ------------------ 140| 0| ChaCha::chacha_avx512_x16(output, state, rounds); 141| 0| output += 16 * 64; 142| 0| output_blocks -= 16; 143| 0| } 144| 0| } 145| 2.75k|#endif 146| | 147| 2.75k|#if defined(BOTAN_HAS_CHACHA_AVX2) 148| 2.75k| if(CPUID::has(CPUID::Feature::AVX2)) { ------------------ | Branch (148:7): [True: 2.75k, False: 0] ------------------ 149| 5.50k| while(output_blocks >= 8) { ------------------ | Branch (149:13): [True: 2.75k, False: 2.75k] ------------------ 150| 2.75k| ChaCha::chacha_avx2_x8(output, state, rounds); 151| 2.75k| output += 8 * 64; 152| 2.75k| output_blocks -= 8; 153| 2.75k| } 154| 2.75k| } 155| 2.75k|#endif 156| | 157| 2.75k|#if defined(BOTAN_HAS_CHACHA_SIMD32) 158| 2.75k| if(CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (158:7): [True: 2.75k, False: 0] ------------------ 159| 2.75k| while(output_blocks >= 4) { ------------------ | Branch (159:13): [True: 0, False: 2.75k] ------------------ 160| 0| ChaCha::chacha_simd32_x4(output, state, rounds); 161| 0| output += 4 * 64; 162| 0| output_blocks -= 4; 163| 0| } 164| 2.75k| } 165| 2.75k|#endif 166| | 167| | // TODO interleave rounds 168| 2.75k| for(size_t i = 0; i != output_blocks; ++i) { ------------------ | Branch (168:22): [True: 0, False: 2.75k] ------------------ 169| 0| uint32_t x00 = state[0]; 170| 0| uint32_t x01 = state[1]; 171| 0| uint32_t x02 = state[2]; 172| 0| uint32_t x03 = state[3]; 173| 0| uint32_t x04 = state[4]; 174| 0| uint32_t x05 = state[5]; 175| 0| uint32_t x06 = state[6]; 176| 0| uint32_t x07 = state[7]; 177| 0| uint32_t x08 = state[8]; 178| 0| uint32_t x09 = state[9]; 179| 0| uint32_t x10 = state[10]; 180| 0| uint32_t x11 = state[11]; 181| 0| uint32_t x12 = state[12]; 182| 0| uint32_t x13 = state[13]; 183| 0| uint32_t x14 = state[14]; 184| 0| uint32_t x15 = state[15]; 185| | 186| 0| for(size_t r = 0; r != rounds / 2; ++r) { ------------------ | Branch (186:25): [True: 0, False: 0] ------------------ 187| 0| chacha_quarter_round(x00, x04, x08, x12); 188| 0| chacha_quarter_round(x01, x05, x09, x13); 189| 0| chacha_quarter_round(x02, x06, x10, x14); 190| 0| chacha_quarter_round(x03, x07, x11, x15); 191| | 192| 0| chacha_quarter_round(x00, x05, x10, x15); 193| 0| chacha_quarter_round(x01, x06, x11, x12); 194| 0| chacha_quarter_round(x02, x07, x08, x13); 195| 0| chacha_quarter_round(x03, x04, x09, x14); 196| 0| } 197| | 198| 0| x00 += state[0]; 199| 0| x01 += state[1]; 200| 0| x02 += state[2]; 201| 0| x03 += state[3]; 202| 0| x04 += state[4]; 203| 0| x05 += state[5]; 204| 0| x06 += state[6]; 205| 0| x07 += state[7]; 206| 0| x08 += state[8]; 207| 0| x09 += state[9]; 208| 0| x10 += state[10]; 209| 0| x11 += state[11]; 210| 0| x12 += state[12]; 211| 0| x13 += state[13]; 212| 0| x14 += state[14]; 213| 0| x15 += state[15]; 214| | 215| 0| store_le(x00, output + 64 * i + 4 * 0); 216| 0| store_le(x01, output + 64 * i + 4 * 1); 217| 0| store_le(x02, output + 64 * i + 4 * 2); 218| 0| store_le(x03, output + 64 * i + 4 * 3); 219| 0| store_le(x04, output + 64 * i + 4 * 4); 220| 0| store_le(x05, output + 64 * i + 4 * 5); 221| 0| store_le(x06, output + 64 * i + 4 * 6); 222| 0| store_le(x07, output + 64 * i + 4 * 7); 223| 0| store_le(x08, output + 64 * i + 4 * 8); 224| 0| store_le(x09, output + 64 * i + 4 * 9); 225| 0| store_le(x10, output + 64 * i + 4 * 10); 226| 0| store_le(x11, output + 64 * i + 4 * 11); 227| 0| store_le(x12, output + 64 * i + 4 * 12); 228| 0| store_le(x13, output + 64 * i + 4 * 13); 229| 0| store_le(x14, output + 64 * i + 4 * 14); 230| 0| store_le(x15, output + 64 * i + 4 * 15); 231| | 232| 0| state[12]++; 233| 0| if(state[12] == 0) { ------------------ | Branch (233:10): [True: 0, False: 0] ------------------ 234| 0| state[13] += 1; 235| 0| } 236| 0| } 237| 2.75k|} _ZN5Botan6ChaCha18generate_keystreamEPhm: 269| 35.6k|void ChaCha::generate_keystream(uint8_t out[], size_t length) { 270| 35.6k| assert_key_material_set(); 271| | 272| 35.6k| if(m_iv_length == 12) { ------------------ | Branch (272:7): [True: 0, False: 35.6k] ------------------ 273| 0| if(length > m_bytes_remaining) { ------------------ | Branch (273:10): [True: 0, False: 0] ------------------ 274| 0| throw Invalid_State("ChaCha 96-bit nonce keystream exhausted"); 275| 0| } 276| 0| m_bytes_remaining -= length; 277| 0| } 278| | 279| 38.4k| while(length >= m_buffer.size() - m_position) { ------------------ | Branch (279:10): [True: 2.74k, False: 35.6k] ------------------ 280| 2.74k| const size_t available = m_buffer.size() - m_position; 281| | 282| | // TODO: this could write directly to the output buffer 283| | // instead of bouncing it through m_buffer first 284| 2.74k| copy_mem(out, &m_buffer[m_position], available); 285| 2.74k| chacha(m_buffer.data(), m_buffer.size() / 64, m_state.data(), m_rounds); 286| | 287| 2.74k| length -= available; 288| 2.74k| out += available; 289| 2.74k| m_position = 0; 290| 2.74k| } 291| | 292| 35.6k| copy_mem(out, &m_buffer[m_position], length); 293| | 294| 35.6k| m_position += length; 295| 35.6k|} _ZN5Botan6ChaCha16initialize_stateEv: 297| 2|void ChaCha::initialize_state() { 298| 2| static const uint32_t TAU[] = {0x61707865, 0x3120646e, 0x79622d36, 0x6b206574}; 299| | 300| 2| static const uint32_t SIGMA[] = {0x61707865, 0x3320646e, 0x79622d32, 0x6b206574}; 301| | 302| 2| m_state[4] = m_key[0]; 303| 2| m_state[5] = m_key[1]; 304| 2| m_state[6] = m_key[2]; 305| 2| m_state[7] = m_key[3]; 306| | 307| 2| if(m_key.size() == 4) { ------------------ | Branch (307:7): [True: 0, False: 2] ------------------ 308| 0| m_state[0] = TAU[0]; 309| 0| m_state[1] = TAU[1]; 310| 0| m_state[2] = TAU[2]; 311| 0| m_state[3] = TAU[3]; 312| | 313| 0| m_state[8] = m_key[0]; 314| 0| m_state[9] = m_key[1]; 315| 0| m_state[10] = m_key[2]; 316| 0| m_state[11] = m_key[3]; 317| 2| } else { 318| 2| m_state[0] = SIGMA[0]; 319| 2| m_state[1] = SIGMA[1]; 320| 2| m_state[2] = SIGMA[2]; 321| 2| m_state[3] = SIGMA[3]; 322| | 323| 2| m_state[8] = m_key[4]; 324| 2| m_state[9] = m_key[5]; 325| 2| m_state[10] = m_key[6]; 326| 2| m_state[11] = m_key[7]; 327| 2| } 328| | 329| 2| m_state[12] = 0; 330| 2| m_state[13] = 0; 331| 2| m_state[14] = 0; 332| 2| m_state[15] = 0; 333| | 334| 2| m_position = 0; 335| 2|} _ZNK5Botan6ChaCha19has_keying_materialEv: 337| 35.6k|bool ChaCha::has_keying_material() const { 338| 35.6k| return !m_state.empty(); 339| 35.6k|} _ZN5Botan6ChaCha12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 348| 2|void ChaCha::key_schedule(std::span key) { 349| 2| m_key.resize(key.size() / 4); 350| 2| load_le(m_key.data(), key.data(), m_key.size()); 351| | 352| 2| m_state.resize(16); 353| | 354| 2| const size_t chacha_block = 64; 355| 2| m_buffer.resize(parallelism() * chacha_block); 356| | 357| 2| set_iv(nullptr, 0); 358| 2|} _ZNK5Botan6ChaCha8key_specEv: 364| 2|Key_Length_Specification ChaCha::key_spec() const { 365| 2| return Key_Length_Specification(16, 32, 16); 366| 2|} _ZNK5Botan6ChaCha15valid_iv_lengthEm: 372| 2|bool ChaCha::valid_iv_length(size_t iv_len) const { 373| 2| return (iv_len == 0 || iv_len == 8 || iv_len == 12 || iv_len == 24); ------------------ | Branch (373:12): [True: 2, False: 0] | Branch (373:27): [True: 0, False: 0] | Branch (373:42): [True: 0, False: 0] | Branch (373:58): [True: 0, False: 0] ------------------ 374| 2|} _ZN5Botan6ChaCha12set_iv_bytesEPKhm: 376| 2|void ChaCha::set_iv_bytes(const uint8_t iv[], size_t length) { 377| 2| assert_key_material_set(); 378| | 379| 2| if(!valid_iv_length(length)) { ------------------ | Branch (379:7): [True: 0, False: 2] ------------------ 380| 0| throw Invalid_IV_Length(name(), length); 381| 0| } 382| | 383| 2| initialize_state(); 384| | 385| 2| if(length == 0) { ------------------ | Branch (385:7): [True: 2, False: 0] ------------------ 386| | // Treat zero length IV same as an all-zero IV 387| 2| m_state[14] = 0; 388| 2| m_state[15] = 0; 389| 2| } else if(length == 8) { ------------------ | Branch (389:14): [True: 0, False: 0] ------------------ 390| 0| m_state[14] = load_le(iv, 0); 391| 0| m_state[15] = load_le(iv, 1); 392| 0| } else if(length == 12) { ------------------ | Branch (392:14): [True: 0, False: 0] ------------------ 393| 0| m_state[13] = load_le(iv, 0); 394| 0| m_state[14] = load_le(iv, 1); 395| 0| m_state[15] = load_le(iv, 2); 396| 0| } else if(length == 24) { ------------------ | Branch (396:14): [True: 0, False: 0] ------------------ 397| 0| m_state[12] = load_le(iv, 0); 398| 0| m_state[13] = load_le(iv, 1); 399| 0| m_state[14] = load_le(iv, 2); 400| 0| m_state[15] = load_le(iv, 3); 401| | 402| 0| secure_vector hc(8); 403| 0| hchacha(hc.data(), m_state.data(), m_rounds); 404| | 405| 0| m_state[4] = hc[0]; 406| 0| m_state[5] = hc[1]; 407| 0| m_state[6] = hc[2]; 408| 0| m_state[7] = hc[3]; 409| 0| m_state[8] = hc[4]; 410| 0| m_state[9] = hc[5]; 411| 0| m_state[10] = hc[6]; 412| 0| m_state[11] = hc[7]; 413| 0| m_state[12] = 0; 414| 0| m_state[13] = 0; 415| 0| m_state[14] = load_le(iv, 4); 416| 0| m_state[15] = load_le(iv, 5); 417| 0| } 418| | 419| 2| m_iv_length = length; 420| 2| m_state13_post_iv = m_state[13]; 421| 2| if(length == 12) { ------------------ | Branch (421:7): [True: 0, False: 2] ------------------ 422| 0| m_bytes_remaining = chacha_96bit_nonce_cap; 423| 0| } 424| | 425| 2| chacha(m_buffer.data(), m_buffer.size() / 64, m_state.data(), m_rounds); 426| 2| m_position = 0; 427| 2|} _ZN5Botan6ChaCha14chacha_avx2_x8EPhPjm: 15| 2.75k|void BOTAN_FN_ISA_AVX2 ChaCha::chacha_avx2_x8(uint8_t output[64 * 8], uint32_t state[16], size_t rounds) { 16| 2.75k| SIMD_8x32::reset_registers(); 17| | 18| 2.75k| BOTAN_ASSERT(rounds % 2 == 0, "Valid rounds"); ------------------ | | 64| 2.75k| do { \ | | 65| 2.75k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 2.75k| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 2.75k] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 2.75k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 2.75k] | | ------------------ ------------------ 19| | 20| 2.75k| const SIMD_8x32 CTR_LO = SIMD_8x32::splat(state[12]) + SIMD_8x32(0, 1, 2, 3, 4, 5, 6, 7); 21| | // Carry into the high counter word for lanes whose low word wrapped 22| 2.75k| const SIMD_8x32 CTR_HI = SIMD_8x32::splat(state[13]) - CTR_LO.unsigned_lt(SIMD_8x32::splat(state[12])); 23| | 24| 2.75k| SIMD_8x32 R00 = SIMD_8x32::splat(state[0]); 25| 2.75k| SIMD_8x32 R01 = SIMD_8x32::splat(state[1]); 26| 2.75k| SIMD_8x32 R02 = SIMD_8x32::splat(state[2]); 27| 2.75k| SIMD_8x32 R03 = SIMD_8x32::splat(state[3]); 28| 2.75k| SIMD_8x32 R04 = SIMD_8x32::splat(state[4]); 29| 2.75k| SIMD_8x32 R05 = SIMD_8x32::splat(state[5]); 30| 2.75k| SIMD_8x32 R06 = SIMD_8x32::splat(state[6]); 31| 2.75k| SIMD_8x32 R07 = SIMD_8x32::splat(state[7]); 32| 2.75k| SIMD_8x32 R08 = SIMD_8x32::splat(state[8]); 33| 2.75k| SIMD_8x32 R09 = SIMD_8x32::splat(state[9]); 34| 2.75k| SIMD_8x32 R10 = SIMD_8x32::splat(state[10]); 35| 2.75k| SIMD_8x32 R11 = SIMD_8x32::splat(state[11]); 36| 2.75k| SIMD_8x32 R12 = CTR_LO; 37| 2.75k| SIMD_8x32 R13 = CTR_HI; 38| 2.75k| SIMD_8x32 R14 = SIMD_8x32::splat(state[14]); 39| 2.75k| SIMD_8x32 R15 = SIMD_8x32::splat(state[15]); 40| | 41| 30.2k| for(size_t r = 0; r != rounds / 2; ++r) { ------------------ | Branch (41:22): [True: 27.5k, False: 2.75k] ------------------ 42| 27.5k| R00 += R04; 43| 27.5k| R01 += R05; 44| 27.5k| R02 += R06; 45| 27.5k| R03 += R07; 46| | 47| 27.5k| R12 ^= R00; 48| 27.5k| R13 ^= R01; 49| 27.5k| R14 ^= R02; 50| 27.5k| R15 ^= R03; 51| | 52| 27.5k| R12 = R12.rotl<16>(); 53| 27.5k| R13 = R13.rotl<16>(); 54| 27.5k| R14 = R14.rotl<16>(); 55| 27.5k| R15 = R15.rotl<16>(); 56| | 57| 27.5k| R08 += R12; 58| 27.5k| R09 += R13; 59| 27.5k| R10 += R14; 60| 27.5k| R11 += R15; 61| | 62| 27.5k| R04 ^= R08; 63| 27.5k| R05 ^= R09; 64| 27.5k| R06 ^= R10; 65| 27.5k| R07 ^= R11; 66| | 67| 27.5k| R04 = R04.rotl<12>(); 68| 27.5k| R05 = R05.rotl<12>(); 69| 27.5k| R06 = R06.rotl<12>(); 70| 27.5k| R07 = R07.rotl<12>(); 71| | 72| 27.5k| R00 += R04; 73| 27.5k| R01 += R05; 74| 27.5k| R02 += R06; 75| 27.5k| R03 += R07; 76| | 77| 27.5k| R12 ^= R00; 78| 27.5k| R13 ^= R01; 79| 27.5k| R14 ^= R02; 80| 27.5k| R15 ^= R03; 81| | 82| 27.5k| R12 = R12.rotl<8>(); 83| 27.5k| R13 = R13.rotl<8>(); 84| 27.5k| R14 = R14.rotl<8>(); 85| 27.5k| R15 = R15.rotl<8>(); 86| | 87| 27.5k| R08 += R12; 88| 27.5k| R09 += R13; 89| 27.5k| R10 += R14; 90| 27.5k| R11 += R15; 91| | 92| 27.5k| R04 ^= R08; 93| 27.5k| R05 ^= R09; 94| 27.5k| R06 ^= R10; 95| 27.5k| R07 ^= R11; 96| | 97| 27.5k| R04 = R04.rotl<7>(); 98| 27.5k| R05 = R05.rotl<7>(); 99| 27.5k| R06 = R06.rotl<7>(); 100| 27.5k| R07 = R07.rotl<7>(); 101| | 102| 27.5k| R00 += R05; 103| 27.5k| R01 += R06; 104| 27.5k| R02 += R07; 105| 27.5k| R03 += R04; 106| | 107| 27.5k| R15 ^= R00; 108| 27.5k| R12 ^= R01; 109| 27.5k| R13 ^= R02; 110| 27.5k| R14 ^= R03; 111| | 112| 27.5k| R15 = R15.rotl<16>(); 113| 27.5k| R12 = R12.rotl<16>(); 114| 27.5k| R13 = R13.rotl<16>(); 115| 27.5k| R14 = R14.rotl<16>(); 116| | 117| 27.5k| R10 += R15; 118| 27.5k| R11 += R12; 119| 27.5k| R08 += R13; 120| 27.5k| R09 += R14; 121| | 122| 27.5k| R05 ^= R10; 123| 27.5k| R06 ^= R11; 124| 27.5k| R07 ^= R08; 125| 27.5k| R04 ^= R09; 126| | 127| 27.5k| R05 = R05.rotl<12>(); 128| 27.5k| R06 = R06.rotl<12>(); 129| 27.5k| R07 = R07.rotl<12>(); 130| 27.5k| R04 = R04.rotl<12>(); 131| | 132| 27.5k| R00 += R05; 133| 27.5k| R01 += R06; 134| 27.5k| R02 += R07; 135| 27.5k| R03 += R04; 136| | 137| 27.5k| R15 ^= R00; 138| 27.5k| R12 ^= R01; 139| 27.5k| R13 ^= R02; 140| 27.5k| R14 ^= R03; 141| | 142| 27.5k| R15 = R15.rotl<8>(); 143| 27.5k| R12 = R12.rotl<8>(); 144| 27.5k| R13 = R13.rotl<8>(); 145| 27.5k| R14 = R14.rotl<8>(); 146| | 147| 27.5k| R10 += R15; 148| 27.5k| R11 += R12; 149| 27.5k| R08 += R13; 150| 27.5k| R09 += R14; 151| | 152| 27.5k| R05 ^= R10; 153| 27.5k| R06 ^= R11; 154| 27.5k| R07 ^= R08; 155| 27.5k| R04 ^= R09; 156| | 157| 27.5k| R05 = R05.rotl<7>(); 158| 27.5k| R06 = R06.rotl<7>(); 159| 27.5k| R07 = R07.rotl<7>(); 160| 27.5k| R04 = R04.rotl<7>(); 161| 27.5k| } 162| | 163| 2.75k| R00 += SIMD_8x32::splat(state[0]); 164| 2.75k| R01 += SIMD_8x32::splat(state[1]); 165| 2.75k| R02 += SIMD_8x32::splat(state[2]); 166| 2.75k| R03 += SIMD_8x32::splat(state[3]); 167| 2.75k| R04 += SIMD_8x32::splat(state[4]); 168| 2.75k| R05 += SIMD_8x32::splat(state[5]); 169| 2.75k| R06 += SIMD_8x32::splat(state[6]); 170| 2.75k| R07 += SIMD_8x32::splat(state[7]); 171| 2.75k| R08 += SIMD_8x32::splat(state[8]); 172| 2.75k| R09 += SIMD_8x32::splat(state[9]); 173| 2.75k| R10 += SIMD_8x32::splat(state[10]); 174| 2.75k| R11 += SIMD_8x32::splat(state[11]); 175| 2.75k| R12 += CTR_LO; 176| 2.75k| R13 += CTR_HI; 177| 2.75k| R14 += SIMD_8x32::splat(state[14]); 178| 2.75k| R15 += SIMD_8x32::splat(state[15]); 179| | 180| 2.75k| SIMD_8x32::transpose(R00, R01, R02, R03, R04, R05, R06, R07); 181| 2.75k| SIMD_8x32::transpose(R08, R09, R10, R11, R12, R13, R14, R15); 182| | 183| 2.75k| R00.store_le(output); 184| 2.75k| R08.store_le(output + 32 * 1); 185| 2.75k| R01.store_le(output + 32 * 2); 186| 2.75k| R09.store_le(output + 32 * 3); 187| 2.75k| R02.store_le(output + 32 * 4); 188| 2.75k| R10.store_le(output + 32 * 5); 189| 2.75k| R03.store_le(output + 32 * 6); 190| 2.75k| R11.store_le(output + 32 * 7); 191| 2.75k| R04.store_le(output + 32 * 8); 192| 2.75k| R12.store_le(output + 32 * 9); 193| 2.75k| R05.store_le(output + 32 * 10); 194| 2.75k| R13.store_le(output + 32 * 11); 195| 2.75k| R06.store_le(output + 32 * 12); 196| 2.75k| R14.store_le(output + 32 * 13); 197| 2.75k| R07.store_le(output + 32 * 14); 198| 2.75k| R15.store_le(output + 32 * 15); 199| | 200| 2.75k| SIMD_8x32::zero_registers(); 201| | 202| 2.75k| state[12] += 8; 203| 2.75k| if(state[12] < 8) { ------------------ | Branch (203:7): [True: 0, False: 2.75k] ------------------ 204| 0| state[13]++; 205| 0| } 206| 2.75k|} _ZN5Botan6CTR_BEC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm: 31| 114| m_cipher(std::move(cipher)), 32| 114| m_block_size(m_cipher->block_size()), 33| 114| m_ctr_size(ctr_size), 34| 114| m_ctr_blocks(m_cipher->parallel_bytes() / m_block_size), 35| 114| m_counter(m_cipher->parallel_bytes()), 36| 114| m_pad(m_counter.size()), 37| 114| m_pad_pos(0) { 38| 114| BOTAN_ARG_CHECK(m_ctr_size >= 4 && m_ctr_size <= m_block_size, "Invalid CTR-BE counter size"); ------------------ | | 35| 114| do { \ | | 36| 114| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 228| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 114, False: 0] | | | Branch (37:12): [True: 114, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 114| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 114] | | ------------------ ------------------ 39| 114|} _ZNK5Botan6CTR_BE15valid_iv_lengthEm: 61| 337|bool CTR_BE::valid_iv_length(size_t iv_len) const { 62| 337| return (iv_len <= m_block_size); 63| 337|} _ZNK5Botan6CTR_BE8key_specEv: 69| 228|Key_Length_Specification CTR_BE::key_spec() const { 70| 228| return m_cipher->key_spec(); 71| 228|} _ZNK5Botan6CTR_BE19has_keying_materialEv: 77| 668|bool CTR_BE::has_keying_material() const { 78| 668| return m_cipher->has_keying_material(); 79| 668|} _ZN5Botan6CTR_BE12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 81| 114|void CTR_BE::key_schedule(std::span key) { 82| 114| m_cipher->set_key(key); 83| | 84| | // Set a default all-zeros IV 85| 114| set_iv(nullptr, 0); 86| 114|} _ZN5Botan6CTR_BE12cipher_bytesEPKhPhm: 96| 331|void CTR_BE::cipher_bytes(const uint8_t in[], uint8_t out[], size_t length) { 97| 331| assert_key_material_set(); 98| | 99| 331| if(m_ctr_size < sizeof(uint64_t)) { ------------------ | Branch (99:7): [True: 331, False: 0] ------------------ 100| 331| if(length > m_bytes_remaining) { ------------------ | Branch (100:10): [True: 0, False: 331] ------------------ 101| 0| throw Invalid_State(fmt("CTR_BE with {}-byte counter has exhausted its keystream", m_ctr_size)); 102| 0| } 103| 331| m_bytes_remaining -= length; 104| 331| } 105| | 106| 331| const uint8_t* pad_bits = m_pad.data(); 107| 331| const size_t pad_size = m_pad.size(); 108| | 109| | /* Consume any already computed keystream in m_pad */ 110| | 111| 331| if(m_pad_pos > 0) { ------------------ | Branch (111:7): [True: 108, False: 223] ------------------ 112| 108| const size_t avail = pad_size - m_pad_pos; 113| 108| const size_t take = std::min(length, avail); 114| 108| xor_buf(out, in, pad_bits + m_pad_pos, take); 115| 108| length -= take; 116| 108| in += take; 117| 108| out += take; 118| 108| m_pad_pos += take; 119| | 120| 108| if(take == avail) { ------------------ | Branch (120:10): [True: 46, False: 62] ------------------ 121| 46| add_counter(m_ctr_blocks); 122| 46| m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks); 123| 46| m_pad_pos = 0; 124| 46| } 125| 108| } 126| | 127| | /* Bulk processing */ 128| | 129| 331| [[maybe_unused]] const bool can_use_bs16_ctr4_fastpath = m_block_size == 16 && m_ctr_size == 4 && pad_size % 64 == 0; ------------------ | Branch (129:61): [True: 331, False: 0] | Branch (129:83): [True: 331, False: 0] | Branch (129:102): [True: 331, False: 0] ------------------ 130| | 131| 331|#if defined(BOTAN_HAS_CTR_BE_AVX2) 132| 331| if(length >= pad_size && can_use_bs16_ctr4_fastpath && CPUID::has(CPUID::Feature::AVX2)) { ------------------ | Branch (132:7): [True: 32, False: 299] | Branch (132:29): [True: 32, False: 0] | Branch (132:59): [True: 32, False: 0] ------------------ 133| 32| const size_t consumed = ctr_proc_bs16_ctr4_avx2(in, out, length); 134| 32| in += consumed; 135| 32| out += consumed; 136| 32| length -= consumed; 137| 32| } 138| 331|#endif 139| | 140| 331|#if defined(BOTAN_HAS_CTR_BE_SIMD32) 141| 331| if(length >= pad_size && can_use_bs16_ctr4_fastpath && CPUID::has(CPUID::Feature::SIMD_4X32)) { ------------------ | Branch (141:7): [True: 0, False: 331] | Branch (141:29): [True: 0, False: 0] | Branch (141:59): [True: 0, False: 0] ------------------ 142| 0| const size_t consumed = ctr_proc_bs16_ctr4_simd32(in, out, length); 143| 0| in += consumed; 144| 0| out += consumed; 145| 0| length -= consumed; 146| 0| } 147| 331|#endif 148| | 149| 331| while(length >= pad_size) { ------------------ | Branch (149:10): [True: 0, False: 331] ------------------ 150| 0| xor_buf(out, in, pad_bits, pad_size); 151| 0| length -= pad_size; 152| 0| in += pad_size; 153| 0| out += pad_size; 154| | 155| 0| add_counter(m_ctr_blocks); 156| 0| m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks); 157| 0| } 158| | 159| | /* Now if length > 0 then we have some remaining text, and m_pad is full - consume as required */ 160| 331| if(length > 0) { ------------------ | Branch (160:7): [True: 266, False: 65] ------------------ 161| 266| xor_buf(out, in, pad_bits, length); 162| 266| m_pad_pos = length; 163| 266| } 164| 331|} _ZN5Botan6CTR_BE12set_iv_bytesEPKhm: 202| 337|void CTR_BE::set_iv_bytes(const uint8_t iv[], size_t iv_len) { 203| 337| if(!valid_iv_length(iv_len)) { ------------------ | Branch (203:7): [True: 0, False: 337] ------------------ 204| 0| throw Invalid_IV_Length(name(), iv_len); 205| 0| } 206| | 207| 337| m_iv.resize(m_block_size); 208| 337| zeroise(m_iv); 209| 337| copy_mem(m_iv.data(), iv, iv_len); 210| | 211| 337| seek(0); 212| 337|} _ZN5Botan6CTR_BE11add_counterEm: 214| 46|void CTR_BE::add_counter(const uint64_t counter) { 215| 46| const size_t ctr_size = m_ctr_size; 216| 46| const size_t ctr_blocks = m_ctr_blocks; 217| 46| const size_t BS = m_block_size; 218| | 219| 46| if(ctr_size == 4) { ------------------ | Branch (219:7): [True: 46, False: 0] ------------------ 220| 46| const size_t off = (BS - 4); 221| 46| const uint32_t low32 = static_cast(counter + load_be(&m_counter[off], 0)); 222| | 223| 782| for(size_t i = 0; i != ctr_blocks; ++i) { ------------------ | Branch (223:25): [True: 736, False: 46] ------------------ 224| 736| store_be(uint32_t(low32 + i), &m_counter[i * BS + off]); 225| 736| } 226| 46| } else if(ctr_size == 8) { ------------------ | Branch (226:14): [True: 0, False: 0] ------------------ 227| 0| const size_t off = (BS - 8); 228| 0| const uint64_t low64 = counter + load_be(&m_counter[off], 0); 229| | 230| 0| for(size_t i = 0; i != ctr_blocks; ++i) { ------------------ | Branch (230:25): [True: 0, False: 0] ------------------ 231| 0| store_be(uint64_t(low64 + i), &m_counter[i * BS + off]); 232| 0| } 233| 0| } else if(ctr_size == 16) { ------------------ | Branch (233:14): [True: 0, False: 0] ------------------ 234| 0| const size_t off = (BS - 16); 235| 0| uint64_t b0 = load_be(&m_counter[off], 0); 236| 0| uint64_t b1 = load_be(&m_counter[off], 1); 237| 0| b1 += counter; 238| 0| b0 += (b1 < counter) ? 1 : 0; // carry ------------------ | Branch (238:13): [True: 0, False: 0] ------------------ 239| | 240| 0| for(size_t i = 0; i != ctr_blocks; ++i) { ------------------ | Branch (240:25): [True: 0, False: 0] ------------------ 241| 0| store_be(b0, &m_counter[i * BS + off]); 242| 0| store_be(b1, &m_counter[i * BS + off + 8]); 243| 0| b1 += 1; 244| 0| if(b1 == 0) { ------------------ | Branch (244:13): [True: 0, False: 0] ------------------ 245| 0| b0 += 1; // carry 246| 0| } 247| 0| } 248| 0| } else { 249| 0| for(size_t i = 0; i != ctr_blocks; ++i) { ------------------ | Branch (249:25): [True: 0, False: 0] ------------------ 250| 0| uint64_t local_counter = counter; 251| 0| uint16_t carry = static_cast(local_counter); 252| 0| for(size_t j = 0; (carry > 0 || local_counter > 0) && j != ctr_size; ++j) { ------------------ | Branch (252:29): [True: 0, False: 0] | Branch (252:42): [True: 0, False: 0] | Branch (252:64): [True: 0, False: 0] ------------------ 253| 0| const size_t off = i * BS + (BS - 1 - j); 254| 0| const uint16_t cnt = static_cast(m_counter[off]) + carry; 255| 0| m_counter[off] = static_cast(cnt); 256| 0| local_counter = (local_counter >> 8); 257| 0| carry = (cnt >> 8) + static_cast(local_counter); 258| 0| } 259| 0| } 260| 0| } 261| 46|} _ZN5Botan6CTR_BE4seekEm: 263| 337|void CTR_BE::seek(uint64_t offset) { 264| 337| assert_key_material_set(); 265| | 266| 337| if(m_ctr_size < sizeof(uint64_t)) { ------------------ | Branch (266:7): [True: 337, False: 0] ------------------ 267| 337| const uint64_t requested_block = offset / m_block_size; 268| 337| const uint64_t max_blocks = uint64_t{1} << (8 * m_ctr_size); 269| 337| if(requested_block >= max_blocks) { ------------------ | Branch (269:10): [True: 0, False: 337] ------------------ 270| 0| throw Invalid_Argument(fmt("CTR_BE::seek offset {} exceeds {}-byte counter range", offset, m_ctr_size)); 271| 0| } 272| | 273| 337| m_bytes_remaining = max_blocks * m_block_size - offset; 274| 337| } 275| | 276| 337| const uint64_t base_counter = m_ctr_blocks * (offset / m_counter.size()); 277| | 278| 337| zeroise(m_counter); 279| 337| BOTAN_ASSERT_NOMSG(m_counter.size() >= m_iv.size()); ------------------ | | 77| 337| do { \ | | 78| 337| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 337| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 337] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 337| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 337] | | ------------------ ------------------ 280| 337| copy_mem(m_counter.data(), m_iv.data(), m_iv.size()); 281| | 282| 337| const size_t BS = m_block_size; 283| | 284| | // Set m_counter blocks to IV, IV + 1, ... IV + n 285| | 286| 337| if(m_ctr_size == 4 && BS >= 8) { ------------------ | Branch (286:7): [True: 337, False: 0] | Branch (286:26): [True: 337, False: 0] ------------------ 287| 337| const uint32_t low32 = load_be(&m_counter[BS - 4], 0); 288| | 289| 337| if(m_ctr_blocks >= 4 && is_power_of_2(m_ctr_blocks)) { ------------------ | Branch (289:10): [True: 337, False: 0] | Branch (289:31): [True: 337, False: 0] ------------------ 290| 337| size_t written = 1; 291| 1.67k| while(written < m_ctr_blocks) { ------------------ | Branch (291:16): [True: 1.33k, False: 337] ------------------ 292| 1.33k| copy_mem(&m_counter[written * BS], &m_counter[0], BS * written); // NOLINT(*container-data-pointer) 293| 1.33k| written *= 2; 294| 1.33k| } 295| 337| } else { 296| 0| for(size_t i = 1; i != m_ctr_blocks; ++i) { ------------------ | Branch (296:28): [True: 0, False: 0] ------------------ 297| 0| copy_mem(&m_counter[i * BS], &m_counter[0], BS - 4); // NOLINT(*container-data-pointer) 298| 0| } 299| 0| } 300| | 301| 5.32k| for(size_t i = 1; i != m_ctr_blocks; ++i) { ------------------ | Branch (301:25): [True: 4.98k, False: 337] ------------------ 302| 4.98k| const uint32_t c = static_cast(low32 + i); 303| 4.98k| store_be(c, &m_counter[(BS - 4) + i * BS]); 304| 4.98k| } 305| 337| } else { 306| | // do everything sequentially: 307| 0| for(size_t i = 1; i != m_ctr_blocks; ++i) { ------------------ | Branch (307:25): [True: 0, False: 0] ------------------ 308| 0| copy_mem(&m_counter[i * BS], &m_counter[(i - 1) * BS], BS); 309| | 310| 0| for(size_t j = 0; j != m_ctr_size; ++j) { ------------------ | Branch (310:28): [True: 0, False: 0] ------------------ 311| 0| uint8_t& c = m_counter[i * BS + (BS - 1 - j)]; 312| 0| c += 1; 313| 0| if(c > 0) { ------------------ | Branch (313:16): [True: 0, False: 0] ------------------ 314| 0| break; 315| 0| } 316| 0| } 317| 0| } 318| 0| } 319| | 320| 337| if(base_counter > 0) { ------------------ | Branch (320:7): [True: 0, False: 337] ------------------ 321| 0| add_counter(base_counter); 322| 0| } 323| | 324| 337| m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks); 325| 337| m_pad_pos = offset % m_counter.size(); 326| 337|} _ZN5Botan6CTR_BE23ctr_proc_bs16_ctr4_avx2EPKhPhm: 15| 32|size_t CTR_BE::ctr_proc_bs16_ctr4_avx2(const uint8_t* in, uint8_t* out, size_t length) { 16| 32| BOTAN_ASSERT_NOMSG(m_pad.size() % 64 == 0); ------------------ | | 77| 32| do { \ | | 78| 32| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 32| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 32] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 32| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 32] | | ------------------ ------------------ 17| 32| BOTAN_DEBUG_ASSERT(m_counter.size() == m_pad.size()); ------------------ | | 130| 32| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 32| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 32] | | ------------------ ------------------ 18| | 19| 32| const size_t pad_size = m_pad.size(); 20| 32| if(length < pad_size) { ------------------ | Branch (20:7): [True: 0, False: 32] ------------------ 21| 0| return 0; 22| 0| } 23| | 24| 32| const size_t ctr_blocks = m_ctr_blocks; 25| | 26| | /* 27| | * Byte swap table that swaps only the counter bytes and not the nonce bytes 28| | */ 29| 32| const SIMD_8x32 bswap_ctr( 30| 32| 0x03020100, 0x07060504, 0x0B0A0908, 0x0C0D0E0F, 0x03020100, 0x07060504, 0x0B0A0908, 0x0C0D0E0F); 31| | 32| | // Load the starting counter value, bswap the counter field itself so we can add 33| 32| const SIMD_8x32 starting_ctr = SIMD_8x32::byte_shuffle(SIMD_8x32::load_le128(m_counter.data()), bswap_ctr); 34| | 35| | // Counter is incremented 4 blocks at a time (2 per register, 2 registers) 36| 32| const SIMD_8x32 inc4(0, 0, 0, 4); 37| | 38| 32| const uint32_t N = static_cast(ctr_blocks); 39| 32| SIMD_8x32 batch_ctr0 = starting_ctr + SIMD_8x32(0, 0, 0, N, 0, 0, 0, N + 1); 40| 32| SIMD_8x32 batch_ctr1 = starting_ctr + SIMD_8x32(0, 0, 0, N + 2, 0, 0, 0, N + 3); 41| 32| const uint8_t* pad_buf = m_pad.data(); 42| 32| uint8_t* ctr_buf = m_counter.data(); 43| | 44| 32| const size_t ctr_block_quads = ctr_blocks / 4; 45| | 46| 32| size_t processed = 0; 47| | 48| 287| while(length >= pad_size) { ------------------ | Branch (48:10): [True: 255, False: 32] ------------------ 49| 1.27k| for(size_t i = 0; i != ctr_block_quads; ++i) { ------------------ | Branch (49:25): [True: 1.02k, False: 255] ------------------ 50| 1.02k| const size_t off = i * 64; 51| | 52| | // Store and update the counters 53| 1.02k| SIMD_8x32::byte_shuffle(batch_ctr0, bswap_ctr).store_le(ctr_buf + off); 54| 1.02k| SIMD_8x32::byte_shuffle(batch_ctr1, bswap_ctr).store_le(ctr_buf + off + 32); 55| 1.02k| batch_ctr0 += inc4; 56| 1.02k| batch_ctr1 += inc4; 57| | 58| 1.02k| const auto p0 = SIMD_8x32::load_le(pad_buf + off); 59| 1.02k| const auto p1 = SIMD_8x32::load_le(pad_buf + off + 32); 60| | 61| 1.02k| auto i0 = SIMD_8x32::load_le(in + off); 62| 1.02k| auto i1 = SIMD_8x32::load_le(in + off + 32); 63| | 64| 1.02k| i0 ^= p0; 65| 1.02k| i1 ^= p1; 66| | 67| 1.02k| i0.store_le(out + off); 68| 1.02k| i1.store_le(out + off + 32); 69| 1.02k| } 70| | 71| 255| in += pad_size; 72| 255| out += pad_size; 73| 255| length -= pad_size; 74| 255| processed += pad_size; 75| | 76| | // Regenerate the pad buffer 77| 255| m_cipher->encrypt_n(m_counter.data(), m_pad.data(), ctr_blocks); 78| 255| } 79| | 80| 32| return processed; 81| 32|} _ZN5Botan12StreamCipher6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 40| 1|std::unique_ptr StreamCipher::create(std::string_view algo_spec, std::string_view provider) { 41| 1|#if defined(BOTAN_HAS_SHAKE_CIPHER) 42| 1| if(algo_spec == "SHAKE-128" || algo_spec == "SHAKE-128-XOF") { ------------------ | Branch (42:7): [True: 0, False: 1] | Branch (42:35): [True: 0, False: 1] ------------------ 43| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (43:10): [True: 0, False: 0] | Branch (43:30): [True: 0, False: 0] ------------------ 44| 0| return std::make_unique(); 45| 0| } 46| 0| } 47| | 48| 1| if(algo_spec == "SHAKE-256" || algo_spec == "SHAKE-256-XOF") { ------------------ | Branch (48:7): [True: 0, False: 1] | Branch (48:35): [True: 0, False: 1] ------------------ 49| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (49:10): [True: 0, False: 0] | Branch (49:30): [True: 0, False: 0] ------------------ 50| 0| return std::make_unique(); 51| 0| } 52| 0| } 53| 1|#endif 54| | 55| 1|#if defined(BOTAN_HAS_CHACHA) 56| 1| if(algo_spec == "ChaCha20") { ------------------ | Branch (56:7): [True: 0, False: 1] ------------------ 57| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (57:10): [True: 0, False: 0] | Branch (57:30): [True: 0, False: 0] ------------------ 58| 0| return std::make_unique(20); 59| 0| } 60| 0| } 61| 1|#endif 62| | 63| 1|#if defined(BOTAN_HAS_SALSA20) 64| 1| if(algo_spec == "Salsa20") { ------------------ | Branch (64:7): [True: 0, False: 1] ------------------ 65| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (65:10): [True: 0, False: 0] | Branch (65:30): [True: 0, False: 0] ------------------ 66| 0| return std::make_unique(); 67| 0| } 68| 0| } 69| 1|#endif 70| | 71| 1| const SCAN_Name req(algo_spec); 72| | 73| 1|#if defined(BOTAN_HAS_CTR_BE) 74| 1| if((req.algo_name() == "CTR-BE" || req.algo_name() == "CTR") && req.arg_count_between(1, 2)) { ------------------ | Branch (74:8): [True: 0, False: 1] | Branch (74:39): [True: 0, False: 1] | Branch (74:68): [True: 0, False: 0] ------------------ 75| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (75:10): [True: 0, False: 0] | Branch (75:30): [True: 0, False: 0] ------------------ 76| 0| auto cipher = BlockCipher::create(req.arg(0)); 77| 0| if(cipher) { ------------------ | Branch (77:13): [True: 0, False: 0] ------------------ 78| 0| const size_t ctr_size = req.arg_as_integer(1, cipher->block_size()); 79| 0| return std::make_unique(std::move(cipher), ctr_size); 80| 0| } 81| 0| } 82| 0| } 83| 1|#endif 84| | 85| 1|#if defined(BOTAN_HAS_CHACHA) 86| 1| if(req.algo_name() == "ChaCha") { ------------------ | Branch (86:7): [True: 1, False: 0] ------------------ 87| 1| if(provider.empty() || provider == "base") { ------------------ | Branch (87:10): [True: 1, False: 0] | Branch (87:30): [True: 0, False: 0] ------------------ 88| 1| return std::make_unique(req.arg_as_integer(0, 20)); 89| 1| } 90| 1| } 91| 0|#endif 92| | 93| 0|#if defined(BOTAN_HAS_OFB) 94| 0| if(req.algo_name() == "OFB" && req.arg_count() == 1) { ------------------ | Branch (94:7): [True: 0, False: 0] | Branch (94:35): [True: 0, False: 0] ------------------ 95| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (95:10): [True: 0, False: 0] | Branch (95:30): [True: 0, False: 0] ------------------ 96| 0| if(auto cipher = BlockCipher::create(req.arg(0))) { ------------------ | Branch (96:18): [True: 0, False: 0] ------------------ 97| 0| return std::make_unique(std::move(cipher)); 98| 0| } 99| 0| } 100| 0| } 101| 0|#endif 102| | 103| 0|#if defined(BOTAN_HAS_RC4) 104| | 105| 0| if(req.algo_name() == "RC4" || req.algo_name() == "ARC4" || req.algo_name() == "MARK-4") { ------------------ | Branch (105:7): [True: 0, False: 0] | Branch (105:35): [True: 0, False: 0] | Branch (105:64): [True: 0, False: 0] ------------------ 106| 0| const size_t skip = (req.algo_name() == "MARK-4") ? 256 : req.arg_as_integer(0, 0); ------------------ | Branch (106:27): [True: 0, False: 0] ------------------ 107| | 108| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (108:10): [True: 0, False: 0] | Branch (108:30): [True: 0, False: 0] ------------------ 109| 0| return std::make_unique(skip); 110| 0| } 111| 0| } 112| | 113| 0|#endif 114| | 115| 0| BOTAN_UNUSED(req); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 116| 0| BOTAN_UNUSED(provider); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 117| | 118| 0| return nullptr; 119| 0|} _ZN5Botan12StreamCipher15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 122| 1|std::unique_ptr StreamCipher::create_or_throw(std::string_view algo, std::string_view provider) { 123| 1| if(auto sc = StreamCipher::create(algo, provider)) { ------------------ | Branch (123:12): [True: 1, False: 0] ------------------ 124| 1| return sc; 125| 1| } 126| 0| throw Lookup_Error("Stream cipher", algo, provider); 127| 1|} _ZN5Botan19Credentials_Manager3pskERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES9_S9_: 29| 2.84k| const std::string& identity) { 30| 2.84k| auto side = [&] { 31| 2.84k| if(type == "tls-client") { 32| 2.84k| return TLS::Connection_Side::Client; 33| 2.84k| } else if(type == "tls-server") { 34| 2.84k| return TLS::Connection_Side::Server; 35| 2.84k| } else { 36| 2.84k| throw Internal_Error(fmt("No PSK set for type {}", type)); 37| 2.84k| } 38| 2.84k| }(); 39| | 40| | // New applications should use the appropriate credentials methods. This is a 41| | // retrofit of the behaviour before Botan 3.2.0 and will be removed in a 42| | // future major release. 43| | // 44| | // TODO: deprecate `psk("...", "session-ticket" | "dtls-cookie-secret")` 45| 2.84k| if(side == TLS::Connection_Side::Server && context == "session-ticket") { ------------------ | Branch (45:7): [True: 2.84k, False: 0] | Branch (45:47): [True: 0, False: 2.84k] ------------------ 46| 0| if(auto key = session_ticket_key(); !key.empty()) { ------------------ | Branch (46:43): [True: 0, False: 0] ------------------ 47| 0| return SymmetricKey(std::move(key)); 48| 0| } 49| 2.84k| } else if(side == TLS::Connection_Side::Server && context == "dtls-cookie-secret") { ------------------ | Branch (49:14): [True: 2.84k, False: 0] | Branch (49:54): [True: 699, False: 2.14k] ------------------ 50| 699| if(auto key = dtls_cookie_secret(); !key.empty()) { ------------------ | Branch (50:43): [True: 699, False: 0] ------------------ 51| 699| return SymmetricKey(std::move(key)); 52| 699| } 53| 2.14k| } else /* context is a host name */ { 54| | // Assuming that find_preshared_keys returns _exactly_ one or no keys when 55| | // searching for a single specific identity. 56| 2.14k| if(auto psks = find_preshared_keys(context, side, {identity}); psks.size() == 1) { ------------------ | Branch (56:70): [True: 2.12k, False: 22] ------------------ 57| 2.12k| return SymmetricKey(psks.front().extract_master_secret()); 58| 2.12k| } 59| 2.14k| } 60| | 61| 22| throw Internal_Error(fmt("No PSK set for identity {}", identity)); 62| 2.84k|} _ZN5Botan19Credentials_Manager19find_preshared_keysENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_3TLS15Connection_SideERKNS1_6vectorINS1_12basic_stringIcS4_NS1_9allocatorIcEEEENSA_ISC_EEEERKNS1_8optionalISC_EE: 67| 22| const std::optional& /* prf */) { 68| 22| return {}; 69| 22|} _ZN5Botan19Credentials_Manager15find_cert_chainERKNSt3__16vectorINS1_12basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS6_IS8_EEEERKNS2_INS_19AlgorithmIdentifierENS6_ISD_EEEERKNS2_INS_7X509_DNENS6_ISI_EEEERKS8_SO_: 88| 5.94k| const std::string& context) { 89| 5.94k| return cert_chain(key_types, cert_signature_schemes, type, context); 90| 5.94k|} _ZN5Botan19Credentials_Manager22cert_chain_single_typeERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEERKNS1_6vectorINS_19AlgorithmIdentifierENS5_ISB_EEEES9_S9_: 109| 5.94k| const std::string& context) { 110| 5.94k| return find_cert_chain({cert_key_type}, cert_signature_schemes, std::vector(), type, context); 111| 5.94k|} _ZN5Botan19Credentials_Manager31trusted_certificate_authoritiesERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES9_: 134| 2.75k| const std::string& /*unused*/) { 135| 2.75k| return std::vector(); 136| 2.75k|} credentials_manager.cpp:_ZZN5Botan19Credentials_Manager3pskERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES9_S9_ENK3$_0clEv: 30| 2.84k| auto side = [&] { 31| 2.84k| if(type == "tls-client") { ------------------ | Branch (31:10): [True: 0, False: 2.84k] ------------------ 32| 0| return TLS::Connection_Side::Client; 33| 2.84k| } else if(type == "tls-server") { ------------------ | Branch (33:17): [True: 2.84k, False: 0] ------------------ 34| 2.84k| return TLS::Connection_Side::Server; 35| 2.84k| } else { 36| 0| throw Internal_Error(fmt("No PSK set for type {}", type)); 37| 0| } 38| 2.84k| }(); _ZN5Botan3TLS18Certificate_VerifyC2ENSt3__14spanIKhLm18446744073709551615EEE: 20| 59|Certificate_Verify::Certificate_Verify(std::span buf) { 21| 59| TLS_Data_Reader reader("CertificateVerify", buf); 22| | 23| 59| m_scheme = Signature_Scheme(reader.get_uint16_t()); 24| | // Somewhat oddly, the signature really is allowed to be empty in a CertificateVerify 25| 59| m_signature = reader.get_range(2, 0, 65535); 26| 59| reader.assert_done(); 27| | 28| 59| if(!m_scheme.is_set()) { ------------------ | Branch (28:7): [True: 1, False: 58] ------------------ 29| 1| throw Decoding_Error("Counterparty did not send hash/sig IDS"); 30| 1| } 31| 59|} _ZN5Botan3TLS17make_hello_randomERNS_21RandomNumberGeneratorERNS0_9CallbacksERKNS0_6PolicyE: 25| 5.52k|std::vector make_hello_random(RandomNumberGenerator& rng, Callbacks& cb, const Policy& policy) { 26| 5.52k| auto buf = rng.random_vec>(32); 27| | 28| 5.52k| if(policy.hash_hello_random()) { ------------------ | Branch (28:7): [True: 5.52k, False: 0] ------------------ 29| 5.52k| auto sha256 = HashFunction::create_or_throw("SHA-256"); 30| 5.52k| sha256->update(buf); 31| 5.52k| sha256->final(buf); 32| 5.52k| } 33| | 34| | // TLS 1.3 does not require the insertion of a timestamp in the client hello 35| | // random. When offering both TLS 1.2 and 1.3 we nevertheless comply with the 36| | // legacy specification. 37| 5.52k| if(policy.include_time_in_hello_random() && (policy.allow_tls12() || policy.allow_dtls12())) { ------------------ | Branch (37:7): [True: 5.52k, False: 0] | Branch (37:49): [True: 5.52k, False: 0] | Branch (37:73): [True: 0, False: 0] ------------------ 38| 5.52k| const uint32_t time32 = static_cast(std::chrono::system_clock::to_time_t(cb.tls_current_timestamp())); 39| | 40| 5.52k| store_be(time32, buf.data()); 41| 5.52k| } 42| | 43| 5.52k| return buf; 44| 5.52k|} _ZN5Botan3TLS21Client_Hello_InternalC2ENSt3__14spanIKhLm18446744073709551615EEE: 46| 7.03k|Client_Hello_Internal::Client_Hello_Internal(std::span buf) { 47| | /* 48| | Minimum possible client hello 49| | 50| | version: 2 bytes 51| | random: 32 bytes 52| | session_id len: 1 byte 53| | ciphersuite_len: 2 54| | ciphersuite (single): 2 55| | compression_len: 1 56| | compression (single): 1 57| | */ 58| | 59| 7.03k| constexpr size_t MinimumClientHelloBytes = 2 + 32 + 1 + 2 + 2 + 1 + 1; 60| 7.03k| if(buf.size() < MinimumClientHelloBytes) { ------------------ | Branch (60:7): [True: 12, False: 7.02k] ------------------ 61| 12| throw Decoding_Error("Client_Hello: Packet corrupted"); 62| 12| } 63| | 64| 7.02k| TLS_Data_Reader reader("ClientHello", buf); 65| | 66| 7.02k| const uint8_t major_version = reader.get_byte(); 67| 7.02k| const uint8_t minor_version = reader.get_byte(); 68| | 69| 7.02k| m_legacy_version = Protocol_Version(major_version, minor_version); 70| | 71| | // DTLS has an additional 1 byte cookie length field 72| 7.02k| if(m_legacy_version.is_datagram_protocol() && buf.size() < MinimumClientHelloBytes + 1) { ------------------ | Branch (72:7): [True: 144, False: 6.87k] | Branch (72:50): [True: 1, False: 143] ------------------ 73| 1| throw Decoding_Error("Client_Hello: DTLS packet corrupted"); 74| 1| } 75| | 76| 7.02k| m_random = reader.get_fixed(32); 77| 7.02k| m_session_id = Session_ID(reader.get_range(1, 0, 32)); 78| | 79| 7.02k| if(m_legacy_version.is_datagram_protocol()) { ------------------ | Branch (79:7): [True: 143, False: 6.87k] ------------------ 80| 143| auto sha256 = HashFunction::create_or_throw("SHA-256"); 81| 143| sha256->update(reader.get_data_read_so_far()); 82| | 83| 143| m_hello_cookie = reader.get_range(1, 0, 255); 84| | 85| 143| sha256->update(reader.get_remaining()); 86| 143| m_cookie_input_bits = sha256->final_stdvec(); 87| 143| } 88| | 89| 7.02k| m_suites = reader.get_range_vector(2, 1, 32767); 90| 7.02k| m_comp_methods = reader.get_range_vector(1, 1, 255); 91| | 92| 7.02k| m_extensions.deserialize(reader, Connection_Side::Client, Handshake_Type::ClientHello); 93| 7.02k|} _ZNK5Botan3TLS21Client_Hello_Internal7versionEv: 95| 3.17k|Protocol_Version Client_Hello_Internal::version() const { 96| | // RFC 8446 4.2.1 97| | // If [the "supported_versions"] extension is not present, servers 98| | // which are compliant with this specification and which also support 99| | // TLS 1.2 MUST negotiate TLS 1.2 or prior as specified in [RFC5246], 100| | // even if ClientHello.legacy_version is 0x0304 or later. 101| | // 102| | // RFC 8446 4.2.1 103| | // Servers MUST be prepared to receive ClientHellos that include 104| | // [the supported_versions] extension but do not include 0x0304 in 105| | // the list of versions. 106| | // 107| | // RFC 8446 4.1.2 108| | // TLS 1.3 ClientHellos are identified as having a legacy_version of 109| | // 0x0303 and a supported_versions extension present with 0x0304 as 110| | // the highest version indicated therein. 111| 3.17k| if(!extensions().has() || ------------------ | Branch (111:7): [True: 3.12k, False: 54] ------------------ 112| 3.14k| !extensions().get()->supports(Protocol_Version::TLS_V13)) { ------------------ | Branch (112:7): [True: 20, False: 34] ------------------ 113| | // The exact legacy_version is ignored we just inspect it to 114| | // distinguish TLS and DTLS. 115| 3.14k| return (m_legacy_version.is_datagram_protocol()) ? Protocol_Version::DTLS_V12 : Protocol_Version::TLS_V12; ------------------ | Branch (115:14): [True: 47, False: 3.09k] ------------------ 116| 3.14k| } 117| | 118| | // Note: The Client_Hello_13 class will make sure that legacy_version 119| | // is exactly 0x0303 (aka ossified TLS 1.2) 120| 34| return Protocol_Version::TLS_V13; 121| 3.17k|} _ZN5Botan3TLS12Client_HelloC2EOS1_: 123| 28.2k|Client_Hello::Client_Hello(Client_Hello&&) noexcept = default; _ZN5Botan3TLS12Client_HelloD2Ev: 126| 34.5k|Client_Hello::~Client_Hello() = default; _ZN5Botan3TLS12Client_HelloC2ENSt3__110unique_ptrINS0_21Client_Hello_InternalENS2_14default_deleteIS4_EEEE: 133| 6.31k|Client_Hello::Client_Hello(std::unique_ptr data) : m_data(std::move(data)) { 134| 6.31k| BOTAN_ASSERT_NONNULL(m_data); ------------------ | | 116| 6.31k| do { \ | | 117| 6.31k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 6.31k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 6.31k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 6.31k] | | ------------------ ------------------ 135| 6.31k|} _ZNK5Botan3TLS12Client_Hello4typeEv: 137| 3.13k|Handshake_Type Client_Hello::type() const { 138| 3.13k| return Handshake_Type::ClientHello; 139| 3.13k|} _ZNK5Botan3TLS12Client_Hello14legacy_versionEv: 141| 3.13k|Protocol_Version Client_Hello::legacy_version() const { 142| 3.13k| return m_data->legacy_version(); 143| 3.13k|} _ZNK5Botan3TLS12Client_Hello6randomEv: 145| 1.50k|const std::vector& Client_Hello::random() const { 146| 1.50k| return m_data->random(); 147| 1.50k|} _ZNK5Botan3TLS12Client_Hello10session_idEv: 149| 2.94k|const Session_ID& Client_Hello::session_id() const { 150| 2.94k| return m_data->session_id(); 151| 2.94k|} _ZNK5Botan3TLS12Client_Hello19compression_methodsEv: 153| 3.10k|const std::vector& Client_Hello::compression_methods() const { 154| 3.10k| return m_data->comp_methods(); 155| 3.10k|} _ZNK5Botan3TLS12Client_Hello12ciphersuitesEv: 157| 2.97k|const std::vector& Client_Hello::ciphersuites() const { 158| 2.97k| return m_data->ciphersuites(); 159| 2.97k|} _ZNK5Botan3TLS12Client_Hello15extension_typesEv: 161| 2.64k|std::set Client_Hello::extension_types() const { 162| 2.64k| return m_data->extensions().extension_types(); 163| 2.64k|} _ZNK5Botan3TLS12Client_Hello10extensionsEv: 165| 2.97k|const Extensions& Client_Hello::extensions() const { 166| 2.97k| return m_data->extensions(); 167| 2.97k|} _ZNK5Botan3TLS12Client_Hello13offered_suiteEt: 209| 3.13k|bool Client_Hello::offered_suite(uint16_t ciphersuite) const { 210| 3.13k| return std::find(m_data->ciphersuites().cbegin(), m_data->ciphersuites().cend(), ciphersuite) != 211| 3.13k| m_data->ciphersuites().cend(); 212| 3.13k|} _ZNK5Botan3TLS12Client_Hello17signature_schemesEv: 214| 5.94k|std::vector Client_Hello::signature_schemes() const { 215| 5.94k| if(const Signature_Algorithms* sigs = m_data->extensions().get()) { ------------------ | Branch (215:35): [True: 365, False: 5.57k] ------------------ 216| 365| return sigs->supported_schemes(); 217| 365| } 218| 5.57k| return {}; 219| 5.94k|} _ZNK5Botan3TLS12Client_Hello29certificate_signature_schemesEv: 221| 2.97k|std::vector Client_Hello::certificate_signature_schemes() const { 222| | // RFC 8446 4.2.3 223| | // If no "signature_algorithms_cert" extension is present, then the 224| | // "signature_algorithms" extension also applies to signatures appearing 225| | // in certificates. 226| 2.97k| if(const Signature_Algorithms_Cert* sigs = m_data->extensions().get()) { ------------------ | Branch (226:40): [True: 5, False: 2.96k] ------------------ 227| 5| return sigs->supported_schemes(); 228| 2.96k| } else { 229| 2.96k| return signature_schemes(); 230| 2.96k| } 231| 2.97k|} _ZNK5Botan3TLS12Client_Hello20supported_ecc_curvesEv: 233| 5.61k|std::vector Client_Hello::supported_ecc_curves() const { 234| 5.61k| if(const Supported_Groups* groups = m_data->extensions().get()) { ------------------ | Branch (234:31): [True: 5.34k, False: 267] ------------------ 235| 5.34k| return groups->ec_groups(); 236| 5.34k| } 237| 267| return {}; 238| 5.61k|} _ZNK5Botan3TLS12Client_Hello19supported_dh_groupsEv: 240| 5.94k|std::vector Client_Hello::supported_dh_groups() const { 241| 5.94k| if(const Supported_Groups* groups = m_data->extensions().get()) { ------------------ | Branch (241:31): [True: 5.41k, False: 534] ------------------ 242| 5.41k| return groups->dh_groups(); 243| 5.41k| } 244| 534| return std::vector(); 245| 5.94k|} _ZNK5Botan3TLS12Client_Hello12sni_hostnameEv: 247| 7.97k|std::string Client_Hello::sni_hostname() const { 248| 7.97k| if(const Server_Name_Indicator* sni = m_data->extensions().get()) { ------------------ | Branch (248:36): [True: 15, False: 7.95k] ------------------ 249| 15| return sni->host_name(); 250| 15| } 251| 7.95k| return ""; 252| 7.97k|} _ZNK5Botan3TLS12Client_Hello18supported_versionsEv: 254| 3.12k|std::vector Client_Hello::supported_versions() const { 255| 3.12k| if(const Supported_Versions* versions = m_data->extensions().get()) { ------------------ | Branch (255:33): [True: 18, False: 3.10k] ------------------ 256| 18| return versions->versions(); 257| 18| } 258| 3.10k| return {}; 259| 3.12k|} _ZNK5Botan3TLS12Client_Hello13supports_alpnEv: 261| 2.99k|bool Client_Hello::supports_alpn() const { 262| 2.99k| return m_data->extensions().has(); 263| 2.99k|} _ZNK5Botan3TLS12Client_Hello14next_protocolsEv: 269| 32|std::vector Client_Hello::next_protocols() const { 270| 32| if(auto* alpn = m_data->extensions().get()) { ------------------ | Branch (270:13): [True: 32, False: 0] ------------------ 271| 32| return alpn->protocols(); 272| 32| } 273| 0| return {}; 274| 32|} _ZN5Botan3TLS20Client_Hello_12_ShimC2ENSt3__110unique_ptrINS0_21Client_Hello_InternalENS2_14default_deleteIS4_EEEE: 288| 6.28k| Client_Hello(std::move(data)) {} _ZN5Botan3TLS24make_server_hello_randomERNS_21RandomNumberGeneratorENS0_16Protocol_VersionERNS0_9CallbacksERKNS0_6PolicyE: 27| 2.76k| const Policy& policy) { 28| 2.76k| auto random = make_hello_random(rng, cb, policy); 29| | 30| | // RFC 8446 4.1.3 31| | // TLS 1.3 has a downgrade protection mechanism embedded in the server's 32| | // random value. TLS 1.3 servers which negotiate TLS 1.2 or below in 33| | // response to a ClientHello MUST set the last 8 bytes of their Random 34| | // value specially in their ServerHello. 35| | // 36| | // If negotiating TLS 1.2, TLS 1.3 servers MUST set the last 8 bytes of 37| | // their Random value to the bytes: [DOWNGRADE_TLS12] 38| 2.76k| if(offered_version.is_pre_tls_13() && policy.allow_tls13()) { ------------------ | Branch (38:7): [True: 2.76k, False: 0] | Branch (38:42): [True: 2.76k, False: 0] ------------------ 39| 2.76k| constexpr size_t downgrade_signal_length = sizeof(DOWNGRADE_TLS12); 40| 2.76k| BOTAN_ASSERT_NOMSG(random.size() >= downgrade_signal_length); ------------------ | | 77| 2.76k| do { \ | | 78| 2.76k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 2.76k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 2.76k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 2.76k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 2.76k] | | ------------------ ------------------ 41| 2.76k| const auto lastbytes = std::span{random}.last(downgrade_signal_length); 42| 2.76k| store_be(DOWNGRADE_TLS12, lastbytes); 43| 2.76k| } 44| | 45| 2.76k| return random; 46| 2.76k|} _ZN5Botan3TLS21Server_Hello_InternalC2ENSt3__14spanIKhLm18446744073709551615EEE: 48| 125|Server_Hello_Internal::Server_Hello_Internal(std::span buf) { 49| 125| if(buf.size() < 38) { ------------------ | Branch (49:7): [True: 2, False: 123] ------------------ 50| 2| throw Decoding_Error("Server_Hello: Packet corrupted"); 51| 2| } 52| | 53| 123| TLS_Data_Reader reader("ServerHello", buf); 54| | 55| 123| const uint8_t major_version = reader.get_byte(); 56| 123| const uint8_t minor_version = reader.get_byte(); 57| | 58| 123| m_legacy_version = Protocol_Version(major_version, minor_version); 59| | 60| | // RFC 8446 4.1.3 61| | // Upon receiving a message with type server_hello, implementations MUST 62| | // first examine the Random value and, if it matches this value, process 63| | // it as described in Section 4.1.4 [Hello Retry Request]). 64| 123| m_random = reader.get_fixed(32); 65| 123| m_is_hello_retry_request = CT::is_equal(m_random, HELLO_RETRY_REQUEST_MARKER).as_bool(); 66| | 67| 123| m_session_id = Session_ID(reader.get_range(1, 0, 32)); 68| 123| m_ciphersuite = reader.get_uint16_t(); 69| 123| m_comp_method = reader.get_byte(); 70| | 71| | // Note that this code path might parse a TLS 1.2 (or older) server hello message that 72| | // is nevertheless marked as being a 'hello retry request' (potentially maliciously). 73| | // Extension parsing will however not be affected by the associated flag. 74| | // Only after parsing the extensions will the upstream code be able to decide 75| | // whether we're dealing with TLS 1.3 or older. 76| 123| m_extensions.deserialize(reader, 77| 123| Connection_Side::Server, 78| 123| m_is_hello_retry_request ? Handshake_Type::HelloRetryRequest : Handshake_Type::ServerHello); ------------------ | Branch (78:29): [True: 0, False: 123] ------------------ 79| 123|} _ZNK5Botan3TLS21Server_Hello_Internal7versionEv: 81| 2.91k|Protocol_Version Server_Hello_Internal::version() const { 82| | // RFC 8446 4.2.1 83| | // A server which negotiates a version of TLS prior to TLS 1.3 MUST set 84| | // ServerHello.version and MUST NOT send the "supported_versions" 85| | // extension. A server which negotiates TLS 1.3 MUST respond by sending 86| | // a "supported_versions" extension containing the selected version 87| | // value (0x0304). 88| | // 89| | // Note: Here we just take a message parsing decision, further validation of 90| | // the extension's contents is done later. 91| 2.91k| return (extensions().has()) ? Protocol_Version::TLS_V13 : m_legacy_version; ------------------ | Branch (91:11): [True: 54, False: 2.85k] ------------------ 92| 2.91k|} _ZN5Botan3TLS12Server_HelloC2ENSt3__110unique_ptrINS0_21Server_Hello_InternalENS2_14default_deleteIS4_EEEE: 94| 2.81k|Server_Hello::Server_Hello(std::unique_ptr data) : m_data(std::move(data)) {} _ZN5Botan3TLS12Server_HelloC2EOS1_: 96| 110|Server_Hello::Server_Hello(Server_Hello&&) noexcept = default; _ZN5Botan3TLS12Server_HelloD2Ev: 99| 2.92k|Server_Hello::~Server_Hello() = default; _ZNK5Botan3TLS12Server_Hello9serializeEv: 104| 2.76k|std::vector Server_Hello::serialize() const { 105| 2.76k| std::vector buf; 106| 2.76k| buf.reserve(1024); // working around GCC warning 107| | 108| 2.76k| buf.push_back(m_data->legacy_version().major_version()); 109| 2.76k| buf.push_back(m_data->legacy_version().minor_version()); 110| 2.76k| buf += m_data->random(); 111| | 112| 2.76k| append_tls_length_value(buf, m_data->session_id().get(), 1); 113| | 114| 2.76k| buf.push_back(get_byte<0>(m_data->ciphersuite())); 115| 2.76k| buf.push_back(get_byte<1>(m_data->ciphersuite())); 116| | 117| 2.76k| buf.push_back(m_data->comp_method()); 118| | 119| 2.76k| buf += m_data->extensions().serialize(Connection_Side::Server); 120| | 121| 2.76k| return buf; 122| 2.76k|} _ZNK5Botan3TLS12Server_Hello4typeEv: 124| 8.31k|Handshake_Type Server_Hello::type() const { 125| 8.31k| return Handshake_Type::ServerHello; 126| 8.31k|} _ZNK5Botan3TLS12Server_Hello14legacy_versionEv: 128| 140|Protocol_Version Server_Hello::legacy_version() const { 129| 140| return m_data->legacy_version(); 130| 140|} _ZNK5Botan3TLS12Server_Hello6randomEv: 132| 1.50k|const std::vector& Server_Hello::random() const { 133| 1.50k| return m_data->random(); 134| 1.50k|} _ZNK5Botan3TLS12Server_Hello18compression_methodEv: 136| 495|uint8_t Server_Hello::compression_method() const { 137| 495| return m_data->comp_method(); 138| 495|} _ZNK5Botan3TLS12Server_Hello10session_idEv: 140| 288|const Session_ID& Server_Hello::session_id() const { 141| 288| return m_data->session_id(); 142| 288|} _ZNK5Botan3TLS12Server_Hello11ciphersuiteEv: 144| 2.95k|uint16_t Server_Hello::ciphersuite() const { 145| 2.95k| return m_data->ciphersuite(); 146| 2.95k|} _ZNK5Botan3TLS12Server_Hello10extensionsEv: 152| 14|const Extensions& Server_Hello::extensions() const { 153| 14| return m_data->extensions(); 154| 14|} _ZN5Botan3TLS20Server_Hello_12_ShimC2ENSt3__110unique_ptrINS0_21Server_Hello_InternalENS2_14default_deleteIS4_EEEE: 160| 2.78k| Server_Hello(std::move(data)) { 161| 2.78k| if(!m_data->version().is_pre_tls_13()) { ------------------ | Branch (161:7): [True: 0, False: 2.78k] ------------------ 162| 0| throw TLS_Exception(Alert::ProtocolVersion, "Expected server hello of (D)TLS 1.2 or lower"); 163| 0| } 164| 2.78k|} _ZN5Botan3TLS14Certificate_12D2Ev: 22| 5|Certificate_12::~Certificate_12() = default; _ZN5Botan3TLS14Certificate_12C2ERNS0_12Handshake_IOERNS0_14Handshake_HashENSt3__16vectorINS_16X509_CertificateENS6_9allocatorIS8_EEEE: 28| 5| m_certs(std::move(cert_list)) { 29| 5| hash.update(io.send(*this)); 30| 5|} _ZNK5Botan3TLS14Certificate_129serializeEv: 90| 5|std::vector Certificate_12::serialize() const { 91| 5| std::vector buf(3); 92| | 93| 5| for(const auto& cert : m_certs) { ------------------ | Branch (93:25): [True: 5, False: 5] ------------------ 94| 5| const auto raw_cert = cert.BER_encode(); 95| 5| const size_t cert_size = raw_cert.size(); 96| 20| for(size_t j = 0; j != 3; ++j) { ------------------ | Branch (96:25): [True: 15, False: 5] ------------------ 97| 15| buf.push_back(get_byte_var(j + 1, static_cast(cert_size))); 98| 15| } 99| 5| buf += raw_cert; 100| 5| } 101| | 102| 5| const size_t buf_size = buf.size() - 3; 103| 20| for(size_t i = 0; i != 3; ++i) { ------------------ | Branch (103:22): [True: 15, False: 5] ------------------ 104| 15| buf[i] = get_byte_var(i + 1, static_cast(buf_size)); 105| 15| } 106| | 107| 5| return buf; 108| 5|} _ZNK5Botan3TLS15Client_Hello_1228prefers_compressed_ec_pointsEv: 29| 2.61k|bool Client_Hello_12::prefers_compressed_ec_points() const { 30| 2.61k| if(const Supported_Point_Formats* ecc_formats = m_data->extensions().get()) { ------------------ | Branch (30:38): [True: 78, False: 2.53k] ------------------ 31| 78| return ecc_formats->prefers_compressed(); 32| 78| } 33| 2.53k| return false; 34| 2.61k|} _ZNK5Botan3TLS15Client_Hello_1220secure_renegotiationEv: 36| 5.90k|bool Client_Hello_12::secure_renegotiation() const { 37| 5.90k| return m_data->extensions().has(); 38| 5.90k|} _ZNK5Botan3TLS15Client_Hello_1218renegotiation_infoEv: 40| 213|std::vector Client_Hello_12::renegotiation_info() const { 41| 213| if(const Renegotiation_Extension* reneg = m_data->extensions().get()) { ------------------ | Branch (41:38): [True: 213, False: 0] ------------------ 42| 213| return reneg->renegotiation_info(); 43| 213| } 44| 0| return {}; 45| 213|} _ZNK5Botan3TLS15Client_Hello_1223supports_session_ticketEv: 47| 2.76k|bool Client_Hello_12::supports_session_ticket() const { 48| 2.76k| return m_data->extensions().has(); 49| 2.76k|} _ZNK5Botan3TLS15Client_Hello_1214session_ticketEv: 51| 2.97k|Session_Ticket Client_Hello_12::session_ticket() const { 52| 2.97k| if(auto* ticket = m_data->extensions().get()) { ------------------ | Branch (52:13): [True: 40, False: 2.93k] ------------------ 53| 40| return ticket->contents(); 54| 40| } 55| 2.93k| return {}; 56| 2.97k|} _ZNK5Botan3TLS15Client_Hello_1214session_handleEv: 58| 2.97k|std::optional Client_Hello_12::session_handle() const { 59| | // RFC 5077 3.4 60| | // If a ticket is presented by the client, the server MUST NOT attempt 61| | // to use the Session ID in the ClientHello for stateful session 62| | // resumption. 63| 2.97k| if(auto ticket = session_ticket(); !ticket.empty()) { ------------------ | Branch (63:39): [True: 33, False: 2.94k] ------------------ 64| 33| return Session_Handle(ticket); 65| 2.94k| } else if(const auto& id = session_id(); !id.empty()) { ------------------ | Branch (65:45): [True: 4, False: 2.93k] ------------------ 66| 4| return Session_Handle(id); 67| 2.93k| } else { 68| 2.93k| return std::nullopt; 69| 2.93k| } 70| 2.97k|} _ZNK5Botan3TLS15Client_Hello_1231supports_extended_master_secretEv: 72| 5.80k|bool Client_Hello_12::supports_extended_master_secret() const { 73| 5.80k| return m_data->extensions().has(); 74| 5.80k|} _ZNK5Botan3TLS15Client_Hello_1228supports_cert_status_messageEv: 76| 2.76k|bool Client_Hello_12::supports_cert_status_message() const { 77| 2.76k| return m_data->extensions().has(); 78| 2.76k|} _ZNK5Botan3TLS15Client_Hello_1225supports_encrypt_then_macEv: 80| 1.61k|bool Client_Hello_12::supports_encrypt_then_mac() const { 81| 1.61k| return m_data->extensions().has(); 82| 1.61k|} _ZN5Botan3TLS15Client_Hello_12C2ENSt3__14spanIKhLm18446744073709551615EEE: 268| 3.14k| Client_Hello_12(std::make_unique(buf)) {} _ZN5Botan3TLS15Client_Hello_12C2ENSt3__110unique_ptrINS0_21Client_Hello_InternalENS2_14default_deleteIS4_EEEE: 279| 3.13k|Client_Hello_12::Client_Hello_12(std::unique_ptr data) : Client_Hello_12_Shim(std::move(data)) { 280| 3.13k| const uint16_t TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0x00FF; 281| | 282| 3.13k| if(offered_suite(static_cast(TLS_EMPTY_RENEGOTIATION_INFO_SCSV))) { ------------------ | Branch (282:7): [True: 224, False: 2.91k] ------------------ 283| 224| if(const Renegotiation_Extension* reneg = m_data->extensions().get()) { ------------------ | Branch (283:41): [True: 3, False: 221] ------------------ 284| 3| if(!reneg->renegotiation_info().empty()) { ------------------ | Branch (284:13): [True: 2, False: 1] ------------------ 285| 2| throw TLS_Exception(Alert::HandshakeFailure, "Client sent renegotiation SCSV and non-empty extension"); 286| 2| } 287| 221| } else { 288| | // add fake extension 289| 221| m_data->extensions().add(new Renegotiation_Extension()); // NOLINT(*-owning-memory) 290| 221| } 291| 224| } 292| 3.13k|} _ZN5Botan3TLS19Client_Key_ExchangeC2ENSt3__14spanIKhLm18446744073709551615EEERKNS0_15Handshake_StateEPKNS_11Private_KeyERNS_19Credentials_ManagerERKNS0_6PolicyERNS_21RandomNumberGeneratorE: 244| 2.15k| RandomNumberGenerator& rng) { 245| 2.15k| const Kex_Algo kex_algo = state.ciphersuite().kex_method(); 246| | 247| 2.15k| if(kex_algo == Kex_Algo::STATIC_RSA) { ------------------ | Branch (247:7): [True: 0, False: 2.15k] ------------------ 248| 0| BOTAN_ASSERT(state.server_certs() && !state.server_certs()->cert_chain().empty(), ------------------ | | 64| 0| do { \ | | 65| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 0| if(!(expr)) { \ | | ------------------ | | | Branch (66:12): [True: 0, False: 0] | | | Branch (66:12): [True: 0, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 0| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 0] | | ------------------ ------------------ 249| 0| "RSA key exchange negotiated so server sent a certificate"); 250| | 251| 0| if(server_rsa_kex_key == nullptr) { ------------------ | Branch (251:10): [True: 0, False: 0] ------------------ 252| 0| throw Internal_Error("Expected RSA kex but no server kex key set"); 253| 0| } 254| | 255| 0| if(server_rsa_kex_key->algo_name() != "RSA") { ------------------ | Branch (255:10): [True: 0, False: 0] ------------------ 256| 0| throw Internal_Error("Expected RSA key but got " + server_rsa_kex_key->algo_name()); 257| 0| } 258| | 259| 0| TLS_Data_Reader reader("ClientKeyExchange", contents); 260| | // RFC 5246 7.4.7.1: encrypted_pre_master_secret<1..2^16-1>. 261| 0| const std::vector encrypted_pre_master = reader.get_range(2, 1, 65535); 262| 0| reader.assert_done(); 263| | 264| 0| const PK_Decryptor_EME decryptor(*server_rsa_kex_key, rng, "PKCS1v15"); 265| | 266| 0| const uint8_t client_major = state.client_hello()->legacy_version().major_version(); 267| 0| const uint8_t client_minor = state.client_hello()->legacy_version().minor_version(); 268| | 269| | /* 270| | * PK_Decryptor::decrypt_or_random will return a random value if 271| | * either the length does not match the expected value or if the 272| | * version number embedded in the PMS does not match the one sent 273| | * in the client hello. 274| | */ 275| 0| const size_t expected_plaintext_size = 48; 276| 0| const size_t expected_content_size = 2; 277| 0| const uint8_t expected_content_bytes[expected_content_size] = {client_major, client_minor}; 278| 0| const uint8_t expected_content_pos[expected_content_size] = {0, 1}; 279| | 280| 0| m_pre_master = decryptor.decrypt_or_random(encrypted_pre_master.data(), 281| 0| encrypted_pre_master.size(), 282| 0| expected_plaintext_size, 283| 0| rng, 284| 0| expected_content_bytes, 285| 0| expected_content_pos, 286| 0| expected_content_size); 287| 2.15k| } else { 288| 2.15k| TLS_Data_Reader reader("ClientKeyExchange", contents); 289| | 290| 2.15k| SymmetricKey psk; 291| | 292| 2.15k| if(key_exchange_is_psk(kex_algo)) { ------------------ | Branch (292:10): [True: 2.15k, False: 0] ------------------ 293| 2.15k| m_psk_identity = reader.get_string(2, 0, 65535); 294| | 295| 2.15k| try { 296| 2.15k| psk = creds.psk("tls-server", state.client_hello()->sni_hostname(), m_psk_identity.value()); 297| 2.15k| } catch(...) { 298| | // Treat any lookup failure for the identity sent by the client as 299| | // "no PSK for this identity" and let the logic below handle it 300| 22| } 301| | 302| 2.15k| if(psk.empty()) { ------------------ | Branch (302:13): [True: 22, False: 2.12k] ------------------ 303| 22| if(policy.hide_unknown_users()) { ------------------ | Branch (303:16): [True: 0, False: 22] ------------------ 304| 0| psk = SymmetricKey(rng, 16); 305| 22| } else { 306| 22| throw TLS_Exception(Alert::UnknownPSKIdentity, "No PSK for identifier " + m_psk_identity.value()); 307| 22| } 308| 22| } 309| 2.14k| } 310| | 311| 2.12k| if(kex_algo == Kex_Algo::PSK) { ------------------ | Branch (311:10): [True: 17, False: 2.10k] ------------------ 312| 17| reader.assert_done(); 313| 17| const std::vector zeros(psk.length()); 314| 17| append_tls_length_value(m_pre_master, zeros, 2); 315| 17| append_tls_length_value(m_pre_master, psk.bits_of(), 2); 316| 2.10k| } else if(kex_algo == Kex_Algo::DH || kex_algo == Kex_Algo::ECDH || kex_algo == Kex_Algo::ECDHE_PSK) { ------------------ | Branch (316:17): [True: 0, False: 2.10k] | Branch (316:45): [True: 0, False: 2.10k] | Branch (316:75): [True: 2.10k, False: 0] ------------------ 317| 2.10k| const PK_Key_Agreement_Key& ka_key = state.server_kex()->server_kex_key(); 318| | 319| 2.10k| const std::vector client_pubkey = (ka_key.algo_name() == "DH") ------------------ | Branch (319:53): [True: 0, False: 2.10k] ------------------ 320| 2.10k| ? reader.get_range(2, 1, 65535) 321| 2.10k| : reader.get_range(1, 1, 255); 322| | 323| 2.10k| const auto shared_group = state.server_kex()->shared_group(); 324| 2.10k| BOTAN_STATE_CHECK(shared_group && shared_group.value() != Group_Params::NONE); ------------------ | | 51| 2.10k| do { \ | | 52| 2.10k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 4.20k| if(!(expr)) { \ | | ------------------ | | | Branch (53:12): [True: 2.10k, False: 1] | | | Branch (53:12): [True: 2.10k, False: 0] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 2.10k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 2.10k] | | ------------------ ------------------ 325| | 326| 2.10k| try { 327| 2.10k| auto shared_secret = 328| 2.10k| state.callbacks().tls_ephemeral_key_agreement(shared_group.value(), ka_key, client_pubkey, rng, policy); 329| | 330| 2.10k| if(ka_key.algo_name() == "DH") { ------------------ | Branch (330:16): [True: 0, False: 2.10k] ------------------ 331| 0| shared_secret = CT::strip_leading_zeros(shared_secret); 332| 0| } 333| | 334| 2.10k| if(kex_algo == Kex_Algo::ECDHE_PSK) { ------------------ | Branch (334:16): [True: 1.64k, False: 463] ------------------ 335| 1.64k| append_tls_length_value(m_pre_master, shared_secret, 2); 336| 1.64k| append_tls_length_value(m_pre_master, psk.bits_of(), 2); 337| 1.64k| } else { 338| 463| m_pre_master = shared_secret; 339| 463| } 340| 2.10k| } catch(Invalid_Argument& e) { 341| 0| throw TLS_Exception(Alert::IllegalParameter, e.what()); 342| 462| } catch(TLS_Exception&) { 343| 462| throw; // rethrow 344| 462| } catch(std::exception&) { 345| | /* 346| | * Something failed in the DH/ECDH computation. To avoid possible 347| | * attacks which are based on triggering and detecting some edge 348| | * failure condition, randomize the pre-master output and carry on, 349| | * allowing the protocol to fail later in the finished checks. 350| | */ 351| 0| rng.random_vec(m_pre_master, ka_key.public_value().size()); 352| 0| } 353| | 354| 1.64k| reader.assert_done(); 355| 1.64k| } else { 356| 0| throw Internal_Error("Client_Key_Exchange: Unknown key exchange negotiated"); 357| 0| } 358| 2.12k| } 359| 2.15k|} _ZN5Botan3TLS11Finished_12C2ERNS0_12Handshake_IOERNS0_15Handshake_StateENS0_15Connection_SideE: 44| 96|Finished_12::Finished_12(Handshake_IO& io, Handshake_State& state, Connection_Side side) { 45| 96| m_verification_data = finished_compute_verify_12(state, side); 46| 96| state.hash().update(io.send(*this)); 47| 96|} _ZNK5Botan3TLS11Finished_126verifyERKNS0_15Handshake_StateENS0_15Connection_SideE: 49| 96|bool Finished_12::verify(const Handshake_State& state, Connection_Side side) const { 50| 96| std::vector computed_verify = finished_compute_verify_12(state, side); 51| | 52| 96|#if defined(BOTAN_UNSAFE_FUZZER_MODE) 53| 96| return true; 54| |#else 55| | return CT::is_equal(m_verification_data, computed_verify).as_bool(); 56| |#endif 57| 96|} msg_finished_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_126finished_compute_verify_12ERKNS0_15Handshake_StateENS0_15Connection_SideE: 23| 192|std::vector finished_compute_verify_12(const Handshake_State& state, Connection_Side side) { 24| 192| const uint8_t TLS_CLIENT_LABEL[] = { 25| 192| 0x63, 0x6C, 0x69, 0x65, 0x6E, 0x74, 0x20, 0x66, 0x69, 0x6E, 0x69, 0x73, 0x68, 0x65, 0x64}; 26| | 27| 192| const uint8_t TLS_SERVER_LABEL[] = { 28| 192| 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x66, 0x69, 0x6E, 0x69, 0x73, 0x68, 0x65, 0x64}; 29| | 30| 192| auto prf = state.protocol_specific_prf(); 31| | 32| 192| std::vector input; 33| 192| std::vector label; 34| 192| label += (side == Connection_Side::Client) ? std::make_pair(TLS_CLIENT_LABEL, sizeof(TLS_CLIENT_LABEL)) ------------------ | Branch (34:13): [True: 96, False: 96] ------------------ 35| 192| : std::make_pair(TLS_SERVER_LABEL, sizeof(TLS_SERVER_LABEL)); 36| | 37| 192| input += state.hash().final(state.ciphersuite().prf_algo()); 38| | 39| 192| return unlock(prf->derive_key(12, state.session_keys().master_secret(), input, label)); 40| 192|} _ZN5Botan3TLS15Server_Hello_12C2ERNS0_12Handshake_IOERNS0_14Handshake_HashERKNS0_6PolicyERNS0_9CallbacksERNS_21RandomNumberGeneratorENSt3__16vectorIhNSD_9allocatorIhEEEERKNS0_15Client_Hello_12ERKNS1_8SettingsENSD_17basic_string_viewIcNSD_11char_traitsIcEEEE: 31| 2.76k| Server_Hello_12(std::make_unique( 32| 2.76k| server_settings.protocol_version(), 33| 2.76k| server_settings.session_id(), 34| 2.76k| make_server_hello_random(rng, server_settings.protocol_version(), cb, policy), 35| 2.76k| server_settings.ciphersuite(), 36| 2.76k| uint8_t(0))) { 37| | // NOLINTBEGIN(*-owning-memory) 38| 2.76k| if(client_hello.supports_extended_master_secret()) { ------------------ | Branch (38:7): [True: 2.76k, False: 0] ------------------ 39| 2.76k| m_data->extensions().add(new Extended_Master_Secret); 40| 2.76k| } 41| | 42| | // Sending the extension back does not commit us to sending a stapled response 43| 2.76k| if(client_hello.supports_cert_status_message() && policy.support_cert_status_message()) { ------------------ | Branch (43:7): [True: 116, False: 2.64k] | Branch (43:54): [True: 116, False: 0] ------------------ 44| 116| m_data->extensions().add(new Certificate_Status_Request); 45| 116| } 46| | 47| 2.76k| if(!next_protocol.empty() && client_hello.supports_alpn()) { ------------------ | Branch (47:7): [True: 21, False: 2.74k] | Branch (47:33): [True: 21, False: 0] ------------------ 48| 21| m_data->extensions().add(new Application_Layer_Protocol_Notification(next_protocol)); 49| 21| } 50| | 51| 2.76k| const auto c = Ciphersuite::by_id(m_data->ciphersuite()); 52| | 53| 2.76k| if(c && c->cbc_ciphersuite() && client_hello.supports_encrypt_then_mac() && policy.negotiate_encrypt_then_mac()) { ------------------ | Branch (53:7): [True: 2.76k, False: 0] | Branch (53:12): [True: 1.61k, False: 1.15k] | Branch (53:36): [True: 76, False: 1.53k] | Branch (53:80): [True: 76, False: 0] ------------------ 54| 76| m_data->extensions().add(new Encrypt_then_MAC); 55| 76| } 56| | 57| 2.76k| if(c && c->ecc_ciphersuite() && client_hello.extension_types().contains(Extension_Code::EcPointFormats)) { ------------------ | Branch (57:7): [True: 2.76k, False: 0] | Branch (57:7): [True: 78, False: 2.68k] | Branch (57:12): [True: 2.64k, False: 116] | Branch (57:36): [True: 78, False: 2.57k] ------------------ 58| 78| m_data->extensions().add(new Supported_Point_Formats(policy.use_ecc_point_compression())); 59| 78| } 60| | 61| 2.76k| if(client_hello.secure_renegotiation()) { ------------------ | Branch (61:7): [True: 153, False: 2.61k] ------------------ 62| 153| m_data->extensions().add(new Renegotiation_Extension(std::move(reneg_info))); 63| 153| } 64| | 65| 2.76k| if(client_hello.supports_session_ticket() && server_settings.offer_session_ticket()) { ------------------ | Branch (65:7): [True: 30, False: 2.73k] | Branch (65:49): [True: 0, False: 30] ------------------ 66| 0| m_data->extensions().add(new Session_Ticket_Extension()); 67| 0| } 68| | 69| 2.76k| if(m_data->legacy_version().is_datagram_protocol()) { ------------------ | Branch (69:7): [True: 0, False: 2.76k] ------------------ 70| 0| const std::vector server_srtp = policy.srtp_profiles(); 71| 0| const std::vector client_srtp = client_hello.srtp_profiles(); 72| | 73| 0| if(!server_srtp.empty() && !client_srtp.empty()) { ------------------ | Branch (73:10): [True: 0, False: 0] | Branch (73:34): [True: 0, False: 0] ------------------ 74| 0| uint16_t shared = 0; 75| | // always using server preferences for now 76| 0| for(auto s_srtp : server_srtp) { ------------------ | Branch (76:26): [True: 0, False: 0] ------------------ 77| 0| for(auto c_srtp : client_srtp) { ------------------ | Branch (77:29): [True: 0, False: 0] ------------------ 78| 0| if(shared == 0 && s_srtp == c_srtp) { ------------------ | Branch (78:19): [True: 0, False: 0] | Branch (78:34): [True: 0, False: 0] ------------------ 79| 0| shared = s_srtp; 80| 0| } 81| 0| } 82| 0| } 83| | 84| 0| if(shared != 0) { ------------------ | Branch (84:13): [True: 0, False: 0] ------------------ 85| 0| m_data->extensions().add(new SRTP_Protection_Profiles(shared)); 86| 0| } 87| 0| } 88| 0| } 89| | // NOLINTEND(*-owning-memory) 90| | 91| 2.76k| cb.tls_modify_extensions(m_data->extensions(), Connection_Side::Server, type()); 92| | 93| 2.76k| hash.update(io.send(*this)); 94| 2.76k|} _ZN5Botan3TLS15Server_Hello_12C2ENSt3__110unique_ptrINS0_21Server_Hello_InternalENS2_14default_deleteIS4_EEEE: 151| 2.76k|Server_Hello_12::Server_Hello_12(std::unique_ptr data) : Server_Hello_12_Shim(std::move(data)) {} _ZNK5Botan3TLS15Server_Hello_1220secure_renegotiationEv: 153| 2.86k|bool Server_Hello_12::secure_renegotiation() const { 154| 2.86k| return m_data->extensions().has(); 155| 2.86k|} _ZNK5Botan3TLS15Server_Hello_1218renegotiation_infoEv: 157| 153|std::vector Server_Hello_12::renegotiation_info() const { 158| 153| if(const Renegotiation_Extension* reneg = m_data->extensions().get()) { ------------------ | Branch (158:38): [True: 153, False: 0] ------------------ 159| 153| return reneg->renegotiation_info(); 160| 153| } 161| 0| return std::vector(); 162| 153|} _ZNK5Botan3TLS15Server_Hello_1231supports_extended_master_secretEv: 164| 1.59k|bool Server_Hello_12::supports_extended_master_secret() const { 165| 1.59k| return m_data->extensions().has(); 166| 1.59k|} _ZNK5Botan3TLS15Server_Hello_1225supports_encrypt_then_macEv: 168| 577|bool Server_Hello_12::supports_encrypt_then_mac() const { 169| 577| return m_data->extensions().has(); 170| 577|} _ZNK5Botan3TLS15Server_Hello_1223supports_session_ticketEv: 176| 288|bool Server_Hello_12::supports_session_ticket() const { 177| 288| return m_data->extensions().has(); 178| 288|} _ZNK5Botan3TLS15Server_Hello_1212srtp_profileEv: 180| 96|uint16_t Server_Hello_12::srtp_profile() const { 181| 96| if(auto* srtp = m_data->extensions().get()) { ------------------ | Branch (181:13): [True: 0, False: 96] ------------------ 182| 0| auto prof = srtp->profiles(); 183| 0| if(prof.size() != 1 || prof[0] == 0) { ------------------ | Branch (183:10): [True: 0, False: 0] | Branch (183:30): [True: 0, False: 0] ------------------ 184| 0| throw Decoding_Error("Server sent malformed DTLS-SRTP extension"); 185| 0| } 186| 0| return prof[0]; 187| 0| } 188| | 189| 96| return 0; 190| 96|} _ZN5Botan3TLS17Server_Hello_DoneC2ERNS0_12Handshake_IOERNS0_14Handshake_HashE: 209| 2.75k|Server_Hello_Done::Server_Hello_Done(Handshake_IO& io, Handshake_Hash& hash) { 210| 2.75k| hash.update(io.send(*this)); 211| 2.75k|} _ZNK5Botan3TLS17Server_Hello_Done9serializeEv: 225| 2.75k|std::vector Server_Hello_Done::serialize() const { 226| 2.75k| return std::vector(); 227| 2.75k|} _ZN5Botan3TLS19Server_Key_ExchangeD2Ev: 26| 2.75k|Server_Key_Exchange::~Server_Key_Exchange() = default; _ZN5Botan3TLS19Server_Key_ExchangeC2ERNS0_12Handshake_IOERNS0_15Handshake_StateERKNS0_6PolicyERNS_19Credentials_ManagerERNS_21RandomNumberGeneratorEPKNS_11Private_KeyE: 36| 2.75k| const Private_Key* signing_key) { 37| 2.75k| const std::string hostname = state.client_hello()->sni_hostname(); 38| 2.75k| const Kex_Algo kex_algo = state.ciphersuite().kex_method(); 39| | 40| 2.75k| if(kex_algo == Kex_Algo::PSK || kex_algo == Kex_Algo::ECDHE_PSK) { ------------------ | Branch (40:7): [True: 116, False: 2.64k] | Branch (40:36): [True: 2.64k, False: 0] ------------------ 41| 2.75k| const std::string identity_hint = creds.psk_identity_hint("tls-server", hostname); 42| | 43| 2.75k| append_tls_length_value(m_params, identity_hint, 2); 44| 2.75k| } 45| | 46| 2.75k| if(kex_algo == Kex_Algo::DH) { ------------------ | Branch (46:7): [True: 0, False: 2.75k] ------------------ 47| 0| const std::vector dh_groups = state.client_hello()->supported_dh_groups(); 48| | 49| 0| m_shared_group = Group_Params::NONE; 50| | 51| | /* 52| | RFC 7919 requires that if the client sends any groups in the FFDHE 53| | range, that we must select one of these. If this is not possible, 54| | then we are required to reject the connection. 55| | 56| | If the client did not send any DH groups, but did offer DH ciphersuites 57| | and we selected one, then consult the policy for which DH group to pick. 58| | */ 59| | 60| 0| if(dh_groups.empty()) { ------------------ | Branch (60:10): [True: 0, False: 0] ------------------ 61| 0| m_shared_group = policy.default_dh_group(); 62| 0| } else { 63| 0| m_shared_group = policy.choose_key_exchange_group(dh_groups, {}); 64| 0| } 65| | 66| 0| if(m_shared_group.value() == Group_Params::NONE) { ------------------ | Branch (66:10): [True: 0, False: 0] ------------------ 67| 0| throw TLS_Exception(Alert::HandshakeFailure, "Could not agree on a DH group with the client"); 68| 0| } 69| | 70| | // The policy had better return a group we know about: 71| 0| BOTAN_ASSERT(m_shared_group.value().is_dh_named_group(), "DH ciphersuite is using a known finite field group"); ------------------ | | 64| 0| do { \ | | 65| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 0| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 0| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 0] | | ------------------ ------------------ 72| | 73| | // Note: TLS 1.2 allows defining and using arbitrary DH groups (additional 74| | // to the named and standardized ones). This API doesn't allow the 75| | // server to make use of that at the moment. TLS 1.3 does not 76| | // provide this flexibility! 77| | // 78| | // A possible implementation strategy in case one would ever need that: 79| | // `Policy::default_dh_group()` could return a `std::variant`, allowing it to define arbitrary groups. 81| 0| m_kex_key = state.callbacks().tls_generate_ephemeral_key(m_shared_group.value(), rng); 82| 0| auto* dh = dynamic_cast(m_kex_key.get()); 83| 0| if(dh == nullptr) { ------------------ | Branch (83:10): [True: 0, False: 0] ------------------ 84| 0| throw TLS_Exception(Alert::InternalError, "Application did not provide a Diffie-Hellman key"); 85| 0| } 86| | 87| 0| append_tls_length_value(m_params, dh->get_int_field("p").serialize(), 2); 88| 0| append_tls_length_value(m_params, dh->get_int_field("g").serialize(), 2); 89| 0| append_tls_length_value(m_params, dh->public_value(), 2); 90| 2.75k| } else if(kex_algo == Kex_Algo::ECDH || kex_algo == Kex_Algo::ECDHE_PSK) { ------------------ | Branch (90:14): [True: 0, False: 2.75k] | Branch (90:44): [True: 2.64k, False: 116] ------------------ 91| 2.64k| const std::vector ec_groups = state.client_hello()->supported_ecc_curves(); 92| | 93| 2.64k| if(ec_groups.empty()) { ------------------ | Branch (93:10): [True: 0, False: 2.64k] ------------------ 94| 0| throw Internal_Error("Client sent no ECC extension but we negotiated ECDH"); 95| 0| } 96| | 97| 2.64k| m_shared_group = policy.choose_key_exchange_group(ec_groups, {}); 98| | 99| 2.64k| if(m_shared_group.value() == Group_Params::NONE) { ------------------ | Branch (99:10): [True: 0, False: 2.64k] ------------------ 100| 0| throw TLS_Exception(Alert::HandshakeFailure, "No shared ECC group with client"); 101| 0| } 102| | 103| 2.64k| m_kex_key = [&] { 104| 2.64k| if(m_shared_group->is_ecdh_named_curve()) { 105| 2.64k| const auto pubkey_point_format = state.client_hello()->prefers_compressed_ec_points() 106| 2.64k| ? EC_Point_Format::Compressed 107| 2.64k| : EC_Point_Format::Uncompressed; 108| 2.64k| return state.callbacks().tls12_generate_ephemeral_ecdh_key(*m_shared_group, rng, pubkey_point_format); 109| 2.64k| } else { 110| 2.64k| return state.callbacks().tls_generate_ephemeral_key(*m_shared_group, rng); 111| 2.64k| } 112| 2.64k| }(); 113| | 114| 2.64k| if(!m_kex_key) { ------------------ | Branch (114:10): [True: 0, False: 2.64k] ------------------ 115| 0| throw TLS_Exception(Alert::InternalError, "Application did not provide an EC key"); 116| 0| } 117| | 118| 2.64k| const uint16_t named_curve_id = m_shared_group.value().wire_code(); 119| 2.64k| m_params.push_back(3); // named curve 120| 2.64k| m_params.push_back(get_byte<0>(named_curve_id)); 121| 2.64k| m_params.push_back(get_byte<1>(named_curve_id)); 122| | 123| | // Note: In contrast to public_value(), raw_public_key_bits() takes the 124| | // point format (compressed vs. uncompressed) into account that was set 125| | // in its construction within tls_generate_ephemeral_key(). 126| 2.64k| append_tls_length_value(m_params, m_kex_key->raw_public_key_bits(), 1); 127| 2.64k| } else if(kex_algo != Kex_Algo::PSK) { ------------------ | Branch (127:14): [True: 0, False: 116] ------------------ 128| 0| throw Internal_Error("Server_Key_Exchange: Unknown kex type " + kex_method_to_string(kex_algo)); 129| 0| } 130| | 131| 2.75k| if(state.ciphersuite().signature_used()) { ------------------ | Branch (131:7): [True: 0, False: 2.75k] ------------------ 132| 0| BOTAN_ASSERT(signing_key, "Signing key was set"); ------------------ | | 64| 0| do { \ | | 65| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 0| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 0| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 0] | | ------------------ ------------------ 133| | 134| 0| const std::pair format = 135| 0| state.choose_sig_format(*signing_key, m_scheme, false, policy); 136| | 137| 0| std::vector buf = state.client_hello()->random(); 138| | 139| 0| buf += state.server_hello()->random(); 140| 0| buf += params(); 141| | 142| 0| m_signature = state.callbacks().tls_sign_message(*signing_key, rng, format.first, format.second, buf); 143| 0| } 144| | 145| 2.75k| state.hash().update(io.send(*this)); 146| 2.75k|} _ZNK5Botan3TLS19Server_Key_Exchange9serializeEv: 197| 2.75k|std::vector Server_Key_Exchange::serialize() const { 198| 2.75k| std::vector buf = params(); 199| | 200| 2.75k| if(!m_signature.empty()) { ------------------ | Branch (200:7): [True: 0, False: 2.75k] ------------------ 201| 0| if(m_scheme.is_set()) { ------------------ | Branch (201:10): [True: 0, False: 0] ------------------ 202| 0| buf.push_back(get_byte<0>(m_scheme.wire_code())); 203| 0| buf.push_back(get_byte<1>(m_scheme.wire_code())); 204| 0| } 205| | 206| 0| append_tls_length_value(buf, m_signature, 2); 207| 0| } 208| | 209| 2.75k| return buf; 210| 2.75k|} _ZNK5Botan3TLS19Server_Key_Exchange14server_kex_keyEv: 239| 2.10k|const PK_Key_Agreement_Key& Server_Key_Exchange::server_kex_key() const { 240| 2.10k| BOTAN_ASSERT_NONNULL(m_kex_key); ------------------ | | 116| 2.10k| do { \ | | 117| 2.10k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 2.10k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 2.10k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 2.10k] | | ------------------ ------------------ 241| 2.10k| return *m_kex_key; 242| 2.10k|} msg_server_kex.cpp:_ZZN5Botan3TLS19Server_Key_ExchangeC1ERNS0_12Handshake_IOERNS0_15Handshake_StateERKNS0_6PolicyERNS_19Credentials_ManagerERNS_21RandomNumberGeneratorEPKNS_11Private_KeyEENK3$_0clEv: 103| 2.64k| m_kex_key = [&] { 104| 2.64k| if(m_shared_group->is_ecdh_named_curve()) { ------------------ | Branch (104:13): [True: 2.61k, False: 26] ------------------ 105| 2.61k| const auto pubkey_point_format = state.client_hello()->prefers_compressed_ec_points() ------------------ | Branch (105:46): [True: 53, False: 2.56k] ------------------ 106| 2.61k| ? EC_Point_Format::Compressed 107| 2.61k| : EC_Point_Format::Uncompressed; 108| 2.61k| return state.callbacks().tls12_generate_ephemeral_ecdh_key(*m_shared_group, rng, pubkey_point_format); 109| 2.61k| } else { 110| 26| return state.callbacks().tls_generate_ephemeral_key(*m_shared_group, rng); 111| 26| } 112| 2.64k| }(); _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_ModeD2Ev: 26| 242|TLS_CBC_HMAC_AEAD_Mode::~TLS_CBC_HMAC_AEAD_Mode() = default; _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_ModeC2ENS_10Cipher_DirENSt3__110unique_ptrINS_11BlockCipherENS3_14default_deleteIS5_EEEENS4_INS_25MessageAuthenticationCodeENS6_IS9_EEEEmmRKNS0_16Protocol_VersionEb: 38| 242| m_mac(std::move(mac)), 39| 242| m_cipher_name(cipher->name()), 40| 242| m_mac_name(m_mac->name()), 41| 242| m_cipher_keylen(cipher_keylen), 42| 242| m_block_size(cipher->block_size()), 43| 242| m_iv_size(m_block_size), 44| 242| m_mac_keylen(mac_keylen), 45| 242| m_tag_size(m_mac->output_length()), 46| 242| m_use_encrypt_then_mac(use_encrypt_then_mac), 47| 242| m_is_datagram(version.is_datagram_protocol()) { 48| 242| BOTAN_ASSERT_NOMSG(m_mac->valid_keylength(m_mac_keylen)); ------------------ | | 77| 242| do { \ | | 78| 242| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 242| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 242] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 242| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 242] | | ------------------ ------------------ 49| 242| BOTAN_ASSERT_NOMSG(cipher->valid_keylength(m_cipher_keylen)); ------------------ | | 77| 242| do { \ | | 78| 242| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 242| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 242] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 242| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 242] | | ------------------ ------------------ 50| | 51| 242| auto null_padding = std::make_unique(); 52| 242| if(dir == Cipher_Dir::Encryption) { ------------------ | Branch (52:7): [True: 63, False: 179] ------------------ 53| 63| m_cbc = std::make_unique(std::move(cipher), std::move(null_padding)); 54| 179| } else { 55| 179| m_cbc = std::make_unique(std::move(cipher), std::move(null_padding)); 56| 179| } 57| 242|} _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode18valid_nonce_lengthEm: 83| 255|bool TLS_CBC_HMAC_AEAD_Mode::valid_nonce_length(size_t nl) const { 84| 255| if(m_cbc_state.empty()) { ------------------ | Branch (84:7): [True: 205, False: 50] ------------------ 85| 205| return nl == block_size(); 86| 205| } 87| 50| return nl == iv_size(); 88| 255|} _ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode8key_specEv: 90| 242|Key_Length_Specification TLS_CBC_HMAC_AEAD_Mode::key_spec() const { 91| 242| return Key_Length_Specification(m_cipher_keylen + m_mac_keylen); 92| 242|} _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 98| 242|void TLS_CBC_HMAC_AEAD_Mode::key_schedule(std::span key) { 99| | // Both keys are of fixed length specified by the ciphersuite 100| | 101| 242| if(key.size() != m_cipher_keylen + m_mac_keylen) { ------------------ | Branch (101:7): [True: 0, False: 242] ------------------ 102| 0| throw Invalid_Key_Length(name(), key.size()); 103| 0| } 104| | 105| 242| mac().set_key(key.first(m_mac_keylen)); 106| 242| cbc().set_key(key.subspan(m_mac_keylen, m_cipher_keylen)); 107| 242|} _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode9start_msgEPKhm: 109| 255|void TLS_CBC_HMAC_AEAD_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) { 110| 255| if(!valid_nonce_length(nonce_len)) { ------------------ | Branch (110:7): [True: 0, False: 255] ------------------ 111| 0| throw Invalid_IV_Length(name(), nonce_len); 112| 0| } 113| | 114| 255| m_msg.clear(); 115| | 116| 255| if(nonce_len > 0) { ------------------ | Branch (116:7): [True: 255, False: 0] ------------------ 117| 255| m_cbc_state.assign(nonce, nonce + nonce_len); 118| 255| } 119| 255|} _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode11process_msgEPhm: 121| 255|size_t TLS_CBC_HMAC_AEAD_Mode::process_msg(uint8_t buf[], size_t sz) { 122| 255| m_msg.insert(m_msg.end(), buf, buf + sz); 123| 255| return 0; 124| 255|} _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode19assoc_data_with_lenEt: 126| 131|std::vector TLS_CBC_HMAC_AEAD_Mode::assoc_data_with_len(uint16_t len) { 127| 131| std::vector ad = m_ad; 128| 131| BOTAN_ASSERT(ad.size() == 13, "Expected AAD size"); ------------------ | | 64| 131| do { \ | | 65| 131| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 131| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 131] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 131| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 131] | | ------------------ ------------------ 129| 131| ad[11] = get_byte<0>(len); 130| 131| ad[12] = get_byte<1>(len); 131| 131| return ad; 132| 131|} _ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE: 134| 255|void TLS_CBC_HMAC_AEAD_Mode::set_associated_data_n(size_t idx, std::span ad) { 135| 255| BOTAN_ARG_CHECK(idx == 0, "TLS 1.2 CBC/HMAC: cannot handle non-zero index in set_associated_data_n"); ------------------ | | 35| 255| do { \ | | 36| 255| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 255| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 255] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 255| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 255] | | ------------------ ------------------ 136| 255| if(ad.size() != 13) { ------------------ | Branch (136:7): [True: 0, False: 255] ------------------ 137| 0| throw Invalid_Argument("Invalid TLS AEAD associated data length"); 138| 0| } 139| 255| m_ad.assign(ad.begin(), ad.end()); 140| 255|} _ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS2_14default_deleteIS4_EEEENS3_INS_25MessageAuthenticationCodeENS5_IS8_EEEEmmRKNS0_16Protocol_VersionEb: 148| 63| TLS_CBC_HMAC_AEAD_Mode(Cipher_Dir::Encryption, 149| 63| std::move(cipher), 150| 63| std::move(mac), 151| 63| cipher_keylen, 152| 63| mac_keylen, 153| 63| version, 154| 63| use_encrypt_then_mac) {} _ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Encryption21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE: 156| 113|void TLS_CBC_HMAC_AEAD_Encryption::set_associated_data_n(size_t idx, std::span ad) { 157| 113| TLS_CBC_HMAC_AEAD_Mode::set_associated_data_n(idx, ad); 158| | 159| 113| if(use_encrypt_then_mac()) { ------------------ | Branch (159:7): [True: 11, False: 102] ------------------ 160| | // AAD hack for EtM 161| | // EtM uses ciphertext size instead of plaintext size for AEAD input 162| 11| const uint16_t pt_size = make_uint16(assoc_data()[11], assoc_data()[12]); 163| 11| const uint16_t enc_size = static_cast(round_up(iv_size() + pt_size + 1, block_size())); 164| 11| assoc_data()[11] = get_byte<0, uint16_t>(enc_size); 165| 11| assoc_data()[12] = get_byte<1, uint16_t>(enc_size); 166| 11| } 167| 113|} _ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Encryption18cbc_encrypt_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEEmm: 171| 113| size_t padding_length) { 172| | // We always do short padding: 173| 113| BOTAN_ASSERT_NOMSG(padding_length <= 16); ------------------ | | 77| 113| do { \ | | 78| 113| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 113| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 113] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 113| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 113] | | ------------------ ------------------ 174| | 175| 113| const size_t buf_with_padding = add_or_throw(buffer.size(), padding_length, "TLS CBC input too large"); 176| 113| buffer.resize(buf_with_padding); 177| | 178| 113| const uint8_t padding_val = static_cast(padding_length - 1); 179| | 180| 113| CT::poison(&padding_val, 1); 181| 113| CT::poison(&padding_length, 1); 182| 113| CT::poison(buffer.data(), buffer.size()); 183| | 184| 113| const size_t last_block_starts = buffer.size() - block_size(); 185| 113| const size_t padding_starts = buffer.size() - padding_length; 186| 1.52k| for(size_t i = last_block_starts; i != buffer.size(); ++i) { ------------------ | Branch (186:38): [True: 1.41k, False: 113] ------------------ 187| 1.41k| auto add_padding = CT::Mask(CT::Mask::is_gte(i, padding_starts)); 188| 1.41k| buffer[i] = add_padding.select(padding_val, buffer[i]); 189| 1.41k| } 190| | 191| 113| CT::unpoison(padding_val); 192| 113| CT::unpoison(padding_length); 193| 113| CT::unpoison(buffer.data(), buffer.size()); 194| | 195| 113| cbc().start(cbc_state()); 196| 113| cbc().process(&buffer[offset], buffer.size() - offset); 197| | 198| 113| cbc_state().assign(buffer.data() + (buffer.size() - block_size()), buffer.data() + buffer.size()); 199| 113|} _ZNK5Botan3TLS28TLS_CBC_HMAC_AEAD_Encryption13output_lengthEm: 201| 113|size_t TLS_CBC_HMAC_AEAD_Encryption::output_length(size_t input_length) const { 202| 113| const size_t mac_in_plaintext = use_encrypt_then_mac() ? 0 : tag_size(); ------------------ | Branch (202:36): [True: 11, False: 102] ------------------ 203| 113| const size_t mac_appended = use_encrypt_then_mac() ? tag_size() : 0; ------------------ | Branch (203:32): [True: 11, False: 102] ------------------ 204| | 205| | // round_up() checks its own addition for overflow, but the addition feeding 206| | // it and the trailing MAC must be checked separately. mac_in_plaintext + 1 207| | // cannot overflow as the MAC length is small. 208| 113| const size_t input_size = add_or_throw(input_length, mac_in_plaintext + 1, "TLS CBC input too large"); 209| 113| return add_or_throw(round_up(input_size, block_size()), mac_appended, "TLS CBC input too large"); 210| 113|} _ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 212| 113|void TLS_CBC_HMAC_AEAD_Encryption::finish_msg(secure_vector& buffer, size_t offset) { 213| 113| update(buffer, offset); 214| | 215| 113| const size_t msg_size = msg().size(); 216| | 217| 113| const size_t input_size = 218| 113| add_or_throw(msg_size, (use_encrypt_then_mac() ? 0 : tag_size()) + 1, "TLS CBC input too large"); ------------------ | Branch (218:31): [True: 11, False: 102] ------------------ 219| 113| const size_t enc_size = round_up(input_size, block_size()); 220| 113| BOTAN_DEBUG_ASSERT(enc_size % block_size() == 0); ------------------ | | 130| 113| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 113| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 113] | | ------------------ ------------------ 221| | 222| 113| const uint8_t padding_val = static_cast(enc_size - input_size); 223| 113| const size_t padding_length = static_cast(padding_val) + 1; 224| | 225| 113| const size_t output_size = add_or_throw(offset, msg_size, "TLS CBC input too large"); 226| 113| buffer.reserve(add_or_throw(output_size, padding_length + tag_size(), "TLS CBC input too large")); 227| 113| buffer.resize(output_size); 228| 113| if(msg_size > 0) { ------------------ | Branch (228:7): [True: 113, False: 0] ------------------ 229| 113| copy_mem(&buffer[offset], msg().data(), msg_size); 230| 113| } 231| | 232| 113| mac().update(assoc_data()); 233| | 234| 113| if(use_encrypt_then_mac()) { ------------------ | Branch (234:7): [True: 11, False: 102] ------------------ 235| 11| if(iv_size() > 0) { ------------------ | Branch (235:10): [True: 11, False: 0] ------------------ 236| 11| mac().update(cbc_state()); 237| 11| } 238| | 239| 11| cbc_encrypt_record(buffer, offset, padding_length); 240| 11| mac().update(&buffer[offset], enc_size); 241| 11| buffer.resize(add_or_throw(buffer.size(), tag_size(), "TLS CBC input too large")); 242| 11| mac().final(&buffer[buffer.size() - tag_size()]); 243| 102| } else { 244| 102| if(msg_size > 0) { ------------------ | Branch (244:10): [True: 102, False: 0] ------------------ 245| 102| mac().update(&buffer[offset], msg_size); 246| 102| } 247| 102| buffer.resize(add_or_throw(buffer.size(), tag_size(), "TLS CBC input too large")); 248| 102| mac().final(&buffer[buffer.size() - tag_size()]); 249| 102| cbc_encrypt_record(buffer, offset, padding_length); 250| 102| } 251| 113|} _ZN5Botan3TLS21check_tls_cbc_paddingEPKhm: 264| 127|uint16_t check_tls_cbc_padding(const uint8_t record[], size_t record_len) { 265| 127| if(record_len == 0 || record_len > 0xFFFF) { ------------------ | Branch (265:7): [True: 0, False: 127] | Branch (265:26): [True: 0, False: 127] ------------------ 266| 0| return 0; 267| 0| } 268| | 269| 127| const uint16_t rec16 = static_cast(record_len); 270| | 271| | /* 272| | * TLS v1.0 and up require all the padding bytes be the same value 273| | * and allows up to 255 bytes. 274| | */ 275| | 276| 127| const uint16_t to_check = std::min(256, static_cast(record_len)); 277| 127| const uint8_t pad_byte = record[record_len - 1]; 278| 127| const uint16_t pad_bytes = 1 + pad_byte; 279| | 280| 127| auto pad_invalid = CT::Mask::is_lt(rec16, pad_bytes); 281| | 282| 28.8k| for(uint16_t i = rec16 - to_check; i != rec16; ++i) { ------------------ | Branch (282:39): [True: 28.7k, False: 127] ------------------ 283| 28.7k| const uint16_t offset = rec16 - i; 284| 28.7k| const auto in_pad_range = CT::Mask::is_lte(offset, pad_bytes); 285| 28.7k| const auto pad_correct = CT::Mask::is_equal(record[i], pad_byte); 286| 28.7k| pad_invalid |= in_pad_range & ~pad_correct; 287| 28.7k| } 288| | 289| 127| return pad_invalid.if_not_set_return(pad_bytes); 290| 127|} _ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS2_14default_deleteIS4_EEEENS3_INS_25MessageAuthenticationCodeENS5_IS8_EEEEmmRKNS0_16Protocol_VersionEb: 298| 179| TLS_CBC_HMAC_AEAD_Mode(Cipher_Dir::Decryption, 299| 179| std::move(cipher), 300| 179| std::move(mac), 301| 179| cipher_keylen, 302| 179| mac_keylen, 303| 179| version, 304| 179| use_encrypt_then_mac) {} _ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption18cbc_decrypt_recordEPhm: 306| 127|void TLS_CBC_HMAC_AEAD_Decryption::cbc_decrypt_record(uint8_t record_contents[], size_t record_len) { 307| 127| if(record_len == 0 || record_len % block_size() != 0) { ------------------ | Branch (307:7): [True: 0, False: 127] | Branch (307:26): [True: 0, False: 127] ------------------ 308| 0| throw Decoding_Error("Received TLS CBC ciphertext with invalid length"); 309| 0| } 310| | 311| 127| cbc().start(cbc_state()); 312| 127| cbc_state().assign(record_contents + record_len - block_size(), record_contents + record_len); 313| | 314| 127| cbc().process(record_contents, record_len); 315| 127|} _ZNK5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption13output_lengthEm: 317| 142|size_t TLS_CBC_HMAC_AEAD_Decryption::output_length(size_t /*input_length*/) const { 318| | /* 319| | * We don't know this because the padding is arbitrary 320| | */ 321| 142| return 0; 322| 142|} _ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption31perform_additional_compressionsEmm: 366| 127|void TLS_CBC_HMAC_AEAD_Decryption::perform_additional_compressions(size_t plen, size_t padlen) { 367| 127| const bool is_sha384 = mac().name() == "HMAC(SHA-384)"; 368| 127| const uint16_t block_size = is_sha384 ? 128 : 64; ------------------ | Branch (368:32): [True: 34, False: 93] ------------------ 369| 127| const uint16_t max_bytes_in_first_block = is_sha384 ? 111 : 55; ------------------ | Branch (369:46): [True: 34, False: 93] ------------------ 370| | 371| | // number of maximum MACed bytes 372| 127| const uint16_t L1 = static_cast(13 + plen - tag_size()); 373| | // number of current MACed bytes (L1 - padlen) 374| | // Here the Lucky 13 paper is different because the padlen length in the paper 375| | // does not count the last message byte. 376| 127| const uint16_t L2 = static_cast(13 + plen - padlen - tag_size()); 377| | // From the paper, for SHA-256/SHA-1 compute: ceil((L1-55)/64) and ceil((L2-55)/64) 378| | // ceil((L1-55)/64) = floor((L1+64-1-55)/64) 379| | // Here we compute number of compressions for SHA-* in general 380| 127| const uint16_t max_compresssions = ((L1 + block_size - 1 - max_bytes_in_first_block) / block_size); 381| 127| const uint16_t current_compressions = ((L2 + block_size - 1 - max_bytes_in_first_block) / block_size); 382| | // number of additional compressions we have to perform 383| 127| const uint16_t add_compressions = max_compresssions - current_compressions; 384| 127| const uint16_t equal = CT::Mask::is_equal(max_compresssions, current_compressions).if_set_return(1); 385| | // We compute the data length we need to achieve the number of compressions. 386| | // If there are no compressions, we just add 55/111 dummy bytes so that no 387| | // compression is performed. 388| 127| const uint16_t data_len = block_size * add_compressions + equal * max_bytes_in_first_block; 389| 127| std::vector data(data_len); 390| 127| mac().update(data); 391| | // we do not need to clear the MAC since the connection is broken anyway 392| 127|} _ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 394| 142|void TLS_CBC_HMAC_AEAD_Decryption::finish_msg(secure_vector& buffer, size_t offset) { 395| 142| update(buffer, offset); 396| 142| buffer.resize(offset); 397| | 398| 142| const size_t record_len = msg().size(); 399| 142| uint8_t* record_contents = msg().data(); 400| | 401| | // This early exit does not leak info because all the values compared are public 402| 142| if(record_len < tag_size() || (record_len - (use_encrypt_then_mac() ? tag_size() : 0)) % block_size() != 0) { ------------------ | Branch (402:7): [True: 0, False: 142] | Branch (402:34): [True: 11, False: 131] | Branch (402:49): [True: 4, False: 138] ------------------ 403| 11| throw TLS_Exception(Alert::BadRecordMac, "Message authentication failure"); 404| 11| } 405| | 406| 131| if(use_encrypt_then_mac()) { ------------------ | Branch (406:7): [True: 4, False: 127] ------------------ 407| 4| const size_t enc_size = record_len - tag_size(); 408| 4| const size_t enc_iv_size = enc_size + iv_size(); 409| | 410| 4| BOTAN_ASSERT_NOMSG(enc_iv_size <= 0xFFFF); ------------------ | | 77| 4| do { \ | | 78| 4| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 4| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 4] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 4| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 4] | | ------------------ ------------------ 411| | 412| 4| mac().update(assoc_data_with_len(static_cast(enc_iv_size))); 413| 4| if(iv_size() > 0) { ------------------ | Branch (413:10): [True: 4, False: 0] ------------------ 414| 4| mac().update(cbc_state()); 415| 4| } 416| 4| mac().update(record_contents, enc_size); 417| | 418| 4| std::vector mac_buf(tag_size()); 419| 4| mac().final(mac_buf.data()); 420| | 421| 4| const size_t mac_offset = enc_size; 422| | 423| 4| const auto mac_ok = CT::is_equal(&record_contents[mac_offset], mac_buf.data(), tag_size()); 424| | 425| 4| if(!mac_ok.as_bool()) { ------------------ | Branch (425:10): [True: 4, False: 0] ------------------ 426| 4| throw TLS_Exception(Alert::BadRecordMac, "Message authentication failure"); 427| 4| } 428| | 429| 0| cbc_decrypt_record(record_contents, enc_size); 430| | 431| | // 0 if padding was invalid, otherwise 1 + padding_bytes 432| 0| const uint16_t pad_size = check_tls_cbc_padding(record_contents, enc_size); 433| | 434| | // No oracle here, whoever sent us this had the key since MAC check passed 435| 0| if(pad_size == 0) { ------------------ | Branch (435:10): [True: 0, False: 0] ------------------ 436| 0| throw TLS_Exception(Alert::BadRecordMac, "Message authentication failure"); 437| 0| } 438| | 439| 0| const uint8_t* plaintext_block = &record_contents[0]; 440| 0| const size_t plaintext_length = enc_size - pad_size; 441| | 442| 0| buffer.insert(buffer.end(), plaintext_block, plaintext_block + plaintext_length); 443| 127| } else { 444| 127| cbc_decrypt_record(record_contents, record_len); 445| | 446| 127| CT::poison(record_contents, record_len); 447| | 448| | // 0 if padding was invalid, otherwise 1 + padding_bytes 449| 127| uint16_t pad_size = check_tls_cbc_padding(record_contents, record_len); 450| | 451| | /* 452| | This mask is zero if there is not enough room in the packet to get a valid MAC. 453| | 454| | We have to accept empty packets, since otherwise we are not compatible 455| | with how OpenSSL's countermeasure for fixing BEAST in TLS 1.0 CBC works 456| | (sending empty records, instead of 1/(n-1) splitting) 457| | */ 458| | 459| | // We know the cast cannot overflow as pad_size <= 256 && tag_size <= 32 460| 127| const auto size_ok_mask = 461| 127| CT::Mask::is_lte(static_cast(tag_size() + pad_size), static_cast(record_len)); 462| | 463| 127| pad_size = size_ok_mask.if_set_return(pad_size); 464| | 465| 127| CT::unpoison(record_contents, record_len); 466| | 467| | /* 468| | This is unpoisoned sooner than it should. The pad_size leaks to plaintext_length and 469| | then to the timing channel in the MAC computation described in the Lucky 13 paper. 470| | */ 471| 127| CT::unpoison(pad_size); 472| | 473| 127| const uint8_t* plaintext_block = &record_contents[0]; 474| 127| const uint16_t plaintext_length = static_cast(record_len - tag_size() - pad_size); 475| | 476| 127| mac().update(assoc_data_with_len(plaintext_length)); 477| 127| mac().update(plaintext_block, plaintext_length); 478| | 479| 127| std::vector mac_buf(tag_size()); 480| 127| mac().final(mac_buf.data()); 481| | 482| 127| const size_t mac_offset = record_len - (tag_size() + pad_size); 483| | 484| 127| const auto mac_ok = CT::is_equal(&record_contents[mac_offset], mac_buf.data(), tag_size()); 485| | 486| 127| const auto ok_mask = size_ok_mask & CT::Mask::expand(mac_ok) & CT::Mask::expand(pad_size); 487| | 488| 127| CT::unpoison(ok_mask); 489| | 490| 127| if(ok_mask.as_bool()) { ------------------ | Branch (490:10): [True: 0, False: 127] ------------------ 491| 0| buffer.insert(buffer.end(), plaintext_block, plaintext_block + plaintext_length); 492| 127| } else { 493| 127| perform_additional_compressions(record_len, pad_size); 494| | 495| | /* 496| | * In DTLS case we have to finish computing the MAC since we require the 497| | * MAC state be reset for future packets. This extra timing channel may 498| | * be exploitable in a Lucky13 variant. 499| | */ 500| 127| if(is_datagram_protocol()) { ------------------ | Branch (500:13): [True: 0, False: 127] ------------------ 501| 0| mac().final(mac_buf); 502| 0| } 503| 127| throw TLS_Exception(Alert::BadRecordMac, "Message authentication failure"); 504| 127| } 505| 127| } 506| 131|} _ZN5Botan3TLS15Channel_Impl_12C2ERKNSt3__110shared_ptrINS0_9CallbacksEEERKNS3_INS0_15Session_ManagerEEERKNS3_INS_21RandomNumberGeneratorEEERKNS3_IKNS0_6PolicyEEEbbm: 97| 3.80k| m_is_server(is_server), 98| 3.80k| m_is_datagram(is_datagram), 99| 3.80k| m_callbacks(callbacks), 100| 3.80k| m_session_manager(session_manager), 101| 3.80k| m_policy(policy), 102| 3.80k| m_rng(rng), 103| 3.80k| m_has_been_closed(false) { 104| 3.80k| BOTAN_ASSERT_NONNULL(m_callbacks); ------------------ | | 116| 3.80k| do { \ | | 117| 3.80k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 3.80k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 3.80k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 3.80k] | | ------------------ ------------------ 105| 3.80k| BOTAN_ASSERT_NONNULL(m_session_manager); ------------------ | | 116| 3.80k| do { \ | | 117| 3.80k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 3.80k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 3.80k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 3.80k] | | ------------------ ------------------ 106| 3.80k| BOTAN_ASSERT_NONNULL(m_rng); ------------------ | | 116| 3.80k| do { \ | | 117| 3.80k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 3.80k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 3.80k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 3.80k] | | ------------------ ------------------ 107| 3.80k| BOTAN_ASSERT_NONNULL(m_policy); ------------------ | | 116| 3.80k| do { \ | | 117| 3.80k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 3.80k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 3.80k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 3.80k] | | ------------------ ------------------ 108| | 109| | /* epoch 0 is plaintext, thus null cipher state */ 110| 3.80k| m_write_cipher_states[0] = nullptr; 111| 3.80k| m_read_cipher_states[0] = {}; 112| | 113| 3.80k| m_writebuf.reserve(reserved_io_buffer_size); 114| 3.80k| m_readbuf.reserve(reserved_io_buffer_size); 115| 3.80k|} _ZN5Botan3TLS15Channel_Impl_1211reset_stateEv: 117| 2.25k|void Channel_Impl_12::reset_state() { 118| 2.25k| m_active_state.reset(); 119| 2.25k| m_pending_state.reset(); 120| 2.25k| m_epochs_before_latest_renegotiation.reset(); 121| 2.25k| m_resumption_handle.reset(); 122| 2.25k| m_readbuf.clear(); 123| 2.25k| m_write_cipher_states.clear(); 124| 2.25k| m_read_cipher_states.clear(); 125| 2.25k|} _ZN5Botan3TLS15Channel_Impl_1222note_resumption_handleENSt3__18optionalINS0_14Session_HandleEEE: 127| 96|void Channel_Impl_12::note_resumption_handle(std::optional handle) { 128| 96| m_resumption_handle = std::move(handle); 129| 96|} _ZN5Botan3TLS15Channel_Impl_1227take_sessions_to_invalidateEv: 131| 2.25k|std::vector Channel_Impl_12::take_sessions_to_invalidate() { 132| | // A ticket-backed session is not cached under the ServerHello session ID, so 133| | // both handles have to be collected. 134| 2.25k| std::vector handles; 135| | 136| 2.25k| if(m_resumption_handle.has_value()) { ------------------ | Branch (136:7): [True: 0, False: 2.25k] ------------------ 137| 0| handles.push_back(m_resumption_handle.value()); 138| 0| m_resumption_handle.reset(); 139| 0| } 140| | 141| 2.25k| if(m_active_state.has_value()) { ------------------ | Branch (141:7): [True: 78, False: 2.17k] ------------------ 142| 78| const auto& sid = m_active_state->session_id(); 143| 78| if(!sid.empty()) { ------------------ | Branch (143:10): [True: 78, False: 0] ------------------ 144| 78| handles.emplace_back(sid); 145| 78| } 146| 78| } 147| | 148| 2.25k| return handles; 149| 2.25k|} _ZN5Botan3TLS15Channel_Impl_1219invalidate_sessionsERKNSt3__16vectorINS0_14Session_HandleENS2_9allocatorIS4_EEEE: 151| 2.25k|void Channel_Impl_12::invalidate_sessions(const std::vector& handles) { 152| | // RFC 5246 7.2.2: "Servers and clients MUST forget any session-identifiers, 153| | // keys, and secrets associated with a failed connection. Thus, any 154| | // connection terminated with a fatal alert MUST NOT be resumed." 155| | // 156| | // Best effort, and deliberately last: remove() reaches application-supplied 157| | // storage and can throw, and by then the keys are already gone. Letting a 158| | // failed cache eviction abort the teardown would leave the channel usable 159| | // after a security-fatal event, which is the worse of the two outcomes. A 160| | // stateless ticket issuer has nothing to remove and cannot revoke what it 161| | // already handed out. 162| 2.25k| for(const auto& handle : handles) { ------------------ | Branch (162:27): [True: 78, False: 2.25k] ------------------ 163| 78| try { 164| 78| session_manager().remove(handle); 165| 78| } catch(...) {} 166| 78| } 167| 2.25k|} _ZN5Botan3TLS15Channel_Impl_12D2Ev: 184| 3.80k|Channel_Impl_12::~Channel_Impl_12() = default; _ZNK5Botan3TLS15Channel_Impl_1216sequence_numbersEv: 186| 30.2k|Connection_Sequence_Numbers& Channel_Impl_12::sequence_numbers() const { 187| 30.2k| BOTAN_ASSERT(m_sequence_numbers, "Have a sequence numbers object"); ------------------ | | 64| 30.2k| do { \ | | 65| 30.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 30.2k| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 30.2k] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 30.2k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 30.2k] | | ------------------ ------------------ 188| 30.2k| return *m_sequence_numbers; 189| 30.2k|} _ZNK5Botan3TLS15Channel_Impl_1223read_cipher_state_epochEt: 191| 347|std::shared_ptr Channel_Impl_12::read_cipher_state_epoch(uint16_t epoch) const { 192| 347| auto i = m_read_cipher_states.find(epoch); 193| 347| if(i == m_read_cipher_states.end()) { ------------------ | Branch (193:7): [True: 34, False: 313] ------------------ 194| 34| throw Internal_Error("TLS::Channel_Impl_12 No read cipherstate for epoch " + std::to_string(epoch)); 195| 34| } 196| | 197| | // RFC 6347 4.1: "In general, implementations SHOULD discard packets from 198| | // earlier epochs, but if packet loss causes noticeable problems they MAY 199| | // choose to retain keying material from previous epochs for up to the 200| | // default MSL specified for TCP [TCP] to allow for packet reordering." 201| | // read_dtls_record drops the record when this throws. 202| 313| if(const auto& retired_at = i->second.retired_at; retired_at.has_value()) { ------------------ | Branch (202:54): [True: 0, False: 313] ------------------ 203| 0| const auto now = callbacks().tls_current_monotonic_clock_ms(); 204| 0| const auto retired = retired_at.value(); 205| 0| BOTAN_ASSERT_NOMSG(now >= retired); ------------------ | | 77| 0| do { \ | | 78| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 0| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 0| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 0] | | ------------------ ------------------ 206| 0| if(now - retired > TCP_MSL_MS) { ------------------ | Branch (206:10): [True: 0, False: 0] ------------------ 207| 0| throw Invalid_State("TLS::Channel_Impl_12 Read cipherstate for epoch " + std::to_string(epoch) + 208| 0| " is past its retention window"); 209| 0| } 210| 0| } 211| | 212| 313| return i->second.state; 213| 313|} _ZNK5Botan3TLS15Channel_Impl_1224write_cipher_state_epochEt: 215| 10.6k|std::shared_ptr Channel_Impl_12::write_cipher_state_epoch(uint16_t epoch) const { 216| 10.6k| auto i = m_write_cipher_states.find(epoch); 217| 10.6k| if(i == m_write_cipher_states.end()) { ------------------ | Branch (217:7): [True: 0, False: 10.6k] ------------------ 218| 0| throw Internal_Error("TLS::Channel_Impl_12 No write cipherstate for epoch " + std::to_string(epoch)); 219| 0| } 220| 10.6k| return i->second; 221| 10.6k|} _ZN5Botan3TLS15Channel_Impl_1222create_handshake_stateENS0_16Protocol_VersionEb: 240| 3.65k|Handshake_State& Channel_Impl_12::create_handshake_state(Protocol_Version version, bool epoch0_restart) { 241| 3.65k| if(pending_state() != nullptr) { ------------------ | Branch (241:7): [True: 0, False: 3.65k] ------------------ 242| 0| throw Internal_Error("create_handshake_state called during handshake"); 243| 0| } 244| | 245| 3.65k| if(m_active_state.has_value()) { ------------------ | Branch (245:7): [True: 0, False: 3.65k] ------------------ 246| 0| const Protocol_Version active_version = m_active_state->version(); 247| | 248| 0| if(active_version.is_datagram_protocol() != version.is_datagram_protocol()) { ------------------ | Branch (248:10): [True: 0, False: 0] ------------------ 249| 0| throw TLS_Exception(Alert::ProtocolVersion, 250| 0| "Active state using version " + active_version.to_string() + " cannot change to " + 251| 0| version.to_string() + " in pending"); 252| 0| } 253| 0| } 254| | 255| 3.65k| if(!m_sequence_numbers) { ------------------ | Branch (255:7): [True: 3.65k, False: 0] ------------------ 256| 3.65k| if(version.is_datagram_protocol()) { ------------------ | Branch (256:10): [True: 522, False: 3.13k] ------------------ 257| 522| m_sequence_numbers = std::make_unique(); 258| 3.13k| } else { 259| 3.13k| m_sequence_numbers = std::make_unique(); 260| 3.13k| } 261| 3.65k| } 262| | 263| | // Read epochs at or below this one belong to the association already in place, 264| | // so application data under them stays deliverable while this handshake runs. 265| | // Anything above it is this handshake's own, unauthenticated until its 266| | // Finished. See the application-data gate in from_peer. 267| 3.65k| m_epochs_before_latest_renegotiation = Epochs_Before_Latest_Renegotiation{sequence_numbers().current_read_epoch(), 268| 3.65k| sequence_numbers().current_write_epoch()}; 269| | 270| | // Floor for the pending handshake's reassembly: a delayed record from the 271| | // handshake arrives under a lower epoch and must be rejected. It would 272| | // otherwise take the sequence slot the real message needs. 273| | // 274| | // Zero on an epoch-zero restart, because there the peer legitimately 275| | // begins again at epoch zero and the floor would reject it. This is keyed 276| | // on the restart actually occurring, not on the policy allowing it: an 277| | // ordinary renegotiation needs the floor either way. 278| 3.65k| const uint16_t initial_epoch = epoch0_restart ? 0 : m_epochs_before_latest_renegotiation->read_epoch; ------------------ | Branch (278:35): [True: 0, False: 3.65k] ------------------ 279| | 280| 3.65k| using namespace std::placeholders; 281| | 282| 3.65k| std::unique_ptr io; 283| 3.65k| if(version.is_datagram_protocol()) { ------------------ | Branch (283:7): [True: 522, False: 3.13k] ------------------ 284| 522| const uint16_t mtu = static_cast(policy().dtls_default_mtu()); 285| 522| const size_t initial_timeout_ms = policy().dtls_initial_timeout(); 286| 522| const size_t max_timeout_ms = policy().dtls_maximum_timeout(); 287| 522| const std::optional max_retransmissions = policy().dtls_maximum_retransmissions(); 288| | 289| 522| auto send_record_f = [this](uint16_t epoch, Record_Type record_type, const std::vector& record) { 290| 522| send_record_under_epoch(epoch, record_type, record); 291| 522| }; 292| 522| auto clock_f = [this]() { return callbacks().tls_current_monotonic_clock_ms(); }; 293| 522| io = std::make_unique(send_record_f, 294| 522| clock_f, 295| 522| sequence_numbers(), 296| 522| mtu, 297| 522| initial_timeout_ms, 298| 522| max_timeout_ms, 299| 522| max_retransmissions, 300| 522| policy().maximum_handshake_message_size(), 301| 522| initial_epoch); 302| 3.13k| } else { 303| 3.13k| auto send_record_f = [this](Record_Type rec_type, const std::vector& record) { 304| 3.13k| send_record(rec_type, record); 305| 3.13k| }; 306| 3.13k| io = std::make_unique(send_record_f); 307| 3.13k| } 308| | 309| 3.65k| m_pending_state = new_handshake_state(std::move(io)); 310| | 311| 3.65k| if(m_active_state.has_value()) { ------------------ | Branch (311:7): [True: 0, False: 3.65k] ------------------ 312| 0| m_pending_state->set_version(m_active_state->version()); 313| 0| } 314| | 315| 3.65k| return *m_pending_state; 316| 3.65k|} _ZN5Botan3TLS15Channel_Impl_1229clear_pending_handshake_stateEv: 331| 96|void Channel_Impl_12::clear_pending_handshake_state() { 332| 96| m_pending_state.reset(); 333| 96| m_epochs_before_latest_renegotiation.reset(); 334| 96|} _ZN5Botan3TLS15Channel_Impl_1225change_cipher_spec_readerENS0_15Connection_SideE: 401| 385|void Channel_Impl_12::change_cipher_spec_reader(Connection_Side side) { 402| 385| const auto* pending = pending_state(); 403| | 404| 385| BOTAN_ASSERT(pending && pending->server_hello(), "Have received server hello"); ------------------ | | 64| 385| do { \ | | 65| 385| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 770| if(!(expr)) { \ | | ------------------ | | | Branch (66:12): [True: 385, False: 0] | | | Branch (66:12): [True: 385, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 385| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 385] | | ------------------ ------------------ 405| | 406| 385| if(pending->server_hello()->compression_method() != 0) { ------------------ | Branch (406:7): [True: 0, False: 385] ------------------ 407| 0| throw Internal_Error("Negotiated unknown compression algorithm"); 408| 0| } 409| | 410| 385| sequence_numbers().new_read_cipher_state(); 411| | 412| 385| const uint16_t epoch = sequence_numbers().current_read_epoch(); 413| | 414| 385| BOTAN_ASSERT(!m_read_cipher_states.contains(epoch), "No read cipher state currently set for next epoch"); ------------------ | | 64| 385| do { \ | | 65| 385| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 385| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 385] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 385| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 385] | | ------------------ ------------------ 415| | 416| | // flip side as we are reading 417| 385| auto read_state = std::make_shared( 418| 385| pending->version(), 419| 385| (side == Connection_Side::Client) ? Connection_Side::Server : Connection_Side::Client, ------------------ | Branch (419:7): [True: 0, False: 385] ------------------ 420| 385| false, 421| 385| pending->ciphersuite(), 422| 385| pending->session_keys(), 423| 385| pending->server_hello()->supports_encrypt_then_mac()); 424| | 425| | // The epoch we just left is retained only to absorb reordering, so start its 426| | // clock now (see read_cipher_state_epoch). Epoch 0 is the plaintext 427| | // placeholder and holds no keys, so the window does not apply to it. 428| 385| if(m_is_datagram && epoch > 1) { ------------------ | Branch (428:7): [True: 0, False: 385] | Branch (428:24): [True: 0, False: 0] ------------------ 429| 0| if(auto prev = m_read_cipher_states.find(static_cast(epoch - 1)); prev != m_read_cipher_states.end()) { ------------------ | Branch (429:83): [True: 0, False: 0] ------------------ 430| 0| prev->second.retired_at = callbacks().tls_current_monotonic_clock_ms(); 431| 0| } 432| 0| } 433| | 434| 385| m_read_cipher_states[epoch] = Retained_Read_Cipher_State{.state = read_state, .retired_at = std::nullopt}; 435| 385| prune_old_cipher_states(m_read_cipher_states); 436| 385|} _ZN5Botan3TLS15Channel_Impl_1225change_cipher_spec_writerENS0_15Connection_SideE: 438| 96|void Channel_Impl_12::change_cipher_spec_writer(Connection_Side side) { 439| 96| const auto* pending = pending_state(); 440| | 441| 96| BOTAN_ASSERT(pending && pending->server_hello(), "Have received server hello"); ------------------ | | 64| 96| do { \ | | 65| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 192| if(!(expr)) { \ | | ------------------ | | | Branch (66:12): [True: 96, False: 0] | | | Branch (66:12): [True: 96, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 96| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 96] | | ------------------ ------------------ 442| | 443| 96| if(pending->server_hello()->compression_method() != 0) { ------------------ | Branch (443:7): [True: 0, False: 96] ------------------ 444| 0| throw Internal_Error("Negotiated unknown compression algorithm"); 445| 0| } 446| | 447| 96| sequence_numbers().new_write_cipher_state(); 448| | 449| 96| const uint16_t epoch = sequence_numbers().current_write_epoch(); 450| | 451| 96| BOTAN_ASSERT(!m_write_cipher_states.contains(epoch), "No write cipher state currently set for next epoch"); ------------------ | | 64| 96| do { \ | | 65| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 96| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 96] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 96| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 96] | | ------------------ ------------------ 452| | 453| 96| auto write_state = std::make_shared(pending->version(), 454| 96| side, 455| 96| true, 456| 96| pending->ciphersuite(), 457| 96| pending->session_keys(), 458| 96| pending->server_hello()->supports_encrypt_then_mac()); 459| | 460| 96| m_write_cipher_states[epoch] = write_state; 461| 96| prune_old_cipher_states(m_write_cipher_states); 462| 96|} _ZNK5Botan3TLS15Channel_Impl_129is_closedEv: 480| 2.44k|bool Channel_Impl_12::is_closed() const { 481| 2.44k| return m_has_been_closed; 482| 2.44k|} _ZN5Botan3TLS15Channel_Impl_1216activate_sessionEv: 484| 96|void Channel_Impl_12::activate_session() { 485| 96| BOTAN_ASSERT_NONNULL(m_pending_state); ------------------ | | 116| 96| do { \ | | 117| 96| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 96] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 96| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 96] | | ------------------ ------------------ 486| | 487| 96| const auto& state = *m_pending_state; 488| | 489| 96| if(!state.version().is_datagram_protocol()) { ------------------ | Branch (489:7): [True: 96, False: 0] ------------------ 490| | // TLS is easy just remove all but the current state 491| 96| const uint16_t current_epoch = sequence_numbers().current_write_epoch(); 492| | 493| 96| const auto not_current_epoch = [current_epoch](uint16_t epoch) { return (epoch != current_epoch); }; 494| | 495| 96| map_remove_if(not_current_epoch, m_write_cipher_states); 496| 96| map_remove_if(not_current_epoch, m_read_cipher_states); 497| 96| } 498| | 499| | // RFC 6347 4.2.4: "the node that transmits the last flight (the server in an 500| | // ordinary handshake or the client in a resumed handshake) MUST respond to a 501| | // retransmit of the peer's last flight with a retransmit of the last 502| | // flight." Both endpoints retain handshake sequence state, but only that 503| | // node replays its outgoing flight. 504| 96| const bool sent_terminal_dtls_flight = m_is_datagram && (m_is_server == (state.server_hello_done() != nullptr)); ------------------ | Branch (504:43): [True: 0, False: 96] | Branch (504:60): [True: 0, False: 0] ------------------ 505| | 506| 96| if(m_is_datagram) { ------------------ | Branch (506:7): [True: 0, False: 96] ------------------ 507| 0| m_active_state = Active_Connection_State_12(state, application_protocol(), m_pending_state->take_handshake_io()); 508| 0| if(auto* dtls_io = m_active_state->dtls_handshake_io()) { ------------------ | Branch (508:16): [True: 0, False: 0] ------------------ 509| | // Retain receive sequence state on both endpoints to distinguish a 510| | // retransmission from an unexpected new handshake message. Only the 511| | // terminal-flight sender responds by replaying its final flight. 512| 0| dtls_io->finalize_handshake(sent_terminal_dtls_flight); 513| 0| } 514| 96| } else { 515| 96| m_active_state = Active_Connection_State_12(state, application_protocol()); 516| 96| } 517| | 518| 96| clear_pending_handshake_state(); 519| | 520| 96| callbacks().tls_session_activated(); 521| 96|} _ZN5Botan3TLS15Channel_Impl_129from_peerENSt3__14spanIKhLm18446744073709551615EEE: 523| 3.80k|size_t Channel_Impl_12::from_peer(std::span data) { 524| 3.80k| const bool allow_epoch0_restart = m_is_datagram && m_is_server && policy().allow_dtls_epoch0_restart(); ------------------ | Branch (524:38): [True: 672, False: 3.13k] | Branch (524:55): [True: 672, False: 0] | Branch (524:70): [True: 0, False: 672] ------------------ 525| | 526| 3.80k| const auto* input = data.data(); 527| 3.80k| auto input_size = data.size(); 528| | 529| 3.80k| try { 530| 11.9k| while(input_size > 0) { ------------------ | Branch (530:13): [True: 8.73k, False: 3.25k] ------------------ 531| | // A fatal alert destroys the cipher states, so nothing further can even 532| | // be decrypted. Closure by close_notify is different: the responding 533| | // close_notify still has to be read, so those records keep flowing 534| | // through the loop and are filtered per record type below. 535| 8.73k| if(m_had_fatal_alert) { ------------------ | Branch (535:13): [True: 1, False: 8.72k] ------------------ 536| 1| return 0; 537| 1| } 538| | 539| 8.72k| size_t consumed = 0; 540| | 541| 8.72k| auto get_epoch = [this](uint16_t epoch) { return read_cipher_state_epoch(epoch); }; 542| | 543| 8.72k| const Record_Header record = read_record(m_is_datagram, 544| 8.72k| m_readbuf, 545| 8.72k| input, 546| 8.72k| input_size, 547| 8.72k| consumed, 548| 8.72k| m_record_buf, 549| 8.72k| m_sequence_numbers.get(), 550| 8.72k| get_epoch, 551| 8.72k| allow_epoch0_restart); 552| | 553| 8.72k| const size_t needed = record.needed(); 554| | 555| 8.72k| BOTAN_ASSERT(consumed > 0, "Got to eat something"); ------------------ | | 64| 8.72k| do { \ | | 65| 8.72k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 8.72k| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 8.72k] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 8.72k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 8.72k] | | ------------------ ------------------ 556| | 557| 8.72k| BOTAN_ASSERT(consumed <= input_size, "Record reader consumed sane amount"); ------------------ | | 64| 8.72k| do { \ | | 65| 8.72k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 8.72k| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 8.72k] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 8.72k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 8.72k] | | ------------------ ------------------ 558| | 559| 8.72k| input += consumed; 560| 8.72k| input_size -= consumed; 561| | 562| 8.72k| BOTAN_ASSERT(input_size == 0 || needed == 0, "Got a full record or consumed all input"); ------------------ | | 64| 8.72k| do { \ | | 65| 8.72k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 14.2k| if(!(expr)) { \ | | ------------------ | | | Branch (66:12): [True: 3.25k, False: 5.47k] | | | Branch (66:12): [True: 5.47k, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 8.72k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 8.72k] | | ------------------ ------------------ 563| | 564| 8.72k| if(input_size == 0 && needed != 0) { ------------------ | Branch (564:13): [True: 2.76k, False: 5.96k] | Branch (564:32): [True: 286, False: 2.47k] ------------------ 565| 286| return needed; // need more data to complete record 566| 286| } 567| | 568| | // Ignore invalid records in DTLS 569| 8.44k| if(m_is_datagram && record.type() == Record_Type::Invalid) { ------------------ | Branch (569:13): [True: 1.69k, False: 6.74k] | Branch (569:30): [True: 164, False: 1.53k] ------------------ 570| 164| return 0; 571| 164| } 572| | 573| 8.27k| const bool old_unprotected_record = m_is_datagram && record.epoch() == 0 && m_active_state.has_value() && ------------------ | Branch (573:46): [True: 1.53k, False: 6.74k] | Branch (573:63): [True: 1.53k, False: 0] | Branch (573:86): [True: 0, False: 1.53k] ------------------ 574| 0| sequence_numbers().current_read_epoch() > 0; ------------------ | Branch (574:46): [True: 0, False: 0] ------------------ 575| | 576| | // Once encrypted traffic is expected, epoch-zero records are 577| | // unauthenticated. Only handshake records can be useful as part of a 578| | // retransmitted flight or an explicitly allowed association restart. 579| 8.27k| if(old_unprotected_record && record.type() != Record_Type::Handshake && ------------------ | Branch (579:13): [True: 0, False: 8.27k] | Branch (579:39): [True: 0, False: 0] ------------------ 580| 0| record.type() != Record_Type::ChangeCipherSpec) { ------------------ | Branch (580:13): [True: 0, False: 0] ------------------ 581| 0| continue; 582| 0| } 583| | 584| 8.27k| if(m_record_buf.size() > MAX_PLAINTEXT_SIZE) { ------------------ | Branch (584:13): [True: 0, False: 8.27k] ------------------ 585| 0| if(old_unprotected_record) { ------------------ | Branch (585:16): [True: 0, False: 0] ------------------ 586| 0| continue; 587| 0| } 588| | 589| 0| throw TLS_Exception(Alert::RecordOverflow, "TLS plaintext record is larger than allowed maximum"); 590| 0| } 591| | 592| 8.27k| const bool epoch0_restart = allow_epoch0_restart && record.epoch() == 0 && m_active_state.has_value(); ------------------ | Branch (592:38): [True: 0, False: 8.27k] | Branch (592:62): [True: 0, False: 0] | Branch (592:85): [True: 0, False: 0] ------------------ 593| 8.27k| BOTAN_ASSERT_IMPLICATION(epoch0_restart, allow_epoch0_restart, "Allowed state"); ------------------ | | 103| 8.27k| do { \ | | 104| 8.27k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 105| 8.27k| if((expr1) && !(expr2)) { \ | | ------------------ | | | Branch (105:10): [True: 0, False: 8.27k] | | | Branch (105:21): [True: 0, False: 0] | | ------------------ | | 106| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 107| 0| Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \ | | 108| 0| } \ | | 109| 8.27k| } while(0) | | ------------------ | | | Branch (109:12): [Folded, False: 8.27k] | | ------------------ ------------------ 594| | 595| 8.27k| const bool initial_record = epoch0_restart || (pending_state() == nullptr && !m_active_state.has_value()); ------------------ | Branch (595:38): [True: 490, False: 7.78k] | Branch (595:57): [True: 4.22k, False: 3.56k] | Branch (595:87): [True: 4.22k, False: 0] ------------------ 596| 8.27k| bool initial_handshake_message = false; 597| 8.27k| if(record.type() == Record_Type::Handshake && !m_record_buf.empty()) { ------------------ | Branch (597:13): [True: 6.97k, False: 1.30k] | Branch (597:56): [True: 6.54k, False: 431] ------------------ 598| 6.54k| const Handshake_Type type = static_cast(m_record_buf[0]); 599| 6.54k| initial_handshake_message = (type == Handshake_Type::ClientHello); 600| 6.54k| } 601| | 602| 8.27k| if(record.type() != Record_Type::Alert && !old_unprotected_record) { ------------------ | Branch (602:13): [True: 7.23k, False: 1.04k] | Branch (602:52): [True: 7.23k, False: 0] ------------------ 603| 7.23k| if(initial_record) { ------------------ | Branch (603:16): [True: 3.70k, False: 3.53k] ------------------ 604| | // For initial records just check for basic sanity 605| 3.70k| if(record.version().major_version() != 3 && record.version().major_version() != 0xFE) { ------------------ | Branch (605:19): [True: 564, False: 3.13k] | Branch (605:19): [True: 13, False: 3.68k] | Branch (605:60): [True: 13, False: 551] ------------------ 606| 13| throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version in initial record"); 607| 13| } 608| 3.70k| } else if(const auto* pending = pending_state()) { ------------------ | Branch (608:35): [True: 3.53k, False: 0] ------------------ 609| 3.53k| if(pending->server_hello() != nullptr && !initial_handshake_message && ------------------ | Branch (609:19): [True: 2.81k, False: 722] | Branch (609:19): [True: 4, False: 3.52k] | Branch (609:57): [True: 2.66k, False: 142] ------------------ 610| 2.66k| record.version() != pending->version()) { ------------------ | Branch (610:19): [True: 4, False: 2.66k] ------------------ 611| 4| throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version"); 612| 4| } 613| 3.53k| } else if(m_active_state.has_value()) { ------------------ | Branch (613:23): [True: 0, False: 0] ------------------ 614| 0| if(record.version() != m_active_state->version() && !initial_handshake_message) { ------------------ | Branch (614:19): [True: 0, False: 0] | Branch (614:19): [True: 0, False: 0] | Branch (614:68): [True: 0, False: 0] ------------------ 615| 0| throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version"); 616| 0| } 617| 0| } 618| 7.23k| } 619| | 620| | // RFC 5246 7.2.1: "Any data received after a closure alert is ignored." 621| | // This is about a closure alert the peer sent us. A peer that keeps 622| | // talking after *our* close_notify is a different case, kept as an 623| | // error below; BoGo's Shutdown-Shim-ApplicationData requires it. 624| 8.26k| if(m_peer_closed_connection && record.type() != Record_Type::Alert) { ------------------ | Branch (624:13): [True: 214, False: 8.04k] | Branch (624:41): [True: 10, False: 204] ------------------ 625| 10| continue; 626| 10| } 627| | 628| 8.25k| if(record.type() == Record_Type::Handshake || record.type() == Record_Type::ChangeCipherSpec) { ------------------ | Branch (628:13): [True: 7.45k, False: 795] | Branch (628:56): [True: 151, False: 644] ------------------ 629| 7.11k| if(m_has_been_closed) { ------------------ | Branch (629:16): [True: 0, False: 7.11k] ------------------ 630| 0| throw TLS_Exception(Alert::UnexpectedMessage, "Received handshake data after connection closure"); 631| 0| } 632| 7.11k| process_handshake_ccs(m_record_buf, record.sequence(), record.type(), record.version(), epoch0_restart); 633| 7.11k| } else if(record.type() == Record_Type::ApplicationData) { ------------------ | Branch (633:20): [True: 48, False: 1.08k] ------------------ 634| 48| if(m_has_been_closed) { ------------------ | Branch (634:16): [True: 0, False: 48] ------------------ 635| 0| throw TLS_Exception(Alert::UnexpectedMessage, "Received application data after connection closure"); 636| 0| } 637| 48| if(pending_state() != nullptr) { ------------------ | Branch (637:16): [True: 45, False: 3] ------------------ 638| | /* 639| | What matters is which epoch the record belongs to, not which role we 640| | are playing. 641| | 642| | RFC 6347 4.2.4: "Implementations MUST either discard or buffer all 643| | application data packets for the new epoch until they have received 644| | the Finished message for that epoch." Data under the epoch this 645| | handshake installed is not authenticated until its Finished, so it 646| | must not reach the application; equally it is not an error, because 647| | ordinary reordering produces it whenever a peer writes immediately 648| | after activating. 649| | 650| | Data under an epoch the established association owns stays valid 651| | while a renegotiation is in flight, per 4.1. 652| | 653| | Epoch zero is neither: application data there is plaintext, so it is 654| | never legitimate and no association is at stake. 655| | */ 656| 45| if(m_is_datagram && record.epoch() > 0) { ------------------ | Branch (656:19): [True: 44, False: 1] | Branch (656:36): [True: 0, False: 44] ------------------ 657| 0| const uint16_t active_epoch = 658| 0| m_epochs_before_latest_renegotiation ? m_epochs_before_latest_renegotiation->read_epoch : 0; ------------------ | Branch (658:22): [True: 0, False: 0] ------------------ 659| | 660| 0| if(!m_active_state.has_value() || record.epoch() > active_epoch) { ------------------ | Branch (660:22): [True: 0, False: 0] | Branch (660:53): [True: 0, False: 0] ------------------ 661| 0| continue; // this handshake's epoch, still unauthenticated 662| 0| } 663| 45| } else { 664| 45| throw TLS_Exception(Alert::UnexpectedMessage, "Can't interleave application and handshake data"); 665| 45| } 666| 45| } 667| 3| process_application_data(record.sequence(), m_record_buf); 668| 1.08k| } else if(record.type() == Record_Type::Alert) { ------------------ | Branch (668:20): [True: 556, False: 530] ------------------ 669| 556| process_alert(m_record_buf); 670| 556| } else if(record.type() != Record_Type::Invalid) { ------------------ | Branch (670:20): [True: 40, False: 490] ------------------ 671| 40| throw Unexpected_Message("Unexpected record type " + std::to_string(static_cast(record.type())) + 672| 40| " from counterparty"); 673| 40| } 674| 8.25k| } 675| | 676| 3.25k| return 0; // on a record boundary 677| 3.80k| } catch(TLS_Exception& e) { 678| 1.62k| send_fatal_alert(e.type()); 679| 1.62k| throw; 680| 1.62k| } catch(Invalid_Authentication_Tag&) { 681| 164| send_fatal_alert(Alert::BadRecordMac); 682| 164| throw; 683| 420| } catch(Decoding_Error&) { 684| 420| send_fatal_alert(Alert::DecodeError); 685| 420| throw; 686| 420| } catch(...) { 687| 32| send_fatal_alert(Alert::InternalError); 688| 32| throw; 689| 32| } 690| 3.80k|} _ZN5Botan3TLS15Channel_Impl_1221process_handshake_ccsERKNSt3__16vectorIhNS_16secure_allocatorIhEEEEmNS0_11Record_TypeENS0_16Protocol_VersionEb: 696| 7.11k| bool epoch0_restart) { 697| 7.11k| const auto process_retransmitted_record = [&] { 698| 7.11k| BOTAN_ASSERT(m_active_state.has_value(), "Have active DTLS association for retransmission"); 699| 7.11k| BOTAN_ASSERT_NONNULL(m_active_state->dtls_handshake_io()); 700| | // Epoch-zero records are unauthenticated and may be spoofed, so a 701| | // malformed one must not tear down an established association. 702| 7.11k| const bool unauthenticated = (record_sequence >> 48) == 0; 703| | 704| 7.11k| absorb_malformed_input_errors(unauthenticated, [&] { 705| 7.11k| m_active_state->dtls_handshake_io()->add_retransmitted_record( 706| 7.11k| record.data(), record.size(), record_type, record_sequence); 707| 7.11k| }); 708| 7.11k| }; 709| | 710| 7.11k| if(!m_pending_state) { ------------------ | Branch (710:7): [True: 3.65k, False: 3.45k] ------------------ 711| | // With no pending handshake this is either a new handshake attempt or a 712| | // DTLS retransmission from the previous handshake. The latter must not 713| | // create fresh pending state; it only asks us to replay our last flight. 714| 3.65k| if(epoch0_restart && m_sequence_numbers && m_active_state.has_value()) { ------------------ | Branch (714:10): [True: 0, False: 3.65k] | Branch (714:28): [True: 0, False: 0] | Branch (714:50): [True: 0, False: 0] ------------------ 715| 0| const bool starts_new_handshake = is_new_dtls_association_client_hello(record, record_type); 716| | 717| 0| if(!starts_new_handshake) { ------------------ | Branch (717:13): [True: 0, False: 0] ------------------ 718| 0| process_retransmitted_record(); 719| 0| return; 720| 0| } 721| 0| } 722| | 723| 3.65k| if(m_is_datagram && !epoch0_restart) { ------------------ | Branch (723:10): [True: 522, False: 3.13k] | Branch (723:27): [True: 522, False: 0] ------------------ 724| 522| if(m_sequence_numbers) { ------------------ | Branch (724:13): [True: 0, False: 522] ------------------ 725| 0| const uint16_t epoch = record_sequence >> 48; 726| 0| const uint16_t current_epoch = sequence_numbers().current_read_epoch(); 727| 0| if(epoch == current_epoch) { ------------------ | Branch (727:16): [True: 0, False: 0] ------------------ 728| | // Either endpoint can initiate renegotiation from FINISHED: 729| | // clients send ClientHello, servers send HelloRequest. 730| 0| const bool starts_new_handshake = 731| 0| (record_type == Record_Type::Handshake && !record.empty() && ------------------ | Branch (731:20): [True: 0, False: 0] | Branch (731:61): [True: 0, False: 0] ------------------ 732| 0| (static_cast(record[0]) == Handshake_Type::ClientHello || ------------------ | Branch (732:21): [True: 0, False: 0] ------------------ 733| 0| static_cast(record[0]) == Handshake_Type::HelloRequest)); ------------------ | Branch (733:21): [True: 0, False: 0] ------------------ 734| | 735| 0| if(m_active_state.has_value() && !starts_new_handshake) { ------------------ | Branch (735:19): [True: 0, False: 0] | Branch (735:49): [True: 0, False: 0] ------------------ 736| 0| process_retransmitted_record(); 737| 0| } else { 738| 0| create_handshake_state(record_version, epoch0_restart); 739| 0| } 740| 0| } else if(current_epoch > 0 && epoch == current_epoch - 1) { ------------------ | Branch (740:23): [True: 0, False: 0] | Branch (740:44): [True: 0, False: 0] ------------------ 741| 0| process_retransmitted_record(); 742| 0| } 743| 522| } else { 744| 522| create_handshake_state(record_version, epoch0_restart); 745| 522| } 746| 3.13k| } else { 747| 3.13k| create_handshake_state(record_version, epoch0_restart); 748| 3.13k| } 749| 3.65k| } 750| | 751| | // May have been created in above conditional 752| 7.11k| if(m_pending_state) { ------------------ | Branch (752:7): [True: 7.11k, False: 0] ------------------ 753| | // An epoch-zero record is unauthenticated. Once an association is 754| | // established, one arriving during a pending renegotiation must not be 755| | // able to destroy it, exactly as for the no-pending-handshake path above. 756| | // Without this a single forged CCS or handshake fragment tore down the 757| | // active association and the renegotiation along with it. 758| | // 759| | // Delivery is inside the guard as well as reassembly. A bare 12-byte 760| | // header declaring a zero-length message reassembles cleanly and only 761| | // fails when the message itself is parsed or dispatched, which reaches 762| | // the same teardown by a later route. 763| 7.11k| const bool unauthenticated_against_active_association = 764| 7.11k| m_is_datagram && (record_sequence >> 48) == 0 && m_active_state.has_value(); ------------------ | Branch (764:10): [True: 1.17k, False: 5.94k] | Branch (764:27): [True: 1.17k, False: 0] | Branch (764:59): [True: 0, False: 1.17k] ------------------ 765| | 766| 7.11k| absorb_malformed_input_errors(unauthenticated_against_active_association, [&] { 767| 7.11k| m_pending_state->handshake_io().add_record(record.data(), record.size(), record_type, record_sequence); 768| | 769| 7.11k| while(auto* pending = m_pending_state.get()) { 770| 7.11k| auto msg = pending->get_next_handshake_msg(policy().maximum_handshake_message_size()); 771| | 772| 7.11k| if(msg.first == Handshake_Type::None) { // no full handshake yet 773| 7.11k| break; 774| 7.11k| } 775| | 776| 7.11k| process_handshake_msg(*pending, msg.first, msg.second, epoch0_restart); 777| | 778| 7.11k| if(!m_pending_state) { 779| 7.11k| break; 780| 7.11k| } 781| 7.11k| } 782| 7.11k| }); 783| 7.11k| } 784| 7.11k|} _ZN5Botan3TLS15Channel_Impl_1224process_application_dataEmRKNSt3__16vectorIhNS_16secure_allocatorIhEEEE: 786| 3|void Channel_Impl_12::process_application_data(uint64_t seq_no, const secure_vector& record) { 787| 3| if(!m_active_state.has_value()) { ------------------ | Branch (787:7): [True: 3, False: 0] ------------------ 788| 3| throw Unexpected_Message("Application data before handshake done"); 789| 3| } 790| | 791| | // ApplicationData must arrive under a non-zero read epoch 792| 0| const uint16_t read_epoch = 793| 0| m_is_datagram ? static_cast(seq_no >> 48) : sequence_numbers().current_read_epoch(); ------------------ | Branch (793:7): [True: 0, False: 0] ------------------ 794| 0| if(read_epoch == 0) { ------------------ | Branch (794:7): [True: 0, False: 0] ------------------ 795| 0| throw Unexpected_Message("Application data received in unexpected read epoch"); 796| 0| } 797| | 798| 0| callbacks().tls_record_received(seq_no, record); 799| 0|} _ZN5Botan3TLS15Channel_Impl_1213process_alertERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE: 801| 556|void Channel_Impl_12::process_alert(const secure_vector& record) { 802| 556| const Alert alert_msg(record); 803| | 804| | // RFC 5246 7.2.2: 805| | // no_renegotiation 806| | // Sent by the client in response to a hello request or by the 807| | // server in response to a client hello after initial handshaking. 808| | // 809| | // Both of those precede any ChangeCipherSpec from the refusing side, so a 810| | // refusal arriving after one means the peer both refused the handshake and 811| | // proceeded with it. Discarding the pending state is what implements the 812| | // refusal, but past a CCS that state is the only thing keeping application 813| | // data under the new, un-Finished keys from being delivered, and there is no 814| | // rollback that would leave keys, identity and exporter describing the same 815| | // handshake. End the association rather than open that gate. 816| 556| if(alert_msg.type() == Alert::NoRenegotiation && m_active_state.has_value()) { ------------------ | Branch (816:7): [True: 15, False: 541] | Branch (816:53): [True: 0, False: 15] ------------------ 817| 0| if(!pending_handshake_epochs_unmoved()) { ------------------ | Branch (817:10): [True: 0, False: 0] ------------------ 818| 0| throw TLS_Exception(Alert::UnexpectedMessage, "Received no_renegotiation after ChangeCipherSpec"); 819| 0| } 820| | 821| 0| clear_pending_handshake_state(); 822| 0| } 823| | 824| 556| if(alert_msg.is_fatal()) { ------------------ | Branch (824:7): [True: 9, False: 547] ------------------ 825| | // RFC 5246 7.2.2: "Upon transmission or receipt of a fatal alert message, 826| | // both parties immediately close the connection." 827| | // 828| | // The teardown completes before the application hears about the alert, so 829| | // the callback cannot reach the connection or its secrets. Same order as 830| | // the TLS 1.3 channel. 831| 9| m_has_been_closed = true; 832| 9| m_had_fatal_alert = true; 833| 9| const auto invalidated = take_sessions_to_invalidate(); 834| 9| reset_state(); 835| 9| invalidate_sessions(invalidated); 836| 9| } 837| | 838| 556| callbacks().tls_alert(alert_msg); 839| | 840| 556| if(alert_msg.type() == Alert::CloseNotify) { ------------------ | Branch (840:7): [True: 208, False: 348] ------------------ 841| 208| m_peer_closed_connection = true; 842| | 843| | // TLS 1.2 requires us to immediately react with our "close_notify", 844| | // the return value of the application's callback has no effect on that. 845| 208| callbacks().tls_peer_closed_connection(); 846| 208| send_warning_alert(Alert::CloseNotify); // reply in kind 847| 208| } 848| | 849| 556| if(alert_msg.type() == Alert::CloseNotify || alert_msg.is_fatal()) { ------------------ | Branch (849:7): [True: 225, False: 331] | Branch (849:49): [True: 8, False: 323] ------------------ 850| 216| m_has_been_closed = true; 851| 216| } 852| 556|} _ZN5Botan3TLS15Channel_Impl_1212write_recordEPNS0_23Connection_Cipher_StateEtNS0_11Record_TypeEPKhm: 858| 10.6k| size_t length) { 859| 10.6k| BOTAN_ASSERT(m_pending_state || m_active_state.has_value(), "Some connection state exists"); ------------------ | | 64| 10.6k| do { \ | | 65| 10.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 10.7k| if(!(expr)) { \ | | ------------------ | | | Branch (66:12): [True: 10.5k, False: 78] | | | Branch (66:12): [True: 78, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 10.6k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 10.6k] | | ------------------ ------------------ 860| | 861| 10.6k| const Protocol_Version record_version = (m_pending_state) ? (m_pending_state->version()) : m_active_state->version(); ------------------ | Branch (861:44): [True: 10.5k, False: 78] ------------------ 862| | 863| 10.6k| const uint64_t next_seq = sequence_numbers().next_write_sequence(epoch); 864| | 865| 10.6k| if(cipher_state == nullptr) { ------------------ | Branch (865:7): [True: 10.5k, False: 174] ------------------ 866| 10.5k| TLS::write_unencrypted_record(m_writebuf, record_type, record_version, next_seq, input, length); 867| 10.5k| } else { 868| 174| TLS::write_record(m_writebuf, record_type, record_version, next_seq, input, length, *cipher_state, rng()); 869| 174| } 870| | 871| 10.6k| callbacks().tls_emit_data(m_writebuf); 872| 10.6k|} _ZN5Botan3TLS15Channel_Impl_1217send_record_arrayEtNS0_11Record_TypeEPKhm: 874| 10.6k|void Channel_Impl_12::send_record_array(uint16_t epoch, Record_Type type, const uint8_t input[], size_t length) { 875| 10.6k| if(length == 0) { ------------------ | Branch (875:7): [True: 0, False: 10.6k] ------------------ 876| 0| return; 877| 0| } 878| | 879| 10.6k| auto cipher_state = write_cipher_state_epoch(epoch); 880| | 881| 21.3k| while(length > 0) { ------------------ | Branch (881:10): [True: 10.6k, False: 10.6k] ------------------ 882| 10.6k| const size_t sending = std::min(length, MAX_PLAINTEXT_SIZE); 883| 10.6k| write_record(cipher_state.get(), epoch, type, input, sending); 884| | 885| 10.6k| input += sending; 886| 10.6k| length -= sending; 887| 10.6k| } 888| 10.6k|} _ZN5Botan3TLS15Channel_Impl_1211send_recordENS0_11Record_TypeERKNSt3__16vectorIhNS3_9allocatorIhEEEE: 890| 10.6k|void Channel_Impl_12::send_record(Record_Type record_type, const std::vector& record) { 891| 10.6k| send_record_array(sequence_numbers().current_write_epoch(), record_type, record.data(), record.size()); 892| 10.6k|} _ZN5Botan3TLS15Channel_Impl_1210send_alertERKNS0_5AlertE: 908| 2.44k|void Channel_Impl_12::send_alert(const Alert& alert) { 909| 2.44k| const bool ready_to_send_anything = !is_closed() && m_sequence_numbers; ------------------ | Branch (909:40): [True: 2.24k, False: 202] | Branch (909:56): [True: 2.19k, False: 51] ------------------ 910| 2.44k| if(alert.is_valid() && ready_to_send_anything) { ------------------ | Branch (910:7): [True: 2.44k, False: 0] | Branch (910:27): [True: 2.19k, False: 253] ------------------ 911| 2.19k| try { 912| 2.19k| send_record(Record_Type::Alert, alert.serialize()); 913| 2.19k| } catch(...) { /* swallow it */ 914| 0| } 915| 2.19k| } 916| | 917| | // RFC 5246 7.2.2: 918| | // no_renegotiation 919| | // Sent by the client in response to a hello request or by the 920| | // server in response to a client hello after initial handshaking. 921| | // 922| | // In this case we are the peer sending the refusal, so there is no reason 923| | // for our epochs to have moved. If they somehow did, clear the pending 924| | // state. A strictly better approach here would be to simply throw 925| | // Internal_Error, but send_alert is called from within catch handlers 926| | // so this is not currently viable. 927| 2.44k| if(alert.type() == Alert::NoRenegotiation && m_active_state.has_value()) { ------------------ | Branch (927:7): [True: 0, False: 2.44k] | Branch (927:49): [True: 0, False: 0] ------------------ 928| 0| if(pending_handshake_epochs_unmoved()) { ------------------ | Branch (928:10): [True: 0, False: 0] ------------------ 929| 0| clear_pending_handshake_state(); 930| 0| } 931| 0| } 932| | 933| 2.44k| if(alert.is_fatal()) { ------------------ | Branch (933:7): [True: 2.24k, False: 208] ------------------ 934| | // Order matters: the channel is made unusable and its secrets destroyed 935| | // before any application-supplied storage is touched, so a throwing 936| | // session manager cannot leave is_active() true with live keys. 937| 2.24k| m_had_fatal_alert = true; 938| 2.24k| m_has_been_closed = true; 939| | 940| | // Alert::None is the local teardown that is never sent to the peer, used 941| | // where the trigger was unauthenticated input or a local timeout. Evicting 942| | // the resumption state on that basis would hand anyone able to reach the 943| | // address the ability to destroy it, which is what keeping the teardown 944| | // local exists to prevent. 945| 2.24k| const auto invalidated = 946| 2.24k| (alert.type() == Alert::None) ? std::vector() : take_sessions_to_invalidate(); ------------------ | Branch (946:10): [True: 0, False: 2.24k] ------------------ 947| | 948| 2.24k| reset_state(); 949| 2.24k| invalidate_sessions(invalidated); 950| 2.24k| } 951| | 952| 2.44k| if(alert.type() == Alert::CloseNotify || alert.is_fatal()) { ------------------ | Branch (952:7): [True: 208, False: 2.24k] | Branch (952:45): [True: 2.24k, False: 0] ------------------ 953| 2.44k| m_has_been_closed = true; 954| 2.44k| } 955| 2.44k|} _ZN5Botan3TLS15Channel_Impl_1226secure_renegotiation_checkEPKNS0_15Client_Hello_12E: 957| 3.04k|void Channel_Impl_12::secure_renegotiation_check(const Client_Hello_12* client_hello) { 958| 3.04k| BOTAN_ASSERT_NONNULL(client_hello); ------------------ | | 116| 3.04k| do { \ | | 117| 3.04k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 3.04k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 3.04k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 3.04k] | | ------------------ ------------------ 959| 3.04k| const bool secure_renegotiation = client_hello->secure_renegotiation(); 960| | 961| 3.04k| if(m_active_state && m_active_state->client_supports_secure_renegotiation() != secure_renegotiation) { ------------------ | Branch (961:7): [True: 0, False: 3.04k] | Branch (961:25): [True: 0, False: 0] ------------------ 962| 0| throw TLS_Exception(Alert::HandshakeFailure, "Client changed its mind about secure renegotiation"); 963| 0| } 964| | 965| 3.04k| if(secure_renegotiation) { ------------------ | Branch (965:7): [True: 213, False: 2.83k] ------------------ 966| 213| const std::vector& data = client_hello->renegotiation_info(); 967| | 968| 213| const auto expected = secure_renegotiation_data_for_client_hello(); 969| 213| if(!CT::is_equal(data, expected).as_bool()) { ------------------ | Branch (969:10): [True: 1, False: 212] ------------------ 970| 1| throw TLS_Exception(Alert::HandshakeFailure, "Client sent bad values for secure renegotiation"); 971| 1| } 972| 213| } 973| 3.04k|} _ZN5Botan3TLS15Channel_Impl_1226secure_renegotiation_checkEPKNS0_15Server_Hello_12E: 975| 2.76k|void Channel_Impl_12::secure_renegotiation_check(const Server_Hello_12* server_hello) { 976| 2.76k| BOTAN_ASSERT_NONNULL(server_hello); ------------------ | | 116| 2.76k| do { \ | | 117| 2.76k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 2.76k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 2.76k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 2.76k] | | ------------------ ------------------ 977| 2.76k| const bool secure_renegotiation = server_hello->secure_renegotiation(); 978| | 979| 2.76k| if(m_active_state && m_active_state->server_supports_secure_renegotiation() != secure_renegotiation) { ------------------ | Branch (979:7): [True: 0, False: 2.76k] | Branch (979:25): [True: 0, False: 0] ------------------ 980| 0| throw TLS_Exception(Alert::HandshakeFailure, "Server changed its mind about secure renegotiation"); 981| 0| } 982| | 983| 2.76k| if(secure_renegotiation) { ------------------ | Branch (983:7): [True: 153, False: 2.61k] ------------------ 984| 153| const std::vector& data = server_hello->renegotiation_info(); 985| | 986| 153| const auto expected = secure_renegotiation_data_for_server_hello(); 987| 153| if(!CT::is_equal(data, expected).as_bool()) { ------------------ | Branch (987:10): [True: 0, False: 153] ------------------ 988| 0| throw TLS_Exception(Alert::HandshakeFailure, "Server sent bad values for secure renegotiation"); 989| 0| } 990| 153| } 991| 2.76k|} _ZNK5Botan3TLS15Channel_Impl_1242secure_renegotiation_data_for_client_helloEv: 993| 213|std::vector Channel_Impl_12::secure_renegotiation_data_for_client_hello() const { 994| 213| if(m_active_state.has_value()) { ------------------ | Branch (994:7): [True: 0, False: 213] ------------------ 995| 0| return m_active_state->client_finished_verify_data(); 996| 0| } 997| 213| return std::vector(); 998| 213|} _ZNK5Botan3TLS15Channel_Impl_1242secure_renegotiation_data_for_server_helloEv: 1000| 2.91k|std::vector Channel_Impl_12::secure_renegotiation_data_for_server_hello() const { 1001| 2.91k| if(m_active_state.has_value()) { ------------------ | Branch (1001:7): [True: 0, False: 2.91k] ------------------ 1002| 0| return concat(m_active_state->client_finished_verify_data(), m_active_state->server_finished_verify_data()); 1003| 2.91k| } else { 1004| 2.91k| return {}; 1005| 2.91k| } 1006| 2.91k|} tls_channel_impl_12.cpp:_ZZN5Botan3TLS15Channel_Impl_1222create_handshake_stateENS0_16Protocol_VersionEbENK3$_2clENS0_11Record_TypeERKNSt3__16vectorIhNS5_9allocatorIhEEEE: 303| 8.47k| auto send_record_f = [this](Record_Type rec_type, const std::vector& record) { 304| 8.47k| send_record(rec_type, record); 305| 8.47k| }; tls_channel_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_123prune_old_cipher_statesINS0_15Channel_Impl_1226Retained_Read_Cipher_StateEEEvRNSt3__13mapItT_NS5_4lessItEENS5_9allocatorINS5_4pairIKtS7_EEEEEE: 55| 385|void prune_old_cipher_states(std::map& states) { 56| | // std::map iterates in ascending key order. Drop the lowest non-zero 57| | // entries until at most TLS_RETAINED_CIPHERSTATES remain. The newly 58| | // installed epoch is the highest key, so it is preserved. 59| 385| size_t non_zero = states.size() - states.count(0); 60| 385| auto it = states.lower_bound(1); 61| 385| while(non_zero > TLS_RETAINED_CIPHERSTATES) { ------------------ | Branch (61:10): [True: 0, False: 385] ------------------ 62| 0| it = states.erase(it); 63| 0| --non_zero; 64| 0| } 65| 385|} tls_channel_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_123prune_old_cipher_statesINSt3__110shared_ptrINS0_23Connection_Cipher_StateEEEEEvRNS3_3mapItT_NS3_4lessItEENS3_9allocatorINS3_4pairIKtS8_EEEEEE: 55| 96|void prune_old_cipher_states(std::map& states) { 56| | // std::map iterates in ascending key order. Drop the lowest non-zero 57| | // entries until at most TLS_RETAINED_CIPHERSTATES remain. The newly 58| | // installed epoch is the highest key, so it is preserved. 59| 96| size_t non_zero = states.size() - states.count(0); 60| 96| auto it = states.lower_bound(1); 61| 96| while(non_zero > TLS_RETAINED_CIPHERSTATES) { ------------------ | Branch (61:10): [True: 0, False: 96] ------------------ 62| 0| it = states.erase(it); 63| 0| --non_zero; 64| 0| } 65| 96|} tls_channel_impl_12.cpp:_ZZN5Botan3TLS15Channel_Impl_1216activate_sessionEvENK3$_0clEt: 493| 384| const auto not_current_epoch = [current_epoch](uint16_t epoch) { return (epoch != current_epoch); }; tls_channel_impl_12.cpp:_ZZN5Botan3TLS15Channel_Impl_129from_peerENSt3__14spanIKhLm18446744073709551615EEEENK3$_0clEt: 541| 347| auto get_epoch = [this](uint16_t epoch) { return read_cipher_state_epoch(epoch); }; tls_channel_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_129absorb_malformed_input_errorsIZNS0_15Channel_Impl_1221process_handshake_ccsERKNSt3__16vectorIhNS_16secure_allocatorIhEEEEmNS0_11Record_TypeENS0_16Protocol_VersionEbE3$_1EEvbT_: 74| 7.11k|void absorb_malformed_input_errors(bool absorb, F fn) { 75| 7.11k| try { 76| 7.11k| fn(); 77| 7.11k| } catch(const TLS_Exception&) { 78| 1.19k| if(!absorb) { ------------------ | Branch (78:10): [True: 1.19k, False: 0] ------------------ 79| 1.19k| throw; 80| 1.19k| } 81| 1.19k| } catch(const Decoding_Error&) { 82| 402| if(!absorb) { ------------------ | Branch (82:10): [True: 402, False: 0] ------------------ 83| 402| throw; 84| 402| } 85| 402| } 86| 7.11k|} tls_channel_impl_12.cpp:_ZZN5Botan3TLS15Channel_Impl_1221process_handshake_ccsERKNSt3__16vectorIhNS_16secure_allocatorIhEEEEmNS0_11Record_TypeENS0_16Protocol_VersionEbENK3$_1clEv: 766| 7.11k| absorb_malformed_input_errors(unauthenticated_against_active_association, [&] { 767| 7.11k| m_pending_state->handshake_io().add_record(record.data(), record.size(), record_type, record_sequence); 768| | 769| 13.1k| while(auto* pending = m_pending_state.get()) { ------------------ | Branch (769:22): [True: 11.5k, False: 1.62k] ------------------ 770| 11.5k| auto msg = pending->get_next_handshake_msg(policy().maximum_handshake_message_size()); 771| | 772| 11.5k| if(msg.first == Handshake_Type::None) { // no full handshake yet ------------------ | Branch (772:16): [True: 5.39k, False: 6.11k] ------------------ 773| 5.39k| break; 774| 5.39k| } 775| | 776| 6.11k| process_handshake_msg(*pending, msg.first, msg.second, epoch0_restart); 777| | 778| 6.11k| if(!m_pending_state) { ------------------ | Branch (778:16): [True: 96, False: 6.02k] ------------------ 779| 96| break; 780| 96| } 781| 6.11k| } 782| 7.11k| }); _ZN5Botan3TLS26Active_Connection_State_12D2Ev: 15| 192|Active_Connection_State_12::~Active_Connection_State_12() = default; _ZN5Botan3TLS26Active_Connection_State_12C2EOS1_: 16| 96|Active_Connection_State_12::Active_Connection_State_12(Active_Connection_State_12&&) noexcept = default; _ZN5Botan3TLS26Active_Connection_State_12C2ERKNS0_15Handshake_StateENSt3__112basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEE: 20| 96| m_version(state.version()), 21| 96| m_ciphersuite_code(state.server_hello()->ciphersuite()), 22| 96| m_application_protocol(std::move(application_protocol)), 23| 96| m_peer_certs(state.peer_cert_chain()), 24| 96| m_client_random(state.client_hello()->random()), 25| 96| m_psk_identity(state.psk_identity()), 26| 96| m_server_random(state.server_hello()->random()), 27| 96| m_session_id(state.server_hello()->session_id()), 28| 96| m_master_secret(state.session_keys().master_secret()), 29| 96| m_prf_algo(state.ciphersuite().prf_algo()), 30| 96| m_client_supports_secure_renegotiation(state.client_hello()->secure_renegotiation()), 31| 96| m_server_supports_secure_renegotiation(state.server_hello()->secure_renegotiation()), 32| 96| m_client_finished_verify_data(state.client_finished()->verify_data()), 33| 96| m_server_finished_verify_data(state.server_finished()->verify_data()), 34| 96| m_supports_extended_master_secret(state.server_hello()->supports_extended_master_secret()) {} _ZN5Botan3TLS23Renegotiation_ExtensionC2ERNS0_15TLS_Data_ReaderEt: 24| 23| m_reneg_data(reader.get_range(1, 0, 255)) { 25| 23| if(m_reneg_data.size() + 1 != extension_size) { ------------------ | Branch (25:7): [True: 7, False: 16] ------------------ 26| 7| throw Decoding_Error("Bad encoding for secure renegotiation extn"); 27| 7| } 28| 23|} _ZNK5Botan3TLS23Renegotiation_Extension9serializeENS0_15Connection_SideE: 30| 153|std::vector Renegotiation_Extension::serialize(Connection_Side /*whoami*/) const { 31| 153| std::vector buf; 32| 153| append_tls_length_value(buf, m_reneg_data, 1); 33| 153| return buf; 34| 153|} _ZNK5Botan3TLS23Supported_Point_Formats9serializeENS0_15Connection_SideE: 36| 78|std::vector Supported_Point_Formats::serialize(Connection_Side /*whoami*/) const { 37| | // if this extension is sent, it MUST include uncompressed (RFC 4492, section 5.1) 38| 78| if(m_prefers_compressed) { ------------------ | Branch (38:7): [True: 0, False: 78] ------------------ 39| 0| return std::vector{2, ANSIX962_COMPRESSED_PRIME, UNCOMPRESSED}; 40| 78| } else { 41| 78| return std::vector{1, UNCOMPRESSED}; 42| 78| } 43| 78|} _ZN5Botan3TLS23Supported_Point_FormatsC2ERNS0_15TLS_Data_ReaderEt: 45| 197|Supported_Point_Formats::Supported_Point_Formats(TLS_Data_Reader& reader, uint16_t extension_size) { 46| 197| const uint8_t len = reader.get_byte(); 47| | 48| 197| if(len + 1 != extension_size) { ------------------ | Branch (48:7): [True: 7, False: 190] ------------------ 49| 7| throw Decoding_Error("Inconsistent length field in supported point formats list"); 50| 7| } 51| | 52| 190| bool includes_uncompressed = false; 53| 1.25k| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (53:22): [True: 1.24k, False: 8] ------------------ 54| 1.24k| const uint8_t format = reader.get_byte(); 55| | 56| 1.24k| if(static_cast(format) == UNCOMPRESSED) { ------------------ | Branch (56:10): [True: 54, False: 1.19k] ------------------ 57| 54| m_prefers_compressed = false; 58| 54| reader.discard_next(len - i - 1); 59| 54| return; 60| 1.19k| } else if(static_cast(format) == ANSIX962_COMPRESSED_PRIME) { ------------------ | Branch (60:17): [True: 128, False: 1.06k] ------------------ 61| 128| m_prefers_compressed = true; 62| 128| std::vector remaining_formats = reader.get_fixed(len - i - 1); 63| 128| includes_uncompressed = 64| 128| std::any_of(std::begin(remaining_formats), std::end(remaining_formats), [](uint8_t remaining_format) { 65| 128| return static_cast(remaining_format) == UNCOMPRESSED; 66| 128| }); 67| 128| break; 68| 128| } 69| | 70| | // ignore ANSIX962_COMPRESSED_CHAR2, we don't support these curves 71| 1.24k| } 72| | 73| | // RFC 4492 5.1.: 74| | // If the Supported Point Formats Extension is indeed sent, it MUST contain the value 0 (uncompressed) 75| | // as one of the items in the list of point formats. 76| | // Note: 77| | // RFC 8422 5.1.2. explicitly requires this check, 78| | // but only if the Supported Groups extension was sent. 79| 136| if(!includes_uncompressed) { ------------------ | Branch (79:7): [True: 17, False: 119] ------------------ 80| 17| throw TLS_Exception(Alert::IllegalParameter, 81| 17| "Supported Point Formats Extension must contain the uncompressed point format"); 82| 17| } 83| 136|} _ZN5Botan3TLS24Session_Ticket_ExtensionC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE: 87| 121| Connection_Side from) { 88| | // RFC 5077 3.2: in a ServerHello the SessionTicket extension is just a 89| | // flag indicating that a NewSessionTicket handshake message will follow; 90| | // its extension_data MUST be empty. A ticket body is only valid in a 91| | // ClientHello. 92| 121| if(from == Connection_Side::Server && extension_size != 0) { ------------------ | Branch (92:7): [True: 8, False: 113] | Branch (92:42): [True: 1, False: 7] ------------------ 93| 1| throw Decoding_Error("Server sent a non-empty SessionTicket extension"); 94| 1| } 95| 120| m_ticket = Session_Ticket(reader.get_elem>(extension_size)); 96| 120|} _ZN5Botan3TLS22Extended_Master_SecretC2ERNS0_15TLS_Data_ReaderEt: 98| 5.97k|Extended_Master_Secret::Extended_Master_Secret(TLS_Data_Reader& /*unused*/, uint16_t extension_size) { 99| 5.97k| if(extension_size != 0) { ------------------ | Branch (99:7): [True: 1, False: 5.97k] ------------------ 100| 1| throw Decoding_Error("Invalid extended_master_secret extension"); 101| 1| } 102| 5.97k|} _ZNK5Botan3TLS22Extended_Master_Secret9serializeENS0_15Connection_SideE: 104| 2.76k|std::vector Extended_Master_Secret::serialize(Connection_Side /*whoami*/) const { 105| 2.76k| return std::vector(); 106| 2.76k|} _ZN5Botan3TLS16Encrypt_then_MACC2ERNS0_15TLS_Data_ReaderEt: 108| 198|Encrypt_then_MAC::Encrypt_then_MAC(TLS_Data_Reader& /*unused*/, uint16_t extension_size) { 109| 198| if(extension_size != 0) { ------------------ | Branch (109:7): [True: 1, False: 197] ------------------ 110| 1| throw Decoding_Error("Invalid encrypt_then_mac extension"); 111| 1| } 112| 198|} _ZNK5Botan3TLS16Encrypt_then_MAC9serializeENS0_15Connection_SideE: 114| 76|std::vector Encrypt_then_MAC::serialize(Connection_Side /*whoami*/) const { 115| 76| return std::vector(); 116| 76|} tls_extensions_12.cpp:_ZZN5Botan3TLS23Supported_Point_FormatsC1ERNS0_15TLS_Data_ReaderEtENK3$_0clEh: 64| 917| std::any_of(std::begin(remaining_formats), std::end(remaining_formats), [](uint8_t remaining_format) { 65| 917| return static_cast(remaining_format) == UNCOMPRESSED; 66| 917| }); _ZNK5Botan3TLS14Handshake_Hash5finalENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 17| 1.59k|secure_vector Handshake_Hash::final(std::string_view mac_algo) const { 18| 1.59k| std::string hash_algo(mac_algo); 19| 1.59k| if(hash_algo == "SHA-1") { ------------------ | Branch (19:7): [True: 411, False: 1.18k] ------------------ 20| 411| hash_algo = "SHA-256"; 21| 411| } 22| | 23| 1.59k| auto hash = HashFunction::create_or_throw(hash_algo); 24| 1.59k| hash->update(m_data); 25| 1.59k| return hash->final(); 26| 1.59k|} _ZNK5Botan3TLS19Stream_Handshake_IO22initial_record_versionEv: 53| 3.13k|Protocol_Version Stream_Handshake_IO::initial_record_version() const { 54| 3.13k| return Protocol_Version::TLS_V12; 55| 3.13k|} _ZN5Botan3TLS19Stream_Handshake_IO10add_recordEPKhmNS0_11Record_TypeEm: 60| 5.94k| uint64_t /*sequence_number*/) { 61| 5.94k| if(record_type == Record_Type::Handshake) { ------------------ | Branch (61:7): [True: 5.92k, False: 22] ------------------ 62| 5.92k| m_queue.insert(m_queue.end(), record, record + record_len); 63| 5.92k| } else if(record_type == Record_Type::ChangeCipherSpec) { ------------------ | Branch (63:14): [True: 22, False: 0] ------------------ 64| 22| if(record_len != 1 || record[0] != 1) { ------------------ | Branch (64:10): [True: 2, False: 20] | Branch (64:29): [True: 6, False: 14] ------------------ 65| 8| throw Decoding_Error("Invalid ChangeCipherSpec"); 66| 8| } 67| | 68| | // Pretend it's a regular handshake message of zero length 69| 14| const uint8_t ccs_hs[] = {static_cast(Handshake_Type::HandshakeCCS), 0, 0, 0}; 70| 14| m_queue.insert(m_queue.end(), ccs_hs, ccs_hs + sizeof(ccs_hs)); 71| 14| } else { 72| 0| throw Decoding_Error("Unknown message type " + std::to_string(static_cast(record_type)) + 73| 0| " in handshake processing"); 74| 0| } 75| 5.94k|} _ZN5Botan3TLS19Stream_Handshake_IO15get_next_recordEbm: 78| 10.4k| size_t max_message_size) { 79| 10.4k| if(m_queue.size() >= 4) { ------------------ | Branch (79:7): [True: 6.79k, False: 3.68k] ------------------ 80| 6.79k| const Handshake_Type type = static_cast(m_queue[0]); 81| | 82| 6.79k| const size_t rec_length = make_uint32(0, m_queue[1], m_queue[2], m_queue[3]); 83| | 84| | // If we are expecting a CCS but the next queued message is not a CCS, 85| | // the peer has skipped the CCS message. This can happen when the peer 86| | // sends an encrypted Finished without the preceding CCS, in which case 87| | // the encrypted bytes are misinterpreted as a handshake message. 88| 6.79k| if(expecting_ccs) { ------------------ | Branch (88:10): [True: 608, False: 6.19k] ------------------ 89| 608| const bool is_ccs = (type == Handshake_Type::HandshakeCCS && rec_length == 0); ------------------ | Branch (89:31): [True: 404, False: 204] | Branch (89:71): [True: 385, False: 19] ------------------ 90| 608| if(!is_ccs) { ------------------ | Branch (90:13): [True: 223, False: 385] ------------------ 91| 223| throw TLS_Exception(Alert::UnexpectedMessage, "Expected ChangeCipherSpec but got a handshake message"); 92| 223| } 93| 6.19k| } else { 94| 6.19k| verify_is_expected_wire_handshake_type(type); 95| | 96| 6.19k| if(max_message_size > 0 && rec_length > max_message_size) { ------------------ | Branch (96:13): [True: 6.18k, False: 6] | Branch (96:37): [True: 31, False: 6.15k] ------------------ 97| 31| throw TLS_Exception( 98| 31| Alert::HandshakeFailure, 99| 31| Botan::fmt("Handshake message is {} bytes, policy maximum is {}", rec_length, max_message_size)); 100| 31| } 101| 6.19k| } 102| | 103| 6.54k| const size_t length = 4 + rec_length; 104| | 105| 6.54k| if(m_queue.size() >= length) { ------------------ | Branch (105:10): [True: 5.79k, False: 748] ------------------ 106| 5.79k| const std::vector contents(m_queue.begin() + 4, m_queue.begin() + length); 107| | 108| 5.79k| m_queue.erase(m_queue.begin(), m_queue.begin() + length); 109| | 110| 5.79k| return std::make_pair(type, contents); 111| 5.79k| } 112| 6.54k| } 113| | 114| 4.43k| return std::make_pair(Handshake_Type::None, std::vector()); 115| 10.4k|} _ZNK5Botan3TLS19Stream_Handshake_IO6formatERKNSt3__16vectorIhNS2_9allocatorIhEEEENS0_14Handshake_TypeE: 117| 13.7k|std::vector Stream_Handshake_IO::format(const std::vector& msg, Handshake_Type type) const { 118| 13.7k| std::vector send_buf(4 + msg.size()); 119| | 120| 13.7k| const size_t buf_size = msg.size(); 121| | 122| 13.7k| send_buf[0] = static_cast(type); 123| | 124| 13.7k| store_be24(&send_buf[1], buf_size); 125| | 126| 13.7k| if(!msg.empty()) { ------------------ | Branch (126:7): [True: 11.0k, False: 2.76k] ------------------ 127| 11.0k| copy_mem(&send_buf[4], msg.data(), msg.size()); 128| 11.0k| } 129| | 130| 13.7k| return send_buf; 131| 13.7k|} _ZN5Botan3TLS19Stream_Handshake_IO4sendERKNS0_17Handshake_MessageE: 137| 8.47k|std::vector Stream_Handshake_IO::send(const Handshake_Message& msg) { 138| 8.47k| const std::vector msg_bits = msg.serialize(); 139| | 140| 8.47k| if(msg.type() == Handshake_Type::HandshakeCCS) { ------------------ | Branch (140:7): [True: 96, False: 8.38k] ------------------ 141| 96| m_send_hs(Record_Type::ChangeCipherSpec, msg_bits); 142| 96| return std::vector(); // not included in handshake hashes 143| 96| } 144| | 145| 8.38k| auto buf = format(msg_bits, msg.wire_type()); 146| 8.38k| m_send_hs(Record_Type::Handshake, buf); 147| 8.38k| return buf; 148| 8.47k|} _ZN5Botan3TLS21Datagram_Handshake_IOC2ENSt3__18functionIFvtNS0_11Record_TypeERKNS2_6vectorIhNS2_9allocatorIhEEEEEEENS3_IFmvEEERNS0_27Connection_Sequence_NumbersEtmmNS2_8optionalImEEmt: 202| 522| m_seqs(seq), 203| 522| m_flights(1), 204| 522| m_flight_ccs(1), 205| 522| m_initial_timeout(initial_timeout_ms), 206| 522| m_max_timeout(max_timeout_ms), 207| 522| m_max_retransmissions(max_retransmissions), 208| 522| m_initial_epoch(initial_epoch), 209| 522| m_last_delivered_epoch(initial_epoch), 210| 522| m_send_hs(std::move(writer)), 211| 522| m_steady_clock_ms(std::move(steady_clock_ms)), 212| 522| m_mtu(mtu), 213| 522| m_max_handshake_msg_size(max_handshake_msg_size), 214| 522| m_max_pending_reassembly(max_pending_reassembly(m_max_handshake_msg_size)) {} _ZNK5Botan3TLS21Datagram_Handshake_IO22initial_record_versionEv: 216| 522|Protocol_Version Datagram_Handshake_IO::initial_record_version() const { 217| 522| return Protocol_Version::DTLS_V12; 218| 522|} _ZNK5Botan3TLS21Datagram_Handshake_IO14have_more_dataEv: 299| 13|bool Datagram_Handshake_IO::have_more_data() const { 300| | // Future or incomplete fragments remain buffered, but only a complete 301| | // next-in-sequence message is trailing handshake data. 302| 13| const auto next = m_messages.find(m_in_message_seq); 303| 13| return next != m_messages.end() && next->second.complete(); ------------------ | Branch (303:11): [True: 7, False: 6] | Branch (303:39): [True: 5, False: 2] ------------------ 304| 13|} _ZN5Botan3TLS21Datagram_Handshake_IO10add_recordEPKhmNS0_11Record_TypeEm: 377| 1.17k| uint64_t record_sequence) { 378| 1.17k| add_record(record, record_len, record_type, record_sequence, false); 379| 1.17k|} _ZN5Botan3TLS21Datagram_Handshake_IO20charged_add_fragmentERNS1_20Handshake_ReassemblyEmPKhmmtNS0_14Handshake_TypeEm: 433| 895| size_t msg_length) { 434| | // We allocate the entire block on the first fragment, so charge it against 435| | // the bound at that point. Later fragments must agree with the declared 436| | // length, so admission is decided once per slot and retransmissions are 437| | // never re-charged. 438| 895| if(!reassembly.initialized()) { ------------------ | Branch (438:7): [True: 385, False: 510] ------------------ 439| 385| if(m_pending_reassembly_bytes + msg_length > ceiling) { ------------------ | Branch (439:10): [True: 35, False: 350] ------------------ 440| 35| return false; 441| 35| } 442| 350| m_pending_reassembly_bytes += msg_length; 443| 350| } 444| | 445| 860| reassembly.add_fragment(fragment, fragment_length, fragment_offset, epoch, msg_type, msg_length); 446| 860| return true; 447| 895|} _ZN5Botan3TLS21Datagram_Handshake_IO24release_reassembly_bytesERKNS1_20Handshake_ReassemblyE: 449| 60|void Datagram_Handshake_IO::release_reassembly_bytes(const Handshake_Reassembly& reassembly) { 450| 60| BOTAN_ASSERT_NOMSG(m_pending_reassembly_bytes >= reassembly.msg_length()); ------------------ | | 77| 60| do { \ | | 78| 60| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 60| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 60] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 60| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 60] | | ------------------ ------------------ 451| 60| m_pending_reassembly_bytes -= reassembly.msg_length(); 452| 60|} _ZN5Botan3TLS21Datagram_Handshake_IO10add_recordEPKhmNS0_11Record_TypeEmb: 548| 1.17k| bool retransmitted_flight) { 549| 1.17k| const uint16_t epoch = static_cast(record_sequence >> 48); 550| | 551| | // A record under a non-zero epoch authenticated at the record layer, so the 552| | // peer is live and is who it claims to be. Restore the peer-cued replay 553| | // budget: RFC 6347 4.2.4 requires the terminal-flight sender to answer a 554| | // retransmit of the peer's last flight for as long as the association lasts, 555| | // and the retained IO never sends a new flight to reset the count otherwise. 556| | // 557| | // Only once our handshake has finished, though. While it is still pending, 558| | // forward progress already resets the count in send_under_epoch, so 559| | // restoring it here as well would let a peer alternate a cheap out-of-window 560| | // protected record with an epoch-zero cue to draw the pending flight without 561| | // bound. 562| 1.17k| if(epoch > 0 && m_finished) { ------------------ | Branch (562:7): [True: 0, False: 1.17k] | Branch (562:20): [True: 0, False: 0] ------------------ 563| 0| m_peer_replay_count = 0; 564| 0| } 565| | 566| 1.17k| if(record_type == Record_Type::ChangeCipherSpec) { ------------------ | Branch (566:7): [True: 129, False: 1.04k] ------------------ 567| 129| if(record_len != 1 || record[0] != 1) { ------------------ | Branch (567:10): [True: 19, False: 110] | Branch (567:29): [True: 8, False: 102] ------------------ 568| 27| throw Decoding_Error("Invalid ChangeCipherSpec"); 569| 27| } 570| | 571| | // TODO: check this is otherwise empty 572| 102| m_ccs_epochs.insert(epoch); 573| 102| if(retransmitted_flight) { ------------------ | Branch (573:10): [True: 0, False: 102] ------------------ 574| | // Retransmitted final flights cross the epoch boundary: CCS is sent 575| | // under the previous epoch and Finished under the newly activated one. 576| | // Keep both observations because their datagrams may arrive reordered. 577| 0| const uint16_t finished_epoch = static_cast(epoch + 1); 578| 0| if(m_retransmitted_finished_epoch == finished_epoch) { ------------------ | Branch (578:13): [True: 0, False: 0] ------------------ 579| 0| m_retransmitted_finished_epoch.reset(); 580| 0| if(m_retransmit_terminal_flight) { ------------------ | Branch (580:16): [True: 0, False: 0] ------------------ 581| 0| replay_last_flight_for_peer(); 582| 0| } 583| 0| } else { 584| 0| m_retransmitted_finished_epoch.reset(); 585| 0| m_retransmitted_ccs_epoch = finished_epoch; 586| 0| } 587| 0| } 588| 102| return; 589| 129| } 590| | 591| 1.04k| bool retransmit_response = false; 592| | 593| 2.35k| while(record_len > 0) { ------------------ | Branch (593:10): [True: 1.62k, False: 733] ------------------ 594| 1.62k| if(record_len < DTLS_HANDSHAKE_HEADER_SIZE) { ------------------ | Branch (594:10): [True: 253, False: 1.36k] ------------------ 595| 253| return; // completely bogus? at least degenerate/weird 596| 253| } 597| | 598| 1.36k| const Handshake_Type msg_type = static_cast(record[0]); 599| | 600| 1.36k| verify_is_expected_wire_handshake_type(msg_type); 601| | 602| 1.36k| const size_t msg_len = load_be24(&record[1]); 603| | 604| 1.36k| if(m_max_handshake_msg_size > 0 && msg_len > m_max_handshake_msg_size) { ------------------ | Branch (604:10): [True: 1.36k, False: 4] | Branch (604:42): [True: 26, False: 1.33k] ------------------ 605| 26| throw TLS_Exception( 606| 26| Alert::HandshakeFailure, 607| 26| Botan::fmt("Handshake message is {} bytes, policy maximum is {}", msg_len, m_max_handshake_msg_size)); 608| 26| } 609| | 610| 1.34k| const uint16_t message_seq = load_be(&record[4], 0); 611| 1.34k| const size_t fragment_offset = load_be24(&record[6]); 612| 1.34k| const size_t fragment_length = load_be24(&record[9]); 613| | 614| 1.34k| const size_t total_size = DTLS_HANDSHAKE_HEADER_SIZE + fragment_length; 615| | 616| 1.34k| if(record_len < total_size) { ------------------ | Branch (616:10): [True: 32, False: 1.31k] ------------------ 617| 32| throw Decoding_Error("Bad lengths in DTLS header"); 618| 32| } 619| | 620| | // Bound the out-of-order reassembly window. 621| 1.31k| constexpr uint16_t reassembly_window = 16; 622| | 623| 1.31k| if(message_seq >= m_in_message_seq && (message_seq - m_in_message_seq) < reassembly_window) { ------------------ | Branch (623:10): [True: 1.30k, False: 4] | Branch (623:45): [True: 1.05k, False: 250] ------------------ 624| | // A wrapped counter would alias new messages onto long-delivered 625| | // sequence numbers. No legitimate handshake gets here, so go quiet. 626| 1.05k| if(m_in_message_seq_wrapped) { ------------------ | Branch (626:13): [True: 0, False: 1.05k] ------------------ 627| 0| record += total_size; 628| 0| record_len -= total_size; 629| 0| continue; 630| 0| } 631| | 632| | // Epochs never decrease within a handshake, so a fragment carrying an 633| | // older epoch belongs to an earlier handshake whose records were 634| | // delayed into this one. Renegotiation restarts message_seq at zero, 635| | // so without this such a record can occupy a slot the current 636| | // handshake still needs. 637| 1.05k| if(epoch < m_last_delivered_epoch) { ------------------ | Branch (637:13): [True: 0, False: 1.05k] ------------------ 638| 0| record += total_size; 639| 0| record_len -= total_size; 640| 0| continue; 641| 0| } 642| | 643| | /* 644| | RFC 6347 4.2.2 keeps message_seq across a retransmission but gives the 645| | record a new sequence number, and a rehandshake restarts message_seq at 646| | zero. A delayed Finished from the previous handshake therefore arrives 647| | with a plausible sequence number and, before this handshake's own 648| | ChangeCipherSpec, the same epoch as its pre-CCS records, so neither the 649| | sequence nor the epoch floor tells it apart. It cannot be genuine 650| | though: a Finished is sent under the epoch its own ChangeCipherSpec 651| | installed, which is always above the one this handshake began in. 652| | 653| | Left in, it takes the slot the real Finished needs, and a complete slot 654| | is never replaced, so verification fails against the wrong transcript. 655| | */ 656| 1.05k| if(msg_type == Handshake_Type::Finished && epoch <= m_initial_epoch) { ------------------ | Branch (656:13): [True: 6, False: 1.05k] | Branch (656:53): [True: 6, False: 0] ------------------ 657| 6| record += total_size; 658| 6| record_len -= total_size; 659| 6| continue; 660| 6| } 661| | 662| 1.05k| if(retransmitted_flight) { ------------------ | Branch (662:13): [True: 0, False: 1.05k] ------------------ 663| 0| if(fragment_length == 0) { ------------------ | Branch (663:16): [True: 0, False: 0] ------------------ 664| 0| record += total_size; 665| 0| record_len -= total_size; 666| 0| continue; 667| 0| } 668| | 669| 0| throw TLS_Exception(Alert::UnexpectedMessage, "Unexpected new DTLS handshake message"); 670| 0| } 671| | 672| | // An empty fragment for a non-empty message is garbage; drop it 673| | // before it can create and charge a reassembly slot. 674| 1.05k| if(fragment_length == 0 && msg_len > 0) { ------------------ | Branch (674:13): [True: 763, False: 288] | Branch (674:37): [True: 156, False: 607] ------------------ 675| 156| record += total_size; 676| 156| record_len -= total_size; 677| 156| continue; 678| 156| } 679| | 680| | // Reserve headroom for the message actually being waited on. Otherwise 681| | // fragments for the fifteen slots beyond it can consume the whole 682| | // budget, after which every fragment of the expected message is 683| | // silently dropped and the handshake cannot proceed. 684| 895| const size_t ceiling = 685| 895| (message_seq == m_in_message_seq) ? m_max_pending_reassembly : m_max_pending_reassembly / 2; ------------------ | Branch (685:13): [True: 617, False: 278] ------------------ 686| | 687| 895| auto [it, inserted] = m_messages.try_emplace(message_seq); 688| | 689| 895| const bool accepted = charged_add_fragment(it->second, 690| 895| ceiling, 691| 895| &record[DTLS_HANDSHAKE_HEADER_SIZE], 692| 895| fragment_length, 693| 895| fragment_offset, 694| 895| epoch, 695| 895| msg_type, 696| 895| msg_len); 697| 895| if(!accepted && inserted) { ------------------ | Branch (697:13): [True: 35, False: 860] | Branch (697:26): [True: 35, False: 0] ------------------ 698| 35| m_messages.erase(it); 699| 35| } 700| 895| } else if(message_seq < m_in_message_seq) { ------------------ | Branch (700:17): [True: 0, False: 254] ------------------ 701| 0| retransmit_response |= process_previous_handshake_fragment(&record[DTLS_HANDSHAKE_HEADER_SIZE], 702| 0| fragment_length, 703| 0| fragment_offset, 704| 0| epoch, 705| 0| msg_type, 706| 0| msg_len, 707| 0| message_seq, 708| 0| retransmitted_flight); 709| 0| } 710| | // else: beyond the reassembly window is not a retransmission of anything 711| | // we have seen, so it must not be able to pull a flight replay out of 712| | // us. Drop it silently: the sender has proven nothing at this point. 713| | 714| 1.14k| record += total_size; 715| 1.14k| record_len -= total_size; 716| 1.14k| } 717| | 718| 733| if(retransmit_response && (!m_finished || m_retransmit_terminal_flight)) { ------------------ | Branch (718:7): [True: 0, False: 733] | Branch (718:31): [True: 0, False: 0] | Branch (718:46): [True: 0, False: 0] ------------------ 719| 0| replay_last_flight_for_peer(); 720| 0| } 721| 733|} _ZN5Botan3TLS21Datagram_Handshake_IO15get_next_recordEbm: 735| 1.02k| size_t /*max_message_size*/) { 736| | // Expecting a message means the last flight is concluded 737| 1.02k| if(!m_flights.rbegin()->empty()) { ------------------ | Branch (737:7): [True: 0, False: 1.02k] ------------------ 738| 0| m_flights.emplace_back(); 739| 0| m_flight_ccs.emplace_back(); 740| 0| } 741| | 742| 1.02k| if(expecting_ccs) { ------------------ | Branch (742:7): [True: 0, False: 1.02k] ------------------ 743| | // CCS is expected under the epoch the peer's handshake messages have 744| | // been arriving on, and always follows at least one delivered message. 745| 0| if(m_first_delivered_epoch.has_value() && m_ccs_epochs.contains(*m_first_delivered_epoch)) { ------------------ | Branch (745:10): [True: 0, False: 0] | Branch (745:49): [True: 0, False: 0] ------------------ 746| 0| return std::make_pair(Handshake_Type::HandshakeCCS, std::vector()); 747| 0| } 748| 0| return std::make_pair(Handshake_Type::None, std::vector()); 749| 0| } 750| | 751| 1.02k| if(m_retransmitted_client_hello.has_value() && m_retransmitted_client_hello->second.complete()) { ------------------ | Branch (751:7): [True: 0, False: 1.02k] | Branch (751:51): [True: 0, False: 0] ------------------ 752| 0| auto result = m_retransmitted_client_hello->second.message(); 753| 0| release_reassembly_bytes(m_retransmitted_client_hello->second); 754| 0| m_retransmitted_client_hello.reset(); 755| 0| m_recreating_hello_verify_request = true; 756| 0| return result; 757| 0| } 758| | 759| 1.02k| auto i = m_messages.find(m_in_message_seq); 760| | 761| 1.02k| if(i == m_messages.end() || !i->second.complete()) { ------------------ | Branch (761:7): [True: 702, False: 320] | Branch (761:7): [True: 962, False: 60] | Branch (761:32): [True: 260, False: 60] ------------------ 762| 962| return std::make_pair(Handshake_Type::None, std::vector()); 763| 962| } 764| | 765| 60| m_in_message_seq += 1; 766| 60| if(m_in_message_seq == 0) { ------------------ | Branch (766:7): [True: 0, False: 60] ------------------ 767| 0| m_in_message_seq_wrapped = true; 768| 0| } 769| | 770| 60| if(!m_first_delivered_epoch.has_value()) { ------------------ | Branch (770:7): [True: 60, False: 0] ------------------ 771| 60| m_first_delivered_epoch = i->second.epoch(); 772| 60| } 773| | 774| 60| auto result = i->second.message(); 775| | 776| 60| if(result.first == Handshake_Type::ClientHello) { ------------------ | Branch (776:7): [True: 13, False: 47] ------------------ 777| 13| m_awaiting_cookie_client_hello = false; 778| 13| } 779| | 780| 60| const uint16_t delivered_epoch = i->second.epoch(); 781| | 782| 60| release_reassembly_bytes(i->second); 783| 60| m_messages.erase(i); 784| | 785| 60| if(delivered_epoch > m_last_delivered_epoch) { ------------------ | Branch (785:7): [True: 0, False: 60] ------------------ 786| 0| m_last_delivered_epoch = delivered_epoch; 787| 0| discard_stale_epoch_messages(); 788| 0| } 789| | 790| 60| return result; 791| 1.02k|} _ZN5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly12add_fragmentEPKhmmtNS0_14Handshake_TypeEm: 798| 860| size_t msg_length) { 799| 860| if(m_msg_type == Handshake_Type::None) { ------------------ | Branch (799:7): [True: 350, False: 510] ------------------ 800| | // First fragment for this message_seq 801| 350| m_epoch = epoch; 802| 350| m_msg_type = msg_type; 803| 350| m_msg_length = msg_length; 804| 350| m_message.resize(msg_length); 805| 350| m_received_mask.assign(msg_length, 0); 806| 510| } else { 807| 510| if(complete()) { ------------------ | Branch (807:10): [True: 422, False: 88] ------------------ 808| | // Ignore even if the header fields disagree: a stray or forged 809| | // retransmission must not tear down the connection once the 810| | // message has already been fully received. 811| 422| return; 812| 422| } 813| | 814| 88| if(msg_type != m_msg_type || msg_length != m_msg_length || epoch != m_epoch) { ------------------ | Branch (814:10): [True: 5, False: 83] | Branch (814:36): [True: 9, False: 74] | Branch (814:66): [True: 0, False: 74] ------------------ 815| 14| throw Decoding_Error("Inconsistent values in fragmented DTLS handshake header"); 816| 14| } 817| 88| } 818| | 819| 424| if(fragment_offset > m_msg_length) { ------------------ | Branch (819:7): [True: 33, False: 391] ------------------ 820| 33| throw Decoding_Error("Fragment offset past end of message"); 821| 33| } 822| | 823| 391| if(fragment_offset + fragment_length > m_msg_length) { ------------------ | Branch (823:7): [True: 8, False: 383] ------------------ 824| 8| throw Decoding_Error("Fragment overlaps past end of message"); 825| 8| } 826| | 827| 383| BOTAN_ASSERT_NOMSG(m_received_mask.size() == m_msg_length); ------------------ | | 77| 383| do { \ | | 78| 383| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 383| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 383] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 383| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 383] | | ------------------ ------------------ 828| | 829| 1.93k| for(size_t i = 0; i != fragment_length; ++i) { ------------------ | Branch (829:22): [True: 1.56k, False: 376] ------------------ 830| 1.56k| const size_t off = fragment_offset + i; 831| 1.56k| if(m_received_mask[off] != 0) { ------------------ | Branch (831:10): [True: 273, False: 1.29k] ------------------ 832| | // RFC 6347 4.2.3 permits overlapping retransmissions, but the 833| | // overlapping bytes must agree. 834| 273| if(m_message[off] != fragment[i]) { ------------------ | Branch (834:13): [True: 7, False: 266] ------------------ 835| 7| throw Decoding_Error("Inconsistent overlapping DTLS handshake fragment"); 836| 7| } 837| 1.29k| } else { 838| 1.29k| m_message[off] = fragment[i]; 839| 1.29k| m_received_mask[off] = 1; 840| 1.29k| ++m_bytes_received; 841| 1.29k| } 842| 1.56k| } 843| 383|} _ZNK5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly8completeEv: 845| 897|bool Datagram_Handshake_IO::Handshake_Reassembly::complete() const { 846| 897| return (m_msg_type != Handshake_Type::None && m_bytes_received == m_msg_length); ------------------ | Branch (846:12): [True: 897, False: 0] | Branch (846:50): [True: 547, False: 350] ------------------ 847| 897|} _ZNK5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly7messageEv: 849| 60|std::pair> Datagram_Handshake_IO::Handshake_Reassembly::message() const { 850| 60| if(!complete()) { ------------------ | Branch (850:7): [True: 0, False: 60] ------------------ 851| 0| throw Internal_Error("Datagram_Handshake_IO - message not complete"); 852| 0| } 853| | 854| 60| return std::make_pair(m_msg_type, m_message); 855| 60|} _ZNK5Botan3TLS21Datagram_Handshake_IO15format_fragmentEPKhmjjNS0_14Handshake_TypeEt: 862| 13| uint16_t msg_sequence) const { 863| 13| std::vector send_buf(12 + frag_len); 864| | 865| 13| send_buf[0] = static_cast(type); 866| | 867| 13| store_be24(&send_buf[1], msg_len); 868| | 869| 13| store_be(msg_sequence, &send_buf[4]); 870| | 871| 13| store_be24(&send_buf[6], frag_offset); 872| 13| store_be24(&send_buf[9], frag_len); 873| | 874| 13| if(frag_len > 0) { ------------------ | Branch (874:7): [True: 1, False: 12] ------------------ 875| 1| copy_mem(&send_buf[12], fragment, frag_len); 876| 1| } 877| | 878| 13| return send_buf; 879| 13|} _ZNK5Botan3TLS21Datagram_Handshake_IO12format_w_seqERKNSt3__16vectorIhNS2_9allocatorIhEEEENS0_14Handshake_TypeEt: 883| 13| uint16_t msg_sequence) const { 884| 13| return format_fragment(msg.data(), msg.size(), 0, static_cast(msg.size()), type, msg_sequence); 885| 13|} _ZNK5Botan3TLS21Datagram_Handshake_IO6formatERKNSt3__16vectorIhNS2_9allocatorIhEEEENS0_14Handshake_TypeE: 887| 13|std::vector Datagram_Handshake_IO::format(const std::vector& msg, Handshake_Type type) const { 888| | // Formats the message just delivered, so the guard is that one exists, not 889| | // that the counter is non-zero. Those differ once m_in_message_seq wraps, 890| | // where the subtraction wraps to 65535 of its own accord, which is the 891| | // right sequence number for that message. 892| 13| BOTAN_ASSERT_NOMSG(m_first_delivered_epoch.has_value()); ------------------ | | 77| 13| do { \ | | 78| 13| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 13| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 13] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 13| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 13] | | ------------------ ------------------ 893| 13| return format_w_seq(msg, type, static_cast(m_in_message_seq - 1)); 894| 13|} tls_handshake_io.cpp:_ZN5Botan3TLS12_GLOBAL__N_138verify_is_expected_wire_handshake_typeENS0_14Handshake_TypeE: 34| 7.55k|void verify_is_expected_wire_handshake_type(Handshake_Type type) { 35| 7.55k| switch(type) { 36| 0| case Handshake_Type::HelloRetryRequest: ------------------ | Branch (36:7): [True: 0, False: 7.55k] ------------------ 37| 1| case Handshake_Type::HandshakeCCS: ------------------ | Branch (37:7): [True: 1, False: 7.55k] ------------------ 38| 10| case Handshake_Type::None: ------------------ | Branch (38:7): [True: 9, False: 7.55k] ------------------ 39| 10| throw TLS_Exception(Alert::UnexpectedMessage, "Invalid handshake message type"); 40| 7.54k| default: ------------------ | Branch (40:7): [True: 7.54k, False: 10] ------------------ 41| 7.54k| break; 42| 7.55k| } 43| 7.55k|} tls_handshake_io.cpp:_ZN5Botan3TLS12_GLOBAL__N_110store_be24EPhm: 45| 13.8k|void store_be24(uint8_t out[3], size_t val) { 46| 13.8k| out[0] = get_byte<1>(static_cast(val)); 47| 13.8k| out[1] = get_byte<2>(static_cast(val)); 48| 13.8k| out[2] = get_byte<3>(static_cast(val)); 49| 13.8k|} tls_handshake_io.cpp:_ZN5Botan3TLS12_GLOBAL__N_122max_pending_reassemblyEm: 166| 522|size_t max_pending_reassembly(size_t policy_hs_max) { 167| | /* 168| | * Here we set arbitrary but probably more than sufficient bounds on the *overall* 169| | * allocation that is allowed across the entire handshake. 170| | * 171| | * If the policy set a limit on individual handshake message sizes, accept up to 4 172| | * times that for the whole handshake. This is more than generous considering most 173| | * handshake messages are fixed length or are relatively tightly bounded. The default 174| | * per-handshake message bound is 64 KiB so without application intervention this will 175| | * top out at 256 KiB for a handshake. 176| | * 177| | * If the application explicitly disables the per handshake message bound, still apply 178| | * an arbitrary upper bound of 16 MiB for the handshake. 179| | */ 180| 522| constexpr size_t overall_cap = 16 * 1024 * 1024; 181| | 182| 522| if(policy_hs_max == 0 || policy_hs_max >= overall_cap / 4) { ------------------ | Branch (182:7): [True: 0, False: 522] | Branch (182:29): [True: 0, False: 522] ------------------ 183| | // If disabled or huge just take our max 184| 0| return overall_cap; 185| 522| } else { 186| | // Otherwise 4x the per-message max 187| 522| return policy_hs_max * 4; 188| 522| } 189| 522|} tls_handshake_io.cpp:_ZN5Botan3TLS12_GLOBAL__N_19load_be24EPKh: 29| 4.04k|inline size_t load_be24(const uint8_t q[3]) { 30| 4.04k| return make_uint32(0, q[0], q[1], q[2]); 31| 4.04k|} _ZN5Botan3TLS15Handshake_StateD2Ev: 28| 3.65k|Handshake_State::~Handshake_State() = default; _ZN5Botan3TLS15Handshake_StateC2ENSt3__110unique_ptrINS0_12Handshake_IOENS2_14default_deleteIS4_EEEERNS0_9CallbacksE: 31| 3.65k| m_callbacks(cb), m_handshake_io(std::move(io)), m_version(m_handshake_io->initial_record_version()) {} _ZN5Botan3TLS15Handshake_State12note_messageERKNS0_17Handshake_MessageE: 33| 13.0k|void Handshake_State::note_message(const Handshake_Message& msg) { 34| 13.0k| m_callbacks.tls_inspect_handshake_msg(msg); 35| 13.0k|} _ZN5Botan3TLS15Handshake_State12client_helloENSt3__110unique_ptrINS0_15Client_Hello_12ENS2_14default_deleteIS4_EEEE: 47| 3.13k|void Handshake_State::client_hello(std::unique_ptr client_hello) { 48| | // Legacy behavior (exception to the rule): Allow client_hello to be nullptr to reset state. 49| 3.13k| if(client_hello == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 3.13k] ------------------ 50| 0| m_client_hello.reset(); 51| 0| hash().reset(); 52| 3.13k| } else { 53| 3.13k| m_client_hello = std::move(client_hello); 54| 3.13k| note_message(*m_client_hello); 55| 3.13k| } 56| 3.13k|} _ZN5Botan3TLS15Handshake_State12server_helloENSt3__110unique_ptrINS0_15Server_Hello_12ENS2_14default_deleteIS4_EEEE: 58| 2.76k|void Handshake_State::server_hello(std::unique_ptr server_hello) { 59| 2.76k| BOTAN_ASSERT_NONNULL(server_hello); ------------------ | | 116| 2.76k| do { \ | | 117| 2.76k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 2.76k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 2.76k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 2.76k] | | ------------------ ------------------ 60| 2.76k| m_server_hello = std::move(server_hello); 61| 2.76k| m_ciphersuite = Ciphersuite::by_id(m_server_hello->ciphersuite()); 62| 2.76k| note_message(*m_server_hello); 63| 2.76k|} _ZN5Botan3TLS15Handshake_State12server_certsENSt3__110unique_ptrINS0_14Certificate_12ENS2_14default_deleteIS4_EEEE: 65| 5|void Handshake_State::server_certs(std::unique_ptr server_certs) { 66| 5| BOTAN_ASSERT_NONNULL(server_certs); ------------------ | | 116| 5| do { \ | | 117| 5| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 5] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 5| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 5] | | ------------------ ------------------ 67| 5| m_server_certs = std::move(server_certs); 68| 5| note_message(*m_server_certs); 69| 5|} _ZN5Botan3TLS15Handshake_State10server_kexENSt3__110unique_ptrINS0_19Server_Key_ExchangeENS2_14default_deleteIS4_EEEE: 77| 2.75k|void Handshake_State::server_kex(std::unique_ptr server_kex) { 78| 2.75k| BOTAN_ASSERT_NONNULL(server_kex); ------------------ | | 116| 2.75k| do { \ | | 117| 2.75k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 2.75k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 2.75k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 2.75k] | | ------------------ ------------------ 79| 2.75k| m_server_kex = std::move(server_kex); 80| 2.75k| note_message(*m_server_kex); 81| 2.75k|} _ZN5Botan3TLS15Handshake_State17server_hello_doneENSt3__110unique_ptrINS0_17Server_Hello_DoneENS2_14default_deleteIS4_EEEE: 89| 2.75k|void Handshake_State::server_hello_done(std::unique_ptr server_hello_done) { 90| 2.75k| BOTAN_ASSERT_NONNULL(server_hello_done); ------------------ | | 116| 2.75k| do { \ | | 117| 2.75k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 2.75k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 2.75k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 2.75k] | | ------------------ ------------------ 91| 2.75k| m_server_hello_done = std::move(server_hello_done); 92| 2.75k| note_message(*m_server_hello_done); 93| 2.75k|} _ZN5Botan3TLS15Handshake_State10client_kexENSt3__110unique_ptrINS0_19Client_Key_ExchangeENS2_14default_deleteIS4_EEEE: 101| 1.40k|void Handshake_State::client_kex(std::unique_ptr client_kex) { 102| 1.40k| BOTAN_ASSERT_NONNULL(client_kex); ------------------ | | 116| 1.40k| do { \ | | 117| 1.40k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 1.40k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 1.40k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 1.40k] | | ------------------ ------------------ 103| 1.40k| m_client_kex = std::move(client_kex); 104| 1.40k| note_message(*m_client_kex); 105| 1.40k|} _ZN5Botan3TLS15Handshake_State15server_finishedENSt3__110unique_ptrINS0_11Finished_12ENS2_14default_deleteIS4_EEEE: 125| 96|void Handshake_State::server_finished(std::unique_ptr server_finished) { 126| 96| BOTAN_ASSERT_NONNULL(server_finished); ------------------ | | 116| 96| do { \ | | 117| 96| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 96] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 96| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 96] | | ------------------ ------------------ 127| 96| m_server_finished = std::move(server_finished); 128| 96| note_message(*m_server_finished); 129| 96|} _ZN5Botan3TLS15Handshake_State15client_finishedENSt3__110unique_ptrINS0_11Finished_12ENS2_14default_deleteIS4_EEEE: 131| 96|void Handshake_State::client_finished(std::unique_ptr client_finished) { 132| 96| BOTAN_ASSERT_NONNULL(client_finished); ------------------ | | 116| 96| do { \ | | 117| 96| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 96] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 96| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 96] | | ------------------ ------------------ 133| 96| m_client_finished = std::move(client_finished); 134| 96| note_message(*m_client_finished); 135| 96|} _ZNK5Botan3TLS15Handshake_State11ciphersuiteEv: 137| 14.2k|const Ciphersuite& Handshake_State::ciphersuite() const { 138| 14.2k| if(!m_ciphersuite.has_value()) { ------------------ | Branch (138:7): [True: 0, False: 14.2k] ------------------ 139| 0| throw Invalid_State("Cipher suite is not set"); 140| 0| } 141| 14.2k| return m_ciphersuite.value(); 142| 14.2k|} _ZNK5Botan3TLS15Handshake_State12psk_identityEv: 144| 192|std::optional Handshake_State::psk_identity() const { 145| 192| if(!m_client_kex) { ------------------ | Branch (145:7): [True: 0, False: 192] ------------------ 146| 0| return std::nullopt; 147| 0| } 148| 192| return m_client_kex->psk_identity(); 149| 192|} _ZN5Botan3TLS15Handshake_State11set_versionERKNS0_16Protocol_VersionE: 151| 3.10k|void Handshake_State::set_version(const Protocol_Version& version) { 152| 3.10k| m_version = version; 153| 3.10k|} _ZN5Botan3TLS15Handshake_State20compute_session_keysEv: 155| 1.40k|void Handshake_State::compute_session_keys() { 156| 1.40k| BOTAN_ASSERT_NONNULL(client_kex()); ------------------ | | 116| 1.40k| do { \ | | 117| 1.40k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 1.40k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 1.40k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 1.40k] | | ------------------ ------------------ 157| 1.40k| m_session_keys = Session_Keys(this, client_kex()->pre_master_secret(), false); 158| 1.40k|} _ZN5Botan3TLS15Handshake_State21confirm_transition_toENS0_14Handshake_TypeE: 164| 5.85k|void Handshake_State::confirm_transition_to(Handshake_Type handshake_msg) { 165| 5.85k| m_transitions.confirm_transition_to(handshake_msg); 166| 5.85k|} _ZN5Botan3TLS15Handshake_State17set_expected_nextENS0_14Handshake_TypeE: 168| 9.06k|void Handshake_State::set_expected_next(Handshake_Type handshake_msg) { 169| 9.06k| m_transitions.set_expected_next(handshake_msg); 170| 9.06k|} _ZNK5Botan3TLS15Handshake_State22received_handshake_msgENS0_14Handshake_TypeE: 172| 2.15k|bool Handshake_State::received_handshake_msg(Handshake_Type handshake_msg) const { 173| 2.15k| return m_transitions.received_handshake_msg(handshake_msg); 174| 2.15k|} _ZN5Botan3TLS15Handshake_State22get_next_handshake_msgEm: 176| 11.5k|std::pair> Handshake_State::get_next_handshake_msg(size_t max_handshake_msg_size) { 177| 11.5k| return m_handshake_io->get_next_record(m_transitions.change_cipher_spec_expected(), max_handshake_msg_size); 178| 11.5k|} _ZNK5Botan3TLS15Handshake_State21protocol_specific_prfEv: 192| 1.59k|std::unique_ptr Handshake_State::protocol_specific_prf() const { 193| 1.59k| return m_callbacks.tls12_protocol_specific_kdf(ciphersuite().prf_algo()); 194| 1.59k|} _ZN5Botan3TLS23Connection_Cipher_StateD2Ev: 33| 481|Connection_Cipher_State::~Connection_Cipher_State() = default; _ZN5Botan3TLS23Connection_Cipher_StateC2ENS0_16Protocol_VersionENS0_15Connection_SideEbRKNS0_11CiphersuiteERKNS0_12Session_KeysEb: 40| 481| bool uses_encrypt_then_mac) { 41| | // NOLINTBEGIN(*-prefer-member-initializer) 42| 481| m_nonce_format = suite.nonce_format(); 43| 481| m_nonce_bytes_from_record = suite.nonce_bytes_from_record(version); 44| 481| m_nonce_bytes_from_handshake = suite.nonce_bytes_from_handshake(); 45| | 46| 481| const secure_vector& aead_key = keys.aead_key(side); 47| 481| m_nonce = keys.nonce(side); 48| | // NOLINTEND(*-prefer-member-initializer) 49| | 50| 481| BOTAN_ASSERT_NOMSG(m_nonce.size() == m_nonce_bytes_from_handshake); ------------------ | | 77| 481| do { \ | | 78| 481| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 481| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 481] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 481| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 481] | | ------------------ ------------------ 51| | 52| 481| if(nonce_format() == Nonce_Format::CBC_MODE) { ------------------ | Branch (52:7): [True: 242, False: 239] ------------------ 53| 242|#if defined(BOTAN_HAS_TLS_CBC) 54| | // legacy CBC+HMAC mode 55| 242| auto mac = MessageAuthenticationCode::create_or_throw(fmt("HMAC({})", suite.mac_algo())); 56| 242| auto cipher = BlockCipher::create_or_throw(suite.cipher_algo()); 57| | 58| 242| if(our_side) { ------------------ | Branch (58:10): [True: 63, False: 179] ------------------ 59| 63| m_aead = std::make_unique(std::move(cipher), 60| 63| std::move(mac), 61| 63| suite.cipher_keylen(), 62| 63| suite.mac_keylen(), 63| 63| version, 64| 63| uses_encrypt_then_mac); 65| 179| } else { 66| 179| m_aead = std::make_unique(std::move(cipher), 67| 179| std::move(mac), 68| 179| suite.cipher_keylen(), 69| 179| suite.mac_keylen(), 70| 179| version, 71| 179| uses_encrypt_then_mac); 72| 179| } 73| | 74| |#else 75| | BOTAN_UNUSED(uses_encrypt_then_mac); 76| | throw Internal_Error("Negotiated disabled TLS CBC+HMAC ciphersuite"); 77| |#endif 78| 242| } else if(nonce_format() == Nonce_Format::NULL_CIPHER) { ------------------ | Branch (78:14): [True: 0, False: 239] ------------------ 79| |#if defined(BOTAN_HAS_TLS_NULL) 80| | auto mac = MessageAuthenticationCode::create_or_throw(fmt("HMAC({})", suite.mac_algo())); 81| | 82| | if(our_side) { 83| | m_aead = std::make_unique(std::move(mac), suite.mac_keylen()); 84| | } else { 85| | m_aead = std::make_unique(std::move(mac), suite.mac_keylen()); 86| | } 87| |#else 88| 0| throw Internal_Error("Negotiated disabled TLS NULL ciphersuite"); 89| 0|#endif 90| 239| } else { 91| 239| m_aead = 92| 239| AEAD_Mode::create_or_throw(suite.cipher_algo(), our_side ? Cipher_Dir::Encryption : Cipher_Dir::Decryption); ------------------ | Branch (92:58): [True: 33, False: 206] ------------------ 93| 239| } 94| | 95| 481| m_aead->set_key(aead_key); 96| 481|} _ZN5Botan3TLS23Connection_Cipher_State10aead_nonceEmRNS_21RandomNumberGeneratorE: 98| 174|std::vector Connection_Cipher_State::aead_nonce(uint64_t seq, RandomNumberGenerator& rng) { 99| 174| switch(m_nonce_format) { ------------------ | Branch (99:11): [True: 174, False: 0] ------------------ 100| 0| case Nonce_Format::NULL_CIPHER: { ------------------ | Branch (100:7): [True: 0, False: 174] ------------------ 101| 0| return std::vector{}; 102| 0| } 103| 113| case Nonce_Format::CBC_MODE: { ------------------ | Branch (103:7): [True: 113, False: 61] ------------------ 104| 113| std::vector nonce(nonce_bytes_from_record()); 105| 113| rng.randomize(nonce.data(), nonce.size()); 106| 113| return nonce; 107| 0| } 108| 23| case Nonce_Format::AEAD_XOR_12: { ------------------ | Branch (108:7): [True: 23, False: 151] ------------------ 109| 23| BOTAN_ASSERT_NOMSG(m_nonce.size() == 12); ------------------ | | 77| 23| do { \ | | 78| 23| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 23| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 23] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 23| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 23] | | ------------------ ------------------ 110| 23| std::vector nonce(12); 111| 23| store_be(seq, nonce.data() + 4); 112| 23| xor_buf(nonce, m_nonce.data(), m_nonce.size()); 113| 23| return nonce; 114| 0| } 115| 38| case Nonce_Format::AEAD_IMPLICIT_4: { ------------------ | Branch (115:7): [True: 38, False: 136] ------------------ 116| 38| BOTAN_ASSERT_NOMSG(m_nonce.size() == 4); ------------------ | | 77| 38| do { \ | | 78| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 38| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 38] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 38| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 38] | | ------------------ ------------------ 117| 38| std::vector nonce(12); 118| 38| copy_mem(&nonce[0], m_nonce.data(), 4); // NOLINT(*container-data-pointer) 119| 38| store_be(seq, &nonce[nonce_bytes_from_handshake()]); 120| 38| return nonce; 121| 0| } 122| 174| } 123| | 124| 0| throw Invalid_State("Unknown nonce format specified"); 125| 174|} _ZN5Botan3TLS23Connection_Cipher_State10aead_nonceEPKhmm: 127| 313|std::vector Connection_Cipher_State::aead_nonce(const uint8_t record[], size_t record_len, uint64_t seq) { 128| 313| switch(m_nonce_format) { ------------------ | Branch (128:11): [True: 313, False: 0] ------------------ 129| 0| case Nonce_Format::NULL_CIPHER: { ------------------ | Branch (129:7): [True: 0, False: 313] ------------------ 130| 0| return std::vector{}; 131| 0| } 132| 146| case Nonce_Format::CBC_MODE: { ------------------ | Branch (132:7): [True: 146, False: 167] ------------------ 133| 146| if(record_len < nonce_bytes_from_record()) { ------------------ | Branch (133:13): [True: 1, False: 145] ------------------ 134| 1| throw Decoding_Error("Invalid CBC packet too short to be valid"); 135| 1| } 136| 145| std::vector nonce(record, record + nonce_bytes_from_record()); 137| 145| return nonce; 138| 146| } 139| 56| case Nonce_Format::AEAD_XOR_12: { ------------------ | Branch (139:7): [True: 56, False: 257] ------------------ 140| 56| BOTAN_ASSERT_NOMSG(m_nonce.size() == 12); ------------------ | | 77| 56| do { \ | | 78| 56| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 56| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 56] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 56| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 56] | | ------------------ ------------------ 141| 56| std::vector nonce(12); 142| 56| store_be(seq, nonce.data() + 4); 143| 56| xor_buf(nonce, m_nonce.data(), m_nonce.size()); 144| 56| return nonce; 145| 146| } 146| 111| case Nonce_Format::AEAD_IMPLICIT_4: { ------------------ | Branch (146:7): [True: 111, False: 202] ------------------ 147| 111| BOTAN_ASSERT_NOMSG(m_nonce.size() == 4); ------------------ | | 77| 111| do { \ | | 78| 111| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 111| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 111] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 111| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 111] | | ------------------ ------------------ 148| 111| if(record_len < nonce_bytes_from_record()) { ------------------ | Branch (148:13): [True: 1, False: 110] ------------------ 149| 1| throw Decoding_Error("Invalid AEAD packet too short to be valid"); 150| 1| } 151| 110| std::vector nonce(12); 152| 110| copy_mem(&nonce[0], m_nonce.data(), 4); // NOLINT(*container-data-pointer) 153| 110| copy_mem(&nonce[nonce_bytes_from_handshake()], record, nonce_bytes_from_record()); 154| 110| return nonce; 155| 111| } 156| 313| } 157| | 158| 0| throw Invalid_State("Unknown nonce format specified"); 159| 313|} _ZN5Botan3TLS23Connection_Cipher_State9format_adEmNS0_11Record_TypeENS0_16Protocol_VersionEt: 164| 480| uint16_t msg_length) { 165| 480| std::vector ad(13); 166| | 167| 480| store_be(msg_sequence, &ad[0]); // NOLINT(*container-data-pointer) 168| 480| ad[8] = static_cast(msg_type); 169| 480| ad[9] = version.major_version(); 170| 480| ad[10] = version.minor_version(); 171| 480| ad[11] = get_byte<0>(msg_length); 172| 480| ad[12] = get_byte<1>(msg_length); 173| | 174| 480| return ad; 175| 480|} _ZN5Botan3TLS24write_unencrypted_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS0_11Record_TypeENS0_16Protocol_VersionEmPKhm: 210| 10.5k| size_t message_len) { 211| 10.5k| if(record_type == Record_Type::ApplicationData) { ------------------ | Branch (211:7): [True: 0, False: 10.5k] ------------------ 212| 0| throw Internal_Error("Writing an unencrypted TLS application data record"); 213| 0| } 214| 10.5k| write_record_header(output, record_type, version, record_sequence); 215| 10.5k| append_u16_len(output, message_len); 216| 10.5k| output.insert(output.end(), message, message + message_len); 217| 10.5k|} _ZN5Botan3TLS12write_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS0_11Record_TypeENS0_16Protocol_VersionEmPKhmRNS0_23Connection_Cipher_StateERNS_21RandomNumberGeneratorE: 226| 174| RandomNumberGenerator& rng) { 227| 174| write_record_header(output, record_type, version, record_sequence); 228| | 229| 174| AEAD_Mode& aead = cs.aead(); 230| 174| std::vector aad = cs.format_ad(record_sequence, record_type, version, static_cast(message_len)); 231| | 232| 174| const size_t ctext_size = aead.output_length(message_len); 233| | 234| 174| const size_t rec_size = ctext_size + cs.nonce_bytes_from_record(); 235| | 236| 174| aead.set_associated_data(aad); 237| | 238| 174| const std::vector nonce = cs.aead_nonce(record_sequence, rng); 239| | 240| 174| append_u16_len(output, rec_size); 241| | 242| 174| if(cs.nonce_bytes_from_record() > 0) { ------------------ | Branch (242:7): [True: 151, False: 23] ------------------ 243| 151| if(cs.nonce_format() == Nonce_Format::CBC_MODE) { ------------------ | Branch (243:10): [True: 113, False: 38] ------------------ 244| 113| output += nonce; 245| 113| } else { 246| 38| output += std::make_pair(&nonce[cs.nonce_bytes_from_handshake()], cs.nonce_bytes_from_record()); 247| 38| } 248| 151| } 249| | 250| 174| const size_t header_size = output.size(); 251| 174| output += std::make_pair(message, message_len); 252| | 253| 174| aead.start(nonce); 254| 174| aead.finish(output, header_size); 255| | 256| 174| BOTAN_ASSERT(output.size() < MAX_CIPHERTEXT_SIZE, "Produced ciphertext larger than protocol allows"); ------------------ | | 64| 174| do { \ | | 65| 174| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 174| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 174] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 174| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 174] | | ------------------ ------------------ 257| 174|} _ZN5Botan3TLS11read_recordEbRNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKhmRmS6_PNS0_27Connection_Sequence_NumbersERKNS1_8functionIFNS1_10shared_ptrINS0_23Connection_Cipher_StateEEEtEEEb: 518| 8.72k| bool allow_epoch0_restart) { 519| 8.72k| if(is_datagram) { ------------------ | Branch (519:7): [True: 1.69k, False: 7.03k] ------------------ 520| 1.69k| return read_dtls_record( 521| 1.69k| readbuf, input, input_len, consumed, recbuf, sequence_numbers, get_cipherstate, allow_epoch0_restart); 522| 7.03k| } else { 523| 7.03k| return read_tls_record(readbuf, input, input_len, consumed, recbuf, sequence_numbers, get_cipherstate); 524| 7.03k| } 525| 8.72k|} tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_119write_record_headerERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS0_11Record_TypeENS0_16Protocol_VersionEm: 189| 10.6k| uint64_t record_sequence) { 190| 10.6k| output.clear(); 191| | 192| 10.6k| output.push_back(static_cast(record_type)); 193| 10.6k| output.push_back(version.major_version()); 194| 10.6k| output.push_back(version.minor_version()); 195| | 196| 10.6k| if(version.is_datagram_protocol()) { ------------------ | Branch (196:7): [True: 316, False: 10.3k] ------------------ 197| 2.84k| for(size_t i = 0; i != 8; ++i) { ------------------ | Branch (197:25): [True: 2.52k, False: 316] ------------------ 198| 2.52k| output.push_back(get_byte_var(i, record_sequence)); 199| 2.52k| } 200| 316| } 201| 10.6k|} tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_114append_u16_lenERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm: 179| 10.6k|inline void append_u16_len(secure_vector& output, size_t len_field) { 180| 10.6k| const uint16_t len16 = static_cast(len_field); 181| 10.6k| BOTAN_ASSERT_EQUAL(len_field, len16, "No truncation"); ------------------ | | 90| 10.6k| do { \ | | 91| 10.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 92| 10.6k| if((expr1) != (expr2)) { \ | | ------------------ | | | Branch (92:10): [True: 0, False: 10.6k] | | ------------------ | | 93| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 94| 0| Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \ | | 95| 0| } \ | | 96| 10.6k| } while(0) | | ------------------ | | | Branch (96:12): [Folded, False: 10.6k] | | ------------------ ------------------ 182| 10.6k| output.push_back(get_byte<0>(len16)); 183| 10.6k| output.push_back(get_byte<1>(len16)); 184| 10.6k|} tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_116read_dtls_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKhmRmS7_PNS0_27Connection_Sequence_NumbersERKNS2_8functionIFNS2_10shared_ptrINS0_23Connection_Cipher_StateEEEtEEEb: 432| 1.69k| bool allow_epoch0_restart) { 433| 1.69k| if(readbuf.size() < DTLS_HEADER_SIZE) { ------------------ | Branch (433:7): [True: 1.69k, False: 0] ------------------ 434| | // header incomplete 435| 1.69k| if(fill_buffer_to(readbuf, input, input_len, consumed, DTLS_HEADER_SIZE) != 0) { ------------------ | Branch (435:10): [True: 61, False: 1.63k] ------------------ 436| 61| readbuf.clear(); 437| 61| return Record_Header(0); 438| 61| } 439| | 440| 1.63k| BOTAN_ASSERT_EQUAL(readbuf.size(), DTLS_HEADER_SIZE, "Have an entire header"); ------------------ | | 90| 1.63k| do { \ | | 91| 1.63k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 92| 1.63k| if((expr1) != (expr2)) { \ | | ------------------ | | | Branch (92:10): [True: 0, False: 1.63k] | | ------------------ | | 93| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 94| 0| Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \ | | 95| 0| } \ | | 96| 1.63k| } while(0) | | ------------------ | | | Branch (96:12): [Folded, False: 1.63k] | | ------------------ ------------------ 441| 1.63k| } 442| | 443| 1.63k| const Protocol_Version version(readbuf[1], readbuf[2]); 444| | 445| 1.63k| if(version.is_datagram_protocol() == false) { ------------------ | Branch (445:7): [True: 21, False: 1.61k] ------------------ 446| 21| readbuf.clear(); 447| 21| return Record_Header(0); 448| 21| } 449| | 450| 1.61k| const size_t record_size = make_uint16(readbuf[DTLS_HEADER_SIZE - 2], readbuf[DTLS_HEADER_SIZE - 1]); 451| | 452| 1.61k| if(record_size > MAX_CIPHERTEXT_SIZE) { ------------------ | Branch (452:7): [True: 5, False: 1.61k] ------------------ 453| | // Too large to be valid, ignore it 454| 5| readbuf.clear(); 455| 5| return Record_Header(0); 456| 5| } 457| | 458| 1.61k| if(fill_buffer_to(readbuf, input, input_len, consumed, DTLS_HEADER_SIZE + record_size) != 0) { ------------------ | Branch (458:7): [True: 39, False: 1.57k] ------------------ 459| | // Truncated packet? 460| 39| readbuf.clear(); 461| 39| return Record_Header(0); 462| 39| } 463| | 464| 1.57k| BOTAN_ASSERT_EQUAL(static_cast(DTLS_HEADER_SIZE) + record_size, readbuf.size(), "Have the full record"); ------------------ | | 90| 1.57k| do { \ | | 91| 1.57k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 92| 1.57k| if((expr1) != (expr2)) { \ | | ------------------ | | | Branch (92:10): [True: 0, False: 1.57k] | | ------------------ | | 93| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 94| 0| Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \ | | 95| 0| } \ | | 96| 1.57k| } while(0) | | ------------------ | | | Branch (96:12): [Folded, False: 1.57k] | | ------------------ ------------------ 465| | 466| 1.57k| const Record_Type type = static_cast(readbuf[0]); 467| | 468| 1.57k| const uint64_t sequence = load_be(&readbuf[3], 0); 469| 1.57k| const uint16_t epoch = (sequence >> 48); 470| | 471| 1.57k| const bool already_seen = sequence_numbers != nullptr && sequence_numbers->already_seen(sequence); ------------------ | Branch (471:30): [True: 742, False: 831] | Branch (471:61): [True: 0, False: 742] ------------------ 472| | 473| 1.57k| if(already_seen && !(epoch == 0 && allow_epoch0_restart)) { ------------------ | Branch (473:7): [True: 0, False: 1.57k] | Branch (473:25): [True: 0, False: 0] | Branch (473:39): [True: 0, False: 0] ------------------ 474| 0| readbuf.clear(); 475| 0| return Record_Header(0); 476| 0| } 477| | 478| 1.57k| if(epoch == 0) { ------------------ | Branch (478:7): [True: 1.53k, False: 34] ------------------ 479| | // Unencrypted initial handshake. Epoch-0 records are unauthenticated and 480| | // deliberately do not advance the replay window: one spoofed record with a 481| | // high sequence number would otherwise silently drop every later record 482| | // from the real peer. Duplicates are filtered by handshake reassembly. 483| 1.53k| recbuf.assign(readbuf.begin() + DTLS_HEADER_SIZE, readbuf.begin() + DTLS_HEADER_SIZE + record_size); 484| 1.53k| readbuf.clear(); 485| 1.53k| return Record_Header(sequence, version, type); 486| 1.53k| } 487| | 488| 34| try { 489| | // Otherwise, decrypt, check MAC, return plaintext 490| 34| auto cs = get_cipherstate(epoch); 491| | 492| 34| BOTAN_ASSERT(cs, "Have cipherstate for this epoch"); ------------------ | | 64| 34| do { \ | | 65| 34| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 34| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 34] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 34| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 34] | | ------------------ ------------------ 493| | 494| 34| decrypt_record(recbuf, &readbuf[DTLS_HEADER_SIZE], record_size, sequence, version, type, *cs); 495| 34| } catch(std::exception&) { 496| 34| readbuf.clear(); 497| 34| return Record_Header(0); 498| 34| } 499| | 500| 0| if(sequence_numbers != nullptr) { ------------------ | Branch (500:7): [True: 0, False: 0] ------------------ 501| 0| sequence_numbers->read_accept(sequence); 502| 0| } 503| | 504| 0| readbuf.clear(); 505| 0| return Record_Header(sequence, version, type); 506| 34|} tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_114fill_buffer_toERNSt3__16vectorIhNS_16secure_allocatorIhEEEERPKhRmSB_m: 262| 17.0k| secure_vector& readbuf, const uint8_t*& input, size_t& input_size, size_t& input_consumed, size_t desired) { 263| 17.0k| if(readbuf.size() >= desired) { ------------------ | Branch (263:7): [True: 581, False: 16.4k] ------------------ 264| 581| return 0; // already have it 265| 581| } 266| | 267| 16.4k| const size_t taken = std::min(input_size, desired - readbuf.size()); 268| | 269| 16.4k| readbuf.insert(readbuf.end(), input, input + taken); 270| 16.4k| input_consumed += taken; 271| 16.4k| input_size -= taken; 272| 16.4k| input += taken; 273| | 274| 16.4k| return (desired - readbuf.size()); // how many bytes do we still need? 275| 17.0k|} tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_114decrypt_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEEPhmmNS0_16Protocol_VersionENS0_11Record_TypeERNS0_23Connection_Cipher_StateE: 283| 313| Connection_Cipher_State& cs) { 284| 313| AEAD_Mode& aead = cs.aead(); 285| | 286| 313| const std::vector nonce = cs.aead_nonce(record_contents, record_len, record_sequence); 287| 313| const size_t nonce_from_record = cs.nonce_bytes_from_record(); 288| 313| if(record_len <= nonce_from_record) { ------------------ | Branch (288:7): [True: 1, False: 312] ------------------ 289| 1| throw TLS_Exception(Alert::BadRecordMac, "AEAD packet too short to be valid"); 290| 1| } 291| 312| const uint8_t* msg = &record_contents[nonce_from_record]; 292| 312| const size_t msg_length = record_len - nonce_from_record; 293| | 294| | /* 295| | * This early rejection is based just on public information (length of the 296| | * encrypted packet) and so does not leak any information. We used to use 297| | * decode_error here which really is more appropriate, but that confuses some 298| | * tools which are attempting automated detection of padding oracles, 299| | * including older versions of TLS-Attacker. 300| | */ 301| 312| if(msg_length < aead.minimum_final_size()) { ------------------ | Branch (301:7): [True: 4, False: 308] ------------------ 302| 4| throw TLS_Exception(Alert::BadRecordMac, "AEAD packet is shorter than the tag"); 303| 4| } 304| | 305| 308| const size_t ptext_size = aead.output_length(msg_length); 306| | 307| 308| aead.set_associated_data( 308| 308| cs.format_ad(record_sequence, record_type, record_version, static_cast(ptext_size))); 309| | 310| 308| aead.start(nonce); 311| | 312| 308| output.assign(msg, msg + msg_length); 313| 308| aead.finish(output, 0); 314| 308|} tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_115read_tls_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKhmRmS7_PNS0_27Connection_Sequence_NumbersERKNS2_8functionIFNS2_10shared_ptrINS0_23Connection_Cipher_StateEEEtEEE: 322| 7.03k| const get_cipherstate_fn& get_cipherstate) { 323| 7.03k| if(readbuf.size() < TLS_HEADER_SIZE) { ------------------ | Branch (323:7): [True: 7.03k, False: 0] ------------------ 324| | // header incomplete 325| 7.03k| if(const size_t needed = fill_buffer_to(readbuf, input, input_len, consumed, TLS_HEADER_SIZE)) { ------------------ | Branch (325:23): [True: 185, False: 6.84k] ------------------ 326| 185| return Record_Header(needed); 327| 185| } 328| | 329| 6.84k| BOTAN_ASSERT_EQUAL(readbuf.size(), TLS_HEADER_SIZE, "Have an entire header"); ------------------ | | 90| 6.84k| do { \ | | 91| 6.84k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 92| 6.84k| if((expr1) != (expr2)) { \ | | ------------------ | | | Branch (92:10): [True: 0, False: 6.84k] | | ------------------ | | 93| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 94| 0| Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \ | | 95| 0| } \ | | 96| 6.84k| } while(0) | | ------------------ | | | Branch (96:12): [Folded, False: 6.84k] | | ------------------ ------------------ 330| 6.84k| } 331| | 332| | /* 333| | Verify that the record type and record version are within some expected 334| | range, so we can quickly reject totally invalid packets. 335| | 336| | Unfortunately we cannot be more strict about the record number than just 337| | checking the major version, at least at this level, due to this requirement 338| | in RFC 7568 339| | 340| | TLS servers MUST accept any value {03,XX} (including {03,00}) as 341| | the record layer version number for ClientHello 342| | */ 343| 6.84k| const bool bad_record_type = readbuf[0] < 20 || readbuf[0] > 23; ------------------ | Branch (343:33): [True: 78, False: 6.76k] | Branch (343:52): [True: 81, False: 6.68k] ------------------ 344| 6.84k| const bool bad_record_version = readbuf[1] != 3; 345| | 346| 6.84k| if(bad_record_type || bad_record_version) { ------------------ | Branch (346:7): [True: 159, False: 6.68k] | Branch (346:26): [True: 8, False: 6.67k] ------------------ 347| | // We know we read up to at least the 5 byte TLS header 348| 167| const std::string first5 = std::string(reinterpret_cast(readbuf.data()), 5); 349| | 350| 167| if(first5 == "GET /" || first5 == "PUT /" || first5 == "POST " || first5 == "HEAD ") { ------------------ | Branch (350:10): [True: 2, False: 165] | Branch (350:31): [True: 2, False: 163] | Branch (350:52): [True: 1, False: 162] | Branch (350:73): [True: 2, False: 160] ------------------ 351| 7| throw TLS_Exception(Alert::ProtocolVersion, "Client sent plaintext HTTP request instead of TLS handshake"); 352| 7| } 353| | 354| 160| if(first5 == "CONNE") { ------------------ | Branch (354:10): [True: 1, False: 159] ------------------ 355| 1| throw TLS_Exception(Alert::ProtocolVersion, 356| 1| "Client sent plaintext HTTP proxy CONNECT request instead of TLS handshake"); 357| 1| } 358| | 359| 159| if(bad_record_type) { ------------------ | Branch (359:10): [True: 151, False: 8] ------------------ 360| | // RFC 5246 Section 6. 361| | // If a TLS implementation receives an unexpected record type, it MUST 362| | // send an unexpected_message alert. 363| 151| throw TLS_Exception(Alert::UnexpectedMessage, "TLS record type had unexpected value"); 364| 151| } 365| 8| throw TLS_Exception(Alert::ProtocolVersion, "TLS record version had unexpected value"); 366| 159| } 367| | 368| 6.67k| const Protocol_Version version(readbuf[1], readbuf[2]); 369| | 370| 6.67k| if(version.is_datagram_protocol()) { ------------------ | Branch (370:7): [True: 0, False: 6.67k] ------------------ 371| 0| throw TLS_Exception(Alert::ProtocolVersion, "Expected TLS but got a record with DTLS version"); 372| 0| } 373| | 374| 6.67k| const size_t record_size = make_uint16(readbuf[TLS_HEADER_SIZE - 2], readbuf[TLS_HEADER_SIZE - 1]); 375| | 376| 6.67k| if(record_size > MAX_CIPHERTEXT_SIZE) { ------------------ | Branch (376:7): [True: 7, False: 6.67k] ------------------ 377| 7| throw TLS_Exception(Alert::RecordOverflow, "Received a record that exceeds maximum size"); 378| 7| } 379| | 380| 6.67k| if(record_size == 0) { ------------------ | Branch (380:7): [True: 3, False: 6.66k] ------------------ 381| 3| throw TLS_Exception(Alert::DecodeError, "Received a completely empty record"); 382| 3| } 383| | 384| 6.66k| if(const size_t needed = fill_buffer_to(readbuf, input, input_len, consumed, TLS_HEADER_SIZE + record_size)) { ------------------ | Branch (384:20): [True: 101, False: 6.56k] ------------------ 385| 101| return Record_Header(needed); 386| 101| } 387| | 388| 6.56k| BOTAN_ASSERT_EQUAL(static_cast(TLS_HEADER_SIZE) + record_size, readbuf.size(), "Have the full record"); ------------------ | | 90| 6.56k| do { \ | | 91| 6.56k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 92| 6.56k| if((expr1) != (expr2)) { \ | | ------------------ | | | Branch (92:10): [True: 0, False: 6.56k] | | ------------------ | | 93| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 94| 0| Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \ | | 95| 0| } \ | | 96| 6.56k| } while(0) | | ------------------ | | | Branch (96:12): [Folded, False: 6.56k] | | ------------------ ------------------ 389| | 390| 6.56k| const Record_Type type = static_cast(readbuf[0]); 391| | 392| 6.56k| uint16_t epoch = 0; 393| | 394| 6.56k| uint64_t sequence = 0; 395| 6.56k| if(sequence_numbers != nullptr) { ------------------ | Branch (395:7): [True: 3.15k, False: 3.41k] ------------------ 396| 3.15k| sequence = sequence_numbers->next_read_sequence(); 397| 3.15k| epoch = sequence_numbers->current_read_epoch(); 398| 3.41k| } else { 399| | // server initial handshake case 400| 3.41k| epoch = 0; 401| 3.41k| } 402| | 403| 6.56k| if(epoch == 0) { ------------------ | Branch (403:7): [True: 6.25k, False: 313] ------------------ 404| | // Unencrypted initial handshake 405| 6.25k| recbuf.assign(readbuf.begin() + TLS_HEADER_SIZE, readbuf.begin() + TLS_HEADER_SIZE + record_size); 406| 6.25k| readbuf.clear(); 407| 6.25k| return Record_Header(sequence, version, type); 408| 6.25k| } 409| | 410| | // Otherwise, decrypt, check MAC, return plaintext 411| 313| auto cs = get_cipherstate(epoch); 412| | 413| 313| BOTAN_ASSERT(cs, "Have cipherstate for this epoch"); ------------------ | | 64| 313| do { \ | | 65| 313| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 313| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 313] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 313| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 313] | | ------------------ ------------------ 414| | 415| 313| decrypt_record(recbuf, &readbuf[TLS_HEADER_SIZE], record_size, sequence, version, type, *cs); 416| | 417| 313| if(sequence_numbers != nullptr) { ------------------ | Branch (417:7): [True: 0, False: 313] ------------------ 418| 0| sequence_numbers->read_accept(sequence); 419| 0| } 420| | 421| 313| readbuf.clear(); 422| 313| return Record_Header(sequence, version, type); 423| 6.56k|} _ZN5Botan3TLS14Server_Impl_12C2ERKNSt3__110shared_ptrINS0_9CallbacksEEERKNS3_INS0_15Session_ManagerEEERKNS3_INS_19Credentials_ManagerEEERKNS3_IKNS0_6PolicyEEERKNS3_INS_21RandomNumberGeneratorEEEbm: 293| 672| Channel_Impl_12(callbacks, session_manager, rng, policy, true, is_datagram, io_buf_sz), m_creds(creds) { 294| 672| BOTAN_ASSERT_NONNULL(m_creds); ------------------ | | 116| 672| do { \ | | 117| 672| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 672] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 672| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 672] | | ------------------ ------------------ 295| | 296| | // Try to load the cookie secret on initialization, rather than waiting to fail 297| | // until the first client connects. 298| 672| if(is_datagram && policy->dtls_server_require_cookie_exchange()) { ------------------ | Branch (298:7): [True: 672, False: 0] | Branch (298:22): [True: 672, False: 0] ------------------ 299| 672| load_dtls_cookie_secret(*m_creds); 300| 672| } 301| 672|} _ZN5Botan3TLS14Server_Impl_12C2ERKNS0_12Channel_Impl21Downgrade_InformationE: 306| 3.13k| Channel_Impl_12(downgrade_info.callbacks, 307| 3.13k| downgrade_info.session_manager, 308| 3.13k| downgrade_info.rng, 309| 3.13k| downgrade_info.policy, 310| 3.13k| true /* is_server*/, 311| 3.13k| false /* TLS 1.3 does not support DTLS yet */, 312| 3.13k| downgrade_info.io_buffer_size), 313| 3.13k| m_creds(downgrade_info.creds) {} _ZN5Botan3TLS14Server_Impl_1219new_handshake_stateENSt3__110unique_ptrINS0_12Handshake_IOENS2_14default_deleteIS4_EEEE: 317| 3.65k|std::unique_ptr Server_Impl_12::new_handshake_state(std::unique_ptr io) { 318| 3.65k| auto state = std::make_unique(std::move(io), callbacks()); 319| 3.65k| state->set_expected_next(Handshake_Type::ClientHello); 320| 3.65k| return state; 321| 3.65k|} _ZN5Botan3TLS14Server_Impl_1224process_client_hello_msgERNS0_22Server_Handshake_StateERKNSt3__16vectorIhNS4_9allocatorIhEEEEb: 392| 3.15k| bool epoch0_restart) { 393| 3.15k| BOTAN_ASSERT_IMPLICATION(epoch0_restart, active_state().has_value(), "Can't restart with a dead connection"); ------------------ | | 103| 3.15k| do { \ | | 104| 3.15k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 105| 3.15k| if((expr1) && !(expr2)) { \ | | ------------------ | | | Branch (105:10): [True: 0, False: 3.15k] | | | Branch (105:21): [True: 0, False: 0] | | ------------------ | | 106| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 107| 0| Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \ | | 108| 0| } \ | | 109| 3.15k| } while(0) | | ------------------ | | | Branch (109:12): [Folded, False: 3.15k] | | ------------------ ------------------ 394| | 395| 3.15k| const bool initial_handshake = epoch0_restart || !active_state().has_value(); ------------------ | Branch (395:35): [True: 0, False: 3.15k] | Branch (395:53): [True: 3.15k, False: 0] ------------------ 396| | 397| 3.15k| if(initial_handshake == false && policy().allow_client_initiated_renegotiation() == false) { ------------------ | Branch (397:7): [True: 0, False: 3.15k] | Branch (397:37): [True: 0, False: 0] ------------------ 398| 0| if(policy().abort_connection_on_undesired_renegotiation()) { ------------------ | Branch (398:10): [True: 0, False: 0] ------------------ 399| 0| throw TLS_Exception(Alert::NoRenegotiation, "Server policy prohibits renegotiation"); 400| 0| } else { 401| 0| send_warning_alert(Alert::NoRenegotiation); 402| 0| } 403| 0| return; 404| 0| } 405| | 406| 3.15k| if(!policy().allow_insecure_renegotiation() && !(initial_handshake || secure_renegotiation_supported())) { ------------------ | Branch (406:7): [True: 3.15k, False: 0] | Branch (406:53): [True: 3.15k, False: 0] | Branch (406:74): [True: 0, False: 0] ------------------ 407| 0| send_warning_alert(Alert::NoRenegotiation); 408| 0| return; 409| 0| } 410| | 411| 3.15k| if(pending_state.handshake_io().have_more_data()) { ------------------ | Branch (411:7): [True: 5, False: 3.14k] ------------------ 412| 5| throw TLS_Exception(Alert::UnexpectedMessage, "Have data remaining in buffer after ClientHello"); 413| 5| } 414| | 415| 3.14k| pending_state.client_hello(std::make_unique(contents)); 416| 3.14k| const Protocol_Version client_offer = pending_state.client_hello()->legacy_version(); 417| 3.14k| const bool datagram = client_offer.is_datagram_protocol(); 418| | 419| 3.14k| if(datagram) { ------------------ | Branch (419:7): [True: 43, False: 3.10k] ------------------ 420| 43| if(client_offer.major_version() == 0xFF) { ------------------ | Branch (420:10): [True: 2, False: 41] ------------------ 421| 2| throw TLS_Exception(Alert::ProtocolVersion, "Client offered DTLS version with major version 0xFF"); 422| 2| } 423| 3.10k| } else { 424| 3.10k| if(client_offer.major_version() < 3) { ------------------ | Branch (424:10): [True: 7, False: 3.09k] ------------------ 425| 7| throw TLS_Exception(Alert::ProtocolVersion, "Client offered TLS version with major version under 3"); 426| 7| } 427| 3.09k| if(client_offer.major_version() == 3 && client_offer.minor_version() == 0) { ------------------ | Branch (427:10): [True: 24, False: 3.07k] | Branch (427:47): [True: 2, False: 22] ------------------ 428| 2| throw TLS_Exception(Alert::ProtocolVersion, "Client offered SSLv3 which is not supported"); 429| 2| } 430| 3.09k| } 431| | 432| | /* 433| | * BoGo test suite expects that we will send the hello verify with a record 434| | * version matching the version that is eventually negotiated. This is wrong 435| | * but harmless, so go with it. Also doing the version negotiation step first 436| | * allows to immediately close the connection with an alert if the client has 437| | * offered a version that we are not going to negotiate anyway, instead of 438| | * making them first do the cookie exchange and then telling them no. 439| | * 440| | * There is no issue with amplification here, since the alert is just 2 bytes. 441| | */ 442| 3.13k| const Protocol_Version negotiated_version = 443| 3.13k| select_version(policy(), 444| 3.13k| client_offer, 445| 3.13k| active_state().has_value() ? active_state()->version() : Protocol_Version(), ------------------ | Branch (445:22): [True: 0, False: 3.13k] ------------------ 446| 3.13k| pending_state.client_hello()->supported_versions()); 447| | 448| 3.13k| pending_state.set_version(negotiated_version); 449| | 450| 3.13k| const auto compression_methods = pending_state.client_hello()->compression_methods(); 451| 3.13k| if(!value_exists(compression_methods, uint8_t(0))) { ------------------ | Branch (451:7): [True: 36, False: 3.09k] ------------------ 452| 36| throw TLS_Exception(Alert::IllegalParameter, "Client did not offer NULL compression"); 453| 36| } 454| | 455| 3.09k| if(initial_handshake && datagram && policy().dtls_server_require_cookie_exchange()) { ------------------ | Branch (455:7): [True: 3.07k, False: 25] | Branch (455:28): [True: 27, False: 3.04k] | Branch (455:40): [True: 27, False: 0] ------------------ 456| | // The cookie secret is read each time to allow for refreshing the key 457| 27| const auto cookie_secret = load_dtls_cookie_secret(*m_creds); 458| | 459| 27| const std::string client_identity = callbacks().tls_peer_network_identity(); 460| 27| if(client_identity.empty()) { ------------------ | Branch (460:10): [True: 27, False: 0] ------------------ 461| | // RFC 9147 Section 11: the cookie MUST depend on the client's address 462| | // 463| | // Without an application-supplied identity the cookie is reusable from 464| | // any source address, defeating the whole point of the cookie exchange. 465| | // 466| | // TODO(Botan4): Remove the version hint about the breaking change. 467| 27| throw Invalid_State( 468| 27| "Since Botan 3.13 DTLS server requires tls_peer_network_identity() return a non-empty value"); 469| 27| } 470| 0| const Hello_Verify_Request verify( 471| 0| pending_state.client_hello()->cookie_input_data(), client_identity, cookie_secret); 472| | 473| 0| if(!CT::is_equal(pending_state.client_hello()->cookie(), verify.cookie()).as_bool()) { ------------------ | Branch (473:10): [True: 0, False: 0] ------------------ 474| 0| if(epoch0_restart) { ------------------ | Branch (474:13): [True: 0, False: 0] ------------------ 475| 0| pending_state.handshake_io().send_under_epoch(verify, 0); 476| 0| } else { 477| 0| pending_state.handshake_io().send(verify); 478| 0| } 479| | 480| 0| pending_state.client_hello(nullptr); 481| 0| pending_state.set_expected_next(Handshake_Type::ClientHello); 482| 0| return; 483| 0| } 484| 0| } 485| | 486| 3.07k| if(epoch0_restart) { ------------------ | Branch (486:7): [True: 0, False: 3.07k] ------------------ 487| | // If we reached here then we were able to verify the cookie 488| 0| reset_active_association_state(); 489| 0| } 490| | 491| 3.07k| secure_renegotiation_check(pending_state.client_hello()); 492| | 493| | // RFC 7627 / RFC 9325 4.4: optionally require Extended Master Secret 494| 3.07k| if(policy().require_extended_master_secret() && !pending_state.client_hello()->supports_extended_master_secret()) { ------------------ | Branch (494:7): [True: 3.04k, False: 26] | Branch (494:52): [True: 70, False: 2.97k] ------------------ 495| 70| throw TLS_Exception(Alert::HandshakeFailure, 496| 70| "Policy requires the Extended Master Secret extension but the client did not send it"); 497| 70| } 498| | 499| | // RFC 7627 5.3 has an explicit MUST regarding EMS mismatch on resumption 500| | // 501| | // "If the original session used the 'extended_master_secret' 502| | // extension but the new ClientHello does not contain it, the 503| | // server MUST abort the abbreviated handshake." 504| | // 505| | // There is apparently no RFC requirement that a client must not drop EMS between the 506| | // initial negotiation and a renegotiation... but there is also no RFC requirement 507| | // that we must accept it. So we don't. 508| 3.00k| if(const auto& active = active_state()) { ------------------ | Branch (508:19): [True: 0, False: 3.00k] ------------------ 509| 0| const bool ems_pending = pending_state.client_hello()->supports_extended_master_secret(); 510| 0| if(active->supports_extended_master_secret() == true && ems_pending == false) { ------------------ | Branch (510:10): [True: 0, False: 0] | Branch (510:63): [True: 0, False: 0] ------------------ 511| 0| throw TLS_Exception(Alert::HandshakeFailure, 512| 0| "Renegotiation ClientHello dropped the Extended Master Secret extension"); 513| 0| } 514| 0| } 515| | 516| 3.00k| callbacks().tls_examine_extensions( 517| 3.00k| pending_state.client_hello()->extensions(), Connection_Side::Client, Handshake_Type::ClientHello); 518| | 519| 3.00k| const auto session_handle = pending_state.client_hello()->session_handle(); 520| | 521| 3.00k| std::optional session_info; 522| 3.00k| if(pending_state.allow_session_resumption() && session_handle.has_value()) { ------------------ | Branch (522:7): [True: 2.97k, False: 26] | Branch (522:51): [True: 37, False: 2.93k] ------------------ 523| 37| session_info = check_for_resume( 524| 37| session_handle.value(), session_manager(), callbacks(), policy(), pending_state.client_hello()); 525| 37| } 526| | 527| 3.00k| m_next_protocol = ""; 528| 3.00k| if(pending_state.client_hello()->supports_alpn()) { ------------------ | Branch (528:7): [True: 32, False: 2.96k] ------------------ 529| 32| const auto offered = pending_state.client_hello()->next_protocols(); 530| 32| m_next_protocol = callbacks().tls_server_choose_app_protocol(offered); 531| | // RFC 7301 3.2: if a protocol is selected, the server MUST select one 532| | // of the protocols advertised by the client. An empty return signals 533| | // "no ALPN" and is allowed. 534| 32| if(!m_next_protocol.empty() && !value_exists(offered, m_next_protocol)) { ------------------ | Branch (534:10): [True: 32, False: 0] | Branch (534:38): [True: 2, False: 30] ------------------ 535| 2| throw TLS_Exception(Alert::InternalError, "Application chose an ALPN protocol that the client did not offer"); 536| 2| } 537| 32| } 538| | 539| 2.99k| if(session_info.has_value()) { ------------------ | Branch (539:7): [True: 0, False: 2.99k] ------------------ 540| 0| this->session_resume(pending_state, {session_info.value(), session_handle.value()}); 541| 2.99k| } else { 542| | // new session 543| 2.99k| this->session_create(pending_state); 544| 2.99k| } 545| 2.99k|} _ZN5Botan3TLS14Server_Impl_1231process_client_key_exchange_msgERNS0_22Server_Handshake_StateERKNSt3__16vectorIhNS4_9allocatorIhEEEE: 560| 2.15k| const std::vector& contents) { 561| 2.15k| if(pending_state.received_handshake_msg(Handshake_Type::Certificate) && !pending_state.client_certs()->empty()) { ------------------ | Branch (561:7): [True: 0, False: 2.15k] | Branch (561:76): [True: 0, False: 0] ------------------ 562| 0| pending_state.set_expected_next(Handshake_Type::CertificateVerify); 563| 2.15k| } else { 564| 2.15k| pending_state.set_expected_next(Handshake_Type::HandshakeCCS); 565| 2.15k| } 566| | 567| 2.15k| pending_state.client_kex(std::make_unique( 568| 2.15k| contents, pending_state, pending_state.server_rsa_kex_key(), *m_creds, policy(), rng())); 569| | 570| 2.15k| pending_state.compute_session_keys(); 571| 2.15k| if(policy().allow_ssl_key_log_file()) { ------------------ | Branch (571:7): [True: 0, False: 2.15k] ------------------ 572| | // draft-thomson-tls-keylogfile-00 Section 3.2 573| | // An implementation of TLS 1.2 (and also earlier versions) use 574| | // the label "CLIENT_RANDOM" to identify the "master" secret for 575| | // the connection. 576| 0| callbacks().tls_ssl_key_log_data( 577| 0| "CLIENT_RANDOM", pending_state.client_hello()->random(), pending_state.session_keys().master_secret()); 578| 0| } 579| 2.15k|} _ZN5Botan3TLS14Server_Impl_1230process_change_cipher_spec_msgERNS0_22Server_Handshake_StateE: 581| 385|void Server_Impl_12::process_change_cipher_spec_msg(Server_Handshake_State& pending_state) { 582| 385| pending_state.set_expected_next(Handshake_Type::Finished); 583| 385| change_cipher_spec_reader(Connection_Side::Server); 584| 385|} _ZN5Botan3TLS14Server_Impl_1220process_finished_msgERNS0_22Server_Handshake_StateENS0_14Handshake_TypeERKNSt3__16vectorIhNS5_9allocatorIhEEEE: 636| 102| const std::vector& contents) { 637| 102| pending_state.set_expected_next(Handshake_Type::None); 638| | 639| 102| if(pending_state.handshake_io().have_more_data()) { ------------------ | Branch (639:7): [True: 6, False: 96] ------------------ 640| 6| throw TLS_Exception(Alert::UnexpectedMessage, "Have data remaining in buffer after Finished"); 641| 6| } 642| | 643| 96| pending_state.client_finished(std::make_unique(contents)); 644| | 645| 96| if(!pending_state.client_finished()->verify(pending_state, Connection_Side::Client)) { ------------------ | Branch (645:7): [True: 0, False: 96] ------------------ 646| 0| throw TLS_Exception(Alert::DecryptError, "Finished message didn't verify"); 647| 0| } 648| | 649| 96| if(pending_state.server_finished() == nullptr) { ------------------ | Branch (649:7): [True: 96, False: 0] ------------------ 650| | // already sent finished if resuming, so this is a new session 651| | 652| 96| pending_state.hash().update(pending_state.handshake_io().format(contents, type)); 653| | 654| 96| Session session_info(pending_state.session_keys().master_secret(), 655| 96| pending_state.server_hello()->legacy_version(), 656| 96| pending_state.server_hello()->ciphersuite(), 657| 96| Connection_Side::Server, 658| 96| pending_state.server_hello()->supports_extended_master_secret(), 659| 96| pending_state.server_hello()->supports_encrypt_then_mac(), 660| 96| pending_state.peer_cert_chain(), 661| 96| Server_Information(pending_state.client_hello()->sni_hostname()), 662| 96| pending_state.server_hello()->srtp_profile(), 663| 96| callbacks().tls_current_timestamp()); 664| | 665| | // Give the application a chance for a final veto before fully 666| | // establishing the connection. 667| 96| callbacks().tls_session_established([&] { 668| 96| Session_Summary summary(session_info, pending_state.is_a_resumption(), pending_state.psk_identity()); 669| 96| summary.set_session_id(pending_state.server_hello()->session_id()); 670| 96| return summary; 671| 96| }()); 672| | 673| 96| if(callbacks().tls_should_persist_resumption_information(session_info)) { ------------------ | Branch (673:10): [True: 96, False: 0] ------------------ 674| 96| auto handle = session_manager().establish(session_info, 675| 96| pending_state.server_hello()->session_id(), 676| 96| !pending_state.server_hello()->supports_session_ticket()); 677| | 678| 96| if(pending_state.server_hello()->supports_session_ticket() && handle.has_value() && handle->is_ticket()) { ------------------ | Branch (678:13): [True: 0, False: 96] | Branch (678:72): [True: 0, False: 0] | Branch (678:94): [True: 0, False: 0] ------------------ 679| 0| pending_state.new_session_ticket(std::make_unique( 680| 0| pending_state.handshake_io(), 681| 0| pending_state.hash(), 682| 0| handle->ticket().value(), 683| 0| static_cast(policy().session_ticket_lifetime().count()))); 684| 0| } 685| | 686| 96| note_resumption_handle(handle); 687| 96| } 688| | 689| 96| if(pending_state.new_session_ticket() == nullptr && pending_state.server_hello()->supports_session_ticket()) { ------------------ | Branch (689:10): [True: 96, False: 0] | Branch (689:59): [True: 0, False: 96] ------------------ 690| 0| pending_state.new_session_ticket( 691| 0| std::make_unique(pending_state.handshake_io(), pending_state.hash())); 692| 0| } 693| | 694| 96| pending_state.handshake_io().send(Change_Cipher_Spec()); 695| | 696| 96| change_cipher_spec_writer(Connection_Side::Server); 697| | 698| 96| pending_state.server_finished( 699| 96| std::make_unique(pending_state.handshake_io(), pending_state, Connection_Side::Server)); 700| 96| } 701| | 702| 96| activate_session(); 703| 96|} _ZN5Botan3TLS14Server_Impl_1221process_handshake_msgERNS0_15Handshake_StateENS0_14Handshake_TypeERKNSt3__16vectorIhNS5_9allocatorIhEEEEb: 711| 5.85k| bool epoch0_restart) { 712| 5.85k| Server_Handshake_State& state = dynamic_cast(state_base); 713| 5.85k| state.confirm_transition_to(type); 714| | 715| | /* 716| | * The change cipher spec message isn't technically a handshake 717| | * message so it's not included in the hash. The finished and 718| | * certificate verify messages are verified based on the current 719| | * state of the hash *before* this message so we delay adding them 720| | * to the hash computation until we've processed them below. 721| | */ 722| 5.85k| if(type != Handshake_Type::HandshakeCCS && type != Handshake_Type::Finished && ------------------ | Branch (722:7): [True: 5.40k, False: 449] | Branch (722:47): [True: 5.30k, False: 102] ------------------ 723| 5.30k| type != Handshake_Type::CertificateVerify) { ------------------ | Branch (723:7): [True: 5.30k, False: 0] ------------------ 724| 5.30k| state.hash().update(state.handshake_io().format(contents, type)); 725| 5.30k| } 726| | 727| 5.85k| switch(type) { 728| 3.15k| case Handshake_Type::ClientHello: ------------------ | Branch (728:7): [True: 3.15k, False: 2.70k] ------------------ 729| 3.15k| return this->process_client_hello_msg(state, contents, epoch0_restart); 730| | 731| 0| case Handshake_Type::Certificate: ------------------ | Branch (731:7): [True: 0, False: 5.85k] ------------------ 732| 0| return this->process_certificate_msg(state, contents); 733| | 734| 2.15k| case Handshake_Type::ClientKeyExchange: ------------------ | Branch (734:7): [True: 2.15k, False: 3.70k] ------------------ 735| 2.15k| return this->process_client_key_exchange_msg(state, contents); 736| | 737| 0| case Handshake_Type::CertificateVerify: ------------------ | Branch (737:7): [True: 0, False: 5.85k] ------------------ 738| 0| return this->process_certificate_verify_msg(state, type, contents); 739| | 740| 385| case Handshake_Type::HandshakeCCS: ------------------ | Branch (740:7): [True: 385, False: 5.47k] ------------------ 741| 385| return this->process_change_cipher_spec_msg(state); 742| | 743| 102| case Handshake_Type::Finished: ------------------ | Branch (743:7): [True: 102, False: 5.75k] ------------------ 744| 102| return this->process_finished_msg(state, type, contents); 745| | 746| 0| default: ------------------ | Branch (746:7): [True: 0, False: 5.85k] ------------------ 747| 0| throw Unexpected_Message("Unknown handshake message received"); 748| 5.85k| } 749| 5.85k|} _ZN5Botan3TLS14Server_Impl_1214session_createERNS0_22Server_Handshake_StateE: 826| 2.97k|void Server_Impl_12::session_create(Server_Handshake_State& pending_state) { 827| 2.97k| std::map> cert_chains; 828| | 829| 2.97k| const std::string sni_hostname = pending_state.client_hello()->sni_hostname(); 830| | 831| | // RFC 8446 1.3 832| | // The "signature_algorithms_cert" extension allows a client to indicate 833| | // which signature algorithms it can validate in X.509 certificates. 834| | // 835| | // RFC 8446 4.2.3 836| | // TLS 1.2 implementations SHOULD also process this extension. 837| 2.97k| const auto cert_signature_schemes = pending_state.client_hello()->certificate_signature_schemes(); 838| 2.97k| cert_chains = get_server_certs(sni_hostname, cert_signature_schemes, *m_creds); 839| | 840| 2.97k| if(!sni_hostname.empty() && cert_chains.empty()) { ------------------ | Branch (840:7): [True: 5, False: 2.96k] | Branch (840:32): [True: 0, False: 5] ------------------ 841| 0| cert_chains = get_server_certs("", cert_signature_schemes, *m_creds); 842| | 843| | /* 844| | * Only send the unrecognized_name alert if we couldn't 845| | * find any certs for the requested name but did find at 846| | * least one cert to use in general. That avoids sending an 847| | * unrecognized_name when a server is configured for purely 848| | * anonymous/PSK operation. 849| | */ 850| 0| if(!cert_chains.empty()) { ------------------ | Branch (850:10): [True: 0, False: 0] ------------------ 851| 0| send_warning_alert(Alert::UnrecognizedName); 852| 0| } 853| 0| } 854| | 855| 2.97k| const uint16_t ciphersuite = 856| 2.97k| choose_ciphersuite(policy(), pending_state.version(), cert_chains, *pending_state.client_hello()); 857| | 858| 2.97k| const Server_Hello_12::Settings srv_settings(Session_ID(make_hello_random(rng(), callbacks(), policy())), 859| 2.97k| pending_state.version(), 860| 2.97k| ciphersuite, 861| 2.97k| session_manager().emits_session_tickets()); 862| | 863| 2.97k| pending_state.server_hello(std::make_unique(pending_state.handshake_io(), 864| 2.97k| pending_state.hash(), 865| 2.97k| policy(), 866| 2.97k| callbacks(), 867| 2.97k| rng(), 868| 2.97k| secure_renegotiation_data_for_server_hello(), 869| 2.97k| *pending_state.client_hello(), 870| 2.97k| srv_settings, 871| 2.97k| m_next_protocol)); 872| | 873| 2.97k| secure_renegotiation_check(pending_state.server_hello()); 874| | 875| 2.97k| const Ciphersuite& pending_suite = pending_state.ciphersuite(); 876| | 877| 2.97k| std::shared_ptr private_key; 878| | 879| 2.97k| if(pending_suite.is_certificate_required()) { ------------------ | Branch (879:7): [True: 5, False: 2.96k] ------------------ 880| 5| const std::string algo_used = pending_suite.signature_used() ? pending_suite.sig_algo() : "RSA"; ------------------ | Branch (880:37): [True: 5, False: 0] ------------------ 881| | 882| 5| BOTAN_ASSERT(!cert_chains[algo_used].empty(), "Attempting to send empty certificate chain"); ------------------ | | 64| 5| do { \ | | 65| 5| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 5| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, False: 5] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 5| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 5] | | ------------------ ------------------ 883| | 884| 5| pending_state.server_certs( 885| 5| std::make_unique(pending_state.handshake_io(), pending_state.hash(), cert_chains[algo_used])); 886| | 887| 5| if(pending_state.client_hello()->supports_cert_status_message() && pending_state.is_a_resumption() == false) { ------------------ | Branch (887:10): [True: 3, False: 2] | Branch (887:74): [True: 3, False: 0] ------------------ 888| 3| auto* csr = pending_state.client_hello()->extensions().get(); 889| | // csr is non-null if client_hello()->supports_cert_status_message() 890| 3| BOTAN_ASSERT_NOMSG(csr != nullptr); ------------------ | | 77| 3| do { \ | | 78| 3| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 3| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 3] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 3| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 3] | | ------------------ ------------------ 891| 3| const auto resp_bytes = callbacks().tls_provide_cert_status(cert_chains[algo_used], *csr); 892| 3| if(!resp_bytes.empty()) { ------------------ | Branch (892:13): [True: 0, False: 3] ------------------ 893| 0| pending_state.server_cert_status( 894| 0| std::make_unique(pending_state.handshake_io(), pending_state.hash(), resp_bytes)); 895| 0| } 896| 3| } 897| | 898| 5| private_key = m_creds->private_key_for(pending_state.server_certs()->cert_chain()[0], "tls-server", sni_hostname); 899| | 900| 5| if(!private_key) { ------------------ | Branch (900:10): [True: 5, False: 0] ------------------ 901| 5| throw Internal_Error("No private key located for associated server cert"); 902| 5| } 903| 5| } 904| | 905| 2.96k| if(pending_suite.kex_method() == Kex_Algo::STATIC_RSA) { ------------------ | Branch (905:7): [True: 0, False: 2.96k] ------------------ 906| 0| pending_state.set_server_rsa_kex_key(private_key); 907| 2.96k| } else { 908| 2.96k| pending_state.server_kex(std::make_unique( 909| 2.96k| pending_state.handshake_io(), pending_state, policy(), *m_creds, rng(), private_key.get())); 910| 2.96k| } 911| | 912| 2.96k| auto trusted_CAs = m_creds->trusted_certificate_authorities("tls-server", sni_hostname); 913| | 914| 2.96k| std::vector client_auth_CAs; 915| | 916| 2.96k| for(auto* store : trusted_CAs) { ------------------ | Branch (916:20): [True: 0, False: 2.96k] ------------------ 917| 0| auto subjects = store->all_subjects(); 918| 0| client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end()); 919| 0| } 920| | 921| 2.96k| const bool request_cert = (client_auth_CAs.empty() == false) || policy().request_client_certificate_authentication(); ------------------ | Branch (921:30): [True: 209, False: 2.75k] | Branch (921:68): [True: 0, False: 2.75k] ------------------ 922| | 923| | // RFC 5246 7.4.4: supported_signature_algorithms<2..2^16-2> 924| | // Without at least one acceptable scheme we cannot construct a valid 925| | // CertificateRequest, so client cert auth is unreachable regardless. 926| 2.96k| const bool can_request_cert = !policy().acceptable_signature_schemes().empty(); 927| | 928| 2.96k| if(request_cert && can_request_cert && pending_state.ciphersuite().is_certificate_required()) { ------------------ | Branch (928:7): [True: 0, False: 2.96k] | Branch (928:23): [True: 0, False: 0] | Branch (928:43): [True: 0, False: 0] ------------------ 929| 0| pending_state.cert_req(std::make_unique( 930| 0| pending_state.handshake_io(), pending_state.hash(), policy(), client_auth_CAs)); 931| | 932| | /* 933| | SSLv3 allowed clients to skip the Certificate message entirely 934| | if they wanted. In TLS v1.0 and later clients must send a 935| | (possibly empty) Certificate message 936| | */ 937| 0| pending_state.set_expected_next(Handshake_Type::Certificate); 938| 2.96k| } else { 939| 2.96k| pending_state.set_expected_next(Handshake_Type::ClientKeyExchange); 940| 2.96k| } 941| | 942| 2.96k| pending_state.server_hello_done( 943| 2.96k| std::make_unique(pending_state.handshake_io(), pending_state.hash())); 944| 2.96k|} tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_123load_dtls_cookie_secretERNS_19Credentials_ManagerE: 262| 699|secure_vector load_dtls_cookie_secret(Credentials_Manager& creds) { 263| 699| auto cookie_secret = [&]() -> secure_vector { 264| 699| try { 265| 699| return creds.psk("tls-server", "dtls-cookie-secret", "").bits_of(); 266| 699| } catch(...) { 267| 699| return {}; 268| 699| } 269| 699| }(); 270| | 271| 699| if(cookie_secret.empty()) { ------------------ | Branch (271:7): [True: 0, False: 699] ------------------ 272| | // TODO(Botan4): Simplify this error message that was meant to ease the 273| | // burden on users running into a deliberate semver violation. 274| 0| throw Invalid_State( 275| 0| "Since Botan 3.13 DTLS server requires setting a non-empty cookie secret. " 276| 0| "Either override Credentials_Manager::dtls_cookie_secret() or disable the " 277| 0| "cookie exchange using TLS::Policy::dtls_server_require_cookie_exchange(), " 278| 0| "if you understand the security implications of doing so."); 279| 0| } 280| | 281| 699| return cookie_secret; 282| 699|} tls_server_impl_12.cpp:_ZZN5Botan3TLS12_GLOBAL__N_123load_dtls_cookie_secretERNS_19Credentials_ManagerEENK3$_0clEv: 263| 699| auto cookie_secret = [&]() -> secure_vector { 264| 699| try { 265| 699| return creds.psk("tls-server", "dtls-cookie-secret", "").bits_of(); 266| 699| } catch(...) { 267| 0| return {}; 268| 0| } 269| 699| }(); tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_114select_versionERKNS0_6PolicyENS0_16Protocol_VersionES5_RKNSt3__16vectorIS5_NS6_9allocatorIS5_EEEE: 337| 3.12k| const std::vector& supported_versions) { 338| 3.12k| const bool is_datagram = client_offer.is_datagram_protocol(); 339| 3.12k| const bool initial_handshake = (active_version.valid() == false); 340| | 341| 3.12k| if(!supported_versions.empty()) { ------------------ | Branch (341:7): [True: 18, False: 3.10k] ------------------ 342| 18| if(is_datagram) { ------------------ | Branch (342:10): [True: 7, False: 11] ------------------ 343| 7| if(policy.allow_dtls12() && value_exists(supported_versions, Protocol_Version(Protocol_Version::DTLS_V12))) { ------------------ | Branch (343:13): [True: 7, False: 0] | Branch (343:13): [True: 1, False: 6] | Branch (343:38): [True: 1, False: 6] ------------------ 344| 1| return Protocol_Version::DTLS_V12; 345| 1| } 346| 6| throw TLS_Exception(Alert::ProtocolVersion, "No shared DTLS version"); 347| 11| } else { 348| 11| if(policy.allow_tls12() && value_exists(supported_versions, Protocol_Version(Protocol_Version::TLS_V12))) { ------------------ | Branch (348:13): [True: 11, False: 0] | Branch (348:13): [True: 5, False: 6] | Branch (348:37): [True: 5, False: 6] ------------------ 349| 5| return Protocol_Version::TLS_V12; 350| 5| } 351| 6| throw TLS_Exception(Alert::ProtocolVersion, "No shared TLS version"); 352| 11| } 353| 18| } 354| | 355| 3.10k| if(!initial_handshake) { ------------------ | Branch (355:7): [True: 0, False: 3.10k] ------------------ 356| | /* 357| | * If this is a renegotiation, and the client has offered a 358| | * later version than what it initially negotiated, negotiate 359| | * the old version. This matches OpenSSL's behavior. If the 360| | * client is offering a version earlier than what it initially 361| | * negotiated, reject as a probable attack. 362| | */ 363| 0| if(active_version > client_offer) { ------------------ | Branch (363:10): [True: 0, False: 0] ------------------ 364| 0| throw TLS_Exception( 365| 0| Alert::ProtocolVersion, 366| 0| "Client negotiated " + active_version.to_string() + " then renegotiated with " + client_offer.to_string()); 367| 0| } else { 368| 0| return active_version; 369| 0| } 370| 0| } 371| | 372| 3.10k| if(is_datagram) { ------------------ | Branch (372:7): [True: 34, False: 3.07k] ------------------ 373| 34| if(policy.allow_dtls12() && client_offer >= Protocol_Version::DTLS_V12) { ------------------ | Branch (373:10): [True: 34, False: 0] | Branch (373:10): [True: 32, False: 2] | Branch (373:35): [True: 32, False: 2] ------------------ 374| 32| return Protocol_Version::DTLS_V12; 375| 32| } 376| 3.07k| } else { 377| 3.07k| if(policy.allow_tls12() && client_offer >= Protocol_Version::TLS_V12) { ------------------ | Branch (377:10): [True: 3.07k, False: 0] | Branch (377:10): [True: 3.07k, False: 1] | Branch (377:34): [True: 3.07k, False: 1] ------------------ 378| 3.07k| return Protocol_Version::TLS_V12; 379| 3.07k| } 380| 3.07k| } 381| | 382| 3| throw TLS_Exception(Alert::ProtocolVersion, 383| 3| "Client version " + client_offer.to_string() + " is unacceptable by policy"); 384| 3.10k|} _ZNK5Botan3TLS22Server_Handshake_State24allow_session_resumptionEv: 34| 2.97k| bool allow_session_resumption() const { return m_allow_session_resumption; } tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_116check_for_resumeERKNS0_14Session_HandleERNS0_15Session_ManagerERNS0_9CallbacksERKNS0_6PolicyEPKNS0_15Client_Hello_12E: 79| 37| const Client_Hello_12* client_hello) { 80| 37| auto session = session_manager.retrieve(handle_to_resume, cb, policy); 81| 37| if(!session.has_value()) { ------------------ | Branch (81:7): [True: 37, False: 0] ------------------ 82| 37| return std::nullopt; 83| 37| } 84| | 85| | // wrong version 86| 0| if(client_hello->legacy_version() != session->version()) { ------------------ | Branch (86:7): [True: 0, False: 0] ------------------ 87| 0| return std::nullopt; 88| 0| } 89| | 90| | // client didn't send original ciphersuite 91| 0| if(!value_exists(client_hello->ciphersuites(), session->ciphersuite_code())) { ------------------ | Branch (91:7): [True: 0, False: 0] ------------------ 92| 0| return std::nullopt; 93| 0| } 94| | 95| | // client sent a different SNI hostname 96| 0| if(!client_hello->sni_hostname().empty() && client_hello->sni_hostname() != session->server_info().hostname()) { ------------------ | Branch (96:7): [True: 0, False: 0] | Branch (96:7): [True: 0, False: 0] | Branch (96:48): [True: 0, False: 0] ------------------ 97| 0| return std::nullopt; 98| 0| } 99| | 100| | // Checking extended_master_secret on resume (RFC 7627 section 5.3) 101| 0| if(client_hello->supports_extended_master_secret() != session->supports_extended_master_secret()) { ------------------ | Branch (101:7): [True: 0, False: 0] ------------------ 102| 0| if(!session->supports_extended_master_secret()) { ------------------ | Branch (102:10): [True: 0, False: 0] ------------------ 103| 0| return std::nullopt; // force new handshake with extended master secret 104| 0| } else { 105| | /* 106| | Client previously negotiated session with extended master secret, 107| | but has now attempted to resume without the extension: abort 108| | */ 109| 0| throw TLS_Exception(Alert::HandshakeFailure, "Client resumed extended ms session without sending extension"); 110| 0| } 111| 0| } 112| | 113| | // Checking encrypt_then_mac on resume (RFC 7366 section 3.1) 114| 0| if(!client_hello->supports_encrypt_then_mac() && session->supports_encrypt_then_mac()) { ------------------ | Branch (114:7): [True: 0, False: 0] | Branch (114:53): [True: 0, False: 0] ------------------ 115| | /* 116| | Client previously negotiated session with Encrypt-then-MAC, 117| | but has now attempted to resume without the extension: abort 118| | */ 119| 0| throw TLS_Exception(Alert::HandshakeFailure, "Client resumed Encrypt-then-MAC session without sending extension"); 120| 0| } 121| | 122| 0| return session; 123| 0|} _ZN5Botan3TLS22Server_Handshake_State18server_rsa_kex_keyEv: 30| 2.15k| Private_Key* server_rsa_kex_key() { return m_server_rsa_kex_key.get(); } _ZNK5Botan3TLS22Server_Handshake_State15peer_cert_chainEv: 48| 192| std::vector peer_cert_chain() const override { 49| 192| if(!m_resume_peer_certs.empty()) { ------------------ | Branch (49:13): [True: 0, False: 192] ------------------ 50| 0| return m_resume_peer_certs; 51| 0| } 52| 192| if(client_certs() != nullptr) { ------------------ | Branch (52:13): [True: 0, False: 192] ------------------ 53| 0| return client_certs()->cert_chain(); 54| 0| } 55| 192| return {}; 56| 192| } tls_server_impl_12.cpp:_ZZN5Botan3TLS14Server_Impl_1220process_finished_msgERNS0_22Server_Handshake_StateENS0_14Handshake_TypeERKNSt3__16vectorIhNS5_9allocatorIhEEEEENK3$_0clEv: 667| 96| callbacks().tls_session_established([&] { 668| 96| Session_Summary summary(session_info, pending_state.is_a_resumption(), pending_state.psk_identity()); 669| 96| summary.set_session_id(pending_state.server_hello()->session_id()); 670| 96| return summary; 671| 96| }()); tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_116get_server_certsENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEERKNS2_6vectorINS0_16Signature_SchemeENS2_9allocatorIS8_EEEERNS_19Credentials_ManagerE: 245| 2.97k| std::string_view hostname, const std::vector& cert_sig_schemes, Credentials_Manager& creds) { 246| 2.97k| const std::vector cert_types = {"RSA", "ECDSA"}; 247| | 248| 2.97k| std::map> cert_chains; 249| | 250| 5.94k| for(const auto& cert_type : cert_types) { ------------------ | Branch (250:30): [True: 5.94k, False: 2.97k] ------------------ 251| 5.94k| const std::vector certs = creds.cert_chain_single_type( 252| 5.94k| cert_type, to_algorithm_identifiers(cert_sig_schemes), "tls-server", std::string(hostname)); 253| | 254| 5.94k| if(!certs.empty()) { ------------------ | Branch (254:10): [True: 2.97k, False: 2.97k] ------------------ 255| 2.97k| cert_chains[cert_type] = certs; 256| 2.97k| } 257| 5.94k| } 258| | 259| 2.97k| return cert_chains; 260| 2.97k|} tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_118choose_ciphersuiteERKNS0_6PolicyENS0_16Protocol_VersionERKNSt3__13mapINS6_12basic_stringIcNS6_11char_traitsIcEENS6_9allocatorIcEEEENS6_6vectorINS_16X509_CertificateENSB_ISF_EEEENS6_4lessISD_EENSB_INS6_4pairIKSD_SH_EEEEEERKNS0_15Client_Hello_12E: 131| 2.97k| const Client_Hello_12& client_hello) { 132| 2.97k| const bool our_choice = policy.server_uses_own_ciphersuite_preferences(); 133| 2.97k| const std::vector& client_suites = client_hello.ciphersuites(); 134| 2.97k| const std::vector server_suites = policy.ciphersuite_list(version); 135| | 136| 2.97k| if(server_suites.empty()) { ------------------ | Branch (136:7): [True: 0, False: 2.97k] ------------------ 137| 0| throw TLS_Exception(Alert::HandshakeFailure, "Policy forbids us from negotiating any ciphersuite"); 138| 0| } 139| | 140| 2.97k| const bool have_shared_ecc_curve = 141| 2.97k| (policy.choose_key_exchange_group(client_hello.supported_ecc_curves(), {}) != Group_Params::NONE); 142| | 143| 2.97k| const bool client_supports_ffdhe_groups = !client_hello.supported_dh_groups().empty(); 144| | 145| 2.97k| const bool have_shared_dh_group = 146| 2.97k| (policy.choose_key_exchange_group(client_hello.supported_dh_groups(), {}) != Group_Params::NONE); 147| | 148| 2.97k| const std::unordered_set client_suite_set(client_suites.begin(), client_suites.end()); 149| | 150| 2.97k| const std::vector allowed_sig_schemes = policy.allowed_signature_schemes(); 151| 2.97k| const std::vector client_sig_methods = client_hello.signature_schemes(); 152| | 153| | // Algorithm names (eg "RSA", "ECDSA") for which the client offered at least 154| | // one signature_scheme that is available, is in our policy, and uses a hash we accept. 155| 2.97k| const std::unordered_set client_sig_algs = [&] { 156| 2.97k| std::unordered_set allowed_codes; 157| 2.97k| allowed_codes.reserve(allowed_sig_schemes.size()); 158| 2.97k| for(auto s : allowed_sig_schemes) { 159| 2.97k| allowed_codes.insert(static_cast(s.wire_code())); 160| 2.97k| } 161| 2.97k| std::unordered_set result; 162| 2.97k| for(const Signature_Scheme scheme : client_sig_methods) { 163| 2.97k| if(!scheme.is_available()) { 164| 2.97k| continue; 165| 2.97k| } 166| 2.97k| if(!allowed_codes.contains(static_cast(scheme.wire_code()))) { 167| 2.97k| continue; 168| 2.97k| } 169| 2.97k| if(!policy.allowed_signature_hash(scheme.hash_function_name())) { 170| 2.97k| continue; 171| 2.97k| } 172| 2.97k| result.insert(scheme.algorithm_name()); 173| 2.97k| } 174| 2.97k| return result; 175| 2.97k| }(); 176| | 177| | /* 178| | Walk down one list in preference order 179| | */ 180| 2.97k| const std::vector& pref_list = our_choice ? server_suites : client_suites; ------------------ | Branch (180:45): [True: 2.97k, False: 0] ------------------ 181| | 182| 2.97k| auto in_other_list = [&](uint16_t suite_id) { 183| | // server_suites is small and policy-controlled 184| 2.97k| return our_choice ? client_suite_set.contains(suite_id) : value_exists(server_suites, suite_id); 185| 2.97k| }; 186| | 187| 176k| for(auto suite_id : pref_list) { ------------------ | Branch (187:22): [True: 176k, False: 209] ------------------ 188| 176k| if(!in_other_list(suite_id)) { ------------------ | Branch (188:10): [True: 173k, False: 2.98k] ------------------ 189| 173k| continue; 190| 173k| } 191| | 192| 2.98k| const auto suite = Ciphersuite::by_id(suite_id); 193| | 194| 2.98k| if(!suite.has_value() || !suite->valid()) { ------------------ | Branch (194:10): [True: 0, False: 2.98k] | Branch (194:32): [True: 0, False: 2.98k] ------------------ 195| 0| continue; 196| 0| } 197| | 198| 2.98k| if(have_shared_ecc_curve == false && suite->ecc_ciphersuite()) { ------------------ | Branch (198:10): [True: 173, False: 2.81k] | Branch (198:44): [True: 26, False: 147] ------------------ 199| 26| continue; 200| 26| } 201| | 202| 2.96k| if(suite->kex_method() == Kex_Algo::DH && client_supports_ffdhe_groups && !have_shared_dh_group) { ------------------ | Branch (202:10): [True: 49, False: 2.91k] | Branch (202:49): [True: 26, False: 23] | Branch (202:81): [True: 26, False: 0] ------------------ 203| 26| continue; 204| 26| } 205| | 206| | // For non-anon ciphersuites 207| 2.93k| if(suite->is_certificate_required()) { ------------------ | Branch (207:10): [True: 177, False: 2.75k] ------------------ 208| 177| const std::string cert_algo = suite->signature_used() ? suite->sig_algo() : "RSA"; ------------------ | Branch (208:40): [True: 150, False: 27] ------------------ 209| | 210| | // Do we have any certificates for this sig? 211| 177| if(!cert_chains.contains(cert_algo)) { ------------------ | Branch (211:13): [True: 94, False: 83] ------------------ 212| 94| continue; 213| 94| } 214| 177| } 215| | 216| 2.84k| if(suite->signature_used()) { ------------------ | Branch (216:10): [True: 83, False: 2.75k] ------------------ 217| | // The client's signature_algorithms list might not include a scheme 218| | // matching this suite's sig_algo (e.g. the client offered ECDSA 219| | // schemes but we're considering an RSA suite). That's just a 220| | // mismatch on this candidate, not a handshake-fatal condition - try 221| | // the next suite. The final "Can't agree on a ciphersuite" throw 222| | // below fires only if no candidate works. 223| 83| if(!client_sig_algs.contains(suite->sig_algo())) { ------------------ | Branch (223:13): [True: 78, False: 5] ------------------ 224| 78| continue; 225| 78| } 226| 83| } 227| | 228| 2.76k| return suite_id; 229| 2.84k| } 230| | 231| | // RFC 7919 Section 4. 232| | // If the [Supported Groups] extension is present 233| | // with FFDHE groups, none of the client’s offered groups are acceptable 234| | // by the server, and none of the client’s proposed non-FFDHE cipher 235| | // suites are acceptable to the server, the server MUST end the 236| | // connection with a fatal TLS alert of type insufficient_security(71). 237| 209| if(client_supports_ffdhe_groups && !have_shared_dh_group) { ------------------ | Branch (237:7): [True: 26, False: 183] | Branch (237:39): [True: 26, False: 0] ------------------ 238| 26| throw TLS_Exception(Alert::InsufficientSecurity, "Can't agree on a sufficiently strong ciphersuite with client"); 239| 26| } 240| | 241| 183| throw TLS_Exception(Alert::HandshakeFailure, "Can't agree on a ciphersuite with client"); 242| 209|} tls_server_impl_12.cpp:_ZZN5Botan3TLS12_GLOBAL__N_118choose_ciphersuiteERKNS0_6PolicyENS0_16Protocol_VersionERKNSt3__13mapINS6_12basic_stringIcNS6_11char_traitsIcEENS6_9allocatorIcEEEENS6_6vectorINS_16X509_CertificateENSB_ISF_EEEENS6_4lessISD_EENSB_INS6_4pairIKSD_SH_EEEEEERKNS0_15Client_Hello_12EENK3$_0clEv: 155| 2.97k| const std::unordered_set client_sig_algs = [&] { 156| 2.97k| std::unordered_set allowed_codes; 157| 2.97k| allowed_codes.reserve(allowed_sig_schemes.size()); 158| 35.6k| for(auto s : allowed_sig_schemes) { ------------------ | Branch (158:18): [True: 35.6k, False: 2.97k] ------------------ 159| 35.6k| allowed_codes.insert(static_cast(s.wire_code())); 160| 35.6k| } 161| 2.97k| std::unordered_set result; 162| 15.8k| for(const Signature_Scheme scheme : client_sig_methods) { ------------------ | Branch (162:41): [True: 15.8k, False: 2.97k] ------------------ 163| 15.8k| if(!scheme.is_available()) { ------------------ | Branch (163:13): [True: 10.1k, False: 5.67k] ------------------ 164| 10.1k| continue; 165| 10.1k| } 166| 5.67k| if(!allowed_codes.contains(static_cast(scheme.wire_code()))) { ------------------ | Branch (166:13): [True: 0, False: 5.67k] ------------------ 167| 0| continue; 168| 0| } 169| 5.67k| if(!policy.allowed_signature_hash(scheme.hash_function_name())) { ------------------ | Branch (169:13): [True: 0, False: 5.67k] ------------------ 170| 0| continue; 171| 0| } 172| 5.67k| result.insert(scheme.algorithm_name()); 173| 5.67k| } 174| 2.97k| return result; 175| 2.97k| }(); tls_server_impl_12.cpp:_ZZN5Botan3TLS12_GLOBAL__N_118choose_ciphersuiteERKNS0_6PolicyENS0_16Protocol_VersionERKNSt3__13mapINS6_12basic_stringIcNS6_11char_traitsIcEENS6_9allocatorIcEEEENS6_6vectorINS_16X509_CertificateENSB_ISF_EEEENS6_4lessISD_EENSB_INS6_4pairIKSD_SH_EEEEEERKNS0_15Client_Hello_12EENK3$_1clEt: 182| 176k| auto in_other_list = [&](uint16_t suite_id) { 183| | // server_suites is small and policy-controlled 184| 176k| return our_choice ? client_suite_set.contains(suite_id) : value_exists(server_suites, suite_id); ------------------ | Branch (184:14): [True: 176k, False: 0] ------------------ 185| 176k| }; _ZNK5Botan3TLS22Server_Handshake_State15is_a_resumptionEv: 46| 99| bool is_a_resumption() const { return m_is_a_resumption; } _ZN5Botan3TLS22Server_Handshake_StateC2ENSt3__110unique_ptrINS0_12Handshake_IOENS2_14default_deleteIS4_EEEERNS0_9CallbacksE: 28| 3.65k| Server_Handshake_State(std::unique_ptr io, Callbacks& cb) : Handshake_State(std::move(io), cb) {} _ZN5Botan3TLS12Session_KeysC2EPKNS0_15Handshake_StateERKNSt3__16vectorIhNS_16secure_allocatorIhEEEEb: 22| 1.40k| bool resuming) { 23| 1.40k| BOTAN_ASSERT_NONNULL(state); ------------------ | | 116| 1.40k| do { \ | | 117| 1.40k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 1.40k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 1.40k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 1.40k] | | ------------------ ------------------ 24| 1.40k| BOTAN_ASSERT_NONNULL(state->client_hello()); ------------------ | | 116| 1.40k| do { \ | | 117| 1.40k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 1.40k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 1.40k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 1.40k] | | ------------------ ------------------ 25| 1.40k| BOTAN_ASSERT_NONNULL(state->server_hello()); ------------------ | | 116| 1.40k| do { \ | | 117| 1.40k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 1.40k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 1.40k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 1.40k] | | ------------------ ------------------ 26| | 27| 1.40k| const auto& suite = state->ciphersuite(); 28| 1.40k| BOTAN_STATE_CHECK(suite.valid()); ------------------ | | 51| 1.40k| do { \ | | 52| 1.40k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 1.40k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 1.40k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 1.40k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 1.40k] | | ------------------ ------------------ 29| | 30| 1.40k| const size_t cipher_keylen = suite.cipher_keylen(); 31| 1.40k| const size_t mac_keylen = suite.mac_keylen(); 32| 1.40k| const size_t cipher_nonce_bytes = suite.nonce_bytes_from_handshake(); 33| | 34| 1.40k| const bool extended_master_secret = state->server_hello()->supports_extended_master_secret(); 35| | 36| 1.40k| const size_t prf_gen = 2 * (mac_keylen + cipher_keylen + cipher_nonce_bytes); 37| | 38| 1.40k| const uint8_t MASTER_SECRET_MAGIC[] = {0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74}; 39| | 40| 1.40k| const uint8_t EXT_MASTER_SECRET_MAGIC[] = {0x65, 0x78, 0x74, 0x65, 0x6E, 0x64, 0x65, 0x64, 0x20, 0x6D, 0x61, 41| 1.40k| 0x73, 0x74, 0x65, 0x72, 0x20, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74}; 42| | 43| 1.40k| const uint8_t KEY_GEN_MAGIC[] = {0x6B, 0x65, 0x79, 0x20, 0x65, 0x78, 0x70, 0x61, 0x6E, 0x73, 0x69, 0x6F, 0x6E}; 44| | 45| 1.40k| auto prf = state->protocol_specific_prf(); 46| | 47| 1.40k| if(resuming) { ------------------ | Branch (47:7): [True: 0, False: 1.40k] ------------------ 48| | // This is actually the master secret saved as part of the session 49| 0| m_master_sec = pre_master_secret; 50| 1.40k| } else { 51| 1.40k| std::vector salt; 52| 1.40k| std::vector label; 53| 1.40k| if(extended_master_secret) { ------------------ | Branch (53:10): [True: 1.40k, False: 0] ------------------ 54| 1.40k| label.assign(EXT_MASTER_SECRET_MAGIC, EXT_MASTER_SECRET_MAGIC + sizeof(EXT_MASTER_SECRET_MAGIC)); 55| 1.40k| salt += state->hash().final(suite.prf_algo()); 56| 1.40k| } else { 57| 0| label.assign(MASTER_SECRET_MAGIC, MASTER_SECRET_MAGIC + sizeof(MASTER_SECRET_MAGIC)); 58| 0| salt += state->client_hello()->random(); 59| 0| salt += state->server_hello()->random(); 60| 0| } 61| | 62| 1.40k| m_master_sec = prf->derive_key(48, pre_master_secret, salt, label); 63| 1.40k| } 64| | 65| 1.40k| std::vector salt; 66| 1.40k| std::vector label; 67| 1.40k| label.assign(KEY_GEN_MAGIC, KEY_GEN_MAGIC + sizeof(KEY_GEN_MAGIC)); 68| 1.40k| salt += state->server_hello()->random(); 69| 1.40k| salt += state->client_hello()->random(); 70| | 71| 1.40k| const secure_vector prf_output = prf->derive_key( 72| 1.40k| prf_gen, m_master_sec.data(), m_master_sec.size(), salt.data(), salt.size(), label.data(), label.size()); 73| | 74| 1.40k| const uint8_t* key_data = prf_output.data(); 75| | 76| 1.40k| m_c_aead.resize(mac_keylen + cipher_keylen); 77| 1.40k| m_s_aead.resize(mac_keylen + cipher_keylen); 78| | 79| | // NOLINTBEGIN(readability-container-data-pointer) 80| 1.40k| copy_mem(&m_c_aead[0], key_data, mac_keylen); 81| 1.40k| copy_mem(&m_s_aead[0], key_data + mac_keylen, mac_keylen); 82| | // NOLINTEND(readability-container-data-pointer) 83| | 84| | // Key is not used for NULL suites 85| 1.40k| if(cipher_keylen > 0) { ------------------ | Branch (85:7): [True: 1.40k, False: 0] ------------------ 86| 1.40k| copy_mem(&m_c_aead[mac_keylen], key_data + 2 * mac_keylen, cipher_keylen); 87| 1.40k| copy_mem(&m_s_aead[mac_keylen], key_data + 2 * mac_keylen + cipher_keylen, cipher_keylen); 88| 1.40k| } else { 89| 0| BOTAN_STATE_CHECK(suite.null_ciphersuite()); ------------------ | | 51| 0| do { \ | | 52| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 0| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 0] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 0| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 0] | | ------------------ ------------------ 90| 0| } 91| | 92| 1.40k| if(cipher_nonce_bytes > 0) { ------------------ | Branch (92:7): [True: 796, False: 610] ------------------ 93| 796| const uint8_t* c_nonce_bytes = key_data + 2 * (mac_keylen + cipher_keylen); 94| 796| m_c_nonce.assign(c_nonce_bytes, c_nonce_bytes + cipher_nonce_bytes); 95| | 96| 796| const uint8_t* s_nonce_bytes = key_data + 2 * (mac_keylen + cipher_keylen) + cipher_nonce_bytes; 97| 796| m_s_nonce.assign(s_nonce_bytes, s_nonce_bytes + cipher_nonce_bytes); 98| 796| } 99| 1.40k|} _ZN5Botan3TLS21Certificate_Verify_13C2ENSt3__14spanIKhLm18446744073709551615EEENS0_15Connection_SideE: 87| 59| Certificate_Verify(buf), m_side(side) { 88| 59| if(!m_scheme.is_available()) { ------------------ | Branch (88:7): [True: 31, False: 28] ------------------ 89| 31| throw TLS_Exception(Alert::IllegalParameter, "Peer sent unknown signature scheme"); 90| 31| } 91| | 92| 28| if(!m_scheme.is_compatible_with(Protocol_Version::TLS_V13)) { ------------------ | Branch (92:7): [True: 3, False: 25] ------------------ 93| 3| throw TLS_Exception(Alert::IllegalParameter, "Peer sent signature algorithm that is not suitable for TLS 1.3"); 94| 3| } 95| 28|} _ZN5Botan3TLS14Certificate_1317Certificate_EntryC2ERNS0_15TLS_Data_ReaderENS0_15Connection_SideENS0_16Certificate_TypeE: 278| 502| Certificate_Type cert_type) { 279| 502| if(cert_type == Certificate_Type::X509) { ------------------ | Branch (279:7): [True: 502, False: 0] ------------------ 280| | // RFC 8446 4.2.2 281| | // [...] each CertificateEntry contains a DER-encoded X.509 282| | // certificate. 283| 502| const auto cert_bytes = reader.get_tls_length_value(3); 284| 502| try { 285| 502| m_certificate = std::make_unique(cert_bytes); 286| 502| m_raw_public_key = m_certificate->subject_public_key(); 287| 502| } catch(Exception& e) { 288| | // bad_certificate would make more sense but BoGo expects decoding_error 289| 490| throw TLS_Exception(Alert::DecodeError, e.what()); 290| 490| } 291| 502| } else if(cert_type == Certificate_Type::RawPublicKey) { ------------------ | Branch (291:14): [True: 0, False: 0] ------------------ 292| | // RFC 7250 3. 293| | // This specification uses raw public keys whereby the already 294| | // available encoding used in a PKIX certificate in the form of a 295| | // SubjectPublicKeyInfo structure is reused. 296| 0| try { 297| 0| m_raw_public_key = X509::load_key(reader.get_tls_length_value(3)); 298| 0| } catch(Exception& e) { 299| 0| throw TLS_Exception(Alert::DecodeError, e.what()); 300| 0| } 301| 0| } else { 302| 0| throw TLS_Exception(Alert::InternalError, "Unknown certificate type"); 303| 0| } 304| | 305| | // Extensions are simply tacked at the end of the certificate entry. This 306| | // is a departure from the typical "tag-length-value" in a sense that the 307| | // Extensions deserializer needs the length value of the extensions. 308| 0| const size_t extensions_length = reader.peek_uint16_t(); 309| 0| const auto exts_buf = reader.get_fixed(extensions_length + 2); 310| 0| TLS_Data_Reader exts_reader("extensions reader", exts_buf); 311| 0| m_extensions.deserialize(exts_reader, side, Handshake_Type::Certificate); 312| | 313| 0| if(cert_type == Certificate_Type::X509) { ------------------ | Branch (313:7): [True: 0, False: 0] ------------------ 314| | // RFC 8446 4.4.2 315| | // Valid extensions for server certificates at present include the 316| | // OCSP Status extension [RFC6066] and the SignedCertificateTimestamp 317| | // extension [RFC6962]; future extensions may be defined for this 318| | // message as well. 319| | // 320| | // RFC 8446 4.4.2.1 321| | // A server MAY request that a client present an OCSP response with its 322| | // certificate by sending an empty "status_request" extension in its 323| | // CertificateRequest message. 324| 0| if(m_extensions.contains_implemented_extensions_other_than({ ------------------ | Branch (324:10): [True: 0, False: 0] ------------------ 325| 0| Extension_Code::CertificateStatusRequest, 326| | // Extension_Code::SignedCertificateTimestamp 327| 0| })) { 328| 0| throw TLS_Exception(Alert::IllegalParameter, "Certificate Entry contained an extension that is not allowed"); 329| 0| } 330| 0| } else if(m_extensions.contains_implemented_extensions_other_than({})) { ------------------ | Branch (330:14): [True: 0, False: 0] ------------------ 331| 0| throw TLS_Exception( 332| 0| Alert::IllegalParameter, 333| 0| "Certificate Entry holding something else than a certificate contained unexpected extensions"); 334| 0| } 335| 0|} _ZN5Botan3TLS14Certificate_13C2ENSt3__14spanIKhLm18446744073709551615EEERKNS0_6PolicyENS0_15Connection_SideENS0_16Certificate_TypeE: 372| 543| m_side(side) { 373| 543| TLS_Data_Reader reader("cert message reader", buf); 374| | 375| 543| m_request_context = reader.get_range(1, 0, 255); 376| | 377| | // RFC 8446 4.4.2 378| | // [...] in the case of server authentication, this field SHALL be zero length. 379| 543| if(m_side == Connection_Side::Server && !m_request_context.empty()) { ------------------ | Branch (379:7): [True: 0, False: 543] | Branch (379:44): [True: 0, False: 0] ------------------ 380| 0| throw TLS_Exception(Alert::IllegalParameter, "Server Certificate message must not contain a request context"); 381| 0| } 382| | 383| 543| const auto cert_entries_len = reader.get_uint24_t(); 384| | 385| 543| if(reader.remaining_bytes() != cert_entries_len) { ------------------ | Branch (385:7): [True: 28, False: 515] ------------------ 386| 28| throw TLS_Exception(Alert::DecodeError, "Certificate: Message malformed"); 387| 28| } 388| | 389| 515| const size_t max_size = policy.maximum_certificate_chain_size(); 390| 515| if(max_size > 0 && cert_entries_len > max_size) { ------------------ | Branch (390:7): [True: 506, False: 9] | Branch (390:23): [True: 0, False: 506] ------------------ 391| 0| throw Decoding_Error("Certificate chain exceeds policy specified maximum size"); 392| 0| } 393| | 394| 1.01k| while(reader.has_remaining()) { ------------------ | Branch (394:10): [True: 502, False: 515] ------------------ 395| 502| m_entries.emplace_back(reader, side, cert_type); 396| 502| } 397| | 398| | // RFC 8446 4.4.2 399| | // The server's certificate_list MUST always be non-empty. A client 400| | // will send an empty certificate_list if it does not have an 401| | // appropriate certificate to send in response to the server's 402| | // authentication request. 403| 515| if(m_entries.empty()) { ------------------ | Branch (403:7): [True: 4, False: 511] ------------------ 404| | // RFC 8446 4.4.2.4 405| | // If the server supplies an empty Certificate message, the client MUST 406| | // abort the handshake with a "decode_error" alert. 407| 4| if(m_side == Connection_Side::Server) { ------------------ | Branch (407:10): [True: 0, False: 4] ------------------ 408| 0| throw TLS_Exception(Alert::DecodeError, "No certificates sent by server"); 409| 0| } 410| | 411| 4| return; 412| 4| } 413| | 414| 511| BOTAN_ASSERT_NOMSG(!m_entries.empty()); ------------------ | | 77| 511| do { \ | | 78| 511| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 511| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 511] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 511| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 511] | | ------------------ ------------------ 415| | 416| | // RFC 8446 4.4.2.2 417| | // The certificate type MUST be X.509v3 [RFC5280], unless explicitly 418| | // negotiated otherwise (e.g., [RFC7250]). 419| | // 420| | // TLS 1.0 through 1.3 all seem to require that the certificate be 421| | // precisely a v3 certificate. In fact the strict wording would seem 422| | // to require that every certificate in the chain be v3. But often 423| | // the intermediates are outside of the control of the server. 424| | // But, require that the leaf certificate be v3. 425| 511| if(cert_type == Certificate_Type::X509 && m_entries.front().certificate().x509_version() != 3) { ------------------ | Branch (425:7): [True: 0, False: 511] | Branch (425:46): [True: 0, False: 0] ------------------ 426| 0| throw TLS_Exception(Alert::BadCertificate, "The leaf certificate must be v3"); 427| 0| } 428| | 429| | // RFC 8446 4.4.2 430| | // If the RawPublicKey certificate type was negotiated, then the 431| | // certificate_list MUST contain no more than one CertificateEntry. 432| 511| if(cert_type == Certificate_Type::RawPublicKey && m_entries.size() != 1) { ------------------ | Branch (432:7): [True: 0, False: 511] | Branch (432:54): [True: 0, False: 0] ------------------ 433| 0| throw TLS_Exception(Alert::IllegalParameter, "Certificate message contained more than one RawPublicKey"); 434| 0| } 435| | 436| | // Validate the provided (certificate) public key against our policy 437| 511| auto pubkey = public_key(); 438| 511| policy.check_peer_key_acceptable(*pubkey); 439| | 440| 511| if(!policy.allowed_signature_method(pubkey->algo_name())) { ------------------ | Branch (440:7): [True: 0, False: 511] ------------------ 441| 0| throw TLS_Exception(Alert::HandshakeFailure, "Rejecting " + pubkey->algo_name() + " signature"); 442| 0| } 443| 511|} _ZN5Botan3TLS22Certificate_Request_13C2ENSt3__14spanIKhLm18446744073709551615EEENS0_15Connection_SideE: 25| 1|Certificate_Request_13::Certificate_Request_13(std::span buf, const Connection_Side side) { 26| 1| TLS_Data_Reader reader("Certificate_Request_13", buf); 27| | 28| | // RFC 8446 4.3.2 29| | // A server which is authenticating with a certificate MAY optionally 30| | // request a certificate from the client. 31| 1| if(side != Connection_Side::Server) { ------------------ | Branch (31:7): [True: 1, False: 0] ------------------ 32| 1| throw TLS_Exception(Alert::UnexpectedMessage, "Received a Certificate_Request message from a client"); 33| 1| } 34| | 35| 0| m_context = reader.get_tls_length_value(1); 36| 0| m_extensions.deserialize(reader, side, type()); 37| | 38| | // RFC 8446 4.3.2 39| | // The "signature_algorithms" extension MUST be specified, and other 40| | // extensions may optionally be included if defined for this message. 41| | // Clients MUST ignore unrecognized extensions. 42| | 43| 0| if(!m_extensions.has()) { ------------------ | Branch (43:7): [True: 0, False: 0] ------------------ 44| 0| throw TLS_Exception(Alert::MissingExtension, 45| 0| "Certificate_Request message did not provide a signature_algorithms extension"); 46| 0| } 47| | 48| | // RFC 8446 4.2. 49| | // The table below indicates the messages where a given extension may 50| | // appear [...]. If an implementation receives an extension which it 51| | // recognizes and which is not specified for the message in which it 52| | // appears, it MUST abort the handshake with an "illegal_parameter" alert. 53| | // 54| | // For Certificate Request said table states: 55| | // "status_request", "signature_algorithms", "signed_certificate_timestamp", 56| | // "certificate_authorities", "oid_filters", "signature_algorithms_cert", 57| 0| const std::set allowed_extensions = { 58| 0| Extension_Code::CertificateStatusRequest, 59| 0| Extension_Code::SignatureAlgorithms, 60| | // Extension_Code::SignedCertificateTimestamp, // NYI 61| 0| Extension_Code::CertificateAuthorities, 62| | // Extension_Code::OidFilters, // NYI 63| 0| Extension_Code::CertSignatureAlgorithms, 64| 0| }; 65| | 66| 0| if(m_extensions.contains_implemented_extensions_other_than(allowed_extensions)) { ------------------ | Branch (66:7): [True: 0, False: 0] ------------------ 67| 0| throw TLS_Exception(Alert::IllegalParameter, "Certificate Request contained an extension that is not allowed"); 68| 0| } 69| | 70| 0| reader.assert_done(); 71| 0|} _ZN5Botan3TLS15Client_Hello_13C2ENSt3__110unique_ptrINS0_21Client_Hello_InternalENS2_14default_deleteIS4_EEEE: 30| 34|Client_Hello_13::Client_Hello_13(std::unique_ptr data) : Client_Hello(std::move(data)) { 31| 34| const auto& exts = m_data->extensions(); 32| | 33| | // RFC 8446 4.1.2 34| | // TLS 1.3 ClientHellos are identified as having a legacy_version of 35| | // 0x0303 and a "supported_versions" extension present with 0x0304 as the 36| | // highest version indicated therein. 37| | // 38| | // Note that we already checked for "supported_versions" before entering this 39| | // c'tor in `Client_Hello_13::parse()`. This is just to be doubly sure. 40| 34| BOTAN_ASSERT_NOMSG(exts.has()); ------------------ | | 77| 34| do { \ | | 78| 34| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 34| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 34] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 34| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 34] | | ------------------ ------------------ 41| | 42| | // RFC 8446 4.2.1 43| | // Servers MAY abort the handshake upon receiving a ClientHello with 44| | // legacy_version 0x0304 or later. 45| 34| if(m_data->legacy_version().is_tls_13_or_later()) { ------------------ | Branch (45:7): [True: 19, False: 15] ------------------ 46| 19| throw TLS_Exception(Alert::DecodeError, "TLS 1.3 Client Hello has invalid legacy_version"); 47| 19| } 48| | 49| | // RFC 8446 D.5 50| | // Any endpoint receiving a Hello message with ClientHello.legacy_version [...] 51| | // set to 0x0300 MUST abort the handshake with a "protocol_version" alert. 52| 15| if(m_data->legacy_version().major_version() == 3 && m_data->legacy_version().minor_version() == 0) { ------------------ | Branch (52:7): [True: 1, False: 14] | Branch (52:7): [True: 1, False: 14] | Branch (52:56): [True: 1, False: 0] ------------------ 53| 1| throw TLS_Exception(Alert::ProtocolVersion, "TLS 1.3 Client Hello has invalid legacy_version"); 54| 1| } 55| | 56| | // RFC 8446 4.1.2 57| | // For every TLS 1.3 ClientHello, [the compression method] MUST contain 58| | // exactly one byte, set to zero, [...]. If a TLS 1.3 ClientHello is 59| | // received with any other value in this field, the server MUST abort the 60| | // handshake with an "illegal_parameter" alert. 61| 14| if(m_data->comp_methods().size() != 1 || m_data->comp_methods().front() != 0) { ------------------ | Branch (61:7): [True: 8, False: 6] | Branch (61:45): [True: 2, False: 4] ------------------ 62| 10| throw TLS_Exception(Alert::IllegalParameter, "Client did not offer NULL compression"); 63| 10| } 64| | 65| | // RFC 8446 4.2.9 66| | // A client MUST provide a "psk_key_exchange_modes" extension if it 67| | // offers a "pre_shared_key" extension. If clients offer "pre_shared_key" 68| | // without a "psk_key_exchange_modes" extension, servers MUST abort 69| | // the handshake. 70| 4| if(exts.has()) { ------------------ | Branch (70:7): [True: 0, False: 4] ------------------ 71| 0| if(!exts.has()) { ------------------ | Branch (71:10): [True: 0, False: 0] ------------------ 72| 0| throw TLS_Exception(Alert::MissingExtension, 73| 0| "Client Hello offered a PSK without a psk_key_exchange_modes extension"); 74| 0| } 75| | 76| | // RFC 8446 4.2.11 77| | // The "pre_shared_key" extension MUST be the last extension in the 78| | // ClientHello [...]. Servers MUST check that it is the last extension 79| | // and otherwise fail the handshake with an "illegal_parameter" alert. 80| 0| if(exts.last_added() != Extension_Code::PresharedKey) { ------------------ | Branch (80:10): [True: 0, False: 0] ------------------ 81| 0| throw TLS_Exception(Alert::IllegalParameter, "PSK extension was not at the very end of the Client Hello"); 82| 0| } 83| 0| } 84| | 85| | // RFC 8446 9.2 86| | // [A TLS 1.3 ClientHello] message MUST meet the following requirements: 87| | // 88| | // - If not containing a "pre_shared_key" extension, it MUST contain 89| | // both a "signature_algorithms" extension and a "supported_groups" 90| | // extension. 91| | // 92| | // - If containing a "supported_groups" extension, it MUST also contain 93| | // a "key_share" extension, and vice versa. An empty 94| | // KeyShare.client_shares vector is permitted. 95| | // 96| | // Servers receiving a ClientHello which does not conform to these 97| | // requirements MUST abort the handshake with a "missing_extension" 98| | // alert. 99| 4| if(!exts.has()) { ------------------ | Branch (99:7): [True: 4, False: 0] ------------------ 100| 4| if(!exts.has() || !exts.has()) { ------------------ | Branch (100:10): [True: 1, False: 3] | Branch (100:43): [True: 1, False: 2] ------------------ 101| 2| throw TLS_Exception( 102| 2| Alert::MissingExtension, 103| 2| "Non-PSK Client Hello did not contain supported_groups and signature_algorithms extensions"); 104| 2| } 105| 4| } 106| 2| if(exts.has() != exts.has()) { ------------------ | Branch (106:7): [True: 2, False: 0] ------------------ 107| 2| throw TLS_Exception(Alert::MissingExtension, 108| 2| "Client Hello must either contain both key_share and supported_groups extensions or neither"); 109| 2| } 110| | 111| 0| if(exts.has()) { ------------------ | Branch (111:7): [True: 0, False: 0] ------------------ 112| 0| auto* const supported_ext = exts.get(); 113| 0| BOTAN_ASSERT_NONNULL(supported_ext); ------------------ | | 116| 0| do { \ | | 117| 0| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 0] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 0| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 0] | | ------------------ ------------------ 114| 0| const auto supports = supported_ext->groups(); 115| 0| const auto offers = exts.get()->offered_groups(); 116| | 117| | // RFC 8446 4.2.8 118| | // Each KeyShareEntry value MUST correspond to a group offered in the 119| | // "supported_groups" extension and MUST appear in the same order. 120| | // [...] 121| | // Clients MUST NOT offer any KeyShareEntry values for groups not 122| | // listed in the client's "supported_groups" extension. 123| | // 124| | // Servers MAY check for violations of these rules and abort the 125| | // handshake with an "illegal_parameter" alert if one is violated. 126| | // 127| | // Note: We can assume that both `offers` and `supports` are unique lists 128| | // as this is ensured in the parsing code of the extensions. 129| | // 130| | // Since offers must appear in the same order as supports, a single 131| | // forward sweep of `supports` suffices: after finding each offered group 132| | // we advance past its position so the next offered group is searched for 133| | // only in the remaining suffix. 134| 0| auto supports_it = supports.begin(); 135| 0| for(const auto offered : offers) { ------------------ | Branch (135:30): [True: 0, False: 0] ------------------ 136| 0| supports_it = std::find(supports_it, supports.end(), offered); 137| 0| if(supports_it == supports.end()) { ------------------ | Branch (137:13): [True: 0, False: 0] ------------------ 138| 0| throw TLS_Exception(Alert::IllegalParameter, 139| 0| "Offered key exchange groups do not align with claimed supported groups"); 140| 0| } 141| 0| ++supports_it; 142| 0| } 143| 0| } 144| | 145| | // TODO: Reject oid_filters extension if found (which is the only known extension that 146| | // must not occur in the TLS 1.3 client hello. 147| | // RFC 8446 4.2.5 148| | // [The oid_filters extension] MUST only be sent in the CertificateRequest message. 149| 0|} _ZN5Botan3TLS15Client_Hello_135parseENSt3__14spanIKhLm18446744073709551615EEE: 286| 3.88k|std::variant Client_Hello_13::parse(std::span buf) { 287| 3.88k| auto data = std::make_unique(buf); 288| 3.88k| const auto version = data->version(); 289| | 290| 3.88k| if(version.is_pre_tls_13()) { ------------------ | Branch (290:7): [True: 3.14k, False: 744] ------------------ 291| 3.14k| return Client_Hello_12_Shim(std::move(data)); 292| 3.14k| } else { 293| 744| return Client_Hello_13(std::move(data)); 294| 744| } 295| 3.88k|} _ZN5Botan3TLS20Encrypted_ExtensionsC2ENSt3__14spanIKhLm18446744073709551615EEE: 134| 659|Encrypted_Extensions::Encrypted_Extensions(std::span buf) { 135| 659| TLS_Data_Reader reader("encrypted extensions reader", buf); 136| | 137| | // Encrypted Extensions contains a list of extensions. This list may legally 138| | // be empty. However, in that case we should at least see a two-byte length 139| | // field that reads 0x00 0x00. 140| 659| if(buf.size() < 2) { ------------------ | Branch (140:7): [True: 3, False: 656] ------------------ 141| 3| throw TLS_Exception(Alert::DecodeError, "Server sent an empty Encrypted Extensions message"); 142| 3| } 143| | 144| 656| m_extensions.deserialize(reader, Connection_Side::Server, type()); 145| | 146| | // RFC 8446 4.2 147| | // If an implementation receives an extension which it recognizes and 148| | // which is not specified for the message in which it appears, it MUST 149| | // abort the handshake with an "illegal_parameter" alert. 150| | // 151| | // Note that we cannot encounter any extensions that we don't recognize here, 152| | // since only extensions we previously offered are allowed in EE. 153| 656| const auto allowed_exts = std::set{ 154| | // Allowed extensions listed in RFC 8446 and implemented in Botan 155| 656| Extension_Code::ServerNameIndication, 156| | // MAX_FRAGMENT_LENGTH 157| 656| Extension_Code::SupportedGroups, 158| 656| Extension_Code::UseSrtp, 159| | // HEARTBEAT 160| 656| Extension_Code::ApplicationLayerProtocolNegotiation, 161| | // RFC 7250 162| 656| Extension_Code::ClientCertificateType, 163| 656| Extension_Code::ServerCertificateType, 164| | // EARLY_DATA 165| | 166| | // Allowed extensions not listed in RFC 8446 but acceptable as Botan implements them 167| 656| Extension_Code::RecordSizeLimit, 168| 656| }; 169| 656| if(m_extensions.contains_implemented_extensions_other_than(allowed_exts)) { ------------------ | Branch (169:7): [True: 57, False: 599] ------------------ 170| 57| throw TLS_Exception(Alert::IllegalParameter, "Encrypted Extensions contained an extension that is not allowed"); 171| 57| } 172| | 173| 599| reader.assert_done(); 174| 599|} _ZN5Botan3TLS15Server_Hello_135parseENSt3__14spanIKhLm18446744073709551615EEE: 85| 125| std::span buf) { 86| 125| auto data = std::make_unique(buf); 87| 125| const auto version = data->version(); 88| | 89| | // server hello that appears to be pre-TLS 1.3, takes precedence over... 90| 125| if(version.is_pre_tls_13()) { ------------------ | Branch (90:7): [True: 22, False: 103] ------------------ 91| 22| return Server_Hello_12_Shim(std::move(data)); 92| 22| } 93| | 94| | // ... the TLS 1.3 "special case" aka. Hello_Retry_Request 95| 103| if(version == Protocol_Version::TLS_V13) { ------------------ | Branch (95:7): [True: 29, False: 74] ------------------ 96| 29| if(data->is_hello_retry_request()) { ------------------ | Branch (96:10): [True: 0, False: 29] ------------------ 97| 0| return Hello_Retry_Request(std::move(data)); 98| 0| } 99| | 100| 29| return Server_Hello_13(std::move(data)); 101| 29| } 102| | 103| 74| throw TLS_Exception(Alert::ProtocolVersion, "unexpected server hello version: " + version.to_string()); 104| 103|} _ZNK5Botan3TLS15Server_Hello_1316basic_validationEv: 109| 29|void Server_Hello_13::basic_validation() const { 110| 29| BOTAN_ASSERT_NOMSG(m_data->version() == Protocol_Version::TLS_V13); ------------------ | | 77| 29| do { \ | | 78| 29| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 29| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 29] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 29| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 29] | | ------------------ ------------------ 111| | 112| | // Note: checks that cannot be performed without contextual information 113| | // are done in the specific TLS client implementation. 114| | // Note: The Supported_Version extension makes sure internally that 115| | // exactly one entry is provided. 116| | 117| | // Note: Hello Retry Request basic validation is equivalent with the 118| | // basic validations required for Server Hello 119| | // 120| | // RFC 8446 4.1.4 121| | // Upon receipt of a HelloRetryRequest, the client MUST check the 122| | // legacy_version, [...], and legacy_compression_method as specified in 123| | // Section 4.1.3 and then process the extensions, starting with determining 124| | // the version using "supported_versions". 125| | 126| | // RFC 8446 4.1.3 127| | // In TLS 1.3, [...] the legacy_version field MUST be set to 0x0303 128| 29| if(legacy_version() != Protocol_Version::TLS_V12) { ------------------ | Branch (128:7): [True: 15, False: 14] ------------------ 129| 15| throw TLS_Exception(Alert::ProtocolVersion, 130| 15| "legacy_version '" + legacy_version().to_string() + "' is not allowed"); 131| 15| } 132| | 133| | // RFC 8446 4.1.3 134| | // legacy_compression_method: A single byte which MUST have the value 0. 135| 14| if(compression_method() != 0x00) { ------------------ | Branch (135:7): [True: 1, False: 13] ------------------ 136| 1| throw TLS_Exception(Alert::DecodeError, "compression is not supported in TLS 1.3"); 137| 1| } 138| | 139| | // RFC 8446 4.1.3 140| | // All TLS 1.3 ServerHello messages MUST contain the "supported_versions" extension. 141| 13| if(!extensions().has()) { ------------------ | Branch (141:7): [True: 0, False: 13] ------------------ 142| 0| throw TLS_Exception(Alert::MissingExtension, "server hello did not contain 'supported version' extension"); 143| 0| } 144| | 145| | // RFC 8446 4.2.1 146| | // A server which negotiates TLS 1.3 MUST respond by sending 147| | // a "supported_versions" extension containing the selected version 148| | // value (0x0304). 149| 13| if(selected_version() != Protocol_Version::TLS_V13) { ------------------ | Branch (149:7): [True: 12, False: 1] ------------------ 150| 12| throw TLS_Exception(Alert::IllegalParameter, "TLS 1.3 Server Hello selected a different version"); 151| 12| } 152| 13|} _ZN5Botan3TLS15Server_Hello_13C2ENSt3__110unique_ptrINS0_21Server_Hello_InternalENS2_14default_deleteIS4_EEEENS1_16Server_Hello_TagE: 156| 29| Server_Hello(std::move(data)) { 157| 29| BOTAN_ASSERT_NOMSG(!m_data->is_hello_retry_request()); ------------------ | | 77| 29| do { \ | | 78| 29| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 29| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 29] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 29| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 29] | | ------------------ ------------------ 158| 29| basic_validation(); 159| | 160| 29| const auto& exts = extensions(); 161| | 162| | // RFC 8446 4.1.3 163| | // The ServerHello MUST only include extensions which are required to 164| | // establish the cryptographic context and negotiate the protocol version. 165| | // [...] 166| | // Other extensions (see Section 4.2) are sent separately in the 167| | // EncryptedExtensions message. 168| | // 169| | // Note that further validation dependent on the client hello is done in the 170| | // TLS client implementation. 171| 29| const std::set allowed = { 172| 29| Extension_Code::KeyShare, 173| 29| Extension_Code::SupportedVersions, 174| 29| Extension_Code::PresharedKey, 175| 29| }; 176| | 177| | // As the ServerHello shall only contain essential extensions, we don't give 178| | // any slack for extensions not implemented by Botan here. 179| 29| if(exts.contains_other_than(allowed)) { ------------------ | Branch (179:7): [True: 1, False: 28] ------------------ 180| 1| throw TLS_Exception(Alert::UnsupportedExtension, "Server Hello contained an extension that is not allowed"); 181| 1| } 182| | 183| | // RFC 8446 4.1.3 184| | // Current ServerHello messages additionally contain 185| | // either the "pre_shared_key" extension or the "key_share" 186| | // extension, or both [...]. 187| 28| if(!exts.has() && !exts.has()) { ------------------ | Branch (187:7): [True: 0, False: 28] | Branch (187:33): [True: 0, False: 0] ------------------ 188| 0| throw TLS_Exception(Alert::MissingExtension, "server hello must contain key exchange information"); 189| 0| } 190| 28|} _ZNK5Botan3TLS15Server_Hello_1316selected_versionEv: 353| 13|Protocol_Version Server_Hello_13::selected_version() const { 354| 13| auto* const versions_ext = m_data->extensions().get(); 355| 13| BOTAN_ASSERT_NOMSG(versions_ext); ------------------ | | 77| 13| do { \ | | 78| 13| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 13| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 13] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 13| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 13] | | ------------------ ------------------ 356| 13| const auto& versions = versions_ext->versions(); 357| 13| BOTAN_ASSERT_NOMSG(versions.size() == 1); ------------------ | | 77| 13| do { \ | | 78| 13| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 13| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 13] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 13| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 13] | | ------------------ ------------------ 358| 13| return versions.front(); 359| 13|} _ZN5Botan3TLS15Channel_Impl_13C2ERKNSt3__110shared_ptrINS0_9CallbacksEEERKNS3_INS0_15Session_ManagerEEERKNS3_INS_19Credentials_ManagerEEERKNS3_INS_21RandomNumberGeneratorEEERKNS3_IKNS0_6PolicyEEEb: 46| 5.57k| m_side(is_server ? Connection_Side::Server : Connection_Side::Client), ------------------ | Branch (46:14): [True: 5.57k, False: 0] ------------------ 47| 5.57k| m_callbacks(callbacks), 48| 5.57k| m_session_manager(session_manager), 49| 5.57k| m_credentials_manager(credentials_manager), 50| 5.57k| m_rng(rng), 51| 5.57k| m_policy(policy), 52| 5.57k| m_record_layer(m_side, m_policy), 53| 5.57k| m_handshake_layer(m_side), 54| 5.57k| m_can_read(true), 55| 5.57k| m_can_write(true), 56| 5.57k| m_opportunistic_key_update(false), 57| 5.57k| m_first_message_sent(false), 58| 5.57k| m_first_message_received(false) { 59| 5.57k| BOTAN_ASSERT_NONNULL(m_callbacks); ------------------ | | 116| 5.57k| do { \ | | 117| 5.57k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 5.57k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 5.57k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 5.57k] | | ------------------ ------------------ 60| 5.57k| BOTAN_ASSERT_NONNULL(m_session_manager); ------------------ | | 116| 5.57k| do { \ | | 117| 5.57k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 5.57k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 5.57k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 5.57k] | | ------------------ ------------------ 61| 5.57k| BOTAN_ASSERT_NONNULL(m_credentials_manager); ------------------ | | 116| 5.57k| do { \ | | 117| 5.57k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 5.57k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 5.57k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 5.57k] | | ------------------ ------------------ 62| 5.57k| BOTAN_ASSERT_NONNULL(m_rng); ------------------ | | 116| 5.57k| do { \ | | 117| 5.57k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 5.57k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 5.57k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 5.57k] | | ------------------ ------------------ 63| 5.57k| BOTAN_ASSERT_NONNULL(m_policy); ------------------ | | 116| 5.57k| do { \ | | 117| 5.57k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 5.57k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 5.57k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 5.57k] | | ------------------ ------------------ 64| 5.57k|} _ZN5Botan3TLS15Channel_Impl_13D2Ev: 66| 5.57k|Channel_Impl_13::~Channel_Impl_13() = default; _ZN5Botan3TLS15Channel_Impl_139from_peerENSt3__14spanIKhLm18446744073709551615EEE: 68| 5.57k|size_t Channel_Impl_13::from_peer(std::span data) { 69| 5.57k| BOTAN_STATE_CHECK(!is_downgrading()); ------------------ | | 51| 5.57k| do { \ | | 52| 5.57k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 5.57k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 5.57k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 5.57k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 5.57k] | | ------------------ ------------------ 70| | 71| | // RFC 8446 6.1 72| | // Any data received after a closure alert has been received MUST be ignored. 73| 5.57k| if(!m_can_read) { ------------------ | Branch (73:7): [True: 0, False: 5.57k] ------------------ 74| 0| return 0; 75| 0| } 76| | 77| 5.57k| try { 78| 5.57k|#if defined(BOTAN_HAS_TLS_DOWNGRADE_SUPPORT) 79| 5.57k| if(expects_downgrade()) { ------------------ | Branch (79:10): [True: 5.57k, False: 0] ------------------ 80| 5.57k| preserve_peer_transcript(data); 81| 5.57k| } 82| 5.57k|#endif 83| | 84| 5.57k| m_record_layer.copy_data(data); 85| | 86| 15.2k| while(true) { ------------------ | Branch (86:13): [True: 13.0k, Folded] ------------------ 87| | // RFC 8446 6.1 88| | // Any data received after a closure alert has been received MUST be ignored. 89| | // 90| | // ... this data might already be in the record layer's read buffer. 91| 13.0k| if(!m_can_read) { ------------------ | Branch (91:13): [True: 20, False: 13.0k] ------------------ 92| 20| return 0; 93| 20| } 94| | 95| 13.0k| auto result = m_record_layer.next_record(m_cipher_state.get()); 96| | 97| 13.0k| if(std::holds_alternative(result)) { ------------------ | Branch (97:13): [True: 134, False: 12.9k] ------------------ 98| 134| return std::get(result); 99| 134| } 100| | 101| 12.9k| const auto& record = std::get(result); 102| | 103| | // RFC 8446 5.1 104| | // Handshake messages MUST NOT be interleaved with other record types. 105| 12.9k| if(record.type != Record_Type::Handshake && m_handshake_layer.has_pending_data()) { ------------------ | Branch (105:13): [True: 931, False: 11.9k] | Branch (105:54): [True: 1, False: 930] ------------------ 106| 1| throw Unexpected_Message("Expected remainder of a handshake message"); 107| 1| } 108| | 109| 12.9k| if(record.type == Record_Type::Handshake) { ------------------ | Branch (109:13): [True: 11.8k, False: 1.01k] ------------------ 110| 11.8k| m_handshake_layer.copy_data(record.fragment); 111| | 112| 11.8k| if(!is_handshake_complete()) { ------------------ | Branch (112:16): [True: 11.8k, False: 0] ------------------ 113| 12.0k| while(auto handshake_msg = m_handshake_layer.next_message(policy(), m_transcript_hash)) { ------------------ | Branch (113:27): [True: 3.33k, False: 8.73k] ------------------ 114| | // RFC 8446 5.1 115| | // Handshake messages MUST NOT span key changes. Implementations 116| | // MUST verify that all messages immediately preceding a key change 117| | // align with a record boundary; if not, then they MUST terminate the 118| | // connection with an "unexpected_message" alert. Because the 119| | // ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate 120| | // messages can immediately precede a key change, implementations 121| | // MUST send these messages in alignment with a record boundary. 122| | // 123| | // Note: Hello_Retry_Request was added to the list below although it cannot immediately precede a key change. 124| | // However, there cannot be any further sensible messages in the record after HRR. 125| | // 126| | // Note: Server_Hello_12 was deliberately not included in the check below because in TLS 1.2 Server Hello and 127| | // other handshake messages can be legally coalesced in a single record. 128| | // 129| 3.33k| if(holds_any_of(handshake_msg.value()) && 134| 3.15k| m_handshake_layer.has_pending_data()) { ------------------ | Branch (134:22): [True: 14, False: 3.14k] ------------------ 135| 14| throw Unexpected_Message("Unexpected additional handshake message data found in record"); 136| 14| } 137| | 138| 3.32k| process_handshake_msg(std::move(handshake_msg.value())); 139| | 140| 3.32k|#if defined(BOTAN_HAS_TLS_DOWNGRADE_SUPPORT) 141| 3.32k| if(is_downgrading()) { ------------------ | Branch (141:22): [True: 3.13k, False: 187] ------------------ 142| | // Downgrade to TLS 1.2 was detected. Stop everything we do and await being replaced by a 1.2 implementation. 143| 3.13k| return 0; 144| 3.13k| } else if(m_downgrade_info != nullptr) { ------------------ | Branch (144:29): [True: 0, False: 187] ------------------ 145| | // We received a TLS 1.3 error alert that could have been a TLS 1.2 warning alert. 146| | // Now that we know that we are talking to a TLS 1.3 server, shut down. 147| 0| if(m_downgrade_info->received_tls_13_error_alert) { ------------------ | Branch (147:25): [True: 0, False: 0] ------------------ 148| 0| shutdown(); 149| 0| } 150| | 151| | // Downgrade can only be indicated in the first received peer message. This was not the case. 152| 0| m_downgrade_info.reset(); 153| 0| } 154| 187|#endif 155| | 156| | // After the initial handshake message is received, the record 157| | // layer must be more restrictive. 158| | // See RFC 8446 5.1 regarding "legacy_record_version" 159| 187| if(!m_first_message_received) { ------------------ | Branch (159:22): [True: 0, False: 187] ------------------ 160| 0| m_record_layer.disable_receiving_compat_mode(); 161| 0| m_first_message_received = true; 162| 0| } 163| 187| } 164| 11.8k| } else { 165| 0| while(auto handshake_msg = m_handshake_layer.next_post_handshake_message(policy())) { ------------------ | Branch (165:27): [True: 0, False: 0] ------------------ 166| 0| process_post_handshake_msg(std::move(handshake_msg.value())); 167| 0| } 168| 0| } 169| 11.8k| } else if(record.type == Record_Type::ChangeCipherSpec) { ------------------ | Branch (169:20): [True: 1, False: 1.01k] ------------------ 170| 1| process_dummy_change_cipher_spec(); 171| 1.01k| } else if(record.type == Record_Type::ApplicationData) { ------------------ | Branch (171:20): [True: 0, False: 1.01k] ------------------ 172| 0| BOTAN_ASSERT_NONNULL(m_cipher_state); ------------------ | | 116| 0| do { \ | | 117| 0| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 0] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 0| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 0] | | ------------------ ------------------ 173| 0| if(!m_cipher_state->can_decrypt_application_traffic()) { ------------------ | Branch (173:16): [True: 0, False: 0] ------------------ 174| 0| throw Unexpected_Message("Application data received before handshake completion"); 175| 0| } 176| | /* 177| | The record sequence number is set in Record_Layer::next_record only when 178| | the record contents are decrypted under the current set of traffic keys 179| | */ 180| 0| if(!record.seq_no.has_value()) { ------------------ | Branch (180:16): [True: 0, False: 0] ------------------ 181| 0| throw Unexpected_Message("Application data must have a sequence number"); 182| 0| } 183| 0| callbacks().tls_record_received(record.seq_no.value(), record.fragment); 184| 1.01k| } else if(record.type == Record_Type::Alert) { ------------------ | Branch (184:20): [True: 929, False: 88] ------------------ 185| 929| process_alert(record.fragment); 186| 929| } else { 187| 88| throw Unexpected_Message("Unexpected record type " + std::to_string(static_cast(record.type)) + 188| 88| " from counterparty"); 189| 88| } 190| 12.9k| } 191| 5.57k| } catch(TLS_Exception& e) { 192| 1.15k| send_fatal_alert(e.type()); 193| 1.15k| throw; 194| 1.15k| } catch(Invalid_Authentication_Tag&) { 195| | // RFC 8446 5.2 196| | // If the decryption fails, the receiver MUST terminate the connection 197| | // with a "bad_record_mac" alert. 198| 0| send_fatal_alert(Alert::BadRecordMac); 199| 0| throw; 200| 1.13k| } catch(Decoding_Error&) { 201| 1.13k| send_fatal_alert(Alert::DecodeError); 202| 1.13k| throw; 203| 1.13k| } catch(...) { 204| 3| send_fatal_alert(Alert::InternalError); 205| 3| throw; 206| 3| } 207| 5.57k|} _ZN5Botan3TLS15Channel_Impl_1310send_alertERKNS0_5AlertE: 306| 2.30k|void Channel_Impl_13::send_alert(const Alert& alert) { 307| 2.30k| if(alert.is_valid() && m_can_write) { ------------------ | Branch (307:7): [True: 2.30k, False: 0] | Branch (307:27): [True: 2.29k, False: 3] ------------------ 308| 2.29k| try { 309| 2.29k| maybe_handle_compatibility_mode(Compat_Mode_Situation::BeforeSendingAlert); 310| 2.29k| send_record(Record_Type::Alert, alert.serialize()); 311| 2.29k| } catch(...) { /* swallow it */ 312| 0| } 313| 2.29k| } 314| | 315| | // Note: In TLS 1.3 sending a CloseNotify must not immediately lead to closing the reading end. 316| | // RFC 8446 6.1 317| | // Each party MUST send a "close_notify" alert before closing its write 318| | // side of the connection, unless it has already sent some error alert. 319| | // This does not have any effect on its read side of the connection. 320| 2.30k| if(is_close_notify_alert(alert) && m_can_write) { ------------------ | Branch (320:7): [True: 15, False: 2.28k] | Branch (320:39): [True: 12, False: 3] ------------------ 321| 12| m_can_write = false; 322| 12| if(m_cipher_state) { ------------------ | Branch (322:10): [True: 0, False: 12] ------------------ 323| 0| m_cipher_state->clear_write_keys(); 324| 0| } 325| 12| } 326| | 327| 2.30k| if(is_error_alert(alert)) { ------------------ | Branch (327:7): [True: 2.28k, False: 15] ------------------ 328| 2.28k| shutdown(); 329| 2.28k| } 330| 2.30k|} _ZN5Botan3TLS15Channel_Impl_1311send_recordENS0_11Record_TypeERKNSt3__16vectorIhNS3_9allocatorIhEEEE: 352| 2.29k|void Channel_Impl_13::send_record(Record_Type type, const std::vector& record) { 353| 2.29k| BOTAN_STATE_CHECK(!is_downgrading()); ------------------ | | 51| 2.29k| do { \ | | 52| 2.29k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 2.29k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 2.29k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 2.29k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 2.29k] | | ------------------ ------------------ 354| 2.29k| BOTAN_STATE_CHECK(m_can_write); ------------------ | | 51| 2.29k| do { \ | | 52| 2.29k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 2.29k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 2.29k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 2.29k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 2.29k] | | ------------------ ------------------ 355| | 356| | // RFC 9846 5. 357| | // An implementation which [...] receives a protected change_cipher_spec 358| | // record MUST abort the handshake [...]. 359| | // 360| | // I.e. Change Cipher Spec records must always be sent unprotected, even if 361| | // the cipher state is already set up for handshake message encryption. 362| 2.29k| auto* cipher_state = (type != Record_Type::ChangeCipherSpec) ? m_cipher_state.get() : nullptr; ------------------ | Branch (362:25): [True: 2.29k, False: 0] ------------------ 363| | 364| 2.29k| auto to_write = m_record_layer.prepare_records(type, record, cipher_state); 365| | 366| | // After the initial handshake message is sent, the record layer must 367| | // adhere to a more strict record specification. Note that for the 368| | // server case this is a NOOP. 369| | // See (RFC 8446 5.1. regarding "legacy_record_version") 370| 2.29k| if(!m_first_message_sent && type == Record_Type::Handshake) { ------------------ | Branch (370:7): [True: 2.29k, False: 0] | Branch (370:32): [True: 0, False: 2.29k] ------------------ 371| 0| m_record_layer.disable_sending_compat_mode(); 372| 0| m_first_message_sent = true; 373| 0| } 374| | 375| 2.29k| callbacks().tls_emit_data(to_write); 376| 2.29k|} _ZN5Botan3TLS15Channel_Impl_1313process_alertERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE: 378| 929|void Channel_Impl_13::process_alert(const secure_vector& record) { 379| 929| const Alert alert(record); 380| | 381| 929| if(is_close_notify_alert(alert)) { ------------------ | Branch (381:7): [True: 15, False: 914] ------------------ 382| 15| m_can_read = false; 383| 15| if(m_cipher_state) { ------------------ | Branch (383:10): [True: 0, False: 15] ------------------ 384| 0| m_cipher_state->clear_read_keys(); 385| 0| } 386| 15| m_record_layer.clear_read_buffer(); 387| 15| } 388| | 389| | // user canceled alerts are ignored 390| | 391| | // RFC 8446 5. 392| | // All the alerts listed in Section 6.2 MUST be sent with 393| | // AlertLevel=fatal and MUST be treated as error alerts when received 394| | // regardless of the AlertLevel in the message. Unknown Alert types 395| | // MUST be treated as error alerts. 396| 929| if(is_error_alert(alert) && !alert.is_fatal()) { ------------------ | Branch (396:7): [True: 573, False: 356] | Branch (396:32): [True: 569, False: 4] ------------------ 397| 569| if(!expects_downgrade()) { ------------------ | Branch (397:10): [True: 0, False: 569] ------------------ 398| 0| throw TLS_Exception(Alert::DecodeError, "Error alert not marked fatal"); 399| 0| } 400| | 401| 569|#if defined(BOTAN_HAS_TLS_DOWNGRADE_SUPPORT) 402| 569| BOTAN_DEBUG_ASSERT(expects_downgrade()); ------------------ | | 130| 569| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 569| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 569] | | ------------------ ------------------ 403| | 404| | // In TLS 1.2 error alerts might be marked as 'warnings' and would not 405| | // demand an immediate shutdown. Until we are sure to talk to a TLS 1.3 406| | // peer we must defer the shutdown and refrain from raising a decode 407| | // error. 408| 569| m_downgrade_info->received_tls_13_error_alert = true; 409| 569|#endif 410| 569| } 411| | 412| 929| if(alert.is_fatal()) { ------------------ | Branch (412:7): [True: 8, False: 921] ------------------ 413| 8| shutdown(); 414| 8| } 415| | 416| 929| callbacks().tls_alert(alert); 417| | 418| | // Respond with our "close_notify" if the application requests us to. 419| 929| if(is_close_notify_alert(alert) && callbacks().tls_peer_closed_connection()) { ------------------ | Branch (419:7): [True: 15, False: 914] | Branch (419:39): [True: 15, False: 0] ------------------ 420| 15| close(); 421| 15| } 422| 929|} _ZN5Botan3TLS15Channel_Impl_138shutdownEv: 424| 2.29k|void Channel_Impl_13::shutdown() { 425| | // RFC 8446 6.2 426| | // Upon transmission or receipt of a fatal alert message, both 427| | // parties MUST immediately close the connection. 428| 2.29k| m_can_read = false; 429| 2.29k| m_can_write = false; 430| 2.29k| m_cipher_state.reset(); 431| 2.29k| m_active_state.reset(); 432| 2.29k|} _ZN5Botan3TLS15Channel_Impl_1316expect_downgradeERKNS0_18Server_InformationERKNSt3__16vectorINS5_12basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEENSA_ISC_EEEE: 437| 5.57k| const std::vector& next_protocols) { 438| 5.57k| Downgrade_Information di{ 439| 5.57k| {}, 440| 5.57k| {}, 441| 5.57k| {}, 442| 5.57k| server_info, 443| 5.57k| next_protocols, 444| 5.57k| Botan::TLS::Channel::IO_BUF_DEFAULT_SIZE, 445| 5.57k| m_callbacks, 446| 5.57k| m_session_manager, 447| 5.57k| m_credentials_manager, 448| 5.57k| m_rng, 449| 5.57k| m_policy, 450| 5.57k| false, // received_tls_13_error_alert 451| 5.57k| false // will_downgrade 452| 5.57k| }; 453| 5.57k| m_downgrade_info = std::make_unique(std::move(di)); 454| 5.57k|} tls_channel_impl_13.cpp:_ZN12_GLOBAL__N_121is_close_notify_alertERKN5Botan3TLS5AlertE: 27| 7.35k|bool is_close_notify_alert(const Botan::TLS::Alert& alert) { 28| 7.35k| return alert.type() == Botan::TLS::Alert::CloseNotify; 29| 7.35k|} tls_channel_impl_13.cpp:_ZN12_GLOBAL__N_114is_error_alertERKN5Botan3TLS5AlertE: 31| 3.21k|bool is_error_alert(const Botan::TLS::Alert& alert) { 32| | // In TLS 1.3 all alerts except for closure alerts are considered error alerts. 33| | // (RFC 8446 6.) 34| 3.21k| return !is_close_notify_alert(alert) && !is_user_canceled_alert(alert); ------------------ | Branch (34:11): [True: 3.18k, False: 30] | Branch (34:44): [True: 2.85k, False: 328] ------------------ 35| 3.21k|} tls_channel_impl_13.cpp:_ZN12_GLOBAL__N_122is_user_canceled_alertERKN5Botan3TLS5AlertE: 23| 3.18k|bool is_user_canceled_alert(const Botan::TLS::Alert& alert) { 24| 3.18k| return alert.type() == Botan::TLS::Alert::UserCanceled; 25| 3.18k|} _ZN5Botan3TLS6CookieC2ERNS0_15TLS_Data_ReaderEt: 26| 33|Cookie::Cookie(TLS_Data_Reader& reader, uint16_t extension_size) { 27| | // RFC 8446 4.2.2 28| | // struct { 29| | // opaque cookie<1..2^16-1>; 30| | // } Cookie; 31| | // 32| | // The wire form requires a 2-byte length field plus at least one byte of 33| | // cookie data, so the minimum extension size is 3 bytes. 34| 33| if(extension_size < 3) { ------------------ | Branch (34:7): [True: 2, False: 31] ------------------ 35| 2| throw Decoding_Error("Empty cookie extension is illegal"); 36| 2| } 37| | 38| 31| const uint16_t len = reader.get_uint16_t(); 39| | 40| 31| if(static_cast(len) + 2 != extension_size) { ------------------ | Branch (40:7): [True: 19, False: 12] ------------------ 41| 19| throw Decoding_Error("Inconsistent length in cookie extension"); 42| 19| } 43| | 44| 12| m_cookie = reader.get_fixed(len); 45| 12|} _ZN5Botan3TLS22PSK_Key_Exchange_ModesC2ERNS0_15TLS_Data_ReaderEt: 65| 82|PSK_Key_Exchange_Modes::PSK_Key_Exchange_Modes(TLS_Data_Reader& reader, uint16_t extension_size) { 66| | // RFC 8446 4.2.9 67| | // struct { 68| | // PskKeyExchangeMode ke_modes<1..255>; 69| | // } PskKeyExchangeModes; 70| | // 71| | // The wire form is a 1-byte length followed by mode_count mode bytes, 72| | // with mode_count in [1, 255], so the extension size is in [2, 256]. 73| 82| if(extension_size < 2) { ------------------ | Branch (73:7): [True: 1, False: 81] ------------------ 74| 1| throw Decoding_Error("Empty psk_key_exchange_modes extension is illegal"); 75| 1| } 76| | 77| 81| const auto mode_count = reader.get_byte(); 78| 81| if(static_cast(mode_count) + 1 != extension_size) { ------------------ | Branch (78:7): [True: 7, False: 74] ------------------ 79| 7| throw Decoding_Error("Inconsistent length in psk_key_exchange_modes extension"); 80| 7| } 81| | 82| 2.18k| for(uint16_t i = 0; i < mode_count; ++i) { ------------------ | Branch (82:24): [True: 2.10k, False: 74] ------------------ 83| 2.10k| const auto mode = static_cast(reader.get_byte()); 84| 2.10k| if(mode == PSK_Key_Exchange_Mode::PSK_KE || mode == PSK_Key_Exchange_Mode::PSK_DHE_KE) { ------------------ | Branch (84:10): [True: 658, False: 1.45k] | Branch (84:51): [True: 337, False: 1.11k] ------------------ 85| 995| m_modes.push_back(mode); 86| 995| } 87| 2.10k| } 88| 74|} _ZN5Botan3TLS23Certificate_AuthoritiesC2ERNS0_15TLS_Data_ReaderEt: 106| 608|Certificate_Authorities::Certificate_Authorities(TLS_Data_Reader& reader, uint16_t extension_size) { 107| 608| if(extension_size < 2) { ------------------ | Branch (107:7): [True: 3, False: 605] ------------------ 108| 3| throw Decoding_Error("Empty certificate_authorities extension is illegal"); 109| 3| } 110| | 111| 605| const uint16_t purported_size = reader.get_uint16_t(); 112| | 113| 605| if(reader.remaining_bytes() != purported_size) { ------------------ | Branch (113:7): [True: 14, False: 591] ------------------ 114| 14| throw Decoding_Error("Inconsistent length in certificate_authorities extension"); 115| 14| } 116| | 117| | // RFC 8446 4.2.4: DistinguishedName authorities<3..2^16-1>; 118| 591| if(purported_size < 3) { ------------------ | Branch (118:7): [True: 1, False: 590] ------------------ 119| 1| throw Decoding_Error("Empty certificate_authorities list is illegal"); 120| 1| } 121| | 122| 1.21k| while(reader.has_remaining()) { ------------------ | Branch (122:10): [True: 629, False: 590] ------------------ 123| | // RFC 8446 4.2.4: opaque DistinguishedName<1..2^16-1> 124| 629| const std::vector name_bits = reader.get_range(2, 1, 65535); 125| | 126| 629| BER_Decoder decoder(name_bits, BER_Decoder::Limits::DER()); 127| 629| m_distinguished_names.emplace_back(); 128| 629| decoder.decode(m_distinguished_names.back()).verify_end(); 129| 629| } 130| 590|} _ZN5Botan3TLS19EarlyDataIndicationC2ERNS0_15TLS_Data_ReaderEtNS0_14Handshake_TypeE: 149| 42| Handshake_Type message_type) { 150| 42| if(message_type == Handshake_Type::NewSessionTicket) { ------------------ | Branch (150:7): [True: 0, False: 42] ------------------ 151| 0| if(extension_size != 4) { ------------------ | Branch (151:10): [True: 0, False: 0] ------------------ 152| 0| throw TLS_Exception(Alert::DecodeError, 153| 0| "Received an early_data extension in a NewSessionTicket message " 154| 0| "without maximum early data size indication"); 155| 0| } 156| | 157| 0| m_max_early_data_size = reader.get_uint32_t(); 158| 42| } else if(extension_size != 0) { ------------------ | Branch (158:14): [True: 5, False: 37] ------------------ 159| 5| throw TLS_Exception(Alert::DecodeError, 160| 5| "Received an early_data extension containing an unexpected data " 161| 5| "size indication"); 162| 5| } 163| 42|} _ZNK5Botan3TLS19EarlyDataIndication5emptyEv: 165| 5|bool EarlyDataIndication::empty() const { 166| | // This extension may be empty by definition but still carry information 167| 5| return false; 168| 5|} _ZN5Botan3TLS9Key_ShareC2ERNS0_15TLS_Data_ReaderEtNS0_14Handshake_TypeE: 377| 64|Key_Share::Key_Share(TLS_Data_Reader& reader, uint16_t extension_size, Handshake_Type message_type) { 378| 64| if(message_type == Handshake_Type::ClientHello) { ------------------ | Branch (378:7): [True: 48, False: 16] ------------------ 379| 48| m_impl = std::make_unique(Key_Share_ClientHello(reader, extension_size)); 380| 48| } else if(message_type == Handshake_Type::HelloRetryRequest) { ------------------ | Branch (380:14): [True: 0, False: 16] ------------------ 381| | // Connection_Side::Server 382| 0| m_impl = std::make_unique(Key_Share_HelloRetryRequest(reader, extension_size)); 383| 16| } else if(message_type == Handshake_Type::ServerHello) { ------------------ | Branch (383:14): [True: 13, False: 3] ------------------ 384| | // Connection_Side::Server 385| 13| m_impl = std::make_unique(Key_Share_ServerHello(reader, extension_size)); 386| 13| } else { 387| 3| throw Invalid_Argument(std::string("cannot create a Key_Share extension for message of type: ") + 388| 3| handshake_type_to_string(message_type)); 389| 3| } 390| 64|} _ZN5Botan3TLS9Key_ShareD2Ev: 409| 32|Key_Share::~Key_Share() = default; _ZNK5Botan3TLS9Key_Share5emptyEv: 415| 4|bool Key_Share::empty() const { 416| 4| return std::visit([](const auto& key_share) { return key_share.empty(); }, m_impl->key_share); 417| 4|} tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHelloC2ERNS0_15TLS_Data_ReaderEt: 161| 48| Key_Share_ClientHello(TLS_Data_Reader& reader, uint16_t /* extension_size */) { 162| | // The reader is per-extension (Extensions::deserialize binds it to 163| | // exactly extension_size bytes). Enforce that the inner 164| | // client_shares length matches what the outer extension has left, 165| | // then let the entry loop consume everything; extn_reader's 166| | // assert_done() at the deserialize call site catches any leftover. 167| 48| const auto client_key_share_length = reader.get_uint16_t(); 168| 48| if(reader.remaining_bytes() != client_key_share_length) { ------------------ | Branch (168:13): [True: 8, False: 40] ------------------ 169| 8| throw TLS_Exception(Alert::DecodeError, "Inconsistent length in client KeyShare extension"); 170| 8| } 171| | 172| 40| std::unordered_set seen_groups; 173| 136| while(reader.has_remaining()) { ------------------ | Branch (173:16): [True: 99, False: 37] ------------------ 174| | // Each KeyShareEntry is at least 4 bytes (group + 2-byte length). 175| | // Cleaner failure than the reader underflow we'd otherwise hit 176| | // when the inner buffer ends mid-entry. 177| 99| if(reader.remaining_bytes() < 4) { ------------------ | Branch (177:16): [True: 2, False: 97] ------------------ 178| 2| throw TLS_Exception(Alert::DecodeError, "Not enough data to read another KeyShareEntry"); 179| 2| } 180| | 181| 97| Key_Share_Entry new_entry(reader); 182| | 183| | // RFC 8446 4.2.8 184| | // Clients MUST NOT offer multiple KeyShareEntry values for the same 185| | // group. [...] 186| | // Servers MAY check for violations of these rules and abort the 187| | // handshake with an "illegal_parameter" alert if one is violated. 188| 97| if(!seen_groups.insert(new_entry.group().wire_code()).second) { ------------------ | Branch (188:16): [True: 1, False: 96] ------------------ 189| 1| throw TLS_Exception(Alert::IllegalParameter, "Received multiple key share entries for the same group"); 190| 1| } 191| | 192| 96| m_client_shares.emplace_back(std::move(new_entry)); 193| 96| } 194| 40| } tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_115Key_Share_EntryC2ERNS0_15TLS_Data_ReaderE: 47| 110| explicit Key_Share_Entry(TLS_Data_Reader& reader) { 48| | // TODO check that the group actually exists before casting... 49| 110| m_group = static_cast(reader.get_uint16_t()); 50| | // RFC 8446 4.2.8: opaque key_exchange<1..2^16-1> 51| 110| m_key_exchange = reader.get_range(2, 1, 65535); 52| 110| } tls_extensions_key_share.cpp:_ZNK5Botan3TLS12_GLOBAL__N_115Key_Share_Entry5groupEv: 81| 87| Named_Group group() const { return m_group; } tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHelloD2Ev: 219| 78| ~Key_Share_ClientHello() = default; tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ServerHelloC2ERNS0_15TLS_Data_ReaderEt: 121| 13| Key_Share_ServerHello(TLS_Data_Reader& reader, uint16_t /*len*/) : m_server_share(reader) {} tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ServerHelloD2Ev: 129| 18| ~Key_Share_ServerHello() = default; tls_extensions_key_share.cpp:_ZZNK5Botan3TLS9Key_Share5emptyEvENK3$_0clINS0_12_GLOBAL__N_121Key_Share_ClientHelloEEEDaRKT_: 416| 4| return std::visit([](const auto& key_share) { return key_share.empty(); }, m_impl->key_share); tls_extensions_key_share.cpp:_ZNK5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHello5emptyEv: 264| 4| bool empty() const { 265| | // RFC 8446 4.2.8 266| | // Clients MAY send an empty client_shares vector in order to request 267| | // group selection from the server, at the cost of an additional round 268| | // trip [...]. 269| 4| return false; 270| 4| } tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHelloC2EOS2_: 224| 52| Key_Share_ClientHello(Key_Share_ClientHello&&) = default; tls_extensions_key_share.cpp:_ZN5Botan3TLS9Key_Share14Key_Share_ImplC2ENSt3__17variantIJNS0_12_GLOBAL__N_121Key_Share_ClientHelloENS5_21Key_Share_ServerHelloENS5_27Key_Share_HelloRetryRequestEEEE: 372| 32| explicit Key_Share_Impl(Key_Share_Type ks) : key_share(std::move(ks)) {} tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ServerHelloC2EOS2_: 134| 12| Key_Share_ServerHello(Key_Share_ServerHello&&) = default; _ZN5Botan3TLS3PSKC2ERNS0_15TLS_Data_ReaderEtNS0_14Handshake_TypeE: 142| 87|PSK::PSK(TLS_Data_Reader& reader, uint16_t extension_size, Handshake_Type message_type) { 143| 87| if(message_type == Handshake_Type::ServerHello) { ------------------ | Branch (143:7): [True: 8, False: 79] ------------------ 144| 8| if(extension_size != 2) { ------------------ | Branch (144:10): [True: 1, False: 7] ------------------ 145| 1| throw TLS_Exception(Alert::DecodeError, "Server provided a malformed PSK extension"); 146| 1| } 147| | 148| 7| const uint16_t selected_id = reader.get_uint16_t(); 149| 7| m_impl = std::make_unique(Server_PSK(selected_id)); 150| 79| } else if(message_type == Handshake_Type::ClientHello) { ------------------ | Branch (150:14): [True: 75, False: 4] ------------------ 151| 75| const auto identities_length = reader.get_uint16_t(); 152| 75| const auto identities_offset = reader.read_so_far(); 153| | 154| 75| std::vector psk_identities; 155| 616| while(reader.has_remaining() && (reader.read_so_far() - identities_offset) < identities_length) { ------------------ | Branch (155:13): [True: 589, False: 27] | Branch (155:39): [True: 541, False: 48] ------------------ 156| | /* Per RFC 8446 PskIdentity is 157| | 158| | struct { 159| | opaque identity<1..2^16-1>; 160| | uint32 obfuscated_ticket_age; 161| | } PskIdentity; 162| | 163| | so we should reject an empty identity. However BoGo seems to expect 164| | being able to send us such an identity, so for now we accept it. 165| | */ 166| | 167| 541| auto identity = reader.get_tls_length_value(2); 168| 541| const auto obfuscated_ticket_age = reader.get_uint32_t(); 169| 541| psk_identities.emplace_back(std::move(identity), obfuscated_ticket_age); 170| 541| } 171| | 172| 75| if(psk_identities.empty()) { ------------------ | Branch (172:10): [True: 1, False: 74] ------------------ 173| 1| throw TLS_Exception(Alert::DecodeError, "Empty PSK list"); 174| 1| } 175| | 176| 74| if(reader.read_so_far() - identities_offset != identities_length) { ------------------ | Branch (176:10): [True: 16, False: 58] ------------------ 177| 16| throw TLS_Exception(Alert::DecodeError, "Inconsistent PSK identity list"); 178| 16| } 179| | 180| 58| const auto binders_length = reader.get_uint16_t(); 181| 58| const auto binders_offset = reader.read_so_far(); 182| | 183| 58| if(binders_length == 0) { ------------------ | Branch (183:10): [True: 1, False: 57] ------------------ 184| 1| throw TLS_Exception(Alert::DecodeError, "Empty PSK binders list"); 185| 1| } 186| | 187| 57| std::vector psks; 188| 287| for(auto& psk_identity : psk_identities) { ------------------ | Branch (188:30): [True: 287, False: 51] ------------------ 189| 287| if(!reader.has_remaining() || reader.read_so_far() - binders_offset >= binders_length) { ------------------ | Branch (189:13): [True: 2, False: 285] | Branch (189:40): [True: 4, False: 281] ------------------ 190| 6| throw TLS_Exception(Alert::IllegalParameter, "Not enough PSK binders"); 191| 6| } 192| | 193| | // RFC 8446 4.2.11 declares PskBinderEntry opaque<32..255>, but we accept any 194| | // 0..255 length here and let validate_binder reject, which yields a bad_record_mac 195| | // alert rather than decode_error. BoringSSL behaves the same way and BoGo has 196| | // tests that specifically expect this. 197| | 198| 281| psks.emplace_back(std::move(psk_identity), reader.get_tls_length_value(1)); 199| 281| } 200| | 201| 51| if(reader.read_so_far() - binders_offset != binders_length) { ------------------ | Branch (201:10): [True: 14, False: 37] ------------------ 202| 14| throw TLS_Exception(Alert::IllegalParameter, "Too many PSK binders"); 203| 14| } 204| | 205| 37| m_impl = std::make_unique(std::move(psks)); 206| 37| } else { 207| 4| throw TLS_Exception(Alert::DecodeError, "Found a PSK extension in an unexpected handshake message"); 208| 4| } 209| 87|} _ZN5Botan3TLS3PSKD2Ev: 231| 21|PSK::~PSK() = default; tls_extensions_psk.cpp:_ZN5Botan3TLS12_GLOBAL__N_110Server_PSKC2Et: 109| 7| explicit Server_PSK(uint16_t id) : m_selected_identity(id), m_session_to_resume_or_psk(std::monostate()) {} tls_extensions_psk.cpp:_ZN5Botan3TLS12_GLOBAL__N_110Client_PSKC2ENS0_11PskIdentityENSt3__16vectorIhNS4_9allocatorIhEEEE: 56| 276| m_identity(std::move(id)), m_binder(std::move(bndr)), m_is_resumption(false) {} tls_extensions_psk.cpp:_ZN5Botan3TLS3PSK12PSK_InternalC2ENS0_12_GLOBAL__N_110Server_PSKE: 134| 7| explicit PSK_Internal(Server_PSK srv_psk) : psk(std::move(srv_psk)) {} tls_extensions_psk.cpp:_ZN5Botan3TLS3PSK12PSK_InternalC2ENSt3__16vectorINS0_12_GLOBAL__N_110Client_PSKENS3_9allocatorIS6_EEEE: 136| 14| explicit PSK_Internal(std::vector clt_psks) : psk(std::move(clt_psks)) {} _ZN5Botan3TLS15Handshake_Layer9copy_dataENSt3__14spanIKhLm18446744073709551615EEE: 22| 11.8k|void Handshake_Layer::copy_data(std::span data_from_peer) { 23| | // Compact consumed data before appending new data 24| 11.8k| BOTAN_ASSERT_NOMSG(m_read_offset <= m_read_buffer.size()); ------------------ | | 77| 11.8k| do { \ | | 78| 11.8k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 11.8k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 11.8k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 11.8k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 11.8k] | | ------------------ ------------------ 25| 11.8k| if(m_read_offset > 0) { ------------------ | Branch (25:7): [True: 0, False: 11.8k] ------------------ 26| 0| m_read_buffer.erase(m_read_buffer.begin(), m_read_buffer.begin() + m_read_offset); 27| 0| m_read_offset = 0; 28| 0| } 29| | 30| 11.8k| m_read_buffer.insert(m_read_buffer.end(), data_from_peer.begin(), data_from_peer.end()); 31| 11.8k|} _ZN5Botan3TLS15Handshake_Layer12next_messageERKNS0_6PolicyERNS0_21Transcript_Hash_StateE: 141| 11.8k| Transcript_Hash_State& transcript_hash) { 142| 11.8k| BOTAN_ASSERT_NOMSG(m_read_offset <= m_read_buffer.size()); ------------------ | | 77| 11.8k| do { \ | | 78| 11.8k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 11.8k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 11.8k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 11.8k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 11.8k] | | ------------------ ------------------ 143| 11.8k| auto pending = std::span{m_read_buffer}.subspan(m_read_offset); 144| 11.8k| TLS::TLS_Data_Reader reader("handshake message", pending); 145| | 146| 11.8k| auto msg = parse_message(reader, policy, m_peer, m_certificate_type); 147| 11.8k| if(msg.has_value()) { ------------------ | Branch (147:7): [True: 3.33k, False: 8.54k] ------------------ 148| 3.33k| transcript_hash.update(pending.first(reader.read_so_far())); 149| 3.33k| m_read_offset += reader.read_so_far(); 150| 3.33k| BOTAN_ASSERT_NOMSG(m_read_offset <= m_read_buffer.size()); ------------------ | | 77| 3.33k| do { \ | | 78| 3.33k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 3.33k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 3.33k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 3.33k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 3.33k] | | ------------------ ------------------ 151| | 152| 3.33k| if(m_read_offset == m_read_buffer.size()) { ------------------ | Branch (152:10): [True: 3.30k, False: 30] ------------------ 153| 3.30k| m_read_buffer.clear(); 154| 3.30k| m_read_offset = 0; 155| 3.30k| } 156| 3.33k| } 157| | 158| 11.8k| return msg; 159| 11.8k|} tls_handshake_layer_13.cpp:_ZN5Botan3TLS12_GLOBAL__N_113parse_messageINSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEEENS3_8optionalIT_EERNS0_15TLS_Data_ReaderERKNS0_6PolicyENS0_15Connection_SideENS0_16Certificate_TypeE: 78| 11.8k| const Certificate_Type cert_type) { 79| | // read the message header 80| 11.8k| if(reader.remaining_bytes() < HEADER_LENGTH) { ------------------ | Branch (80:7): [True: 80, False: 11.8k] ------------------ 81| 80| return std::nullopt; 82| 80| } 83| | 84| 11.8k| const Handshake_Type type = handshake_type_from_byte(reader.get_byte()); 85| | 86| | // make sure we have received the full message 87| 11.8k| const size_t msg_len = reader.get_uint24_t(); 88| | 89| | // TODO(Botan4) this is split out due to a GCC 11 ICE, can be inlined 90| 11.8k| verify_handshake_message_size(msg_len, policy.maximum_handshake_message_size()); 91| | 92| 11.8k| if(reader.remaining_bytes() < msg_len) { ------------------ | Branch (92:7): [True: 6.48k, False: 5.32k] ------------------ 93| 6.48k| return std::nullopt; 94| 6.48k| } 95| | 96| | // create the message 97| 5.32k| const auto msg = reader.get_fixed(msg_len); 98| 5.32k| if constexpr(std::is_same_v) { 99| 5.32k| switch(type) { 100| | // Client Hello and Server Hello messages are ambiguous. Both may come 101| | // from non-TLS 1.3 peers. Hence, their parsing is somewhat different. 102| 3.88k| case Handshake_Type::ClientHello: ------------------ | Branch (102:10): [True: 3.88k, False: 1.43k] ------------------ 103| | // ... might be TLS 1.2 Client Hello or TLS 1.3 Client Hello 104| 3.88k| return generalize_to(Client_Hello_13::parse(msg)); 105| 125| case Handshake_Type::ServerHello: ------------------ | Branch (105:10): [True: 125, False: 5.19k] ------------------ 106| | // ... might be TLS 1.2 Server Hello or TLS 1.3 Server Hello or 107| | // a TLS 1.3 Hello Retry Request disguising as a Server Hello 108| 125| return generalize_to(Server_Hello_13::parse(msg)); 109| | // case Handshake_Type::EndOfEarlyData: 110| | // return End_Of_Early_Data(msg); 111| 659| case Handshake_Type::EncryptedExtensions: ------------------ | Branch (111:10): [True: 659, False: 4.66k] ------------------ 112| 659| return Encrypted_Extensions(msg); 113| 543| case Handshake_Type::Certificate: ------------------ | Branch (113:10): [True: 543, False: 4.77k] ------------------ 114| 543| return Certificate_13(msg, policy, peer_side, cert_type); 115| 1| case Handshake_Type::CertificateRequest: ------------------ | Branch (115:10): [True: 1, False: 5.31k] ------------------ 116| 1| return Certificate_Request_13(msg, peer_side); 117| 59| case Handshake_Type::CertificateVerify: ------------------ | Branch (117:10): [True: 59, False: 5.26k] ------------------ 118| 59| return Certificate_Verify_13(msg, peer_side); 119| 10| case Handshake_Type::Finished: ------------------ | Branch (119:10): [True: 10, False: 5.31k] ------------------ 120| 10| return Finished_13(msg); 121| 0| default: ------------------ | Branch (121:10): [True: 0, False: 5.32k] ------------------ 122| 0| BOTAN_ASSERT(false, "cannot be reached"); // make sure to update handshake_type_from_byte ------------------ | | 64| 0| do { \ | | 65| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 0| if(!(expr)) { \ | | ------------------ | | | Branch (66:10): [True: 0, Folded] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 0| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 0] | | ------------------ ------------------ 123| 5.32k| } 124| | } else { 125| | BOTAN_UNUSED(peer_side); 126| | 127| | switch(type) { 128| | case Handshake_Type::NewSessionTicket: 129| | return New_Session_Ticket_13(msg, peer_side); 130| | case Handshake_Type::KeyUpdate: 131| | return Key_Update(msg); 132| | default: 133| | BOTAN_ASSERT(false, "cannot be reached"); // make sure to update handshake_type_from_byte 134| | } 135| | } 136| 5.32k|} tls_handshake_layer_13.cpp:_ZN5Botan3TLS12_GLOBAL__N_124handshake_type_from_byteINSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEEENS0_14Handshake_TypeEh: 38| 11.8k|Handshake_Type handshake_type_from_byte(uint8_t byte_value) { 39| 11.8k| const auto type = static_cast(byte_value); 40| | 41| 11.8k| if constexpr(std::is_same_v) { 42| 11.8k| switch(type) { 43| 4.28k| case Handshake_Type::ClientHello: ------------------ | Branch (43:10): [True: 4.28k, False: 7.51k] ------------------ 44| 4.60k| case Handshake_Type::ServerHello: ------------------ | Branch (44:10): [True: 322, False: 11.4k] ------------------ 45| | // case Handshake_Type::EndOfEarlyData: // NYI: needs PSK/resumption support -- won't be offered in Client Hello for now 46| 5.52k| case Handshake_Type::EncryptedExtensions: ------------------ | Branch (46:10): [True: 920, False: 10.8k] ------------------ 47| 7.20k| case Handshake_Type::Certificate: ------------------ | Branch (47:10): [True: 1.67k, False: 10.1k] ------------------ 48| 10.4k| case Handshake_Type::CertificateRequest: ------------------ | Branch (48:10): [True: 3.19k, False: 8.60k] ------------------ 49| 11.1k| case Handshake_Type::CertificateVerify: ------------------ | Branch (49:10): [True: 704, False: 11.0k] ------------------ 50| 11.7k| case Handshake_Type::Finished: ------------------ | Branch (50:10): [True: 683, False: 11.1k] ------------------ 51| 11.7k| return type; 52| 10| default: ------------------ | Branch (52:10): [True: 10, False: 11.7k] ------------------ 53| 10| throw TLS_Exception(AlertType::UnexpectedMessage, "Unknown handshake message received"); 54| 11.8k| } 55| | } else { 56| | switch(type) { 57| | case Handshake_Type::NewSessionTicket: 58| | case Handshake_Type::KeyUpdate: 59| | // case Handshake_Type::CertificateRequest: // NYI: post-handshake client auth (RFC 8446 4.6.2) -- won't be offered in Client Hello for now 60| | return type; 61| | default: 62| | throw TLS_Exception(AlertType::UnexpectedMessage, "Unknown post-handshake message received"); 63| | } 64| | } 65| 11.8k|} tls_handshake_layer_13.cpp:_ZN5Botan3TLS12_GLOBAL__N_129verify_handshake_message_sizeEmm: 67| 11.7k|void verify_handshake_message_size(size_t msg_len, size_t max_size) { 68| 11.7k| if(max_size > 0 && msg_len > max_size) { ------------------ | Branch (68:7): [True: 11.7k, False: 0] | Branch (68:23): [True: 25, False: 11.7k] ------------------ 69| 25| throw TLS_Exception(Alert::HandshakeFailure, 70| 25| Botan::fmt("Handshake message is {} bytes, policy maximum is {}", msg_len, max_size)); 71| 25| } 72| 11.7k|} _ZN5Botan3TLS8Internal23Handshake_State_13_Base5storeENS0_20Client_Hello_12_ShimEb: 26| 3.13k|Client_Hello_12_Shim& Handshake_State_13_Base::store(Client_Hello_12_Shim client_hello, const bool /*from_peer*/) { 27| 3.13k| BOTAN_STATE_CHECK(!m_client_hello_12.has_value()); ------------------ | | 51| 3.13k| do { \ | | 52| 3.13k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 3.13k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 3.13k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 3.13k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 3.13k] | | ------------------ ------------------ 28| 3.13k| m_client_hello_12 = std::move(client_hello); 29| 3.13k| return m_client_hello_12.value(); 30| 3.13k|} _ZN5Botan3TLS12Record_LayerC2ENS0_15Connection_SideENSt3__110shared_ptrIKNS0_6PolicyEEE: 150| 5.57k| m_side(side), 151| 5.57k| m_policy(std::move(policy)), 152| 5.57k| m_outgoing_record_size_limit(MAX_PLAINTEXT_SIZE + 1 /* content type byte */), 153| 5.57k| m_incoming_record_size_limit(MAX_PLAINTEXT_SIZE + 1 /* content type byte */) 154| | 155| | // RFC 8446 5.1 156| | // legacy_record_version: MUST be set to 0x0303 for all records 157| | // generated by a TLS 1.3 implementation other than an initial 158| | // ClientHello [...], where it MAY also be 0x0301 for compatibility 159| | // purposes. 160| | // 161| | // Additionally, older peers might send other values while requesting a 162| | // protocol downgrade. I.e. we need to be able to tolerate/emit legacy 163| | // values until we negotiated a TLS 1.3 compliant connection. 164| | // 165| | // As a client: we may initially emit the compatibility version and 166| | // accept a wider range of incoming legacy record versions. 167| | // As a server: we start with emitting the specified legacy version of 0x0303 168| | // but must also allow a wider range of incoming legacy values. 169| | // 170| | // Once TLS 1.3 is negotiateed, the implementations will disable these 171| | // compatibility modes accordingly or a protocol downgrade will transfer 172| | // the marshalling responsibility to our TLS 1.2 implementation. 173| | , 174| 5.57k| m_sending_compat_mode(m_side == Connection_Side::Client), 175| 5.57k| m_receiving_compat_mode(true) { 176| 5.57k| BOTAN_ASSERT_NONNULL(m_policy); ------------------ | | 116| 5.57k| do { \ | | 117| 5.57k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 5.57k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 5.57k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 5.57k] | | ------------------ ------------------ 177| 5.57k|} _ZN5Botan3TLS12Record_Layer9copy_dataENSt3__14spanIKhLm18446744073709551615EEE: 179| 5.57k|void Record_Layer::copy_data(std::span data) { 180| | // Compact consumed data before appending new data 181| 5.57k| BOTAN_ASSERT_NOMSG(m_read_offset <= m_read_buffer.size()); ------------------ | | 77| 5.57k| do { \ | | 78| 5.57k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 5.57k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 5.57k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 5.57k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 5.57k] | | ------------------ ------------------ 182| 5.57k| if(m_read_offset > 0) { ------------------ | Branch (182:7): [True: 0, False: 5.57k] ------------------ 183| 0| m_read_buffer.erase(m_read_buffer.begin(), m_read_buffer.begin() + m_read_offset); 184| 0| m_read_offset = 0; 185| 0| } 186| | 187| 5.57k| m_read_buffer.insert(m_read_buffer.end(), data.begin(), data.end()); 188| 5.57k|} _ZNK5Botan3TLS12Record_Layer15prepare_recordsENS0_11Record_TypeENSt3__14spanIKhLm18446744073709551615EEEPNS0_12Cipher_StateE: 192| 2.29k| Cipher_State* cipher_state) const { 193| | // RFC 8446 5. 194| | // Note that [change_cipher_spec records] may appear at a point at the 195| | // handshake where the implementation is expecting protected records. 196| | // 197| | // RFC 8446 5. 198| | // An implementation which receives [...] a protected change_cipher_spec 199| | // record MUST abort the handshake [...]. 200| | // 201| | // ... hence, CHANGE_CIPHER_SPEC is never protected, even if a usable cipher 202| | // state was passed to this method. 203| 2.29k| const bool protect = cipher_state != nullptr && type != Record_Type::ChangeCipherSpec; ------------------ | Branch (203:25): [True: 0, False: 2.29k] | Branch (203:52): [True: 0, False: 0] ------------------ 204| | 205| | // RFC 8446 5.1 206| 2.29k| BOTAN_ASSERT(protect || type != Record_Type::ApplicationData, ------------------ | | 64| 2.29k| do { \ | | 65| 2.29k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 4.59k| if(!(expr)) { \ | | ------------------ | | | Branch (66:12): [True: 0, False: 2.29k] | | | Branch (66:12): [True: 2.29k, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 2.29k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 2.29k] | | ------------------ ------------------ 207| 2.29k| "Application Data records MUST NOT be written to the wire unprotected"); 208| | 209| | // RFC 8446 5.1 210| | // "MUST NOT sent zero-length fragments of Handshake types" 211| | // "a record with an Alert type MUST contain exactly one message" [of non-zero length] 212| | // "Zero-length fragments of Application Data MAY be sent" 213| 2.29k| BOTAN_ASSERT(!data.empty() || type == Record_Type::ApplicationData, ------------------ | | 64| 2.29k| do { \ | | 65| 2.29k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 66| 2.29k| if(!(expr)) { \ | | ------------------ | | | Branch (66:12): [True: 2.29k, False: 0] | | | Branch (66:12): [True: 0, False: 0] | | ------------------ | | 67| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 68| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 69| 0| } \ | | 70| 2.29k| } while(0) | | ------------------ | | | Branch (70:12): [Folded, False: 2.29k] | | ------------------ ------------------ 214| 2.29k| "zero-length fragments of types other than application data are not allowed"); 215| | 216| 2.29k| if(type == Record_Type::ChangeCipherSpec && !verify_change_cipher_spec(data.begin(), data.size())) { ------------------ | Branch (216:7): [True: 0, False: 2.29k] | Branch (216:48): [True: 0, False: 0] ------------------ 217| 0| throw Invalid_Argument("TLS 1.3 deprecated CHANGE_CIPHER_SPEC"); 218| 0| } 219| | 220| 2.29k| std::vector output; 221| | 222| | // RFC 8446 5.2 223| | // type: The TLSPlaintext.type value containing the content type of the record. 224| 2.29k| constexpr size_t content_type_tag_length = 1; 225| | 226| | // RFC 8449 4. 227| | // When the "record_size_limit" extension is negotiated, an endpoint 228| | // MUST NOT generate a protected record with plaintext that is larger 229| | // than the RecordSizeLimit value it receives from its peer. 230| | // Unprotected messages are not subject to this limit. 231| 2.29k| const size_t max_plaintext_size = 232| 2.29k| (protect) ? m_outgoing_record_size_limit - content_type_tag_length : static_cast(MAX_PLAINTEXT_SIZE); ------------------ | Branch (232:7): [True: 0, False: 2.29k] ------------------ 233| | 234| 2.29k| const auto records = std::max((data.size() + max_plaintext_size - 1) / max_plaintext_size, size_t(1)); 235| 2.29k| auto output_length = records * TLS_HEADER_SIZE; 236| | 237| | // Policy-requested padding (RFC 9846 5.4) is applied to the final record 238| | // only; all preceding records are filled to the maximum plaintext size 239| | // already, leaving no room for padding within the record size limit. 240| 2.29k| size_t final_record_padding = 0; 241| | 242| 2.29k| if(protect) { ------------------ | Branch (242:7): [True: 0, False: 2.29k] ------------------ 243| | // n-1 full records of size max_plaintext_size 244| 0| output_length += 245| 0| (records - 1) * cipher_state->encrypt_output_length(max_plaintext_size + content_type_tag_length); 246| | // last record with size of remaining data 247| 0| const auto remaining_bytes = data.size() - ((records - 1) * max_plaintext_size) + content_type_tag_length; 248| 0| final_record_padding = std::min(m_policy->record_padding_bytes(remaining_bytes), 249| 0| m_outgoing_record_size_limit - remaining_bytes); 250| 0| output_length += cipher_state->encrypt_output_length(remaining_bytes + final_record_padding); 251| 2.29k| } else { 252| 2.29k| output_length += data.size(); 253| 2.29k| } 254| 2.29k| output.reserve(output_length); 255| | 256| 2.29k| size_t pt_offset = 0; 257| 2.29k| size_t to_process = data.size(); 258| | 259| | // For protected records we need to write at least one encrypted fragment, 260| | // even if the plaintext size is zero. This happens only for Application 261| | // Data types. 262| 2.29k| BOTAN_ASSERT_NOMSG(to_process != 0 || protect); ------------------ | | 77| 2.29k| do { \ | | 78| 2.29k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 2.29k| if(!(expr)) { \ | | ------------------ | | | Branch (79:12): [True: 2.29k, False: 0] | | | Branch (79:12): [True: 0, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 2.29k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 2.29k] | | ------------------ ------------------ 263| | // NOLINTNEXTLINE(*-avoid-do-while) 264| 2.29k| do { 265| 2.29k| const size_t pt_size = std::min(to_process, max_plaintext_size); 266| 2.29k| const size_t pt_size_with_type = pt_size + content_type_tag_length; 267| 2.29k| const bool final_record = (pt_size == to_process); 268| 2.29k| const size_t pt_size_with_type_and_padding = pt_size_with_type + (final_record ? final_record_padding : 0); ------------------ | Branch (268:73): [True: 2.29k, False: 0] ------------------ 269| 2.29k| BOTAN_ASSERT_IMPLICATION(protect, ------------------ | | 103| 2.29k| do { \ | | 104| 2.29k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 105| 2.29k| if((expr1) && !(expr2)) { \ | | ------------------ | | | Branch (105:10): [True: 0, False: 2.29k] | | | Branch (105:21): [True: 0, False: 0] | | ------------------ | | 106| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 107| 0| Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \ | | 108| 0| } \ | | 109| 2.29k| } while(0) | | ------------------ | | | Branch (109:12): [Folded, False: 2.29k] | | ------------------ ------------------ 270| 2.29k| pt_size_with_type_and_padding <= m_outgoing_record_size_limit, 271| 2.29k| "Padded record size is within the negotiated record size limit"); 272| | 273| 2.29k| const size_t ct_size = (!protect) ? pt_size : cipher_state->encrypt_output_length(pt_size_with_type_and_padding); ------------------ | Branch (273:30): [True: 2.29k, False: 0] ------------------ 274| 2.29k| const auto pt_type = (!protect) ? type : Record_Type::ApplicationData; ------------------ | Branch (274:28): [True: 2.29k, False: 0] ------------------ 275| | 276| | // RFC 8446 5.1 277| | // MUST be set to 0x0303 for all records generated by a TLS 1.3 278| | // implementation other than an initial ClientHello [...], where 279| | // it MAY also be 0x0301 for compatibility purposes. 280| 2.29k| const auto record_header = TLSPlaintext_Header(pt_type, ct_size, m_sending_compat_mode).serialized(); 281| | 282| 2.29k| output.insert(output.end(), record_header.cbegin(), record_header.cend()); 283| | 284| 2.29k| auto pt_fragment = data.subspan(pt_offset, pt_size); 285| 2.29k| if(protect) { ------------------ | Branch (285:10): [True: 0, False: 2.29k] ------------------ 286| 0| secure_vector fragment; 287| 0| fragment.reserve(ct_size); 288| | 289| | // assemble TLSInnerPlaintext structure 290| 0| fragment.insert(fragment.end(), pt_fragment.begin(), pt_fragment.end()); 291| 0| fragment.push_back(static_cast(type)); 292| | 293| | // RFC 9846 5.4 294| | // When generating a TLSCiphertext record, implementations MAY 295| | // choose to pad. [...] Implementations MUST set the padding octets 296| | // to all zeros before encrypting. 297| 0| fragment.insert(fragment.end(), pt_size_with_type_and_padding - pt_size_with_type, 0x00); 298| | 299| 0| cipher_state->encrypt_record_fragment(record_header, fragment); 300| 0| BOTAN_ASSERT_NOMSG(fragment.size() == ct_size); ------------------ | | 77| 0| do { \ | | 78| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 0| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 0| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 0] | | ------------------ ------------------ 301| | 302| 0| output.insert(output.end(), fragment.cbegin(), fragment.cend()); 303| 2.29k| } else { 304| 2.29k| output.insert(output.end(), pt_fragment.begin(), pt_fragment.end()); 305| 2.29k| } 306| | 307| 2.29k| pt_offset += pt_size; 308| 2.29k| to_process -= pt_size; 309| 2.29k| } while(to_process > 0); ------------------ | Branch (309:12): [True: 0, False: 2.29k] ------------------ 310| | 311| 2.29k| BOTAN_ASSERT_NOMSG(output.size() == output_length); ------------------ | | 77| 2.29k| do { \ | | 78| 2.29k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 2.29k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 2.29k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 2.29k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 2.29k] | | ------------------ ------------------ 312| 2.29k| return output; 313| 2.29k|} _ZN5Botan3TLS12Record_Layer11next_recordEPNS0_12Cipher_StateE: 315| 13.0k|Record_Layer::ReadResult Record_Layer::next_record(Cipher_State* cipher_state) { 316| | // Special case: on the record boundary we don't actually need any more data 317| | // and we also don't want to be the know-it-all that now demands exactly 318| | // enough bytes to start parsing the next record header. 319| 13.0k| if(m_read_buffer.empty()) { ------------------ | Branch (319:7): [True: 75, False: 12.9k] ------------------ 320| 75| return BytesNeeded(0); 321| 75| } 322| | 323| 12.9k| const auto remaining = m_read_buffer.size() - m_read_offset; 324| | 325| 12.9k| if(remaining < TLS_HEADER_SIZE) { ------------------ | Branch (325:7): [True: 20, False: 12.9k] ------------------ 326| 20| return TLS_HEADER_SIZE - remaining; 327| 20| } 328| | 329| 12.9k| const auto header_begin = m_read_buffer.cbegin() + m_read_offset; 330| 12.9k| const auto header_end = header_begin + TLS_HEADER_SIZE; 331| | 332| | // The first received record(s) are likely a client or server hello. To be able to 333| | // perform protocol downgrades we must be less vigorous with the record's 334| | // legacy version. Hence, `check_tls13_version` is `false` for the first record(s). 335| 12.9k| const TLSPlaintext_Header plaintext_header({header_begin, header_end}, !m_receiving_compat_mode); 336| | 337| | // After the key exchange phase of the handshake is completed and record protection is engaged, 338| | // cipher_state is set. At this point, only protected traffic (and CCS) is allowed. 339| | // 340| | // RFC 8446 2. 341| | // - Key Exchange: Establish shared keying material and select the 342| | // cryptographic parameters. Everything after this phase is 343| | // encrypted. 344| | // RFC 8446 5. 345| | // An implementation may receive an unencrypted [CCS] at any time 346| 12.9k| if(cipher_state != nullptr && plaintext_header.type() != Record_Type::ApplicationData && ------------------ | Branch (346:7): [True: 0, False: 12.9k] | Branch (346:34): [True: 0, False: 0] ------------------ 347| 0| plaintext_header.type() != Record_Type::ChangeCipherSpec && ------------------ | Branch (347:7): [True: 0, False: 0] ------------------ 348| 0| (!cipher_state->must_expect_unprotected_alert_traffic() || plaintext_header.type() != Record_Type::Alert)) { ------------------ | Branch (348:8): [True: 0, False: 0] | Branch (348:66): [True: 0, False: 0] ------------------ 349| 0| throw TLS_Exception(Alert::UnexpectedMessage, "unprotected record received where protected traffic was expected"); 350| 0| } 351| | 352| 12.9k| if(remaining < TLS_HEADER_SIZE + plaintext_header.fragment_length()) { ------------------ | Branch (352:7): [True: 39, False: 12.9k] ------------------ 353| 39| return TLS_HEADER_SIZE + plaintext_header.fragment_length() - remaining; 354| 39| } 355| | 356| 12.9k| const auto fragment_begin = header_end; 357| 12.9k| const auto fragment_end = fragment_begin + plaintext_header.fragment_length(); 358| | 359| 12.9k| if(plaintext_header.type() == Record_Type::ChangeCipherSpec && ------------------ | Branch (359:7): [True: 13, False: 12.8k] ------------------ 360| 13| !verify_change_cipher_spec(fragment_begin, plaintext_header.fragment_length())) { ------------------ | Branch (360:7): [True: 12, False: 1] ------------------ 361| 12| throw TLS_Exception(Alert::UnexpectedMessage, "malformed change cipher spec record received"); 362| 12| } 363| | 364| 12.8k| Record record(plaintext_header.type(), secure_vector(fragment_begin, fragment_end)); 365| 12.8k| m_read_offset += TLS_HEADER_SIZE + plaintext_header.fragment_length(); 366| | 367| | // If all buffered data has been consumed, release the buffer memory 368| | // to avoid retaining peak allocation on idle connections. 369| 12.8k| if(m_read_offset == m_read_buffer.size()) { ------------------ | Branch (369:7): [True: 2.74k, False: 10.1k] ------------------ 370| 2.74k| zap(m_read_buffer); 371| 2.74k| m_read_offset = 0; 372| 2.74k| } 373| | 374| 12.8k| if(record.type == Record_Type::ApplicationData) { ------------------ | Branch (374:7): [True: 6, False: 12.8k] ------------------ 375| 6| if(cipher_state == nullptr) { ------------------ | Branch (375:10): [True: 6, False: 0] ------------------ 376| | // This could also mean a misuse of the interface, i.e. failing to provide a valid 377| | // cipher_state to parse_records when receiving valid (encrypted) Application Data. 378| 6| throw TLS_Exception(Alert::UnexpectedMessage, "premature Application Data received"); 379| 6| } 380| | 381| 0| if(record.fragment.size() < cipher_state->minimum_decryption_input_length()) { ------------------ | Branch (381:10): [True: 0, False: 0] ------------------ 382| 0| throw TLS_Exception(Alert::BadRecordMac, "incomplete record mac received"); 383| 0| } 384| | 385| 0| if(cipher_state->decrypt_output_length(record.fragment.size()) > m_incoming_record_size_limit) { ------------------ | Branch (385:10): [True: 0, False: 0] ------------------ 386| 0| throw TLS_Exception(Alert::RecordOverflow, "Received an encrypted record that exceeds maximum plaintext size"); 387| 0| } 388| | 389| 0| record.seq_no = cipher_state->decrypt_record_fragment(plaintext_header.serialized(), record.fragment); 390| | 391| | // Remove record padding (RFC 8446 5.4). The TLSInnerPlaintext layout is 392| | // content || content_type || zero_padding 393| 0| auto seen_nonzero = CT::Mask::cleared(); 394| 0| uint8_t content_type_byte = 0; 395| 0| size_t content_index = 0; 396| 0| for(size_t i = record.fragment.size(); i-- > 0;) { ------------------ | Branch (396:46): [True: 0, False: 0] ------------------ 397| 0| const uint8_t b = record.fragment[i]; 398| 0| const auto byte_is_nonzero = CT::Mask::expand(b); 399| | // Set on the first non-zero byte we encounter scanning right-to-left. 400| 0| const auto first_nonzero = byte_is_nonzero & ~seen_nonzero; 401| 0| content_type_byte = first_nonzero.select(b, content_type_byte); 402| 0| content_index = CT::Mask::expand(first_nonzero.value()).select(i, content_index); 403| 0| seen_nonzero |= byte_is_nonzero; 404| 0| } 405| | 406| 0| if(!seen_nonzero.as_bool()) { ------------------ | Branch (406:10): [True: 0, False: 0] ------------------ 407| | // RFC 8446 5.4 408| | // If a receiving implementation does not 409| | // find a non-zero octet in the cleartext, it MUST terminate the 410| | // connection with an "unexpected_message" alert. 411| 0| throw TLS_Exception(Alert::UnexpectedMessage, "No content type found in encrypted record"); 412| 0| } 413| | 414| | // hydrate the actual content type from TLSInnerPlaintext 415| 0| record.type = read_record_type(content_type_byte); 416| | 417| 0| if(record.type == Record_Type::ChangeCipherSpec) { ------------------ | Branch (417:10): [True: 0, False: 0] ------------------ 418| | // RFC 8446 5 419| | // An implementation [...] which receives a protected change_cipher_spec record MUST 420| | // abort the handshake with an "unexpected_message" alert. 421| 0| throw TLS_Exception(Alert::UnexpectedMessage, "protected change cipher spec received"); 422| 0| } 423| | 424| | // Truncate to drop the content_type byte and padding. resize() on a 425| | // vector of trivially-destructible elements is bookkeeping-only and 426| | // does not allocate or iterate over the dropped suffix. 427| 0| record.fragment.resize(content_index); 428| | 429| | // RFC 8446 5.4 430| | // Implementations MUST NOT send Handshake and Alert records that have 431| | // a zero-length TLSInnerPlaintext.content; if such a message is 432| | // received, the receiving implementation MUST terminate the connection 433| | // with an "unexpected_message" alert. 434| 0| if(record.fragment.empty() && record.type != Record_Type::ApplicationData) { ------------------ | Branch (434:10): [True: 0, False: 0] | Branch (434:37): [True: 0, False: 0] ------------------ 435| 0| throw TLS_Exception(Alert::UnexpectedMessage, 436| 0| "Received a protected record with empty TLSInnerPlaintext content"); 437| 0| } 438| 0| } 439| | 440| 12.8k| return record; 441| 12.8k|} tls_record_layer_13.cpp:_ZN5Botan3TLS12_GLOBAL__N_119TLSPlaintext_HeaderC2ENS0_11Record_TypeEmb: 120| 2.29k| m_type(record_type), 121| 2.29k| m_legacy_version(use_compatibility_version ? 0x0301 : 0x0303) // RFC 8446 5.1 ------------------ | Branch (121:30): [True: 0, False: 2.29k] ------------------ 122| | , 123| 2.29k| m_fragment_length(static_cast(frgmnt_length)), 124| 2.29k| m_serialized({ 125| 2.29k| static_cast(m_type), 126| 2.29k| m_legacy_version.major_version(), 127| 2.29k| m_legacy_version.minor_version(), 128| 2.29k| get_byte<0>(m_fragment_length), 129| 2.29k| get_byte<1>(m_fragment_length), 130| 2.29k| }) {} tls_record_layer_13.cpp:_ZNK5Botan3TLS12_GLOBAL__N_119TLSPlaintext_Header10serializedEv: 138| 2.29k| const std::vector& serialized() const { return m_serialized; } tls_record_layer_13.cpp:_ZN5Botan3TLS12_GLOBAL__N_119TLSPlaintext_HeaderC2ENSt3__16vectorIhNS3_9allocatorIhEEEEb: 57| 12.9k| TLSPlaintext_Header(std::vector hdr, const bool check_tls13_version) { 58| | // NOLINTBEGIN(*-prefer-member-initializer) 59| 12.9k| m_type = read_record_type(hdr[0]); 60| 12.9k| m_legacy_version = Protocol_Version(make_uint16(hdr[1], hdr[2])); 61| 12.9k| m_fragment_length = make_uint16(hdr[3], hdr[4]); 62| 12.9k| m_serialized = std::move(hdr); 63| | // NOLINTEND(*-prefer-member-initializer) 64| | 65| | // If no full version check is requested, we just verify the practically 66| | // ossified major version number. 67| 12.9k| if(m_legacy_version.major_version() != 0x03) { ------------------ | Branch (67:13): [True: 22, False: 12.9k] ------------------ 68| 22| throw TLS_Exception(Alert::IllegalParameter, "Received unexpected record version"); 69| 22| } 70| | 71| | // RFC 8446 5.1 72| | // legacy_record_version: MUST be set to 0x0303 for all records 73| | // generated by a TLS 1.3 implementation 74| 12.9k| if(check_tls13_version && m_legacy_version.version_code() != 0x0303) { ------------------ | Branch (74:13): [True: 0, False: 12.9k] | Branch (74:36): [True: 0, False: 0] ------------------ 75| 0| throw TLS_Exception(Alert::IllegalParameter, "Received unexpected record version"); 76| 0| } 77| | 78| | // RFC 8446 5.1 79| | // Implementations MUST NOT send zero-length fragments of Handshake 80| | // types, even if those fragments contain padding. 81| | // 82| | // Zero-length fragments of Application Data MAY be sent, as they are 83| | // potentially useful as a traffic analysis countermeasure. 84| 12.9k| if(m_fragment_length == 0 && type() != Record_Type::ApplicationData) { ------------------ | Branch (84:13): [True: 11, False: 12.9k] | Branch (84:39): [True: 5, False: 6] ------------------ 85| 5| throw TLS_Exception(Alert::DecodeError, "empty record received"); 86| 5| } 87| | 88| 12.9k| if(m_type == Record_Type::ApplicationData) { ------------------ | Branch (88:13): [True: 23, False: 12.8k] ------------------ 89| | // RFC 8446 5.2 90| | // The length [...] is the sum of the lengths of the content and the 91| | // padding, plus one for the inner content type, plus any expansion 92| | // added by the AEAD algorithm. The length MUST NOT exceed 2^14 + 256 bytes. 93| | // 94| | // Note: Limits imposed by a "record_size_limit" extension do not come 95| | // into play here, as those limits are on the plaintext _not_ the 96| | // encrypted data. Constricted devices must be able to deal with 97| | // data overhead inflicted by the AEAD. 98| 23| if(m_fragment_length > MAX_CIPHERTEXT_SIZE_TLS13) { ------------------ | Branch (98:16): [True: 4, False: 19] ------------------ 99| 4| throw TLS_Exception(Alert::RecordOverflow, "Received an encrypted record that exceeds maximum size"); 100| 4| } 101| 12.8k| } else { 102| | // RFC 8446 5.1 103| | // The length MUST NOT exceed 2^14 bytes. An endpoint that receives a record that 104| | // exceeds this length MUST terminate the connection with a "record_overflow" alert. 105| | // 106| | // RFC 8449 4. 107| | // When the "record_size_limit" extension is negotiated, an endpoint 108| | // MUST NOT generate a protected record with plaintext that is larger 109| | // than the RecordSizeLimit value it receives from its peer. 110| | // -> Unprotected messages are not subject to this limit. <- 111| 12.8k| if(m_fragment_length > MAX_PLAINTEXT_SIZE) { ------------------ | Branch (111:16): [True: 6, False: 12.8k] ------------------ 112| 6| throw TLS_Exception(Alert::RecordOverflow, "Received a record that exceeds maximum size"); 113| 6| } 114| 12.8k| } 115| 12.9k| } tls_record_layer_13.cpp:_ZNK5Botan3TLS12_GLOBAL__N_119TLSPlaintext_Header4typeEv: 132| 25.6k| Record_Type type() const { return m_type; } tls_record_layer_13.cpp:_ZNK5Botan3TLS12_GLOBAL__N_119TLSPlaintext_Header15fragment_lengthEv: 134| 38.5k| uint16_t fragment_length() const { return m_fragment_length; } tls_record_layer_13.cpp:_ZN5Botan3TLS12_GLOBAL__N_116read_record_typeEh: 38| 12.9k|Record_Type read_record_type(const uint8_t type_byte) { 39| | // RFC 8446 5. 40| | // If a TLS implementation receives an unexpected record type, 41| | // it MUST terminate the connection with an "unexpected_message" alert. 42| 12.9k| if(type_byte != static_cast(Record_Type::ApplicationData) && ------------------ | Branch (42:7): [True: 12.9k, False: 23] ------------------ 43| 12.9k| type_byte != static_cast(Record_Type::Handshake) && ------------------ | Branch (43:7): [True: 989, False: 11.9k] ------------------ 44| 989| type_byte != static_cast(Record_Type::Alert) && ------------------ | Branch (44:7): [True: 50, False: 939] ------------------ 45| 50| type_byte != static_cast(Record_Type::ChangeCipherSpec)) { ------------------ | Branch (45:7): [True: 33, False: 17] ------------------ 46| 33| throw TLS_Exception(Alert::UnexpectedMessage, "TLS record type had unexpected value"); 47| 33| } 48| | 49| 12.9k| return static_cast(type_byte); 50| 12.9k|} tls_record_layer_13.cpp:_ZN5Botan3TLS12_GLOBAL__N_125verify_change_cipher_specINSt3__111__wrap_iterIPKhEEEEbT_m: 26| 13|bool verify_change_cipher_spec(const IteratorT data, const size_t size) { 27| | // RFC 8446 5. 28| | // An implementation may receive an unencrypted record of type 29| | // change_cipher_spec consisting of the single byte value 0x01 30| | // at any time [...]. An implementation which receives any other 31| | // change_cipher_spec value or which receives a protected 32| | // change_cipher_spec record MUST abort the handshake [...]. 33| 13| const size_t expected_fragment_length = 1; 34| 13| const uint8_t expected_fragment_byte = 0x01; 35| 13| return (size == expected_fragment_length && *data == expected_fragment_byte); ------------------ | Branch (35:12): [True: 8, False: 5] | Branch (35:48): [True: 1, False: 7] ------------------ 36| 13|} _ZN5Botan3TLS14Server_Impl_13C2ERKNSt3__110shared_ptrINS0_9CallbacksEEERKNS3_INS0_15Session_ManagerEEERKNS3_INS_19Credentials_ManagerEEERKNS3_IKNS0_6PolicyEEERKNS3_INS_21RandomNumberGeneratorEEE: 28| 5.57k| Channel_Impl_13(callbacks, session_manager, credentials_manager, rng, policy, true /* is_server */), 29| 5.57k| m_handshake(std::make_unique()) { 30| 5.57k|#if defined(BOTAN_HAS_TLS_12) 31| 5.57k| if(policy->allow_tls12()) { ------------------ | Branch (31:7): [True: 5.57k, False: 0] ------------------ 32| 5.57k| expect_downgrade({}, {}); 33| 5.57k| } 34| 5.57k|#endif 35| | 36| 5.57k| m_handshake->transitions.set_expected_next(Handshake_Type::ClientHello); 37| 5.57k|} _ZN5Botan3TLS14Server_Impl_1321process_handshake_msgENSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEE: 152| 3.32k|void Server_Impl_13::process_handshake_msg(Handshake_Message_13 message) { 153| 3.32k| BOTAN_STATE_CHECK(m_handshake != nullptr); ------------------ | | 51| 3.32k| do { \ | | 52| 3.32k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 3.32k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 3.32k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 3.32k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 3.32k] | | ------------------ ------------------ 154| | 155| | // first verify that the message was expected by the state machine 156| | // (and only then store it in the handshake state) 157| 3.32k| m_handshake->transitions.confirm_transition_to(std::visit([](const auto& msg) { return msg.type(); }, message)); 158| | 159| 3.32k| std::visit( 160| 3.32k| [&](auto msg) { 161| | // ... then allow the library user to abort on their discretion 162| 3.32k| callbacks().tls_inspect_handshake_msg(msg.get()); 163| | 164| | // ... finally handle the message 165| 3.32k| handle(msg.get()); 166| 3.32k| }, 167| 3.32k| m_handshake->state.received(std::move(message))); 168| 3.32k|} _ZN5Botan3TLS14Server_Impl_1332process_dummy_change_cipher_specEv: 181| 1|void Server_Impl_13::process_dummy_change_cipher_spec() { 182| | // RFC 8446 5. 183| | // If an implementation detects a change_cipher_spec record received before 184| | // the first ClientHello message or after the peer's Finished message, it MUST be 185| | // treated as an unexpected record type [("unexpected_message" alert)]. 186| 1| if(!m_handshake || !m_handshake->state.has_client_hello() || m_handshake->state.has_client_finished()) { ------------------ | Branch (186:7): [True: 0, False: 1] | Branch (186:23): [True: 1, False: 0] | Branch (186:65): [True: 0, False: 0] ------------------ 187| 1| throw TLS_Exception(Alert::UnexpectedMessage, "Received an unexpected dummy Change Cipher Spec"); 188| 1| } 189| | 190| | // RFC 8446 5. 191| | // An implementation may receive an unencrypted record of type change_cipher_spec [...] 192| | // at any time after the first ClientHello message has been sent or received 193| | // and before the peer's Finished message has been received [...] 194| | // and MUST simply drop it without further processing. 195| | // 196| | // ... no further processing. 197| 1|} _ZNK5Botan3TLS14Server_Impl_1321is_handshake_completeEv: 199| 11.8k|bool Server_Impl_13::is_handshake_complete() const { 200| 11.8k| return m_active_state.has_value() || (m_handshake != nullptr && m_handshake->state.handshake_finished()); ------------------ | Branch (200:11): [True: 0, False: 11.8k] | Branch (200:42): [True: 11.8k, False: 0] | Branch (200:68): [True: 0, False: 11.8k] ------------------ 201| 11.8k|} _ZN5Botan3TLS14Server_Impl_139downgradeEv: 215| 3.13k|void Server_Impl_13::downgrade() { 216| 3.13k| BOTAN_ASSERT_NOMSG(expects_downgrade()); ------------------ | | 77| 3.13k| do { \ | | 78| 3.13k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 3.13k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 3.13k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 3.13k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 3.13k] | | ------------------ ------------------ 217| | 218| 3.13k| request_downgrade(); 219| | 220| | // After this, no further messages are expected here because this instance 221| | // will be replaced by a Server_Impl_12. 222| 3.13k| m_handshake->transitions.set_expected_next({}); 223| 3.13k|} _ZN5Botan3TLS14Server_Impl_1331maybe_handle_compatibility_modeENS0_15Channel_Impl_1321Compat_Mode_SituationE: 227| 2.29k|void Server_Impl_13::maybe_handle_compatibility_mode(Compat_Mode_Situation situation) { 228| | // RFC 9846 E.4 229| | // This "compatibility mode" is partially negotiated: the client can opt 230| | // to provide a session ID or not, [...]. 231| | // 232| | // I.e., before we received a ClientHello, we cannot know whether the client 233| | // requested middlebox compatibility mode or not. 234| 2.29k| if(m_handshake == nullptr || !m_handshake->state.has_client_hello()) { ------------------ | Branch (234:7): [True: 0, False: 2.29k] | Branch (234:33): [True: 2.29k, False: 0] ------------------ 235| 2.29k| return; 236| 2.29k| } 237| | 238| | // RFC 9846 E.4 239| | // This "compatibility mode" is partially negotiated: the client can opt 240| | // to provide a session ID or not, and the server has to echo it. Either 241| | // side can send change_cipher_spec at any time during the handshake, as 242| | // they must be ignored by the peer, but if the client sends a non-empty 243| | // session ID, the server MUST send the change_cipher_spec as described 244| | // [above]. 245| | // 246| | // Technically, the usage of compatibility mode is fully up to the client 247| | // sending a non-empty session ID. Nevertheless, when the policy requests 248| | // it we send a CCS regardless. Note that this is perfectly legal and also 249| | // satisfies some BoGo tests that expect this behaviour. 250| 0| const bool client_requested_compatibility_mode = !m_handshake->state.client_hello().session_id().empty(); 251| 0| if(!policy().tls_13_middlebox_compatibility_mode() && !client_requested_compatibility_mode) { ------------------ | Branch (251:7): [True: 0, False: 0] | Branch (251:58): [True: 0, False: 0] ------------------ 252| 0| return; 253| 0| } 254| | 255| 0| switch(situation) { ------------------ | Branch (255:11): [True: 0, False: 0] ------------------ 256| 0| case Compat_Mode_Situation::AfterSendingFirstServerHello: ------------------ | Branch (256:7): [True: 0, False: 0] ------------------ 257| 0| case Compat_Mode_Situation::AfterSendingHelloRetryRequest: ------------------ | Branch (257:7): [True: 0, False: 0] ------------------ 258| | // RFC 9846 E.4 259| | // The server sends a dummy change_cipher_spec record immediately after 260| | // its first handshake message. This may either be after a ServerHello or 261| | // a HelloRetryRequest. 262| 0| send_dummy_change_cipher_spec(); 263| 0| break; 264| | 265| 0| case Compat_Mode_Situation::BeforeSendingAlert: ------------------ | Branch (265:7): [True: 0, False: 0] ------------------ 266| | // RFC 9846 E.4 267| | // The server sends a dummy change_cipher_spec record immediately after 268| | // its first handshake message. 269| | // 270| | // The server cannot send an encrypted alert message as its first 271| | // message. Hence, it won't ever need a dummy CCS before an alert. 272| 0| break; 273| | 274| 0| case Compat_Mode_Situation::AfterSendingFirstClientHello: ------------------ | Branch (274:7): [True: 0, False: 0] ------------------ 275| 0| case Compat_Mode_Situation::BeforeSendingSecondClientHello: ------------------ | Branch (275:7): [True: 0, False: 0] ------------------ 276| 0| case Compat_Mode_Situation::BeforeSendingEncryptedClientFlight: ------------------ | Branch (276:7): [True: 0, False: 0] ------------------ 277| 0| BOTAN_ASSERT_UNREACHABLE(); // These situations occur on the client side. ------------------ | | 166| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 278| 0| } 279| 0|} _ZN5Botan3TLS14Server_Impl_136handleERKNS0_20Client_Hello_12_ShimE: 486| 3.13k|void Server_Impl_13::handle(const Client_Hello_12_Shim& ch) { 487| | // The detailed handling of the TLS 1.2 compliant Client Hello is left to 488| | // the TLS 1.2 server implementation. 489| 3.13k| BOTAN_UNUSED(ch); ------------------ | | 144| 3.13k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 490| 3.13k| BOTAN_ASSERT_NONNULL(m_handshake); ------------------ | | 116| 3.13k| do { \ | | 117| 3.13k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 3.13k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 3.13k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 3.13k] | | ------------------ ------------------ 491| | 492| | // After we sent a Hello Retry Request we must not accept a downgrade. 493| 3.13k| if(m_handshake->state.has_hello_retry_request()) { ------------------ | Branch (493:7): [True: 0, False: 3.13k] ------------------ 494| 0| throw TLS_Exception(Alert::UnexpectedMessage, "Received a TLS 1.2 Client Hello after Hello Retry Request"); 495| 0| } 496| | 497| |#if !defined(BOTAN_HAS_TLS_DOWNGRADE_SUPPORT) 498| | throw TLS_Exception(Alert::ProtocolVersion, "Received an unsupported Client Hello"); 499| |#else 500| | 501| | // RFC 8446 Appendix D.2 502| | // If the "supported_versions" extension is absent and the server only 503| | // supports versions greater than ClientHello.legacy_version, the server 504| | // MUST abort the handshake with a "protocol_version" alert. 505| | // 506| | // If we're not expecting a downgrade, we only support TLS 1.3. 507| 3.13k| if(!expects_downgrade()) { ------------------ | Branch (507:7): [True: 0, False: 3.13k] ------------------ 508| 0| throw TLS_Exception(Alert::ProtocolVersion, "Received a legacy Client Hello"); 509| 0| } 510| | 511| 3.13k| downgrade(); 512| 3.13k|#endif 513| 3.13k|} tls_server_impl_13.cpp:_ZZN5Botan3TLS14Server_Impl_1321process_handshake_msgENSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEENK3$_0clIS5_EEDaRKT_: 157| 3.13k| m_handshake->transitions.confirm_transition_to(std::visit([](const auto& msg) { return msg.type(); }, message)); tls_server_impl_13.cpp:_ZZN5Botan3TLS14Server_Impl_1321process_handshake_msgENSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEENK3$_0clIS7_EEDaRKT_: 157| 22| m_handshake->transitions.confirm_transition_to(std::visit([](const auto& msg) { return msg.type(); }, message)); tls_server_impl_13.cpp:_ZZN5Botan3TLS14Server_Impl_1321process_handshake_msgENSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEENK3$_0clIS9_EEDaRKT_: 157| 152| m_handshake->transitions.confirm_transition_to(std::visit([](const auto& msg) { return msg.type(); }, message)); tls_server_impl_13.cpp:_ZZN5Botan3TLS14Server_Impl_1321process_handshake_msgENSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEENK3$_0clISA_EEDaRKT_: 157| 4| m_handshake->transitions.confirm_transition_to(std::visit([](const auto& msg) { return msg.type(); }, message)); tls_server_impl_13.cpp:_ZZN5Botan3TLS14Server_Impl_1321process_handshake_msgENSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEENK3$_0clISC_EEDaRKT_: 157| 6| m_handshake->transitions.confirm_transition_to(std::visit([](const auto& msg) { return msg.type(); }, message)); tls_server_impl_13.cpp:_ZZN5Botan3TLS14Server_Impl_1321process_handshake_msgENSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEENK3$_0clISD_EEDaRKT_: 157| 3| m_handshake->transitions.confirm_transition_to(std::visit([](const auto& msg) { return msg.type(); }, message)); tls_server_impl_13.cpp:_ZZN5Botan3TLS14Server_Impl_1321process_handshake_msgENSt3__17variantIJNS0_15Client_Hello_13ENS0_20Client_Hello_12_ShimENS0_15Server_Hello_13ENS0_20Server_Hello_12_ShimENS0_19Hello_Retry_RequestENS0_20Encrypted_ExtensionsENS0_14Certificate_13ENS0_22Certificate_Request_13ENS0_21Certificate_Verify_13ENS0_11Finished_13EEEEENK3$_1clINS2_17reference_wrapperIS5_EEEEDaT_: 160| 3.13k| [&](auto msg) { 161| | // ... then allow the library user to abort on their discretion 162| 3.13k| callbacks().tls_inspect_handshake_msg(msg.get()); 163| | 164| | // ... finally handle the message 165| 3.13k| handle(msg.get()); 166| 3.13k| }, _ZN5Botan3TLS21Transcript_Hash_StateC2Ev: 24| 5.57k|Transcript_Hash_State::Transcript_Hash_State() = default; _ZN5Botan3TLS21Transcript_Hash_StateD2Ev: 26| 5.57k|Transcript_Hash_State::~Transcript_Hash_State() = default; _ZN5Botan3TLS21Transcript_Hash_State6updateENSt3__14spanIKhLm18446744073709551615EEE: 155| 3.33k|void Transcript_Hash_State::update(std::span serialized_message_s) { 156| 3.33k| const auto* serialized_message = serialized_message_s.data(); 157| 3.33k| auto serialized_message_length = serialized_message_s.size(); 158| 3.33k| if(m_hash != nullptr) { ------------------ | Branch (158:7): [True: 0, False: 3.33k] ------------------ 159| 0| auto truncation_mark = serialized_message_length; 160| | 161| | // Check whether we should generate a truncated hash for supporting PSK 162| | // binder calculation or verification. See RFC 8446 4.2.11.2. 163| 0| if(serialized_message_length > 0 && *serialized_message == static_cast(Handshake_Type::ClientHello)) { ------------------ | Branch (163:10): [True: 0, False: 0] | Branch (163:43): [True: 0, False: 0] ------------------ 164| 0| truncation_mark = find_client_hello_truncation_mark(serialized_message_s); 165| 0| } 166| | 167| 0| if(truncation_mark < serialized_message_length) { ------------------ | Branch (167:10): [True: 0, False: 0] ------------------ 168| 0| m_hash->update(serialized_message, truncation_mark); 169| 0| m_truncated = read_hash_state(m_hash); 170| 0| m_hash->update(serialized_message + truncation_mark, serialized_message_length - truncation_mark); 171| 0| } else { 172| 0| m_truncated.clear(); 173| 0| m_hash->update(serialized_message, serialized_message_length); 174| 0| } 175| | 176| 0| m_previous = std::exchange(m_current, read_hash_state(m_hash)); 177| 3.33k| } else { 178| 3.33k| m_unprocessed_transcript.push_back( 179| 3.33k| std::vector(serialized_message, serialized_message + serialized_message_length)); 180| 3.33k| } 181| 3.33k|} _ZN5Botan3TLS5AlertC2ERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE: 14| 1.48k|Alert::Alert(const secure_vector& buf) { 15| 1.48k| if(buf.size() != 2) { ------------------ | Branch (15:7): [True: 21, False: 1.46k] ------------------ 16| 21| throw Decoding_Error("Bad size (" + std::to_string(buf.size()) + ") for TLS alert message"); 17| 21| } 18| | 19| 1.46k| if(buf[0] == 1) { ------------------ | Branch (19:7): [True: 1.43k, False: 26] ------------------ 20| 1.43k| m_fatal = false; 21| 1.43k| } else if(buf[0] == 2) { ------------------ | Branch (21:14): [True: 17, False: 9] ------------------ 22| 17| m_fatal = true; 23| 17| } else { 24| 9| throw TLS_Exception(Alert::IllegalParameter, "Bad code for TLS alert level"); 25| 9| } 26| | 27| 1.45k| const uint8_t dc = buf[1]; 28| | 29| 1.45k| m_type_code = static_cast(dc); 30| 1.45k|} _ZNK5Botan3TLS5Alert9serializeEv: 32| 4.49k|std::vector Alert::serialize() const { 33| 4.49k| return std::vector({static_cast(is_fatal() ? 2 : 1), static_cast(type())}); ------------------ | Branch (33:54): [True: 4.48k, False: 12] ------------------ 34| 4.49k|} _ZN5Botan3TLS18kdf_algo_to_stringENS0_8KDF_AlgoE: 17| 3.29k|std::string kdf_algo_to_string(KDF_Algo algo) { 18| 3.29k| switch(algo) { ------------------ | Branch (18:11): [True: 3.29k, False: 0] ------------------ 19| 854| case KDF_Algo::SHA_1: ------------------ | Branch (19:7): [True: 854, False: 2.43k] ------------------ 20| 854| return "SHA-1"; 21| 1.50k| case KDF_Algo::SHA_256: ------------------ | Branch (21:7): [True: 1.50k, False: 1.78k] ------------------ 22| 1.50k| return "SHA-256"; 23| 931| case KDF_Algo::SHA_384: ------------------ | Branch (23:7): [True: 931, False: 2.36k] ------------------ 24| 931| return "SHA-384"; 25| 3.29k| } 26| | 27| 0| throw Invalid_State("kdf_algo_to_string unknown enum value"); 28| 3.29k|} _ZN5Botan3TLS20kex_method_to_stringENS0_8Kex_AlgoE: 30| 96|std::string kex_method_to_string(Kex_Algo method) { 31| 96| switch(method) { ------------------ | Branch (31:11): [True: 96, False: 0] ------------------ 32| 0| case Kex_Algo::STATIC_RSA: ------------------ | Branch (32:7): [True: 0, False: 96] ------------------ 33| 0| return "RSA"; 34| 0| case Kex_Algo::DH: ------------------ | Branch (34:7): [True: 0, False: 96] ------------------ 35| 0| return "DH"; 36| 0| case Kex_Algo::ECDH: ------------------ | Branch (36:7): [True: 0, False: 96] ------------------ 37| 0| return "ECDH"; 38| 0| case Kex_Algo::PSK: ------------------ | Branch (38:7): [True: 0, False: 96] ------------------ 39| 0| return "PSK"; 40| 96| case Kex_Algo::ECDHE_PSK: ------------------ | Branch (40:7): [True: 96, False: 0] ------------------ 41| 96| return "ECDHE_PSK"; 42| 0| case Kex_Algo::DHE_PSK: ------------------ | Branch (42:7): [True: 0, False: 96] ------------------ 43| 0| return "DHE_PSK"; 44| 0| case Kex_Algo::KEM: ------------------ | Branch (44:7): [True: 0, False: 96] ------------------ 45| 0| return "KEM"; 46| 0| case Kex_Algo::KEM_PSK: ------------------ | Branch (46:7): [True: 0, False: 96] ------------------ 47| 0| return "KEM_PSK"; 48| 0| case Kex_Algo::HYBRID: ------------------ | Branch (48:7): [True: 0, False: 96] ------------------ 49| 0| return "HYBRID"; 50| 0| case Kex_Algo::HYBRID_PSK: ------------------ | Branch (50:7): [True: 0, False: 96] ------------------ 51| 0| return "HYBRID_PSK"; 52| 0| case Kex_Algo::UNDEFINED: ------------------ | Branch (52:7): [True: 0, False: 96] ------------------ 53| 0| return "UNDEFINED"; 54| 96| } 55| | 56| 0| throw Invalid_State("kex_method_to_string unknown enum value"); 57| 96|} _ZN5Botan3TLS21auth_method_to_stringENS0_11Auth_MethodE: 107| 238|std::string auth_method_to_string(Auth_Method method) { 108| 238| switch(method) { ------------------ | Branch (108:11): [True: 238, False: 0] ------------------ 109| 67| case Auth_Method::RSA: ------------------ | Branch (109:7): [True: 67, False: 171] ------------------ 110| 67| return "RSA"; 111| 171| case Auth_Method::ECDSA: ------------------ | Branch (111:7): [True: 171, False: 67] ------------------ 112| 171| return "ECDSA"; 113| 0| case Auth_Method::IMPLICIT: ------------------ | Branch (113:7): [True: 0, False: 238] ------------------ 114| 0| return "IMPLICIT"; 115| 0| case Auth_Method::UNDEFINED: ------------------ | Branch (115:7): [True: 0, False: 238] ------------------ 116| 0| return "UNDEFINED"; 117| 238| } 118| | 119| 0| throw Invalid_State("auth_method_to_string unknown enum value"); 120| 238|} _ZNK5Botan3TLS12Group_Params9to_stringEv: 402| 2.05k|std::optional Group_Params::to_string() const { 403| 2.05k| switch(m_code) { 404| 705| case Group_Params::SECP256R1: ------------------ | Branch (404:7): [True: 705, False: 1.35k] ------------------ 405| 705| return "secp256r1"; 406| 505| case Group_Params::SECP384R1: ------------------ | Branch (406:7): [True: 505, False: 1.55k] ------------------ 407| 505| return "secp384r1"; 408| 849| case Group_Params::SECP521R1: ------------------ | Branch (408:7): [True: 849, False: 1.21k] ------------------ 409| 849| return "secp521r1"; 410| 0| case Group_Params::BRAINPOOL256R1: ------------------ | Branch (410:7): [True: 0, False: 2.05k] ------------------ 411| 0| return "brainpool256r1"; 412| 0| case Group_Params::BRAINPOOL384R1: ------------------ | Branch (412:7): [True: 0, False: 2.05k] ------------------ 413| 0| return "brainpool384r1"; 414| 0| case Group_Params::BRAINPOOL512R1: ------------------ | Branch (414:7): [True: 0, False: 2.05k] ------------------ 415| 0| return "brainpool512r1"; 416| 0| case Group_Params::X25519: ------------------ | Branch (416:7): [True: 0, False: 2.05k] ------------------ 417| 0| return "x25519"; 418| 0| case Group_Params::X448: ------------------ | Branch (418:7): [True: 0, False: 2.05k] ------------------ 419| 0| return "x448"; 420| 0| case Group_Params::BRAINPOOL256R1TLS13: ------------------ | Branch (420:7): [True: 0, False: 2.05k] ------------------ 421| 0| return "brainpool256r1tls13"; 422| 0| case Group_Params::BRAINPOOL384R1TLS13: ------------------ | Branch (422:7): [True: 0, False: 2.05k] ------------------ 423| 0| return "brainpool384r1tls13"; 424| 0| case Group_Params::BRAINPOOL512R1TLS13: ------------------ | Branch (424:7): [True: 0, False: 2.05k] ------------------ 425| 0| return "brainpool512r1tls13"; 426| | 427| 0| case Group_Params::FFDHE_2048: ------------------ | Branch (427:7): [True: 0, False: 2.05k] ------------------ 428| 0| return "ffdhe/ietf/2048"; 429| 0| case Group_Params::FFDHE_3072: ------------------ | Branch (429:7): [True: 0, False: 2.05k] ------------------ 430| 0| return "ffdhe/ietf/3072"; 431| 0| case Group_Params::FFDHE_4096: ------------------ | Branch (431:7): [True: 0, False: 2.05k] ------------------ 432| 0| return "ffdhe/ietf/4096"; 433| 0| case Group_Params::FFDHE_6144: ------------------ | Branch (433:7): [True: 0, False: 2.05k] ------------------ 434| 0| return "ffdhe/ietf/6144"; 435| 0| case Group_Params::FFDHE_8192: ------------------ | Branch (435:7): [True: 0, False: 2.05k] ------------------ 436| 0| return "ffdhe/ietf/8192"; 437| | 438| 0| case Group_Params::ML_KEM_512: ------------------ | Branch (438:7): [True: 0, False: 2.05k] ------------------ 439| 0| return "ML-KEM-512"; 440| 0| case Group_Params::ML_KEM_768: ------------------ | Branch (440:7): [True: 0, False: 2.05k] ------------------ 441| 0| return "ML-KEM-768"; 442| 0| case Group_Params::ML_KEM_1024: ------------------ | Branch (442:7): [True: 0, False: 2.05k] ------------------ 443| 0| return "ML-KEM-1024"; 444| | 445| 0| case Group_Params::eFRODOKEM_640_SHAKE_OQS: ------------------ | Branch (445:7): [True: 0, False: 2.05k] ------------------ 446| 0| return "eFrodoKEM-640-SHAKE"; 447| 0| case Group_Params::eFRODOKEM_976_SHAKE_OQS: ------------------ | Branch (447:7): [True: 0, False: 2.05k] ------------------ 448| 0| return "eFrodoKEM-976-SHAKE"; 449| 0| case Group_Params::eFRODOKEM_1344_SHAKE_OQS: ------------------ | Branch (449:7): [True: 0, False: 2.05k] ------------------ 450| 0| return "eFrodoKEM-1344-SHAKE"; 451| 0| case Group_Params::eFRODOKEM_640_AES_OQS: ------------------ | Branch (451:7): [True: 0, False: 2.05k] ------------------ 452| 0| return "eFrodoKEM-640-AES"; 453| 0| case Group_Params::eFRODOKEM_976_AES_OQS: ------------------ | Branch (453:7): [True: 0, False: 2.05k] ------------------ 454| 0| return "eFrodoKEM-976-AES"; 455| 0| case Group_Params::eFRODOKEM_1344_AES_OQS: ------------------ | Branch (455:7): [True: 0, False: 2.05k] ------------------ 456| 0| return "eFrodoKEM-1344-AES"; 457| | 458| 0| case Group_Params::HYBRID_X25519_eFRODOKEM_640_SHAKE_OQS: ------------------ | Branch (458:7): [True: 0, False: 2.05k] ------------------ 459| 0| return "x25519/eFrodoKEM-640-SHAKE"; 460| 0| case Group_Params::HYBRID_X25519_eFRODOKEM_640_AES_OQS: ------------------ | Branch (460:7): [True: 0, False: 2.05k] ------------------ 461| 0| return "x25519/eFrodoKEM-640-AES"; 462| 0| case Group_Params::HYBRID_X448_eFRODOKEM_976_SHAKE_OQS: ------------------ | Branch (462:7): [True: 0, False: 2.05k] ------------------ 463| 0| return "x448/eFrodoKEM-976-SHAKE"; 464| 0| case Group_Params::HYBRID_X448_eFRODOKEM_976_AES_OQS: ------------------ | Branch (464:7): [True: 0, False: 2.05k] ------------------ 465| 0| return "x448/eFrodoKEM-976-AES"; 466| 0| case Group_Params::HYBRID_SECP256R1_eFRODOKEM_640_SHAKE_OQS: ------------------ | Branch (466:7): [True: 0, False: 2.05k] ------------------ 467| 0| return "secp256r1/eFrodoKEM-640-SHAKE"; 468| 0| case Group_Params::HYBRID_SECP256R1_eFRODOKEM_640_AES_OQS: ------------------ | Branch (468:7): [True: 0, False: 2.05k] ------------------ 469| 0| return "secp256r1/eFrodoKEM-640-AES"; 470| 0| case Group_Params::HYBRID_SECP384R1_eFRODOKEM_976_SHAKE_OQS: ------------------ | Branch (470:7): [True: 0, False: 2.05k] ------------------ 471| 0| return "secp384r1/eFrodoKEM-976-SHAKE"; 472| 0| case Group_Params::HYBRID_SECP384R1_eFRODOKEM_976_AES_OQS: ------------------ | Branch (472:7): [True: 0, False: 2.05k] ------------------ 473| 0| return "secp384r1/eFrodoKEM-976-AES"; 474| 0| case Group_Params::HYBRID_SECP521R1_eFRODOKEM_1344_SHAKE_OQS: ------------------ | Branch (474:7): [True: 0, False: 2.05k] ------------------ 475| 0| return "secp521r1/eFrodoKEM-1344-SHAKE"; 476| 0| case Group_Params::HYBRID_SECP521R1_eFRODOKEM_1344_AES_OQS: ------------------ | Branch (476:7): [True: 0, False: 2.05k] ------------------ 477| 0| return "secp521r1/eFrodoKEM-1344-AES"; 478| | 479| 0| case Group_Params::HYBRID_X25519_ML_KEM_768: ------------------ | Branch (479:7): [True: 0, False: 2.05k] ------------------ 480| 0| return "x25519/ML-KEM-768"; 481| 0| case Group_Params::HYBRID_SECP256R1_ML_KEM_768: ------------------ | Branch (481:7): [True: 0, False: 2.05k] ------------------ 482| 0| return "secp256r1/ML-KEM-768"; 483| 0| case Group_Params::HYBRID_SECP384R1_ML_KEM_1024: ------------------ | Branch (483:7): [True: 0, False: 2.05k] ------------------ 484| 0| return "secp384r1/ML-KEM-1024"; 485| | 486| 0| default: ------------------ | Branch (486:7): [True: 0, False: 2.05k] ------------------ 487| 0| return std::nullopt; 488| 2.05k| } 489| 2.05k|} _ZNK5Botan3TLS12Group_Params17to_algorithm_specEv: 491| 4.71k|std::optional Group_Params::to_algorithm_spec() const { 492| 4.71k| switch(m_code) { 493| | // Brainpool curves have two sets of code points. See RFCs 7027 and 8734. 494| 1.24k| case Group_Params::BRAINPOOL256R1: ------------------ | Branch (494:7): [True: 1.24k, False: 3.46k] ------------------ 495| 1.33k| case Group_Params::BRAINPOOL256R1TLS13: ------------------ | Branch (495:7): [True: 86, False: 4.62k] ------------------ 496| 1.33k| return "brainpool256r1"; 497| 501| case Group_Params::BRAINPOOL384R1: ------------------ | Branch (497:7): [True: 501, False: 4.21k] ------------------ 498| 524| case Group_Params::BRAINPOOL384R1TLS13: ------------------ | Branch (498:7): [True: 23, False: 4.68k] ------------------ 499| 524| return "brainpool384r1"; 500| 779| case Group_Params::BRAINPOOL512R1: ------------------ | Branch (500:7): [True: 779, False: 3.93k] ------------------ 501| 795| case Group_Params::BRAINPOOL512R1TLS13: ------------------ | Branch (501:7): [True: 16, False: 4.69k] ------------------ 502| 795| return "brainpool512r1"; 503| | 504| 2.05k| default: ------------------ | Branch (504:7): [True: 2.05k, False: 2.65k] ------------------ 505| 2.05k| return to_string(); 506| 4.71k| } 507| 4.71k|} _ZN5Botan3TLS9Callbacks25tls_inspect_handshake_msgERKNS0_17Handshake_MessageE: 49| 16.1k|void TLS::Callbacks::tls_inspect_handshake_msg(const Handshake_Message& /*unused*/) { 50| | // default is no op 51| 16.1k|} _ZN5Botan3TLS9Callbacks25tls_peer_network_identityEv: 57| 27|std::string TLS::Callbacks::tls_peer_network_identity() { 58| 27| return ""; 59| 27|} _ZN5Botan3TLS9Callbacks21tls_current_timestampEv: 61| 5.62k|std::chrono::system_clock::time_point TLS::Callbacks::tls_current_timestamp() { 62| 5.62k| return std::chrono::system_clock::now(); 63| 5.62k|} _ZN5Botan3TLS9Callbacks21tls_modify_extensionsERNS0_10ExtensionsENS0_15Connection_SideENS0_14Handshake_TypeE: 72| 2.76k| Handshake_Type /*unused*/) {} _ZN5Botan3TLS9Callbacks22tls_examine_extensionsERKNS0_10ExtensionsENS0_15Connection_SideENS0_14Handshake_TypeE: 76| 2.97k| Handshake_Type /*unused*/) {} _ZN5Botan3TLS9Callbacks41tls_should_persist_resumption_informationERKNS0_7SessionE: 78| 96|bool TLS::Callbacks::tls_should_persist_resumption_information(const Session& session) { 79| | // RFC 5077 3.3 80| | // The ticket_lifetime_hint field contains a hint from the server about 81| | // how long the ticket should be stored. A value of zero is reserved to 82| | // indicate that the lifetime of the ticket is unspecified. 83| | // 84| | // RFC 8446 4.6.1 85| | // [A ticket_lifetime] of zero indicates that the ticket should be discarded 86| | // immediately. 87| | // 88| | // By default we opt to keep all sessions, except for TLS 1.3 with a lifetime 89| | // hint of zero. 90| 96| return session.lifetime_hint().count() > 0 || session.version().is_pre_tls_13(); ------------------ | Branch (90:11): [True: 96, False: 0] | Branch (90:50): [True: 0, False: 0] ------------------ 91| 96|} _ZN5Botan3TLS9Callbacks31tls_deserialize_peer_public_keyERKNSt3__17variantIJNS0_12Group_ParamsENS_8DL_GroupEEEENS2_4spanIKhLm18446744073709551615EEE: 197| 2.10k| const std::variant& group, std::span key_bits) { 198| 2.10k| if(is_dh_group(group)) { ------------------ | Branch (198:7): [True: 0, False: 2.10k] ------------------ 199| | // TLS 1.2 allows specifying arbitrary DL_Group parameters in-lieu of 200| | // a standardized DH group identifier. 201| 0| const auto dl_group = get_dl_group(group); 202| | 203| 0| auto Y = BigInt::from_bytes(key_bits); 204| | 205| | /* 206| | * A basic check for key validity. As we do not know q here we 207| | * cannot check that Y is in the right subgroup. However since 208| | * our key is ephemeral there does not seem to be any 209| | * advantage to bogus keys anyway. 210| | */ 211| 0| if(Y <= 1 || Y >= dl_group.get_p() - 1) { ------------------ | Branch (211:10): [True: 0, False: 0] | Branch (211:10): [True: 0, False: 0] | Branch (211:20): [True: 0, False: 0] ------------------ 212| 0| throw Decoding_Error("Server sent bad DH key for DHE exchange"); 213| 0| } 214| | 215| 0| return std::make_unique(dl_group, Y); 216| 0| } 217| | 218| | // The special case for TLS 1.2 with an explicit DH group definition is 219| | // handled above. All other cases are based on the opaque group definition. 220| 2.10k| BOTAN_ASSERT_NOMSG(std::holds_alternative(group)); ------------------ | | 77| 2.10k| do { \ | | 78| 2.10k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 2.10k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 2.10k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 2.10k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 2.10k] | | ------------------ ------------------ 221| 2.10k| const auto group_params = std::get(group); 222| | 223| 2.10k| if(group_params.is_ecdh_named_curve()) { ------------------ | Branch (223:7): [True: 2.09k, False: 9] ------------------ 224| 2.09k| const auto ec_group = EC_Group::from_name(group_params.to_algorithm_spec().value()); 225| | // TLS 1.3 requires uncompressed points (checked when parsing the key 226| | // share); TLS 1.2 may negotiate the compressed format. The deprecated 227| | // hybrid encoding and the identity element are never accepted. 228| | 229| 2.09k| auto point = [&]() -> EC_AffinePoint { 230| 2.09k| if(auto pt_uncompressed = EC_AffinePoint::deserialize_uncompressed(ec_group, key_bits)) { 231| 2.09k| return std::move(pt_uncompressed).value(); 232| 2.09k| } else if(auto pt_compressed = EC_AffinePoint::deserialize_compressed(ec_group, key_bits)) { 233| 2.09k| return std::move(pt_compressed).value(); 234| 2.09k| } else { 235| 2.09k| throw Decoding_Error("Invalid ECDH public key encoding"); 236| 2.09k| } 237| 2.09k| }(); 238| 2.09k| return std::make_unique(ec_group, std::move(point)); 239| 2.09k| } 240| | 241| 9|#if defined(BOTAN_HAS_X25519) 242| 9| if(group_params.is_x25519()) { ------------------ | Branch (242:7): [True: 6, False: 3] ------------------ 243| 6| return std::make_unique(key_bits); 244| 6| } 245| 3|#endif 246| | 247| 3|#if defined(BOTAN_HAS_X448) 248| 3| if(group_params.is_x448()) { ------------------ | Branch (248:7): [True: 3, False: 0] ------------------ 249| 3| return std::make_unique(key_bits); 250| 3| } 251| 0|#endif 252| | 253| 0|#if defined(BOTAN_HAS_TLS_13_PQC) 254| 0| if(group_params.is_pqc_hybrid()) { ------------------ | Branch (254:7): [True: 0, False: 0] ------------------ 255| 0| return Hybrid_KEM_PublicKey::load_for_group(group_params, key_bits); 256| 0| } 257| 0|#endif 258| | 259| 0|#if defined(BOTAN_HAS_ML_KEM) 260| 0| if(group_params.is_pure_ml_kem()) { ------------------ | Branch (260:7): [True: 0, False: 0] ------------------ 261| 0| return std::make_unique(key_bits, ML_KEM_Mode(group_params.to_algorithm_spec().value())); 262| 0| } 263| 0|#endif 264| | 265| 0|#if defined(BOTAN_HAS_FRODOKEM) 266| 0| if(group_params.is_pure_frodokem()) { ------------------ | Branch (266:7): [True: 0, False: 0] ------------------ 267| 0| return std::make_unique(key_bits, FrodoKEMMode(group_params.to_algorithm_spec().value())); 268| 0| } 269| 0|#endif 270| | 271| 0| throw Decoding_Error("cannot create a key offering without a group definition"); 272| 0|} _ZN5Botan3TLS9Callbacks26tls_generate_ephemeral_keyERKNSt3__17variantIJNS0_12Group_ParamsENS_8DL_GroupEEEERNS_21RandomNumberGeneratorE: 362| 2.64k| const std::variant& group, RandomNumberGenerator& rng) { 363| 2.64k| if(is_dh_group(group)) { ------------------ | Branch (363:7): [True: 0, False: 2.64k] ------------------ 364| 0| const DL_Group dl_group = get_dl_group(group); 365| 0| return std::make_unique(rng, dl_group); 366| 0| } 367| | 368| 2.64k| BOTAN_ASSERT_NOMSG(std::holds_alternative(group)); ------------------ | | 77| 2.64k| do { \ | | 78| 2.64k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 2.64k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 2.64k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 2.64k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 2.64k] | | ------------------ ------------------ 369| 2.64k| const auto group_params = std::get(group); 370| | 371| 2.64k| if(group_params.is_ecdh_named_curve()) { ------------------ | Branch (371:7): [True: 2.61k, False: 26] ------------------ 372| 2.61k| const auto ec_group = EC_Group::from_name(group_params.to_algorithm_spec().value()); 373| 2.61k| auto ecdh_key = std::make_unique(rng, ec_group); 374| | 375| | // RFC 8446 Ch. 4.2.8.2 376| | // 377| | // Note: Versions of TLS prior to 1.3 permitted point format 378| | // negotiation; TLS 1.3 removes this feature in favor of a single point 379| | // format for each curve. 380| | // 381| | // Hence, TLS 1.3 won't take Policy::use_ecc_point_compression() or 382| | // ClientHello::prefers_compressed_ec_points() into account but always use 383| | // uncompressed point encoding. Note that TLS 1.2 uses the 384| | // `tls12_generate_ephemeral_ecdh_key()` callback, which allows to specify 385| | // the point encoding format. 386| 2.61k| ecdh_key->set_point_encoding(EC_Point_Format::Uncompressed); 387| 2.61k| return ecdh_key; 388| 2.61k| } 389| | 390| 26|#if defined(BOTAN_HAS_X25519) 391| 26| if(group_params.is_x25519()) { ------------------ | Branch (391:7): [True: 13, False: 13] ------------------ 392| 13| return std::make_unique(rng); 393| 13| } 394| 13|#endif 395| | 396| 13|#if defined(BOTAN_HAS_X448) 397| 13| if(group_params.is_x448()) { ------------------ | Branch (397:7): [True: 13, False: 0] ------------------ 398| 13| return std::make_unique(rng); 399| 13| } 400| 0|#endif 401| | 402| 0| if(group_params.is_kem()) { ------------------ | Branch (402:7): [True: 0, False: 0] ------------------ 403| 0| throw TLS_Exception(Alert::IllegalParameter, "cannot generate an ephemeral KEX key for a KEM"); 404| 0| } 405| | 406| 0| throw TLS_Exception(Alert::DecodeError, "cannot create a key offering without a group definition"); 407| 0|} _ZN5Botan3TLS9Callbacks33tls12_generate_ephemeral_ecdh_keyENS0_12Group_ParamsERNS_21RandomNumberGeneratorENS_15EC_Point_FormatE: 410| 2.61k| TLS::Group_Params group, RandomNumberGenerator& rng, EC_Point_Format tls12_ecc_pubkey_encoding_format) { 411| | // Delegating to the "universal" callback to obtain an ECDH key pair 412| 2.61k| auto key = tls_generate_ephemeral_key(group, rng); 413| | 414| | // For ordinary ECDH key pairs (that are derived from `ECDH_PublicKey`), we 415| | // set the internal point encoding flag for the key before passing it on into 416| | // the TLS 1.2 implementation. For user-defined keypair types (e.g. to 417| | // offload to some crypto hardware) inheriting from Botan's `ECDH_PublicKey` 418| | // might not be feasible. Such users should consider overriding this 419| | // ECDH-specific callback and ensure that their custom class handles the 420| | // public point encoding as requested by `tls12_ecc_pubkey_encoding_format`. 421| 2.61k| if(auto* ecc_key = dynamic_cast(key.get())) { ------------------ | Branch (421:13): [True: 2.61k, False: 0] ------------------ 422| 2.61k| ecc_key->set_point_encoding(tls12_ecc_pubkey_encoding_format); 423| 2.61k| } 424| | 425| 2.61k| return key; 426| 2.61k|} _ZN5Botan3TLS9Callbacks27tls_ephemeral_key_agreementERKNSt3__17variantIJNS0_12Group_ParamsENS_8DL_GroupEEEERKNS_20PK_Key_Agreement_KeyERKNS2_6vectorIhNS2_9allocatorIhEEEERNS_21RandomNumberGeneratorERKNS0_6PolicyE: 433| 2.10k| const Policy& policy) { 434| 2.10k| const auto kex_pub_key = [&]() { 435| 2.10k| try { 436| 2.10k| return tls_deserialize_peer_public_key(group, public_value); 437| 2.10k| } catch(const Decoding_Error& ex) { 438| | // This exception means that the public key was invalid. However, 439| | // TLS' DecodeError would imply that a protocol message was invalid. 440| 2.10k| throw TLS_Exception(Alert::IllegalParameter, ex.what()); 441| 2.10k| } catch(const Invalid_Argument& ex) { 442| 2.10k| throw TLS_Exception(Alert::IllegalParameter, ex.what()); 443| 2.10k| } 444| 2.10k| }(); 445| | 446| 2.10k| BOTAN_ASSERT_NONNULL(kex_pub_key); ------------------ | | 116| 2.10k| do { \ | | 117| 2.10k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 2.10k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 2.10k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 2.10k] | | ------------------ ------------------ 447| 2.10k| policy.check_peer_key_acceptable(*kex_pub_key); 448| | 449| | // RFC 8422 - 5.11. 450| | // With X25519 and X448, a receiving party MUST check whether the 451| | // computed premaster secret is the all-zero value and abort the 452| | // handshake if so, as described in Section 6 of [RFC7748]. 453| | // 454| | // This is done within the key agreement operation and throws 455| | // an Invalid_Argument exception if the shared secret is all-zero. 456| 2.10k| try { 457| 2.10k| const PK_Key_Agreement ka(private_key, rng, "Raw"); 458| 2.10k| return ka.derive_key(0, kex_pub_key->raw_public_key_bits()).bits_of(); 459| 2.10k| } catch(const Invalid_Argument& ex) { 460| 2| throw TLS_Exception(Alert::IllegalParameter, ex.what()); 461| 2| } 462| 2.10k|} _ZN5Botan3TLS9Callbacks23tls_session_establishedERKNS0_15Session_SummaryE: 464| 96|void TLS::Callbacks::tls_session_established(const Session_Summary& session) { 465| 96| BOTAN_UNUSED(session); ------------------ | | 144| 96|#define BOTAN_UNUSED Botan::ignore_params ------------------ 466| 96|} _ZN5Botan3TLS9Callbacks23tls_provide_cert_statusERKNSt3__16vectorINS_16X509_CertificateENS2_9allocatorIS4_EEEERKNS0_26Certificate_Status_RequestE: 469| 3| const Certificate_Status_Request& csr) { 470| 3| BOTAN_UNUSED(chain, csr); ------------------ | | 144| 3|#define BOTAN_UNUSED Botan::ignore_params ------------------ 471| 3| return std::vector(); 472| 3|} _ZNK5Botan3TLS9Callbacks27tls12_protocol_specific_kdfENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 492| 1.59k|std::unique_ptr TLS::Callbacks::tls12_protocol_specific_kdf(std::string_view prf_algo) const { 493| 1.59k| if(prf_algo == "MD5" || prf_algo == "SHA-1") { ------------------ | Branch (493:7): [True: 0, False: 1.59k] | Branch (493:28): [True: 411, False: 1.18k] ------------------ 494| 411| return KDF::create_or_throw("TLS-12-PRF(SHA-256)"); 495| 411| } 496| | 497| 1.18k| return KDF::create_or_throw(Botan::fmt("TLS-12-PRF({})", prf_algo)); 498| 1.59k|} tls_callbacks.cpp:_ZN5Botan12_GLOBAL__N_111is_dh_groupERKNSt3__17variantIJNS_3TLS12Group_ParamsENS_8DL_GroupEEEE: 177| 4.74k|bool is_dh_group(const std::variant& group) { 178| 4.74k| return std::holds_alternative(group) || std::get(group).is_dh_named_group(); ------------------ | Branch (178:11): [True: 0, False: 4.74k] | Branch (178:54): [True: 0, False: 4.74k] ------------------ 179| 4.74k|} tls_callbacks.cpp:_ZZN5Botan3TLS9Callbacks31tls_deserialize_peer_public_keyERKNSt3__17variantIJNS0_12Group_ParamsENS_8DL_GroupEEEENS2_4spanIKhLm18446744073709551615EEEENK3$_0clEv: 229| 2.09k| auto point = [&]() -> EC_AffinePoint { 230| 2.09k| if(auto pt_uncompressed = EC_AffinePoint::deserialize_uncompressed(ec_group, key_bits)) { ------------------ | Branch (230:18): [True: 0, False: 2.09k] ------------------ 231| 0| return std::move(pt_uncompressed).value(); 232| 2.09k| } else if(auto pt_compressed = EC_AffinePoint::deserialize_compressed(ec_group, key_bits)) { ------------------ | Branch (232:25): [True: 1.63k, False: 456] ------------------ 233| 1.63k| return std::move(pt_compressed).value(); 234| 1.63k| } else { 235| 456| throw Decoding_Error("Invalid ECDH public key encoding"); 236| 456| } 237| 2.09k| }(); tls_callbacks.cpp:_ZZN5Botan3TLS9Callbacks27tls_ephemeral_key_agreementERKNSt3__17variantIJNS0_12Group_ParamsENS_8DL_GroupEEEERKNS_20PK_Key_Agreement_KeyERKNS2_6vectorIhNS2_9allocatorIhEEEERNS_21RandomNumberGeneratorERKNS0_6PolicyEENK3$_0clEv: 434| 2.10k| const auto kex_pub_key = [&]() { 435| 2.10k| try { 436| 2.10k| return tls_deserialize_peer_public_key(group, public_value); 437| 2.10k| } catch(const Decoding_Error& ex) { 438| | // This exception means that the public key was invalid. However, 439| | // TLS' DecodeError would imply that a protocol message was invalid. 440| 459| throw TLS_Exception(Alert::IllegalParameter, ex.what()); 441| 459| } catch(const Invalid_Argument& ex) { 442| 1| throw TLS_Exception(Alert::IllegalParameter, ex.what()); 443| 1| } 444| 2.10k| }(); _ZNK5Botan3TLS11Ciphersuite26nonce_bytes_from_handshakeEv: 16| 1.88k|size_t Ciphersuite::nonce_bytes_from_handshake() const { 17| 1.88k| switch(m_nonce_format) { ------------------ | Branch (17:11): [True: 1.88k, False: 0] ------------------ 18| 852| case Nonce_Format::CBC_MODE: ------------------ | Branch (18:7): [True: 852, False: 1.03k] ------------------ 19| 852| return 0; 20| 469| case Nonce_Format::AEAD_IMPLICIT_4: ------------------ | Branch (20:7): [True: 469, False: 1.41k] ------------------ 21| 469| return 4; 22| 566| case Nonce_Format::AEAD_XOR_12: ------------------ | Branch (22:7): [True: 566, False: 1.32k] ------------------ 23| 566| return 12; 24| 0| case Nonce_Format::NULL_CIPHER: ------------------ | Branch (24:7): [True: 0, False: 1.88k] ------------------ 25| 0| return 0; 26| 1.88k| } 27| | 28| 0| throw Invalid_State("In Ciphersuite::nonce_bytes_from_handshake invalid enum value"); 29| 1.88k|} _ZNK5Botan3TLS11Ciphersuite23nonce_bytes_from_recordENS0_16Protocol_VersionE: 31| 481|size_t Ciphersuite::nonce_bytes_from_record(Protocol_Version version) const { 32| 481| BOTAN_UNUSED(version); ------------------ | | 144| 481|#define BOTAN_UNUSED Botan::ignore_params ------------------ 33| 481| switch(m_nonce_format) { ------------------ | Branch (33:11): [True: 481, False: 0] ------------------ 34| 242| case Nonce_Format::CBC_MODE: ------------------ | Branch (34:7): [True: 242, False: 239] ------------------ 35| 242| return cipher_algo() == "3DES" ? 8 : 16; ------------------ | Branch (35:17): [True: 105, False: 137] ------------------ 36| 161| case Nonce_Format::AEAD_IMPLICIT_4: ------------------ | Branch (36:7): [True: 161, False: 320] ------------------ 37| 161| return 8; 38| 78| case Nonce_Format::AEAD_XOR_12: ------------------ | Branch (38:7): [True: 78, False: 403] ------------------ 39| 78| case Nonce_Format::NULL_CIPHER: ------------------ | Branch (39:7): [True: 0, False: 481] ------------------ 40| 78| return 0; 41| 481| } 42| | 43| 0| throw Invalid_State("In Ciphersuite::nonce_bytes_from_handshake invalid enum value"); 44| 481|} _ZNK5Botan3TLS11Ciphersuite15ecc_ciphersuiteEv: 73| 2.93k|bool Ciphersuite::ecc_ciphersuite() const { 74| 2.93k| return kex_method() == Kex_Algo::ECDH || kex_method() == Kex_Algo::ECDHE_PSK || auth_method() == Auth_Method::ECDSA; ------------------ | Branch (74:11): [True: 8, False: 2.92k] | Branch (74:45): [True: 2.66k, False: 263] | Branch (74:84): [True: 0, False: 263] ------------------ 75| 2.93k|} _ZNK5Botan3TLS11Ciphersuite17usable_in_versionENS0_16Protocol_VersionE: 77| 279k|bool Ciphersuite::usable_in_version(Protocol_Version version) const { 78| | // RFC 8446 B.4.: 79| | // Although TLS 1.3 uses the same cipher suite space as previous 80| | // versions of TLS, TLS 1.3 cipher suites are defined differently, only 81| | // specifying the symmetric ciphers, and cannot be used for TLS 1.2. 82| | // Similarly, cipher suites for TLS 1.2 and lower cannot be used with 83| | // TLS 1.3. 84| | // 85| | // Currently cipher suite codes {0x13,0x01} through {0x13,0x05} are 86| | // allowed for TLS 1.3. This may change in the future. 87| 279k| const auto is_legacy_suite = (ciphersuite_code() & 0xFF00) != 0x1300; 88| 279k| return version.is_pre_tls_13() == is_legacy_suite; 89| 279k|} _ZNK5Botan3TLS11Ciphersuite15cbc_ciphersuiteEv: 91| 2.76k|bool Ciphersuite::cbc_ciphersuite() const { 92| 2.76k| return (mac_algo() != "AEAD" && cipher_algo() != "NULL"); ------------------ | Branch (92:12): [True: 1.61k, False: 1.15k] | Branch (92:36): [True: 1.61k, False: 0] ------------------ 93| 2.76k|} _ZNK5Botan3TLS11Ciphersuite14signature_usedEv: 108| 11.4k|bool Ciphersuite::signature_used() const { 109| 11.4k| return auth_method() != Auth_Method::IMPLICIT; 110| 11.4k|} _ZNK5Botan3TLS11Ciphersuite23is_certificate_requiredEv: 112| 5.70k|bool Ciphersuite::is_certificate_required() const { 113| 5.70k| return signature_used() || kex_method() == Kex_Algo::STATIC_RSA; ------------------ | Branch (113:11): [True: 155, False: 5.54k] | Branch (113:31): [True: 27, False: 5.51k] ------------------ 114| 5.70k|} _ZN5Botan3TLS11Ciphersuite5by_idEt: 116| 8.61k|std::optional Ciphersuite::by_id(uint16_t suite) { 117| 8.61k| const std::vector& all_suites = all_known_ciphersuites(); 118| 8.61k| auto s = std::lower_bound(all_suites.begin(), all_suites.end(), suite); 119| | 120| 8.61k| if(s != all_suites.end() && s->ciphersuite_code() == suite) { ------------------ | Branch (120:7): [True: 8.61k, False: 0] | Branch (120:7): [True: 8.61k, False: 0] | Branch (120:32): [True: 8.61k, False: 0] ------------------ 121| 8.61k| return *s; 122| 8.61k| } 123| | 124| 0| return std::nullopt; // some unknown ciphersuite 125| 8.61k|} _ZN5Botan3TLS10ExtensionsD2Ev: 141| 11.3k|Extensions::~Extensions() = default; _ZNK5Botan3TLS10Extensions3hasENS0_14Extension_CodeE: 143| 90.7k|bool Extensions::has(Extension_Code type) const { 144| 90.7k| return m_extensions.contains(type); 145| 90.7k|} _ZNK5Botan3TLS10Extensions3getENS0_14Extension_CodeE: 147| 71.7k|Extension* Extensions::get(Extension_Code type) const { 148| 71.7k| const auto i = m_extensions.find(type); 149| | 150| 71.7k| if(i == m_extensions.end()) { ------------------ | Branch (150:7): [True: 51.1k, False: 20.5k] ------------------ 151| 51.1k| return nullptr; 152| 51.1k| } else { 153| 20.5k| return i->second.get(); 154| 20.5k| } 155| 71.7k|} _ZN5Botan3TLS10Extensions3addENSt3__110unique_ptrINS0_9ExtensionENS2_14default_deleteIS4_EEEE: 157| 46.5k|void Extensions::add(std::unique_ptr extn) { 158| 46.5k| const auto type = extn->type(); 159| 46.5k| if(has(type)) { ------------------ | Branch (159:7): [True: 0, False: 46.5k] ------------------ 160| 0| throw Invalid_Argument("cannot add the same extension twice: " + std::to_string(static_cast(type))); 161| 0| } 162| | 163| 46.5k| m_extension_codes.push_back(type); 164| 46.5k| m_extensions.emplace(type, std::move(extn)); 165| 46.5k|} _ZN5Botan3TLS10Extensions11deserializeERNS0_15TLS_Data_ReaderENS0_15Connection_SideENS0_14Handshake_TypeE: 167| 7.74k|void Extensions::deserialize(TLS_Data_Reader& reader, const Connection_Side from, const Handshake_Type message_type) { 168| 7.74k| if(reader.has_remaining()) { ------------------ | Branch (168:7): [True: 7.56k, False: 182] ------------------ 169| 7.56k| const uint16_t all_extn_size = reader.get_uint16_t(); 170| | 171| 7.56k| if(reader.remaining_bytes() != all_extn_size) { ------------------ | Branch (171:10): [True: 30, False: 7.53k] ------------------ 172| 30| throw Decoding_Error("Bad extension size"); 173| 30| } 174| | 175| 51.7k| while(reader.has_remaining()) { ------------------ | Branch (175:13): [True: 44.2k, False: 7.53k] ------------------ 176| 44.2k| const uint16_t extension_code = reader.get_uint16_t(); 177| 44.2k| const uint16_t extension_size = reader.get_uint16_t(); 178| | 179| 44.2k| const auto type = static_cast(extension_code); 180| | 181| 44.2k| if(this->has(type)) { ------------------ | Branch (181:13): [True: 2, False: 44.2k] ------------------ 182| 2| throw TLS_Exception(TLS::Alert::DecodeError, "Peer sent duplicated extensions"); 183| 2| } 184| | 185| | // TODO offer a function on reader that returns a byte range as a reference 186| | // to avoid this copy of the extension data 187| 44.2k| const std::vector extn_data = reader.get_fixed(extension_size); 188| 44.2k| m_raw_extension_data[type] = extn_data; 189| 44.2k| TLS_Data_Reader extn_reader("Extension", extn_data); 190| 44.2k| this->add(make_extension(extn_reader, type, from, message_type)); 191| 44.2k| extn_reader.assert_done(); 192| 44.2k| } 193| 7.53k| } 194| 7.74k|} _ZNK5Botan3TLS10Extensions19contains_other_thanERKNSt3__13setINS0_14Extension_CodeENS2_4lessIS4_EENS2_9allocatorIS4_EEEEb: 197| 210| const bool allow_unknown_extensions) const { 198| 210| const auto found = extension_types(); 199| | 200| 210| std::vector diff; 201| 210| std::set_difference( 202| 210| found.cbegin(), found.end(), allowed_extensions.cbegin(), allowed_extensions.cend(), std::back_inserter(diff)); 203| | 204| 210| if(allow_unknown_extensions) { ------------------ | Branch (204:7): [True: 209, False: 1] ------------------ 205| | // Go through the found unexpected extensions whether any of those 206| | // is known to this TLS implementation. 207| 209| const auto itr = std::find_if(diff.cbegin(), diff.cend(), [this](const auto ext_type) { 208| 209| const auto ext = get(ext_type); 209| 209| return ext && ext->is_implemented(); 210| 209| }); 211| | 212| | // ... if yes, `contains_other_than` is true 213| 209| return itr != diff.cend(); 214| 209| } 215| | 216| 1| return !diff.empty(); 217| 210|} _ZNK5Botan3TLS10Extensions9serializeENS0_15Connection_SideE: 232| 2.76k|std::vector Extensions::serialize(Connection_Side whoami) const { 233| 2.76k| std::vector buf(2); // 2 bytes for length field 234| | 235| | // Serialize in the order extensions were added, which matters for TLS 1.3 236| 3.20k| for(const auto extn_type : m_extension_codes) { ------------------ | Branch (236:29): [True: 3.20k, False: 2.76k] ------------------ 237| 3.20k| const auto& extn = m_extensions.at(extn_type); 238| | 239| 3.20k| if(extn->empty()) { ------------------ | Branch (239:10): [True: 0, False: 3.20k] ------------------ 240| 0| continue; 241| 0| } 242| | 243| 3.20k| const uint16_t extn_code = static_cast(extn_type); 244| | 245| 3.20k| const std::vector extn_val = extn->serialize(whoami); 246| | 247| | // Each extension carries a uint16 length prefix. 248| 3.20k| BOTAN_ASSERT_NOMSG(extn_val.size() <= 0xFFFF); ------------------ | | 77| 3.20k| do { \ | | 78| 3.20k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 3.20k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 3.20k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 3.20k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 3.20k] | | ------------------ ------------------ 249| | 250| 3.20k| buf.push_back(get_byte<0>(extn_code)); 251| 3.20k| buf.push_back(get_byte<1>(extn_code)); 252| | 253| 3.20k| buf.push_back(get_byte<0>(static_cast(extn_val.size()))); 254| 3.20k| buf.push_back(get_byte<1>(static_cast(extn_val.size()))); 255| | 256| 3.20k| buf += extn_val; 257| 3.20k| } 258| | 259| | // The outer extensions block is itself uint16-length-prefixed. 260| 2.76k| BOTAN_ASSERT_NOMSG(buf.size() - 2 <= 0xFFFF); ------------------ | | 77| 2.76k| do { \ | | 78| 2.76k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 2.76k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 2.76k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 2.76k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 2.76k] | | ------------------ ------------------ 261| 2.76k| const uint16_t extn_size = static_cast(buf.size() - 2); 262| | 263| 2.76k| buf[0] = get_byte<0>(extn_size); 264| 2.76k| buf[1] = get_byte<1>(extn_size); 265| | 266| | // avoid sending a completely empty extensions block 267| 2.76k| if(buf.size() == 2) { ------------------ | Branch (267:7): [True: 0, False: 2.76k] ------------------ 268| 0| return std::vector(); 269| 0| } 270| | 271| 2.76k| return buf; 272| 2.76k|} _ZNK5Botan3TLS10Extensions15extension_typesEv: 274| 2.85k|std::set Extensions::extension_types() const { 275| 2.85k| std::set offers; 276| 19.7k| for(const auto& [extn_type, extn] : m_extensions) { ------------------ | Branch (276:38): [True: 19.7k, False: 2.85k] ------------------ 277| | // Consistent with serialize(): empty extensions are not placed on 278| | // the wire so they must not appear in the "offered" set either. 279| 19.7k| if(!extn->empty()) { ------------------ | Branch (279:10): [True: 19.7k, False: 8] ------------------ 280| 19.7k| offers.insert(extn_type); 281| 19.7k| } 282| 19.7k| } 283| 2.85k| return offers; 284| 2.85k|} _ZN5Botan3TLS17Unknown_ExtensionC2ENS0_14Extension_CodeERNS0_15TLS_Data_ReaderEt: 314| 29.9k| m_type(type), m_value(reader.get_fixed(extension_size)) {} _ZN5Botan3TLS21Server_Name_IndicatorC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE: 320| 91|Server_Name_Indicator::Server_Name_Indicator(TLS_Data_Reader& reader, uint16_t extension_size, Connection_Side from) { 321| | /* 322| | RFC 6066 Section 3 323| | 324| | A server that receives a client hello containing the "server_name" 325| | extension MAY use the information contained in the extension to guide 326| | its selection of an appropriate certificate to return to the client, 327| | and/or other aspects of security policy. In this event, the server 328| | SHALL include an extension of type "server_name" in the (extended) 329| | server hello. The "extension_data" field of this extension SHALL be 330| | empty. 331| | */ 332| 91| if(from == Connection_Side::Server) { ------------------ | Branch (332:7): [True: 40, False: 51] ------------------ 333| 40| if(extension_size != 0) { ------------------ | Branch (333:10): [True: 2, False: 38] ------------------ 334| 2| throw TLS_Exception(Alert::IllegalParameter, "Server sent non-empty SNI extension"); 335| 2| } 336| 51| } else { 337| | // Clients are required to send at least one name in the SNI 338| 51| if(extension_size == 0) { ------------------ | Branch (338:10): [True: 3, False: 48] ------------------ 339| 3| throw TLS_Exception(Alert::IllegalParameter, "Client sent empty SNI extension"); 340| 3| } 341| | 342| 48| const uint16_t name_bytes = reader.get_uint16_t(); 343| | 344| | // RFC 6066 3: a ServerName carrying a host_name (the only NameType 345| | // currently defined and the only one this implementation acts on) 346| | // requires at least 1 byte name_type + 2 byte length + 1 byte HostName. 347| 48| if(name_bytes + 2 != extension_size || name_bytes < 4) { ------------------ | Branch (347:10): [True: 12, False: 36] | Branch (347:46): [True: 1, False: 35] ------------------ 348| 13| throw Decoding_Error("Bad encoding of SNI extension"); 349| 13| } 350| | 351| 35| BOTAN_ASSERT_NOMSG(reader.remaining_bytes() == name_bytes); ------------------ | | 77| 35| do { \ | | 78| 35| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 35| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 35] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 35| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 35] | | ------------------ ------------------ 352| | 353| 94| while(reader.has_remaining()) { ------------------ | Branch (353:13): [True: 61, False: 33] ------------------ 354| 61| const uint8_t name_type = reader.get_byte(); 355| | 356| 61| if(name_type == 0) { ------------------ | Branch (356:13): [True: 24, False: 37] ------------------ 357| | /* 358| | RFC 6066 Section 3 359| | The ServerNameList MUST NOT contain more than one name of the same name_type. 360| | */ 361| 24| if(!m_sni_host_name.empty()) { ------------------ | Branch (361:16): [True: 2, False: 22] ------------------ 362| 2| throw Decoding_Error("TLS ServerNameIndicator contains more than one host_name"); 363| 2| } 364| 22| m_sni_host_name = reader.get_string(2, 1, 65535); 365| 37| } else { 366| | /* 367| | Unknown name type - skip its length-prefixed value and continue 368| | 369| | RFC 6066 Section 3 370| | For backward compatibility, all future data structures associated 371| | with new NameTypes MUST begin with a 16-bit length field. 372| | */ 373| 37| const uint16_t unknown_name_len = reader.get_uint16_t(); 374| 37| reader.discard_next(unknown_name_len); 375| 37| } 376| 61| } 377| 35| } 378| 91|} _ZN5Botan3TLS39Application_Layer_Protocol_NotificationC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 432| 21|Application_Layer_Protocol_Notification::Application_Layer_Protocol_Notification(std::string_view protocol) { 433| 21| BOTAN_ARG_CHECK(!protocol.empty(), "ALPN protocol name must not be empty"); ------------------ | | 35| 21| do { \ | | 36| 21| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 21| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 21] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 21| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 21] | | ------------------ ------------------ 434| 21| BOTAN_ARG_CHECK(protocol.size() < 256, "ALPN protocol name too long"); ------------------ | | 35| 21| do { \ | | 36| 21| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 21| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 21] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 21| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 21] | | ------------------ ------------------ 435| 21| m_protocols.emplace_back(protocol); 436| 21|} _ZN5Botan3TLS39Application_Layer_Protocol_NotificationC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE: 448| 143| Connection_Side from) { 449| 143| if(extension_size < 2) { ------------------ | Branch (449:7): [True: 4, False: 139] ------------------ 450| 4| throw Decoding_Error("ALPN extension cannot be empty"); 451| 4| } 452| | 453| 139| const uint16_t name_bytes = reader.get_uint16_t(); 454| | 455| 139| size_t bytes_remaining = extension_size - 2; 456| | 457| 139| if(name_bytes != bytes_remaining) { ------------------ | Branch (457:7): [True: 20, False: 119] ------------------ 458| 20| throw Decoding_Error("Bad encoding of ALPN extension, bad length field"); 459| 20| } 460| | 461| | // RFC 7301 3.1: ProtocolName protocol_name_list<2..2^16-1> 462| 119| if(name_bytes == 0) { ------------------ | Branch (462:7): [True: 1, False: 118] ------------------ 463| 1| throw Decoding_Error("Empty ALPN protocol_name_list not allowed"); 464| 1| } 465| | 466| 2.24k| while(bytes_remaining > 0) { ------------------ | Branch (466:10): [True: 2.13k, False: 113] ------------------ 467| 2.13k| const std::string p = reader.get_string(1, 0, 255); 468| | 469| 2.13k| if(bytes_remaining < p.size() + 1) { ------------------ | Branch (469:10): [True: 0, False: 2.13k] ------------------ 470| 0| throw Decoding_Error("Bad encoding of ALPN, length field too long"); 471| 0| } 472| | 473| 2.13k| if(p.empty()) { ------------------ | Branch (473:10): [True: 5, False: 2.12k] ------------------ 474| 5| throw Decoding_Error("Empty ALPN protocol not allowed"); 475| 5| } 476| | 477| 2.12k| bytes_remaining -= (p.size() + 1); 478| | 479| 2.12k| m_protocols.push_back(p); 480| 2.12k| } 481| | 482| | // RFC 7301 3.1 483| | // The "extension_data" field of the [...] extension is structured the 484| | // same as described above for the client "extension_data", except that 485| | // the "ProtocolNameList" MUST contain exactly one "ProtocolName". 486| 113| if(from == Connection_Side::Server && m_protocols.size() != 1) { ------------------ | Branch (486:7): [True: 10, False: 103] | Branch (486:42): [True: 6, False: 4] ------------------ 487| 6| throw TLS_Exception( 488| 6| Alert::DecodeError, 489| 6| "Server sent " + std::to_string(m_protocols.size()) + " protocols in ALPN extension response"); 490| 6| } 491| 113|} _ZNK5Botan3TLS39Application_Layer_Protocol_Notification9serializeENS0_15Connection_SideE: 498| 21|std::vector Application_Layer_Protocol_Notification::serialize(Connection_Side /*whoami*/) const { 499| 21| std::vector buf(2); 500| | 501| 21| for(auto&& proto : m_protocols) { ------------------ | Branch (501:21): [True: 21, False: 21] ------------------ 502| 21| if(proto.length() >= 256) { ------------------ | Branch (502:10): [True: 0, False: 21] ------------------ 503| 0| throw TLS_Exception(Alert::InternalError, "ALPN name too long"); 504| 0| } 505| 21| if(!proto.empty()) { ------------------ | Branch (505:10): [True: 21, False: 0] ------------------ 506| 21| append_tls_length_value(buf, proto, 1); 507| 21| } 508| 21| } 509| | 510| | // RFC 7301 3.1: ProtocolName protocol_name_list<2..2^16-1>; 511| 21| BOTAN_ASSERT_NOMSG(buf.size() - 2 <= 0xFFFF); ------------------ | | 77| 21| do { \ | | 78| 21| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 21| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 21] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 21| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 21] | | ------------------ ------------------ 512| 21| buf[0] = get_byte<0>(static_cast(buf.size() - 2)); 513| 21| buf[1] = get_byte<1>(static_cast(buf.size() - 2)); 514| | 515| 21| return buf; 516| 21|} _ZN5Botan3TLS21Certificate_Type_BaseC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE: 554| 77| m_from(from) { 555| 77| if(extension_size == 0) { ------------------ | Branch (555:7): [True: 3, False: 74] ------------------ 556| 3| throw Decoding_Error("Certificate type extension cannot be empty"); 557| 3| } 558| | 559| 74| if(from == Connection_Side::Client) { ------------------ | Branch (559:7): [True: 61, False: 13] ------------------ 560| 61| const auto type_bytes = reader.get_tls_length_value(1); 561| 61| if(static_cast(extension_size) != type_bytes.size() + 1) { ------------------ | Branch (561:10): [True: 1, False: 60] ------------------ 562| 1| throw Decoding_Error("certificate type extension had inconsistent length"); 563| 1| } 564| | // RFC 7250 4: {client,server}_certificate_types<1..2^8-1> so must be non-empty 565| 60| if(type_bytes.empty()) { ------------------ | Branch (565:10): [True: 1, False: 59] ------------------ 566| 1| throw Decoding_Error("Certificate type extension contains no types"); 567| 1| } 568| 59| std::transform( 569| 59| type_bytes.begin(), type_bytes.end(), std::back_inserter(m_certificate_types), [](const auto type_byte) { 570| 59| return static_cast(type_byte); 571| 59| }); 572| 59| } else { 573| | // RFC 7250 4.2 574| | // Note that only a single value is permitted in the 575| | // server_certificate_type extension when carried in the server hello. 576| 13| if(extension_size != 1) { ------------------ | Branch (576:10): [True: 1, False: 12] ------------------ 577| 1| throw Decoding_Error("Server's certificate type extension must be of length 1"); 578| 1| } 579| 12| const auto type_byte = reader.get_byte(); 580| 12| m_certificate_types.push_back(static_cast(type_byte)); 581| 12| } 582| 74|} _ZNK5Botan3TLS16Supported_Groups9ec_groupsEv: 627| 5.34k|std::vector Supported_Groups::ec_groups() const { 628| 5.34k| std::vector ec; 629| 23.3k| for(auto g : m_groups) { ------------------ | Branch (629:15): [True: 23.3k, False: 5.34k] ------------------ 630| 23.3k| if(g.is_pure_ecc_group()) { ------------------ | Branch (630:10): [True: 5.48k, False: 17.8k] ------------------ 631| 5.48k| ec.push_back(g); 632| 5.48k| } 633| 23.3k| } 634| 5.34k| return ec; 635| 5.34k|} _ZNK5Botan3TLS16Supported_Groups9dh_groupsEv: 637| 5.41k|std::vector Supported_Groups::dh_groups() const { 638| 5.41k| std::vector dh; 639| 24.5k| for(auto g : m_groups) { ------------------ | Branch (639:15): [True: 24.5k, False: 5.41k] ------------------ 640| 24.5k| if(g.is_in_ffdhe_range()) { ------------------ | Branch (640:10): [True: 984, False: 23.6k] ------------------ 641| 984| dh.push_back(g); 642| 984| } 643| 24.5k| } 644| 5.41k| return dh; 645| 5.41k|} _ZN5Botan3TLS16Supported_GroupsC2ERNS0_15TLS_Data_ReaderEt: 667| 5.53k|Supported_Groups::Supported_Groups(TLS_Data_Reader& reader, uint16_t extension_size) { 668| 5.53k| const uint16_t len = reader.get_uint16_t(); 669| | 670| 5.53k| if(len + 2 != extension_size) { ------------------ | Branch (670:7): [True: 24, False: 5.51k] ------------------ 671| 24| throw Decoding_Error("Inconsistent length field in supported groups list"); 672| 24| } 673| | 674| | // RFC 8446 4.2.7: NamedGroup named_group_list<2..2^16-1>; 675| 5.51k| if(len == 0) { ------------------ | Branch (675:7): [True: 1, False: 5.51k] ------------------ 676| 1| throw Decoding_Error("Empty supported groups list"); 677| 1| } 678| | 679| 5.51k| if(len % 2 == 1) { ------------------ | Branch (679:7): [True: 1, False: 5.51k] ------------------ 680| 1| throw Decoding_Error("Supported groups list of strange size"); 681| 1| } 682| | 683| 5.51k| const size_t elems = len / 2; 684| | 685| 5.51k| std::unordered_set seen; 686| 33.8k| for(size_t i = 0; i != elems; ++i) { ------------------ | Branch (686:22): [True: 28.3k, False: 5.51k] ------------------ 687| 28.3k| const auto group = static_cast(reader.get_uint16_t()); 688| | // Note: RFC 8446 does not explicitly enforce that groups must be unique. 689| 28.3k| if(seen.insert(group.wire_code()).second) { ------------------ | Branch (689:10): [True: 25.4k, False: 2.93k] ------------------ 690| 25.4k| m_groups.push_back(group); 691| 25.4k| } 692| 28.3k| } 693| 5.51k|} _ZN5Botan3TLS20Signature_AlgorithmsC2ERNS0_15TLS_Data_ReaderEt: 739| 381| m_schemes(parse_signature_algorithms(reader, extension_size)) {} _ZN5Botan3TLS25Signature_Algorithms_CertC2ERNS0_15TLS_Data_ReaderEt: 746| 33| m_schemes(parse_signature_algorithms(reader, extension_size)) {} _ZN5Botan3TLS24SRTP_Protection_ProfilesC2ERNS0_15TLS_Data_ReaderEt: 748| 51|SRTP_Protection_Profiles::SRTP_Protection_Profiles(TLS_Data_Reader& reader, uint16_t extension_size) { 749| | // RFC 5764 4.1.1: UseSRTPData consists of 750| | // SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>; 751| | // opaque srtp_mki<0..255>; 752| | // for a wire size of 2 (profiles len) + 2*N + 1 (mki len) + mki_bytes, 753| | // with N >= 1. 754| 51| if(extension_size < 5) { ------------------ | Branch (754:7): [True: 2, False: 49] ------------------ 755| 2| throw Decoding_Error("Truncated SRTP protection extension"); 756| 2| } 757| 49| const size_t max_profile_pairs = (static_cast(extension_size) - 3) / 2; 758| 49| m_pp = reader.get_range(2, 1, max_profile_pairs); 759| 49| const std::vector mki = reader.get_range(1, 0, 255); 760| | 761| 49| if(m_pp.size() * 2 + mki.size() + 3 != extension_size) { ------------------ | Branch (761:7): [True: 10, False: 39] ------------------ 762| 10| throw Decoding_Error("Bad encoding for SRTP protection extension"); 763| 10| } 764| | 765| 39| if(!mki.empty()) { ------------------ | Branch (765:7): [True: 2, False: 37] ------------------ 766| 2| throw Decoding_Error("Unhandled non-empty MKI for SRTP protection extension"); 767| 2| } 768| 39|} _ZN5Botan3TLS18Supported_VersionsC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE: 843| 113|Supported_Versions::Supported_Versions(TLS_Data_Reader& reader, uint16_t extension_size, Connection_Side from) { 844| 113| if(from == Connection_Side::Server) { ------------------ | Branch (844:7): [True: 29, False: 84] ------------------ 845| 29| if(extension_size != 2) { ------------------ | Branch (845:10): [True: 1, False: 28] ------------------ 846| 1| throw Decoding_Error("Server sent invalid supported_versions extension"); 847| 1| } 848| 28| m_versions.push_back(Protocol_Version(reader.get_uint16_t())); 849| 84| } else { 850| 84| auto versions = reader.get_range(1, 1, 127); 851| | 852| 1.01k| for(auto v : versions) { ------------------ | Branch (852:18): [True: 1.01k, False: 84] ------------------ 853| 1.01k| m_versions.push_back(Protocol_Version(v)); 854| 1.01k| } 855| | 856| 84| if(extension_size != 1 + 2 * versions.size()) { ------------------ | Branch (856:10): [True: 8, False: 76] ------------------ 857| 8| throw Decoding_Error("Client sent invalid supported_versions extension"); 858| 8| } 859| 84| } 860| 113|} _ZNK5Botan3TLS18Supported_Versions8supportsENS0_16Protocol_VersionE: 862| 54|bool Supported_Versions::supports(Protocol_Version version) const { 863| 485| for(auto v : m_versions) { ------------------ | Branch (863:15): [True: 485, False: 20] ------------------ 864| 485| if(version == v) { ------------------ | Branch (864:10): [True: 34, False: 451] ------------------ 865| 34| return true; 866| 34| } 867| 485| } 868| 20| return false; 869| 54|} _ZN5Botan3TLS17Record_Size_LimitC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE: 877| 34|Record_Size_Limit::Record_Size_Limit(TLS_Data_Reader& reader, uint16_t extension_size, Connection_Side from) { 878| 34| if(extension_size != 2) { ------------------ | Branch (878:7): [True: 2, False: 32] ------------------ 879| 2| throw TLS_Exception(Alert::DecodeError, "invalid record_size_limit extension"); 880| 2| } 881| | 882| 32| m_limit = reader.get_uint16_t(); 883| | 884| | // RFC 8449 4. 885| | // This value is the length of the plaintext of a protected record. 886| | // The value includes the content type and padding added in TLS 1.3 (that 887| | // is, the complete length of TLSInnerPlaintext). 888| | // 889| | // A server MUST NOT enforce this restriction; a client might advertise 890| | // a higher limit that is enabled by an extension or version the server 891| | // does not understand. A client MAY abort the handshake with an 892| | // "illegal_parameter" alert. 893| | // 894| | // Note: We are currently supporting this extension in TLS 1.3 only, hence 895| | // we check for the TLS 1.3 limit. The TLS 1.2 limit would not include 896| | // the "content type byte" and hence be one byte less! 897| 32| if(m_limit > MAX_PLAINTEXT_SIZE + 1 /* encrypted content type byte */ && from == Connection_Side::Server) { ------------------ | Branch (897:7): [True: 4, False: 28] | Branch (897:77): [True: 1, False: 3] ------------------ 898| 1| throw TLS_Exception(Alert::IllegalParameter, 899| 1| "Server requested a record size limit larger than the protocol's maximum"); 900| 1| } 901| | 902| | // RFC 8449 4. 903| | // Endpoints MUST NOT send a "record_size_limit" extension with a value 904| | // smaller than 64. An endpoint MUST treat receipt of a smaller value 905| | // as a fatal error and generate an "illegal_parameter" alert. 906| 31| if(m_limit < 64) { ------------------ | Branch (906:7): [True: 4, False: 27] ------------------ 907| 4| throw TLS_Exception(Alert::IllegalParameter, "Received a record size limit smaller than 64 bytes"); 908| 4| } 909| 31|} tls_extensions.cpp:_ZN5Botan3TLS12_GLOBAL__N_114make_extensionERNS0_15TLS_Data_ReaderENS0_14Extension_CodeENS0_15Connection_SideENS0_14Handshake_TypeE: 42| 44.1k| const Handshake_Type message_type) { 43| | // This cast is safe because we read exactly a 16 bit length field for 44| | // the extension in Extensions::deserialize 45| 44.1k| const uint16_t size = static_cast(reader.remaining_bytes()); 46| 44.1k| switch(code) { ------------------ | Branch (46:11): [True: 14.1k, False: 29.9k] ------------------ 47| 91| case Extension_Code::ServerNameIndication: ------------------ | Branch (47:7): [True: 91, False: 44.0k] ------------------ 48| 91| return std::make_unique(reader, size, from); 49| | 50| 5.53k| case Extension_Code::SupportedGroups: ------------------ | Branch (50:7): [True: 5.53k, False: 38.6k] ------------------ 51| 5.53k| return std::make_unique(reader, size); 52| | 53| 303| case Extension_Code::CertificateStatusRequest: ------------------ | Branch (53:7): [True: 303, False: 43.8k] ------------------ 54| 303| return std::make_unique(reader, size, message_type, from); 55| | 56| 381| case Extension_Code::SignatureAlgorithms: ------------------ | Branch (56:7): [True: 381, False: 43.7k] ------------------ 57| 381| return std::make_unique(reader, size); 58| | 59| 33| case Extension_Code::CertSignatureAlgorithms: ------------------ | Branch (59:7): [True: 33, False: 44.1k] ------------------ 60| 33| return std::make_unique(reader, size); 61| | 62| 51| case Extension_Code::UseSrtp: ------------------ | Branch (62:7): [True: 51, False: 44.0k] ------------------ 63| 51| return std::make_unique(reader, size); 64| | 65| 143| case Extension_Code::ApplicationLayerProtocolNegotiation: ------------------ | Branch (65:7): [True: 143, False: 44.0k] ------------------ 66| 143| return std::make_unique(reader, size, from); 67| | 68| 26| case Extension_Code::ClientCertificateType: ------------------ | Branch (68:7): [True: 26, False: 44.1k] ------------------ 69| 26| return std::make_unique(reader, size, from); 70| | 71| 51| case Extension_Code::ServerCertificateType: ------------------ | Branch (71:7): [True: 51, False: 44.0k] ------------------ 72| 51| return std::make_unique(reader, size, from); 73| | 74| 34| case Extension_Code::RecordSizeLimit: ------------------ | Branch (74:7): [True: 34, False: 44.1k] ------------------ 75| 34| return std::make_unique(reader, size, from); 76| | 77| 113| case Extension_Code::SupportedVersions: ------------------ | Branch (77:7): [True: 113, False: 44.0k] ------------------ 78| 113| return std::make_unique(reader, size, from); 79| | 80| 2| case Extension_Code::Padding: ------------------ | Branch (80:7): [True: 2, False: 44.1k] ------------------ 81| 2| break; // RFC 7685, recognized but not implemented; falls through to Unknown_Extension 82| | 83| 0|#if defined(BOTAN_HAS_TLS_12) 84| 197| case Extension_Code::EcPointFormats: ------------------ | Branch (84:7): [True: 197, False: 43.9k] ------------------ 85| 197| return std::make_unique(reader, size); 86| | 87| 23| case Extension_Code::SafeRenegotiation: ------------------ | Branch (87:7): [True: 23, False: 44.1k] ------------------ 88| 23| return std::make_unique(reader, size); 89| | 90| 5.97k| case Extension_Code::ExtendedMasterSecret: ------------------ | Branch (90:7): [True: 5.97k, False: 38.1k] ------------------ 91| 5.97k| return std::make_unique(reader, size); 92| | 93| 198| case Extension_Code::EncryptThenMac: ------------------ | Branch (93:7): [True: 198, False: 43.9k] ------------------ 94| 198| return std::make_unique(reader, size); 95| | 96| 121| case Extension_Code::SessionTicket: ------------------ | Branch (96:7): [True: 121, False: 44.0k] ------------------ 97| 121| return std::make_unique(reader, size, from); 98| |#else 99| | case Extension_Code::EcPointFormats: 100| | case Extension_Code::SafeRenegotiation: 101| | case Extension_Code::ExtendedMasterSecret: 102| | case Extension_Code::EncryptThenMac: 103| | case Extension_Code::SessionTicket: 104| | break; // considered as 'unknown extension' 105| |#endif 106| | 107| 0|#if defined(BOTAN_HAS_TLS_13) 108| 87| case Extension_Code::PresharedKey: ------------------ | Branch (108:7): [True: 87, False: 44.0k] ------------------ 109| 87| return std::make_unique(reader, size, message_type); 110| | 111| 42| case Extension_Code::EarlyData: ------------------ | Branch (111:7): [True: 42, False: 44.1k] ------------------ 112| 42| return std::make_unique(reader, size, message_type); 113| | 114| 33| case Extension_Code::Cookie: ------------------ | Branch (114:7): [True: 33, False: 44.1k] ------------------ 115| 33| return std::make_unique(reader, size); 116| | 117| 82| case Extension_Code::PskKeyExchangeModes: ------------------ | Branch (117:7): [True: 82, False: 44.0k] ------------------ 118| 82| return std::make_unique(reader, size); 119| | 120| 608| case Extension_Code::CertificateAuthorities: ------------------ | Branch (120:7): [True: 608, False: 43.5k] ------------------ 121| 608| return std::make_unique(reader, size); 122| | 123| 64| case Extension_Code::KeyShare: ------------------ | Branch (123:7): [True: 64, False: 44.0k] ------------------ 124| 64| return std::make_unique(reader, size, message_type); 125| |#else 126| | case Extension_Code::PresharedKey: 127| | case Extension_Code::EarlyData: 128| | case Extension_Code::Cookie: 129| | case Extension_Code::PskKeyExchangeModes: 130| | case Extension_Code::CertificateAuthorities: 131| | case Extension_Code::KeyShare: 132| | break; // considered as 'unknown extension' 133| |#endif 134| 44.1k| } 135| | 136| 29.9k| return std::make_unique(code, reader, size); 137| 44.1k|} tls_extensions.cpp:_ZZNK5Botan3TLS10Extensions19contains_other_thanERKNSt3__13setINS0_14Extension_CodeENS2_4lessIS4_EENS2_9allocatorIS4_EEEEbENK3$_0clIS4_EEDaT_: 207| 463| const auto itr = std::find_if(diff.cbegin(), diff.cend(), [this](const auto ext_type) { 208| 463| const auto ext = get(ext_type); 209| 463| return ext && ext->is_implemented(); ------------------ | Branch (209:17): [True: 463, False: 0] | Branch (209:24): [True: 57, False: 406] ------------------ 210| 463| }); tls_extensions.cpp:_ZZN5Botan3TLS21Certificate_Type_BaseC1ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideEENK3$_0clIhEEDaT_: 569| 1.60k| type_bytes.begin(), type_bytes.end(), std::back_inserter(m_certificate_types), [](const auto type_byte) { 570| 1.60k| return static_cast(type_byte); 571| 1.60k| }); tls_extensions.cpp:_ZN5Botan3TLS12_GLOBAL__N_126parse_signature_algorithmsERNS0_15TLS_Data_ReaderEt: 715| 414|std::vector parse_signature_algorithms(TLS_Data_Reader& reader, uint16_t extension_size) { 716| 414| uint16_t len = reader.get_uint16_t(); 717| | 718| 414| if(len + 2 != extension_size || len % 2 == 1 || len == 0) { ------------------ | Branch (718:7): [True: 19, False: 395] | Branch (718:36): [True: 1, False: 394] | Branch (718:52): [True: 1, False: 393] ------------------ 719| 16| throw Decoding_Error("Bad encoding on signature algorithms extension"); 720| 16| } 721| | 722| 398| std::vector schemes; 723| 398| schemes.reserve(len / 2); 724| 32.3k| while(len > 0) { ------------------ | Branch (724:10): [True: 31.9k, False: 398] ------------------ 725| 31.9k| schemes.emplace_back(reader.get_uint16_t()); 726| 31.9k| len -= 2; 727| 31.9k| } 728| | 729| 398| return schemes; 730| 414|} _ZN5Botan3TLS26Certificate_Status_RequestC2ERNS0_15TLS_Data_ReaderEtNS0_14Handshake_TypeENS0_15Connection_SideE: 104| 303| Connection_Side from) { 105| | // This parser needs to take TLS 1.2 and TLS 1.3 into account. The 106| | // extension's content and structure is dependent on the context it 107| | // was sent in (i.e. the enclosing handshake message). Below is a list 108| | // of handshake messages this can appear in. 109| | // 110| | // TLS 1.2 111| | // * Client Hello 112| | // * Server Hello 113| | // 114| | // TLS 1.3 115| | // * Client Hello 116| | // * Certificate Request 117| | // * Certificate (Entry) 118| | 119| | // RFC 6066 8. 120| | // In order to indicate their desire to receive certificate status 121| | // information, clients MAY include an extension of type "status_request" 122| | // in the (extended) client hello. 123| 303| if(message_type == Handshake_Type::ClientHello) { ------------------ | Branch (123:7): [True: 297, False: 6] ------------------ 124| 297| m_impl = std::make_unique( 125| 297| RFC6066_Certificate_Status_Request(reader, extension_size)); 126| 297| } 127| | 128| | // RFC 6066 8. 129| | // If a server returns a "CertificateStatus" message, then the server MUST 130| | // have included an extension of type "status_request" with empty 131| | // "extension_data" in the extended server hello. 132| | // 133| | // RFC 8446 4.4.2.1 134| | // A server MAY request that a client present an OCSP response with its 135| | // certificate by sending an empty "status_request" extension in its 136| | // CertificateRequest message. 137| 6| else if(message_type == Handshake_Type::ServerHello || message_type == Handshake_Type::CertificateRequest) { ------------------ | Branch (137:12): [True: 5, False: 1] | Branch (137:59): [True: 0, False: 1] ------------------ 138| 5| m_impl = std::make_unique( 139| 5| RFC6066_Empty_Certificate_Status_Request(extension_size)); 140| 5| } 141| | 142| | // RFC 8446 4.4.2.1 143| | // In TLS 1.3, the server's OCSP information is carried in an extension 144| | // in the CertificateEntry [in a Certificate handshake message] [...]. 145| | // Specifically, the body of the "status_request" extension from the 146| | // server MUST be a CertificateStatus structure as defined in [RFC6066] 147| | // [...]. 148| | // 149| | // RFC 8446 4.4.2.1 150| | // If the client opts to send an OCSP response, the body of its 151| | // "status_request" extension MUST be a CertificateStatus structure as 152| | // defined in [RFC6066]. 153| 1| else if(message_type == Handshake_Type::Certificate) { ------------------ | Branch (153:12): [True: 0, False: 1] ------------------ 154| 0| m_impl = std::make_unique( 155| 0| Certificate_Status(reader.get_fixed(extension_size), from)); 156| 0| } 157| | 158| | // all other contexts are not allowed for this extension 159| 1| else { 160| 1| throw TLS_Exception(Alert::UnsupportedExtension, 161| 1| "Server sent a Certificate_Status_Request extension in an unsupported context"); 162| 1| } 163| 303|} _ZN5Botan3TLS26Certificate_Status_RequestC2Ev: 166| 116| m_impl(std::make_unique(RFC6066_Empty_Certificate_Status_Request())) {} _ZN5Botan3TLS26Certificate_Status_RequestD2Ev: 176| 384|Certificate_Status_Request::~Certificate_Status_Request() = default; _ZNK5Botan3TLS26Certificate_Status_Request9serializeENS0_15Connection_SideE: 184| 116|std::vector Certificate_Status_Request::serialize(Connection_Side /*side*/) const { 185| 116| BOTAN_ASSERT_NONNULL(m_impl); ------------------ | | 116| 116| do { \ | | 117| 116| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 116] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 116| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 116] | | ------------------ ------------------ 186| 116| return std::visit([](const auto& c) { return c.serialize(); }, m_impl->content); 187| 116|} tls_extensions_cert_status_req.cpp:_ZN5Botan3TLS12_GLOBAL__N_134RFC6066_Certificate_Status_RequestC2ERNS0_15TLS_Data_ReaderEt: 38| 297| RFC6066_Certificate_Status_Request(TLS_Data_Reader& reader, uint16_t extension_size) { 39| 297| if(extension_size == 0) { ------------------ | Branch (39:13): [True: 1, False: 296] ------------------ 40| 1| throw Decoding_Error("Received an unexpectedly empty Certificate_Status_Request"); 41| 1| } 42| | 43| 296| const uint8_t type = reader.get_byte(); 44| 296| if(type == 1 /* ocsp */) { ------------------ | Branch (44:13): [True: 44, False: 252] ------------------ 45| | // RFC 6066 Section 8: OCSP CertificateStatusRequest is 46| | // ResponderID responder_id_list<0..2^16-1>; 47| | // Extensions request_extensions; 48| | // 49| | // for a total wire size of 1 (status_type) + 2 (resp_id_list len) 50| | // + len_resp_id_list + 2 (request_ext len) + len_requ_ext. 51| 44| if(extension_size < 5) { ------------------ | Branch (51:16): [True: 1, False: 43] ------------------ 52| 1| throw Decoding_Error("Truncated OCSP CertificateStatusRequest"); 53| 1| } 54| 43| const size_t len_resp_id_list = reader.get_uint16_t(); 55| 43| if(len_resp_id_list > static_cast(extension_size) - 5) { ------------------ | Branch (55:16): [True: 9, False: 34] ------------------ 56| 9| throw Decoding_Error("Inconsistent length in OCSP CertificateStatusRequest"); 57| 9| } 58| 34| ocsp_names = reader.get_fixed(len_resp_id_list); 59| 34| const size_t len_requ_ext = reader.get_uint16_t(); 60| 34| if(len_resp_id_list + len_requ_ext + 5 != extension_size) { ------------------ | Branch (60:16): [True: 22, False: 12] ------------------ 61| 22| throw Decoding_Error("Inconsistent length in OCSP CertificateStatusRequest"); 62| 22| } 63| 12| extension_bytes = reader.get_fixed(len_requ_ext); 64| 252| } else { 65| | // RFC 6066 does not specify anything but 'ocsp' and we 66| | // don't support anything else either. 67| 252| reader.discard_next(extension_size - 1); 68| 252| } 69| 296| } tls_extensions_cert_status_req.cpp:_ZN5Botan3TLS12_GLOBAL__N_140RFC6066_Empty_Certificate_Status_RequestC2Et: 24| 5| explicit RFC6066_Empty_Certificate_Status_Request(uint16_t extension_size) { 25| 5| if(extension_size != 0) { ------------------ | Branch (25:13): [True: 1, False: 4] ------------------ 26| 1| throw Decoding_Error("Received an unexpectedly non-empty Certificate_Status_Request"); 27| 1| } 28| 5| } tls_extensions_cert_status_req.cpp:_ZZNK5Botan3TLS26Certificate_Status_Request9serializeENS0_15Connection_SideEENK3$_0clINS0_12_GLOBAL__N_140RFC6066_Empty_Certificate_Status_RequestEEEDaRKT_: 186| 116| return std::visit([](const auto& c) { return c.serialize(); }, m_impl->content); tls_extensions_cert_status_req.cpp:_ZNK5Botan3TLS12_GLOBAL__N_140RFC6066_Empty_Certificate_Status_Request9serializeEv: 30| 116| std::vector serialize() const { return {}; } tls_extensions_cert_status_req.cpp:_ZN5Botan3TLS35Certificate_Status_Request_InternalC2ENSt3__17variantIJNS0_12_GLOBAL__N_140RFC6066_Empty_Certificate_Status_RequestENS4_34RFC6066_Certificate_Status_RequestENS0_18Certificate_StatusEEEE: 96| 384| explicit Certificate_Status_Request_Internal(Contents c) : content(std::move(c)) {} _ZN5Botan3TLS11ExternalPSK21extract_master_secretEv: 16| 2.12k|secure_vector ExternalPSK::extract_master_secret() { 17| 2.12k| BOTAN_STATE_CHECK(!m_master_secret.empty()); ------------------ | | 51| 2.12k| do { \ | | 52| 2.12k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 2.12k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 2.12k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 2.12k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 2.12k] | | ------------------ ------------------ 18| 2.12k| return std::exchange(m_master_secret, {}); 19| 2.12k|} _ZNK5Botan3TLS21Handshake_Transitions22received_handshake_msgENS0_14Handshake_TypeE: 125| 2.15k|bool Handshake_Transitions::received_handshake_msg(Handshake_Type msg_type) const { 126| 2.15k| const uint32_t mask = bitmask_for_handshake_type(msg_type); 127| | 128| 2.15k| return (m_hand_received_mask & mask) != 0; 129| 2.15k|} _ZN5Botan3TLS21Handshake_Transitions21confirm_transition_toENS0_14Handshake_TypeE: 131| 9.18k|void Handshake_Transitions::confirm_transition_to(Handshake_Type msg_type) { 132| 9.18k| const uint32_t mask = bitmask_for_handshake_type(msg_type); 133| | 134| 9.18k| m_hand_received_mask |= mask; 135| | 136| 9.18k| const bool ok = (m_hand_expecting_mask & mask) != 0; // overlap? 137| | 138| 9.18k| if(!ok) { ------------------ | Branch (138:7): [True: 234, False: 8.94k] ------------------ 139| 234| const uint32_t seen_so_far = m_hand_received_mask & ~mask; 140| | 141| 234| std::ostringstream msg; 142| | 143| 234| msg << "Unexpected state transition in handshake got a " << handshake_type_to_string(msg_type); 144| | 145| 234| if(m_hand_expecting_mask == 0) { ------------------ | Branch (145:10): [True: 0, False: 234] ------------------ 146| 0| msg << " not expecting messages"; 147| 234| } else { 148| 234| msg << " expected " << handshake_mask_to_string(m_hand_expecting_mask, '|'); 149| 234| } 150| | 151| 234| if(seen_so_far != 0) { ------------------ | Branch (151:10): [True: 13, False: 221] ------------------ 152| 13| msg << " seen " << handshake_mask_to_string(seen_so_far, '+'); 153| 13| } 154| | 155| 234| throw Unexpected_Message(msg.str()); 156| 234| } 157| | 158| | /* We don't know what to expect next, so force a call to 159| | set_expected_next; if it doesn't happen, the next transition 160| | check will always fail which is what we want. 161| | */ 162| 8.94k| m_hand_expecting_mask = 0; 163| 8.94k|} _ZN5Botan3TLS21Handshake_Transitions17set_expected_nextENS0_14Handshake_TypeE: 165| 17.7k|void Handshake_Transitions::set_expected_next(Handshake_Type msg_type) { 166| 17.7k| m_hand_expecting_mask |= bitmask_for_handshake_type(msg_type); 167| 17.7k|} _ZNK5Botan3TLS21Handshake_Transitions27change_cipher_spec_expectedEv: 175| 11.5k|bool Handshake_Transitions::change_cipher_spec_expected() const { 176| 11.5k| return (bitmask_for_handshake_type(Handshake_Type::HandshakeCCS) & m_hand_expecting_mask) != 0; 177| 11.5k|} tls_handshake_transitions.cpp:_ZN5Botan3TLS12_GLOBAL__N_126bitmask_for_handshake_typeENS0_14Handshake_TypeE: 19| 45.0k|uint32_t bitmask_for_handshake_type(Handshake_Type type) { 20| 45.0k| switch(type) { ------------------ | Branch (20:11): [True: 45.0k, False: 17] ------------------ 21| 248| case Handshake_Type::HelloVerifyRequest: ------------------ | Branch (21:7): [True: 248, False: 44.8k] ------------------ 22| 248| return (1 << 0); 23| | 24| 3.41k| case Handshake_Type::HelloRequest: ------------------ | Branch (24:7): [True: 3.41k, False: 41.6k] ------------------ 25| 3.41k| return (1 << 1); 26| | 27| 15.7k| case Handshake_Type::ClientHello: ------------------ | Branch (27:7): [True: 15.7k, False: 29.2k] ------------------ 28| 15.7k| return (1 << 2); 29| | 30| 270| case Handshake_Type::ServerHello: ------------------ | Branch (30:7): [True: 270, False: 44.7k] ------------------ 31| 270| return (1 << 3); 32| | 33| 2.40k| case Handshake_Type::Certificate: ------------------ | Branch (33:7): [True: 2.40k, False: 42.6k] ------------------ 34| 2.40k| return (1 << 4); 35| | 36| 249| case Handshake_Type::CertificateUrl: ------------------ | Branch (36:7): [True: 249, False: 44.8k] ------------------ 37| 249| return (1 << 5); 38| | 39| 248| case Handshake_Type::CertificateStatus: ------------------ | Branch (39:7): [True: 248, False: 44.8k] ------------------ 40| 248| return (1 << 6); 41| | 42| 249| case Handshake_Type::ServerKeyExchange: ------------------ | Branch (42:7): [True: 249, False: 44.8k] ------------------ 43| 249| return (1 << 7); 44| | 45| 247| case Handshake_Type::CertificateRequest: ------------------ | Branch (45:7): [True: 247, False: 44.8k] ------------------ 46| 247| return (1 << 8); 47| | 48| 247| case Handshake_Type::ServerHelloDone: ------------------ | Branch (48:7): [True: 247, False: 44.8k] ------------------ 49| 247| return (1 << 9); 50| | 51| 253| case Handshake_Type::CertificateVerify: ------------------ | Branch (51:7): [True: 253, False: 44.8k] ------------------ 52| 253| return (1 << 10); 53| | 54| 5.16k| case Handshake_Type::ClientKeyExchange: ------------------ | Branch (54:7): [True: 5.16k, False: 39.9k] ------------------ 55| 5.16k| return (1 << 11); 56| | 57| 247| case Handshake_Type::NewSessionTicket: ------------------ | Branch (57:7): [True: 247, False: 44.8k] ------------------ 58| 247| return (1 << 12); 59| | 60| 14.2k| case Handshake_Type::HandshakeCCS: ------------------ | Branch (60:7): [True: 14.2k, False: 30.7k] ------------------ 61| 14.2k| return (1 << 13); 62| | 63| 737| case Handshake_Type::Finished: ------------------ | Branch (63:7): [True: 737, False: 44.3k] ------------------ 64| 737| return (1 << 14); 65| | 66| 249| case Handshake_Type::EndOfEarlyData: // RFC 8446 ------------------ | Branch (66:7): [True: 249, False: 44.8k] ------------------ 67| 249| return (1 << 15); 68| | 69| 399| case Handshake_Type::EncryptedExtensions: // RFC 8446 ------------------ | Branch (69:7): [True: 399, False: 44.6k] ------------------ 70| 399| return (1 << 16); 71| | 72| 248| case Handshake_Type::KeyUpdate: // RFC 8446 ------------------ | Branch (72:7): [True: 248, False: 44.8k] ------------------ 73| 248| return (1 << 17); 74| | 75| 0| case Handshake_Type::HelloRetryRequest: // RFC 8446 ------------------ | Branch (75:7): [True: 0, False: 45.0k] ------------------ 76| 0| return (1 << 18); 77| | 78| | // allow explicitly disabling new handshakes 79| 102| case Handshake_Type::None: ------------------ | Branch (79:7): [True: 102, False: 44.9k] ------------------ 80| 102| return 0; 81| 45.0k| } 82| | 83| 17| throw TLS_Exception(Alert::UnexpectedMessage, 84| 17| "Unknown TLS handshake message type " + std::to_string(static_cast(type))); 85| 45.0k|} tls_handshake_transitions.cpp:_ZN5Botan3TLS12_GLOBAL__N_124handshake_mask_to_stringEjc: 87| 247|std::string handshake_mask_to_string(uint32_t mask, char combiner) { 88| 247| const Handshake_Type types[] = {Handshake_Type::HelloVerifyRequest, 89| 247| Handshake_Type::HelloRequest, 90| 247| Handshake_Type::ClientHello, 91| 247| Handshake_Type::ServerHello, 92| 247| Handshake_Type::Certificate, 93| 247| Handshake_Type::CertificateUrl, 94| 247| Handshake_Type::CertificateStatus, 95| 247| Handshake_Type::ServerKeyExchange, 96| 247| Handshake_Type::CertificateRequest, 97| 247| Handshake_Type::ServerHelloDone, 98| 247| Handshake_Type::CertificateVerify, 99| 247| Handshake_Type::ClientKeyExchange, 100| 247| Handshake_Type::NewSessionTicket, 101| 247| Handshake_Type::HandshakeCCS, 102| 247| Handshake_Type::Finished, 103| 247| Handshake_Type::EndOfEarlyData, 104| 247| Handshake_Type::EncryptedExtensions, 105| 247| Handshake_Type::KeyUpdate}; 106| | 107| 247| std::ostringstream o; 108| 247| bool empty = true; 109| | 110| 4.44k| for(auto&& t : types) { ------------------ | Branch (110:17): [True: 4.44k, False: 247] ------------------ 111| 4.44k| if((mask & bitmask_for_handshake_type(t)) != 0) { ------------------ | Branch (111:10): [True: 258, False: 4.18k] ------------------ 112| 258| if(!empty) { ------------------ | Branch (112:13): [True: 11, False: 247] ------------------ 113| 11| o << combiner; 114| 11| } 115| 258| o << handshake_type_to_string(t); 116| 258| empty = false; 117| 258| } 118| 4.44k| } 119| | 120| 247| return o.str(); 121| 247|} _ZN5Botan3TLS24handshake_type_to_stringENS0_14Handshake_TypeE: 15| 495|const char* handshake_type_to_string(Handshake_Type type) { 16| 495| switch(type) { ------------------ | Branch (16:11): [True: 495, False: 0] ------------------ 17| 1| case Handshake_Type::HelloVerifyRequest: ------------------ | Branch (17:7): [True: 1, False: 494] ------------------ 18| 1| return "hello_verify_request"; 19| | 20| 31| case Handshake_Type::HelloRequest: ------------------ | Branch (20:7): [True: 31, False: 464] ------------------ 21| 31| return "hello_request"; 22| | 23| 234| case Handshake_Type::ClientHello: ------------------ | Branch (23:7): [True: 234, False: 261] ------------------ 24| 234| return "client_hello"; 25| | 26| 23| case Handshake_Type::ServerHello: ------------------ | Branch (26:7): [True: 23, False: 472] ------------------ 27| 23| return "server_hello"; 28| | 29| 0| case Handshake_Type::HelloRetryRequest: ------------------ | Branch (29:7): [True: 0, False: 495] ------------------ 30| 0| return "hello_retry_request"; 31| | 32| 6| case Handshake_Type::Certificate: ------------------ | Branch (32:7): [True: 6, False: 489] ------------------ 33| 6| return "certificate"; 34| | 35| 2| case Handshake_Type::CertificateUrl: ------------------ | Branch (35:7): [True: 2, False: 493] ------------------ 36| 2| return "certificate_url"; 37| | 38| 1| case Handshake_Type::CertificateStatus: ------------------ | Branch (38:7): [True: 1, False: 494] ------------------ 39| 1| return "certificate_status"; 40| | 41| 2| case Handshake_Type::ServerKeyExchange: ------------------ | Branch (41:7): [True: 2, False: 493] ------------------ 42| 2| return "server_key_exchange"; 43| | 44| 0| case Handshake_Type::CertificateRequest: ------------------ | Branch (44:7): [True: 0, False: 495] ------------------ 45| 0| return "certificate_request"; 46| | 47| 0| case Handshake_Type::ServerHelloDone: ------------------ | Branch (47:7): [True: 0, False: 495] ------------------ 48| 0| return "server_hello_done"; 49| | 50| 6| case Handshake_Type::CertificateVerify: ------------------ | Branch (50:7): [True: 6, False: 489] ------------------ 51| 6| return "certificate_verify"; 52| | 53| 16| case Handshake_Type::ClientKeyExchange: ------------------ | Branch (53:7): [True: 16, False: 479] ------------------ 54| 16| return "client_key_exchange"; 55| | 56| 0| case Handshake_Type::NewSessionTicket: ------------------ | Branch (56:7): [True: 0, False: 495] ------------------ 57| 0| return "new_session_ticket"; 58| | 59| 6| case Handshake_Type::HandshakeCCS: ------------------ | Branch (59:7): [True: 6, False: 489] ------------------ 60| 6| return "change_cipher_spec"; 61| | 62| 9| case Handshake_Type::Finished: ------------------ | Branch (62:7): [True: 9, False: 486] ------------------ 63| 9| return "finished"; 64| | 65| 2| case Handshake_Type::EndOfEarlyData: ------------------ | Branch (65:7): [True: 2, False: 493] ------------------ 66| 2| return "end_of_early_data"; 67| | 68| 155| case Handshake_Type::EncryptedExtensions: ------------------ | Branch (68:7): [True: 155, False: 340] ------------------ 69| 155| return "encrypted_extensions"; 70| | 71| 1| case Handshake_Type::KeyUpdate: ------------------ | Branch (71:7): [True: 1, False: 494] ------------------ 72| 1| return "key_update"; 73| | 74| 0| case Handshake_Type::None: ------------------ | Branch (74:7): [True: 0, False: 495] ------------------ 75| 0| return "invalid"; 76| 495| } 77| | 78| 0| throw TLS_Exception(Alert::UnexpectedMessage, 79| 0| "Unknown TLS handshake message type " + std::to_string(static_cast(type))); 80| 495|} _ZNK5Botan3TLS6Policy22allow_ssl_key_log_fileEv: 25| 1.40k|bool Policy::allow_ssl_key_log_file() const { 26| 1.40k| return false; 27| 1.40k|} _ZNK5Botan3TLS6Policy25allowed_signature_schemesEv: 29| 5.73k|std::vector Policy::allowed_signature_schemes() const { 30| 5.73k| std::vector schemes; 31| | 32| 68.7k| for(const Signature_Scheme scheme : Signature_Scheme::all_available_schemes()) { ------------------ | Branch (32:38): [True: 68.7k, False: 5.73k] ------------------ 33| 68.7k| const bool sig_allowed = allowed_signature_method(scheme.algorithm_name()); 34| 68.7k| const bool hash_allowed = allowed_signature_hash(scheme.hash_function_name()); 35| | 36| 68.7k| if(sig_allowed && hash_allowed) { ------------------ | Branch (36:10): [True: 68.7k, False: 0] | Branch (36:25): [True: 68.7k, False: 0] ------------------ 37| 68.7k| schemes.push_back(scheme); 38| 68.7k| } 39| 68.7k| } 40| | 41| 5.73k| return schemes; 42| 5.73k|} _ZNK5Botan3TLS6Policy28acceptable_signature_schemesEv: 44| 2.75k|std::vector Policy::acceptable_signature_schemes() const { 45| 2.75k| return this->allowed_signature_schemes(); 46| 2.75k|} _ZNK5Botan3TLS6Policy24allowed_signature_hashesEv: 73| 74.4k|std::vector Policy::allowed_signature_hashes() const { 74| 74.4k| return { 75| 74.4k| "SHA-512", 76| 74.4k| "SHA-384", 77| 74.4k| "SHA-256", 78| 74.4k| }; 79| 74.4k|} _ZNK5Botan3TLS6Policy25allowed_signature_methodsEv: 105| 68.7k|std::vector Policy::allowed_signature_methods() const { 106| 68.7k| return { 107| 68.7k| "ECDSA", "RSA", 108| | //"IMPLICIT", 109| 68.7k| }; 110| 68.7k|} _ZNK5Botan3TLS6Policy24allowed_signature_methodENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 112| 68.7k|bool Policy::allowed_signature_method(std::string_view sig_method) const { 113| 68.7k| return value_exists(allowed_signature_methods(), sig_method); 114| 68.7k|} _ZNK5Botan3TLS6Policy22allowed_signature_hashENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 116| 74.4k|bool Policy::allowed_signature_hash(std::string_view sig_hash) const { 117| 74.4k| return value_exists(allowed_signature_hashes(), sig_hash); 118| 74.4k|} _ZNK5Botan3TLS6Policy25use_ecc_point_compressionEv: 120| 78|bool Policy::use_ecc_point_compression() const { 121| 78| return false; 122| 78|} _ZNK5Botan3TLS6Policy25choose_key_exchange_groupERKNSt3__16vectorINS0_12Group_ParamsENS2_9allocatorIS4_EEEES9_: 125| 8.58k| const std::vector& offered_by_peer) const { 126| 8.58k| if(supported_by_peer.empty()) { ------------------ | Branch (126:7): [True: 2.91k, False: 5.67k] ------------------ 127| 2.91k| return Group_Params::NONE; 128| 2.91k| } 129| | 130| 5.67k| const auto our_groups = key_exchange_groups(); 131| | 132| | // First check if the peer sent a PQ share of a group we also support 133| 5.67k| for(auto share : offered_by_peer) { ------------------ | Branch (133:19): [True: 0, False: 5.67k] ------------------ 134| 0| if(share.is_post_quantum() && value_exists(our_groups, share)) { ------------------ | Branch (134:10): [True: 0, False: 0] | Branch (134:37): [True: 0, False: 0] ------------------ 135| 0| return share; 136| 0| } 137| 0| } 138| | 139| | // Then check if the peer offered a PQ algo we also support 140| 5.97k| for(auto share : supported_by_peer) { ------------------ | Branch (140:19): [True: 5.97k, False: 5.67k] ------------------ 141| 5.97k| if(share.is_post_quantum() && value_exists(our_groups, share)) { ------------------ | Branch (141:10): [True: 0, False: 5.97k] | Branch (141:37): [True: 0, False: 0] ------------------ 142| 0| return share; 143| 0| } 144| 5.97k| } 145| | 146| | // Prefer groups that were offered by the peer for the sake of saving 147| | // an additional round trip. For TLS 1.2, this won't be used. 148| 5.67k| for(auto g : offered_by_peer) { ------------------ | Branch (148:15): [True: 0, False: 5.67k] ------------------ 149| 0| if(value_exists(our_groups, g)) { ------------------ | Branch (149:10): [True: 0, False: 0] ------------------ 150| 0| return g; 151| 0| } 152| 0| } 153| | 154| | // If no pre-offered groups fit our supported set, we prioritize our 155| | // own preference. 156| 49.7k| for(auto g : our_groups) { ------------------ | Branch (156:15): [True: 49.7k, False: 357] ------------------ 157| 49.7k| if(value_exists(supported_by_peer, g)) { ------------------ | Branch (157:10): [True: 5.32k, False: 44.4k] ------------------ 158| 5.32k| return g; 159| 5.32k| } 160| 49.7k| } 161| | 162| 357| return Group_Params::NONE; 163| 5.67k|} _ZNK5Botan3TLS6Policy19key_exchange_groupsEv: 178| 5.67k|std::vector Policy::key_exchange_groups() const { 179| 5.67k| return { 180| | // clang-format off 181| 5.67k|#if defined(BOTAN_HAS_X25519) 182| 5.67k| Group_Params::X25519, 183| 5.67k|#endif 184| | 185| 5.67k| Group_Params::SECP256R1, 186| | 187| 5.67k|#if defined(BOTAN_HAS_ML_KEM) && defined(BOTAN_HAS_TLS_13_PQC) 188| | 189| 5.67k|#if defined(BOTAN_HAS_X25519) 190| 5.67k| Group_Params_Code::HYBRID_X25519_ML_KEM_768, 191| 5.67k|#endif 192| | 193| 5.67k| Group_Params_Code::HYBRID_SECP256R1_ML_KEM_768, 194| 5.67k| Group_Params_Code::HYBRID_SECP384R1_ML_KEM_1024, 195| 5.67k|#endif 196| | 197| 5.67k|#if defined(BOTAN_HAS_X448) 198| 5.67k| Group_Params::X448, 199| 5.67k|#endif 200| | 201| 5.67k| Group_Params::SECP384R1, 202| 5.67k| Group_Params::SECP521R1, 203| | 204| 5.67k| Group_Params::BRAINPOOL256R1, 205| 5.67k| Group_Params::BRAINPOOL256R1TLS13, 206| 5.67k| Group_Params::BRAINPOOL384R1, 207| 5.67k| Group_Params::BRAINPOOL384R1TLS13, 208| 5.67k| Group_Params::BRAINPOOL512R1, 209| 5.67k| Group_Params::BRAINPOOL512R1TLS13, 210| | 211| | // clang-format on 212| 5.67k| }; 213| 5.67k|} _ZNK5Botan3TLS6Policy23minimum_ecdh_group_sizeEv: 257| 1.64k|size_t Policy::minimum_ecdh_group_size() const { 258| | // x25519 is smallest curve currently supported for TLS key exchange 259| 1.64k| return 255; 260| 1.64k|} _ZNK5Botan3TLS6Policy25check_peer_key_acceptableERKNS_10Public_KeyE: 281| 1.64k|void Policy::check_peer_key_acceptable(const Public_Key& public_key) const { 282| 1.64k| const std::string algo_name = public_key.algo_name(); 283| | 284| 1.64k| const size_t keylength = public_key.key_length(); 285| 1.64k| size_t expected_keylength = 0; 286| | 287| 1.64k| if(algo_name == "RSA") { ------------------ | Branch (287:7): [True: 0, False: 1.64k] ------------------ 288| 0| expected_keylength = minimum_rsa_bits(); 289| 1.64k| } else if(algo_name == "DH") { ------------------ | Branch (289:14): [True: 0, False: 1.64k] ------------------ 290| 0| expected_keylength = minimum_dh_group_size(); 291| 1.64k| } else if(algo_name == "ECDH" || algo_name == "X25519" || algo_name == "X448") { ------------------ | Branch (291:14): [True: 1.63k, False: 5] | Branch (291:37): [True: 3, False: 2] | Branch (291:62): [True: 2, False: 0] ------------------ 292| 1.64k| expected_keylength = minimum_ecdh_group_size(); 293| 1.64k| } else if(algo_name == "ECDSA") { ------------------ | Branch (293:14): [True: 0, False: 0] ------------------ 294| 0| expected_keylength = minimum_ecdsa_group_size(); 295| 0| } 296| | // else some other algo, so leave expected_keylength as zero and the check is a no-op 297| | 298| 1.64k| if(keylength < expected_keylength) { ------------------ | Branch (298:7): [True: 0, False: 1.64k] ------------------ 299| 0| throw TLS_Exception(Alert::InsufficientSecurity, 300| 0| "Peer sent " + std::to_string(keylength) + " bit " + algo_name + 301| 0| " key" 302| 0| ", policy requires at least " + 303| 0| std::to_string(expected_keylength)); 304| 0| } 305| 1.64k|} _ZNK5Botan3TLS6Policy27acceptable_protocol_versionENS0_16Protocol_VersionE: 323| 6.24k|bool Policy::acceptable_protocol_version(Protocol_Version version) const { 324| 6.24k|#if defined(BOTAN_HAS_TLS_13) 325| 6.24k| if(version == Protocol_Version::TLS_V13 && allow_tls13()) { ------------------ | Branch (325:7): [True: 5.57k, False: 672] | Branch (325:7): [True: 5.57k, False: 672] | Branch (325:47): [True: 5.57k, False: 0] ------------------ 326| 5.57k| return true; 327| 5.57k| } 328| 672|#endif 329| | 330| 672|#if defined(BOTAN_HAS_TLS_12) 331| 672| if(version == Protocol_Version::TLS_V12 && allow_tls12()) { ------------------ | Branch (331:7): [True: 0, False: 672] | Branch (331:7): [True: 0, False: 672] | Branch (331:47): [True: 0, False: 0] ------------------ 332| 0| return true; 333| 0| } 334| | 335| 672| if(version == Protocol_Version::DTLS_V12 && allow_dtls12()) { ------------------ | Branch (335:7): [True: 672, False: 0] | Branch (335:7): [True: 672, False: 0] | Branch (335:48): [True: 672, False: 0] ------------------ 336| 672| return true; 337| 672| } 338| 0|#endif 339| | 340| 0| BOTAN_UNUSED(version); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 341| 0| return false; 342| 672|} _ZNK5Botan3TLS6Policy24latest_supported_versionEb: 344| 6.24k|Protocol_Version Policy::latest_supported_version(bool datagram) const { 345| 6.24k| if(datagram) { ------------------ | Branch (345:7): [True: 672, False: 5.57k] ------------------ 346| 672| if(acceptable_protocol_version(Protocol_Version::DTLS_V12)) { ------------------ | Branch (346:10): [True: 672, False: 0] ------------------ 347| 672| return Protocol_Version::DTLS_V12; 348| 672| } 349| 5.57k| } else { 350| 5.57k| if(acceptable_protocol_version(Protocol_Version::TLS_V13)) { ------------------ | Branch (350:10): [True: 5.57k, False: 0] ------------------ 351| 5.57k| return Protocol_Version::TLS_V13; 352| 5.57k| } 353| 0| if(acceptable_protocol_version(Protocol_Version::TLS_V12)) { ------------------ | Branch (353:10): [True: 0, False: 0] ------------------ 354| 0| return Protocol_Version::TLS_V12; 355| 0| } 356| 0| } 357| | 358| 0| throw Invalid_State("Policy forbids all available TLS version"); 359| 6.24k|} _ZNK5Botan3TLS6Policy28allow_insecure_renegotiationEv: 374| 3.15k|bool Policy::allow_insecure_renegotiation() const { 375| 3.15k| return false; 376| 3.15k|} _ZNK5Botan3TLS6Policy11allow_tls12Ev: 378| 14.1k|bool Policy::allow_tls12() const { 379| 14.1k|#if defined(BOTAN_HAS_TLS_12) 380| 14.1k| return true; 381| |#else 382| | return false; 383| |#endif 384| 14.1k|} _ZNK5Botan3TLS6Policy11allow_tls13Ev: 386| 8.34k|bool Policy::allow_tls13() const { 387| 8.34k|#if defined(BOTAN_HAS_TLS_13) 388| 8.34k| return true; 389| |#else 390| | return false; 391| |#endif 392| 8.34k|} _ZNK5Botan3TLS6Policy12allow_dtls12Ev: 394| 713|bool Policy::allow_dtls12() const { 395| 713|#if defined(BOTAN_HAS_TLS_12) 396| 713| return true; 397| |#else 398| | return false; 399| |#endif 400| 713|} _ZNK5Botan3TLS6Policy28include_time_in_hello_randomEv: 402| 5.52k|bool Policy::include_time_in_hello_random() const { 403| 5.52k| return true; 404| 5.52k|} _ZNK5Botan3TLS6Policy18hide_unknown_usersEv: 406| 22|bool Policy::hide_unknown_users() const { 407| 22| return false; 408| 22|} _ZNK5Botan3TLS6Policy39server_uses_own_ciphersuite_preferencesEv: 410| 2.97k|bool Policy::server_uses_own_ciphersuite_preferences() const { 411| 2.97k| return true; 412| 2.97k|} _ZNK5Botan3TLS6Policy26negotiate_encrypt_then_macEv: 414| 76|bool Policy::negotiate_encrypt_then_mac() const { 415| 76| return true; 416| 76|} _ZNK5Botan3TLS6Policy30require_extended_master_secretEv: 418| 3.04k|bool Policy::require_extended_master_secret() const { 419| 3.04k| return true; 420| 3.04k|} _ZNK5Botan3TLS6Policy27support_cert_status_messageEv: 431| 116|bool Policy::support_cert_status_message() const { 432| 116| return true; 433| 116|} _ZNK5Botan3TLS6Policy17hash_hello_randomEv: 443| 5.52k|bool Policy::hash_hello_random() const { 444| 5.52k| return true; 445| 5.52k|} _ZNK5Botan3TLS6Policy41require_client_certificate_authenticationEv: 451| 2.75k|bool Policy::require_client_certificate_authentication() const { 452| 2.75k| return false; 453| 2.75k|} _ZNK5Botan3TLS6Policy41request_client_certificate_authenticationEv: 455| 2.75k|bool Policy::request_client_certificate_authentication() const { 456| 2.75k| return require_client_certificate_authentication(); 457| 2.75k|} _ZNK5Botan3TLS6Policy25allow_dtls_epoch0_restartEv: 471| 672|bool Policy::allow_dtls_epoch0_restart() const { 472| 672| return false; 473| 672|} _ZNK5Botan3TLS6Policy35dtls_server_require_cookie_exchangeEv: 475| 699|bool Policy::dtls_server_require_cookie_exchange() const { 476| | /* 477| | RFC 9147 Section 11 "Security Considerations": 478| | 479| | The primary additional security consideration raised by DTLS is that of 480| | denial of service by excessive resource consumption. DTLS includes a 481| | cookie exchange designed to protect against denial of service. [...] 482| | In particular, DTLS servers that do not use the cookie exchange may be 483| | used as attack amplifiers even if they themselves are not experiencing 484| | DoS. Therefore, DTLS servers SHOULD use the cookie exchange unless there 485| | is good reason to believe that amplification is not a threat in their 486| | environment. 487| | */ 488| 699| return true; 489| 699|} _ZNK5Botan3TLS6Policy30maximum_handshake_message_sizeEv: 491| 23.8k|size_t Policy::maximum_handshake_message_size() const { 492| 23.8k| return 65536; 493| 23.8k|} _ZNK5Botan3TLS6Policy30maximum_certificate_chain_sizeEv: 495| 506|size_t Policy::maximum_certificate_chain_size() const { 496| 506| return 65536; 497| 506|} _ZNK5Botan3TLS6Policy20dtls_initial_timeoutEv: 508| 522|size_t Policy::dtls_initial_timeout() const { 509| 522| return 1 * 1000; 510| 522|} _ZNK5Botan3TLS6Policy20dtls_maximum_timeoutEv: 512| 522|size_t Policy::dtls_maximum_timeout() const { 513| 522| return 60 * 1000; 514| 522|} _ZNK5Botan3TLS6Policy28dtls_maximum_retransmissionsEv: 522| 522|std::optional Policy::dtls_maximum_retransmissions() const { 523| | // Matches BoringSSL's DTLS1_MAX_TIMEOUTS. 524| | // 525| | // With the default schedule of a 1 second initial timeout and 60 526| | // second maximum, this gives up after roughly 8 minutes 527| | // (1+2+4+8+16+32+7*60 s). 528| | 529| 522| return 12; 530| 522|} _ZNK5Botan3TLS6Policy16dtls_default_mtuEv: 532| 522|size_t Policy::dtls_default_mtu() const { 533| | // default MTU is IPv6 min MTU minus UDP/IP headers 534| 522| return 1280 - 40 - 8; 535| 522|} _ZNK5Botan3TLS15TLS_Data_Reader15assert_at_leastEm: 14| 385k|void TLS_Data_Reader::assert_at_least(size_t n) const { 15| 385k| const size_t left = remaining_bytes(); 16| 385k| if(left < n) { ------------------ | Branch (16:7): [True: 267, False: 385k] ------------------ 17| 267| throw_decode_error(fmt("Expected {} bytes remaining, only {} left", n, left)); 18| 267| } 19| 385k|} _ZNK5Botan3TLS15TLS_Data_Reader18throw_decode_errorENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 21| 591|void TLS_Data_Reader::throw_decode_error(std::string_view why) const { 22| 591| throw Decoding_Error(fmt("Invalid {}: {}", m_typename, why)); 23| 591|} _ZN5Botan3TLS6ServerC2ERKNSt3__110shared_ptrINS0_9CallbacksEEERKNS3_INS0_15Session_ManagerEEERKNS3_INS_19Credentials_ManagerEEERKNS3_IKNS0_6PolicyEEERKNS3_INS_21RandomNumberGeneratorEEEbm: 36| 6.24k| size_t io_buf_sz) { 37| 6.24k| const auto max_version = policy->latest_supported_version(is_datagram); 38| | 39| 6.24k|#if defined(BOTAN_HAS_TLS_13) 40| 6.24k| if(!max_version.is_pre_tls_13()) { ------------------ | Branch (40:7): [True: 5.57k, False: 672] ------------------ 41| 5.57k| m_impl = std::make_unique(callbacks, session_manager, creds, policy, rng); 42| | 43| 5.57k| #if defined(BOTAN_HAS_TLS_DOWNGRADE_SUPPORT) 44| 5.57k| if(m_impl->expects_downgrade()) { ------------------ | Branch (44:10): [True: 5.57k, False: 0] ------------------ 45| 5.57k| m_impl->set_io_buffer_size(io_buf_sz); 46| 5.57k| } 47| 5.57k| #endif 48| | 49| 5.57k| return; 50| 5.57k| } 51| 672|#endif 52| | 53| 672|#if defined(BOTAN_HAS_TLS_12) 54| 672| if(max_version.is_pre_tls_13()) { ------------------ | Branch (54:7): [True: 672, False: 0] ------------------ 55| 672| m_impl = std::make_unique(callbacks, session_manager, creds, policy, rng, is_datagram, io_buf_sz); 56| 672| return; 57| 672| } 58| 0|#endif 59| | 60| 0| BOTAN_UNUSED(max_version, callbacks, session_manager, creds, policy, rng, is_datagram, io_buf_sz); ------------------ | | 144| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 61| 0| throw Not_Implemented("Requested TLS server version is not available in this build"); 62| 672|} _ZN5Botan3TLS6ServerD2Ev: 64| 6.24k|Server::~Server() = default; _ZN5Botan3TLS6Server9from_peerENSt3__14spanIKhLm18446744073709551615EEE: 66| 6.24k|size_t Server::from_peer(std::span data) { 67| 6.24k| auto read = m_impl->from_peer(data); 68| | 69| 6.24k|#if defined(BOTAN_HAS_TLS_DOWNGRADE_SUPPORT) 70| | // If TLS 1.2 is not available, we will never downgrade, the downgrade info 71| | // won't even be created and `is_downgrading()` would always return false. 72| 6.24k| if(m_impl->is_downgrading()) { ------------------ | Branch (72:7): [True: 3.13k, False: 3.11k] ------------------ 73| 3.13k| auto info = m_impl->extract_downgrade_info(); 74| 3.13k| m_impl = std::make_unique(*info); 75| | 76| | // replay peer data received so far 77| 3.13k| read = m_impl->from_peer(info->peer_transcript); 78| 3.13k| } 79| 6.24k|#endif 80| | 81| 6.24k| return read; 82| 6.24k|} _ZNK5Botan3TLS14Session_Handle20validate_constraintsEv: 34| 115|void Session_Handle::validate_constraints() const { 35| 115| std::visit(overloaded{ 36| 115| [](const Session_ID& id) { 37| | // RFC 5246 7.4.1.2 38| | // opaque SessionID<0..32>; 39| 115| BOTAN_ARG_CHECK(!id.empty(), "Session ID must not be empty"); 40| 115| BOTAN_ARG_CHECK(id.size() <= 32, "Session ID cannot be longer than 32 bytes"); 41| 115| }, 42| 115| [](const Session_Ticket& ticket) { 43| 115| BOTAN_ARG_CHECK(!ticket.empty(), "Ticket most not be empty"); 44| 115| BOTAN_ARG_CHECK(ticket.size() <= std::numeric_limits::max(), 45| 115| "Ticket cannot be longer than 64kB"); 46| 115| }, 47| 115| [](const Opaque_Session_Handle& handle) { 48| | // RFC 8446 4.6.1 49| | // opaque ticket<1..2^16-1>; 50| 115| BOTAN_ARG_CHECK(!handle.empty(), "Opaque session handle must not be empty"); 51| 115| BOTAN_ARG_CHECK(handle.size() <= std::numeric_limits::max(), 52| 115| "Opaque session handle cannot be longer than 64kB"); 53| 115| }, 54| 115| }, 55| 115| m_handle); 56| 115|} _ZN5Botan3TLS12Session_BaseD2Ev: 94| 192|Session_Base::~Session_Base() = default; _ZN5Botan3TLS12Session_BaseC2ERKS1_: 96| 96|Session_Base::Session_Base(const Session_Base& other) = default; _ZN5Botan3TLS12Session_BaseC2ENSt3__16chrono10time_pointINS3_12system_clockENS3_8durationIxNS2_5ratioILl1ELl1000000EEEEEEENS0_16Protocol_VersionEtNS0_15Connection_SideEtbbRKNS2_6vectorINS_16X509_CertificateENS2_9allocatorISE_EEEENS2_10shared_ptrIKNS_10Public_KeyEEENS0_18Server_InformationE: 112| 96| m_start_time(start_time), 113| 96| m_version(version), 114| 96| m_ciphersuite(ciphersuite), 115| 96| m_connection_side(connection_side), 116| 96| m_srtp_profile(srtp_profile), 117| 96| m_extended_master_secret(extended_master_secret), 118| 96| m_encrypt_then_mac(encrypt_then_mac), 119| 96| m_peer_certs(peer_certs), 120| 96| m_peer_raw_public_key(std::move(peer_raw_public_key)), 121| 96| m_server_info(std::move(server_info)) {} _ZNK5Botan3TLS12Session_Base11ciphersuiteEv: 123| 96|Ciphersuite Session_Base::ciphersuite() const { 124| 96| auto suite = Ciphersuite::by_id(m_ciphersuite); 125| 96| if(!suite.has_value()) { ------------------ | Branch (125:7): [True: 0, False: 96] ------------------ 126| 0| throw Decoding_Error("Failed to find cipher suite for ID " + std::to_string(m_ciphersuite)); 127| 0| } 128| 96| return suite.value(); 129| 96|} _ZN5Botan3TLS15Session_SummaryC2ERKNS0_12Session_BaseEbNSt3__18optionalINS5_12basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEEEE: 134| 96| Session_Base(base), m_external_psk_identity(std::move(psk_identity)), m_was_resumption(was_resumption) { 135| 96| BOTAN_ARG_CHECK(version().is_pre_tls_13(), "Instantiated a TLS 1.2 session summary with an newer TLS version"); ------------------ | | 35| 96| do { \ | | 36| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 96| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 96] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 96| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 96] | | ------------------ ------------------ 136| | 137| 96| const auto cs = ciphersuite(); 138| 96| m_kex_algo = cs.kex_algo(); 139| 96|} _ZN5Botan3TLS7SessionC2ERKNSt3__16vectorIhNS_16secure_allocatorIhEEEENS0_16Protocol_VersionEtNS0_15Connection_SideEbbRKNS3_INS_16X509_CertificateENS2_9allocatorISB_EEEERKNS0_18Server_InformationEtNS2_6chrono10time_pointINSK_12system_clockENSK_8durationIxNS2_5ratioILl1ELl1000000EEEEEEENSN_IxNSO_ILl1ELl1EEEEE: 250| 96| Session_Base(current_timestamp, 251| 96| version, 252| 96| ciphersuite, 253| 96| side, 254| 96| srtp_profile, 255| 96| extended_master_secret, 256| 96| encrypt_then_mac, 257| 96| certs, 258| 96| nullptr, // RFC 7250 (raw public keys) is NYI for TLS 1.2 259| 96| server_info), 260| 96| m_master_secret(master_secret), 261| 96| m_early_data_allowed(false), 262| 96| m_max_early_data_bytes(0), 263| 96| m_ticket_age_add(0), 264| 96| m_lifetime_hint(lifetime_hint) { 265| 96| BOTAN_ARG_CHECK(version.is_pre_tls_13(), "Instantiated a TLS 1.2 session object with a TLS version newer than 1.2"); ------------------ | | 35| 96| do { \ | | 36| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 96| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 96] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 96| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 96] | | ------------------ ------------------ 266| 96|} tls_session.cpp:_ZZNK5Botan3TLS14Session_Handle20validate_constraintsEvENK3$_0clERKNS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS0_11Session_ID_EJEEE: 36| 82| [](const Session_ID& id) { 37| | // RFC 5246 7.4.1.2 38| | // opaque SessionID<0..32>; 39| 82| BOTAN_ARG_CHECK(!id.empty(), "Session ID must not be empty"); ------------------ | | 35| 82| do { \ | | 36| 82| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 82| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 82] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 82| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 82] | | ------------------ ------------------ 40| 82| BOTAN_ARG_CHECK(id.size() <= 32, "Session ID cannot be longer than 32 bytes"); ------------------ | | 35| 82| do { \ | | 36| 82| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 82| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 82] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 82| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 82] | | ------------------ ------------------ 41| 82| }, tls_session.cpp:_ZZNK5Botan3TLS14Session_Handle20validate_constraintsEvENK3$_1clERKNS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS0_15Session_Ticket_EJEEE: 42| 33| [](const Session_Ticket& ticket) { 43| 33| BOTAN_ARG_CHECK(!ticket.empty(), "Ticket most not be empty"); ------------------ | | 35| 33| do { \ | | 36| 33| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 33| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 33] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 33| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 33] | | ------------------ ------------------ 44| 33| BOTAN_ARG_CHECK(ticket.size() <= std::numeric_limits::max(), ------------------ | | 35| 33| do { \ | | 36| 33| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 33| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 33] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 33| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 33] | | ------------------ ------------------ 45| 33| "Ticket cannot be longer than 64kB"); 46| 33| }, _ZN5Botan3TLS15Session_ManagerC2ERKNSt3__110shared_ptrINS_21RandomNumberGeneratorEEE: 24| 6.24k|Session_Manager::Session_Manager(const std::shared_ptr& rng) : m_rng(rng) { 25| 6.24k| BOTAN_ASSERT_NONNULL(m_rng); ------------------ | | 116| 6.24k| do { \ | | 117| 6.24k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 6.24k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 6.24k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 6.24k] | | ------------------ ------------------ 26| 6.24k|} _ZN5Botan3TLS15Session_Manager8retrieveERKNS0_14Session_HandleERNS0_9CallbacksERKNS0_6PolicyE: 45| 37| const Policy& policy) { 46| | // Retrieving a session for a given handle does not require locking on this 47| | // level. Concurrent threads might handle the removal of an expired ticket 48| | // more than once, but removing an already removed ticket is a harmless NOOP. 49| | 50| 37| auto session = retrieve_one(handle); 51| 37| if(!session.has_value()) { ------------------ | Branch (51:7): [True: 37, False: 0] ------------------ 52| 37| return std::nullopt; 53| 37| } 54| | 55| | // A value of '0' means: No policy restrictions. 56| 0| const std::chrono::seconds policy_lifetime = 57| 0| (policy.session_ticket_lifetime().count() > 0) ? policy.session_ticket_lifetime() : std::chrono::seconds::max(); ------------------ | Branch (57:7): [True: 0, False: 0] ------------------ 58| | 59| | // RFC 5077 3.3 -- "Old Session Tickets" 60| | // A server MAY treat a ticket as valid for a shorter or longer period of 61| | // time than what is stated in the ticket_lifetime_hint. 62| | // 63| | // RFC 5246 F.1.4 -- TLS 1.2 64| | // If either party suspects that the session may have been compromised, or 65| | // that certificates may have expired or been revoked, it should force a 66| | // full handshake. An upper limit of 24 hours is suggested for session ID 67| | // lifetimes. 68| | // 69| | // RFC 8446 4.6.1 -- TLS 1.3 70| | // A server MAY treat a ticket as valid for a shorter period of time than 71| | // what is stated in the ticket_lifetime. 72| | // 73| | // Note: This disregards what is stored in the session (e.g. "lifetime_hint") 74| | // and only takes the local policy into account. The lifetime stored in 75| | // the sessions was taken from the same policy anyways and changes by 76| | // the application should have an immediate effect. 77| 0| const auto ticket_age = 78| 0| std::chrono::duration_cast(callbacks.tls_current_timestamp() - session->start_time()); 79| 0| const bool expired = ticket_age > policy_lifetime; 80| | 81| 0| if(expired) { ------------------ | Branch (81:7): [True: 0, False: 0] ------------------ 82| 0| remove(handle); 83| 0| return std::nullopt; 84| 0| } else { 85| 0| return session; 86| 0| } 87| 0|} _ZN5Botan3TLS20Session_Manager_NoopC2Ev: 16| 6.24k|Session_Manager_Noop::Session_Manager_Noop() : Session_Manager(std::make_shared()) {} _ZN5Botan3TLS20Session_Manager_Noop9establishERKNS0_7SessionERKNSt3__18optionalINS_6StrongINS5_6vectorIhNS5_9allocatorIhEEEENS0_11Session_ID_EJEEEEEb: 20| 96| bool /*tls12_no_ticket*/) { 21| 96| return {}; 22| 96|} _ZN5Botan3TLS20Session_Manager_Noop12retrieve_oneERKNS0_14Session_HandleE: 24| 37|std::optional Session_Manager_Noop::retrieve_one(const Session_Handle& /*handle*/) { 25| 37| return {}; 26| 37|} _ZN5Botan3TLS16Signature_Scheme21all_available_schemesEv: 20| 5.73k|const std::vector& Signature_Scheme::all_available_schemes() { 21| | /* 22| | * This is ordered in some approximate order of preference 23| | */ 24| 5.73k| static const std::vector all_schemes = { 25| | 26| | // EdDSA 25519 is currently not supported as a signature scheme for certificates 27| | // certificate authentication. 28| | // See: https://github.com/randombit/botan/pull/2958#discussion_r851294715 29| | // 30| | // #if defined(BOTAN_HAS_ED25519) 31| | // EDDSA_25519, 32| | // #endif 33| | 34| 5.73k| ECDSA_SECP384R1_TLS13_SHA384, 35| 5.73k| ECDSA_SECP521R1_TLS13_SHA512, 36| 5.73k| ECDSA_SECP256R1_TLS13_SHA256, 37| | 38| 5.73k| RSA_PSS_SHA384, 39| 5.73k| RSA_PSS_SHA256, 40| 5.73k| RSA_PSS_SHA512, 41| | 42| 5.73k| ECDSA_BRAINPOOL384R1_TLS13_SHA384, 43| 5.73k| ECDSA_BRAINPOOL256R1_TLS13_SHA256, 44| 5.73k| ECDSA_BRAINPOOL512R1_TLS13_SHA512, 45| | 46| 5.73k| RSA_PKCS1_SHA384, 47| 5.73k| RSA_PKCS1_SHA512, 48| 5.73k| RSA_PKCS1_SHA256, 49| 5.73k| }; 50| | 51| 5.73k| return all_schemes; 52| 5.73k|} _ZN5Botan3TLS16Signature_SchemeC2Ev: 115| 2.81k|Signature_Scheme::Signature_Scheme() : m_code(NONE) {} _ZN5Botan3TLS16Signature_SchemeC2Et: 117| 31.9k|Signature_Scheme::Signature_Scheme(uint16_t wire_code) : Signature_Scheme(Signature_Scheme::Code(wire_code)) {} _ZN5Botan3TLS16Signature_SchemeC2ENS1_4CodeE: 119| 32.0k|Signature_Scheme::Signature_Scheme(Signature_Scheme::Code wire_code) : m_code(wire_code) {} _ZNK5Botan3TLS16Signature_Scheme12is_availableEv: 121| 15.8k|bool Signature_Scheme::is_available() const noexcept { 122| 15.8k| switch(m_code) { 123| 1.56k| case RSA_PSS_SHA384: ------------------ | Branch (123:7): [True: 1.56k, False: 14.3k] ------------------ 124| 5.06k| case RSA_PSS_SHA256: ------------------ | Branch (124:7): [True: 3.49k, False: 12.3k] ------------------ 125| 5.17k| case RSA_PSS_SHA512: ------------------ | Branch (125:7): [True: 117, False: 15.7k] ------------------ 126| 5.26k| case RSA_PKCS1_SHA384: ------------------ | Branch (126:7): [True: 84, False: 15.8k] ------------------ 127| 5.35k| case RSA_PKCS1_SHA512: ------------------ | Branch (127:7): [True: 88, False: 15.8k] ------------------ 128| 5.42k| case RSA_PKCS1_SHA256: ------------------ | Branch (128:7): [True: 74, False: 15.8k] ------------------ 129| 5.44k| case ECDSA_BRAINPOOL384R1_TLS13_SHA384: ------------------ | Branch (129:7): [True: 24, False: 15.8k] ------------------ 130| 5.49k| case ECDSA_BRAINPOOL256R1_TLS13_SHA256: ------------------ | Branch (130:7): [True: 50, False: 15.8k] ------------------ 131| 5.51k| case ECDSA_BRAINPOOL512R1_TLS13_SHA512: ------------------ | Branch (131:7): [True: 17, False: 15.8k] ------------------ 132| 5.54k| case ECDSA_SECP384R1_TLS13_SHA384: ------------------ | Branch (132:7): [True: 30, False: 15.8k] ------------------ 133| 5.61k| case ECDSA_SECP521R1_TLS13_SHA512: ------------------ | Branch (133:7): [True: 73, False: 15.8k] ------------------ 134| 5.67k| case ECDSA_SECP256R1_TLS13_SHA256: ------------------ | Branch (134:7): [True: 60, False: 15.8k] ------------------ 135| 5.67k| return true; 136| 10.2k| default: ------------------ | Branch (136:7): [True: 10.2k, False: 5.67k] ------------------ 137| 10.2k| return false; 138| 15.8k| } 139| 15.8k|} _ZNK5Botan3TLS16Signature_Scheme6is_setEv: 141| 41|bool Signature_Scheme::is_set() const noexcept { 142| 41| return m_code != NONE; 143| 41|} _ZNK5Botan3TLS16Signature_Scheme18hash_function_nameEv: 189| 74.4k|std::string Signature_Scheme::hash_function_name() const { 190| 74.4k| switch(m_code) { 191| 0| case RSA_PKCS1_SHA1: ------------------ | Branch (191:7): [True: 0, False: 74.4k] ------------------ 192| 0| case ECDSA_SHA1: ------------------ | Branch (192:7): [True: 0, False: 74.4k] ------------------ 193| 0| return "SHA-1"; 194| | 195| 5.79k| case ECDSA_SECP256R1_TLS13_SHA256: ------------------ | Branch (195:7): [True: 5.79k, False: 68.6k] ------------------ 196| 11.5k| case RSA_PKCS1_SHA256: ------------------ | Branch (196:7): [True: 5.80k, False: 68.6k] ------------------ 197| 20.8k| case RSA_PSS_SHA256: ------------------ | Branch (197:7): [True: 9.22k, False: 65.2k] ------------------ 198| 26.6k| case ECDSA_BRAINPOOL256R1_TLS13_SHA256: ------------------ | Branch (198:7): [True: 5.78k, False: 68.6k] ------------------ 199| 26.6k| return "SHA-256"; 200| | 201| 5.76k| case ECDSA_SECP384R1_TLS13_SHA384: ------------------ | Branch (201:7): [True: 5.76k, False: 68.6k] ------------------ 202| 11.5k| case RSA_PKCS1_SHA384: ------------------ | Branch (202:7): [True: 5.81k, False: 68.6k] ------------------ 203| 18.8k| case RSA_PSS_SHA384: ------------------ | Branch (203:7): [True: 7.29k, False: 67.1k] ------------------ 204| 24.6k| case ECDSA_BRAINPOOL384R1_TLS13_SHA384: ------------------ | Branch (204:7): [True: 5.75k, False: 68.6k] ------------------ 205| 24.6k| return "SHA-384"; 206| | 207| 5.80k| case ECDSA_SECP521R1_TLS13_SHA512: ------------------ | Branch (207:7): [True: 5.80k, False: 68.6k] ------------------ 208| 11.6k| case RSA_PKCS1_SHA512: ------------------ | Branch (208:7): [True: 5.81k, False: 68.6k] ------------------ 209| 17.4k| case RSA_PSS_SHA512: ------------------ | Branch (209:7): [True: 5.84k, False: 68.6k] ------------------ 210| 23.2k| case ECDSA_BRAINPOOL512R1_TLS13_SHA512: ------------------ | Branch (210:7): [True: 5.74k, False: 68.7k] ------------------ 211| 23.2k| return "SHA-512"; 212| | 213| 0| case EDDSA_25519: ------------------ | Branch (213:7): [True: 0, False: 74.4k] ------------------ 214| 0| case EDDSA_448: ------------------ | Branch (214:7): [True: 0, False: 74.4k] ------------------ 215| 0| return "Pure"; 216| | 217| 0| default: ------------------ | Branch (217:7): [True: 0, False: 74.4k] ------------------ 218| 0| return "Unknown hash function"; 219| 74.4k| } 220| 74.4k|} _ZNK5Botan3TLS16Signature_Scheme14algorithm_nameEv: 261| 74.4k|std::string Signature_Scheme::algorithm_name() const { 262| 74.4k| switch(m_code) { 263| 0| case RSA_PKCS1_SHA1: ------------------ | Branch (263:7): [True: 0, False: 74.4k] ------------------ 264| 5.80k| case RSA_PKCS1_SHA256: ------------------ | Branch (264:7): [True: 5.80k, False: 68.6k] ------------------ 265| 11.6k| case RSA_PKCS1_SHA384: ------------------ | Branch (265:7): [True: 5.81k, False: 68.6k] ------------------ 266| 17.4k| case RSA_PKCS1_SHA512: ------------------ | Branch (266:7): [True: 5.81k, False: 68.6k] ------------------ 267| 26.6k| case RSA_PSS_SHA256: ------------------ | Branch (267:7): [True: 9.22k, False: 65.2k] ------------------ 268| 33.9k| case RSA_PSS_SHA384: ------------------ | Branch (268:7): [True: 7.29k, False: 67.1k] ------------------ 269| 39.8k| case RSA_PSS_SHA512: ------------------ | Branch (269:7): [True: 5.84k, False: 68.6k] ------------------ 270| 39.8k| return "RSA"; 271| | 272| 0| case ECDSA_SHA1: ------------------ | Branch (272:7): [True: 0, False: 74.4k] ------------------ 273| 5.79k| case ECDSA_SECP256R1_TLS13_SHA256: ------------------ | Branch (273:7): [True: 5.79k, False: 68.6k] ------------------ 274| 11.5k| case ECDSA_SECP384R1_TLS13_SHA384: ------------------ | Branch (274:7): [True: 5.76k, False: 68.6k] ------------------ 275| 17.3k| case ECDSA_SECP521R1_TLS13_SHA512: ------------------ | Branch (275:7): [True: 5.80k, False: 68.6k] ------------------ 276| 23.1k| case ECDSA_BRAINPOOL256R1_TLS13_SHA256: ------------------ | Branch (276:7): [True: 5.78k, False: 68.6k] ------------------ 277| 28.8k| case ECDSA_BRAINPOOL384R1_TLS13_SHA384: ------------------ | Branch (277:7): [True: 5.75k, False: 68.6k] ------------------ 278| 34.6k| case ECDSA_BRAINPOOL512R1_TLS13_SHA512: ------------------ | Branch (278:7): [True: 5.74k, False: 68.7k] ------------------ 279| 34.6k| return "ECDSA"; 280| | 281| 0| case EDDSA_25519: ------------------ | Branch (281:7): [True: 0, False: 74.4k] ------------------ 282| 0| return "Ed25519"; 283| | 284| 0| case EDDSA_448: ------------------ | Branch (284:7): [True: 0, False: 74.4k] ------------------ 285| 0| return "Ed448"; 286| | 287| 0| default: ------------------ | Branch (287:7): [True: 0, False: 74.4k] ------------------ 288| 0| return "Unknown algorithm"; 289| 74.4k| } 290| 74.4k|} _ZNK5Botan3TLS16Signature_Scheme20algorithm_identifierEv: 337| 31.8k|AlgorithmIdentifier Signature_Scheme::algorithm_identifier() const { 338| 31.8k| switch(m_code) { 339| 118| case RSA_PKCS1_SHA1: ------------------ | Branch (339:7): [True: 118, False: 31.7k] ------------------ 340| 118| return AlgorithmIdentifier(OID::from_string("RSA/PKCS1v15(SHA-1)"), AlgorithmIdentifier::USE_NULL_PARAM); 341| 146| case RSA_PKCS1_SHA256: ------------------ | Branch (341:7): [True: 146, False: 31.7k] ------------------ 342| 146| return AlgorithmIdentifier(OID::from_string("RSA/PKCS1v15(SHA-256)"), AlgorithmIdentifier::USE_NULL_PARAM); 343| 166| case RSA_PKCS1_SHA384: ------------------ | Branch (343:7): [True: 166, False: 31.6k] ------------------ 344| 166| return AlgorithmIdentifier(OID::from_string("RSA/PKCS1v15(SHA-384)"), AlgorithmIdentifier::USE_NULL_PARAM); 345| 174| case RSA_PKCS1_SHA512: ------------------ | Branch (345:7): [True: 174, False: 31.6k] ------------------ 346| 174| return AlgorithmIdentifier(OID::from_string("RSA/PKCS1v15(SHA-512)"), AlgorithmIdentifier::USE_NULL_PARAM); 347| | 348| 44| case ECDSA_SHA1: ------------------ | Branch (348:7): [True: 44, False: 31.8k] ------------------ 349| 44| return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-1"), AlgorithmIdentifier::USE_EMPTY_PARAM); 350| 118| case ECDSA_SECP256R1_TLS13_SHA256: ------------------ | Branch (350:7): [True: 118, False: 31.7k] ------------------ 351| 218| case ECDSA_BRAINPOOL256R1_TLS13_SHA256: ------------------ | Branch (351:7): [True: 100, False: 31.7k] ------------------ 352| 218| return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-256"), AlgorithmIdentifier::USE_EMPTY_PARAM); 353| 60| case ECDSA_SECP384R1_TLS13_SHA384: ------------------ | Branch (353:7): [True: 60, False: 31.8k] ------------------ 354| 108| case ECDSA_BRAINPOOL384R1_TLS13_SHA384: ------------------ | Branch (354:7): [True: 48, False: 31.8k] ------------------ 355| 108| return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-384"), AlgorithmIdentifier::USE_EMPTY_PARAM); 356| 144| case ECDSA_SECP521R1_TLS13_SHA512: ------------------ | Branch (356:7): [True: 144, False: 31.7k] ------------------ 357| 178| case ECDSA_BRAINPOOL512R1_TLS13_SHA512: ------------------ | Branch (357:7): [True: 34, False: 31.8k] ------------------ 358| 178| return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-512"), AlgorithmIdentifier::USE_EMPTY_PARAM); 359| | 360| 7.00k| case RSA_PSS_SHA256: ------------------ | Branch (360:7): [True: 7.00k, False: 24.8k] ------------------ 361| 7.00k| return AlgorithmIdentifier(OID::from_string("RSA/PSS"), PSS_Params("SHA-256", 32).serialize()); 362| 3.12k| case RSA_PSS_SHA384: ------------------ | Branch (362:7): [True: 3.12k, False: 28.7k] ------------------ 363| 3.12k| return AlgorithmIdentifier(OID::from_string("RSA/PSS"), PSS_Params("SHA-384", 48).serialize()); 364| 232| case RSA_PSS_SHA512: ------------------ | Branch (364:7): [True: 232, False: 31.6k] ------------------ 365| 232| return AlgorithmIdentifier(OID::from_string("RSA/PSS"), PSS_Params("SHA-512", 64).serialize()); 366| | 367| 20.3k| default: ------------------ | Branch (367:7): [True: 20.3k, False: 11.5k] ------------------ 368| | // Note that Ed25519 and Ed448 end up here 369| 20.3k| return AlgorithmIdentifier(); 370| 31.8k| } 371| 31.8k|} _ZNK5Botan3TLS16Signature_Scheme18is_compatible_withERKNS0_16Protocol_VersionE: 400| 9|bool Signature_Scheme::is_compatible_with(const Protocol_Version& protocol_version) const noexcept { 401| | // RFC 8446 4.4.3: 402| | // The SHA-1 algorithm MUST NOT be used in any signatures of 403| | // CertificateVerify messages. 404| | // 405| | // Note that Botan enforces that for TLS 1.2 as well. 406| 9| if(m_code == RSA_PKCS1_SHA1 || m_code == ECDSA_SHA1) { ------------------ | Branch (406:7): [True: 0, False: 9] | Branch (406:35): [True: 0, False: 9] ------------------ 407| 0| return false; 408| 0| } 409| | 410| | // RFC 8446 4.4.3: 411| | // RSA signatures MUST use an RSASSA-PSS algorithm, regardless of whether 412| | // RSASSA-PKCS1-v1_5 algorithms appear in "signature_algorithms". 413| | // 414| | // Note that this is enforced for TLS 1.3 and above only. 415| 9| if(!protocol_version.is_pre_tls_13() && (m_code == RSA_PKCS1_SHA1 || m_code == RSA_PKCS1_SHA256 || ------------------ | Branch (415:7): [True: 9, False: 0] | Branch (415:45): [True: 0, False: 9] | Branch (415:73): [True: 1, False: 8] ------------------ 416| 8| m_code == RSA_PKCS1_SHA384 || m_code == RSA_PKCS1_SHA512)) { ------------------ | Branch (416:45): [True: 1, False: 7] | Branch (416:75): [True: 1, False: 6] ------------------ 417| 3| return false; 418| 3| } 419| | 420| 6| return true; 421| 9|} _ZN5Botan3TLS24to_algorithm_identifiersERKNSt3__16vectorINS0_16Signature_SchemeENS1_9allocatorIS3_EEEE: 451| 5.94k|std::vector to_algorithm_identifiers(const std::vector& schemes) { 452| 5.94k| std::vector result; 453| 5.94k| result.reserve(schemes.size()); 454| 31.8k| for(const auto& scheme : schemes) { ------------------ | Branch (454:27): [True: 31.8k, False: 5.94k] ------------------ 455| 31.8k| result.push_back(scheme.algorithm_identifier()); 456| 31.8k| } 457| 5.94k| return result; 458| 5.94k|} _ZN5Botan3TLS11Ciphersuite15is_known_usableEt: 338| 102|bool Ciphersuite::is_known_usable(uint16_t code) { 339| 102| static constexpr auto codes = available_ciphersuites(); 340| 102| return std::binary_search(codes.begin(), codes.end(), code); 341| 102|} _ZN5Botan3TLS11Ciphersuite22all_known_ciphersuitesEv: 344| 11.5k|const std::vector& Ciphersuite::all_known_ciphersuites() { 345| | // clang-format off 346| | 347| | // Note that this list of ciphersuites is ordered by id! 348| 11.5k| static const std::vector g_ciphersuite_list = { 349| 11.5k| Ciphersuite(0x000A, "RSA_WITH_3DES_EDE_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 350| 11.5k| Ciphersuite(0x0016, "DHE_RSA_WITH_3DES_EDE_CBC_SHA", Auth_Method::RSA, Kex_Algo::DH, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 351| 11.5k| Ciphersuite(0x002C, "PSK_WITH_NULL_SHA", Auth_Method::IMPLICIT, Kex_Algo::PSK, "NULL", 0, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::NULL_CIPHER), 352| 11.5k| Ciphersuite(0x002F, "RSA_WITH_AES_128_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 353| 11.5k| Ciphersuite(0x0033, "DHE_RSA_WITH_AES_128_CBC_SHA", Auth_Method::RSA, Kex_Algo::DH, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 354| 11.5k| Ciphersuite(0x0035, "RSA_WITH_AES_256_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 355| 11.5k| Ciphersuite(0x0039, "DHE_RSA_WITH_AES_256_CBC_SHA", Auth_Method::RSA, Kex_Algo::DH, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 356| 11.5k| Ciphersuite(0x003C, "RSA_WITH_AES_128_CBC_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE), 357| 11.5k| Ciphersuite(0x003D, "RSA_WITH_AES_256_CBC_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256", 32, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE), 358| 11.5k| Ciphersuite(0x0067, "DHE_RSA_WITH_AES_128_CBC_SHA256", Auth_Method::RSA, Kex_Algo::DH, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE), 359| 11.5k| Ciphersuite(0x006B, "DHE_RSA_WITH_AES_256_CBC_SHA256", Auth_Method::RSA, Kex_Algo::DH, "AES-256", 32, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE), 360| 11.5k| Ciphersuite(0x008B, "PSK_WITH_3DES_EDE_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::PSK, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 361| 11.5k| Ciphersuite(0x008C, "PSK_WITH_AES_128_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 362| 11.5k| Ciphersuite(0x008D, "PSK_WITH_AES_256_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 363| 11.5k| Ciphersuite(0x009C, "RSA_WITH_AES_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 364| 11.5k| Ciphersuite(0x009D, "RSA_WITH_AES_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 365| 11.5k| Ciphersuite(0x009E, "DHE_RSA_WITH_AES_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::DH, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 366| 11.5k| Ciphersuite(0x009F, "DHE_RSA_WITH_AES_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::DH, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 367| 11.5k| Ciphersuite(0x00A8, "PSK_WITH_AES_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 368| 11.5k| Ciphersuite(0x00A9, "PSK_WITH_AES_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 369| 11.5k| Ciphersuite(0x00AE, "PSK_WITH_AES_128_CBC_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE), 370| 11.5k| Ciphersuite(0x00AF, "PSK_WITH_AES_256_CBC_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256", 32, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::CBC_MODE), 371| 11.5k| Ciphersuite(0x00B0, "PSK_WITH_NULL_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "NULL", 0, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::NULL_CIPHER), 372| 11.5k| Ciphersuite(0x00B1, "PSK_WITH_NULL_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "NULL", 0, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::NULL_CIPHER), 373| 11.5k| Ciphersuite(0x1301, "AES_128_GCM_SHA256", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 374| 11.5k| Ciphersuite(0x1302, "AES_256_GCM_SHA384", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 375| 11.5k| Ciphersuite(0x1303, "CHACHA20_POLY1305_SHA256", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 376| 11.5k| Ciphersuite(0x1304, "AES_128_CCM_SHA256", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 377| 11.5k| Ciphersuite(0x1305, "AES_128_CCM_8_SHA256", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 378| 11.5k| Ciphersuite(0xC006, "ECDHE_ECDSA_WITH_NULL_SHA", Auth_Method::ECDSA, Kex_Algo::ECDH, "NULL", 0, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::NULL_CIPHER), 379| 11.5k| Ciphersuite(0xC008, "ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", Auth_Method::ECDSA, Kex_Algo::ECDH, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 380| 11.5k| Ciphersuite(0xC009, "ECDHE_ECDSA_WITH_AES_128_CBC_SHA", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 381| 11.5k| Ciphersuite(0xC00A, "ECDHE_ECDSA_WITH_AES_256_CBC_SHA", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 382| 11.5k| Ciphersuite(0xC010, "ECDHE_RSA_WITH_NULL_SHA", Auth_Method::RSA, Kex_Algo::ECDH, "NULL", 0, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::NULL_CIPHER), 383| 11.5k| Ciphersuite(0xC012, "ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", Auth_Method::RSA, Kex_Algo::ECDH, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 384| 11.5k| Ciphersuite(0xC013, "ECDHE_RSA_WITH_AES_128_CBC_SHA", Auth_Method::RSA, Kex_Algo::ECDH, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 385| 11.5k| Ciphersuite(0xC014, "ECDHE_RSA_WITH_AES_256_CBC_SHA", Auth_Method::RSA, Kex_Algo::ECDH, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 386| 11.5k| Ciphersuite(0xC023, "ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE), 387| 11.5k| Ciphersuite(0xC024, "ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256", 32, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::CBC_MODE), 388| 11.5k| Ciphersuite(0xC027, "ECDHE_RSA_WITH_AES_128_CBC_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE), 389| 11.5k| Ciphersuite(0xC028, "ECDHE_RSA_WITH_AES_256_CBC_SHA384", Auth_Method::RSA, Kex_Algo::ECDH, "AES-256", 32, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::CBC_MODE), 390| 11.5k| Ciphersuite(0xC02B, "ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 391| 11.5k| Ciphersuite(0xC02C, "ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 392| 11.5k| Ciphersuite(0xC02F, "ECDHE_RSA_WITH_AES_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 393| 11.5k| Ciphersuite(0xC030, "ECDHE_RSA_WITH_AES_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::ECDH, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 394| 11.5k| Ciphersuite(0xC034, "ECDHE_PSK_WITH_3DES_EDE_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 395| 11.5k| Ciphersuite(0xC035, "ECDHE_PSK_WITH_AES_128_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 396| 11.5k| Ciphersuite(0xC036, "ECDHE_PSK_WITH_AES_256_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE), 397| 11.5k| Ciphersuite(0xC037, "ECDHE_PSK_WITH_AES_128_CBC_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE), 398| 11.5k| Ciphersuite(0xC038, "ECDHE_PSK_WITH_AES_256_CBC_SHA384", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-256", 32, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::CBC_MODE), 399| 11.5k| Ciphersuite(0xC039, "ECDHE_PSK_WITH_NULL_SHA", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "NULL", 0, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::NULL_CIPHER), 400| 11.5k| Ciphersuite(0xC03A, "ECDHE_PSK_WITH_NULL_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "NULL", 0, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::NULL_CIPHER), 401| 11.5k| Ciphersuite(0xC03B, "ECDHE_PSK_WITH_NULL_SHA384", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "NULL", 0, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::NULL_CIPHER), 402| 11.5k| Ciphersuite(0xC050, "RSA_WITH_ARIA_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 403| 11.5k| Ciphersuite(0xC051, "RSA_WITH_ARIA_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 404| 11.5k| Ciphersuite(0xC052, "DHE_RSA_WITH_ARIA_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::DH, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 405| 11.5k| Ciphersuite(0xC053, "DHE_RSA_WITH_ARIA_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::DH, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 406| 11.5k| Ciphersuite(0xC05C, "ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 407| 11.5k| Ciphersuite(0xC05D, "ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", Auth_Method::ECDSA, Kex_Algo::ECDH, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 408| 11.5k| Ciphersuite(0xC060, "ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 409| 11.5k| Ciphersuite(0xC061, "ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::ECDH, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 410| 11.5k| Ciphersuite(0xC06A, "PSK_WITH_ARIA_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 411| 11.5k| Ciphersuite(0xC06B, "PSK_WITH_ARIA_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 412| 11.5k| Ciphersuite(0xC07A, "RSA_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 413| 11.5k| Ciphersuite(0xC07B, "RSA_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 414| 11.5k| Ciphersuite(0xC07C, "DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::DH, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 415| 11.5k| Ciphersuite(0xC07D, "DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::DH, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 416| 11.5k| Ciphersuite(0xC086, "ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 417| 11.5k| Ciphersuite(0xC087, "ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::ECDSA, Kex_Algo::ECDH, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 418| 11.5k| Ciphersuite(0xC08A, "ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 419| 11.5k| Ciphersuite(0xC08B, "ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::ECDH, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 420| 11.5k| Ciphersuite(0xC08E, "PSK_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 421| 11.5k| Ciphersuite(0xC08F, "PSK_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 422| 11.5k| Ciphersuite(0xC09C, "RSA_WITH_AES_128_CCM", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 423| 11.5k| Ciphersuite(0xC09D, "RSA_WITH_AES_256_CCM", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256/CCM", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 424| 11.5k| Ciphersuite(0xC09E, "DHE_RSA_WITH_AES_128_CCM", Auth_Method::RSA, Kex_Algo::DH, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 425| 11.5k| Ciphersuite(0xC09F, "DHE_RSA_WITH_AES_256_CCM", Auth_Method::RSA, Kex_Algo::DH, "AES-256/CCM", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 426| 11.5k| Ciphersuite(0xC0A0, "RSA_WITH_AES_128_CCM_8", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 427| 11.5k| Ciphersuite(0xC0A1, "RSA_WITH_AES_256_CCM_8", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256/CCM(8)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 428| 11.5k| Ciphersuite(0xC0A2, "DHE_RSA_WITH_AES_128_CCM_8", Auth_Method::RSA, Kex_Algo::DH, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 429| 11.5k| Ciphersuite(0xC0A3, "DHE_RSA_WITH_AES_256_CCM_8", Auth_Method::RSA, Kex_Algo::DH, "AES-256/CCM(8)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 430| 11.5k| Ciphersuite(0xC0A4, "PSK_WITH_AES_128_CCM", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 431| 11.5k| Ciphersuite(0xC0A5, "PSK_WITH_AES_256_CCM", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256/CCM", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 432| 11.5k| Ciphersuite(0xC0A8, "PSK_WITH_AES_128_CCM_8", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 433| 11.5k| Ciphersuite(0xC0A9, "PSK_WITH_AES_256_CCM_8", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256/CCM(8)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 434| 11.5k| Ciphersuite(0xC0AC, "ECDHE_ECDSA_WITH_AES_128_CCM", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 435| 11.5k| Ciphersuite(0xC0AD, "ECDHE_ECDSA_WITH_AES_256_CCM", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256/CCM", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 436| 11.5k| Ciphersuite(0xC0AE, "ECDHE_ECDSA_WITH_AES_128_CCM_8", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 437| 11.5k| Ciphersuite(0xC0AF, "ECDHE_ECDSA_WITH_AES_256_CCM_8", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256/CCM(8)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 438| 11.5k| Ciphersuite(0xCCA8, "ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 439| 11.5k| Ciphersuite(0xCCA9, "ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 440| 11.5k| Ciphersuite(0xCCAA, "DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::RSA, Kex_Algo::DH, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 441| 11.5k| Ciphersuite(0xCCAB, "PSK_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 442| 11.5k| Ciphersuite(0xCCAC, "ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 443| 11.5k| Ciphersuite(0xD001, "ECDHE_PSK_WITH_AES_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 444| 11.5k| Ciphersuite(0xD002, "ECDHE_PSK_WITH_AES_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4), 445| 11.5k| Ciphersuite(0xD003, "ECDHE_PSK_WITH_AES_128_CCM_8_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 446| 11.5k| Ciphersuite(0xD005, "ECDHE_PSK_WITH_AES_128_CCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4), 447| 11.5k| Ciphersuite(0xFFC3, "ECDHE_RSA_WITH_AES_256_OCB_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "AES-256/OCB(12)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 448| 11.5k| Ciphersuite(0xFFC5, "ECDHE_ECDSA_WITH_AES_256_OCB_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256/OCB(12)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 449| 11.5k| Ciphersuite(0xFFC7, "PSK_WITH_AES_256_OCB_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256/OCB(12)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 450| 11.5k| Ciphersuite(0xFFCB, "ECDHE_PSK_WITH_AES_256_OCB_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-256/OCB(12)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12), 451| 11.5k| }; 452| | 453| | // clang-format on 454| | 455| 11.5k| return g_ciphersuite_list; 456| 11.5k|} _ZNK5Botan3TLS16Protocol_Version9to_stringEv: 34| 62|std::string Protocol_Version::to_string() const { 35| 62| const uint8_t maj = major_version(); 36| 62| const uint8_t min = minor_version(); 37| | 38| 62| if(maj == 3 && min == 0) { ------------------ | Branch (38:7): [True: 12, False: 50] | Branch (38:19): [True: 1, False: 11] ------------------ 39| 1| return "SSL v3"; 40| 1| } 41| | 42| 61| if(maj == 3 && min >= 1) { // TLS v1.x ------------------ | Branch (42:7): [True: 11, False: 50] | Branch (42:19): [True: 11, False: 0] ------------------ 43| 11| return "TLS v1." + std::to_string(min - 1); 44| 11| } 45| | 46| 50| if(maj == 254) { // DTLS 1.x ------------------ | Branch (46:7): [True: 7, False: 43] ------------------ 47| 7| return "DTLS v1." + std::to_string(255 - min); 48| 7| } 49| | 50| | // Some very new or very old protocol (or bogus data) 51| 43| return "Unknown " + std::to_string(maj) + "." + std::to_string(min); 52| 50|} _ZNK5Botan3TLS16Protocol_Version20is_datagram_protocolEv: 54| 382k|bool Protocol_Version::is_datagram_protocol() const { 55| 382k| return major_version() > 250; 56| 382k|} _ZNK5Botan3TLS16Protocol_Version13is_pre_tls_13Ev: 58| 295k|bool Protocol_Version::is_pre_tls_13() const { 59| 295k| return (!is_datagram_protocol() && *this <= Protocol_Version::TLS_V12) || ------------------ | Branch (59:12): [True: 293k, False: 1.42k] | Branch (59:39): [True: 288k, False: 5.68k] ------------------ 60| 7.10k| (is_datagram_protocol() && *this <= Protocol_Version::DTLS_V12); ------------------ | Branch (60:12): [True: 1.42k, False: 5.68k] | Branch (60:38): [True: 1.40k, False: 11] ------------------ 61| 295k|} _ZNK5Botan3TLS16Protocol_Version18is_tls_13_or_laterEv: 63| 34|bool Protocol_Version::is_tls_13_or_later() const { 64| 34| return (!is_datagram_protocol() && *this >= Protocol_Version::TLS_V13) || ------------------ | Branch (64:12): [True: 25, False: 9] | Branch (64:39): [True: 14, False: 11] ------------------ 65| 20| (is_datagram_protocol() && *this >= Protocol_Version::DTLS_V13); ------------------ | Branch (65:12): [True: 9, False: 11] | Branch (65:38): [True: 5, False: 4] ------------------ 66| 34|} _ZNK5Botan3TLS16Protocol_VersiongtERKS1_: 68| 8.86k|bool Protocol_Version::operator>(const Protocol_Version& other) const { 69| 8.86k| if(this->is_datagram_protocol() != other.is_datagram_protocol()) { ------------------ | Branch (69:7): [True: 0, False: 8.86k] ------------------ 70| 0| throw TLS_Exception(Alert::ProtocolVersion, "Version comparing " + to_string() + " with " + other.to_string()); 71| 0| } 72| | 73| 8.86k| if(this->is_datagram_protocol()) { ------------------ | Branch (73:7): [True: 68, False: 8.79k] ------------------ 74| 68| return m_version < other.m_version; // goes backwards 75| 68| } 76| | 77| 8.79k| return m_version > other.m_version; 78| 8.86k|} _ZNK5Botan3TLS16Protocol_Version5validEv: 80| 3.12k|bool Protocol_Version::valid() const { 81| 3.12k| const uint8_t maj = major_version(); 82| 3.12k| const uint8_t min = minor_version(); 83| | 84| 3.12k| if(maj == 3 && min <= 4) { ------------------ | Branch (84:7): [True: 0, False: 3.12k] | Branch (84:19): [True: 0, False: 0] ------------------ 85| | // 3.0: SSLv3 86| | // 3.1: TLS 1.0 87| | // 3.2: TLS 1.1 88| | // 3.3: TLS 1.2 89| | // 3.4: TLS 1.3 90| 0| return true; 91| 0| } 92| | 93| 3.12k| if(maj == 254 && (min == 253 || min == 255)) { ------------------ | Branch (93:7): [True: 0, False: 3.12k] | Branch (93:22): [True: 0, False: 0] | Branch (93:36): [True: 0, False: 0] ------------------ 94| | // 254.253: DTLS 1.2 95| | // 254.255: DTLS 1.0 96| 0| return true; 97| 0| } 98| | 99| 3.12k| return false; 100| 3.12k|} _ZN5Botan15allocate_memoryEmm: 21| 595k|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) { 22| 595k| if(elems == 0 || elem_size == 0) { ------------------ | Branch (22:7): [True: 0, False: 595k] | Branch (22:21): [True: 0, False: 595k] ------------------ 23| 0| return nullptr; 24| 0| } 25| | 26| | // Some calloc implementations do not check for overflow (?!?) 27| 595k| if(!checked_mul(elems, elem_size).has_value()) { ------------------ | Branch (27:7): [True: 0, False: 595k] ------------------ 28| 0| throw std::bad_alloc(); 29| 0| } 30| | 31| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 32| | // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy 33| | if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) { 34| | return p; 35| | } 36| |#endif 37| | 38| |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL) 39| | void* ptr = ::calloc_conceal(elems, elem_size); 40| |#else 41| | // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy 42| 595k| void* ptr = std::calloc(elems, elem_size); // NOLINT(*-no-malloc,*-owning-memory) 43| 595k|#endif 44| 595k| if(ptr == nullptr) { ------------------ | Branch (44:7): [True: 0, False: 595k] ------------------ 45| 0| [[unlikely]] throw std::bad_alloc(); 46| 0| } 47| 595k| return ptr; 48| 595k|} _ZN5Botan17deallocate_memoryEPvmm: 50| 595k|void deallocate_memory(void* p, size_t elems, size_t elem_size) { 51| 595k| if(p == nullptr) { ------------------ | Branch (51:7): [True: 0, False: 595k] ------------------ 52| 0| [[unlikely]] return; 53| 0| } 54| | 55| 595k| secure_scrub_memory(p, elems * elem_size); 56| | 57| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 58| | if(mlock_allocator::instance().deallocate(p, elems, elem_size)) { 59| | return; 60| | } 61| |#endif 62| | 63| 595k| std::free(p); // NOLINT(*-no-malloc,*-owning-memory) 64| 595k|} _ZN5Botan20initialize_allocatorEv: 66| 1|void initialize_allocator() { 67| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 68| | mlock_allocator::instance(); 69| |#endif 70| 1|} _ZN5Botan22throw_invalid_argumentEPKcS1_S1_: 23| 1|void throw_invalid_argument(const char* message, const char* func, const char* file) { 24| 1| throw Invalid_Argument(fmt("{} in {}:{}", message, func, file)); 25| 1|} _ZN5Botan19next_utf8_codepointENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEERm: 53| 213k|uint32_t next_utf8_codepoint(std::string_view utf8, size_t& pos) { 54| 213k| auto read_continuation = [&]() -> uint32_t { 55| 213k| if(pos >= utf8.size()) { 56| 213k| throw Decoding_Error("Invalid UTF-8 sequence"); 57| 213k| } 58| 213k| const uint8_t b = static_cast(utf8[pos++]); 59| 213k| if((b & 0xC0) != 0x80) { 60| 213k| throw Decoding_Error("Invalid UTF-8 sequence"); 61| 213k| } 62| 213k| return b & 0x3F; 63| 213k| }; 64| | 65| 213k| if(pos >= utf8.size()) { ------------------ | Branch (65:7): [True: 0, False: 213k] ------------------ 66| 0| throw Decoding_Error("Invalid UTF-8 sequence"); 67| 0| } 68| 213k| const uint8_t lead = static_cast(utf8[pos++]); 69| 213k| uint32_t c = 0; 70| | 71| 213k| if(lead <= 0x7F) { ------------------ | Branch (71:7): [True: 213k, False: 143] ------------------ 72| 213k| c = lead; 73| 213k| } else if((lead & 0xE0) == 0xC0) { ------------------ | Branch (73:14): [True: 18, False: 125] ------------------ 74| 18| c = (lead & 0x1F) << 6; 75| 18| c |= read_continuation(); 76| 18| if(c < 0x80) { ------------------ | Branch (76:10): [True: 2, False: 16] ------------------ 77| 2| throw Decoding_Error("Overlong UTF-8 sequence"); 78| 2| } 79| 125| } else if((lead & 0xF0) == 0xE0) { ------------------ | Branch (79:14): [True: 53, False: 72] ------------------ 80| 53| c = (lead & 0x0F) << 12; 81| 53| c |= read_continuation() << 6; 82| 53| c |= read_continuation(); 83| 53| if(c < 0x800) { ------------------ | Branch (83:10): [True: 3, False: 50] ------------------ 84| 3| throw Decoding_Error("Overlong UTF-8 sequence"); 85| 3| } 86| 72| } else if((lead & 0xF8) == 0xF0) { ------------------ | Branch (86:14): [True: 63, False: 9] ------------------ 87| 63| c = (lead & 0x07) << 18; 88| 63| c |= read_continuation() << 12; 89| 63| c |= read_continuation() << 6; 90| 63| c |= read_continuation(); 91| 63| if(c < 0x10000) { ------------------ | Branch (91:10): [True: 3, False: 60] ------------------ 92| 3| throw Decoding_Error("Overlong UTF-8 sequence"); 93| 3| } 94| 63| } else { 95| 9| throw Decoding_Error("Invalid UTF-8 sequence"); 96| 9| } 97| | 98| 213k| if(c > 0x10FFFF) { ------------------ | Branch (98:7): [True: 2, False: 213k] ------------------ 99| 2| throw Decoding_Error("UTF-8 sequence encodes value outside Unicode range"); 100| 2| } 101| 213k| if(c >= 0xD800 && c < 0xE000) { ------------------ | Branch (101:7): [True: 58, False: 213k] | Branch (101:22): [True: 1, False: 57] ------------------ 102| 1| throw Decoding_Error("UTF-8 sequence encodes surrogate code point"); 103| 1| } 104| | 105| 213k| return c; 106| 213k|} _ZN5Botan13is_valid_utf8ENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE: 108| 12.7k|bool is_valid_utf8(std::string_view utf8) { 109| 12.7k| try { 110| 12.7k| size_t pos = 0; 111| 226k| while(pos < utf8.size()) { ------------------ | Branch (111:13): [True: 213k, False: 12.7k] ------------------ 112| 213k| const uint32_t c = next_utf8_codepoint(utf8, pos); 113| 213k| BOTAN_UNUSED(c); ------------------ | | 144| 213k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 114| 213k| } 115| 12.7k| } catch(Decoding_Error&) { 116| 26| return false; 117| 26| } 118| 12.7k| return true; 119| 12.7k|} _ZN5Botan12ucs2_to_utf8ENSt3__14spanIKhLm18446744073709551615EEE: 121| 35|std::string ucs2_to_utf8(std::span ucs2) { 122| 35| if(ucs2.size() % 2 != 0) { ------------------ | Branch (122:7): [True: 1, False: 34] ------------------ 123| 1| throw Decoding_Error("Invalid length for UCS-2 string"); 124| 1| } 125| | 126| 34| const size_t chars = ucs2.size() / 2; 127| | 128| 34| std::string s; 129| 219| for(size_t i = 0; i != chars; ++i) { ------------------ | Branch (129:22): [True: 185, False: 34] ------------------ 130| 185| const uint32_t c = load_be(ucs2.data(), i); 131| 185| append_utf8_for(s, c); 132| 185| } 133| | 134| 34| return s; 135| 35|} _ZN5Botan12ucs4_to_utf8ENSt3__14spanIKhLm18446744073709551615EEE: 155| 61|std::string ucs4_to_utf8(std::span ucs4) { 156| 61| if(ucs4.size() % 4 != 0) { ------------------ | Branch (156:7): [True: 1, False: 60] ------------------ 157| 1| throw Decoding_Error("Invalid length for UCS-4 string"); 158| 1| } 159| | 160| 60| const size_t chars = ucs4.size() / 4; 161| | 162| 60| std::string s; 163| 200| for(size_t i = 0; i != chars; ++i) { ------------------ | Branch (163:22): [True: 140, False: 60] ------------------ 164| 140| const uint32_t c = load_be(ucs4.data(), i); 165| 140| append_utf8_for(s, c); 166| 140| } 167| | 168| 60| return s; 169| 61|} _ZN5Botan14latin1_to_utf8ENSt3__14spanIKhLm18446744073709551615EEE: 190| 90|std::string latin1_to_utf8(std::span chars) { 191| 90| std::string s; 192| 883| for(const uint8_t b : chars) { ------------------ | Branch (192:24): [True: 883, False: 90] ------------------ 193| 883| append_utf8_for(s, static_cast(b)); 194| 883| } 195| 90| return s; 196| 90|} charset.cpp:_ZZN5Botan19next_utf8_codepointENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEERmENK3$_0clEv: 54| 310| auto read_continuation = [&]() -> uint32_t { 55| 310| if(pos >= utf8.size()) { ------------------ | Branch (55:10): [True: 3, False: 307] ------------------ 56| 3| throw Decoding_Error("Invalid UTF-8 sequence"); 57| 3| } 58| 307| const uint8_t b = static_cast(utf8[pos++]); 59| 307| if((b & 0xC0) != 0x80) { ------------------ | Branch (59:10): [True: 3, False: 304] ------------------ 60| 3| throw Decoding_Error("Invalid UTF-8 sequence"); 61| 3| } 62| 304| return b & 0x3F; 63| 307| }; charset.cpp:_ZN5Botan12_GLOBAL__N_115append_utf8_forERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEj: 17| 1.20k|void append_utf8_for(std::string& s, uint32_t c) { 18| 1.20k| if(c >= 0xD800 && c < 0xE000) { ------------------ | Branch (18:7): [True: 167, False: 1.04k] | Branch (18:22): [True: 7, False: 160] ------------------ 19| 7| throw Decoding_Error("Invalid Unicode character"); 20| 7| } 21| | 22| 1.20k| if(c <= 0x7F) { ------------------ | Branch (22:7): [True: 704, False: 497] ------------------ 23| 704| const uint8_t b0 = static_cast(c); 24| 704| s.push_back(static_cast(b0)); 25| 704| } else if(c <= 0x7FF) { ------------------ | Branch (25:14): [True: 267, False: 230] ------------------ 26| 267| const uint8_t b0 = 0xC0 | static_cast(c >> 6); 27| 267| const uint8_t b1 = 0x80 | static_cast(c & 0x3F); 28| 267| s.push_back(static_cast(b0)); 29| 267| s.push_back(static_cast(b1)); 30| 267| } else if(c <= 0xFFFF) { ------------------ | Branch (30:14): [True: 127, False: 103] ------------------ 31| 127| const uint8_t b0 = 0xE0 | static_cast(c >> 12); 32| 127| const uint8_t b1 = 0x80 | static_cast((c >> 6) & 0x3F); 33| 127| const uint8_t b2 = 0x80 | static_cast(c & 0x3F); 34| 127| s.push_back(static_cast(b0)); 35| 127| s.push_back(static_cast(b1)); 36| 127| s.push_back(static_cast(b2)); 37| 127| } else if(c <= 0x10FFFF) { ------------------ | Branch (37:14): [True: 66, False: 37] ------------------ 38| 66| const uint8_t b0 = 0xF0 | static_cast(c >> 18); 39| 66| const uint8_t b1 = 0x80 | static_cast((c >> 12) & 0x3F); 40| 66| const uint8_t b2 = 0x80 | static_cast((c >> 6) & 0x3F); 41| 66| const uint8_t b3 = 0x80 | static_cast(c & 0x3F); 42| 66| s.push_back(static_cast(b0)); 43| 66| s.push_back(static_cast(b1)); 44| 66| s.push_back(static_cast(b2)); 45| 66| s.push_back(static_cast(b3)); 46| 66| } else { 47| 37| throw Decoding_Error("Invalid Unicode character"); 48| 37| } 49| 1.20k|} _ZN5Botan5CPUID10CPUID_DataC2Ev: 80| 1|CPUID::CPUID_Data::CPUID_Data() { 81| | // NOLINTBEGIN(*-prefer-member-initializer) 82| 1|#if defined(BOTAN_HAS_CPUID_DETECTION) 83| 1| m_processor_features = detect_cpu_features(~cleared_cpuid_bits()); 84| |#else 85| | m_processor_features = 0; 86| |#endif 87| | // NOLINTEND(*-prefer-member-initializer) 88| 1|} cpuid.cpp:_ZN5Botan12_GLOBAL__N_118cleared_cpuid_bitsEv: 59| 1|uint32_t cleared_cpuid_bits() { 60| 1| uint32_t cleared = 0; 61| | 62| 1| #if defined(BOTAN_HAS_OS_UTILS) 63| 1| std::string clear_cpuid_env; 64| 1| if(OS::read_env_variable(clear_cpuid_env, "BOTAN_CLEAR_CPUID")) { ------------------ | Branch (64:7): [True: 0, False: 1] ------------------ 65| 0| for(const auto& cpuid : split_on(clear_cpuid_env, ',')) { ------------------ | Branch (65:29): [True: 0, False: 0] ------------------ 66| 0| if(auto bit = CPUID::bit_from_string(cpuid)) { ------------------ | Branch (66:18): [True: 0, False: 0] ------------------ 67| 0| cleared |= bit->as_u32(); 68| 0| } 69| 0| } 70| 0| } 71| 1| #endif 72| | 73| 1| return cleared; 74| 1|} _ZN5Botan5CPUID10CPUID_Data19detect_cpu_featuresEj: 62| 1|uint32_t CPUID::CPUID_Data::detect_cpu_features(uint32_t allowed) { 63| 1| enum class x86_CPUID_1_bits : uint64_t { 64| 1| RDTSC = (1ULL << 4), 65| 1| SSE2 = (1ULL << 26), 66| 1| CLMUL = (1ULL << 33), 67| 1| SSSE3 = (1ULL << 41), 68| 1| SSE41 = (1ULL << 51), 69| 1| AESNI = (1ULL << 57), 70| | // AVX + OSXSAVE 71| 1| OSXSAVE = (1ULL << 59) | (1ULL << 60), 72| 1| RDRAND = (1ULL << 62) 73| 1| }; 74| | 75| 1| enum class x86_CPUID_7_bits : uint64_t { 76| 1| BMI1 = (1ULL << 3), 77| 1| AVX2 = (1ULL << 5), 78| 1| BMI2 = (1ULL << 8), 79| 1| BMI_1_AND_2 = BMI1 | BMI2, 80| 1| AVX512_F = (1ULL << 16), 81| 1| AVX512_DQ = (1ULL << 17), 82| 1| RDSEED = (1ULL << 18), 83| 1| ADX = (1ULL << 19), 84| 1| AVX512_IFMA = (1ULL << 21), 85| 1| SHA = (1ULL << 29), 86| 1| AVX512_BW = (1ULL << 30), 87| 1| AVX512_VL = (1ULL << 31), 88| 1| AVX512_VBMI = (1ULL << 33), 89| 1| AVX512_VBMI2 = (1ULL << 38), 90| 1| GFNI = (1ULL << 40), 91| 1| AVX512_VAES = (1ULL << 41), 92| 1| AVX512_VCLMUL = (1ULL << 42), 93| 1| AVX512_VBITALG = (1ULL << 44), 94| | 95| | /* 96| | We only enable AVX512 support if all of the below flags are available 97| | 98| | This is more than we strictly need for most uses, however it also has 99| | the effect of preventing execution of AVX512 codepaths on cores that 100| | have serious downclocking problems when AVX512 code executes, 101| | especially Intel Skylake. 102| | 103| | VBMI2/VBITALG are the key flags here as they restrict us to Intel Ice 104| | Lake/Rocket Lake, or AMD Zen4, all of which do not have penalties for 105| | executing AVX512. 106| | 107| | There is nothing stopping some future processor from supporting the 108| | above flags and having AVX512 penalties, but maybe you should not have 109| | bought such a processor. 110| | */ 111| 1| AVX512_PROFILE = 112| 1| AVX512_F | AVX512_DQ | AVX512_IFMA | AVX512_BW | AVX512_VL | AVX512_VBMI | AVX512_VBMI2 | AVX512_VBITALG, 113| 1| }; 114| | 115| | // NOLINTNEXTLINE(performance-enum-size) 116| 1| enum class x86_CPUID_7_1_bits : uint64_t { 117| 1| SHA512 = (1 << 0), 118| 1| SM3 = (1 << 1), 119| 1| SM4 = (1 << 2), 120| 1| }; 121| | 122| 1| uint32_t feat = 0; 123| 1| uint32_t cpuid[4] = {0}; 124| 1| bool has_os_ymm_support = false; 125| 1| bool has_os_zmm_support = false; 126| | 127| | // CPUID 0: vendor identification, max sublevel 128| 1| invoke_cpuid(0, cpuid); 129| | 130| 1| const uint32_t max_supported_sublevel = cpuid[0]; 131| | 132| 1| if(max_supported_sublevel >= 1) { ------------------ | Branch (132:7): [True: 1, False: 0] ------------------ 133| | // CPUID 1: feature bits 134| 1| invoke_cpuid(1, cpuid); 135| 1| const uint64_t flags0 = (static_cast(cpuid[2]) << 32) | cpuid[3]; 136| | 137| 1| feat |= if_set(flags0, x86_CPUID_1_bits::RDTSC, CPUFeature::Bit::RDTSC, allowed); 138| | 139| 1| feat |= if_set(flags0, x86_CPUID_1_bits::RDRAND, CPUFeature::Bit::RDRAND, allowed); 140| | 141| 1| feat |= if_set(flags0, x86_CPUID_1_bits::SSE2, CPUFeature::Bit::SSE2, allowed); 142| | 143| 1| if(is_set(feat, CPUFeature::Bit::SSE2)) { ------------------ | Branch (143:10): [True: 1, False: 0] ------------------ 144| 1| feat |= if_set(flags0, x86_CPUID_1_bits::SSSE3, CPUFeature::Bit::SSSE3, allowed); 145| | 146| 1| if(is_set(feat, CPUFeature::Bit::SSSE3)) { ------------------ | Branch (146:13): [True: 1, False: 0] ------------------ 147| 1| feat |= if_set(flags0, x86_CPUID_1_bits::CLMUL, CPUFeature::Bit::CLMUL, allowed); 148| 1| feat |= if_set(flags0, x86_CPUID_1_bits::AESNI, CPUFeature::Bit::AESNI, allowed); 149| 1| } 150| | 151| 1| const uint64_t osxsave64 = static_cast(x86_CPUID_1_bits::OSXSAVE); 152| 1| if((flags0 & osxsave64) == osxsave64) { ------------------ | Branch (152:13): [True: 1, False: 0] ------------------ 153| 1| const uint64_t xcr_flags = xgetbv(); 154| 1| if((xcr_flags & 0x6) == 0x6) { ------------------ | Branch (154:16): [True: 1, False: 0] ------------------ 155| 1| has_os_ymm_support = true; 156| 1| has_os_zmm_support = (xcr_flags & 0xE0) == 0xE0; 157| 1| } 158| 1| } 159| 1| } 160| 1| } 161| | 162| 1| if(max_supported_sublevel >= 7) { ------------------ | Branch (162:7): [True: 1, False: 0] ------------------ 163| 1| clear_mem(cpuid, 4); 164| 1| invoke_cpuid_sublevel(7, 0, cpuid); 165| | 166| 1| const uint64_t flags7 = (static_cast(cpuid[2]) << 32) | cpuid[1]; 167| | 168| 1| clear_mem(cpuid, 4); 169| 1| invoke_cpuid_sublevel(7, 1, cpuid); 170| 1| const uint32_t flags7_1 = cpuid[0]; 171| | 172| 1| feat |= if_set(flags7, x86_CPUID_7_bits::RDSEED, CPUFeature::Bit::RDSEED, allowed); 173| 1| feat |= if_set(flags7, x86_CPUID_7_bits::ADX, CPUFeature::Bit::ADX, allowed); 174| | 175| | /* 176| | We only set the BMI bit if both BMI1 and BMI2 are supported, since 177| | typically we want to use both extensions in the same code. 178| | */ 179| 1| feat |= if_set(flags7, x86_CPUID_7_bits::BMI_1_AND_2, CPUFeature::Bit::BMI, allowed); 180| | 181| 1| if(is_set(feat, CPUFeature::Bit::SSSE3)) { ------------------ | Branch (181:10): [True: 1, False: 0] ------------------ 182| 1| feat |= if_set(flags7, x86_CPUID_7_bits::SHA, CPUFeature::Bit::SHA, allowed); 183| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM3, CPUFeature::Bit::SM3, allowed); 184| | 185| | // We only consider AVX2 if SSSE3 is supported 186| 1| if(has_os_ymm_support) { ------------------ | Branch (186:13): [True: 1, False: 0] ------------------ 187| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX2, CPUFeature::Bit::AVX2, allowed); 188| | 189| 1| if(is_set(feat, CPUFeature::Bit::AVX2)) { ------------------ | Branch (189:16): [True: 1, False: 0] ------------------ 190| 1| feat |= if_set(flags7, x86_CPUID_7_bits::GFNI, CPUFeature::Bit::GFNI, allowed); 191| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX2_AES, allowed); 192| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX2_CLMUL, allowed); 193| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SHA512, CPUFeature::Bit::SHA512, allowed); 194| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM4, CPUFeature::Bit::SM4, allowed); 195| | 196| | // Likewise we only consider AVX-512 if AVX2 is supported 197| 1| if(has_os_zmm_support) { ------------------ | Branch (197:19): [True: 0, False: 1] ------------------ 198| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_PROFILE, CPUFeature::Bit::AVX512, allowed); 199| | 200| 0| if(is_set(feat, CPUFeature::Bit::AVX512)) { ------------------ | Branch (200:22): [True: 0, False: 0] ------------------ 201| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX512_AES, allowed); 202| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX512_CLMUL, allowed); 203| 0| } 204| 0| } 205| 1| } 206| 1| } 207| 1| } 208| 1| } 209| | 210| |/* 211| | * If we don't have access to CPUID, we can still safely assume that 212| | * any x86-64 processor has SSE2 and RDTSC 213| | */ 214| 1|#if defined(BOTAN_TARGET_ARCH_IS_X86_64) 215| 1| if(feat == 0) { ------------------ | Branch (215:7): [True: 0, False: 1] ------------------ 216| 0| feat |= CPUFeature::Bit::SSE2 & allowed; 217| 0| feat |= CPUFeature::Bit::RDTSC & allowed; 218| 0| } 219| 1|#endif 220| | 221| 1| return feat; 222| 1|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_112invoke_cpuidEjPj: 24| 2|void invoke_cpuid(uint32_t type, uint32_t out[4]) { 25| 2| clear_mem(out, 4); 26| | 27| 2|#if defined(BOTAN_USE_GCC_INLINE_ASM) 28| | // NOLINTNEXTLINE(*-no-assembler) 29| 2| asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type)); 30| | 31| |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC) 32| | __cpuid((int*)out, type); 33| | 34| |#else 35| | BOTAN_UNUSED(type); 36| | #warning "No way of calling x86 cpuid instruction for this compiler" 37| |#endif 38| 2|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_16xgetbvEv: 56| 1|BOTAN_FUNC_ISA("xsave") uint64_t xgetbv() { 57| | return _xgetbv(0); 58| 1|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_121invoke_cpuid_sublevelEjjPj: 40| 2|void invoke_cpuid_sublevel(uint32_t type, uint32_t level, uint32_t out[4]) { 41| 2| clear_mem(out, 4); 42| | 43| 2|#if defined(BOTAN_USE_GCC_INLINE_ASM) 44| | // NOLINTNEXTLINE(*-no-assembler) 45| 2| asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type), "2"(level)); 46| | 47| |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC) 48| | __cpuidex((int*)out, type, level); 49| | 50| |#else 51| | BOTAN_UNUSED(type, level); 52| | #warning "No way of calling x86 cpuid instruction for this compiler" 53| |#endif 54| 2|} _ZN5Botan10DataSource9read_byteERh: 27| 3.86M|size_t DataSource::read_byte(uint8_t& out) { 28| 3.86M| return read(&out, 1); 29| 3.86M|} _ZN5Botan10DataSource9read_byteEv: 34| 6.35M|std::optional DataSource::read_byte() { 35| 6.35M| uint8_t b = 0; 36| 6.35M| if(this->read(&b, 1) == 1) { ------------------ | Branch (36:7): [True: 6.32M, False: 25.0k] ------------------ 37| 6.32M| return b; 38| 6.32M| } else { 39| 25.0k| return {}; 40| 25.0k| } 41| 6.35M|} _ZNK5Botan10DataSource9peek_byteERh: 46| 12.9k|size_t DataSource::peek_byte(uint8_t& out) const { 47| 12.9k| return peek(&out, 1, 0); 48| 12.9k|} _ZN5Botan17DataSource_Memory4readEPhm: 73| 6.35M|size_t DataSource_Memory::read(uint8_t out[], size_t length) { 74| 6.35M| const size_t got = std::min(m_source.size() - m_offset, length); 75| 6.35M| copy_mem(out, m_source.data() + m_offset, got); 76| 6.35M| m_offset += got; 77| 6.35M| return got; 78| 6.35M|} _ZN5Botan17DataSource_Memory15check_availableEm: 80| 170k|bool DataSource_Memory::check_available(size_t n) { 81| 170k| return (n <= (m_source.size() - m_offset)); 82| 170k|} _ZNK5Botan17DataSource_Memory4peekEPhmm: 87| 13.4k|size_t DataSource_Memory::peek(uint8_t out[], size_t length, size_t peek_offset) const { 88| 13.4k| const size_t bytes_left = m_source.size() - m_offset; 89| 13.4k| if(peek_offset >= bytes_left) { ------------------ | Branch (89:7): [True: 1, False: 13.4k] ------------------ 90| 1| return 0; 91| 1| } 92| | 93| 13.4k| const size_t got = std::min(bytes_left - peek_offset, length); 94| 13.4k| copy_mem(out, &m_source[m_offset + peek_offset], got); 95| 13.4k| return got; 96| 13.4k|} _ZNK5Botan17DataSource_Memory11end_of_dataEv: 101| 125k|bool DataSource_Memory::end_of_data() const { 102| 125k| return (m_offset == m_source.size()); 103| 125k|} _ZN5Botan17DataSource_MemoryC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 108| 12.4k|DataSource_Memory::DataSource_Memory(std::string_view in) : DataSource_Memory(as_span_of_bytes(in)) {} _ZN5Botan7DNSName15from_san_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 149| 6.24k|std::optional DNSName::from_san_string(std::string_view name) { 150| 6.24k| if(auto canon = check_and_canonicalize_dns_name(name)) { ------------------ | Branch (150:12): [True: 6.24k, False: 0] ------------------ 151| | /* 152| | Validate the wildcard shape: at most one "*", and if present it must be in 153| | the leftmost label (no "." before it). This matches the RFC 6125 6.4.3 154| | form that host_wildcard_match accepts and rejects eg "*.*.example.com" or 155| | "foo.*.example.com" 156| | */ 157| 6.24k| const auto first_star = canon->find('*'); 158| 6.24k| if(first_star != std::string::npos) { ------------------ | Branch (158:10): [True: 0, False: 6.24k] ------------------ 159| 0| if(canon->find('*', first_star + 1) != std::string::npos) { ------------------ | Branch (159:13): [True: 0, False: 0] ------------------ 160| 0| return std::nullopt; 161| 0| } 162| 0| const auto first_dot = canon->find('.'); 163| 0| if(first_dot != std::string::npos && first_dot < first_star) { ------------------ | Branch (163:13): [True: 0, False: 0] | Branch (163:47): [True: 0, False: 0] ------------------ 164| 0| return std::nullopt; 165| 0| } 166| | /* 167| | RFC 6125 6.4.3: "the client SHOULD NOT attempt to match a presented 168| | identifier where the wildcard character is embedded within an 169| | A-label or U-label" 170| | */ 171| 0| if(canon->starts_with("xn--")) { ------------------ | Branch (171:13): [True: 0, False: 0] ------------------ 172| 0| return std::nullopt; 173| 0| } 174| | // A wildcard match requires at least three labels, so shorter 175| | // patterns ("*", "*.com") could never match any host 176| 0| if(std::count(canon->begin(), canon->end(), '.') < 2) { ------------------ | Branch (176:13): [True: 0, False: 0] ------------------ 177| 0| return std::nullopt; 178| 0| } 179| 0| } 180| 6.24k| return DNSName(std::move(*canon)); 181| 6.24k| } else { 182| 0| return {}; 183| 0| } 184| 6.24k|} dns_name.cpp:_ZN5Botan12_GLOBAL__N_131check_and_canonicalize_dns_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 23| 6.24k|std::optional check_and_canonicalize_dns_name(std::string_view name) { 24| | /* 25| | * RFC 1035 limits names to "255 octets or less", but that is in the wire 26| | * encoding, which includes a length octet per label plus the root label. 27| | * In presentation form (without a trailing dot) the limit is 253. 28| | */ 29| 6.24k| if(name.size() > 253) { ------------------ | Branch (29:7): [True: 0, False: 6.24k] ------------------ 30| 0| return {}; 31| 0| } 32| | 33| | // DNS names are not empty 34| 6.24k| if(name.empty()) { ------------------ | Branch (34:7): [True: 0, False: 6.24k] ------------------ 35| 0| return {}; 36| 0| } 37| | 38| | // DNS names do not start with or end with a dot 39| 6.24k| if(name.starts_with(".") || name.ends_with(".")) { ------------------ | Branch (39:7): [True: 0, False: 6.24k] | Branch (39:32): [True: 0, False: 6.24k] ------------------ 40| 0| return {}; 41| 0| } 42| | 43| | /* 44| | * Table mapping uppercase to lowercase and only including values valid for 45| | * DNS names: A-Z, a-z, 0-9, '-', '.', plus '*' for wildcarding (RFC 1035) 46| | */ 47| | // clang-format off 48| 6.24k| constexpr uint8_t DNS_CHAR_MAPPING[128] = { 49| 6.24k| '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', 50| 6.24k| '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', 51| 6.24k| '\0', '\0', '\0', '\0', '*', '\0', '\0', '-', '.', '\0', '0', '1', '2', '3', '4', '5', '6', '7', '8', 52| 6.24k| '9', '\0', '\0', '\0', '\0', '\0', '\0', '\0', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 53| 6.24k| 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '\0', '\0', '\0', '\0', 54| 6.24k| '\0', '\0', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 55| 6.24k| 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '\0', '\0', '\0', '\0', '\0', 56| 6.24k| }; 57| | // clang-format on 58| | 59| 6.24k| std::string canon; 60| 6.24k| canon.reserve(name.size()); 61| | 62| | // RFC 1035: DNS labels must not exceed 63 characters 63| 6.24k| size_t current_label_length = 0; 64| | 65| | // Tracks if the name consists only of digits and dots 66| 6.24k| bool all_numeric = true; 67| | 68| 62.4k| for(size_t i = 0; i != name.size(); ++i) { ------------------ | Branch (68:22): [True: 56.2k, False: 6.24k] ------------------ 69| 56.2k| const char c = name[i]; 70| | 71| 56.2k| if(c == '.') { ------------------ | Branch (71:10): [True: 0, False: 56.2k] ------------------ 72| | // Sequential dot (.) characters are not allowed 73| 0| if(i > 0 && name[i - 1] == '.') { ------------------ | Branch (73:13): [True: 0, False: 0] | Branch (73:22): [True: 0, False: 0] ------------------ 74| 0| return {}; 75| 0| } 76| | 77| | // Empty labels are not allowed 78| 0| if(current_label_length == 0) { ------------------ | Branch (78:13): [True: 0, False: 0] ------------------ 79| 0| return {}; 80| 0| } 81| 0| current_label_length = 0; // Reset for next label 82| 56.2k| } else { 83| 56.2k| current_label_length++; 84| | 85| | // Labels cannot exceed maximum DNS label length 86| 56.2k| if(current_label_length > 63) { ------------------ | Branch (86:13): [True: 0, False: 56.2k] ------------------ 87| 0| return {}; 88| 0| } 89| 56.2k| } 90| | 91| 56.2k| const uint8_t cu = static_cast(c); 92| | // DNS names are not allowed to include any high-bit set characters 93| 56.2k| if(cu >= 128) { ------------------ | Branch (93:10): [True: 0, False: 56.2k] ------------------ 94| 0| return {}; 95| 0| } 96| 56.2k| const uint8_t mapped = DNS_CHAR_MAPPING[cu]; 97| | // DNS names are from a restricted character set 98| 56.2k| if(mapped == 0) { ------------------ | Branch (98:10): [True: 0, False: 56.2k] ------------------ 99| 0| return {}; 100| 0| } 101| | 102| 56.2k| if(mapped != '.' && (mapped < '0' || mapped > '9')) { ------------------ | Branch (102:10): [True: 56.2k, False: 0] | Branch (102:28): [True: 0, False: 56.2k] | Branch (102:44): [True: 56.2k, False: 0] ------------------ 103| 56.2k| all_numeric = false; 104| 56.2k| } 105| | 106| 56.2k| if(mapped == '-') { ------------------ | Branch (106:10): [True: 0, False: 56.2k] ------------------ 107| | // DNS labels are not allowed to include a leading or trailing hyphen 108| 0| if(i == 0 || (i > 0 && name[i - 1] == '.')) { ------------------ | Branch (108:13): [True: 0, False: 0] | Branch (108:24): [True: 0, False: 0] | Branch (108:33): [True: 0, False: 0] ------------------ 109| 0| return {}; // leading hyphen 110| 0| } 111| | 112| 0| if(i == name.size() - 1 || (i < name.size() - 1 && name[i + 1] == '.')) { ------------------ | Branch (112:13): [True: 0, False: 0] | Branch (112:38): [True: 0, False: 0] | Branch (112:61): [True: 0, False: 0] ------------------ 113| 0| return {}; // trailing hyphen 114| 0| } 115| 0| } 116| 56.2k| canon.push_back(static_cast(mapped)); 117| 56.2k| } 118| | 119| | // This should never be hit, due to earlier validation steps 120| 6.24k| if(current_label_length == 0) { ------------------ | Branch (120:7): [True: 0, False: 6.24k] ------------------ 121| 0| return {}; 122| 0| } 123| | 124| | // An entirely numeric name ("1.2.3.4") is either a misplaced IP address 125| | // or an attempt at confusing some other system; reject outright 126| 6.24k| if(all_numeric) { ------------------ | Branch (126:7): [True: 0, False: 6.24k] ------------------ 127| 0| return {}; 128| 0| } 129| | 130| 6.24k| return canon; 131| 6.24k|} _ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 71| 5.35k|Exception::Exception(std::string_view msg) : m_msg(msg) {} _ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKSt9exception: 73| 489|Exception::Exception(std::string_view msg, const std::exception& e) : m_msg(fmt("{} failed with {}", msg, e.what())) {} _ZN5Botan9ExceptionC2EPKcNSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE: 75| 226|Exception::Exception(const char* prefix, std::string_view msg) : m_msg(fmt("{} {}", prefix, msg)) {} _ZN5Botan16Invalid_ArgumentC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 77| 6|Invalid_Argument::Invalid_Argument(std::string_view msg) : Exception(msg) {} _ZN5Botan14Internal_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 99| 61|Internal_Error::Internal_Error(std::string_view err) : Exception("Internal error:", err) {} _ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 125| 2.54k|Decoding_Error::Decoding_Error(std::string_view name) : Exception(name) {} _ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKSt9exception: 130| 489|Decoding_Error::Decoding_Error(std::string_view msg, const std::exception& e) : Exception(msg, e) {} _ZN5Botan26Invalid_Authentication_TagC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 133| 164| Exception("Invalid authentication tag:", msg) {} _ZN5Botan15Stream_IO_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 135| 1|Stream_IO_Error::Stream_IO_Error(std::string_view err) : Exception("I/O error:", err) {} _ZN5Botan5GHASH14ghash_multiplyENSt3__14spanIhLm16EEENS2_IKhLm18446744073709551615EEEm: 44| 383|void GHASH::ghash_multiply(std::span x, std::span input, size_t blocks) { 45| 383| BOTAN_ASSERT_NOMSG(input.size() % GCM_BS == 0); ------------------ | | 77| 383| do { \ | | 78| 383| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 383| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 383] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 383| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 383] | | ------------------ ------------------ 46| | 47| 383|#if defined(BOTAN_HAS_GHASH_AVX512_CLMUL) 48| 383| if(CPUID::has(CPUID::Feature::AVX512_CLMUL)) { ------------------ | Branch (48:7): [True: 0, False: 383] ------------------ 49| 0| BOTAN_ASSERT_NOMSG(!m_H_pow.empty()); ------------------ | | 77| 0| do { \ | | 78| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 0| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 0| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 0] | | ------------------ ------------------ 50| 0| return ghash_multiply_avx512_clmul(x.data(), m_H_pow.data(), input.data(), blocks); 51| 0| } 52| 383|#endif 53| | 54| 383|#if defined(BOTAN_HAS_GHASH_CLMUL_CPU) 55| 383| if(CPUID::has(CPUID::Feature::HW_CLMUL)) { ------------------ | Branch (55:7): [True: 383, False: 0] ------------------ 56| 383| BOTAN_ASSERT_NOMSG(!m_H_pow.empty()); ------------------ | | 77| 383| do { \ | | 78| 383| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 383| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 383] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 383| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 383] | | ------------------ ------------------ 57| 383| return ghash_multiply_cpu(x.data(), m_H_pow, input.data(), blocks); 58| 383| } 59| 0|#endif 60| | 61| 0|#if defined(BOTAN_HAS_GHASH_CLMUL_VPERM) 62| 0| if(CPUID::has(CPUID::Feature::SIMD_2X64)) { ------------------ | Branch (62:7): [True: 0, False: 0] ------------------ 63| 0| return ghash_multiply_vperm(x.data(), m_HM.data(), input.data(), blocks); 64| 0| } 65| 0|#endif 66| | 67| 0| ghash_multiply_base(x, m_HM, input, blocks); 68| 0|} _ZNK5Botan5GHASH19has_keying_materialEv: 107| 326|bool GHASH::has_keying_material() const { 108| 326| return !m_HM.empty() || !m_H_pow.empty(); ------------------ | Branch (108:11): [True: 0, False: 326] | Branch (108:28): [True: 326, False: 0] ------------------ 109| 326|} _ZN5Botan5GHASH12key_scheduleENSt3__14spanIKhLm18446744073709551615EEE: 111| 114|void GHASH::key_schedule(std::span key) { 112| 114| m_H_ad = {0}; 113| 114| m_ad_len = 0; 114| 114| m_text_len = 0; 115| | 116| 114| BOTAN_ASSERT_NOMSG(key.size() == GCM_BS); ------------------ | | 77| 114| do { \ | | 78| 114| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 114| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 114] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 114| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 114] | | ------------------ ------------------ 117| | 118| 114|#if defined(BOTAN_HAS_GHASH_AVX512_CLMUL) 119| 114| if(CPUID::has(CPUID::Feature::AVX512_CLMUL)) { ------------------ | Branch (119:7): [True: 0, False: 114] ------------------ 120| 0| zap(m_HM); 121| 0| if(m_H_pow.size() != 32) { ------------------ | Branch (121:10): [True: 0, False: 0] ------------------ 122| 0| m_H_pow.resize(32); 123| 0| } 124| 0| ghash_precompute_avx512_clmul(key.data(), m_H_pow.data()); 125| | // m_HM left empty 126| 0| return; 127| 0| } 128| 114|#endif 129| | 130| 114|#if defined(BOTAN_HAS_GHASH_CLMUL_CPU) 131| 114| if(CPUID::has(CPUID::Feature::HW_CLMUL)) { ------------------ | Branch (131:7): [True: 114, False: 0] ------------------ 132| 114| zap(m_HM); 133| 114| ghash_precompute_cpu(key.data(), m_H_pow); 134| | // m_HM left empty 135| 114| return; 136| 114| } 137| 0|#endif 138| | 139| 0| ghash_precompute_base(key.first(), m_HM); 140| 0|} _ZN5Botan5GHASH5startENSt3__14spanIKhLm18446744073709551615EEE: 169| 109|void GHASH::start(std::span nonce) { 170| 109| BOTAN_ARG_CHECK(nonce.size() == 16, "GHASH requires a 128-bit nonce"); ------------------ | | 35| 109| do { \ | | 36| 109| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 109| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 109] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 109| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 109] | | ------------------ ------------------ 171| 109| auto& n = m_nonce.emplace(); 172| 109| copy_mem(n, nonce); 173| 109| copy_mem(m_ghash, m_H_ad); 174| 109| m_buffer.clear(); 175| 109| m_text_len = 0; 176| 109|} _ZN5Botan5GHASH19set_associated_dataENSt3__14spanIKhLm18446744073709551615EEE: 178| 109|void GHASH::set_associated_data(std::span input) { 179| 109| BOTAN_STATE_CHECK(!m_nonce); ------------------ | | 51| 109| do { \ | | 52| 109| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 109| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 109] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 109| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 109] | | ------------------ ------------------ 180| | 181| 109| assert_key_material_set(); 182| 109| m_H_ad = {0}; 183| 109| ghash_update(m_H_ad, input); 184| 109| ghash_zeropad(m_H_ad); 185| 109| m_ad_len = input.size(); 186| 109|} _ZN5Botan5GHASH6updateENSt3__14spanIKhLm18446744073709551615EEE: 202| 108|void GHASH::update(std::span input) { 203| 108| assert_key_material_set(); 204| 108| BOTAN_STATE_CHECK(m_nonce); ------------------ | | 51| 108| do { \ | | 52| 108| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 108| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 108] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 108| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 108] | | ------------------ ------------------ 205| 108| ghash_update(m_ghash, input); 206| 108| m_text_len += input.size(); 207| | 208| | // NIST SP 800-38D limits plaintext/ciphertext to 2^39 - 256 bits 209| 108| constexpr uint64_t GHASH_MAX_BYTES = (((static_cast(1) << 39)) - 256) / 8; 210| 108| if(m_text_len > GHASH_MAX_BYTES) { ------------------ | Branch (210:7): [True: 0, False: 108] ------------------ 211| 0| throw Invalid_State("GCM message length limit exceeded"); 212| 0| } 213| 108|} _ZN5Botan5GHASH5finalENSt3__14spanIhLm18446744073709551615EEE: 215| 109|void GHASH::final(std::span mac) { 216| 109| BOTAN_ARG_CHECK(!mac.empty() && mac.size() <= GCM_BS, "GHASH output length"); ------------------ | | 35| 109| do { \ | | 36| 109| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 218| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 109, False: 0] | | | Branch (37:12): [True: 109, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 109| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 109] | | ------------------ ------------------ 217| 109| BOTAN_STATE_CHECK(m_nonce); ------------------ | | 51| 109| do { \ | | 52| 109| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 109| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 109] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 109| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 109] | | ------------------ ------------------ 218| 109| assert_key_material_set(); 219| | 220| 109| ghash_zeropad(m_ghash); 221| 109| ghash_final_block(m_ghash, m_ad_len, m_text_len); 222| | 223| 109| xor_buf(mac, std::span{m_ghash}.first(mac.size()), std::span{*m_nonce}.first(mac.size())); 224| | 225| 109| secure_scrub_memory(m_ghash); 226| 109| m_text_len = 0; 227| 109| m_nonce.reset(); 228| 109|} _ZN5Botan5GHASH11reset_stateEv: 247| 114|void GHASH::reset_state() { 248| 114| secure_scrub_memory(m_ghash); 249| 114| if(m_nonce) { ------------------ | Branch (249:7): [True: 0, False: 114] ------------------ 250| 0| secure_scrub_memory(m_nonce.value()); 251| 0| m_nonce.reset(); 252| 0| } 253| 114| m_buffer.clear(); 254| 114| m_text_len = 0; 255| 114|} _ZN5Botan5GHASH12ghash_updateENSt3__14spanIhLm16EEENS2_IKhLm18446744073709551615EEE: 257| 217|void GHASH::ghash_update(std::span x, std::span input) { 258| 217| BufferSlicer in(input); 259| 491| while(!in.empty()) { ------------------ | Branch (259:10): [True: 274, False: 217] ------------------ 260| 274| if(const auto one_block = m_buffer.handle_unaligned_data(in)) { ------------------ | Branch (260:21): [True: 0, False: 274] ------------------ 261| 0| ghash_multiply(x, one_block.value(), 1); 262| 0| } 263| | 264| 274| if(m_buffer.in_alignment()) { ------------------ | Branch (264:10): [True: 86, False: 188] ------------------ 265| 86| const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in); 266| 86| if(full_blocks > 0) { ------------------ | Branch (266:13): [True: 86, False: 0] ------------------ 267| 86| ghash_multiply(x, aligned_data, full_blocks); 268| 86| } 269| 86| } 270| 274| } 271| 217| BOTAN_ASSERT_NOMSG(in.empty()); ------------------ | | 77| 217| do { \ | | 78| 217| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 217| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 217] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 217| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 217] | | ------------------ ------------------ 272| 217|} _ZN5Botan5GHASH13ghash_zeropadENSt3__14spanIhLm16EEE: 274| 218|void GHASH::ghash_zeropad(std::span x) { 275| 218| if(!m_buffer.in_alignment()) { ------------------ | Branch (275:7): [True: 188, False: 30] ------------------ 276| 188| m_buffer.fill_up_with_zeros(); 277| 188| ghash_multiply(x, m_buffer.consume(), 1); 278| 188| } 279| 218|} _ZN5Botan5GHASH17ghash_final_blockENSt3__14spanIhLm16EEEmm: 281| 109|void GHASH::ghash_final_block(std::span x, uint64_t ad_len, uint64_t text_len) { 282| 109| BOTAN_STATE_CHECK(m_buffer.in_alignment()); ------------------ | | 51| 109| do { \ | | 52| 109| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 109| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 109] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 109| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 109] | | ------------------ ------------------ 283| 109| const auto final_block = store_be(8 * ad_len, 8 * text_len); 284| 109| ghash_multiply(x, final_block, 1); 285| 109|} _ZN5Botan5GHASH20ghash_precompute_cpuEPKhRNSt3__16vectorImNS_16secure_allocatorImEEEE: 175| 114|void BOTAN_FN_ISA_CLMUL GHASH::ghash_precompute_cpu(const uint8_t H_bytes[16], secure_vector& H_pow) { 176| 114| precompute_clmul(mulx_polyval(reverse_vector(SIMD_4x32::load_le(H_bytes))), H_pow); 177| 114|} _ZN5Botan5GHASH18ghash_multiply_cpuEPhRNSt3__16vectorImNS_16secure_allocatorImEEEEPKhm: 182| 383| size_t blocks) { 183| 383| multiply_clmul(x, H_pow, input, blocks); 184| 383|} ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_116precompute_clmulERKNS_9SIMD_4x32ERNSt3__16vectorImNS_16secure_allocatorImEEEE: 83| 114|void BOTAN_FN_ISA_CLMUL precompute_clmul(const SIMD_4x32& H1, secure_vector& H_pow) { 84| 114| const SIMD_4x32 H2 = polyval_multiply(H1, H1); 85| 114| const SIMD_4x32 H3 = polyval_multiply(H1, H2); 86| 114| const SIMD_4x32 H4 = polyval_multiply(H2, H2); 87| | 88| 114| H_pow.reserve(2 * 8); 89| 114| H_pow.resize(2 * 4); 90| 114| H1.store_le(&H_pow[0]); // NOLINT(*-container-data-pointer) 91| 114| H2.store_le(&H_pow[2]); 92| 114| H3.store_le(&H_pow[4]); 93| 114| H4.store_le(&H_pow[6]); 94| 114|} ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_114multiply_clmulILb1EEEvPhRNSt3__16vectorImNS_16secure_allocatorImEEEEPKhm: 98| 383|multiply_clmul(uint8_t x[16], secure_vector& H_pow, const uint8_t input[], size_t blocks) { 99| 383| BOTAN_ASSERT_NOMSG(H_pow.size() == 2 * 4 || H_pow.size() == 2 * 8); ------------------ | | 77| 383| do { \ | | 78| 383| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 481| if(!(expr)) { \ | | ------------------ | | | Branch (79:12): [True: 285, False: 98] | | | Branch (79:12): [True: 98, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 383| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 383] | | ------------------ ------------------ 100| | 101| 383| const SIMD_4x32 H1 = SIMD_4x32::load_le(&H_pow[0]); // NOLINT(*-container-data-pointer) 102| | 103| 383| SIMD_4x32 a = load_block(x); 104| | 105| 383| if(blocks >= 8) { ------------------ | Branch (105:7): [True: 53, False: 330] ------------------ 106| 53| const SIMD_4x32 H2 = SIMD_4x32::load_le(&H_pow[2]); 107| 53| const SIMD_4x32 H3 = SIMD_4x32::load_le(&H_pow[4]); 108| 53| const SIMD_4x32 H4 = SIMD_4x32::load_le(&H_pow[6]); 109| | 110| 53| if(H_pow.size() < 2 * 8) { ------------------ | Branch (110:10): [True: 53, False: 0] ------------------ 111| 53| H_pow.resize(2 * 8); 112| 53| const SIMD_4x32 H5 = polyval_multiply(H4, H1); 113| 53| const SIMD_4x32 H6 = polyval_multiply(H4, H2); 114| 53| const SIMD_4x32 H7 = polyval_multiply(H4, H3); 115| 53| const SIMD_4x32 H8 = polyval_multiply(H4, H4); 116| 53| H5.store_le(&H_pow[8]); 117| 53| H6.store_le(&H_pow[10]); 118| 53| H7.store_le(&H_pow[12]); 119| 53| H8.store_le(&H_pow[14]); 120| 53| } 121| | 122| 53| const SIMD_4x32 H5 = SIMD_4x32::load_le(&H_pow[8]); 123| 53| const SIMD_4x32 H6 = SIMD_4x32::load_le(&H_pow[10]); 124| 53| const SIMD_4x32 H7 = SIMD_4x32::load_le(&H_pow[12]); 125| 53| const SIMD_4x32 H8 = SIMD_4x32::load_le(&H_pow[14]); 126| | 127| 663| while(blocks >= 8) { ------------------ | Branch (127:13): [True: 610, False: 53] ------------------ 128| 610| const SIMD_4x32 m0 = load_block(input); 129| 610| const SIMD_4x32 m1 = load_block(input + 16 * 1); 130| 610| const SIMD_4x32 m2 = load_block(input + 16 * 2); 131| 610| const SIMD_4x32 m3 = load_block(input + 16 * 3); 132| 610| const SIMD_4x32 m4 = load_block(input + 16 * 4); 133| 610| const SIMD_4x32 m5 = load_block(input + 16 * 5); 134| 610| const SIMD_4x32 m6 = load_block(input + 16 * 6); 135| 610| const SIMD_4x32 m7 = load_block(input + 16 * 7); 136| | 137| 610| a = polyval_multiply_x8(H1, H2, H3, H4, H5, H6, H7, H8, m7, m6, m5, m4, m3, m2, m1, m0 ^ a); 138| | 139| 610| input += 8 * 16; 140| 610| blocks -= 8; 141| 610| } 142| 53| } 143| | 144| 383| if(blocks >= 4) { ------------------ | Branch (144:7): [True: 39, False: 344] ------------------ 145| 39| const SIMD_4x32 H2 = SIMD_4x32::load_le(&H_pow[2]); 146| 39| const SIMD_4x32 H3 = SIMD_4x32::load_le(&H_pow[4]); 147| 39| const SIMD_4x32 H4 = SIMD_4x32::load_le(&H_pow[6]); 148| | 149| 78| while(blocks >= 4) { ------------------ | Branch (149:13): [True: 39, False: 39] ------------------ 150| 39| const SIMD_4x32 m0 = load_block(input); 151| 39| const SIMD_4x32 m1 = load_block(input + 16 * 1); 152| 39| const SIMD_4x32 m2 = load_block(input + 16 * 2); 153| 39| const SIMD_4x32 m3 = load_block(input + 16 * 3); 154| | 155| 39| a ^= m0; 156| 39| a = polyval_multiply_x4(H1, H2, H3, H4, m3, m2, m1, a); 157| | 158| 39| input += 4 * 16; 159| 39| blocks -= 4; 160| 39| } 161| 39| } 162| | 163| 814| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (163:22): [True: 431, False: 383] ------------------ 164| 431| const SIMD_4x32 m = load_block(input + 16 * i); 165| | 166| 431| a ^= m; 167| 431| a = polyval_multiply(H1, a); 168| 431| } 169| | 170| 383| store_block(a, x); 171| 383|} ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_119polyval_multiply_x8ERKNS_9SIMD_4x32ES3_S3_S3_S3_S3_S3_S3_S3_S3_S3_S3_S3_S3_S3_S3_: 60| 610| const SIMD_4x32& X8) { 61| 610| const SIMD_4x32 lo = clmul<0x00>(H1, X1) ^ clmul<0x00>(H2, X2) ^ clmul<0x00>(H3, X3) ^ clmul<0x00>(H4, X4) ^ 62| 610| clmul<0x00>(H5, X5) ^ clmul<0x00>(H6, X6) ^ clmul<0x00>(H7, X7) ^ clmul<0x00>(H8, X8); 63| | 64| 610| const SIMD_4x32 hi = clmul<0x11>(H1, X1) ^ clmul<0x11>(H2, X2) ^ clmul<0x11>(H3, X3) ^ clmul<0x11>(H4, X4) ^ 65| 610| clmul<0x11>(H5, X5) ^ clmul<0x11>(H6, X6) ^ clmul<0x11>(H7, X7) ^ clmul<0x11>(H8, X8); 66| | 67| 610| SIMD_4x32 mid; 68| | 69| 610| mid ^= clmul<0x00>(H1 ^ H1.shift_elems_right<2>(), X1 ^ X1.shift_elems_right<2>()); 70| 610| mid ^= clmul<0x00>(H2 ^ H2.shift_elems_right<2>(), X2 ^ X2.shift_elems_right<2>()); 71| 610| mid ^= clmul<0x00>(H3 ^ H3.shift_elems_right<2>(), X3 ^ X3.shift_elems_right<2>()); 72| 610| mid ^= clmul<0x00>(H4 ^ H4.shift_elems_right<2>(), X4 ^ X4.shift_elems_right<2>()); 73| 610| mid ^= clmul<0x00>(H5 ^ H5.shift_elems_right<2>(), X5 ^ X5.shift_elems_right<2>()); 74| 610| mid ^= clmul<0x00>(H6 ^ H6.shift_elems_right<2>(), X6 ^ X6.shift_elems_right<2>()); 75| 610| mid ^= clmul<0x00>(H7 ^ H7.shift_elems_right<2>(), X7 ^ X7.shift_elems_right<2>()); 76| 610| mid ^= clmul<0x00>(H8 ^ H8.shift_elems_right<2>(), X8 ^ X8.shift_elems_right<2>()); 77| 610| mid ^= lo; 78| 610| mid ^= hi; 79| | 80| 610| return polyval_reduce(hi ^ mid.shift_elems_right<2>(), lo ^ mid.shift_elems_left<2>()); 81| 610|} ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_119polyval_multiply_x4ERKNS_9SIMD_4x32ES3_S3_S3_S3_S3_S3_S3_: 29| 39| const SIMD_4x32& X4) { 30| 39| const SIMD_4x32 lo = (clmul<0x00>(H1, X1) ^ clmul<0x00>(H2, X2)) ^ (clmul<0x00>(H3, X3) ^ clmul<0x00>(H4, X4)); 31| 39| const SIMD_4x32 hi = (clmul<0x11>(H1, X1) ^ clmul<0x11>(H2, X2)) ^ (clmul<0x11>(H3, X3) ^ clmul<0x11>(H4, X4)); 32| | 33| 39| SIMD_4x32 mid; 34| | 35| 39| mid ^= clmul<0x00>(H1 ^ H1.shift_elems_right<2>(), X1 ^ X1.shift_elems_right<2>()); 36| 39| mid ^= clmul<0x00>(H2 ^ H2.shift_elems_right<2>(), X2 ^ X2.shift_elems_right<2>()); 37| 39| mid ^= clmul<0x00>(H3 ^ H3.shift_elems_right<2>(), X3 ^ X3.shift_elems_right<2>()); 38| 39| mid ^= clmul<0x00>(H4 ^ H4.shift_elems_right<2>(), X4 ^ X4.shift_elems_right<2>()); 39| 39| mid ^= lo; 40| 39| mid ^= hi; 41| | 42| 39| return polyval_reduce(hi ^ mid.shift_elems_right<2>(), lo ^ mid.shift_elems_left<2>()); 43| 39|} _ZN5Botan19secure_scrub_memoryEPvm: 25| 1.71M|void secure_scrub_memory(void* ptr, size_t n) { 26| 1.71M| return secure_zeroize_buffer(ptr, n); 27| 1.71M|} _ZN5Botan21secure_zeroize_bufferEPvm: 29| 1.79M|void secure_zeroize_buffer(void* ptr, size_t n) { 30| 1.79M| if(n == 0) { ------------------ | Branch (30:7): [True: 650k, False: 1.14M] ------------------ 31| 650k| return; 32| 650k| } 33| | 34| |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY) 35| | ::RtlSecureZeroMemory(ptr, n); 36| | 37| |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO) 38| 1.14M| ::explicit_bzero(ptr, n); 39| | 40| |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET) 41| | (void)::explicit_memset(ptr, 0, n); 42| | 43| |#else 44| | /* 45| | * Call memset through a static volatile pointer, which the compiler should 46| | * not elide. This construct should be safe in conforming compilers, but who 47| | * knows. This has been checked to generate the expected code, which saves the 48| | * memset address in the data segment and unconditionally loads and jumps to 49| | * that address, with the following targets: 50| | * 51| | * x86-64: Clang 19, GCC 6, 11, 13, 14 52| | * riscv64: GCC 14 53| | * aarch64: GCC 14 54| | * armv7: GCC 14 55| | * 56| | * Actually all of them generated the expected jump even without marking the 57| | * function pointer as volatile. However this seems worth including as an 58| | * additional precaution. 59| | */ 60| | static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset; 61| | (memset_ptr)(ptr, 0, n); 62| |#endif 63| 1.14M|} _ZN5Botan2OS14get_process_idEv: 77| 35.6k|uint32_t OS::get_process_id() { 78| 35.6k|#if defined(BOTAN_TARGET_OS_HAS_POSIX1) 79| 35.6k| return ::getpid(); 80| |#elif defined(BOTAN_TARGET_OS_HAS_WIN32) 81| | return ::GetCurrentProcessId(); 82| |#elif defined(BOTAN_TARGET_OS_IS_LLVM) || defined(BOTAN_TARGET_OS_IS_NONE) 83| | return 0; // truly no meaningful value 84| |#else 85| | #error "Missing get_process_id" 86| |#endif 87| 35.6k|} _ZN5Botan2OS17read_env_variableERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE: 449| 1|bool OS::read_env_variable(std::string& value_out, std::string_view name_view) { 450| 1| value_out = ""; 451| | 452| 1| if(running_in_privileged_state()) { ------------------ | Branch (452:7): [True: 0, False: 1] ------------------ 453| 0| return false; 454| 0| } 455| | 456| |#if defined(BOTAN_TARGET_OS_HAS_WIN32) && \ 457| | (defined(BOTAN_BUILD_COMPILER_IS_MSVC) || defined(BOTAN_BUILD_COMPILER_IS_CLANGCL)) 458| | const std::string name(name_view); 459| | char val[128] = {0}; 460| | size_t req_size = 0; 461| | if(getenv_s(&req_size, val, sizeof(val), name.c_str()) == 0) { 462| | // Microsoft's implementation always writes a terminating \0, 463| | // and includes it in the reported length of the environment variable 464| | // if a value exists. 465| | if(req_size > 0 && val[req_size - 1] == '\0') { 466| | value_out = std::string(val); 467| | } else { 468| | value_out = std::string(val, req_size); 469| | } 470| | return true; 471| | } 472| |#else 473| 1| const std::string name(name_view); 474| 1| if(const char* val = std::getenv(name.c_str())) { ------------------ | Branch (474:19): [True: 0, False: 1] ------------------ 475| 0| value_out = val; 476| 0| return true; 477| 0| } 478| 1|#endif 479| | 480| 1| return false; 481| 1|} os_utils.cpp:_ZN5Botan12_GLOBAL__N_110get_auxvalENSt3__18optionalImEE: 119| 1|std::optional get_auxval(std::optional id) { 120| 1| if(id) { ------------------ | Branch (120:7): [True: 1, False: 0] ------------------ 121| 1|#if defined(BOTAN_TARGET_OS_HAS_GETAUXVAL) 122| 1| return ::getauxval(*id); 123| |#elif defined(BOTAN_TARGET_OS_HAS_ELF_AUX_INFO) 124| | unsigned long auxinfo = 0; 125| | if(::elf_aux_info(static_cast(*id), &auxinfo, sizeof(auxinfo)) == 0) { 126| | return auxinfo; 127| | } 128| |#endif 129| 1| } 130| | 131| 0| return {}; 132| 1|} os_utils.cpp:_ZN5Botan12_GLOBAL__N_127running_in_privileged_stateEv: 153| 1|bool running_in_privileged_state() { 154| 1|#if defined(AT_SECURE) 155| 1| if(auto at_secure = get_auxval(AT_SECURE)) { ------------------ | Branch (155:12): [True: 1, False: 0] ------------------ 156| 1| return at_secure != 0; 157| 1| } 158| 0|#endif 159| | 160| 0|#if defined(BOTAN_TARGET_OS_HAS_POSIX1) 161| 0| return (::getuid() != ::geteuid()) || (::getgid() != ::getegid()); ------------------ | Branch (161:11): [True: 0, False: 0] | Branch (161:42): [True: 0, False: 0] ------------------ 162| |#else 163| | return false; 164| |#endif 165| 1|} _ZN5Botan9parse_u32ENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEb: 64| 75.0k|std::optional parse_u32(std::string_view input, bool require_canonical) { 65| 75.0k| return parse_decimal_integer(input, require_canonical); 66| 75.0k|} _ZN5Botan9to_u32bitENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE: 76| 75.0k|uint32_t to_u32bit(std::string_view input) { 77| 75.0k| if(const auto parsed = parse_u32(input)) { ------------------ | Branch (77:18): [True: 75.0k, False: 0] ------------------ 78| 75.0k| return *parsed; 79| 75.0k| } else { 80| 0| throw Invalid_Argument(fmt("Failed to parse input '{}' as a 32-bit integer", input)); 81| 0| } 82| 75.0k|} _ZN5Botan20parse_algorithm_nameENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE: 87| 239|std::vector parse_algorithm_name(std::string_view scan_name) { 88| 239| if(scan_name.find('(') == std::string::npos && scan_name.find(')') == std::string::npos) { ------------------ | Branch (88:7): [True: 132, False: 107] | Branch (88:51): [True: 132, False: 0] ------------------ 89| 132| return {std::string(scan_name)}; 90| 132| } 91| | 92| 107| std::string name(scan_name); 93| 107| std::string substring; 94| 107| std::vector elems; 95| 107| size_t level = 0; 96| | 97| 107| elems.push_back(name.substr(0, name.find('('))); 98| 107| name = name.substr(name.find('(')); 99| | 100| 399| for(auto i = name.begin(); i != name.end(); ++i) { ------------------ | Branch (100:31): [True: 399, False: 0] ------------------ 101| 399| const char c = *i; 102| | 103| 399| if(c == '(') { ------------------ | Branch (103:10): [True: 107, False: 292] ------------------ 104| 107| ++level; 105| 107| } 106| 399| if(c == ')') { ------------------ | Branch (106:10): [True: 107, False: 292] ------------------ 107| 107| if(level == 1 && i == name.end() - 1) { ------------------ | Branch (107:13): [True: 107, False: 0] | Branch (107:13): [True: 107, False: 0] | Branch (107:27): [True: 107, False: 0] ------------------ 108| 107| if(elems.size() == 1) { ------------------ | Branch (108:16): [True: 107, False: 0] ------------------ 109| 107| elems.push_back(substring.substr(1)); 110| 107| } else { 111| 0| elems.push_back(substring); 112| 0| } 113| 107| return elems; 114| 107| } 115| | 116| 0| if(level == 0 || (level == 1 && i != name.end() - 1)) { ------------------ | Branch (116:13): [True: 0, False: 0] | Branch (116:13): [True: 0, False: 0] | Branch (116:28): [True: 0, False: 0] | Branch (116:42): [True: 0, False: 0] ------------------ 117| 0| throw Invalid_Algorithm_Name(scan_name); 118| 0| } 119| 0| --level; 120| 0| } 121| | 122| 292| if(c == ',' && level == 1) { ------------------ | Branch (122:10): [True: 0, False: 292] | Branch (122:22): [True: 0, False: 0] ------------------ 123| 0| if(elems.size() == 1) { ------------------ | Branch (123:13): [True: 0, False: 0] ------------------ 124| 0| elems.push_back(substring.substr(1)); 125| 0| } else { 126| 0| elems.push_back(substring); 127| 0| } 128| 0| substring.clear(); 129| 292| } else { 130| 292| substring += c; 131| 292| } 132| 292| } 133| | 134| 0| if(!substring.empty()) { ------------------ | Branch (134:7): [True: 0, False: 0] ------------------ 135| 0| throw Invalid_Algorithm_Name(scan_name); 136| 0| } 137| | 138| 0| return elems; 139| 0|} _ZN5Botan8split_onENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEc: 141| 6.48k|std::vector split_on(std::string_view str, char delim) { 142| 6.48k| std::vector elems; 143| 6.48k| if(str.empty()) { ------------------ | Branch (143:7): [True: 0, False: 6.48k] ------------------ 144| 0| return elems; 145| 0| } 146| | 147| 6.48k| std::string substr; 148| 34.2k| for(const char c : str) { ------------------ | Branch (148:21): [True: 34.2k, False: 6.48k] ------------------ 149| 34.2k| if(c == delim) { ------------------ | Branch (149:10): [True: 239, False: 34.0k] ------------------ 150| 239| if(!substr.empty()) { ------------------ | Branch (150:13): [True: 239, False: 0] ------------------ 151| 239| elems.push_back(substr); 152| 239| } 153| 239| substr.clear(); 154| 34.0k| } else { 155| 34.0k| substr += c; 156| 34.0k| } 157| 34.2k| } 158| | 159| 6.48k| if(substr.empty()) { ------------------ | Branch (159:7): [True: 0, False: 6.48k] ------------------ 160| 0| throw Invalid_Argument(fmt("Unable to split string '{}", str)); 161| 0| } 162| 6.48k| elems.push_back(substr); 163| | 164| 6.48k| return elems; 165| 6.48k|} parsing.cpp:_ZN5Botan12_GLOBAL__N_116digit_from_asciiEc: 23| 150k|std::optional digit_from_ascii(char c) { 24| 150k| if(c >= '0' && c <= '9') { ------------------ | Branch (24:7): [True: 150k, False: 0] | Branch (24:19): [True: 150k, False: 0] ------------------ 25| 150k| return c - '0'; 26| 150k| } else { 27| 0| return {}; 28| 0| } 29| 150k|} parsing.cpp:_ZN5Botan12_GLOBAL__N_121parse_decimal_integerITkNSt3__117unsigned_integralEjEENS2_8optionalIT_EENS2_17basic_string_viewIcNS2_11char_traitsIcEEEEb: 32| 75.0k|std::optional parse_decimal_integer(std::string_view input, bool require_canonical) { 33| 75.0k| if(input.empty() || input.size() > (std::numeric_limits::digits10 + 1)) { ------------------ | Branch (33:7): [True: 0, False: 75.0k] | Branch (33:24): [True: 0, False: 75.0k] ------------------ 34| 0| return {}; 35| 0| } 36| | 37| | // The canonical encoding of zero is "0"; no other value starts with a zero 38| 75.0k| if(require_canonical && input.size() > 1 && input.front() == '0') { ------------------ | Branch (38:7): [True: 0, False: 75.0k] | Branch (38:28): [True: 0, False: 0] | Branch (38:48): [True: 0, False: 0] ------------------ 39| 0| return {}; 40| 0| } 41| | 42| 75.0k| T accum = 0; 43| | 44| 150k| for(const char c : input) { ------------------ | Branch (44:21): [True: 150k, False: 75.0k] ------------------ 45| 150k| if(const auto digit = digit_from_ascii(c)) { ------------------ | Branch (45:21): [True: 150k, False: 0] ------------------ 46| 150k| if(accum > (std::numeric_limits::max() - static_cast(*digit)) / 10) { ------------------ | Branch (46:13): [True: 0, False: 150k] ------------------ 47| 0| return {}; 48| 0| } 49| 150k| accum = accum * 10 + static_cast(*digit); 50| 150k| } else { 51| 0| return {}; 52| 0| } 53| 150k| } 54| | 55| 75.0k| return accum; 56| 75.0k|} _ZN5Botan13poly_double_nEPhPKhm: 81| 704|void poly_double_n(uint8_t out[], const uint8_t in[], size_t n) { 82| 704| switch(n) { 83| 0| case 8: ------------------ | Branch (83:7): [True: 0, False: 704] ------------------ 84| 0| return poly_double<1, MinWeightPolynomial::P64>(out, in); 85| 704| case 16: ------------------ | Branch (85:7): [True: 704, False: 0] ------------------ 86| 704| return poly_double<2, MinWeightPolynomial::P128>(out, in); 87| 0| case 24: ------------------ | Branch (87:7): [True: 0, False: 704] ------------------ 88| 0| return poly_double<3, MinWeightPolynomial::P192>(out, in); 89| 0| case 32: ------------------ | Branch (89:7): [True: 0, False: 704] ------------------ 90| 0| return poly_double<4, MinWeightPolynomial::P256>(out, in); 91| 0| case 64: ------------------ | Branch (91:7): [True: 0, False: 704] ------------------ 92| 0| return poly_double<8, MinWeightPolynomial::P512>(out, in); 93| 0| case 128: ------------------ | Branch (93:7): [True: 0, False: 704] ------------------ 94| 0| return poly_double<16, MinWeightPolynomial::P1024>(out, in); 95| 0| default: ------------------ | Branch (95:7): [True: 0, False: 704] ------------------ 96| 0| throw Invalid_Argument("Unsupported size for poly_double_n"); 97| 704| } 98| 704|} poly_dbl.cpp:_ZN5Botan12_GLOBAL__N_111poly_doubleILm2ELNS0_19MinWeightPolynomialE135EEEvPhPKh: 44| 704|void poly_double(uint8_t out[], const uint8_t in[]) { 45| 704| uint64_t W[LIMBS]; 46| 704| load_be(W, in, LIMBS); 47| | 48| 704| const uint64_t carry = return_carry

(W[0]); 49| | 50| 704| if constexpr(LIMBS > 0) { 51| 1.40k| for(size_t i = 0; i != LIMBS - 1; ++i) { ------------------ | Branch (51:25): [True: 704, False: 704] ------------------ 52| 704| W[i] = (W[i] << 1) ^ (W[i + 1] >> 63); 53| 704| } 54| 704| } 55| | 56| 704| W[LIMBS - 1] = (W[LIMBS - 1] << 1) ^ carry; 57| | 58| 704| copy_out_be(std::span(out, LIMBS * 8), W); 59| 704|} poly_dbl.cpp:_ZN5Botan12_GLOBAL__N_112return_carryILNS0_19MinWeightPolynomialE135EEEmm: 39| 704|inline uint64_t return_carry(uint64_t c) { 40| 704| return CT::Mask::expand_top_bit(c).if_set_return(static_cast(P)); 41| 704|} _ZN5Botan18prefetch_array_rawEmPKv: 14| 20|uint64_t prefetch_array_raw(size_t bytes, const void* arrayv) noexcept { 15| 20|#if defined(__cpp_lib_hardware_interference_size) 16| 20| constexpr size_t cache_line_size = std::hardware_destructive_interference_size; 17| |#else 18| | // We arbitrarily use a 64 byte cache line, which is by far the most 19| | // common size. 20| | // 21| | // Runtime detection adds too much overhead to this function. 22| | constexpr size_t cache_line_size = 64; 23| |#endif 24| | 25| 20| const uint8_t* array = static_cast(arrayv); 26| | 27| 20| volatile uint64_t combiner = 1; 28| | 29| 100| for(size_t idx = 0; idx < bytes; idx += cache_line_size) { ------------------ | Branch (29:24): [True: 80, False: 20] ------------------ 30| 80|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_prefetch) 31| | // we have no way of knowing if the compiler will emit anything here 32| 80| __builtin_prefetch(&array[idx]); 33| 80|#endif 34| | 35| 80| combiner = combiner | array[idx]; 36| 80| } 37| | 38| | /* 39| | * The combiner variable is initialized with 1, and we accumulate using OR, so 40| | * now combiner must be a value other than zero. This being the case we will 41| | * always return zero here. Hopefully the compiler will not figure this out. 42| | */ 43| 20| return ct_is_zero(combiner); 44| 20|} _ZN5Botan9SCAN_NameC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 61| 3.67k|SCAN_Name::SCAN_Name(std::string_view algo_spec) : m_orig_algo_spec(algo_spec) { 62| 3.67k| if(algo_spec.empty()) { ------------------ | Branch (62:7): [True: 0, False: 3.67k] ------------------ 63| 0| throw Invalid_Argument("Expected algorithm name, got empty string"); 64| 0| } 65| | 66| | // Fast path for a bare name with no arguments or modes (eg "SHA-256"), 67| | // which is the common case. Equivalent to the general parse below, which 68| | // for such input produces a single token and no args/modes. 69| 3.67k| if(algo_spec.find_first_of("(),/") == std::string_view::npos) { ------------------ | Branch (69:7): [True: 0, False: 3.67k] ------------------ 70| 0| m_alg_name = std::string(algo_spec); 71| 0| return; 72| 0| } 73| | 74| 3.67k| std::vector> name; 75| 3.67k| size_t level = 0; 76| 3.67k| std::pair accum = std::make_pair(level, ""); 77| | 78| 3.67k| bool expect_token = true; 79| | 80| 57.2k| for(const char c : algo_spec) { ------------------ | Branch (80:21): [True: 57.2k, False: 3.67k] ------------------ 81| 57.2k| if(c == '/' || c == ',' || c == '(' || c == ')') { ------------------ | Branch (81:10): [True: 0, False: 57.2k] | Branch (81:22): [True: 107, False: 57.1k] | Branch (81:34): [True: 3.67k, False: 53.4k] | Branch (81:46): [True: 3.67k, False: 49.7k] ------------------ 82| 7.46k| if(c == '(') { ------------------ | Branch (82:13): [True: 3.67k, False: 3.78k] ------------------ 83| 3.67k| ++level; 84| 3.78k| } else if(c == ')') { ------------------ | Branch (84:20): [True: 3.67k, False: 107] ------------------ 85| 3.67k| if(level == 0) { ------------------ | Branch (85:16): [True: 0, False: 3.67k] ------------------ 86| 0| throw Invalid_Algorithm_Name(m_orig_algo_spec); 87| 0| } 88| 3.67k| --level; 89| 3.67k| } 90| | 91| 7.46k| if(c == '/' && level > 0) { ------------------ | Branch (91:13): [True: 0, False: 7.46k] | Branch (91:25): [True: 0, False: 0] ------------------ 92| 0| accum.second.push_back(c); 93| 0| expect_token = false; 94| 7.46k| } else { 95| 7.46k| if(expect_token) { ------------------ | Branch (95:16): [True: 0, False: 7.46k] ------------------ 96| 0| throw Invalid_Algorithm_Name(m_orig_algo_spec); 97| 0| } 98| 7.46k| if(!accum.second.empty()) { ------------------ | Branch (98:16): [True: 7.46k, False: 0] ------------------ 99| 7.46k| name.push_back(accum); 100| 7.46k| } 101| 7.46k| accum = std::make_pair(level, ""); 102| 7.46k| expect_token = (c != ')'); 103| 7.46k| } 104| 49.7k| } else { 105| 49.7k| accum.second.push_back(c); 106| 49.7k| expect_token = false; 107| 49.7k| } 108| 57.2k| } 109| | 110| 3.67k| if(!accum.second.empty()) { ------------------ | Branch (110:7): [True: 0, False: 3.67k] ------------------ 111| 0| name.push_back(accum); 112| 0| } 113| | 114| 3.67k| if(level != 0) { ------------------ | Branch (114:7): [True: 0, False: 3.67k] ------------------ 115| 0| throw Invalid_Algorithm_Name(m_orig_algo_spec); 116| 0| } 117| | 118| 3.67k| if(expect_token) { ------------------ | Branch (118:7): [True: 0, False: 3.67k] ------------------ 119| | // A trailing separator with no following token, eg "Foo/" or "Foo," 120| 0| throw Invalid_Algorithm_Name(m_orig_algo_spec); 121| 0| } 122| | 123| 3.67k| if(name.empty()) { ------------------ | Branch (123:7): [True: 0, False: 3.67k] ------------------ 124| 0| throw Invalid_Algorithm_Name(m_orig_algo_spec); 125| 0| } 126| | 127| 3.67k| m_alg_name = name[0].second; 128| | 129| 3.67k| bool in_modes = false; 130| | 131| 7.46k| for(size_t i = 1; i != name.size(); ++i) { ------------------ | Branch (131:22): [True: 3.78k, False: 3.67k] ------------------ 132| 3.78k| if(name[i].first == 0) { ------------------ | Branch (132:10): [True: 0, False: 3.78k] ------------------ 133| 0| m_mode_info.push_back(make_arg(name, i)); 134| 0| in_modes = true; 135| 3.78k| } else if(name[i].first == 1 && !in_modes) { ------------------ | Branch (135:17): [True: 3.78k, False: 0] | Branch (135:39): [True: 3.78k, False: 0] ------------------ 136| 3.78k| m_args.push_back(make_arg(name, i)); 137| 3.78k| } 138| 3.78k| } 139| 3.67k|} _ZNK5Botan9SCAN_Name3argEm: 141| 3.67k|std::string SCAN_Name::arg(size_t i) const { 142| 3.67k| if(i >= arg_count()) { ------------------ | Branch (142:7): [True: 0, False: 3.67k] ------------------ 143| 0| throw Invalid_Argument("SCAN_Name::arg " + std::to_string(i) + " out of range for '" + to_string() + "'"); 144| 0| } 145| 3.67k| return m_args[i]; 146| 3.67k|} _ZNK5Botan9SCAN_Name14arg_as_integerEmm: 155| 287|size_t SCAN_Name::arg_as_integer(size_t i, size_t def_value) const { 156| 287| if(i >= arg_count()) { ------------------ | Branch (156:7): [True: 179, False: 108] ------------------ 157| 179| return def_value; 158| 179| } 159| 108| return to_u32bit(m_args[i]); 160| 287|} scan_name.cpp:_ZN5Botan12_GLOBAL__N_18make_argERKNSt3__16vectorINS1_4pairImNS1_12basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEENS7_ISA_EEEEm: 18| 3.78k|std::string make_arg(const std::vector>& name, size_t start) { 19| 3.78k| std::string output = name[start].second; 20| 3.78k| size_t level = name[start].first; 21| | 22| 3.78k| size_t paren_depth = 0; 23| | 24| 3.78k| for(size_t i = start + 1; i != name.size(); ++i) { ------------------ | Branch (24:30): [True: 107, False: 3.67k] ------------------ 25| 107| if(name[i].first <= name[start].first) { ------------------ | Branch (25:10): [True: 107, False: 0] ------------------ 26| 107| break; 27| 107| } 28| | 29| 0| if(name[i].first > level) { ------------------ | Branch (29:10): [True: 0, False: 0] ------------------ 30| 0| for(size_t j = level; j < name[i].first; j++) { ------------------ | Branch (30:32): [True: 0, False: 0] ------------------ 31| 0| output += "("; 32| 0| ++paren_depth; 33| 0| } 34| 0| output += name[i].second; 35| 0| } else if(name[i].first < level) { ------------------ | Branch (35:17): [True: 0, False: 0] ------------------ 36| 0| for(size_t j = name[i].first; j < level; j++) { ------------------ | Branch (36:40): [True: 0, False: 0] ------------------ 37| 0| output += ")"; 38| 0| BOTAN_ASSERT_NOMSG(paren_depth != 0); ------------------ | | 77| 0| do { \ | | 78| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 0| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 0] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 0| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 0] | | ------------------ ------------------ 39| 0| --paren_depth; 40| 0| } 41| 0| output += "," + name[i].second; 42| 0| } else { 43| 0| if(output[output.size() - 1] != '(') { ------------------ | Branch (43:13): [True: 0, False: 0] ------------------ 44| 0| output += ","; 45| 0| } 46| 0| output += name[i].second; 47| 0| } 48| | 49| 0| level = name[i].first; 50| 0| } 51| | 52| 3.78k| for(size_t i = 0; i != paren_depth; ++i) { ------------------ | Branch (52:22): [True: 0, False: 3.78k] ------------------ 53| 0| output += ")"; 54| 0| } 55| | 56| 3.78k| return output; 57| 3.78k|} _ZN5Botan15AlternativeName7add_dnsENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 63| 6.24k|void AlternativeName::add_dns(std::string_view dns) { 64| 6.24k| if(dns.empty()) { ------------------ | Branch (64:7): [True: 0, False: 6.24k] ------------------ 65| 0| return; 66| 0| } 67| 6.24k| if(auto parsed = DNSName::from_san_string(dns)) { ------------------ | Branch (67:12): [True: 6.24k, False: 0] ------------------ 68| 6.24k| add_dns(std::move(*parsed)); 69| 6.24k| } else { 70| 0| throw Decoding_Error("Invalid DNS name in SubjectAlternativeName"); 71| 0| } 72| 6.24k|} _ZN5Botan15AlternativeName7add_dnsENS_7DNSNameE: 74| 6.24k|void AlternativeName::add_dns(DNSName dns) { 75| 6.24k| m_dns.insert(std::move(dns)); 76| 6.24k|} _ZNK5Botan15AlternativeName5countEv: 113| 6.24k|size_t AlternativeName::count() const { 114| 6.24k| const auto sum = checked_add(m_dns.size(), 115| 6.24k| m_uri.size(), 116| 6.24k| m_email.size(), 117| 6.24k| m_ipv4_addrs.size(), 118| 6.24k| m_ipv6_addrs.size(), 119| 6.24k| m_dn_names.size(), 120| 6.24k| m_other_name_values.size(), 121| 6.24k| m_registered_ids.size()); 122| | 123| 6.24k| BOTAN_ASSERT_NOMSG(sum.has_value()); ------------------ | | 77| 6.24k| do { \ | | 78| 6.24k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 79| 6.24k| if(!(expr)) { \ | | ------------------ | | | Branch (79:10): [True: 0, False: 6.24k] | | ------------------ | | 80| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 81| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 82| 0| } \ | | 83| 6.24k| } while(0) | | ------------------ | | | Branch (83:12): [Folded, False: 6.24k] | | ------------------ ------------------ 124| 6.24k| return sum.value(); 125| 6.24k|} _ZNK5Botan15AlternativeName9has_itemsEv: 127| 6.24k|bool AlternativeName::has_items() const { 128| 6.24k| return this->count() > 0; 129| 6.24k|} _ZN5Botan15AlternativeName11decode_fromERNS_11BER_DecoderE: 198| 6.24k|void AlternativeName::decode_from(BER_Decoder& source) { 199| 6.24k| BER_Decoder names = source.start_sequence(); 200| | 201| 12.4k| while(names.more_items()) { ------------------ | Branch (201:10): [True: 6.24k, False: 6.24k] ------------------ 202| 6.24k| const BER_Object obj = names.get_next_object(); 203| | 204| 6.24k| if(obj.is_a(0, ASN1_Class::ExplicitContextSpecific)) { ------------------ | Branch (204:10): [True: 0, False: 6.24k] ------------------ 205| 0| BER_Decoder othername(obj, names.limits()); 206| | 207| 0| OID oid; 208| 0| othername.decode(oid); 209| 0| const BER_Object othername_value_outer = othername.get_next_object(); 210| 0| othername.verify_end(); 211| | 212| 0| if(!othername_value_outer.is_a(0, ASN1_Class::ExplicitContextSpecific)) { ------------------ | Branch (212:13): [True: 0, False: 0] ------------------ 213| 0| throw Decoding_Error("Invalid tags on otherName value"); 214| 0| } 215| | 216| 0| BER_Decoder othername_value_inner(othername_value_outer, names.limits()); 217| | 218| 0| const BER_Object value = othername_value_inner.get_next_object(); 219| 0| othername_value_inner.verify_end(); 220| | 221| | // Capture the inner ANY value verbatim so applications can retrieve 222| | // it regardless of its ASN.1 form. 223| 0| std::vector raw_value; 224| 0| DER_Encoder(raw_value).add_object(value.type_tag(), value.class_tag(), value.data()); 225| 0| m_other_name_values.insert(OtherNameValue{oid, std::move(raw_value)}); 226| | 227| | // Populate old string view for compatibility 228| 0| if(ASN1_String::is_string_type(value.type()) && value.get_class() == ASN1_Class::Universal) { ------------------ | Branch (228:13): [True: 0, False: 0] | Branch (228:58): [True: 0, False: 0] ------------------ 229| 0| try { 230| 0| m_othernames.insert(std::make_pair(oid, ASN1_String(ASN1::to_string(value), value.type()))); 231| 0| } catch(const Invalid_Argument&) { // NOLINT(*-empty-catch) 232| 0| } 233| 0| } 234| | 235| 0| if(oid == OID::from_string("PKIX.SmtpUTF8Mailbox")) { ------------------ | Branch (235:13): [True: 0, False: 0] ------------------ 236| 0| if(!value.is_a(ASN1_Type::Utf8String, ASN1_Class::Universal)) { ------------------ | Branch (236:16): [True: 0, False: 0] ------------------ 237| 0| throw Decoding_Error("SmtpUTF8Mailbox otherName must contain a UTF8String"); 238| 0| } 239| 0| auto parsed_mailbox = SmtpUtf8Mailbox::from_string(ASN1::to_string(value)); 240| 0| if(!parsed_mailbox.has_value()) { ------------------ | Branch (240:16): [True: 0, False: 0] ------------------ 241| 0| throw Decoding_Error("Invalid SmtpUTF8Mailbox encoding"); 242| 0| } 243| 0| m_smtp_utf8_mailboxes.insert(std::move(*parsed_mailbox)); 244| 0| } 245| 6.24k| } else if(obj.is_a(1, ASN1_Class::ContextSpecific)) { ------------------ | Branch (245:17): [True: 0, False: 6.24k] ------------------ 246| 0| add_email(ASN1::to_string(obj)); 247| 6.24k| } else if(obj.is_a(2, ASN1_Class::ContextSpecific)) { ------------------ | Branch (247:17): [True: 6.24k, False: 0] ------------------ 248| 6.24k| add_dns(ASN1::to_string(obj)); 249| 6.24k| } else if(obj.is_a(3, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) { ------------------ | Branch (249:17): [True: 0, False: 0] ------------------ 250| | // x400Address not supported but it is a SEQUENCE so we know it cannot be empty 251| 0| if(obj.length() == 0) { ------------------ | Branch (251:13): [True: 0, False: 0] ------------------ 252| 0| throw Decoding_Error("Invalid x400Address field"); 253| 0| } 254| 0| } else if(obj.is_a(4, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) { ------------------ | Branch (254:17): [True: 0, False: 0] ------------------ 255| 0| BER_Decoder dec(obj, names.limits()); 256| 0| X509_DN dn; 257| 0| dec.decode(dn).verify_end(); 258| 0| this->add_dn(dn); 259| 0| } else if(obj.is_a(5, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) { ------------------ | Branch (259:17): [True: 0, False: 0] ------------------ 260| | // ediPartyName not supported but it is a SEQUENCE so we know it cannot be empty 261| 0| if(obj.length() == 0) { ------------------ | Branch (261:13): [True: 0, False: 0] ------------------ 262| 0| throw Decoding_Error("Invalid ediPartyName field"); 263| 0| } 264| 0| } else if(obj.is_a(6, ASN1_Class::ContextSpecific)) { ------------------ | Branch (264:17): [True: 0, False: 0] ------------------ 265| 0| this->add_uri(ASN1::to_string(obj)); 266| 0| } else if(obj.is_a(7, ASN1_Class::ContextSpecific)) { ------------------ | Branch (266:17): [True: 0, False: 0] ------------------ 267| 0| if(obj.length() == 4) { ------------------ | Branch (267:13): [True: 0, False: 0] ------------------ 268| 0| const uint32_t ip = load_be(obj.bits(), 0); 269| 0| this->add_ipv4_address(ip); 270| 0| } else if(obj.length() == 16) { ------------------ | Branch (270:20): [True: 0, False: 0] ------------------ 271| 0| const IPv6Address ip(std::span{obj.bits(), 16}); 272| 0| this->add_ipv6_address(ip); 273| 0| } else { 274| 0| throw Decoding_Error("Invalid IP constraint neither IPv4 or IPv6"); 275| 0| } 276| 0| } else if(obj.is_a(8, ASN1_Class::ContextSpecific)) { ------------------ | Branch (276:17): [True: 0, False: 0] ------------------ 277| | // [8] registeredID is IMPLICIT OBJECT IDENTIFIER. 278| 0| OID oid; 279| 0| names.decode_implicit(obj, oid, ASN1_Type::ObjectId, ASN1_Class::Universal); 280| 0| this->add_registered_id(oid); 281| 0| } else { 282| 0| throw Decoding_Error(fmt("Unknown GeneralName tag {}/class {}", 283| 0| static_cast(obj.type_tag()), 284| 0| static_cast(obj.class_tag()))); 285| 0| } 286| 6.24k| } 287| 6.24k|} _ZN5BotaneqERKNS_7X509_DNES2_: 339| 6.24k|bool operator==(const X509_DN& dn1, const X509_DN& dn2) { 340| 6.24k| return dn1._canonical_bytes() == dn2._canonical_bytes(); 341| 6.24k|} _ZN5Botan7X509_DN11decode_fromERNS_11BER_DecoderE: 408| 13.0k|void X509_DN::decode_from(BER_Decoder& source) { 409| 13.0k| std::vector bits; 410| | 411| 13.0k| source.start_sequence().raw_bytes(bits).end_cons(); 412| | 413| 13.0k| BER_Decoder sequence(bits, source.limits()); 414| | 415| 13.0k| std::vector>> rdns; 416| | 417| | // Cap AVAs per RDN to bound work for downstream set-based matching. 418| | // No legitimate cert has anywhere near this many AVAs in a single RDN. 419| 13.0k| constexpr size_t MAX_AVAS_PER_RDN = 32; 420| | 421| 51.0k| while(sequence.more_items()) { ------------------ | Branch (421:10): [True: 37.9k, False: 13.0k] ------------------ 422| 37.9k| BER_Decoder rdn_decoder = sequence.start_set(); 423| | 424| 37.9k| std::vector> rdn; 425| 75.9k| while(rdn_decoder.more_items()) { ------------------ | Branch (425:13): [True: 38.0k, False: 37.9k] ------------------ 426| 38.0k| OID oid; 427| 38.0k| ASN1_String str; 428| | 429| 38.0k| rdn_decoder.start_sequence() 430| 38.0k| .decode(oid) 431| 38.0k| .decode(str) // TODO support Any 432| 38.0k| .end_cons(); 433| | 434| 38.0k| rdn.emplace_back(std::move(oid), std::move(str)); 435| | 436| 38.0k| if(rdn.size() > MAX_AVAS_PER_RDN) { ------------------ | Branch (436:13): [True: 0, False: 38.0k] ------------------ 437| 0| throw Decoding_Error("X.500 RDN has too many attribute-value assertions"); 438| 0| } 439| 38.0k| } 440| | 441| | /* 442| | RFC 5280 4.1.2.4: 443| | RelativeDistinguishedName ::= 444| | SET SIZE (1..MAX) OF AttributeTypeAndValue 445| | */ 446| 37.9k| if(rdn.empty()) { ------------------ | Branch (446:10): [True: 1, False: 37.9k] ------------------ 447| 1| throw Decoding_Error("X.500 RDN must contain at least one attribute-value assertion"); 448| 1| } 449| 37.9k| rdns.push_back(std::move(rdn)); 450| 37.9k| } 451| | 452| 13.0k| auto canonical_bits = canonicalize_dn(rdns); 453| | 454| 13.0k| m_rdn = std::move(rdns); 455| 13.0k| m_dn_bits = std::move(bits); 456| 13.0k| m_canonical_dn_bits = std::move(canonical_bits); 457| 13.0k|} x509_dn.cpp:_ZN5Botan12_GLOBAL__N_115canonicalize_dnERKNSt3__16vectorINS2_INS1_4pairINS_3OIDENS_11ASN1_StringEEENS1_9allocatorIS6_EEEENS7_IS9_EEEE: 311| 12.6k|std::vector canonicalize_dn(const std::vector>>& rdns) { 312| 12.6k| auto append_canonical_data = [](std::vector& out, const T& data) { 313| 12.6k| const std::array data_len = store_le(static_cast(data.size())); 314| 12.6k| out.insert(out.end(), data_len.begin(), data_len.end()); 315| 12.6k| out.insert(out.end(), data.begin(), data.end()); 316| 12.6k| }; 317| | 318| 12.6k| std::vector canonical_bits; 319| | 320| 37.6k| for(const auto& rdn : rdns) { ------------------ | Branch (320:24): [True: 37.6k, False: 12.6k] ------------------ 321| 37.6k| std::vector rdn_bits; 322| | 323| 37.8k| for(const auto& [oid, value] : canonicalize_rdn(rdn)) { ------------------ | Branch (323:36): [True: 37.8k, False: 37.6k] ------------------ 324| 37.8k| append_canonical_data(rdn_bits, oid.BER_encode()); 325| 37.8k| append_canonical_data(rdn_bits, value); 326| 37.8k| } 327| | 328| 37.6k| append_canonical_data(canonical_bits, rdn_bits); 329| 37.6k| } 330| | 331| 12.6k| return canonical_bits; 332| 12.6k|} x509_dn.cpp:_ZN5Botan12_GLOBAL__N_116canonicalize_rdnERKNSt3__16vectorINS1_4pairINS_3OIDENS_11ASN1_StringEEENS1_9allocatorIS6_EEEE: 299| 37.6k|std::vector> canonicalize_rdn(const std::vector>& rdn) { 300| 37.6k| std::vector> result; 301| 37.6k| result.reserve(rdn.size()); 302| 37.8k| for(const auto& ava : rdn) { ------------------ | Branch (302:24): [True: 37.8k, False: 37.6k] ------------------ 303| 37.8k| result.emplace_back(ava.first, X500_Char_Iterator::canonicalize(ava.second.value())); 304| 37.8k| } 305| 37.6k| if(result.size() != 1) { ------------------ | Branch (305:7): [True: 54, False: 37.5k] ------------------ 306| 54| std::sort(result.begin(), result.end()); 307| 54| } 308| 37.6k| return result; 309| 37.6k|} x509_dn.cpp:_ZN5Botan12_GLOBAL__N_118X500_Char_Iterator12canonicalizeENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 115| 37.8k| static std::string canonicalize(std::string_view name) { 116| 37.8k| std::string result; 117| 37.8k| result.reserve(name.size()); 118| | 119| 37.8k| X500_Char_Iterator it(name); 120| 339k| while(auto c = it.next()) { ------------------ | Branch (120:21): [True: 301k, False: 37.8k] ------------------ 121| 301k| result += *c; 122| 301k| } 123| | 124| 37.8k| return result; 125| 37.8k| } x509_dn.cpp:_ZN5Botan12_GLOBAL__N_118X500_Char_IteratorC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 82| 37.8k| explicit X500_Char_Iterator(std::string_view s) : m_str(s), m_pos(0) { 83| | // Skip leading whitespace 84| 38.0k| while(m_pos < m_str.size() && is_space(m_str[m_pos])) { ------------------ | Branch (84:16): [True: 37.9k, False: 101] | Branch (84:40): [True: 232, False: 37.7k] ------------------ 85| 232| ++m_pos; 86| 232| } 87| 37.8k| } x509_dn.cpp:_ZN5Botan12_GLOBAL__N_118X500_Char_Iterator4nextEv: 90| 339k| std::optional next() { 91| 339k| if(m_pos >= m_str.size()) { ------------------ | Branch (91:13): [True: 37.7k, False: 301k] ------------------ 92| 37.7k| return std::nullopt; 93| 37.7k| } 94| | 95| 301k| if(is_space(m_str[m_pos])) { ------------------ | Branch (95:13): [True: 25.0k, False: 276k] ------------------ 96| | // Skip the entire whitespace run 97| 50.2k| while(m_pos < m_str.size() && is_space(m_str[m_pos])) { ------------------ | Branch (97:19): [True: 50.2k, False: 21] | Branch (97:43): [True: 25.2k, False: 25.0k] ------------------ 98| 25.2k| ++m_pos; 99| 25.2k| } 100| | // Emit a single space only if more content follows (strip trailing ws) 101| 25.0k| if(m_pos < m_str.size()) { ------------------ | Branch (101:16): [True: 25.0k, False: 21] ------------------ 102| 25.0k| return ' '; 103| 25.0k| } 104| 21| return std::nullopt; 105| 25.0k| } 106| | 107| 276k| const char c = m_str[m_pos++]; 108| | // Locale-independent ASCII fold; RFC 5280 DN matching does not depend on libc locale 109| 276k| if(c >= 'A' && c <= 'Z') { ------------------ | Branch (109:13): [True: 262k, False: 13.7k] | Branch (109:25): [True: 75.0k, False: 187k] ------------------ 110| 75.0k| return static_cast(c + ('a' - 'A')); 111| 75.0k| } 112| 201k| return c; 113| 276k| } x509_dn.cpp:_ZZN5Botan12_GLOBAL__N_115canonicalize_dnERKNSt3__16vectorINS2_INS1_4pairINS_3OIDENS_11ASN1_StringEEENS1_9allocatorIS6_EEEENS7_IS9_EEEEENK3$_0clINS2_IhNS7_IhEEEEEEDaRSH_RKT_: 312| 75.4k| auto append_canonical_data = [](std::vector& out, const T& data) { 313| 75.4k| const std::array data_len = store_le(static_cast(data.size())); 314| 75.4k| out.insert(out.end(), data_len.begin(), data_len.end()); 315| 75.4k| out.insert(out.end(), data.begin(), data.end()); 316| 75.4k| }; x509_dn.cpp:_ZZN5Botan12_GLOBAL__N_115canonicalize_dnERKNSt3__16vectorINS2_INS1_4pairINS_3OIDENS_11ASN1_StringEEENS1_9allocatorIS6_EEEENS7_IS9_EEEEENK3$_0clINS1_12basic_stringIcNS1_11char_traitsIcEENS7_IcEEEEEEDaRNS2_IhNS7_IhEEEERKT_: 312| 37.8k| auto append_canonical_data = [](std::vector& out, const T& data) { 313| 37.8k| const std::array data_len = store_le(static_cast(data.size())); 314| 37.8k| out.insert(out.end(), data_len.begin(), data_len.end()); 315| 37.8k| out.insert(out.end(), data.begin(), data.end()); 316| 37.8k| }; x509_dn.cpp:_ZN5Botan12_GLOBAL__N_18is_spaceEc: 27| 389k|bool is_space(char c) { 28| 389k| return c == ' ' || c == '\t'; ------------------ | Branch (28:11): [True: 50.2k, False: 339k] | Branch (28:23): [True: 220, False: 339k] ------------------ 29| 389k|} _ZN5Botan10Extensions15create_extn_objERKNS_3OIDEbRKNSt3__16vectorIhNS4_9allocatorIhEEEENS4_8optionalINS_17Extension_ContextEEE: 148| 24.9k| std::optional context) { 149| 24.9k| auto extn = extension_from_oid(oid); 150| | 151| 24.9k| if(!extn) { ------------------ | Branch (151:7): [True: 0, False: 24.9k] ------------------ 152| | // some other unknown extension type 153| 0| extn = std::make_unique(oid, critical); 154| 24.9k| } else { 155| 24.9k| if(context.has_value() && !extn->is_appropriate_context(*context)) { ------------------ | Branch (155:10): [True: 24.9k, False: 0] | Branch (155:33): [True: 0, False: 24.9k] ------------------ 156| 0| throw Decoding_Error(fmt("Extension {} is not allowed in this context", extn->oid_name())); 157| 0| } 158| | 159| 24.9k| try { 160| 24.9k| extn->decode_inner(body); 161| 24.9k| return extn; 162| 24.9k| } catch(const Exception&) { 163| | // OID was recognized but contents failed to decode 164| 0| extn = std::make_unique(oid, critical, /*failed_to_decode=*/true); 165| 0| } 166| 24.9k| } 167| | 168| | // This is always Unknown_Extension: 169| 0| extn->decode_inner(body); 170| 0| return extn; 171| 24.9k|} _ZNK5Botan10Extensions15Extensions_Info3objEv: 173| 24.9k|const Certificate_Extension& Extensions::Extensions_Info::obj() const { 174| 24.9k| BOTAN_ASSERT_NONNULL(m_obj.get()); ------------------ | | 116| 24.9k| do { \ | | 117| 24.9k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (117:10): [True: 0, False: 24.9k] | | ------------------ | | 118| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 119| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 120| 0| } \ | | 121| 24.9k| } while(0) | | ------------------ | | | Branch (121:12): [Folded, False: 24.9k] | | ------------------ ------------------ 175| 24.9k| return *m_obj; 176| 24.9k|} _ZNK5Botan10Extensions13extension_setERKNS_3OIDE: 235| 18.7k|bool Extensions::extension_set(const OID& oid) const { 236| 18.7k| return m_extension_info.contains(oid); 237| 18.7k|} _ZNK5Botan10Extensions20get_extension_objectERKNS_3OIDE: 256| 68.7k|const Certificate_Extension* Extensions::get_extension_object(const OID& oid) const { 257| 68.7k| auto extn = m_extension_info.find(oid); 258| 68.7k| if(extn == m_extension_info.end()) { ------------------ | Branch (258:7): [True: 43.7k, False: 24.9k] ------------------ 259| 43.7k| return nullptr; 260| 43.7k| } 261| | 262| 24.9k| return &extn->second.obj(); 263| 68.7k|} _ZN5Botan10Extensions11decode_fromERNS_11BER_DecoderENSt3__18optionalINS_17Extension_ContextEEE: 326| 6.24k|void Extensions::decode_from(BER_Decoder& from_source, std::optional context) { 327| 6.24k| m_extension_oids.clear(); 328| 6.24k| m_extension_info.clear(); 329| 6.24k| m_has_unknown_critical_extension = false; 330| | 331| 6.24k| BER_Decoder sequence = from_source.start_sequence(); 332| | 333| 31.2k| while(sequence.more_items()) { ------------------ | Branch (333:10): [True: 24.9k, False: 6.24k] ------------------ 334| 24.9k| OID oid; 335| 24.9k| bool critical = false; 336| 24.9k| std::vector bits; 337| | 338| 24.9k| sequence.start_sequence() 339| 24.9k| .decode(oid) 340| 24.9k| .decode_optional(critical, ASN1_Type::Boolean, ASN1_Class::Universal, false) 341| 24.9k| .decode(bits, ASN1_Type::OctetString) 342| 24.9k| .end_cons(); 343| | 344| 24.9k| auto obj = create_extn_obj(oid, critical, bits, context); 345| | // Unknown_Extension is the only Certificate_Extension with an empty oid_name 346| 24.9k| if(critical && obj->oid_name().empty()) { ------------------ | Branch (346:10): [True: 6.24k, False: 18.7k] | Branch (346:10): [True: 0, False: 24.9k] | Branch (346:22): [True: 0, False: 6.24k] ------------------ 347| 0| m_has_unknown_critical_extension = true; 348| 0| } 349| 24.9k| Extensions_Info info(critical, bits, std::move(obj)); 350| | 351| | // RFC 5280 4.2: "A certificate MUST NOT include more than one 352| | // instance of a particular extension." 353| 24.9k| if(!m_extension_info.emplace(oid, info).second) { ------------------ | Branch (353:10): [True: 0, False: 24.9k] ------------------ 354| 0| throw Decoding_Error("Duplicate certificate extension encountered"); 355| 0| } 356| 24.9k| m_extension_oids.push_back(oid); 357| 24.9k| } 358| 6.24k| sequence.verify_end(); 359| 6.24k|} _ZNK5Botan14Cert_Extension17Basic_Constraints22is_appropriate_contextENS_17Extension_ContextE: 363| 6.24k|bool Basic_Constraints::is_appropriate_context(Extension_Context context) const { 364| 6.24k| return context == Extension_Context::Certificate; 365| 6.24k|} _ZNK5Botan14Cert_Extension14Subject_Key_ID22is_appropriate_contextENS_17Extension_ContextE: 371| 6.24k|bool Subject_Key_ID::is_appropriate_context(Extension_Context context) const { 372| 6.24k| return context == Extension_Context::Certificate; 373| 6.24k|} _ZNK5Botan14Cert_Extension16Authority_Key_ID22is_appropriate_contextENS_17Extension_ContextE: 375| 6.24k|bool Authority_Key_ID::is_appropriate_context(Extension_Context context) const { 376| 6.24k| return context == Extension_Context::Certificate || context == Extension_Context::CRL; ------------------ | Branch (376:11): [True: 6.24k, False: 0] | Branch (376:56): [True: 0, False: 0] ------------------ 377| 6.24k|} _ZNK5Botan14Cert_Extension24Subject_Alternative_Name22is_appropriate_contextENS_17Extension_ContextE: 379| 6.24k|bool Subject_Alternative_Name::is_appropriate_context(Extension_Context context) const { 380| 6.24k| return context == Extension_Context::Certificate; 381| 6.24k|} _ZN5Botan14Cert_Extension17Basic_ConstraintsC2Ebm: 446| 6.24k| Basic_Constraints(is_ca, is_ca ? std::optional(path_length_constraint) : std::nullopt) {} ------------------ | Branch (446:32): [True: 0, False: 6.24k] ------------------ _ZN5Botan14Cert_Extension17Basic_ConstraintsC2EbNSt3__18optionalImEE: 449| 6.24k| m_is_ca(is_ca), m_path_length_constraint(path_length_constraint) { 450| 6.24k| if(!m_is_ca && m_path_length_constraint.has_value()) { ------------------ | Branch (450:7): [True: 6.24k, False: 0] | Branch (450:19): [True: 0, False: 6.24k] ------------------ 451| | // RFC 5280 Sec 4.2.1.9 "CAs MUST NOT include the pathLenConstraint field unless the cA boolean is asserted" 452| 0| throw Invalid_Argument( 453| 0| "Basic_Constraints nonsensical to set a path length constraint for a non-CA basicConstraints"); 454| 0| } 455| 6.24k|} _ZN5Botan14Cert_Extension17Basic_Constraints12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE: 486| 6.24k|void Basic_Constraints::decode_inner(const std::vector& in) { 487| | /* 488| | * RFC 5280 Section 4.2.1.9 489| | * 490| | * BasicConstraints ::= SEQUENCE { 491| | * cA BOOLEAN DEFAULT FALSE, 492| | * pathLenConstraint INTEGER (0..MAX) OPTIONAL } 493| | */ 494| 6.24k| BER_Decoder(in, BER_Decoder::Limits::DER()) 495| 6.24k| .start_sequence() 496| 6.24k| .decode_optional(m_is_ca, ASN1_Type::Boolean, ASN1_Class::Universal, false) 497| 6.24k| .decode_optional(m_path_length_constraint, ASN1_Type::Integer, ASN1_Class::Universal) 498| 6.24k| .end_cons() 499| 6.24k| .verify_end(); 500| | 501| | /* RFC 5280 Section 4.2.1.9: 502| | * "CAs MUST NOT include the pathLenConstraint field unless the cA boolean 503| | * is asserted and the key usage extension asserts the keyCertSign bit" */ 504| 6.24k| if(!m_is_ca && m_path_length_constraint.has_value()) { ------------------ | Branch (504:7): [True: 6.24k, False: 0] | Branch (504:19): [True: 0, False: 6.24k] ------------------ 505| 0| throw Decoding_Error("BasicConstraints pathLenConstraint must not be present when cA is FALSE"); 506| 0| } 507| 6.24k|} _ZN5Botan14Cert_Extension14Subject_Key_ID12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE: 554| 6.24k|void Subject_Key_ID::decode_inner(const std::vector& in) { 555| | /* RFC 5280 Section 4.2.1.2 - SubjectKeyIdentifier ::= KeyIdentifier */ 556| 6.24k| BER_Decoder(in, BER_Decoder::Limits::DER()).decode(m_key_id, ASN1_Type::OctetString).verify_end(); 557| | 558| 6.24k| if(m_key_id.empty()) { ------------------ | Branch (558:7): [True: 0, False: 6.24k] ------------------ 559| 0| throw Decoding_Error("SubjectKeyIdentifier must not be empty"); 560| 0| } 561| 6.24k| if(m_key_id.size() > MaximumKeyIdentifierLength) { ------------------ | Branch (561:7): [True: 0, False: 6.24k] ------------------ 562| 0| throw Decoding_Error( 563| 0| fmt("SubjectKeyIdentifier length {} exceeds limit of {} bytes", m_key_id.size(), MaximumKeyIdentifierLength)); 564| 0| } 565| 6.24k|} _ZN5Botan14Cert_Extension16Authority_Key_ID12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE: 624| 6.24k|void Authority_Key_ID::decode_inner(const std::vector& in) { 625| | /* 626| | * RFC 5280 Section 4.2.1.1 627| | * 628| | * AuthorityKeyIdentifier ::= SEQUENCE { 629| | * keyIdentifier [0] KeyIdentifier OPTIONAL, 630| | * authorityCertIssuer [1] GeneralNames OPTIONAL, 631| | * authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL } 632| | */ 633| 6.24k| BER_Decoder ber(in, BER_Decoder::Limits::DER()); 634| 6.24k| BER_Decoder seq = ber.start_sequence(); 635| | 636| 6.24k| m_key_id.clear(); 637| 6.24k| m_authority_cert.reset(); 638| | 639| 6.24k| bool key_id_present = false; 640| 6.24k| std::optional authority_cert_issuer; 641| 6.24k| std::optional authority_cert_serial; 642| | 643| 6.24k| seq.decode_optional_field(0, 644| 6.24k| ASN1_Class::ContextSpecific, 645| 6.24k| [&](BER_Decoder& d) { 646| 6.24k| d.decode(m_key_id, ASN1_Type::OctetString, ASN1_Type(0), ASN1_Class::ContextSpecific); 647| 6.24k| key_id_present = true; 648| 6.24k| }) 649| 6.24k| .decode_optional_field(1, 650| 6.24k| ASN1_Class::ContextSpecific | ASN1_Class::Constructed, 651| 6.24k| [&](BER_Decoder& d) { 652| 6.24k| AlternativeName names; 653| 6.24k| d.decode_implicit(names, 654| 6.24k| ASN1_Type(1), 655| 6.24k| ASN1_Class::ContextSpecific | ASN1_Class::Constructed, 656| 6.24k| ASN1_Type::Sequence, 657| 6.24k| ASN1_Class::Constructed); 658| 6.24k| authority_cert_issuer = std::move(names); 659| 6.24k| }) 660| 6.24k| .decode_optional_field(2, ASN1_Class::ContextSpecific, [&](BER_Decoder& d) { 661| 6.24k| X509_Serial_Number serial; 662| 6.24k| d.decode_implicit( 663| 6.24k| serial, ASN1_Type(2), ASN1_Class::ContextSpecific, ASN1_Type::Integer, ASN1_Class::Universal); 664| 6.24k| authority_cert_serial = std::move(serial); 665| 6.24k| }); 666| | 667| 6.24k| seq.end_cons(); 668| 6.24k| ber.verify_end(); 669| | 670| 6.24k| if(key_id_present) { ------------------ | Branch (670:7): [True: 6.24k, False: 0] ------------------ 671| 6.24k| if(m_key_id.empty()) { ------------------ | Branch (671:10): [True: 0, False: 6.24k] ------------------ 672| 0| throw Decoding_Error("AuthorityKeyIdentifier keyIdentifier must not be empty"); 673| 0| } 674| 6.24k| if(m_key_id.size() > MaximumKeyIdentifierLength) { ------------------ | Branch (674:10): [True: 0, False: 6.24k] ------------------ 675| 0| throw Decoding_Error(fmt("AuthorityKeyIdentifier keyIdentifier length {} exceeds limit of {} bytes", 676| 0| m_key_id.size(), 677| 0| MaximumKeyIdentifierLength)); 678| 0| } 679| 6.24k| } 680| | 681| | // RFC 5280 4.2.1.6: GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName 682| 6.24k| if(authority_cert_issuer.has_value() && authority_cert_issuer->is_empty()) { ------------------ | Branch (682:7): [True: 0, False: 6.24k] | Branch (682:44): [True: 0, False: 0] ------------------ 683| 0| throw Decoding_Error("AuthorityKeyIdentifier authorityCertIssuer must contain at least one GeneralName"); 684| 0| } 685| | 686| | /* 687| | * RFC 5280 Appendix A.2: 688| | * 689| | * authorityCertIssuer and authorityCertSerialNumber MUST both be 690| | * present or both be absent 691| | */ 692| 6.24k| if(authority_cert_issuer.has_value() != authority_cert_serial.has_value()) { ------------------ | Branch (692:7): [True: 0, False: 6.24k] ------------------ 693| 0| throw Decoding_Error( 694| 0| "AuthorityKeyIdentifier authorityCertIssuer and authorityCertSerialNumber must both be present or absent"); 695| 0| } 696| | 697| 6.24k| if(authority_cert_issuer.has_value()) { ------------------ | Branch (697:7): [True: 0, False: 6.24k] ------------------ 698| 0| m_authority_cert = 699| 0| Authority_Cert_Identifier{std::move(*authority_cert_issuer), std::move(*authority_cert_serial)}; 700| 0| } 701| 6.24k|} _ZN5Botan14Cert_Extension24Subject_Alternative_Name12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE: 724| 6.24k|void Subject_Alternative_Name::decode_inner(const std::vector& in) { 725| | /* RFC 5280 Section 4.2.1.6 - SubjectAltName ::= GeneralNames 726| | * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName */ 727| 6.24k| BER_Decoder(in, BER_Decoder::Limits::DER()).decode(m_alt_name).verify_end(); 728| 6.24k| if(!m_alt_name.has_items()) { ------------------ | Branch (728:7): [True: 0, False: 6.24k] ------------------ 729| 0| throw Decoding_Error("SubjectAlternativeName extension must contain at least one GeneralName"); 730| 0| } 731| 6.24k|} x509_ext.cpp:_ZN5Botan12_GLOBAL__N_118extension_from_oidERKNS_3OIDE: 55| 24.9k|std::unique_ptr extension_from_oid(const OID& oid) { 56| 24.9k| if(auto iso_ext = is_sub_element_of(oid, {2, 5, 29})) { ------------------ | Branch (56:12): [True: 24.9k, False: 0] ------------------ 57| | // NOLINTNEXTLINE(*-switch-missing-default-case) 58| 24.9k| switch(*iso_ext) { ------------------ | Branch (58:14): [True: 24.9k, False: 0] ------------------ 59| 6.24k| case 14: ------------------ | Branch (59:10): [True: 6.24k, False: 18.7k] ------------------ 60| 6.24k| return make_extension(oid); 61| 0| case 15: ------------------ | Branch (61:10): [True: 0, False: 24.9k] ------------------ 62| 0| return make_extension(oid); 63| 6.24k| case 17: ------------------ | Branch (63:10): [True: 6.24k, False: 18.7k] ------------------ 64| 6.24k| return make_extension(oid); 65| 0| case 18: ------------------ | Branch (65:10): [True: 0, False: 24.9k] ------------------ 66| 0| return make_extension(oid); 67| 6.24k| case 19: ------------------ | Branch (67:10): [True: 6.24k, False: 18.7k] ------------------ 68| 6.24k| return make_extension(oid); 69| 0| case 20: ------------------ | Branch (69:10): [True: 0, False: 24.9k] ------------------ 70| 0| return make_extension(oid); 71| 0| case 21: ------------------ | Branch (71:10): [True: 0, False: 24.9k] ------------------ 72| 0| return make_extension(oid); 73| 0| case 28: ------------------ | Branch (73:10): [True: 0, False: 24.9k] ------------------ 74| 0| return make_extension(oid); 75| 0| case 30: ------------------ | Branch (75:10): [True: 0, False: 24.9k] ------------------ 76| 0| return make_extension(oid); 77| 0| case 31: ------------------ | Branch (77:10): [True: 0, False: 24.9k] ------------------ 78| 0| return make_extension(oid); 79| 0| case 32: ------------------ | Branch (79:10): [True: 0, False: 24.9k] ------------------ 80| 0| return make_extension(oid); 81| 6.24k| case 35: ------------------ | Branch (81:10): [True: 6.24k, False: 18.7k] ------------------ 82| 6.24k| return make_extension(oid); 83| 0| case 37: ------------------ | Branch (83:10): [True: 0, False: 24.9k] ------------------ 84| 0| return make_extension(oid); 85| 0| case 56: ------------------ | Branch (85:10): [True: 0, False: 24.9k] ------------------ 86| 0| return make_extension(oid); 87| 24.9k| } 88| 24.9k| } 89| | 90| 0| if(auto pkix_ext = is_sub_element_of(oid, {1, 3, 6, 1, 5, 5, 7, 1})) { ------------------ | Branch (90:12): [True: 0, False: 0] ------------------ 91| | // NOLINTNEXTLINE(*-switch-missing-default-case) 92| 0| switch(*pkix_ext) { ------------------ | Branch (92:14): [True: 0, False: 0] ------------------ 93| 0| case 1: ------------------ | Branch (93:10): [True: 0, False: 0] ------------------ 94| 0| return make_extension(oid); 95| 0| case 7: ------------------ | Branch (95:10): [True: 0, False: 0] ------------------ 96| 0| return make_extension(oid); 97| 0| case 8: ------------------ | Branch (97:10): [True: 0, False: 0] ------------------ 98| 0| return make_extension(oid); 99| 0| case 26: ------------------ | Branch (99:10): [True: 0, False: 0] ------------------ 100| 0| return make_extension(oid); 101| 0| } 102| 0| } 103| | 104| 0| if(oid == Cert_Extension::OCSP_NoCheck::static_oid()) { ------------------ | Branch (104:7): [True: 0, False: 0] ------------------ 105| 0| return make_extension(oid); 106| 0| } 107| | 108| 0| return nullptr; // unknown 109| 0|} x509_ext.cpp:_ZN5Botan12_GLOBAL__N_114make_extensionITkNSt3__112derived_fromINS_21Certificate_ExtensionEEENS_14Cert_Extension14Subject_Key_IDEEEDaRKNS_3OIDE: 50| 6.24k|auto make_extension([[maybe_unused]] const OID& oid) { 51| 6.24k| BOTAN_DEBUG_ASSERT(oid == T::static_oid()); ------------------ | | 130| 6.24k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 6.24k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 6.24k] | | ------------------ ------------------ 52| 6.24k| return std::make_unique(); 53| 6.24k|} x509_ext.cpp:_ZN5Botan12_GLOBAL__N_114make_extensionITkNSt3__112derived_fromINS_21Certificate_ExtensionEEENS_14Cert_Extension24Subject_Alternative_NameEEEDaRKNS_3OIDE: 50| 6.24k|auto make_extension([[maybe_unused]] const OID& oid) { 51| 6.24k| BOTAN_DEBUG_ASSERT(oid == T::static_oid()); ------------------ | | 130| 6.24k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 6.24k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 6.24k] | | ------------------ ------------------ 52| 6.24k| return std::make_unique(); 53| 6.24k|} x509_ext.cpp:_ZN5Botan12_GLOBAL__N_114make_extensionITkNSt3__112derived_fromINS_21Certificate_ExtensionEEENS_14Cert_Extension17Basic_ConstraintsEEEDaRKNS_3OIDE: 50| 6.24k|auto make_extension([[maybe_unused]] const OID& oid) { 51| 6.24k| BOTAN_DEBUG_ASSERT(oid == T::static_oid()); ------------------ | | 130| 6.24k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 6.24k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 6.24k] | | ------------------ ------------------ 52| 6.24k| return std::make_unique(); 53| 6.24k|} x509_ext.cpp:_ZN5Botan12_GLOBAL__N_114make_extensionITkNSt3__112derived_fromINS_21Certificate_ExtensionEEENS_14Cert_Extension16Authority_Key_IDEEEDaRKNS_3OIDE: 50| 6.24k|auto make_extension([[maybe_unused]] const OID& oid) { 51| 6.24k| BOTAN_DEBUG_ASSERT(oid == T::static_oid()); ------------------ | | 130| 6.24k| do { /* NOLINT(*-avoid-do-while) */ \ | | 131| 6.24k| } while(0) | | ------------------ | | | Branch (131:15): [Folded, False: 6.24k] | | ------------------ ------------------ 52| 6.24k| return std::make_unique(); 53| 6.24k|} x509_ext.cpp:_ZZN5Botan14Cert_Extension16Authority_Key_ID12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEEENK3$_0clERNS_11BER_DecoderE: 645| 6.24k| [&](BER_Decoder& d) { 646| 6.24k| d.decode(m_key_id, ASN1_Type::OctetString, ASN1_Type(0), ASN1_Class::ContextSpecific); 647| 6.24k| key_id_present = true; 648| 6.24k| }) _ZN5Botan11X509_Object9load_dataERNS_10DataSourceE: 24| 6.73k|void X509_Object::load_data(DataSource& in) { 25| 6.73k| try { 26| 6.73k| if(ASN1::maybe_BER(in) && !PEM_Code::matches(in)) { ------------------ | Branch (26:10): [True: 451, False: 6.28k] | Branch (26:33): [True: 451, False: 0] ------------------ 27| 451| BER_Decoder dec(in, BER_Decoder::Limits::DER()); 28| 451| decode_from(dec); 29| | // Call to verify_end omitted here since we have to sometimes decode 30| | // multiple certificates encoded sequentially in a DataSource 31| 6.28k| } else { 32| 6.28k| std::string got_label; 33| 6.28k| DataSource_Memory ber(PEM_Code::decode(in, got_label)); 34| | 35| 6.28k| if(got_label != PEM_label()) { ------------------ | Branch (35:13): [True: 0, False: 6.28k] ------------------ 36| 0| bool is_alternate = false; 37| 0| for(const std::string_view alt_label : alternate_PEM_labels()) { ------------------ | Branch (37:50): [True: 0, False: 0] ------------------ 38| 0| if(got_label == alt_label) { ------------------ | Branch (38:19): [True: 0, False: 0] ------------------ 39| 0| is_alternate = true; 40| 0| break; 41| 0| } 42| 0| } 43| | 44| 0| if(!is_alternate) { ------------------ | Branch (44:16): [True: 0, False: 0] ------------------ 45| 0| throw Decoding_Error("Unexpected PEM label for " + PEM_label() + " of " + got_label); 46| 0| } 47| 0| } 48| | 49| 6.28k| BER_Decoder dec(ber, BER_Decoder::Limits::DER()); 50| 6.28k| decode_from(dec); 51| | // Call to verify_end omitted here since we have to sometimes decode 52| | // multiple certificates encoded sequentially in a DataSource 53| 6.28k| } 54| 6.73k| } catch(Decoding_Error& e) { 55| 489| throw Decoding_Error(PEM_label() + " decoding", e); 56| 489| } 57| 6.73k|} _ZNK5Botan11X509_Object9signatureEv: 59| 6.25k|const std::vector& X509_Object::signature() const { 60| 6.25k| if(!m_signed_data) { ------------------ | Branch (60:7): [True: 0, False: 6.25k] ------------------ 61| 0| throw Invalid_State("X509_Object uninitialized"); 62| 0| } 63| 6.25k| return m_signed_data->m_sig; 64| 6.25k|} _ZNK5Botan11X509_Object11signed_bodyEv: 66| 12.5k|const std::vector& X509_Object::signed_body() const { 67| 12.5k| if(!m_signed_data) { ------------------ | Branch (67:7): [True: 0, False: 12.5k] ------------------ 68| 0| throw Invalid_State("X509_Object uninitialized"); 69| 0| } 70| 12.5k| return m_signed_data->m_tbs_bits; 71| 12.5k|} _ZNK5Botan11X509_Object19signature_algorithmEv: 73| 12.5k|const AlgorithmIdentifier& X509_Object::signature_algorithm() const { 74| 12.5k| if(!m_signed_data) { ------------------ | Branch (74:7): [True: 0, False: 12.5k] ------------------ 75| 0| throw Invalid_State("X509_Object uninitialized"); 76| 0| } 77| 12.5k| return m_signed_data->m_sig_algo; 78| 12.5k|} _ZNK5Botan11X509_Object11encode_intoERNS_11DER_EncoderE: 80| 6.25k|void X509_Object::encode_into(DER_Encoder& to) const { 81| 6.25k| to.start_sequence() 82| 6.25k| .start_sequence() 83| 6.25k| .raw_bytes(signed_body()) 84| 6.25k| .end_cons() 85| 6.25k| .encode(signature_algorithm()) 86| 6.25k| .encode_octet_aligned_bitstring(signature()) 87| 6.25k| .end_cons(); 88| 6.25k|} _ZN5Botan11X509_Object11decode_fromERNS_11BER_DecoderE: 93| 6.70k|void X509_Object::decode_from(BER_Decoder& from) { 94| 6.70k| auto data = std::make_shared(); 95| | 96| 6.70k| from.start_sequence() 97| 6.70k| .start_sequence() 98| 6.70k| .raw_bytes(data->m_tbs_bits) 99| 6.70k| .end_cons() 100| 6.70k| .decode(data->m_sig_algo) 101| 6.70k| .decode_octet_aligned_bitstring(data->m_sig) 102| 6.70k| .end_cons(); 103| | 104| 6.70k| m_signed_data = std::move(data); 105| 6.70k| force_decode(); 106| 6.70k|} _ZN5Botan18X509_Serial_NumberC2ERKNS_6BigIntE: 20| 6.29k|X509_Serial_Number::X509_Serial_Number(const BigInt& value) : m_contents(ASN1::integer_contents(value)) {} _ZNK5Botan18X509_Serial_Number11is_negativeEv: 65| 6.24k|bool X509_Serial_Number::is_negative() const { 66| 6.24k| BOTAN_STATE_CHECK(!m_contents.empty()); ------------------ | | 51| 6.24k| do { \ | | 52| 6.24k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 6.24k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 6.24k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 6.24k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 6.24k] | | ------------------ ------------------ 67| 6.24k| return (m_contents[0] & 0x80) == 0x80; 68| 6.24k|} _ZNK5Botan18X509_Serial_Number7is_zeroEv: 70| 6.24k|bool X509_Serial_Number::is_zero() const { 71| 6.24k| return m_contents.size() == 1 && m_contents[0] == 0x00; ------------------ | Branch (71:11): [True: 0, False: 6.24k] | Branch (71:37): [True: 0, False: 0] ------------------ 72| 6.24k|} _ZNK5Botan18X509_Serial_Number9magnitudeEv: 74| 6.24k|std::vector X509_Serial_Number::magnitude() const { 75| 6.24k| BOTAN_STATE_CHECK(!m_contents.empty()); ------------------ | | 51| 6.24k| do { \ | | 52| 6.24k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 6.24k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 6.24k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 6.24k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 6.24k] | | ------------------ ------------------ 76| | 77| 6.24k| if(is_zero()) { ------------------ | Branch (77:7): [True: 0, False: 6.24k] ------------------ 78| 0| return {}; 79| 6.24k| } else if(is_negative()) { ------------------ | Branch (79:14): [True: 0, False: 6.24k] ------------------ 80| 0| return to_bigint().serialize(); 81| 6.24k| } else if(m_contents[0] == 0x00) { ------------------ | Branch (81:14): [True: 6.24k, False: 0] ------------------ 82| | // Positive value whose leading magnitude bit is set; skip the sign octet 83| 6.24k| return {m_contents.begin() + 1, m_contents.end()}; 84| 6.24k| } else { 85| 0| return m_contents; 86| 0| } 87| 6.24k|} _ZN5Botan18X509_Serial_Number11decode_fromERNS_11BER_DecoderE: 108| 6.33k|void X509_Serial_Number::decode_from(BER_Decoder& from) { 109| | // Decode via BigInt so the decoder's limits apply, in particular the 110| | // rejection of non-minimal INTEGER encodings in DER mode 111| 6.33k| BigInt value; 112| 6.33k| from.decode(value); 113| 6.33k| *this = X509_Serial_Number(value); 114| 6.33k|} _ZN5Botan16X509_CertificateD2Ev: 86| 12.2k|X509_Certificate::~X509_Certificate() = default; _ZNK5Botan16X509_Certificate9PEM_labelEv: 88| 6.73k|std::string X509_Certificate::PEM_label() const { 89| 6.73k| return "CERTIFICATE"; 90| 6.73k|} _ZN5Botan16X509_CertificateC2ERNS_10DataSourceE: 96| 6.24k|X509_Certificate::X509_Certificate(DataSource& src) { 97| 6.24k| load_data(src); 98| 6.24k|} _ZN5Botan16X509_CertificateC2ENSt3__14spanIKhLm18446744073709551615EEE: 100| 490|X509_Certificate::X509_Certificate(std::span in) { 101| 490| DataSource_Memory src(in); 102| 490| load_data(src); 103| 490|} _ZN5Botan16X509_Certificate12force_decodeEv: 368| 6.33k|void X509_Certificate::force_decode() { 369| 6.33k| m_data.reset(); 370| 6.33k| m_data = parse_x509_cert_body(*this); 371| 6.33k|} x509cert.cpp:_ZN5Botan12_GLOBAL__N_120parse_x509_cert_bodyERKNS_11X509_ObjectE: 114| 6.33k|std::unique_ptr parse_x509_cert_body(const X509_Object& obj) { 115| 6.33k| auto data = std::make_unique(); 116| | 117| 6.33k| BER_Object public_key; 118| 6.33k| BER_Object v3_exts_data; 119| | 120| 6.33k| BER_Decoder(obj.signed_body(), BER_Decoder::Limits::DER()) 121| 6.33k| .decode_optional(data->m_version, ASN1_Type(0), ASN1_Class::Constructed | ASN1_Class::ContextSpecific) 122| 6.33k| .decode(data->m_serial) 123| 6.33k| .decode(data->m_sig_algo_inner) 124| 6.33k| .decode(data->m_issuer_dn) 125| 6.33k| .start_sequence() 126| 6.33k| .decode(data->m_not_before) 127| 6.33k| .decode(data->m_not_after) 128| 6.33k| .end_cons() 129| 6.33k| .decode(data->m_subject_dn) 130| 6.33k| .get_next(public_key) 131| 6.33k| .decode_optional_string(data->m_v2_issuer_key_id, ASN1_Type::BitString, 1) 132| 6.33k| .decode_optional_string(data->m_v2_subject_key_id, ASN1_Type::BitString, 2) 133| 6.33k| .get_next(v3_exts_data) 134| 6.33k| .verify_end("TBSCertificate has extra data after extensions block"); 135| | 136| 6.33k| if(data->m_version > 2) { ------------------ | Branch (136:7): [True: 0, False: 6.33k] ------------------ 137| 0| throw Decoding_Error("Unknown X.509 cert version " + std::to_string(data->m_version)); 138| 0| } 139| 6.33k| if(obj.signature_algorithm() != data->m_sig_algo_inner) { ------------------ | Branch (139:7): [True: 0, False: 6.33k] ------------------ 140| 0| throw Decoding_Error("X.509 Certificate had differing algorithm identifiers in inner and outer ID fields"); 141| 0| } 142| | 143| 6.33k| public_key.assert_is_a(ASN1_Type::Sequence, ASN1_Class::Constructed, "X.509 certificate public key"); 144| | 145| | // for general sanity convert wire version (0 based) to standards version (v1 .. v3) 146| 6.33k| data->m_version += 1; 147| | 148| 6.33k| data->m_serial_bits = data->m_serial.magnitude(); 149| 6.33k| data->m_subject_dn_bits = ASN1::put_in_sequence(data->m_subject_dn.get_bits()); 150| 6.33k| data->m_issuer_dn_bits = ASN1::put_in_sequence(data->m_issuer_dn.get_bits()); 151| | 152| 6.33k| data->m_subject_public_key_bits.assign(public_key.bits(), public_key.bits() + public_key.length()); 153| | 154| 6.33k| data->m_subject_public_key_bits_seq = ASN1::put_in_sequence(data->m_subject_public_key_bits); 155| | 156| 6.33k| BER_Decoder(data->m_subject_public_key_bits, BER_Decoder::Limits::DER()) 157| 6.33k| .decode(data->m_subject_public_key_algid) 158| 6.33k| .decode_octet_aligned_bitstring(data->m_subject_public_key_bitstring) 159| 6.33k| .verify_end(); 160| | 161| 6.33k| if(v3_exts_data.is_a(3, ASN1_Class::Constructed | ASN1_Class::ContextSpecific)) { ------------------ | Branch (161:7): [True: 6.24k, False: 85] ------------------ 162| | // Path validation will reject a v1/v2 cert with v3 extensions 163| 6.24k| BER_Decoder cert_extensions(v3_exts_data, BER_Decoder::Limits::DER()); 164| 6.24k| data->m_v3_extensions.decode_from(cert_extensions, Extension_Context::Certificate); 165| 6.24k| cert_extensions.verify_end(); 166| 6.24k| } else if(v3_exts_data.is_set()) { ------------------ | Branch (166:14): [True: 0, False: 85] ------------------ 167| 0| throw BER_Bad_Tag("Unknown tag in X.509 cert", v3_exts_data.tagging()); 168| 0| } 169| | 170| | // Now cache some fields from the extensions 171| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (171:19): [True: 0, False: 6.33k] ------------------ 172| 0| data->m_key_constraints = ext->get_constraints(); 173| | /* 174| | RFC 5280: When the keyUsage extension appears in a certificate, 175| | at least one of the bits MUST be set to 1. 176| | */ 177| 0| if(data->m_key_constraints.empty()) { ------------------ | Branch (177:10): [True: 0, False: 0] ------------------ 178| 0| throw Decoding_Error("Certificate has invalid encoding for KeyUsage"); 179| 0| } 180| 0| } 181| | 182| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (182:19): [True: 6.24k, False: 85] ------------------ 183| 6.24k| data->m_subject_key_id = ext->get_key_id(); 184| 6.24k| } 185| | 186| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (186:19): [True: 6.24k, False: 85] ------------------ 187| 6.24k| data->m_authority_key_id = ext->get_key_id(); 188| 6.24k| } 189| | 190| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (190:19): [True: 0, False: 6.33k] ------------------ 191| 0| data->m_name_constraints = ext->get_name_constraints(); 192| 0| } 193| | 194| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (194:19): [True: 0, False: 6.33k] ------------------ 195| 0| data->m_extended_key_usage = ext->object_identifiers(); 196| | /* 197| | RFC 5280 section 4.2.1.12 198| | 199| | "This extension indicates one or more purposes ..." 200| | 201| | "If the extension is present, then the certificate MUST only be 202| | used for one of the purposes indicated." 203| | 204| | Thus we reject an EKU extension which is empty, since this indicates 205| | the certificate cannot be used for any purpose. 206| | */ 207| 0| if(data->m_extended_key_usage.empty()) { ------------------ | Branch (207:10): [True: 0, False: 0] ------------------ 208| 0| throw Decoding_Error("Certificate has invalid empty EKU extension"); 209| 0| } 210| 0| } 211| | 212| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (212:19): [True: 6.24k, False: 85] ------------------ 213| | /* 214| | * RFC 5280 4.2.1.9 requires that conforming CAs "MUST mark the 215| | * extension [basicConstraints] as critical in such certificates" 216| | * but places no such requirement on validators. 217| | */ 218| 6.24k| if(ext->is_ca() == true) { ------------------ | Branch (218:10): [True: 0, False: 6.24k] ------------------ 219| | /* 220| | * RFC 5280 section 4.2.1.3 requires that CAs include KeyUsage in all 221| | * intermediate CA certificates they issue. Currently we accept it being 222| | * missing, as do most other implementations. But it may be worth 223| | * removing this entirely, or alternately adding a warning level 224| | * validation failure for it. 225| | */ 226| 0| const bool allowed_by_ku = 227| 0| data->m_key_constraints.includes(Key_Constraints::KeyCertSign) || data->m_key_constraints.empty(); ------------------ | Branch (227:13): [True: 0, False: 0] | Branch (227:79): [True: 0, False: 0] ------------------ 228| | 229| | /* 230| | * If the extended key usages are set then we must restrict the usage in 231| | * accordance with it as well. 232| | * 233| | * RFC 5280 does not define any extended key usages compatible with certificate 234| | * signing, but some CAs use serverAuth, clientAuth, OCSPSigning, or AnyExtendedKeyUsage 235| | * for this purpose, even though clearly all of these (besides AEKU) are invalid. 236| | * This check at least allows excluding a certificate which is set for only eg 237| | * timestamping or code signing, and that seems about the best we can possibly enforce. 238| | * OpenSSL, BoringSSL, and Go all completely ignore EKUs in determining ability to 239| | * issue certs. 240| | */ 241| 0| const bool allowed_by_ext_ku = [](const std::vector& ext_ku) -> bool { 242| 0| if(ext_ku.empty()) { 243| 0| return true; 244| 0| } 245| | 246| 0| const auto server_auth = OID::from_name("PKIX.ServerAuth"); 247| 0| const auto client_auth = OID::from_name("PKIX.ClientAuth"); 248| 0| const auto ocsp_sign = OID::from_name("PKIX.OCSPSigning"); 249| 0| const auto any_eku = OID::from_name("X509v3.AnyExtendedKeyUsage"); 250| | 251| 0| for(const auto& oid : ext_ku) { 252| 0| if(oid == any_eku || oid == server_auth || oid == client_auth || oid == ocsp_sign) { 253| 0| return true; 254| 0| } 255| 0| } 256| | 257| 0| return false; 258| 0| }(data->m_extended_key_usage); 259| | 260| 0| if(allowed_by_ku && allowed_by_ext_ku) { ------------------ | Branch (260:13): [True: 0, False: 0] | Branch (260:30): [True: 0, False: 0] ------------------ 261| 0| data->m_is_ca_certificate = true; 262| 0| data->m_path_len_constraint = ext->path_length_constraint(); 263| 0| } 264| 0| } 265| 6.24k| } 266| | 267| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (267:19): [True: 0, False: 6.33k] ------------------ 268| 0| data->m_issuer_alt_name = ext->get_alt_name(); 269| 0| } 270| | 271| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (271:19): [True: 6.24k, False: 85] ------------------ 272| 6.24k| data->m_subject_alt_name = ext->get_alt_name(); 273| 6.24k| } 274| | 275| | // This will be set even if SAN parsing failed entirely eg due to a decoding error 276| | // or if the SAN is empty. This is used to guard against using the CN for domain 277| | // name checking. 278| 6.33k| const auto san_oid = OID::from_string("X509v3.SubjectAlternativeName"); 279| 6.33k| data->m_subject_alt_name_exists = data->m_v3_extensions.extension_set(san_oid); 280| | 281| | /* 282| | * RFC 9608 Section 4: 283| | * 284| | * If the noRevAvail certificate extension specified in this document is 285| | * present or the ocsp-nocheck certificate extension [RFC6960] is 286| | * present, then Step (a)(3) is skipped. Otherwise, revocation status 287| | * determination of the certificate is performed. 288| | */ 289| 6.33k| data->m_skip_revocation_check = 290| 6.33k| data->m_v3_extensions.extension_set(Cert_Extension::NoRevocationAvailable::static_oid()) || ------------------ | Branch (290:7): [True: 85, False: 6.24k] ------------------ 291| 6.24k| data->m_v3_extensions.extension_set(Cert_Extension::OCSP_NoCheck::static_oid()); ------------------ | Branch (291:7): [True: 0, False: 6.24k] ------------------ 292| | 293| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (293:19): [True: 0, False: 6.33k] ------------------ 294| 0| data->m_cert_policies = ext->get_policy_oids(); 295| 0| } 296| | 297| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (297:19): [True: 0, False: 6.33k] ------------------ 298| 0| data->m_ocsp_responders = ext->ocsp_responder_uris(); 299| 0| data->m_ca_issuers = ext->ca_issuer_uris(); 300| 0| } 301| | 302| 6.33k| if(const auto* ext = data->m_v3_extensions.get_extension_object_as()) { ------------------ | Branch (302:19): [True: 0, False: 6.33k] ------------------ 303| 0| data->m_crl_distribution_points = ext->crl_distribution_point_uris(); 304| 0| } 305| | 306| | /* 307| | Determine if this certificate appears to be self-issued (subject == issuer). 308| | This is only a heuristic used for path building so it's ok it is not precise. 309| | The self-signature is verified during path validation. 310| | */ 311| 6.33k| if(data->m_subject_dn == data->m_issuer_dn) { ------------------ | Branch (311:7): [True: 6.24k, False: 85] ------------------ 312| 6.24k| if(!data->m_subject_key_id.empty() && !data->m_authority_key_id.empty()) { ------------------ | Branch (312:10): [True: 6.24k, False: 0] | Branch (312:45): [True: 6.24k, False: 0] ------------------ 313| | /* 314| | Both SKID and AKID are set so we can reliably determine self-signed vs 315| | self-issued by comparing the two 316| | */ 317| 6.24k| data->m_self_signed = (data->m_subject_key_id == data->m_authority_key_id); 318| 6.24k| } else { 319| | /* 320| | Without both SKID and AKID we can't determine with certainty. Assume 321| | self-signed since that's by far the common case. 322| | */ 323| 0| data->m_self_signed = true; 324| 0| } 325| 6.24k| } 326| | 327| 6.33k| const std::vector full_encoding = obj.BER_encode(); 328| | 329| 6.33k| if(auto sha1 = HashFunction::create("SHA-1")) { ------------------ | Branch (329:12): [True: 6.24k, False: 85] ------------------ 330| 6.24k| sha1->update(data->m_subject_public_key_bitstring); 331| 6.24k| data->m_subject_public_key_bitstring_sha1 = sha1->final_stdvec(); 332| | // otherwise left as empty, and we will throw if subject_public_key_bitstring_sha1 is called 333| | 334| 6.24k| sha1->update(full_encoding); 335| 6.24k| sha1->final(data->m_cert_data_sha1); 336| 6.24k| data->m_fingerprint_sha1 = format_hex_fingerprint(data->m_cert_data_sha1); 337| | 338| 6.24k| sha1->update(data->m_issuer_dn_bits); 339| 6.24k| sha1->final(data->m_issuer_dn_bits_sha1); 340| | 341| 6.24k| sha1->update(data->m_subject_dn_bits); 342| 6.24k| sha1->final(data->m_subject_dn_bits_sha1); 343| 6.24k| } 344| | 345| | // SHA-256 is a hard dependency of this module 346| 6.33k| auto sha256 = HashFunction::create_or_throw("SHA-256"); 347| 6.33k| sha256->update(data->m_issuer_dn_bits); 348| 6.33k| data->m_issuer_dn_bits_sha256 = sha256->final_stdvec(); 349| | 350| 6.33k| sha256->update(data->m_subject_dn_bits); 351| 6.33k| data->m_subject_dn_bits_sha256 = sha256->final_stdvec(); 352| | 353| 6.33k| sha256->update(full_encoding); 354| 6.33k| sha256->final(data->m_cert_data_sha256); 355| 6.33k| data->m_fingerprint_sha256 = format_hex_fingerprint(data->m_cert_data_sha256); 356| | 357| 6.33k| sha256->update(data->m_subject_public_key_bitstring); 358| 6.33k| sha256->final(data->m_subject_public_key_bitstring_sha256); 359| | 360| 6.33k| return data; 361| 6.33k|}