_ZNK5Botan16AlgorithmPattern9to_stringEv: 98| 132| std::string_view to_string() const { return m_text; } _ZNK5Botan16AlgorithmPattern8any_headEv: 103| 748| bool any_head() const { return m_head_count == 0; } _ZNK5Botan16AlgorithmPattern17head_alternativesEv: 105| 748| std::span head_alternatives() const { return std::span(m_heads).first(m_head_count); } _ZNK5Botan16AlgorithmPattern8elementsEv: 107| 264| std::span elements() const { return std::span(m_elements).first(m_element_count); } _ZNK5Botan13AlgorithmSpec4headEv: 171| 132| std::string_view head() const { return m_head; } _ZNK5Botan14AlgorithmMatch4headEv: 240| 88| std::string_view head() const { return m_head; } _ZNK5Botan13AlgorithmSpec7matchesERKNS_16AlgorithmPatternE: 292| 176|inline bool AlgorithmSpec::matches(const AlgorithmPattern& pattern) const { 293| 176| return match(pattern).has_value(); 294| 176|} _ZN5Botan13AlgorithmSpecC2Ev: 212| 440| AlgorithmSpec() = default; _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EEC2Ev: 62| 38| AlignmentBuffer() = default; _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE5clearEv: 71| 76| void clear() { 72| 76| zeroize_buffer(m_buffer.data(), m_buffer.size()); 73| 76| m_position = 0; 74| 76| } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EED2Ev: 64| 38| ~AlignmentBuffer() { secure_zeroize_buffer(m_buffer.data(), sizeof(T) * m_buffer.size()); } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE21handle_unaligned_dataERNS_12BufferSlicerE: 166| 38| [[nodiscard]] std::optional> handle_unaligned_data(BufferSlicer& slicer) { 167| | // When the final block is to be deferred, we would need to store and 168| | // hold a buffer that contains exactly one block until more data is 169| | // passed or it is explicitly consumed. 170| 38| const size_t defer = (defers_final_block()) ? 1 : 0; ------------------ | Branch (170:31): [True: 0, False: 38] ------------------ 171| | 172| 38| if(in_alignment() && slicer.remaining() >= m_buffer.size() + defer) { ------------------ | Branch (172:13): [True: 38, False: 0] | Branch (172:31): [True: 0, False: 38] ------------------ 173| | // We are currently in alignment and the passed-in data source 174| | // contains enough data to benefit from aligned processing. 175| | // Therefore, we don't copy anything into the intermittent buffer. 176| 0| return std::nullopt; 177| 0| } 178| | 179| | // Fill the buffer with as much input data as needed to reach alignment 180| | // or until the input source is depleted. 181| 38| const auto elements_to_consume = std::min(m_buffer.size() - m_position, slicer.remaining()); 182| 38| append(slicer.take(elements_to_consume)); 183| | 184| | // If we collected enough data, we push out one full block. When 185| | // deferring the final block is enabled, we additionally check that 186| | // more input data is available to continue processing a consecutive 187| | // block. 188| 38| if(ready_to_consume() && (!defers_final_block() || !slicer.empty())) { ------------------ | Branch (188:13): [True: 0, False: 38] | Branch (188:36): [True: 0, False: 0] | Branch (188:61): [True: 0, False: 0] ------------------ 189| 0| return consume(); 190| 38| } else { 191| 38| return std::nullopt; 192| 38| } 193| 38| } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE18defers_final_blockEv: 233| 38| constexpr bool defers_final_block() const { 234| 38| return FINAL_BLOCK_STRATEGY == AlignmentBufferFinalBlock::must_be_deferred; 235| 38| } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE6appendENSt3__14spanIKhLm18446744073709551615EEE: 90| 76| void append(std::span elements) { 91| 76| BOTAN_ASSERT_NOMSG(elements.size() <= elements_until_alignment()); ------------------ | | 84| 76| do { \ | | 85| 76| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 76| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 76] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 76| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 76] | | ------------------ ------------------ 92| 76| std::copy(elements.begin(), elements.end(), m_buffer.begin() + m_position); 93| 76| m_position += elements.size(); 94| 76| } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE24elements_until_alignmentEv: 221| 190| size_t elements_until_alignment() const { return m_buffer.size() - m_position; } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE16ready_to_consumeEv: 231| 152| bool ready_to_consume() const { return m_position == m_buffer.size(); } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE7consumeEv: 200| 38| [[nodiscard]] std::span consume() { 201| 38| BOTAN_ASSERT_NOMSG(ready_to_consume()); ------------------ | | 84| 38| do { \ | | 85| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 38| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 38] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 38| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 38] | | ------------------ ------------------ 202| 38| m_position = 0; 203| 38| return m_buffer; 204| 38| } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE12in_alignmentEv: 226| 76| bool in_alignment() const { return m_position == 0; } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE18fill_up_with_zerosEv: 79| 38| void fill_up_with_zeros() { 80| 38| if(!ready_to_consume()) { ------------------ | Branch (80:13): [True: 38, False: 0] ------------------ 81| 38| zeroize_buffer(&m_buffer[m_position], elements_until_alignment()); 82| 38| m_position = m_buffer.size(); 83| 38| } 84| 38| } _ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE20directly_modify_lastEm: 113| 38| std::span directly_modify_last(size_t elements) { 114| 38| BOTAN_ASSERT_NOMSG(size() >= elements); ------------------ | | 84| 38| do { \ | | 85| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 38| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 38] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 38| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 38] | | ------------------ ------------------ 115| 38| return std::span(m_buffer).last(elements); 116| 38| } _ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE4sizeEv: 217| 38| constexpr size_t size() const { return m_buffer.size(); } _ZNK5Botan17Barrett_Reduction4cubeERKNS_6BigIntE: 66| 2.98k| BigInt cube(const BigInt& x) const { return this->multiply(x, this->square(x)); } _ZNK5Botan17Barrett_Reduction12modulus_bitsEv: 71| 375| size_t modulus_bits() const { return m_modulus_bits; } _ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEmEET_S2_: 28| 108M|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) { 29| 108M| const T top = CT::value_barrier(a >> (sizeof(T) * 8 - 1)); 30| 108M| return static_cast(0) - top; 31| 108M|} _ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEmEET_S2_: 37| 104M|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) { 38| 104M| return ct_expand_top_bit(~x & (x - 1)); 39| 104M|} _ZN5Botan6chooseITkNSt3__117unsigned_integralEmEET_S2_S2_S2_: 217| 184M|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) { 218| | //return (mask & a) | (~mask & b); 219| 184M| return (b ^ (mask & (a ^ b))); 220| 184M|} _ZN5Botan13ceil_divisionITkNSt3__117unsigned_integralEmEET_S2_S2_: 167| 39.4k|BOTAN_FORCE_INLINE constexpr T ceil_division(T a, T b) { 168| | // Same as `(a + b - 1) / b` but avoids possible overflow 169| 39.4k| return a / b + ((a % b != 0) ? 1 : 0); ------------------ | Branch (169:20): [True: 37.9k, False: 1.50k] ------------------ 170| 39.4k|} _ZN5Botan8high_bitITkNSt3__117unsigned_integralEjEEmT_: 73| 2.00k|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) { 74| 2.00k| size_t hb = 0; 75| | 76| 12.0k| for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) { ------------------ | Branch (76:38): [True: 10.0k, False: 2.00k] ------------------ 77| | // Equivalent to: ((n >> s) == 0) ? 0 : s; 78| 10.0k| const size_t z = s - ct_if_is_zero_ret(n >> s, s); 79| 10.0k| hb += z; 80| 10.0k| n >>= z; 81| 10.0k| } 82| | 83| 2.00k| hb += static_cast(n); 84| | 85| 2.00k| return hb; 86| 2.00k|} _ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEjEEmT_m: 45| 10.0k|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) { 46| | /* 47| | Similar to `return ct_is_zero(x) & s` but has to account for possibility that 48| | sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking 49| | */ 50| 10.0k| const T a = ~x & (x - 1); 51| 10.0k| const size_t a_top = static_cast(CT::value_barrier(a >> (sizeof(T) * 8 - 1))); 52| 10.0k| const size_t mask = static_cast(0) - a_top; 53| 10.0k| return mask & s; 54| 10.0k|} _ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEmEEmT_m: 45| 2.85M|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) { 46| | /* 47| | Similar to `return ct_is_zero(x) & s` but has to account for possibility that 48| | sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking 49| | */ 50| 2.85M| const T a = ~x & (x - 1); 51| 2.85M| const size_t a_top = static_cast(CT::value_barrier(a >> (sizeof(T) * 8 - 1))); 52| 2.85M| const size_t mask = static_cast(0) - a_top; 53| 2.85M| return mask & s; 54| 2.85M|} _ZN5Botan3ctzITkNSt3__117unsigned_integralEmEEmT_: 115| 124k|BOTAN_FORCE_INLINE constexpr size_t ctz(T n) { 116| | /* 117| | * If n == 0 then this function will compute 8*sizeof(T)-1, so 118| | * initialize lb to 1 if n == 0 to produce the expected result. 119| | */ 120| 124k| size_t lb = ct_if_is_zero_ret(n, 1); 121| | 122| 872k| for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) { ------------------ | Branch (122:38): [True: 747k, False: 124k] ------------------ 123| 747k| const T range = (static_cast(1) << s) - 1; 124| | // Equivalent to: ((n & range) == 0) ? s : 0; 125| 747k| const size_t z = ct_if_is_zero_ret(n & range, s); 126| 747k| lb += z; 127| 747k| n >>= z; 128| 747k| } 129| | 130| 124k| return lb; 131| 124k|} _ZN5Botan13is_power_of_2ITkNSt3__117unsigned_integralEmEEbT_: 62| 19.0k|BOTAN_FORCE_INLINE constexpr bool is_power_of_2(T arg) { 63| 19.0k| return (arg != 0) && (arg != 1) && ((arg & static_cast(arg - 1)) == 0); ------------------ | Branch (63:11): [True: 19.0k, False: 0] | Branch (63:25): [True: 19.0k, False: 0] | Branch (63:39): [True: 11.5k, False: 7.57k] ------------------ 64| 19.0k|} _ZN5Botan8majorityITkNSt3__117unsigned_integralEmEET_S2_S2_S2_: 223| 3.04k|BOTAN_FORCE_INLINE constexpr T majority(T a, T b, T c) { 224| | /* 225| | Considering each bit of a, b, c individually 226| | 227| | If a xor b is set, then c is the deciding vote. 228| | 229| | If a xor b is not set then either a and b are both set or both unset. 230| | In either case the value of c doesn't matter, and examining b (or a) 231| | allows us to determine which case we are in. 232| | */ 233| 3.04k| return choose(a ^ b, c, b); 234| 3.04k|} _ZN5Botan8high_bitITkNSt3__117unsigned_integralEmEEmT_: 73| 330k|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) { 74| 330k| size_t hb = 0; 75| | 76| 2.31M| for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) { ------------------ | Branch (76:38): [True: 1.98M, False: 330k] ------------------ 77| | // Equivalent to: ((n >> s) == 0) ? 0 : s; 78| 1.98M| const size_t z = s - ct_if_is_zero_ret(n >> s, s); 79| 1.98M| hb += z; 80| 1.98M| n >>= z; 81| 1.98M| } 82| | 83| 330k| hb += static_cast(n); 84| | 85| 330k| return hb; 86| 330k|} _ZN5Botan12ceil_tobytesITkNSt3__117unsigned_integralEmEET_S2_: 176| 2.95k|BOTAN_FORCE_INLINE constexpr T ceil_tobytes(T bits) { 177| 2.95k| return (bits + 7) / 8; 178| 2.95k|} _ZN5Botan9ceil_log2ITkNSt3__117unsigned_integralEmEEhT_QltstS2_Li32E: 142| 843|{ 143| 843| if(x >> (sizeof(T) * 8 - 1)) { ------------------ | Branch (143:7): [True: 0, False: 843] ------------------ 144| 0| return sizeof(T) * 8; 145| 0| } 146| | 147| 843| uint8_t result = 0; 148| 843| T compare = 1; 149| | 150| 9.92k| while(compare < x) { ------------------ | Branch (150:10): [True: 9.08k, False: 843] ------------------ 151| 9.08k| compare <<= 1; 152| 9.08k| result++; 153| 9.08k| } 154| | 155| 843| return result; 156| 843|} _ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEhEET_S2_: 37| 45.2k|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) { 38| 45.2k| return ct_expand_top_bit(~x & (x - 1)); 39| 45.2k|} _ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEhEET_S2_: 28| 45.2k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) { 29| 45.2k| const T top = CT::value_barrier(a >> (sizeof(T) * 8 - 1)); 30| 45.2k| return static_cast(0) - top; 31| 45.2k|} _ZN5Botan6chooseITkNSt3__117unsigned_integralEhEET_S2_S2_S2_: 217| 16.0k|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) { 218| | //return (mask & a) | (~mask & b); 219| 16.0k| return (b ^ (mask & (a ^ b))); 220| 16.0k|} _ZN5Botan9ceil_log2ITkNSt3__117unsigned_integralEjEEhT_QltstS2_Li32E: 142| 84|{ 143| 84| if(x >> (sizeof(T) * 8 - 1)) { ------------------ | Branch (143:7): [True: 0, False: 84] ------------------ 144| 0| return sizeof(T) * 8; 145| 0| } 146| | 147| 84| uint8_t result = 0; 148| 84| T compare = 1; 149| | 150| 650| while(compare < x) { ------------------ | Branch (150:10): [True: 566, False: 84] ------------------ 151| 566| compare <<= 1; 152| 566| result++; 153| 566| } 154| | 155| 84| return result; 156| 84|} _ZN5Botan12ceil_tobytesITkNSt3__117unsigned_integralEjEET_S2_: 176| 168|BOTAN_FORCE_INLINE constexpr T ceil_tobytes(T bits) { 177| 168| return (bits + 7) / 8; 178| 168|} _ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEjEET_S2_: 28| 115k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) { 29| 115k| const T top = CT::value_barrier(a >> (sizeof(T) * 8 - 1)); 30| 115k| return static_cast(0) - top; 31| 115k|} _ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEmQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_: 25| 217k|inline constexpr T reverse_bytes(T x) { 26| | if constexpr(sizeof(T) == 1) { 27| | return x; 28| | } else if constexpr(sizeof(T) == 2) { 29| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16) 30| | return static_cast(__builtin_bswap16(x)); 31| |#else 32| | return static_cast((x << 8) | (x >> 8)); 33| |#endif 34| | } else if constexpr(sizeof(T) == 4) { 35| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32) 36| | return static_cast(__builtin_bswap32(x)); 37| |#else 38| | // MSVC at least recognizes this as a bswap 39| | return static_cast(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) | 40| | ((x & 0xFF000000) >> 24)); 41| |#endif 42| 217k| } else if constexpr(sizeof(T) == 8) { 43| 217k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64) 44| 217k| return static_cast(__builtin_bswap64(x)); 45| |#else 46| | uint32_t hi = static_cast(x >> 32); 47| | uint32_t lo = static_cast(x); 48| | 49| | hi = reverse_bytes(hi); 50| | lo = reverse_bytes(lo); 51| | 52| | return (static_cast(lo) << 32) | hi; 53| |#endif 54| 217k| } 55| 217k|} _ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEtQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_: 25| 70|inline constexpr T reverse_bytes(T x) { 26| | if constexpr(sizeof(T) == 1) { 27| | return x; 28| 70| } else if constexpr(sizeof(T) == 2) { 29| 70|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16) 30| 70| return static_cast(__builtin_bswap16(x)); 31| |#else 32| | return static_cast((x << 8) | (x >> 8)); 33| |#endif 34| | } else if constexpr(sizeof(T) == 4) { 35| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32) 36| | return static_cast(__builtin_bswap32(x)); 37| |#else 38| | // MSVC at least recognizes this as a bswap 39| | return static_cast(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) | 40| | ((x & 0xFF000000) >> 24)); 41| |#endif 42| | } else if constexpr(sizeof(T) == 8) { 43| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64) 44| | return static_cast(__builtin_bswap64(x)); 45| |#else 46| | uint32_t hi = static_cast(x >> 32); 47| | uint32_t lo = static_cast(x); 48| | 49| | hi = reverse_bytes(hi); 50| | lo = reverse_bytes(lo); 51| | 52| | return (static_cast(lo) << 32) | hi; 53| |#endif 54| | } 55| 70|} _ZN5Botan12BufferSlicerC2ENSt3__14spanIKhLm18446744073709551615EEE: 25| 17.4k| explicit BufferSlicer(std::span buffer) : m_remaining(buffer) {} _ZNK5Botan12BufferSlicer5emptyEv: 75| 140k| bool empty() const { return m_remaining.empty(); } _ZN5Botan12BufferSlicer9take_byteEv: 57| 68.6k| uint8_t take_byte() { return take(1)[0]; } _ZN5Botan12BufferSlicer4takeEm: 37| 72.7k| std::span take(const size_t count) { 38| 72.7k| BOTAN_STATE_CHECK(remaining() >= count); ------------------ | | 51| 72.7k| do { \ | | 52| 72.7k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 72.7k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 72.7k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 72.7k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 72.7k] | | ------------------ ------------------ 39| 72.7k| const auto result = m_remaining.first(count); 40| 72.7k| m_remaining = m_remaining.subspan(count); 41| 72.7k| return result; 42| 72.7k| } _ZNK5Botan12BufferSlicer9remainingEv: 73| 127k| size_t remaining() const { return m_remaining.size(); } _ZN5Botan12BufferSlicer9copy_intoENSt3__14spanIhLm18446744073709551615EEE: 66| 3.88k| void copy_into(std::span sink) { 67| 3.88k| const auto data = take(sink.size()); 68| 3.88k| std::copy(data.begin(), data.end(), sink.begin()); 69| 3.88k| } _ZN5Botan12BufferSlicer4takeILm8EEENSt3__14spanIKhXT_EEEv: 45| 44.3k| std::span take() { 46| 44.3k| BOTAN_STATE_CHECK(remaining() >= count); ------------------ | | 51| 44.3k| do { \ | | 52| 44.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 44.3k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 44.3k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 44.3k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 44.3k] | | ------------------ ------------------ 47| 44.3k| const auto result = m_remaining.first(); 48| 44.3k| m_remaining = m_remaining.subspan(count); 49| 44.3k| return result; 50| 44.3k| } _ZN5Botan12BufferSlicer4copyITkNS_8concepts20contiguous_containerENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_18SphincsPublicSeed_EJEEEEEDam: 28| 4| auto copy(const size_t count) { 29| 4| const auto result = take(count); 30| 4| return ContainerT(result.begin(), result.end()); 31| 4| } _ZN5Botan12BufferSlicer4copyITkNS_8concepts20contiguous_containerENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_16SphincsTreeNode_EJEEEEEDam: 28| 4| auto copy(const size_t count) { 29| 4| const auto result = take(count); 30| 4| return ContainerT(result.begin(), result.end()); 31| 4| } _ZN5Botan12BufferSlicer4copyITkNS_8concepts20contiguous_containerENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_18SphincsSecretSeed_EJEEEEEDam: 28| 4| auto copy(const size_t count) { 29| 4| const auto result = take(count); 30| 4| return ContainerT(result.begin(), result.end()); 31| 4| } _ZN5Botan12BufferSlicer4copyITkNS_8concepts20contiguous_containerENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_17SphincsSecretPRF_EJEEEEEDam: 28| 4| auto copy(const size_t count) { 29| 4| const auto result = take(count); 30| 4| return ContainerT(result.begin(), result.end()); 31| 4| } _ZN5Botan12BufferSlicer4copyITkNS_8concepts20contiguous_containerENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_13KyberSeedRho_EJEEEEEDam: 28| 44| auto copy(const size_t count) { 29| 44| const auto result = take(count); 30| 44| return ContainerT(result.begin(), result.end()); 31| 44| } _ZN5Botan12BufferSlicer4copyITkNS_8concepts20contiguous_containerENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEEEEDam: 28| 44| auto copy(const size_t count) { 29| 44| const auto result = take(count); 30| 44| return ContainerT(result.begin(), result.end()); 31| 44| } _ZN5Botan12BufferSlicer4takeILm4EEENSt3__14spanIKhXT_EEEv: 45| 7.80k| std::span take() { 46| 7.80k| BOTAN_STATE_CHECK(remaining() >= count); ------------------ | | 51| 7.80k| do { \ | | 52| 7.80k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 7.80k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 7.80k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 7.80k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 7.80k] | | ------------------ ------------------ 47| 7.80k| const auto result = m_remaining.first(); 48| 7.80k| m_remaining = m_remaining.subspan(count); 49| 7.80k| return result; 50| 7.80k| } _ZN5Botan12BufferSlicer4takeILm3EEENSt3__14spanIKhXT_EEEv: 45| 2.81k| std::span take() { 46| 2.81k| BOTAN_STATE_CHECK(remaining() >= count); ------------------ | | 51| 2.81k| do { \ | | 52| 2.81k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 2.81k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 2.81k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 2.81k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 2.81k] | | ------------------ ------------------ 47| 2.81k| const auto result = m_remaining.first(); 48| 2.81k| m_remaining = m_remaining.subspan(count); 49| 2.81k| return result; 50| 2.81k| } _ZN5Botan12BufferSlicer4copyITkNS_8concepts20contiguous_containerENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_28KyberImplicitRejectionValue_EJEEEEEDam: 28| 44| auto copy(const size_t count) { 29| 44| const auto result = take(count); 30| 44| return ContainerT(result.begin(), result.end()); 31| 44| } _ZN5Botan12BufferSlicer4copyITkNS_8concepts20contiguous_containerENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_20KyberSeedRandomness_EJEEEEEDam: 28| 44| auto copy(const size_t count) { 29| 44| const auto result = take(count); 30| 44| return ContainerT(result.begin(), result.end()); 31| 44| } _ZN5Botan13BufferStufferC2ENSt3__14spanIhLm18446744073709551615EEE: 26| 825k| constexpr explicit BufferStuffer(std::span buffer) : m_buffer(buffer) {} _ZN5Botan13BufferStuffer6appendEhm: 67| 2.25k| constexpr void append(uint8_t val, size_t repeat = 1) { 68| 2.25k| for(auto& b : next(repeat)) { ------------------ | Branch (68:22): [True: 2.25k, False: 2.25k] ------------------ 69| 2.25k| b = val; 70| 2.25k| } 71| 2.25k| } _ZN5Botan13BufferStuffer4nextEm: 32| 1.03M| constexpr std::span next(size_t bytes) { 33| 1.03M| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 1.03M| do { \ | | 52| 1.03M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 1.03M| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 1.03M] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 1.03M| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 1.03M] | | ------------------ ------------------ 34| | 35| 1.03M| const auto result = m_buffer.first(bytes); 36| 1.03M| m_buffer = m_buffer.subspan(bytes); 37| 1.03M| return result; 38| 1.03M| } _ZN5Botan13BufferStuffer6appendENSt3__14spanIKhLm18446744073709551615EEE: 59| 1.03M| constexpr void append(std::span buffer) { 60| 1.03M| const size_t len = buffer.size(); 61| 1.03M| const auto sink = next(len); 62| 3.46M| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (62:28): [True: 2.43M, False: 1.03M] ------------------ 63| 2.43M| sink[i] = buffer[i]; 64| 2.43M| } 65| 1.03M| } _ZNK5Botan13BufferStuffer4fullEv: 73| 823k| constexpr bool full() const { return m_buffer.empty(); } _ZN5Botan13BufferStuffer4nextILm32EEENSt3__14spanIhXT_EEEv: 41| 1.07k| constexpr std::span next() { 42| 1.07k| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 1.07k| do { \ | | 52| 1.07k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 1.07k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 1.07k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 1.07k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 1.07k] | | ------------------ ------------------ 43| | 44| 1.07k| const auto result = m_buffer.first(); 45| 1.07k| m_buffer = m_buffer.subspan(bytes); 46| 1.07k| return result; 47| 1.07k| } _ZN5Botan13BufferStuffer4nextILm48EEENSt3__14spanIhXT_EEEv: 41| 686| constexpr std::span next() { 42| 686| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 686| do { \ | | 52| 686| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 686| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 686] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 686| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 686] | | ------------------ ------------------ 43| | 44| 686| const auto result = m_buffer.first(); 45| 686| m_buffer = m_buffer.subspan(bytes); 46| 686| return result; 47| 686| } _ZN5Botan13BufferStuffer4nextILm64EEENSt3__14spanIhXT_EEEv: 41| 270| constexpr std::span next() { 42| 270| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 270| do { \ | | 52| 270| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 270| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 270] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 270| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 270] | | ------------------ ------------------ 43| | 44| 270| const auto result = m_buffer.first(); 45| 270| m_buffer = m_buffer.subspan(bytes); 46| 270| return result; 47| 270| } _ZN5Botan13BufferStuffer4nextILm28EEENSt3__14spanIhXT_EEEv: 41| 798| constexpr std::span next() { 42| 798| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 798| do { \ | | 52| 798| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 798| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 798] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 798| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 798] | | ------------------ ------------------ 43| | 44| 798| const auto result = m_buffer.first(); 45| 798| m_buffer = m_buffer.subspan(bytes); 46| 798| return result; 47| 798| } _ZN5Botan13BufferStuffer4nextILm66EEENSt3__14spanIhXT_EEEv: 41| 502| constexpr std::span next() { 42| 502| BOTAN_STATE_CHECK(m_buffer.size() >= bytes); ------------------ | | 51| 502| do { \ | | 52| 502| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 502| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 502] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 502| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 502] | | ------------------ ------------------ 43| | 44| 502| const auto result = m_buffer.first(); 45| 502| m_buffer = m_buffer.subspan(bytes); 46| 502| return result; 47| 502| } _ZN5Botan13nibble_to_hexEh: 76| 68|inline constexpr char nibble_to_hex(uint8_t b) { 77| 68| const uint8_t n = b & 0x0F; 78| 68| return static_cast(n < 10 ? '0' + n : 'A' + (n - 10)); ------------------ | Branch (78:29): [True: 42, False: 26] ------------------ 79| 68|} base64.cpp:_ZN5Botan11base_decodeINS_12_GLOBAL__N_16Base64EEEmRKT_PhPKcmRmbb: 124| 144| bool ignore_ws = true) { 125| | // TODO(Botan4) Check if we can use just base. or Base:: here instead 126| 144| constexpr size_t decoding_bytes_in = std::remove_reference_t::decoding_bytes_in(); 127| 144| constexpr size_t decoding_bytes_out = std::remove_reference_t::decoding_bytes_out(); 128| | 129| 144| input_consumed = 0; 130| | 131| 144| uint8_t* out_ptr = output; 132| 144| std::array decode_buf{}; 133| 144| size_t decode_buf_pos = 0; 134| 144| size_t final_truncate = 0; 135| 144| bool seen_padding = false; 136| | 137| 144| clear_mem(output, base.decode_max_output(input_length)); 138| | 139| 44.4k| for(size_t i = 0; i != input_length; ++i) { ------------------ | Branch (139:22): [True: 44.3k, False: 134] ------------------ 140| 44.3k| const uint8_t bin = base.lookup_binary_value(input[i]); 141| | 142| | // This call might throw Invalid_Argument 143| 44.3k| if(base.check_bad_char(bin, input[i], ignore_ws)) { ------------------ | Branch (143:10): [True: 11.9k, False: 32.3k] ------------------ 144| | // Padding may only appear at the end, so a data symbol must never 145| | // follow one (0x81 marks a padding character) 146| 11.9k| if(seen_padding) { ------------------ | Branch (146:13): [True: 3, False: 11.9k] ------------------ 147| 3| throw Invalid_Argument(base.name() + " decoding failed, data follows padding"); 148| 3| } 149| 11.9k| decode_buf[decode_buf_pos] = bin; 150| 11.9k| ++decode_buf_pos; 151| 32.3k| } else if(bin == 0x81) { ------------------ | Branch (151:17): [True: 203, False: 32.1k] ------------------ 152| 203| seen_padding = true; 153| 203| } 154| | 155| | /* 156| | * If we're at the end of the input, pad with 0s and truncate 157| | */ 158| 44.3k| if(final_inputs && (i == input_length - 1)) { ------------------ | Branch (158:10): [True: 44.2k, False: 43] | Branch (158:26): [True: 80, False: 44.1k] ------------------ 159| 80| if(decode_buf_pos) { ------------------ | Branch (159:13): [True: 45, False: 35] ------------------ 160| 45| const size_t bits_per_symbol = base.bits_consumed(); 161| 45| const size_t pad_bits = (decode_buf_pos * bits_per_symbol) % 8; 162| | 163| | // A trailing symbol contributing only pad bits cannot occur in a 164| | // valid encoding; RFC 4648 4 and 6 enumerate the reachable cases 165| 45| if(pad_bits >= bits_per_symbol) { ------------------ | Branch (165:16): [True: 5, False: 40] ------------------ 166| 5| throw Invalid_Argument(base.name() + " decoding failed, invalid length"); 167| 5| } 168| | 169| | // RFC 4648 3.5: "decoders MAY chose to reject an encoding if the 170| | // pad bits have not been set to zero" 171| 40| const uint8_t pad_mask = static_cast((1U << pad_bits) - 1); 172| 40| if(decode_buf[decode_buf_pos - 1] & pad_mask) { ------------------ | Branch (172:16): [True: 2, False: 38] ------------------ 173| 2| throw Invalid_Argument(base.name() + " decoding failed, nonzero padding bits"); 174| 2| } 175| | 176| 72| for(size_t j = decode_buf_pos; j < decoding_bytes_in; ++j) { ------------------ | Branch (176:44): [True: 34, False: 38] ------------------ 177| 34| decode_buf[j] = 0; 178| 34| } 179| | 180| 38| final_truncate = decoding_bytes_in - decode_buf_pos; 181| 38| decode_buf_pos = decoding_bytes_in; 182| 38| } 183| 80| } 184| | 185| 44.3k| if(decode_buf_pos == decoding_bytes_in) { ------------------ | Branch (185:10): [True: 2.99k, False: 41.3k] ------------------ 186| 2.99k| base.decode(out_ptr, decode_buf.data()); 187| | 188| 2.99k| out_ptr += decoding_bytes_out; 189| 2.99k| decode_buf_pos = 0; 190| 2.99k| input_consumed = i + 1; 191| 2.99k| } 192| 44.3k| } 193| | 194| 21.7k| while(input_consumed < input_length && base.lookup_binary_value(input[input_consumed]) == 0x80) { ------------------ | Branch (194:10): [True: 21.6k, False: 125] | Branch (194:43): [True: 21.6k, False: 9] ------------------ 195| 21.6k| ++input_consumed; 196| 21.6k| } 197| | 198| 134| const size_t written = (out_ptr - output) - base.bytes_to_remove(final_truncate); 199| | 200| 134| return written; 201| 144|} base64.cpp:_ZN5Botan16base_decode_fullINS_12_GLOBAL__N_16Base64EEEmRKT_PhPKcmb: 204| 144|size_t base_decode_full(const Base& base, uint8_t output[], const char input[], size_t input_length, bool ignore_ws) { 205| 144| size_t consumed = 0; 206| 144| const size_t written = base_decode(base, output, input, input_length, consumed, true, ignore_ws); 207| | 208| 144| if(consumed != input_length) { ------------------ | Branch (208:7): [True: 9, False: 135] ------------------ 209| 9| throw Invalid_Argument(base.name() + " decoding failed, input did not have full bytes"); 210| 9| } 211| | 212| 135| return written; 213| 144|} _ZZZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIPNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS5_6DomainE0EEENS3_9allocatorISA_EEEETpTkNS2_14spanable_rangeEJSD_SD_EEET_DpOT0_Qoosr8conceptsE20reservable_containerISE_Esr6rangesE25statically_spanable_rangeISE_EENKUlvE_clEvENKUlOSE_E_clISD_EEDaSJ_: 51| 88| return [&result](auto&& range) { 52| 88| auto& out = unwrap_strong_type(result); 53| 88| out.insert(out.end(), std::ranges::begin(range), std::ranges::end(range)); 54| 88| }; _ZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIPNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS5_6DomainE0EEENS3_9allocatorISA_EEEETpTkNS2_14spanable_rangeEJSD_SD_EEET_DpOT0_Qoosr8conceptsE20reservable_containerISE_Esr6rangesE25statically_spanable_rangeISE_E: 36| 44|{ 37| 44| OutR result{}; 38| | 39| | // Prepare and validate the output range and construct a lambda that does the 40| | // actual filling of the result buffer. 41| | // (if no input ranges are given, GCC claims that fill_fn is unused) 42| | // NOLINTNEXTLINE(*-const-correctness) the fixed-size branch returns a mutable lambda 43| 44| [[maybe_unused]] auto fill_fn = [&] { 44| 44| if constexpr(concepts::reservable_container) { 45| | // dynamically allocate the correct result byte length 46| 44| const size_t total_size = (ranges.size() + ... + 0); 47| 44| result.reserve(total_size); 48| | 49| | // append each input as a whole range, so contiguous byte 50| | // buffers are copied with memcpy rather than element by element 51| 44| return [&result](auto&& range) { 52| 44| auto& out = unwrap_strong_type(result); 53| 44| out.insert(out.end(), std::ranges::begin(range), std::ranges::end(range)); 54| 44| }; 55| 44| } else { 56| 44| if constexpr((ranges::statically_spanable_range && ... && true)) { 57| | // all input ranges have a static extent, so check the total size at compile time 58| | // (work around an issue in MSVC that warns `total_size` is unused) 59| 44| [[maybe_unused]] constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 60| 44| static_assert(result.size() == total_size, "size of result buffer does not match the sum of input buffers"); 61| 44| } else { 62| | // at least one input range has a dynamic extent, so check the total size at runtime 63| 44| const size_t total_size = (ranges.size() + ... + 0); 64| 44| BOTAN_ARG_CHECK(result.size() == total_size, 65| 44| "result buffer has static extent that does not match the sum of input buffers"); 66| 44| } 67| | 68| | // fill the result buffer and hold the current output-iterator position 69| 44| return [itr = std::ranges::begin(result)](auto&& range) mutable { 70| 44| std::copy(std::ranges::begin(range), std::ranges::end(range), itr); 71| 44| std::advance(itr, std::ranges::size(range)); 72| 44| }; 73| 44| } 74| 44| }(); 75| | 76| | // perform the actual concatenation 77| 44| (fill_fn(std::forward(ranges)), ...); 78| | 79| 44| return result; 80| 44|} _ZN5Botan6concatINS_6detail10AutoDetectETpTkNS_6ranges14spanable_rangeEJNSt3__16vectorIPNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS6_6DomainE0EEENS4_9allocatorISB_EEEESE_EEEDaDpOT0_Q10all_same_vIDpNS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRSF_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISO_EESP_E4type10value_typeEE: 97| 44|{ 98| 44| if constexpr(std::same_as) { 99| | // Try to auto-detect a reasonable output type given the input ranges 100| 44| static_assert(sizeof...(Rs) > 0, "Cannot auto-detect the output type if not a single input range is provided."); 101| 44| using candidate_result_t = std::remove_cvref_t>>; 102| 44| using result_range_value_t = std::remove_cvref_t>; 103| | 104| | if constexpr((ranges::statically_spanable_range && ...)) { 105| | // If all input ranges have a static extent, we can calculate the total size at compile time 106| | // and therefore can use a statically sized output container. This is constexpr. 107| | constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 108| | using out_array_t = std::array; 109| | return detail::concatenate(std::forward(ranges)...); 110| 44| } else { 111| | // If at least one input range has a dynamic extent, we must use a dynamically allocated output container. 112| | // We assume that the user wants to use the first input range's container type as output type. 113| 44| static_assert( 114| 44| concepts::reservable_container, 115| 44| "First input range has static extent, but a dynamically allocated output range is required. Please explicitly specify a dynamically allocatable output type."); 116| 44| return detail::concatenate(std::forward(ranges)...); 117| 44| } 118| | } else { 119| | // The caller has explicitly specified the output type 120| | return detail::concatenate(std::forward(ranges)...); 121| | } 122| 44|} _ZZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIPNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS5_6DomainE0EEENS3_9allocatorISA_EEEETpTkNS2_14spanable_rangeEJSD_SD_EEET_DpOT0_Qoosr8conceptsE20reservable_containerISE_Esr6rangesE25statically_spanable_rangeISE_EENKUlvE_clEv: 43| 44| [[maybe_unused]] auto fill_fn = [&] { 44| 44| if constexpr(concepts::reservable_container) { 45| | // dynamically allocate the correct result byte length 46| 44| const size_t total_size = (ranges.size() + ... + 0); 47| 44| result.reserve(total_size); 48| | 49| | // append each input as a whole range, so contiguous byte 50| | // buffers are copied with memcpy rather than element by element 51| 44| return [&result](auto&& range) { 52| 44| auto& out = unwrap_strong_type(result); 53| 44| out.insert(out.end(), std::ranges::begin(range), std::ranges::end(range)); 54| 44| }; 55| | } else { 56| | if constexpr((ranges::statically_spanable_range && ... && true)) { 57| | // all input ranges have a static extent, so check the total size at compile time 58| | // (work around an issue in MSVC that warns `total_size` is unused) 59| | [[maybe_unused]] constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 60| | static_assert(result.size() == total_size, "size of result buffer does not match the sum of input buffers"); 61| | } else { 62| | // at least one input range has a dynamic extent, so check the total size at runtime 63| | const size_t total_size = (ranges.size() + ... + 0); 64| | BOTAN_ARG_CHECK(result.size() == total_size, 65| | "result buffer has static extent that does not match the sum of input buffers"); 66| | } 67| | 68| | // fill the result buffer and hold the current output-iterator position 69| | return [itr = std::ranges::begin(result)](auto&& range) mutable { 70| | std::copy(std::ranges::begin(range), std::ranges::end(range), itr); 71| | std::advance(itr, std::ranges::size(range)); 72| | }; 73| | } 74| 44| }(); _ZN5Botan6concatINS_6detail10AutoDetectETpTkNS_6ranges14spanable_rangeEJNSt3__16vectorIhNS4_9allocatorIhEEEERNS_6StrongIS8_NS_13KyberSeedRho_EJEEEEEEDaDpOT0_Q10all_same_vIDpNS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRSD_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISM_EESN_E4type10value_typeEE: 97| 44|{ 98| 44| if constexpr(std::same_as) { 99| | // Try to auto-detect a reasonable output type given the input ranges 100| 44| static_assert(sizeof...(Rs) > 0, "Cannot auto-detect the output type if not a single input range is provided."); 101| 44| using candidate_result_t = std::remove_cvref_t>>; 102| 44| using result_range_value_t = std::remove_cvref_t>; 103| | 104| | if constexpr((ranges::statically_spanable_range && ...)) { 105| | // If all input ranges have a static extent, we can calculate the total size at compile time 106| | // and therefore can use a statically sized output container. This is constexpr. 107| | constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 108| | using out_array_t = std::array; 109| | return detail::concatenate(std::forward(ranges)...); 110| 44| } else { 111| | // If at least one input range has a dynamic extent, we must use a dynamically allocated output container. 112| | // We assume that the user wants to use the first input range's container type as output type. 113| 44| static_assert( 114| 44| concepts::reservable_container, 115| 44| "First input range has static extent, but a dynamically allocated output range is required. Please explicitly specify a dynamically allocatable output type."); 116| 44| return detail::concatenate(std::forward(ranges)...); 117| 44| } 118| | } else { 119| | // The caller has explicitly specified the output type 120| | return detail::concatenate(std::forward(ranges)...); 121| | } 122| 44|} _ZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS3_9allocatorIhEEEETpTkNS2_14spanable_rangeEJS7_RNS_6StrongIS7_NS_13KyberSeedRho_EJEEEEEET_DpOT0_Qoosr8conceptsE20reservable_containerISC_Esr6rangesE25statically_spanable_rangeISC_E: 36| 44|{ 37| 44| OutR result{}; 38| | 39| | // Prepare and validate the output range and construct a lambda that does the 40| | // actual filling of the result buffer. 41| | // (if no input ranges are given, GCC claims that fill_fn is unused) 42| | // NOLINTNEXTLINE(*-const-correctness) the fixed-size branch returns a mutable lambda 43| 44| [[maybe_unused]] auto fill_fn = [&] { 44| 44| if constexpr(concepts::reservable_container) { 45| | // dynamically allocate the correct result byte length 46| 44| const size_t total_size = (ranges.size() + ... + 0); 47| 44| result.reserve(total_size); 48| | 49| | // append each input as a whole range, so contiguous byte 50| | // buffers are copied with memcpy rather than element by element 51| 44| return [&result](auto&& range) { 52| 44| auto& out = unwrap_strong_type(result); 53| 44| out.insert(out.end(), std::ranges::begin(range), std::ranges::end(range)); 54| 44| }; 55| 44| } else { 56| 44| if constexpr((ranges::statically_spanable_range && ... && true)) { 57| | // all input ranges have a static extent, so check the total size at compile time 58| | // (work around an issue in MSVC that warns `total_size` is unused) 59| 44| [[maybe_unused]] constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 60| 44| static_assert(result.size() == total_size, "size of result buffer does not match the sum of input buffers"); 61| 44| } else { 62| | // at least one input range has a dynamic extent, so check the total size at runtime 63| 44| const size_t total_size = (ranges.size() + ... + 0); 64| 44| BOTAN_ARG_CHECK(result.size() == total_size, 65| 44| "result buffer has static extent that does not match the sum of input buffers"); 66| 44| } 67| | 68| | // fill the result buffer and hold the current output-iterator position 69| 44| return [itr = std::ranges::begin(result)](auto&& range) mutable { 70| 44| std::copy(std::ranges::begin(range), std::ranges::end(range), itr); 71| 44| std::advance(itr, std::ranges::size(range)); 72| 44| }; 73| 44| } 74| 44| }(); 75| | 76| | // perform the actual concatenation 77| 44| (fill_fn(std::forward(ranges)), ...); 78| | 79| 44| return result; 80| 44|} _ZZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS3_9allocatorIhEEEETpTkNS2_14spanable_rangeEJS7_RNS_6StrongIS7_NS_13KyberSeedRho_EJEEEEEET_DpOT0_Qoosr8conceptsE20reservable_containerISC_Esr6rangesE25statically_spanable_rangeISC_EENKUlvE_clEv: 43| 44| [[maybe_unused]] auto fill_fn = [&] { 44| 44| if constexpr(concepts::reservable_container) { 45| | // dynamically allocate the correct result byte length 46| 44| const size_t total_size = (ranges.size() + ... + 0); 47| 44| result.reserve(total_size); 48| | 49| | // append each input as a whole range, so contiguous byte 50| | // buffers are copied with memcpy rather than element by element 51| 44| return [&result](auto&& range) { 52| 44| auto& out = unwrap_strong_type(result); 53| 44| out.insert(out.end(), std::ranges::begin(range), std::ranges::end(range)); 54| 44| }; 55| | } else { 56| | if constexpr((ranges::statically_spanable_range && ... && true)) { 57| | // all input ranges have a static extent, so check the total size at compile time 58| | // (work around an issue in MSVC that warns `total_size` is unused) 59| | [[maybe_unused]] constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0); 60| | static_assert(result.size() == total_size, "size of result buffer does not match the sum of input buffers"); 61| | } else { 62| | // at least one input range has a dynamic extent, so check the total size at runtime 63| | const size_t total_size = (ranges.size() + ... + 0); 64| | BOTAN_ARG_CHECK(result.size() == total_size, 65| | "result buffer has static extent that does not match the sum of input buffers"); 66| | } 67| | 68| | // fill the result buffer and hold the current output-iterator position 69| | return [itr = std::ranges::begin(result)](auto&& range) mutable { 70| | std::copy(std::ranges::begin(range), std::ranges::end(range), itr); 71| | std::advance(itr, std::ranges::size(range)); 72| | }; 73| | } 74| 44| }(); _ZZZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS3_9allocatorIhEEEETpTkNS2_14spanable_rangeEJS7_RNS_6StrongIS7_NS_13KyberSeedRho_EJEEEEEET_DpOT0_Qoosr8conceptsE20reservable_containerISC_Esr6rangesE25statically_spanable_rangeISC_EENKUlvE_clEvENKUlOSC_E_clIS7_EEDaSH_: 51| 44| return [&result](auto&& range) { 52| 44| auto& out = unwrap_strong_type(result); 53| 44| out.insert(out.end(), std::ranges::begin(range), std::ranges::end(range)); 54| 44| }; _ZZZN5Botan6detail11concatenateITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS3_9allocatorIhEEEETpTkNS2_14spanable_rangeEJS7_RNS_6StrongIS7_NS_13KyberSeedRho_EJEEEEEET_DpOT0_Qoosr8conceptsE20reservable_containerISC_Esr6rangesE25statically_spanable_rangeISC_EENKUlvE_clEvENKUlOSC_E_clISB_EEDaSH_: 51| 44| return [&result](auto&& range) { 52| 44| auto& out = unwrap_strong_type(result); 53| 44| out.insert(out.end(), std::ranges::begin(range), std::ranges::end(range)); 54| 44| }; _ZN5Botan5CPUID5checkENS_10CPUFeatureE: 66| 88| static std::optional check(CPUID::Feature feat) { 67| 88| if(state().has_bit(feat.as_u32())) { ------------------ | Branch (67:13): [True: 44, False: 44] ------------------ 68| 44| return feat.to_string(); 69| 44| } else { 70| 44| return {}; 71| 44| } 72| 88| } _ZN5Botan5CPUID3hasENS_10CPUFeatureE: 93| 35.5k| static bool has(CPUID::Feature feat) { return state().has_bit(feat.as_u32()); } _ZN5Botan5CPUID3hasENS_10CPUFeatureES1_: 98| 11.5M| static bool has(CPUID::Feature feat1, CPUID::Feature feat2) { 99| 11.5M| return state().has_bit(feat1.as_u32() | feat2.as_u32()); 100| 11.5M| } _ZN5Botan5CPUID6is_setEjNS_10CPUFeatureE: 126| 5| static inline bool is_set(uint32_t allowed, CPUID::Feature bit) { 127| 5| const uint32_t feat_bit = bit.as_u32(); 128| 5| return ((allowed & feat_bit) == feat_bit); 129| 5| } _ZNK5Botan5CPUID10CPUID_Data7has_bitEj: 143| 11.6M| bool has_bit(uint32_t bit) const { return (m_processor_features & bit) == bit; } _ZN5Botan5CPUID5stateEv: 155| 11.6M| static CPUID_Data& state() { 156| 11.6M| static CPUID::CPUID_Data g_cpuid; 157| 11.6M| return g_cpuid; 158| 11.6M| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_1_bitsEEjmT_NS_10CPUFeatureEj: 116| 7| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 117| 7| const uint64_t flag64 = static_cast(flag); 118| 7| if((cpuid & flag64) == flag64) { ------------------ | Branch (118:13): [True: 7, False: 0] ------------------ 119| 7| return (bit.as_u32() & allowed); 120| 7| } else { 121| 0| return 0; 122| 0| } 123| 7| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_7_bitsEEjmT_NS_10CPUFeatureEj: 116| 8| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 117| 8| const uint64_t flag64 = static_cast(flag); 118| 8| if((cpuid & flag64) == flag64) { ------------------ | Branch (118:13): [True: 5, False: 3] ------------------ 119| 5| return (bit.as_u32() & allowed); 120| 5| } else { 121| 3| return 0; 122| 3| } 123| 8| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE18x86_CPUID_7_1_bitsEEjmT_NS_10CPUFeatureEj: 116| 3| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 117| 3| const uint64_t flag64 = static_cast(flag); 118| 3| if((cpuid & flag64) == flag64) { ------------------ | Branch (118:13): [True: 0, False: 3] ------------------ 119| 0| return (bit.as_u32() & allowed); 120| 3| } else { 121| 3| return 0; 122| 3| } 123| 3| } _ZN5Botan10CPUFeatureC2ENS0_3BitE: 54| 23.1M| CPUFeature(Bit b) : m_bit(b) {} // NOLINT(*-explicit-conversions,*-explicit-constructor) _ZNK5Botan10CPUFeature6as_u32Ev: 56| 23.1M| uint32_t as_u32() const { return static_cast(m_bit); } _ZN5Botan2CT6Choice9from_maskEm: 303| 5.52M| constexpr static Choice from_mask(underlying_type v) { return Choice(v); } _ZN5Botan2CT6Choice2noEv: 307| 387| constexpr static Choice no() { return Choice(0); } _ZNK5Botan2CT6ChoicentEv: 309| 435k| constexpr Choice operator!() const { return Choice(~value()); } _ZNK5Botan2CT6ChoiceaaERKS1_: 311| 1.18M| constexpr Choice operator&&(const Choice& other) const { return Choice(value() & other.value()); } _ZNK5Botan2CT6ChoiceooERKS1_: 313| 521k| constexpr Choice operator||(const Choice& other) const { return Choice(value() | other.value()); } _ZNK5Botan2CT6ChoiceneERKS1_: 315| 76| constexpr Choice operator!=(const Choice& other) const { return Choice(value() ^ other.value()); } _ZNK5Botan2CT6Choice7as_boolEv: 329| 389k| constexpr bool as_bool() const { return m_value != 0; } _ZNK5Botan2CT6Choice5valueEv: 332| 8.09M| constexpr underlying_type value() const { return value_barrier(m_value); } _ZN5Botan2CT6ChoiceC2Em: 341| 7.72M| constexpr explicit Choice(underlying_type v) : m_value(CT::value_barrier(v)) {} _ZN5Botan2CT4MaskImE7is_zeroEm: 437| 41.7M| static constexpr Mask is_zero(T x) { return Mask(ct_is_zero(value_barrier(x))); } _ZNK5Botan2CT4MaskImE5valueEv: 630| 110M| constexpr T value() const { return value_barrier(m_mask); } _ZNK5Botan2CT4MaskImEcoEv: 533| 32.7M| constexpr Mask operator~() const { return Mask(~value()); } _ZN5Botan2CT4MaskImE6expandEm: 392| 31.1M| static constexpr Mask expand(T v) { return ~Mask::is_zero(value_barrier(v)); } _ZN5Botan2CT6poisonImEEvPKT_m: 56| 39.7k|constexpr inline void poison(const T* p, size_t n) { 57| |#if defined(BOTAN_HAS_VALGRIND) 58| | if(!std::is_constant_evaluated()) { 59| | VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T)); 60| | } 61| |#endif 62| | 63| 39.7k| BOTAN_UNUSED(p, n); ------------------ | | 151| 39.7k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 64| 39.7k|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt17custom_poisonableISC_EEEvRKSC_: 121| 3.74k|constexpr void poison(const R& r) { 122| 3.74k| const std::span s{r}; 123| 3.74k| poison(s.data(), s.size()); 124| 3.74k|} _ZN5Botan2CT8unpoisonImEEvPKT_m: 67| 14.7M|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 14.7M| BOTAN_UNUSED(p, n); ------------------ | | 151| 14.7M|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 14.7M|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt19custom_unpoisonableISC_EEEvRKSC_: 128| 89.4k|constexpr void unpoison(const R& r) { 129| 89.4k| const std::span s{r}; 130| 89.4k| unpoison(s.data(), s.size()); 131| 89.4k|} _ZNK5Botan2CT4MaskImE6selectEmm: 548| 5.79M| constexpr T select(T x, T y) const { return choose(value(), x, y); } _ZNK5Botan2CT4MaskImE16conditional_swapImEEvRT_S5_QlestTL0__stS4_: 587| 6.28k| { 588| 6.28k| const auto cnd = Mask(*this); 589| 6.28k| U t0 = cnd.select(y, x); 590| 6.28k| U t1 = cnd.select(x, y); 591| 6.28k| x = t0; 592| 6.28k| y = t1; 593| 6.28k| } _ZN5Botan2CTanENS0_4MaskImEES2_: 518| 555k| friend constexpr Mask operator&(Mask x, Mask y) { return Mask(x.value() & y.value()); } _ZN5Botan2CT4MaskImEC2Em: 637| 81.6M| constexpr explicit Mask(T m) : m_mask(m) {} _ZN5Botan2CT9all_zerosImEENS0_4MaskIT_EEPKS3_m: 785| 4.84M|constexpr inline CT::Mask all_zeros(const T elem[], size_t len) { 786| 4.84M| T sum = 0; 787| 36.9M| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (787:22): [True: 32.0M, False: 4.84M] ------------------ 788| 32.0M| sum |= elem[i]; 789| 32.0M| } 790| 4.84M| return CT::Mask::is_zero(sum); 791| 4.84M|} _ZNK5Botan2CT4MaskImE7as_boolEv: 614| 277k| constexpr bool as_bool() const { return unpoisoned_value() != 0; } _ZNK5Botan2CT4MaskImE16unpoisoned_valueEv: 598| 5.79M| constexpr T unpoisoned_value() const { 599| 5.79M| T r = value(); 600| 5.79M| CT::unpoison(r); 601| 5.79M| return r; 602| 5.79M| } _ZN5Botan2CT8unpoisonITkNSt3__18integralEmEEvRKT_: 112| 11.5M|constexpr void unpoison(const T& p) { 113| 11.5M| unpoison(&p, 1); 114| 11.5M|} _ZN5Botan2CT4MaskImE8is_equalEmm: 442| 4.72M| static constexpr Mask is_equal(T x, T y) { 443| 4.72M| const T diff = value_barrier(x) ^ value_barrier(y); 444| 4.72M| return Mask::is_zero(diff); 445| 4.72M| } _ZNK5Botan2CT4MaskImE13if_set_returnEm: 538| 9.58M| constexpr T if_set_return(T x) const { return value() & x; } _ZN5Botan2CT4MaskImE5is_ltEmm: 450| 2.90M| static constexpr Mask is_lt(T x, T y) { 451| 2.90M| T u = x ^ ((x ^ y) | ((x - y) ^ x)); 452| 2.90M| return Mask::expand_top_bit(u); 453| 2.90M| } _ZN5Botan2CT4MaskImE14expand_top_bitEm: 415| 4.35M| static constexpr Mask expand_top_bit(T v) { return Mask(ct_expand_top_bit(v)); } _ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m: 738| 57.8k|constexpr inline Mask conditional_copy_mem(T cnd, T* dest, const T* if_set, const T* if_unset, size_t elems) { 739| 57.8k| const auto mask = CT::Mask::expand(cnd); 740| 57.8k| return CT::conditional_copy_mem(mask, dest, if_set, if_unset, elems); 741| 57.8k|} _ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES4_PS3_PKS3_S7_m: 732| 57.8k|constexpr inline Mask conditional_copy_mem(Mask mask, T* dest, const T* if_set, const T* if_unset, size_t elems) { 733| 57.8k| mask.select_n(dest, if_set, if_unset, elems); 734| 57.8k| return mask; 735| 57.8k|} _ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m: 565| 24.5M| constexpr void select_n(T output[], const T x[], const T y[], size_t len) const { 566| 24.5M| const T mask = value(); 567| 140M| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (567:28): [True: 116M, False: 24.5M] ------------------ 568| 116M| output[i] = choose(mask, x[i], y[i]); 569| 116M| } 570| 24.5M| } _ZN5Botan2CT4MaskImE5is_gtEmm: 458| 636k| static constexpr Mask is_gt(T x, T y) { return Mask::is_lt(y, x); } _ZN5Botan2CT4MaskImE6is_gteEmm: 468| 1.55M| static constexpr Mask is_gte(T x, T y) { return ~Mask::is_lt(x, y); } _ZNK5Botan2CT4MaskImE9as_choiceEv: 619| 5.52M| constexpr CT::Choice as_choice() const { 620| 5.52M| if constexpr(sizeof(T) >= sizeof(Choice::underlying_type)) { 621| 5.52M| return CT::Choice::from_mask(static_cast(unpoisoned_value())); 622| | } else { 623| | return CT::Choice::from_int(unpoisoned_value()); 624| | } 625| 5.52M| } _ZNK5Botan2CT4MaskImE11select_maskES2_S2_: 559| 378k| Mask select_mask(Mask x, Mask y) const { return Mask(select(x.value(), y.value())); } _ZN5Botan2CT4MaskImEoRES2_: 510| 126k| Mask& operator|=(Mask o) { 511| 126k| m_mask |= o.value(); 512| 126k| return (*this); 513| 126k| } _ZN5Botan2CT4MaskImEaNES2_: 494| 39.0k| Mask& operator&=(Mask o) { 495| 39.0k| m_mask &= o.value(); 496| 39.0k| return (*this); 497| 39.0k| } _ZN5Botan2CT4MaskIhE11expand_boolEb: 397| 16.0k| static constexpr Mask expand_bool(bool v) { return Mask::expand(static_cast(v)); } _ZN5Botan2CT4MaskIhE6expandEh: 392| 19.2k| static constexpr Mask expand(T v) { return ~Mask::is_zero(value_barrier(v)); } _ZN5Botan2CT4MaskIhE7is_zeroEh: 437| 45.2k| static constexpr Mask is_zero(T x) { return Mask(ct_is_zero(value_barrier(x))); } _ZN5Botan2CT4MaskIhEC2Eh: 637| 64.5k| constexpr explicit Mask(T m) : m_mask(m) {} _ZNK5Botan2CT4MaskIhEcoEv: 533| 19.2k| constexpr Mask operator~() const { return Mask(~value()); } _ZNK5Botan2CT4MaskIhE5valueEv: 630| 64.5k| constexpr T value() const { return value_barrier(m_mask); } _ZNK5Botan2CT4MaskIhE6selectEhh: 548| 16.0k| constexpr T select(T x, T y) const { return choose(value(), x, y); } _ZN5Botan2CTorENS0_4MaskImEES2_: 528| 1.79M| friend constexpr Mask operator|(Mask x, Mask y) { return Mask(x.value() | y.value()); } _ZN5Botan2CT6Choice8from_intIjQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_: 268| 32.4k| constexpr static Choice from_int(T v) { 269| 32.4k| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 270| 32.4k| return !Choice(ct_is_zero(v)); 271| | } else { 272| | // Mask of T that is either |0| or |1| 273| | const T v_is_0 = ct_is_zero(value_barrier(v)); 274| | 275| | // We want the mask to be set if v != 0 so we must check that 276| | // v_is_0 is itself zero. 277| | // 278| | // Also sizeof(T) may not equal sizeof(underlying_type) so we must 279| | // use ct_is_zero. It's ok to either truncate or 280| | // zero extend v_is_0 to 32 bits since we know it is |0| or |1| 281| | // so even just the low bit is sufficient. 282| | return Choice(ct_is_zero(static_cast(v_is_0))); 283| | } 284| 32.4k| } _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt17custom_poisonableISB_EEEvRKSB_: 121| 29.3k|constexpr void poison(const R& r) { 122| 29.3k| const std::span s{r}; 123| 29.3k| poison(s.data(), s.size()); 124| 29.3k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt19custom_unpoisonableISB_EEEvRKSB_: 128| 29.3k|constexpr void unpoison(const R& r) { 129| 29.3k| const std::span s{r}; 130| 29.3k| unpoison(s.data(), s.size()); 131| 29.3k|} _ZN5Botan2CT4MaskImE15if_set_zero_outEPmm: 575| 2.31M| constexpr void if_set_zero_out(T buf[], size_t elems) { 576| 23.1M| for(size_t i = 0; i != elems; ++i) { ------------------ | Branch (576:28): [True: 20.8M, False: 2.31M] ------------------ 577| 20.8M| buf[i] = this->if_not_set_return(buf[i]); 578| 20.8M| } 579| 2.31M| } _ZNK5Botan2CT4MaskImE17if_not_set_returnEm: 543| 20.9M| constexpr T if_not_set_return(T x) const { return ~value() & x; } _ZN5Botan2CT22conditional_assign_memImEENS0_4MaskIT_EES3_PS3_PKS3_m: 749| 24.3M|constexpr inline Mask conditional_assign_mem(T cnd, T* dest, const T* src, size_t elems) { 750| 24.3M| const auto mask = CT::Mask::expand(cnd); 751| 24.3M| mask.select_n(dest, src, dest, elems); 752| 24.3M| return mask; 753| 24.3M|} _ZN5Botan2CT4MaskImE7clearedEv: 387| 22.2k| static constexpr Mask cleared() { return Mask(0); } _ZN5Botan2CT16driveby_unpoisonITkNS0_12unpoisonableEmEEDcOT_Qsr3stdE21is_rvalue_reference_vIDtfp_EE: 245| 915|{ 246| 915| unpoison(v); 247| 915| return std::forward(v); 248| 915|} _ZN5Botan2CT8is_equalImEENS0_4MaskIT_EEPKS3_S6_m: 798| 43.2k|constexpr inline CT::Mask is_equal(const T x[], const T y[], size_t len) { 799| 43.2k| if(std::is_constant_evaluated()) { ------------------ | Branch (799:7): [Folded, False: 43.2k] ------------------ 800| 0| T difference = 0; 801| | 802| 0| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (802:25): [True: 0, False: 0] ------------------ 803| 0| difference = difference | (x[i] ^ y[i]); 804| 0| } 805| | 806| 0| return CT::Mask::is_zero(difference); 807| 43.2k| } else { 808| 43.2k| volatile T difference = 0; 809| | 810| 249k| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (810:25): [True: 206k, False: 43.2k] ------------------ 811| 206k| difference = difference | (x[i] ^ y[i]); 812| 206k| } 813| | 814| 43.2k| return CT::Mask::is_zero(difference); 815| 43.2k| } 816| 43.2k|} _ZNK5Botan2CT6Choice12into_bitmaskImQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES3_v: 291| 4.25M| constexpr T into_bitmask() const { 292| 4.25M| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 293| | // The inner mask is already |0| or |1| so just truncate 294| 4.25M| return static_cast(value()); 295| | } else { 296| | return ~ct_is_zero(value()); 297| | } 298| 4.25M| } _ZN5Botan2CT6poisonIhEEvPKT_m: 56| 1.76k|constexpr inline void poison(const T* p, size_t n) { 57| |#if defined(BOTAN_HAS_VALGRIND) 58| | if(!std::is_constant_evaluated()) { 59| | VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T)); 60| | } 61| |#endif 62| | 63| 1.76k| BOTAN_UNUSED(p, n); ------------------ | | 151| 1.76k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 64| 1.76k|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 175|constexpr void poison(const T& x) { 139| 175| x._const_time_poison(); 140| 175|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 175|constexpr void poison_all(const Ts&... ts) { 202| 175| (poison(ts), ...); 203| 175|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 138| 525|constexpr void poison(const T& x) { 139| 525| x._const_time_poison(); 140| 525|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm4EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 2.58k|constexpr void poison(const R& r) { 122| 2.58k| const std::span s{r}; 123| 2.58k| poison(s.data(), s.size()); 124| 2.58k|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 175|constexpr void unpoison(const T& x) { 144| 175| x._const_time_unpoison(); 145| 175|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 175|constexpr void unpoison_all(const Ts&... ts) { 208| 175| (unpoison(ts), ...); 209| 175|} pcurves_brainpool256r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 143| 525|constexpr void unpoison(const T& x) { 144| 525| x._const_time_unpoison(); 145| 525|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm4EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 2.58k|constexpr void unpoison(const R& r) { 129| 2.58k| const std::span s{r}; 130| 2.58k| unpoison(s.data(), s.size()); 131| 2.58k|} _ZN5Botan2CT8unpoisonIhEEvPKT_m: 67| 31.1k|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 31.1k| BOTAN_UNUSED(p, n); ------------------ | | 151| 31.1k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 31.1k|} _ZN5Botan2CT6Choice8from_intIhQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_: 268| 28.9k| constexpr static Choice from_int(T v) { 269| 28.9k| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 270| 28.9k| return !Choice(ct_is_zero(v)); 271| | } else { 272| | // Mask of T that is either |0| or |1| 273| | const T v_is_0 = ct_is_zero(value_barrier(v)); 274| | 275| | // We want the mask to be set if v != 0 so we must check that 276| | // v_is_0 is itself zero. 277| | // 278| | // Also sizeof(T) may not equal sizeof(underlying_type) so we must 279| | // use ct_is_zero. It's ok to either truncate or 280| | // zero extend v_is_0 to 32 bits since we know it is |0| or |1| 281| | // so even just the low bit is sufficient. 282| | return Choice(ct_is_zero(static_cast(v_is_0))); 283| | } 284| 28.9k| } _ZN5Botan2CT4MaskIhE8is_equalEhh: 442| 25.7k| static constexpr Mask is_equal(T x, T y) { 443| 25.7k| const T diff = value_barrier(x) ^ value_barrier(y); 444| 25.7k| return Mask::is_zero(diff); 445| 25.7k| } _ZNK5Botan2CT4MaskIhE9as_choiceEv: 619| 28.9k| constexpr CT::Choice as_choice() const { 620| | if constexpr(sizeof(T) >= sizeof(Choice::underlying_type)) { 621| | return CT::Choice::from_mask(static_cast(unpoisoned_value())); 622| 28.9k| } else { 623| 28.9k| return CT::Choice::from_int(unpoisoned_value()); 624| 28.9k| } 625| 28.9k| } _ZNK5Botan2CT4MaskIhE16unpoisoned_valueEv: 598| 29.1k| constexpr T unpoisoned_value() const { 599| 29.1k| T r = value(); 600| 29.1k| CT::unpoison(r); 601| 29.1k| return r; 602| 29.1k| } _ZN5Botan2CT8unpoisonITkNSt3__18integralEhEEvRKT_: 112| 29.1k|constexpr void unpoison(const T& p) { 113| 29.1k| unpoison(&p, 1); 114| 29.1k|} _ZN5Botan2CT6Choice8from_intImQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_: 268| 76| constexpr static Choice from_int(T v) { 269| 76| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 270| 76| return !Choice(ct_is_zero(v)); 271| | } else { 272| | // Mask of T that is either |0| or |1| 273| | const T v_is_0 = ct_is_zero(value_barrier(v)); 274| | 275| | // We want the mask to be set if v != 0 so we must check that 276| | // v_is_0 is itself zero. 277| | // 278| | // Also sizeof(T) may not equal sizeof(underlying_type) so we must 279| | // use ct_is_zero. It's ok to either truncate or 280| | // zero extend v_is_0 to 32 bits since we know it is |0| or |1| 281| | // so even just the low bit is sufficient. 282| | return Choice(ct_is_zero(static_cast(v_is_0))); 283| | } 284| 76| } pcurves_brainpool384r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 150|constexpr void poison(const T& x) { 139| 150| x._const_time_poison(); 140| 150|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 150|constexpr void poison_all(const Ts&... ts) { 202| 150| (poison(ts), ...); 203| 150|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 138| 450|constexpr void poison(const T& x) { 139| 450| x._const_time_poison(); 140| 450|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm6EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 1.02k|constexpr void poison(const R& r) { 122| 1.02k| const std::span s{r}; 123| 1.02k| poison(s.data(), s.size()); 124| 1.02k|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 150|constexpr void unpoison(const T& x) { 144| 150| x._const_time_unpoison(); 145| 150|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 150|constexpr void unpoison_all(const Ts&... ts) { 208| 150| (unpoison(ts), ...); 209| 150|} pcurves_brainpool384r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 143| 450|constexpr void unpoison(const T& x) { 144| 450| x._const_time_unpoison(); 145| 450|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm6EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 1.02k|constexpr void unpoison(const R& r) { 129| 1.02k| const std::span s{r}; 130| 1.02k| unpoison(s.data(), s.size()); 131| 1.02k|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 135|constexpr void poison(const T& x) { 139| 135| x._const_time_poison(); 140| 135|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 135|constexpr void poison_all(const Ts&... ts) { 202| 135| (poison(ts), ...); 203| 135|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 138| 405|constexpr void poison(const T& x) { 139| 405| x._const_time_poison(); 140| 405|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm8EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 405|constexpr void poison(const R& r) { 122| 405| const std::span s{r}; 123| 405| poison(s.data(), s.size()); 124| 405|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES4_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 135|constexpr void unpoison(const T& x) { 144| 135| x._const_time_unpoison(); 145| 135|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 135|constexpr void unpoison_all(const Ts&... ts) { 208| 135| (unpoison(ts), ...); 209| 135|} pcurves_brainpool512r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEEEEvRKT_: 143| 405|constexpr void unpoison(const T& x) { 144| 405| x._const_time_unpoison(); 145| 405|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm8EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 405|constexpr void unpoison(const R& r) { 129| 405| const std::span s{r}; 130| 405| unpoison(s.data(), s.size()); 131| 405|} _ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6PCurve22GenericProjectivePointEEEvRKT_: 138| 364|constexpr void poison(const T& x) { 139| 364| x._const_time_poison(); 140| 364|} pcurves_generic.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6PCurve12_GLOBAL__N_112GenericFieldES4_S4_EQgtsZT_Li0EEEvDpRKT_: 201| 364|constexpr void poison_all(const Ts&... ts) { 202| 364| (poison(ts), ...); 203| 364|} pcurves_generic.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6PCurve12_GLOBAL__N_112GenericFieldEEEvRKT_: 138| 1.09k|constexpr void poison(const T& x) { 139| 1.09k| x._const_time_poison(); 140| 1.09k|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm9EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 1.84k|constexpr void poison(const R& r) { 122| 1.84k| const std::span s{r}; 123| 1.84k| poison(s.data(), s.size()); 124| 1.84k|} _ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6PCurve22GenericProjectivePointEEEvRKT_: 143| 364|constexpr void unpoison(const T& x) { 144| 364| x._const_time_unpoison(); 145| 364|} pcurves_generic.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6PCurve12_GLOBAL__N_112GenericFieldES4_S4_EQgtsZT_Li0EEEvDpRKT_: 207| 364|constexpr void unpoison_all(const Ts&... ts) { 208| 364| (unpoison(ts), ...); 209| 364|} pcurves_generic.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6PCurve12_GLOBAL__N_112GenericFieldEEEvRKT_: 143| 1.09k|constexpr void unpoison(const T& x) { 144| 1.09k| x._const_time_unpoison(); 145| 1.09k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayImLm9EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 1.84k|constexpr void unpoison(const R& r) { 129| 1.84k| const std::span s{r}; 130| 1.84k| unpoison(s.data(), s.size()); 131| 1.84k|} pcurves_secp224r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS6_6ParamsES7_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 323|constexpr void poison(const T& x) { 139| 323| x._const_time_poison(); 140| 323|} pcurves_secp224r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 323|constexpr void poison_all(const Ts&... ts) { 202| 323| (poison(ts), ...); 203| 323|} pcurves_secp224r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEEvRKT_: 138| 969|constexpr void poison(const T& x) { 139| 969| x._const_time_poison(); 140| 969|} pcurves_secp224r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS6_6ParamsES7_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 323|constexpr void unpoison(const T& x) { 144| 323| x._const_time_unpoison(); 145| 323|} pcurves_secp224r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 323|constexpr void unpoison_all(const Ts&... ts) { 208| 323| (unpoison(ts), ...); 209| 323|} pcurves_secp224r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEEvRKT_: 143| 969|constexpr void unpoison(const T& x) { 144| 969| x._const_time_unpoison(); 145| 969|} pcurves_secp224r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE: 653| 145| constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {} pcurves_secp224r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEE19as_optional_vartimeEv: 710| 145| constexpr std::optional as_optional_vartime() const { 711| 145| if(m_has_value.as_bool()) { ------------------ | Branch (711:13): [True: 76, False: 69] ------------------ 712| 76| return {m_value}; 713| 76| } else { 714| 69| return {}; 715| 69| } 716| 145| } pcurves_secp256k1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS6_6ParamsES7_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 189|constexpr void poison(const T& x) { 139| 189| x._const_time_poison(); 140| 189|} pcurves_secp256k1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 189|constexpr void poison_all(const Ts&... ts) { 202| 189| (poison(ts), ...); 203| 189|} pcurves_secp256k1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEEvRKT_: 138| 567|constexpr void poison(const T& x) { 139| 567| x._const_time_poison(); 140| 567|} pcurves_secp256k1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS6_6ParamsES7_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 189|constexpr void unpoison(const T& x) { 144| 189| x._const_time_unpoison(); 145| 189|} pcurves_secp256k1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 189|constexpr void unpoison_all(const Ts&... ts) { 208| 189| (unpoison(ts), ...); 209| 189|} pcurves_secp256k1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEEvRKT_: 143| 567|constexpr void unpoison(const T& x) { 144| 567| x._const_time_unpoison(); 145| 567|} pcurves_secp256r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS5_9secp256r16ParamsES6_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 173|constexpr void poison(const T& x) { 139| 173| x._const_time_poison(); 140| 173|} pcurves_secp256r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 173|constexpr void poison_all(const Ts&... ts) { 202| 173| (poison(ts), ...); 203| 173|} pcurves_secp256r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEEEEvRKT_: 138| 519|constexpr void poison(const T& x) { 139| 519| x._const_time_poison(); 140| 519|} pcurves_secp256r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS5_9secp256r16ParamsES6_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 173|constexpr void unpoison(const T& x) { 144| 173| x._const_time_unpoison(); 145| 173|} pcurves_secp256r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 173|constexpr void unpoison_all(const Ts&... ts) { 208| 173| (unpoison(ts), ...); 209| 173|} pcurves_secp256r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEEEEvRKT_: 143| 519|constexpr void unpoison(const T& x) { 144| 519| x._const_time_unpoison(); 145| 519|} pcurves_secp384r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS5_9secp384r16ParamsES6_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 193|constexpr void poison(const T& x) { 139| 193| x._const_time_poison(); 140| 193|} pcurves_secp384r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 193|constexpr void poison_all(const Ts&... ts) { 202| 193| (poison(ts), ...); 203| 193|} pcurves_secp384r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEEEEvRKT_: 138| 579|constexpr void poison(const T& x) { 139| 579| x._const_time_poison(); 140| 579|} pcurves_secp384r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS5_9secp384r16ParamsES6_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 193|constexpr void unpoison(const T& x) { 144| 193| x._const_time_unpoison(); 145| 193|} pcurves_secp384r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 193|constexpr void unpoison_all(const Ts&... ts) { 208| 193| (unpoison(ts), ...); 209| 193|} pcurves_secp384r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEEEEvRKT_: 143| 579|constexpr void unpoison(const T& x) { 144| 579| x._const_time_unpoison(); 145| 579|} pcurves_secp521r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS6_6ParamsES7_E11FieldParamsEEEEES9_EEEEvRKT_: 138| 250|constexpr void poison(const T& x) { 139| 250| x._const_time_poison(); 140| 250|} pcurves_secp521r1.cpp:_ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 201| 250|constexpr void poison_all(const Ts&... ts) { 202| 250| (poison(ts), ...); 203| 250|} pcurves_secp521r1.cpp:_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEEvRKT_: 138| 750|constexpr void poison(const T& x) { 139| 750| x._const_time_poison(); 140| 750|} pcurves_secp521r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS6_6ParamsES7_E11FieldParamsEEEEES9_EEEEvRKT_: 143| 250|constexpr void unpoison(const T& x) { 144| 250| x._const_time_unpoison(); 145| 250|} pcurves_secp521r1.cpp:_ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEESC_SC_EQgtsZT_Li0EEEvDpRKT_: 207| 250|constexpr void unpoison_all(const Ts&... ts) { 208| 250| (unpoison(ts), ...); 209| 250|} pcurves_secp521r1.cpp:_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEEvRKT_: 143| 750|constexpr void unpoison(const T& x) { 144| 750| x._const_time_unpoison(); 145| 750|} _ZN5Botan2CT8is_equalIhEENS0_4MaskIT_EEPKS3_S6_m: 798| 189|constexpr inline CT::Mask is_equal(const T x[], const T y[], size_t len) { 799| 189| if(std::is_constant_evaluated()) { ------------------ | Branch (799:7): [Folded, False: 189] ------------------ 800| 0| T difference = 0; 801| | 802| 0| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (802:25): [True: 0, False: 0] ------------------ 803| 0| difference = difference | (x[i] ^ y[i]); 804| 0| } 805| | 806| 0| return CT::Mask::is_zero(difference); 807| 189| } else { 808| 189| volatile T difference = 0; 809| | 810| 11.2k| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (810:25): [True: 11.0k, False: 189] ------------------ 811| 11.0k| difference = difference | (x[i] ^ y[i]); 812| 11.0k| } 813| | 814| 189| return CT::Mask::is_zero(difference); 815| 189| } 816| 189|} _ZNK5Botan2CT4MaskIhE7as_boolEv: 614| 189| constexpr bool as_bool() const { return unpoisoned_value() != 0; } _ZN5Botan2CT12poison_rangeITkNSt3__16ranges5rangeENS2_6vectorINS_14Montgomery_IntENS2_9allocatorIS5_EEEEQ10poisonableINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvRKSC_: 181| 234|constexpr void poison_range(const R& r) { 182| 3.74k| for(const auto& v : r) { ------------------ | Branch (182:22): [True: 3.74k, False: 234] ------------------ 183| 3.74k| poison(v); 184| 3.74k| } 185| 234|} _ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_14Montgomery_IntEEEvRKT_: 138| 3.74k|constexpr void poison(const T& x) { 139| 3.74k| x._const_time_poison(); 140| 3.74k|} _ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_14Montgomery_IntEEEvRKT_: 143| 1.33k|constexpr void unpoison(const T& x) { 144| 1.33k| x._const_time_unpoison(); 145| 1.33k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt19custom_unpoisonableISC_EEEvRKSC_: 128| 1|constexpr void unpoison(const R& r) { 129| 1| const std::span s{r}; 130| 1| unpoison(s.data(), s.size()); 131| 1|} _ZNK5Botan2CT4MaskIjE5valueEv: 630| 115k| constexpr T value() const { return value_barrier(m_mask); } _ZNK5Botan2CT4MaskIjE13if_set_returnEj: 538| 115k| constexpr T if_set_return(T x) const { return value() & x; } _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt17custom_poisonableISC_EEEvRKSC_: 121| 1|constexpr void poison(const R& r) { 122| 1| const std::span s{r}; 123| 1| poison(s.data(), s.size()); 124| 1|} _ZN5Botan2CT8unpoisonITkNSt3__18integralEbEEvRKT_: 112| 306k|constexpr void unpoison(const T& p) { 113| 306k| unpoison(&p, 1); 114| 306k|} _ZN5Botan2CT8unpoisonIbEEvPKT_m: 67| 306k|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 306k| BOTAN_UNUSED(p, n); ------------------ | | 151| 306k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 306k|} _ZN5Botan2CT4MaskIjEC2Ej: 637| 115k| constexpr explicit Mask(T m) : m_mask(m) {} _ZN5Botan2CT16driveby_unpoisonITkNS0_12unpoisonableEbEEDcOT_Qsr3stdE21is_rvalue_reference_vIDtfp_EE: 245| 306k|{ 246| 306k| unpoison(v); 247| 306k| return std::forward(v); 248| 306k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIhLm32EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 50|constexpr void unpoison(const R& r) { 129| 50| const std::span s{r}; 130| 50| unpoison(s.data(), s.size()); 131| 50|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__14spanIKhLm32EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt17custom_poisonableISB_EEEvRKSB_: 121| 12|constexpr void poison(const R& r) { 122| 12| const std::span s{r}; 123| 12| poison(s.data(), s.size()); 124| 12|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIKhLm32EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt19custom_unpoisonableISB_EEEvRKSB_: 128| 12|constexpr void unpoison(const R& r) { 129| 12| const std::span s{r}; 130| 12| unpoison(s.data(), s.size()); 131| 12|} _ZN5Botan2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS7_EEEDaDpRKS7_: 222| 1|[[nodiscard]] constexpr auto scoped_poison(const Ts&... xs) { 223| 1| auto scope = scoped_cleanup([&] { unpoison_all(xs...); }); 224| 1| poison_all(xs...); 225| 1| return scope; 226| 1|} _ZN5Botan2CT10poison_allITpTkNS0_10poisonableEJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQgtsZT_Li0EEEvDpRKT_: 201| 1|constexpr void poison_all(const Ts&... ts) { 202| 1| (poison(ts), ...); 203| 1|} _ZZN5Botan2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS7_EEEDaDpRKS7_ENKUlvE_clEv: 223| 1| auto scope = scoped_cleanup([&] { unpoison_all(xs...); }); _ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQgtsZT_Li0EEEvDpRKT_: 207| 1|constexpr void unpoison_all(const Ts&... ts) { 208| 1| (unpoison(ts), ...); 209| 1|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__15arrayIhLm56EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 1|constexpr void unpoison(const R& r) { 129| 1| const std::span s{r}; 130| 1| unpoison(s.data(), s.size()); 131| 1|} _ZN5Botan2CT4MaskImEeOES2_: 502| 448| Mask& operator^=(Mask o) { 503| 448| m_mask ^= o.value(); 504| 448| return (*this); 505| 448| } _ZN5Botan2CT4MaskIjE14expand_top_bitEj: 415| 115k| static constexpr Mask expand_top_bit(T v) { return Mask(ct_expand_top_bit(v)); } _ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS2_6DomainE0EEEEEvRKT_: 138| 844|constexpr void poison(const T& x) { 139| 844| x._const_time_poison(); 140| 844|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__14spanIiLm256EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt17custom_poisonableISA_EEEvRKSA_: 121| 844|constexpr void poison(const R& r) { 122| 844| const std::span s{r}; 123| 844| poison(s.data(), s.size()); 124| 844|} _ZN5Botan2CT6poisonIiEEvPKT_m: 56| 844|constexpr inline void poison(const T* p, size_t n) { 57| |#if defined(BOTAN_HAS_VALGRIND) 58| | if(!std::is_constant_evaluated()) { 59| | VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T)); 60| | } 61| |#endif 62| | 63| 844| BOTAN_UNUSED(p, n); ------------------ | | 151| 844|#define BOTAN_UNUSED Botan::ignore_params ------------------ 64| 844|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEEQaasr3stdE23is_trivially_copyable_vINS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEnt17custom_poisonableISF_EEEvRKSF_: 121| 72|constexpr void poison(const R& r) { 122| 72| const std::span s{r}; 123| 72| poison(s.data(), s.size()); 124| 72|} _ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS2_6DomainE0EEEEEvRKT_: 143| 288|constexpr void unpoison(const T& x) { 144| 288| x._const_time_unpoison(); 145| 288|} _ZN5Botan2CT14unpoison_rangeITkNSt3__16ranges5rangeENS2_6vectorINS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS5_6DomainE0EEENS2_9allocatorIS9_EEEEQ12unpoisonableINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvRKSG_: 189| 288|constexpr void unpoison_range(const R& r) { 190| 1.74k| for(const auto& v : r) { ------------------ | Branch (190:22): [True: 1.74k, False: 288] ------------------ 191| 1.74k| unpoison(v); 192| 1.74k| } 193| 288|} _ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS2_6DomainE0EEEEEvRKT_: 143| 1.74k|constexpr void unpoison(const T& x) { 144| 1.74k| x._const_time_unpoison(); 145| 1.74k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIiLm256EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 1.74k|constexpr void unpoison(const R& r) { 129| 1.74k| const std::span s{r}; 130| 1.74k| unpoison(s.data(), s.size()); 131| 1.74k|} _ZN5Botan2CT8unpoisonIiEEvPKT_m: 67| 1.74k|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 1.74k| BOTAN_UNUSED(p, n); ------------------ | | 151| 1.74k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 1.74k|} _ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_28Dilithium_PrivateKeyInternalEEEvRKT_: 143| 72|constexpr void unpoison(const T& x) { 144| 72| x._const_time_unpoison(); 145| 72|} _ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15DilithiumSeedK_EJEEENS_8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNSA_6DomainE0EEESE_SE_EQgtsZT_Li0EEEvDpRKT_: 207| 72|constexpr void unpoison_all(const Ts&... ts) { 208| 72| (unpoison(ts), ...); 209| 72|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15DilithiumSeedK_EJEEEQaasr3stdE23is_trivially_copyable_vINS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEnt19custom_unpoisonableISF_EEEvRKSF_: 128| 72|constexpr void unpoison(const R& r) { 129| 72| const std::span s{r}; 130| 72| unpoison(s.data(), s.size()); 131| 72|} _ZN5Botan2CT8unpoisonINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEEQrQRKT__Xclgssr5Botan2CTE8unpoisonfL0p_EEEEvRKNS3_8optionalISA_EE: 160| 72|constexpr void unpoison(const std::optional& x) { 161| 72| if(x.has_value()) { ------------------ | Branch (161:7): [True: 72, False: 0] ------------------ 162| 72| unpoison(*x); 163| 72| } 164| 72|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEEQaasr3stdE23is_trivially_copyable_vINS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEnt19custom_unpoisonableISF_EEEvRKSF_: 128| 72|constexpr void unpoison(const R& r) { 129| 72| const std::span s{r}; 130| 72| unpoison(s.data(), s.size()); 131| 72|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEQaasr3stdE23is_trivially_copyable_vINS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEnt19custom_unpoisonableISF_EEEvRKSF_: 128| 72|constexpr void unpoison(const R& r) { 129| 72| const std::span s{r}; 130| 72| unpoison(s.data(), s.size()); 131| 72|} _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_20KyberSeedRandomness_EJEEEQaasr3stdE23is_trivially_copyable_vINS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEnt17custom_poisonableISF_EEEvRKSF_: 121| 44|constexpr void poison(const R& r) { 122| 44| const std::span s{r}; 123| 44| poison(s.data(), s.size()); 124| 44|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_20KyberSeedRandomness_EJEEEQaasr3stdE23is_trivially_copyable_vINS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEnt19custom_unpoisonableISF_EEEvRKSF_: 128| 44|constexpr void unpoison(const R& r) { 129| 44| const std::span s{r}; 130| 44| unpoison(s.data(), s.size()); 131| 44|} _ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS2_6DomainE1EEEEEvRKT_: 143| 88|constexpr void unpoison(const T& x) { 144| 88| x._const_time_unpoison(); 145| 88|} _ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS2_6DomainE1EEEEEvRKT_: 143| 288|constexpr void unpoison(const T& x) { 144| 288| x._const_time_unpoison(); 145| 288|} _ZN5Botan2CT14unpoison_rangeITkNSt3__16ranges5rangeENS2_6vectorINS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS5_6DomainE1EEENS2_9allocatorIS9_EEEEQ12unpoisonableINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvRKSG_: 189| 88|constexpr void unpoison_range(const R& r) { 190| 288| for(const auto& v : r) { ------------------ | Branch (190:22): [True: 288, False: 88] ------------------ 191| 288| unpoison(v); 192| 288| } 193| 88|} _ZN5Botan2CT8unpoisonIsEEvPKT_m: 67| 288|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 288| BOTAN_UNUSED(p, n); ------------------ | | 151| 288|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 288|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIsLm256EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEnt19custom_unpoisonableISA_EEEvRKSA_: 128| 288|constexpr void unpoison(const R& r) { 129| 288| const std::span s{r}; 130| 288| unpoison(s.data(), s.size()); 131| 288|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_13KyberSeedRho_EJEEEQaasr3stdE23is_trivially_copyable_vINS4_11conditionalIXsr21__is_primary_templateINS4_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS4_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS4_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEnt19custom_unpoisonableISF_EEEvRKSF_: 128| 44|constexpr void unpoison(const R& r) { 129| 44| const std::span s{r}; 130| 44| unpoison(s.data(), s.size()); 131| 44|} _ZN5Botan2CT12unpoison_allITpTkNS0_12unpoisonableEJNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_20KyberSeedRandomness_EJEEENS_8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNSA_6DomainE1EEESE_EQgtsZT_Li0EEEvDpRKT_: 207| 44|constexpr void unpoison_all(const Ts&... ts) { 208| 44| (unpoison(ts), ...); 209| 44|} _ZN5Botan9Gf448ElemC2ENSt3__14spanIKmLm7EEE: 48| 2| explicit Gf448Elem(std::span data) /* NOLINT(*-member-init) */ { copy_mem(m_x, data); } _ZN5Botan9Gf448Elem4zeroEv: 59| 228| static Gf448Elem zero() { return Gf448Elem(0); } _ZN5Botan9Gf448Elem3oneEv: 64| 231| static Gf448Elem one() { return Gf448Elem(1); } _ZN5Botan9Gf448Elem5wordsEv: 120| 7.84k| std::span words() { return m_x; } _ZNK5Botan9Gf448Elem5wordsEv: 128| 7.84k| std::span words() const { return m_x; } _ZNK5Botan18DilithiumConstants4modeEv: 162| 149| DilithiumMode mode() const { return m_mode; } _ZNK5Botan18DilithiumConstants16public_key_bytesEv: 152| 72| size_t public_key_bytes() const { return m_public_key_bytes; } _ZNK5Botan18DilithiumConstants20symmetric_primitivesEv: 167| 3.55k| Dilithium_Symmetric_Primitives_Base& symmetric_primitives() const { return *m_symmetric_primitives; } _ZN5Botan18DilithiumConstantsC2EOS0_: 96| 370| DilithiumConstants(DilithiumConstants&& other) = default; _ZNK5Botan18DilithiumConstants9is_ml_dsaEv: 104| 298| bool is_ml_dsa() const { return m_mode.is_ml_dsa(); } _ZNK5Botan18DilithiumConstants1kEv: 123| 817| uint8_t k() const { return m_k; } _ZNK5Botan18DilithiumConstants1lEv: 126| 3.30k| uint8_t l() const { return m_l; } _ZNK5Botan18DilithiumConstants13keypair_codecEv: 169| 77| Dilithium_Keypair_Codec& keypair_codec() const { return *m_keypair_codec; } _ZN5Botan18DilithiumConstantsC2ERKS0_: 94| 72| DilithiumConstants(const DilithiumConstants& other) : DilithiumConstants(other.m_mode) {} _ZNK5Botan18DilithiumConstants9is_modernEv: 100| 149| bool is_modern() const { return m_mode.is_modern(); } _ZNK5Botan18DilithiumConstants6is_aesEv: 102| 149| bool is_aes() const { return m_mode.is_aes(); } _ZNK5Botan18DilithiumConstants3etaEv: 129| 844| DilithiumEta eta() const { return m_eta; } _ZNK5Botan18DilithiumConstants21public_key_hash_bytesEv: 138| 149| size_t public_key_hash_bytes() const { return m_public_key_hash_bytes; } _ZNK5Botan18DilithiumConstants26commitment_hash_full_bytesEv: 141| 149| size_t commitment_hash_full_bytes() const { return m_commitment_hash_full_bytes; } _ZN5Botan27Dilithium_PublicKeyInternalC2ENS_18DilithiumConstantsENS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEENS_8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNSA_6DomainE0EEE: 42| 72| m_mode(std::move(mode)), 43| 72| m_rho(std::move(rho)), 44| 72| m_t1(std::move(t1)), 45| 72| m_tr(m_mode.symmetric_primitives().H(raw_pk())) { 46| 72| BOTAN_ASSERT_NOMSG(!m_rho.empty()); ------------------ | | 84| 72| do { \ | | 85| 72| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 72| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 72] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 72| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 72] | | ------------------ ------------------ 47| 72| BOTAN_ASSERT_NOMSG(m_t1.size() > 0); ------------------ | | 84| 72| do { \ | | 85| 72| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 72| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 72] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 72| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 72] | | ------------------ ------------------ 48| 72| } _ZNK5Botan27Dilithium_PublicKeyInternal6raw_pkEv: 51| 72| DilithiumSerializedPublicKey raw_pk() const { return Dilithium_Algos::encode_public_key(m_rho, m_t1, m_mode); } _ZNK5Botan28Dilithium_PrivateKeyInternal20_const_time_unpoisonEv: 102| 72| void _const_time_unpoison() const { 103| 72| CT::unpoison_all(m_signing_seed, m_s1, m_s2, m_t0); 104| 72| CT::unpoison(m_seed); 105| 72| } _ZN5Botan28Dilithium_PrivateKeyInternalC2ENS_18DilithiumConstantsENSt3__18optionalINS_6StrongINS2_6vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEEEENS4_IS8_NS_15DilithiumSeedK_EJEEENS_8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNSE_6DomainE0EEESI_SI_: 76| 72| m_mode(std::move(mode)), 77| 72| m_seed(std::move(seed)), 78| 72| m_signing_seed(std::move(signing_seed)), 79| 72| m_t0(std::move(t0)), 80| 72| m_s1(std::move(s1)), 81| 72| m_s2(std::move(s2)) {} _ZN5Botan23Dilithium_Keypair_CodecD2Ev: 27| 149| virtual ~Dilithium_Keypair_Codec() = default; _ZN5Botan19DilithiumPolyTraits3nttENSt3__14spanIiLm256EEE: 48| 392| static constexpr void ntt(std::span coeffs) { 49| 392| size_t j = 0; 50| 392| size_t k = 0; 51| | 52| 3.52k| for(size_t len = N / 2; len > 0; len >>= 1) { ------------------ | Branch (52:34): [True: 3.13k, False: 392] ------------------ 53| 103k| for(size_t start = 0; start < N; start = j + len) { ------------------ | Branch (53:35): [True: 99.9k, False: 3.13k] ------------------ 54| 99.9k| const T zeta = zetas[++k]; 55| 501k| for(j = start; j < start + len; ++j) { ------------------ | Branch (55:31): [True: 401k, False: 99.9k] ------------------ 56| | // Zetas contain the montgomery parameter 2^32 mod q 57| 401k| const T t = fqmul(zeta, coeffs[j + len]); 58| 401k| coeffs[j + len] = coeffs[j] - t; 59| 401k| coeffs[j] = coeffs[j] + t; 60| 401k| } 61| 99.9k| } 62| 3.13k| } 63| 392| } _ZN5Botan19DilithiumPolyTraits29montgomery_reduce_coefficientEl: 24| 1.63M| static constexpr T montgomery_reduce_coefficient(T2 a) { 25| 1.63M| const T2 t = static_cast(static_cast(static_cast(a)) * Q_inverse); 26| 1.63M| return static_cast((a - static_cast(t) * Q) >> (sizeof(T) * 8)); 27| 1.63M| } _ZN5Botan19DilithiumPolyTraits25poly_pointwise_montgomeryENSt3__14spanIiLm256EEENS2_IKiLm256EEES5_: 105| 2.56k| std::span rhs) { 106| 658k| for(size_t i = 0; i < N; ++i) { ------------------ | Branch (106:28): [True: 656k, False: 2.56k] ------------------ 107| 656k| result[i] = fqmul(lhs[i], rhs[i]); 108| 656k| } 109| 2.56k| } _ZN5Botan19DilithiumPolyTraits26barrett_reduce_coefficientEi: 29| 231k| static constexpr T barrett_reduce_coefficient(T a) { 30| | // 2**22 is roughly Q/2 and 2**23 is roughly Q 31| 231k| const T t = (a + (1 << 22)) >> 23; 32| 231k| a = a - t * Q; 33| 231k| return a; 34| 231k| } _ZN5Botan19DilithiumPolyTraits11inverse_nttENSt3__14spanIiLm256EEE: 76| 452| static constexpr void inverse_ntt(std::span coeffs) { 77| 452| size_t j = 0; 78| 452| size_t k = N; 79| 4.06k| for(size_t len = 1; len < N; len <<= 1) { ------------------ | Branch (79:30): [True: 3.61k, False: 452] ------------------ 80| 118k| for(size_t start = 0; start < N; start = j + len) { ------------------ | Branch (80:35): [True: 115k, False: 3.61k] ------------------ 81| 115k| const T zeta = -zetas[--k]; 82| 578k| for(j = start; j < start + len; ++j) { ------------------ | Branch (82:31): [True: 462k, False: 115k] ------------------ 83| 462k| const T t = coeffs[j]; 84| 462k| coeffs[j] = t + coeffs[j + len]; 85| 462k| coeffs[j + len] = t - coeffs[j + len]; 86| | // Zetas contain the montgomery parameter 2^32 mod q 87| 462k| coeffs[j + len] = fqmul(zeta, coeffs[j + len]); 88| 462k| } 89| 115k| } 90| 3.61k| } 91| | 92| 115k| for(auto& coeff : coeffs) { ------------------ | Branch (92:26): [True: 115k, False: 452] ------------------ 93| 115k| coeff = fqmul(coeff, F_WITH_MONTY_SQUARED); 94| 115k| } 95| 452| } _ZNK5Botan17DilithiumShakeXOF6XOF128ENSt3__14spanIKhLm18446744073709551615EEEt: 27| 2.56k| std::unique_ptr XOF128(std::span seed, uint16_t nonce) const override { 28| 2.56k| return createXOF("SHAKE-128", seed, nonce); 29| 2.56k| } _ZNK5Botan17DilithiumShakeXOF6XOF256ENSt3__14spanIKhLm18446744073709551615EEEt: 31| 844| std::unique_ptr XOF256(std::span seed, uint16_t nonce) const override { 32| 844| return createXOF("SHAKE-256", seed, nonce); 33| 844| } _ZN5Botan17DilithiumShakeXOFC2Ev: 18| 149| DilithiumShakeXOF() = default; _ZNK5Botan35Dilithium_Symmetric_Primitives_Base1HENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS_29DilithiumSerializedPublicKey_EJEEEEE: 122| 72| DilithiumHashedPublicKey H(StrongSpan pk) const { 123| 72| return H_256(m_public_key_hash_bytes, pk); 124| 72| } _ZNK5Botan35Dilithium_Symmetric_Primitives_Base5H_256ITkNS_8concepts21resizable_byte_bufferENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_25DilithiumHashedPublicKey_EJEEETpTkNS_6ranges14spanable_rangeEJNS_10StrongSpanIKNS3_IS8_NS_29DilithiumSerializedPublicKey_EJEEEEEEEET_mDpRKT0_: 180| 72| OutT H_256(size_t outbytes, const InTs&... ins) const { 181| 72| auto xof = XOF::create_or_throw("SHAKE-256"); 182| 72| (xof->update(ins), ...); 183| 72| return xof->output(outbytes); 184| 72| } _ZNK5Botan35Dilithium_Symmetric_Primitives_Base1HENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEEEE: 127| 72| StrongSpan seed) const { 128| 72| auto xof = XOF::create_or_throw("SHAKE-256"); 129| 72| xof->update(seed); 130| 72| if(auto domsep = seed_expansion_domain_separator()) { ------------------ | Branch (130:18): [True: 72, False: 0] ------------------ 131| 72| xof->update(domsep.value()); 132| 72| } 133| | 134| | // Note: The order of invocations in an initializer list is not 135| | // guaranteed by the C++ standard. Hence, we have to store the 136| | // results in variables to ensure the correct order of execution. 137| 72| auto rho = xof->output(DilithiumConstants::SEED_RHO_BYTES); 138| 72| auto rhoprime = xof->output(DilithiumConstants::SEED_RHOPRIME_BYTES); 139| 72| auto k = xof->output(DilithiumConstants::SEED_SIGNING_KEY_BYTES); 140| | 141| 72| return {std::move(rho), std::move(rhoprime), std::move(k)}; 142| 72| } _ZNK5Botan35Dilithium_Symmetric_Primitives_Base1HENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEEt: 155| 2.56k| std::unique_ptr H(StrongSpan seed, uint16_t nonce) const { 156| 2.56k| return m_xof_adapter->XOF128(seed, nonce); 157| 2.56k| } _ZNK5Botan35Dilithium_Symmetric_Primitives_Base1HENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_22DilithiumSeedRhoPrime_EJEEEEEt: 159| 844| std::unique_ptr H(StrongSpan seed, uint16_t nonce) const { 160| 844| return m_xof_adapter->XOF256(seed, nonce); 161| 844| } _ZN5Botan12DilithiumXOFD2Ev: 87| 149| virtual ~DilithiumXOF() = default; _ZN5Botan35Dilithium_Symmetric_Primitives_BaseD2Ev: 104| 149| virtual ~Dilithium_Symmetric_Primitives_Base() = default; _ZNK5Botan13DL_PrivateKey5groupEv: 67| 78| const DL_Group& group() const { return m_group; } _ZNK5Botan17EC_Scalar_Data_BN5valueEv: 52| 1.00k| const BigInt& value() const { return m_v; } _ZN5Botan17EC_Scalar_Data_BNC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEENS_6BigIntE: 18| 668| m_group(std::move(group)), m_v(std::move(v)) {} _ZNK5Botan22EC_AffinePoint_Data_BN15to_legacy_pointEv: 85| 442| EC_Point to_legacy_point() const override { return m_pt; } _ZNK5Botan13EC_Group_Data7p_bytesEv: 206| 2.76k| size_t p_bytes() const { return (m_p_bits + 7) / 8; } _ZNK5Botan13EC_Group_Data11order_bytesEv: 210| 8.88k| size_t order_bytes() const { return m_order_bytes; } _ZNK5Botan13EC_Group_Data1pEv: 170| 339k| const BigInt& p() const { return m_p; } _ZNK5Botan13EC_Group_Data1aEv: 172| 598| const BigInt& a() const { return m_a; } _ZNK5Botan13EC_Group_Data1bEv: 174| 590| const BigInt& b() const { return m_b; } _ZNK5Botan13EC_Group_Data10base_pointEv: 183| 15| const EC_Point& base_point() const { return m_base_point; } _ZNK5Botan13EC_Group_Data5orderEv: 176| 318| const BigInt& order() const { return m_order; } _ZNK5Botan13EC_Group_Data3g_xEv: 198| 4| const BigInt& g_x() const { return m_g_x; } _ZNK5Botan13EC_Group_Data3g_yEv: 200| 4| const BigInt& g_y() const { return m_g_y; } _ZNK5Botan13EC_Group_Data8cofactorEv: 178| 303| const BigInt& cofactor() const { return m_cofactor; } _ZNK5Botan13EC_Group_Data3oidEv: 166| 3.63k| const OID& oid() const { return m_oid; } _ZNK5Botan13EC_Group_Data6engineEv: 218| 19| EC_Group_Engine engine() const { return m_engine; } _ZNK5Botan13EC_Group_Data5curveEv: 181| 2.02k| const CurveGFp& curve() const { return m_curve; } _ZNK5Botan13EC_Group_Data5montyEv: 185| 6.13M| const Montgomery_Params& monty() const { return m_monty; } _ZNK5Botan13EC_Group_Data7monty_aEv: 187| 187| const BigInt& monty_a() const { return m_a_r; } _ZNK5Botan13EC_Group_Data7monty_bEv: 189| 187| const BigInt& monty_b() const { return m_b_r; } _ZNK5Botan13EC_Group_Data7p_wordsEv: 202| 513k| size_t p_words() const { return m_p_words; } _ZNK5Botan13EC_Group_Data12a_is_minus_3Ev: 212| 28.4k| bool a_is_minus_3() const { return m_a_is_minus_3; } _ZNK5Botan13EC_Group_Data9a_is_zeroEv: 214| 136k| bool a_is_zero() const { return m_a_is_zero; } _ZNK5Botan13EC_Group_Data6pcurveEv: 297| 10.3k| const PCurve::PrimeOrderCurve& pcurve() const { 298| 10.3k| BOTAN_ASSERT_NONNULL(m_pcurve); ------------------ | | 123| 10.3k| do { \ | | 124| 10.3k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 10.3k] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 10.3k| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 10.3k] | | ------------------ ------------------ 299| 10.3k| return *m_pcurve; 300| 10.3k| } _ZN5Botan19EC_AffinePoint_DataD2Ev: 74| 2.47k| virtual ~EC_AffinePoint_Data() = default; _ZN5Botan14EC_Scalar_DataD2Ev: 39| 4.57k| virtual ~EC_Scalar_Data() = default; _ZNK5Botan17EC_Scalar_Data_PC5valueEv: 53| 3.90k| const auto& value() const { return m_v; } _ZNK5Botan22EC_AffinePoint_Data_PC5valueEv: 88| 4| const PCurve::PrimeOrderCurve::AffinePoint& value() const { return m_pt; } _ZN5Botan17EC_Scalar_Data_PCC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEENS_6PCurve15PrimeOrderCurve6ScalarE: 19| 3.90k| m_group(std::move(group)), m_v(std::move(v)) {} _ZNK5Botan17EC_PublicKey_Data5groupEv: 30| 1.49k| const EC_Group& group() const { return m_group; } _ZNK5Botan17EC_PublicKey_Data10public_keyEv: 32| 370| const EC_AffinePoint& public_key() const { return m_point; } _ZN5Botan20Ed25519_FieldElementC2Ev: 144| 115k| constexpr Ed25519_FieldElement() : m_val{} {} _ZN5Botan20Ed25519_FieldElement9from_wordEm: 154| 2| constexpr static Ed25519_FieldElement from_word(word x) { 155| 2| Ed25519_FieldElement r; 156| 2| r.m_val[0] = x; 157| 2| return r; 158| 2| } _ZNK5Botan20Ed25519_FieldElement3sqrEv: 242| 1.55k| constexpr Ed25519_FieldElement sqr() const { 243| 1.55k| std::array z; // NOLINT(*-member-init) 244| 1.55k| comba_sqr(z.data(), m_val.data()); 245| 1.55k| Ed25519_FieldElement r; 246| 1.55k| r.reduce_wide(z); 247| 1.55k| return r; 248| 1.55k| } _ZN5Botan20Ed25519_FieldElement11reduce_wideERKNSt3__15arrayImLm8EEE: 88| 42.8k| constexpr void reduce_wide(const std::array& z) { 89| | // t = lo + 38 * hi < 39 * 2^256, so carry <= 38 90| 42.8k| W carry = 0; 91| 214k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (91:28): [True: 171k, False: 42.8k] ------------------ 92| 171k| m_val[i] = word_madd3(z[i + N], W(38), z[i], &carry); 93| 171k| } 94| 42.8k| BOTAN_DEBUG_ASSERT(carry <= 38); ------------------ | | 137| 42.8k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 42.8k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 42.8k] | | ------------------ ------------------ 95| | 96| | // Fold the bits at and above 2^255 back in by 19. The first fold 97| | // leaves at most 19*77 above 2^255, the second leaves none. 98| 128k| for(size_t fold = 0; fold != 2; ++fold) { ------------------ | Branch (98:31): [True: 85.7k, False: 42.8k] ------------------ 99| 85.7k| const W top = (carry << 1) | (m_val[N - 1] >> TOP_BIT); 100| 85.7k| m_val[N - 1] &= TOP_MASK; 101| 85.7k| carry = 0; 102| | 103| 85.7k| W c = 0; 104| 85.7k| m_val[0] = word_add(m_val[0], static_cast(top * 19), &c); 105| 343k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (105:31): [True: 257k, False: 85.7k] ------------------ 106| 257k| m_val[i] = word_add(m_val[i], static_cast(0), &c); 107| 257k| } 108| | // The top word was masked below 2^(bits-1) so this cannot carry out 109| 85.7k| BOTAN_DEBUG_ASSERT(c == 0); ------------------ | | 137| 85.7k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 85.7k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 85.7k] | | ------------------ ------------------ 110| 85.7k| } 111| | 112| 42.8k| BOTAN_DEBUG_ASSERT((m_val[N - 1] >> TOP_BIT) == 0); ------------------ | | 137| 42.8k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 42.8k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 42.8k] | | ------------------ ------------------ 113| 42.8k| } _ZN5Botan20Ed25519_FieldElement3oneEv: 148| 6.50k| constexpr static Ed25519_FieldElement one() { 149| 6.50k| Ed25519_FieldElement o; 150| 6.50k| o.m_val[0] = 1; 151| 6.50k| return o; 152| 6.50k| } _ZNK5Botan20Ed25519_FieldElement9pow_22523Ev: 340| 1|constexpr Ed25519_FieldElement Ed25519_FieldElement::pow_22523() const { 341| 1| auto t0 = this->sqr(); 342| 1| auto t1 = t0.sqr_iter(2); 343| 1| t1 = (*this) * t1; 344| 1| t0 = t0 * t1; 345| 1| t0 = t0.sqr(); 346| 1| t0 = t1 * t0; 347| 1| t1 = t0.sqr_iter(5); 348| 1| t0 = t1 * t0; 349| 1| t1 = t0.sqr_iter(10); 350| 1| t1 = t1 * t0; 351| 1| auto t2 = t1.sqr_iter(20); 352| 1| t1 = t2 * t1; 353| 1| t1 = t1.sqr_iter(10); 354| 1| t0 = t1 * t0; 355| 1| t1 = t0.sqr_iter(50); 356| 1| t1 = t1 * t0; 357| 1| t2 = t1.sqr_iter(100); 358| 1| t1 = t2 * t1; 359| 1| t1 = t1.sqr_iter(50); 360| 1| t0 = t1 * t0; 361| 1| t0 = t0.sqr_iter(2); 362| | 363| 1| t0 = t0 * (*this); 364| 1| return t0; 365| 1|} _ZNK5Botan20Ed25519_FieldElement8sqr_iterEm: 250| 477| constexpr Ed25519_FieldElement sqr_iter(size_t iter) const { 251| 477| auto r = *this; 252| 477| std::array z; // NOLINT(*-member-init) 253| 13.8k| for(size_t i = 0; i != iter; ++i) { ------------------ | Branch (253:28): [True: 13.3k, False: 477] ------------------ 254| 13.3k| comba_sqr(z.data(), r.m_val.data()); 255| 13.3k| r.reduce_wide(z); 256| 13.3k| } 257| 477| return r; 258| 477| } _ZNK5Botan20Ed25519_FieldElement11is_negativeEv: 210| 39| constexpr bool is_negative() const { return (canonical()[0] & 1) == 1; } _ZNK5Botan20Ed25519_FieldElement9canonicalEv: 118| 90| constexpr std::array canonical() const { 119| | // Fold the bit at 2^255, leaving a value below 2^255 + 19, then 120| | // conditionally subtract p once 121| 90| std::array t = m_val; 122| | 123| 90| const W top = t[N - 1] >> TOP_BIT; 124| 90| t[N - 1] &= TOP_MASK; 125| 90| W c = 0; 126| 90| t[0] = word_add(t[0], static_cast(top * 19), &c); 127| 360| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (127:28): [True: 270, False: 90] ------------------ 128| 270| t[i] = word_add(t[i], static_cast(0), &c); 129| 270| } 130| | 131| 90| std::array r{}; 132| 90| W borrow = 0; 133| 450| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (133:28): [True: 360, False: 90] ------------------ 134| 360| r[i] = word_sub(t[i], P[i], &borrow); 135| 360| } 136| 90| CT::conditional_assign_mem(borrow, r.data(), t.data(), N); 137| 90| return r; 138| 90| } _ZN5Botan20Ed25519_FieldElement4zeroEv: 146| 6.50k| constexpr static Ed25519_FieldElement zero() { return Ed25519_FieldElement(); } _ZN5Botan20Ed25519_FieldElement18conditional_assignENS_2CT6ChoiceERKS0_: 273| 80.0k| constexpr void conditional_assign(CT::Choice cond, const Ed25519_FieldElement& other) { 274| 80.0k| const W mask = cond.into_bitmask(); 275| 400k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (275:28): [True: 320k, False: 80.0k] ------------------ 276| 320k| m_val[i] = choose(mask, other.m_val[i], m_val[i]); 277| 320k| } 278| 80.0k| } _ZN5Botan20Ed25519_FieldElement16conditional_swapENS_2CT6ChoiceERS0_S3_: 283| 3.20k| static constexpr void conditional_swap(CT::Choice cond, Ed25519_FieldElement& x, Ed25519_FieldElement& y) { 284| 3.20k| const W mask = cond.into_bitmask(); 285| 16.0k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (285:28): [True: 12.8k, False: 3.20k] ------------------ 286| 12.8k| const W nx = choose(mask, y.m_val[i], x.m_val[i]); 287| 12.8k| const W ny = choose(mask, x.m_val[i], y.m_val[i]); 288| 12.8k| x.m_val[i] = nx; 289| 12.8k| y.m_val[i] = ny; 290| 12.8k| } 291| 3.20k| } _ZNK5Botan20Ed25519_FieldElement4sqr2Ev: 261| 360| constexpr Ed25519_FieldElement sqr2() const { 262| 360| const auto z = sqr(); 263| 360| return add(z, z); 264| 360| } _ZN5Botan20Ed25519_FieldElement3addERKS0_S2_: 212| 15.0k| static constexpr Ed25519_FieldElement add(const Ed25519_FieldElement& a, const Ed25519_FieldElement& b) { 213| 15.0k| Ed25519_FieldElement z; 214| 15.0k| W carry = 0; 215| 75.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (215:28): [True: 60.3k, False: 15.0k] ------------------ 216| 60.3k| z.m_val[i] = word_add(a.m_val[i], b.m_val[i], &carry); 217| 60.3k| } 218| 15.0k| z.fold_carry(carry); 219| 15.0k| return z; 220| 15.0k| } _ZN5Botan20Ed25519_FieldElement10fold_carryEm: 57| 15.0k| constexpr void fold_carry(W carry) { 58| 45.2k| for(size_t fold = 0; fold != 2; ++fold) { ------------------ | Branch (58:31): [True: 30.1k, False: 15.0k] ------------------ 59| 30.1k| W c = 0; 60| 30.1k| m_val[0] = word_add(m_val[0], carry * 38, &c); 61| 120k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (61:31): [True: 90.4k, False: 30.1k] ------------------ 62| 90.4k| m_val[i] = word_add(m_val[i], static_cast(0), &c); 63| 90.4k| } 64| 30.1k| carry = c; 65| 30.1k| } 66| 15.0k| } _ZN5BotanmlERKNS_20Ed25519_FieldElementES2_: 305| 27.9k|inline constexpr Ed25519_FieldElement operator*(const Ed25519_FieldElement& x, const Ed25519_FieldElement& y) { 306| 27.9k| return Ed25519_FieldElement::mul(x, y); 307| 27.9k|} _ZN5Botan20Ed25519_FieldElement3mulERKS0_S2_: 234| 27.9k| static constexpr Ed25519_FieldElement mul(const Ed25519_FieldElement& a, const Ed25519_FieldElement& b) { 235| 27.9k| std::array z; // NOLINT(*-member-init) 236| 27.9k| comba_mul(z.data(), a.m_val.data(), b.m_val.data()); 237| 27.9k| Ed25519_FieldElement r; 238| 27.9k| r.reduce_wide(z); 239| 27.9k| return r; 240| 27.9k| } _ZN5BotanplERKNS_20Ed25519_FieldElementES2_: 297| 14.7k|inline constexpr Ed25519_FieldElement operator+(const Ed25519_FieldElement& x, const Ed25519_FieldElement& y) { 298| 14.7k| return Ed25519_FieldElement::add(x, y); 299| 14.7k|} _ZN5BotanmiERKNS_20Ed25519_FieldElementES2_: 301| 11.6k|inline constexpr Ed25519_FieldElement operator-(const Ed25519_FieldElement& x, const Ed25519_FieldElement& y) { 302| 11.6k| return Ed25519_FieldElement::sub(x, y); 303| 11.6k|} _ZN5Botan20Ed25519_FieldElement3subERKS0_S2_: 222| 14.8k| static constexpr Ed25519_FieldElement sub(const Ed25519_FieldElement& a, const Ed25519_FieldElement& b) { 223| 14.8k| Ed25519_FieldElement z; 224| 14.8k| W borrow = 0; 225| 74.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (225:28): [True: 59.4k, False: 14.8k] ------------------ 226| 59.4k| z.m_val[i] = word_sub(a.m_val[i], b.m_val[i], &borrow); 227| 59.4k| } 228| 14.8k| z.fold_borrow(borrow); 229| 14.8k| return z; 230| 14.8k| } _ZN5Botan20Ed25519_FieldElement11fold_borrowEm: 71| 14.8k| constexpr void fold_borrow(W borrow) { 72| 44.5k| for(size_t fold = 0; fold != 2; ++fold) { ------------------ | Branch (72:31): [True: 29.7k, False: 14.8k] ------------------ 73| 29.7k| W b = 0; 74| 29.7k| m_val[0] = word_sub(m_val[0], borrow * 38, &b); 75| 118k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (75:31): [True: 89.1k, False: 29.7k] ------------------ 76| 89.1k| m_val[i] = word_sub(m_val[i], static_cast(0), &b); 77| 89.1k| } 78| 29.7k| borrow = b; 79| 29.7k| } 80| 14.8k| } _ZNK5Botan20Ed25519_FieldElement6invertEv: 313| 52|constexpr Ed25519_FieldElement Ed25519_FieldElement::invert() const { 314| 52| auto t0 = this->sqr(); 315| 52| auto t1 = t0.sqr_iter(2); 316| 52| t1 = *this * t1; 317| 52| t0 = t0 * t1; 318| 52| auto t2 = t0.sqr(); 319| 52| t1 = t1 * t2; 320| 52| t2 = t1.sqr_iter(5); 321| 52| t1 = t2 * t1; 322| 52| t2 = t1.sqr_iter(10); 323| 52| t2 = t2 * t1; 324| 52| auto t3 = t2.sqr_iter(20); 325| 52| t2 = t3 * t2; 326| 52| t2 = t2.sqr_iter(10); 327| 52| t1 = t2 * t1; 328| 52| t2 = t1.sqr_iter(50); 329| 52| t2 = t2 * t1; 330| 52| t3 = t2.sqr_iter(100); 331| 52| t2 = t3 * t2; 332| 52| t2 = t2.sqr_iter(50); 333| 52| t1 = t2 * t1; 334| 52| t1 = t1.sqr_iter(5); 335| | 336| 52| t0 = t1 * t0; 337| 52| return t0; 338| 52|} _ZNK5Botan20Ed25519_FieldElement12serialize_toENSt3__14spanIhLm32EEE: 186| 50| void serialize_to(std::span b) const { 187| 50| const auto w = canonical(); 188| 250| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (188:28): [True: 200, False: 50] ------------------ 189| 200| store_le(w[i], b.data() + sizeof(W) * i); 190| 200| } 191| 50| } _ZNK5Botan20Ed25519_FieldElement7is_zeroEv: 193| 1| constexpr bool is_zero() const { 194| 1| const auto w = canonical(); 195| 1| if(std::is_constant_evaluated()) { ------------------ | Branch (195:13): [Folded, False: 1] ------------------ 196| 0| for(const auto x : w) { ------------------ | Branch (196:30): [True: 0, False: 0] ------------------ 197| 0| if(x != 0) { ------------------ | Branch (197:19): [True: 0, False: 0] ------------------ 198| 0| return false; 199| 0| } 200| 0| } 201| 0| return true; 202| 0| } 203| 1| return CT::all_zeros(w.data(), w.size()).as_bool(); 204| 1| } _ZN5BotanngERKNS_20Ed25519_FieldElementE: 309| 3.20k|inline constexpr Ed25519_FieldElement operator-(const Ed25519_FieldElement& x) { 310| 3.20k| return Ed25519_FieldElement::negate(x); 311| 3.20k|} _ZN5Botan20Ed25519_FieldElement6negateERKS0_: 232| 3.20k| static constexpr Ed25519_FieldElement negate(const Ed25519_FieldElement& a) { return sub(zero(), a); } _ZNK5Botan14Ed25519_Scalar8to_bytesEv: 59| 50| std::array to_bytes() const { 60| 50| std::array b; // NOLINT(*-member-init) 61| 50| serialize_to(b); 62| 50| return b; 63| 50| } _ZN5Botan14Ed25519_ScalarC2ERKNSt3__15arrayImLm4EEE: 72| 50| explicit Ed25519_Scalar(const std::array& v) : m_val(v) {} _ZN5Botan10Ed448PointC2ERKNS_9Gf448ElemES3_S3_: 35| 1.90k| Ed448Point(const Gf448Elem& x, const Gf448Elem& y, const Gf448Elem& z) : m_x(x), m_y(y), m_z(z) {} _ZN5Botan10Ed448PointC2ERKNS_9Gf448ElemES3_: 38| 228| Ed448Point(const Gf448Elem& x, const Gf448Elem& y) : m_x(x), m_y(y), m_z(1) {} _ZN5Botan10Ed448Point8identityEv: 41| 227| static Ed448Point identity() { return Ed448Point(Gf448Elem::zero(), Gf448Elem::one()); } _ZN5Botan3fmtIJNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEEES7_NS1_17basic_string_viewIcS4_EEDpRKT_: 53| 498|std::string fmt(std::string_view format, const T&... args) { 54| 498| std::ostringstream oss; 55| 498| oss.imbue(std::locale::classic()); 56| 498| fmt_detail::do_fmt(oss, format, args...); 57| 498| return oss.str(); 58| 498|} _ZN5Botan10fmt_detail6do_fmtINSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEJEEEvRNS2_19basic_ostringstreamIcS5_S7_EENS2_17basic_string_viewIcS5_EERKT_DpRKT0_: 25| 498|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 498| size_t i = 0; 27| | 28| 11.5k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 11.5k, False: 0] ------------------ 29| 11.5k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 498, False: 11.0k] | Branch (29:30): [True: 498, False: 0] | Branch (29:59): [True: 498, False: 0] ------------------ 30| 498| oss << val; 31| 498| return do_fmt(oss, format.substr(i + 2), rest...); 32| 11.0k| } else { 33| 11.0k| oss << format[i]; 34| 11.0k| } 35| | 36| 11.0k| i += 1; 37| 11.0k| } 38| 498|} _ZN5Botan10fmt_detail6do_fmtERNSt3__119basic_ostringstreamIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE: 20| 13.1k|inline void do_fmt(std::ostringstream& oss, std::string_view format) { 21| 13.1k| oss << format; 22| 13.1k|} _ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_: 53| 7.61k|std::string fmt(std::string_view format, const T&... args) { 54| 7.61k| std::ostringstream oss; 55| 7.61k| oss.imbue(std::locale::classic()); 56| 7.61k| fmt_detail::do_fmt(oss, format, args...); 57| 7.61k| return oss.str(); 58| 7.61k|} _ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_: 25| 9.52k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 9.52k| size_t i = 0; 27| | 28| 91.9k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 91.9k, False: 0] ------------------ 29| 91.9k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 9.52k, False: 82.4k] | Branch (29:30): [True: 9.52k, False: 0] | Branch (29:59): [True: 9.52k, False: 0] ------------------ 30| 9.52k| oss << val; 31| 9.52k| return do_fmt(oss, format.substr(i + 2), rest...); 32| 82.4k| } else { 33| 82.4k| oss << format[i]; 34| 82.4k| } 35| | 36| 82.4k| i += 1; 37| 82.4k| } 38| 9.52k|} _ZN5Botan10fmt_detail6do_fmtImJEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_: 25| 88|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 88| size_t i = 0; 27| | 28| 572| while(i < format.size()) { ------------------ | Branch (28:10): [True: 572, False: 0] ------------------ 29| 572| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 88, False: 484] | Branch (29:30): [True: 88, False: 0] | Branch (29:59): [True: 88, False: 0] ------------------ 30| 88| oss << val; 31| 88| return do_fmt(oss, format.substr(i + 2), rest...); 32| 484| } else { 33| 484| oss << format[i]; 34| 484| } 35| | 36| 484| i += 1; 37| 484| } 38| 88|} _ZN5Botan3fmtIJNS_3OIDEEEENSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EEDpRKT_: 53| 1.84k|std::string fmt(std::string_view format, const T&... args) { 54| 1.84k| std::ostringstream oss; 55| 1.84k| oss.imbue(std::locale::classic()); 56| 1.84k| fmt_detail::do_fmt(oss, format, args...); 57| 1.84k| return oss.str(); 58| 1.84k|} _ZN5Botan10fmt_detail6do_fmtINS_3OIDEJEEEvRNSt3__119basic_ostringstreamIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EERKT_DpRKT0_: 25| 1.84k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 1.84k| size_t i = 0; 27| | 28| 42.3k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 42.3k, False: 0] ------------------ 29| 42.3k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 1.84k, False: 40.5k] | Branch (29:30): [True: 1.84k, False: 0] | Branch (29:59): [True: 1.84k, False: 0] ------------------ 30| 1.84k| oss << val; 31| 1.84k| return do_fmt(oss, format.substr(i + 2), rest...); 32| 40.5k| } else { 33| 40.5k| oss << format[i]; 34| 40.5k| } 35| | 36| 40.5k| i += 1; 37| 40.5k| } 38| 1.84k|} _ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_EEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_: 53| 1.90k|std::string fmt(std::string_view format, const T&... args) { 54| 1.90k| std::ostringstream oss; 55| 1.90k| oss.imbue(std::locale::classic()); 56| 1.90k| fmt_detail::do_fmt(oss, format, args...); 57| 1.90k| return oss.str(); 58| 1.90k|} _ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJS6_EEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_: 25| 1.90k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 1.90k| size_t i = 0; 27| | 28| 1.90k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 1.90k, False: 0] ------------------ 29| 1.90k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 1.90k, False: 0] | Branch (29:30): [True: 1.90k, False: 0] | Branch (29:59): [True: 1.90k, False: 0] ------------------ 30| 1.90k| oss << val; 31| 1.90k| return do_fmt(oss, format.substr(i + 2), rest...); 32| 1.90k| } else { 33| 0| oss << format[i]; 34| 0| } 35| | 36| 0| i += 1; 37| 0| } 38| 1.90k|} _ZN5Botan10fmt_detail6do_fmtIPKcJEEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_: 25| 1.16k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 1.16k| size_t i = 0; 27| | 28| 16.2k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 16.2k, False: 0] ------------------ 29| 16.2k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 1.16k, False: 15.1k] | Branch (29:30): [True: 1.16k, False: 0] | Branch (29:59): [True: 1.16k, False: 0] ------------------ 30| 1.16k| oss << val; 31| 1.16k| return do_fmt(oss, format.substr(i + 2), rest...); 32| 15.1k| } else { 33| 15.1k| oss << format[i]; 34| 15.1k| } 35| | 36| 15.1k| i += 1; 37| 15.1k| } 38| 1.16k|} _ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEPKcEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_: 53| 1.16k|std::string fmt(std::string_view format, const T&... args) { 54| 1.16k| std::ostringstream oss; 55| 1.16k| oss.imbue(std::locale::classic()); 56| 1.16k| fmt_detail::do_fmt(oss, format, args...); 57| 1.16k| return oss.str(); 58| 1.16k|} _ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJPKcEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_: 25| 1.16k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 1.16k| size_t i = 0; 27| | 28| 1.16k| while(i < format.size()) { ------------------ | Branch (28:10): [True: 1.16k, False: 0] ------------------ 29| 1.16k| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 1.16k, False: 0] | Branch (29:30): [True: 1.16k, False: 0] | Branch (29:59): [True: 1.16k, False: 0] ------------------ 30| 1.16k| oss << val; 31| 1.16k| return do_fmt(oss, format.substr(i + 2), rest...); 32| 1.16k| } else { 33| 0| oss << format[i]; 34| 0| } 35| | 36| 0| i += 1; 37| 0| } 38| 1.16k|} _ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEmEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_: 53| 44|std::string fmt(std::string_view format, const T&... args) { 54| 44| std::ostringstream oss; 55| 44| oss.imbue(std::locale::classic()); 56| 44| fmt_detail::do_fmt(oss, format, args...); 57| 44| return oss.str(); 58| 44|} _ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJmEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_: 25| 44|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 44| size_t i = 0; 27| | 28| 44| while(i < format.size()) { ------------------ | Branch (28:10): [True: 44, False: 0] ------------------ 29| 44| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 44, False: 0] | Branch (29:30): [True: 44, False: 0] | Branch (29:59): [True: 44, False: 0] ------------------ 30| 44| oss << val; 31| 44| return do_fmt(oss, format.substr(i + 2), rest...); 32| 44| } else { 33| 0| oss << format[i]; 34| 0| } 35| | 36| 0| i += 1; 37| 0| } 38| 44|} _ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEjEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_: 53| 53|std::string fmt(std::string_view format, const T&... args) { 54| 53| std::ostringstream oss; 55| 53| oss.imbue(std::locale::classic()); 56| 53| fmt_detail::do_fmt(oss, format, args...); 57| 53| return oss.str(); 58| 53|} _ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJjEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_: 25| 53|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 53| size_t i = 0; 27| | 28| 53| while(i < format.size()) { ------------------ | Branch (28:10): [True: 53, False: 0] ------------------ 29| 53| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 53, False: 0] | Branch (29:30): [True: 53, False: 0] | Branch (29:59): [True: 53, False: 0] ------------------ 30| 53| oss << val; 31| 53| return do_fmt(oss, format.substr(i + 2), rest...); 32| 53| } else { 33| 0| oss << format[i]; 34| 0| } 35| | 36| 0| i += 1; 37| 0| } 38| 53|} _ZN5Botan10fmt_detail6do_fmtIjJEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_: 25| 53|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 53| size_t i = 0; 27| | 28| 159| while(i < format.size()) { ------------------ | Branch (28:10): [True: 159, False: 0] ------------------ 29| 159| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 53, False: 106] | Branch (29:30): [True: 53, False: 0] | Branch (29:59): [True: 53, False: 0] ------------------ 30| 53| oss << val; 31| 53| return do_fmt(oss, format.substr(i + 2), rest...); 32| 106| } else { 33| 106| oss << format[i]; 34| 106| } 35| | 36| 106| i += 1; 37| 106| } 38| 53|} _ZN5Botan3fmtIJmEEENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EEDpRKT_: 53| 44|std::string fmt(std::string_view format, const T&... args) { 54| 44| std::ostringstream oss; 55| 44| oss.imbue(std::locale::classic()); 56| 44| fmt_detail::do_fmt(oss, format, args...); 57| 44| return oss.str(); 58| 44|} _ZN5Botan3fmtIJmPKcEEENSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EEDpRKT_: 53| 1|std::string fmt(std::string_view format, const T&... args) { 54| 1| std::ostringstream oss; 55| 1| oss.imbue(std::locale::classic()); 56| 1| fmt_detail::do_fmt(oss, format, args...); 57| 1| return oss.str(); 58| 1|} _ZN5Botan10fmt_detail6do_fmtImJPKcEEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_: 25| 1|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 1| size_t i = 0; 27| | 28| 14| while(i < format.size()) { ------------------ | Branch (28:10): [True: 14, False: 0] ------------------ 29| 14| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 1, False: 13] | Branch (29:30): [True: 1, False: 0] | Branch (29:59): [True: 1, False: 0] ------------------ 30| 1| oss << val; 31| 1| return do_fmt(oss, format.substr(i + 2), rest...); 32| 13| } else { 33| 13| oss << format[i]; 34| 13| } 35| | 36| 13| i += 1; 37| 13| } 38| 1|} _ZN5Botan3fmtIJNS_3OIDENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEEEENS2_12basic_stringIcS5_NS2_9allocatorIcEEEES6_DpRKT_: 53| 5|std::string fmt(std::string_view format, const T&... args) { 54| 5| std::ostringstream oss; 55| 5| oss.imbue(std::locale::classic()); 56| 5| fmt_detail::do_fmt(oss, format, args...); 57| 5| return oss.str(); 58| 5|} _ZN5Botan10fmt_detail6do_fmtINS_3OIDEJNSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEEEEvRNS3_19basic_ostringstreamIcS6_NS3_9allocatorIcEEEES7_RKT_DpRKT0_: 25| 5|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) { 26| 5| size_t i = 0; 27| | 28| 180| while(i < format.size()) { ------------------ | Branch (28:10): [True: 180, False: 0] ------------------ 29| 180| if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') { ------------------ | Branch (29:10): [True: 5, False: 175] | Branch (29:30): [True: 5, False: 0] | Branch (29:59): [True: 5, False: 0] ------------------ 30| 5| oss << val; 31| 5| return do_fmt(oss, format.substr(i + 2), rest...); 32| 175| } else { 33| 175| oss << format[i]; 34| 175| } 35| | 36| 175| i += 1; 37| 175| } 38| 5|} _ZN5Botan11Hash_Engine10batch_hashENSt3__14spanINS2_IhLm18446744073709551615EEELm18446744073709551615EEENS2_INS2_IKhLm18446744073709551615EEELm18446744073709551615EEE: 57| 44| void batch_hash(std::span> outputs, std::span> inputs) { 58| 44| batch_hash(outputs, inputs, {}); 59| 44| } _ZN5Botan11Hash_EngineC2ENSt3__14spanIKhLm18446744073709551615EEE: 122| 88| m_common_prefix(common_prefix.begin(), common_prefix.end()) {} _ZNK5Botan11Hash_Engine13common_prefixEv: 127| 88| std::span common_prefix() const { return m_common_prefix; } _ZN5Botan11Hash_EngineD2Ev: 118| 88| virtual ~Hash_Engine() = default; _ZN5Botan11checked_mulITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_: 46| 2.90M|constexpr inline std::optional checked_mul(T a, T b) { 47| | // Multiplication by 1U is a hack to work around C's insane 48| | // integer promotion rules. 49| | // https://stackoverflow.com/questions/24795651 50| 2.90M| const T r = (1U * a) * b; 51| | // If a == 0 then the multiply certainly did not overflow 52| | // Otherwise r / a == b unless overflow occurred 53| 2.90M| if(a != 0 && r / a != b) { ------------------ | Branch (53:7): [True: 2.90M, False: 0] | Branch (53:17): [True: 0, False: 2.90M] ------------------ 54| 0| return {}; 55| 0| } 56| 2.90M| return r; 57| 2.90M|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEjEENS1_8optionalIT_EES3_S3_: 19| 2.43k|constexpr inline std::optional checked_add(T a, T b) { 20| 2.43k| const T r = a + b; 21| 2.43k| if(r < a || r < b) { ------------------ | Branch (21:7): [True: 0, False: 2.43k] | Branch (21:16): [True: 0, False: 2.43k] ------------------ 22| 0| return {}; 23| 0| } 24| 2.43k| return r; 25| 2.43k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmTpTkNS1_17unsigned_integralEJmmEQ10all_same_vIT_DpT0_EEENS1_8optionalIS2_EES2_S2_S4_: 37| 44|constexpr inline std::optional checked_add(T a, T b, Ts... rest) { 38| 44| if(auto r = checked_add(a, b)) { ------------------ | Branch (38:12): [True: 44, False: 0] ------------------ 39| 44| return checked_add(r.value(), rest...); 40| 44| } else { 41| 0| return {}; 42| 0| } 43| 44|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_: 19| 132|constexpr inline std::optional checked_add(T a, T b) { 20| 132| const T r = a + b; 21| 132| if(r < a || r < b) { ------------------ | Branch (21:7): [True: 0, False: 132] | Branch (21:16): [True: 0, False: 132] ------------------ 22| 0| return {}; 23| 0| } 24| 132| return r; 25| 132|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEmTpTkNS1_17unsigned_integralEJmEQ10all_same_vIT_DpT0_EEENS1_8optionalIS2_EES2_S2_S4_: 37| 44|constexpr inline std::optional checked_add(T a, T b, Ts... rest) { 38| 44| if(auto r = checked_add(a, b)) { ------------------ | Branch (38:12): [True: 44, False: 0] ------------------ 39| 44| return checked_add(r.value(), rest...); 40| 44| } else { 41| 0| return {}; 42| 0| } 43| 44|} _ZN5Botan13swar_in_rangeITkNSt3__117unsigned_integralEmEET_S2_S2_S2_: 144| 1.13M|constexpr T swar_in_range(T v, T lower, T upper) { 145| | // The constant 0x808080... as a T 146| 1.13M| constexpr T hi1 = (static_cast(-1) / 255) << 7; 147| | // The constant 0x7F7F7F... as a T 148| 1.13M| constexpr T lo7 = ~hi1; 149| | 150| 1.13M| const T sub = ((v | hi1) - (lower & lo7)) ^ ((v ^ (~lower)) & hi1); 151| 1.13M| const T a_lo = sub & lo7; 152| 1.13M| const T a_hi = sub & hi1; 153| 1.13M| return (lo7 - a_lo + upper) & hi1 & ~a_hi; 154| 1.13M|} _ZN5Botan23index_of_first_set_byteITkNSt3__117unsigned_integralEmEEmT_: 160| 1.06M|constexpr size_t index_of_first_set_byte(T v) { 161| | // The constant 0x010101... as a T 162| 1.06M| constexpr T lo1 = (static_cast(-1) / 255); 163| | // The constant 0x808080... as a T 164| 1.06M| constexpr T hi1 = lo1 << 7; 165| | // How many bits to shift in order to get the top byte 166| 1.06M| constexpr size_t bits = (sizeof(T) * 8) - 8; 167| | 168| 1.06M| return static_cast((((((v & hi1) - 1) & lo1) * lo1) >> bits) - 1); 169| 1.06M|} _ZN5Botan13KeccakPadding4sha3Ev: 24| 88| static constexpr KeccakPadding sha3() { return {.padding = 0b10 /* little-endian */, .bit_len = 2}; } _ZN5Botan13KeccakPadding5shakeEv: 27| 3.63k| static constexpr KeccakPadding shake() { return {.padding = 0b1111, .bit_len = 4}; } _ZN5Botan18Keccak_PermutationC2ENS0_6ConfigE: 69| 3.71k| Sponge({.bit_rate = state_bits() - config.capacity_bits, .initial_state = {}}), m_padding(config.padding) { 70| | // finish() packs the padding bits plus the first bit of "pad10*1" into a 71| | // single byte, leaving its top bit free for the final bit of "pad10*1" 72| 3.71k| BOTAN_ASSERT_NOMSG(m_padding.bit_len <= 6 && (m_padding.padding >> m_padding.bit_len) == 0); ------------------ | | 84| 3.71k| do { \ | | 85| 3.71k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 7.43k| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 3.71k, False: 0] | | | Branch (86:12): [True: 3.71k, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 3.71k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 3.71k] | | ------------------ ------------------ 73| 3.71k| } _ZN5Botan24Keccak_Permutation_roundImEEvPT_PKS1_m: 57| 399k|BOTAN_FORCE_INLINE void Keccak_Permutation_round(W T[25], const W A[25], uint64_t RC) { 58| 399k| const W C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20]; 59| 399k| const W C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21]; 60| 399k| const W C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22]; 61| 399k| const W C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23]; 62| 399k| const W C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24]; 63| | 64| 399k| const W D0 = keccak_rotl<1>(C0) ^ C3; 65| 399k| const W D1 = keccak_rotl<1>(C1) ^ C4; 66| 399k| const W D2 = keccak_rotl<1>(C2) ^ C0; 67| 399k| const W D3 = keccak_rotl<1>(C3) ^ C1; 68| 399k| const W D4 = keccak_rotl<1>(C4) ^ C2; 69| | 70| 399k| const W B00 = A[0] ^ D1; 71| 399k| const W B01 = keccak_rotl<44>(A[6] ^ D2); 72| 399k| const W B02 = keccak_rotl<43>(A[12] ^ D3); 73| 399k| const W B03 = keccak_rotl<21>(A[18] ^ D4); 74| 399k| const W B04 = keccak_rotl<14>(A[24] ^ D0); 75| 399k| T[0] = keccak_chi(B00, B01, B02) ^ keccak_iota(RC); 76| 399k| T[1] = keccak_chi(B01, B02, B03); 77| 399k| T[2] = keccak_chi(B02, B03, B04); 78| 399k| T[3] = keccak_chi(B03, B04, B00); 79| 399k| T[4] = keccak_chi(B04, B00, B01); 80| | 81| 399k| const W B05 = keccak_rotl<28>(A[3] ^ D4); 82| 399k| const W B06 = keccak_rotl<20>(A[9] ^ D0); 83| 399k| const W B07 = keccak_rotl<3>(A[10] ^ D1); 84| 399k| const W B08 = keccak_rotl<45>(A[16] ^ D2); 85| 399k| const W B09 = keccak_rotl<61>(A[22] ^ D3); 86| 399k| T[5] = keccak_chi(B05, B06, B07); 87| 399k| T[6] = keccak_chi(B06, B07, B08); 88| 399k| T[7] = keccak_chi(B07, B08, B09); 89| 399k| T[8] = keccak_chi(B08, B09, B05); 90| 399k| T[9] = keccak_chi(B09, B05, B06); 91| | 92| 399k| const W B10 = keccak_rotl<1>(A[1] ^ D2); 93| 399k| const W B11 = keccak_rotl<6>(A[7] ^ D3); 94| 399k| const W B12 = keccak_rotl<25>(A[13] ^ D4); 95| 399k| const W B13 = keccak_rotl<8>(A[19] ^ D0); 96| 399k| const W B14 = keccak_rotl<18>(A[20] ^ D1); 97| 399k| T[10] = keccak_chi(B10, B11, B12); 98| 399k| T[11] = keccak_chi(B11, B12, B13); 99| 399k| T[12] = keccak_chi(B12, B13, B14); 100| 399k| T[13] = keccak_chi(B13, B14, B10); 101| 399k| T[14] = keccak_chi(B14, B10, B11); 102| | 103| 399k| const W B15 = keccak_rotl<27>(A[4] ^ D0); 104| 399k| const W B16 = keccak_rotl<36>(A[5] ^ D1); 105| 399k| const W B17 = keccak_rotl<10>(A[11] ^ D2); 106| 399k| const W B18 = keccak_rotl<15>(A[17] ^ D3); 107| 399k| const W B19 = keccak_rotl<56>(A[23] ^ D4); 108| 399k| T[15] = keccak_chi(B15, B16, B17); 109| 399k| T[16] = keccak_chi(B16, B17, B18); 110| 399k| T[17] = keccak_chi(B17, B18, B19); 111| 399k| T[18] = keccak_chi(B18, B19, B15); 112| 399k| T[19] = keccak_chi(B19, B15, B16); 113| | 114| 399k| const W B20 = keccak_rotl<62>(A[2] ^ D3); 115| 399k| const W B21 = keccak_rotl<55>(A[8] ^ D4); 116| 399k| const W B22 = keccak_rotl<39>(A[14] ^ D0); 117| 399k| const W B23 = keccak_rotl<41>(A[15] ^ D1); 118| 399k| const W B24 = keccak_rotl<2>(A[21] ^ D2); 119| 399k| T[20] = keccak_chi(B20, B21, B22); 120| 399k| T[21] = keccak_chi(B21, B22, B23); 121| 399k| T[22] = keccak_chi(B22, B23, B24); 122| 399k| T[23] = keccak_chi(B23, B24, B20); 123| 399k| T[24] = keccak_chi(B24, B20, B21); 124| 399k|} _ZN5Botan11keccak_rotlILm1EmEET0_RKS1_: 30| 2.39M|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 2.39M| if constexpr(std::unsigned_integral) { 32| 2.39M| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 2.39M|} _ZN5Botan11keccak_rotlILm44EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm43EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm21EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm14EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan10keccak_chiImEET_RKS1_S3_S3_: 39| 9.99M|BOTAN_FORCE_INLINE W keccak_chi(const W& x, const W& y, const W& z) { 40| 9.99M| if constexpr(std::unsigned_integral) { 41| 9.99M| return x ^ (~y & z); 42| | } else { 43| | return W::chi(x, y, z); 44| | } 45| 9.99M|} _ZN5Botan11keccak_iotaImEET_m: 48| 399k|BOTAN_FORCE_INLINE W keccak_iota(uint64_t rc) { 49| 399k| if constexpr(std::unsigned_integral) { 50| 399k| return rc; 51| | } else { 52| | return W::splat(rc); 53| | } 54| 399k|} _ZN5Botan11keccak_rotlILm28EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm20EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm3EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm45EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm61EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm6EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm25EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm8EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm18EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm27EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm36EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm10EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm15EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm56EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm62EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm55EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm39EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm41EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan11keccak_rotlILm2EmEET0_RKS1_: 30| 399k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| 399k| if constexpr(std::unsigned_integral) { 32| 399k| return rotl(v); 33| | } else { 34| | return v.template rotl(); 35| | } 36| 399k|} _ZN5Botan24Keccak_Permutation_roundINS_9SIMD_4x64EEEvPT_PKS2_m: 57| 9.57k|BOTAN_FORCE_INLINE void Keccak_Permutation_round(W T[25], const W A[25], uint64_t RC) { 58| 9.57k| const W C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20]; 59| 9.57k| const W C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21]; 60| 9.57k| const W C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22]; 61| 9.57k| const W C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23]; 62| 9.57k| const W C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24]; 63| | 64| 9.57k| const W D0 = keccak_rotl<1>(C0) ^ C3; 65| 9.57k| const W D1 = keccak_rotl<1>(C1) ^ C4; 66| 9.57k| const W D2 = keccak_rotl<1>(C2) ^ C0; 67| 9.57k| const W D3 = keccak_rotl<1>(C3) ^ C1; 68| 9.57k| const W D4 = keccak_rotl<1>(C4) ^ C2; 69| | 70| 9.57k| const W B00 = A[0] ^ D1; 71| 9.57k| const W B01 = keccak_rotl<44>(A[6] ^ D2); 72| 9.57k| const W B02 = keccak_rotl<43>(A[12] ^ D3); 73| 9.57k| const W B03 = keccak_rotl<21>(A[18] ^ D4); 74| 9.57k| const W B04 = keccak_rotl<14>(A[24] ^ D0); 75| 9.57k| T[0] = keccak_chi(B00, B01, B02) ^ keccak_iota(RC); 76| 9.57k| T[1] = keccak_chi(B01, B02, B03); 77| 9.57k| T[2] = keccak_chi(B02, B03, B04); 78| 9.57k| T[3] = keccak_chi(B03, B04, B00); 79| 9.57k| T[4] = keccak_chi(B04, B00, B01); 80| | 81| 9.57k| const W B05 = keccak_rotl<28>(A[3] ^ D4); 82| 9.57k| const W B06 = keccak_rotl<20>(A[9] ^ D0); 83| 9.57k| const W B07 = keccak_rotl<3>(A[10] ^ D1); 84| 9.57k| const W B08 = keccak_rotl<45>(A[16] ^ D2); 85| 9.57k| const W B09 = keccak_rotl<61>(A[22] ^ D3); 86| 9.57k| T[5] = keccak_chi(B05, B06, B07); 87| 9.57k| T[6] = keccak_chi(B06, B07, B08); 88| 9.57k| T[7] = keccak_chi(B07, B08, B09); 89| 9.57k| T[8] = keccak_chi(B08, B09, B05); 90| 9.57k| T[9] = keccak_chi(B09, B05, B06); 91| | 92| 9.57k| const W B10 = keccak_rotl<1>(A[1] ^ D2); 93| 9.57k| const W B11 = keccak_rotl<6>(A[7] ^ D3); 94| 9.57k| const W B12 = keccak_rotl<25>(A[13] ^ D4); 95| 9.57k| const W B13 = keccak_rotl<8>(A[19] ^ D0); 96| 9.57k| const W B14 = keccak_rotl<18>(A[20] ^ D1); 97| 9.57k| T[10] = keccak_chi(B10, B11, B12); 98| 9.57k| T[11] = keccak_chi(B11, B12, B13); 99| 9.57k| T[12] = keccak_chi(B12, B13, B14); 100| 9.57k| T[13] = keccak_chi(B13, B14, B10); 101| 9.57k| T[14] = keccak_chi(B14, B10, B11); 102| | 103| 9.57k| const W B15 = keccak_rotl<27>(A[4] ^ D0); 104| 9.57k| const W B16 = keccak_rotl<36>(A[5] ^ D1); 105| 9.57k| const W B17 = keccak_rotl<10>(A[11] ^ D2); 106| 9.57k| const W B18 = keccak_rotl<15>(A[17] ^ D3); 107| 9.57k| const W B19 = keccak_rotl<56>(A[23] ^ D4); 108| 9.57k| T[15] = keccak_chi(B15, B16, B17); 109| 9.57k| T[16] = keccak_chi(B16, B17, B18); 110| 9.57k| T[17] = keccak_chi(B17, B18, B19); 111| 9.57k| T[18] = keccak_chi(B18, B19, B15); 112| 9.57k| T[19] = keccak_chi(B19, B15, B16); 113| | 114| 9.57k| const W B20 = keccak_rotl<62>(A[2] ^ D3); 115| 9.57k| const W B21 = keccak_rotl<55>(A[8] ^ D4); 116| 9.57k| const W B22 = keccak_rotl<39>(A[14] ^ D0); 117| 9.57k| const W B23 = keccak_rotl<41>(A[15] ^ D1); 118| 9.57k| const W B24 = keccak_rotl<2>(A[21] ^ D2); 119| 9.57k| T[20] = keccak_chi(B20, B21, B22); 120| 9.57k| T[21] = keccak_chi(B21, B22, B23); 121| 9.57k| T[22] = keccak_chi(B22, B23, B24); 122| 9.57k| T[23] = keccak_chi(B23, B24, B20); 123| 9.57k| T[24] = keccak_chi(B24, B20, B21); 124| 9.57k|} _ZN5Botan11keccak_rotlILm1ENS_9SIMD_4x64EEET0_RKS2_: 30| 57.4k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 57.4k| } else { 34| 57.4k| return v.template rotl(); 35| 57.4k| } 36| 57.4k|} _ZN5Botan11keccak_rotlILm44ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm43ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm21ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm14ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan10keccak_chiINS_9SIMD_4x64EEET_RKS2_S4_S4_: 39| 239k|BOTAN_FORCE_INLINE W keccak_chi(const W& x, const W& y, const W& z) { 40| | if constexpr(std::unsigned_integral) { 41| | return x ^ (~y & z); 42| 239k| } else { 43| 239k| return W::chi(x, y, z); 44| 239k| } 45| 239k|} _ZN5Botan11keccak_iotaINS_9SIMD_4x64EEET_m: 48| 9.57k|BOTAN_FORCE_INLINE W keccak_iota(uint64_t rc) { 49| | if constexpr(std::unsigned_integral) { 50| | return rc; 51| 9.57k| } else { 52| 9.57k| return W::splat(rc); 53| 9.57k| } 54| 9.57k|} _ZN5Botan11keccak_rotlILm28ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm20ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm3ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm45ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm61ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm6ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm25ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm8ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm18ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm27ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm36ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm10ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm15ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm56ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm62ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm55ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm39ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm41ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11keccak_rotlILm2ENS_9SIMD_4x64EEET0_RKS2_: 30| 9.57k|BOTAN_FORCE_INLINE W keccak_rotl(const W& v) { 31| | if constexpr(std::unsigned_integral) { 32| | return rotl(v); 33| 9.57k| } else { 34| 9.57k| return v.template rotl(); 35| 9.57k| } 36| 9.57k|} _ZN5Botan11Kyber_Algos17PolynomialSamplerINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEEEC2ENS_10StrongSpanIKS9_EERKNS_14KyberConstantsE: 68| 44| m_seed(seed), m_mode(mode), m_nonce(0) {} _ZN5Botan11Kyber_Algos17PolynomialSamplerINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEEE38sample_polynomial_vector_pair_cbd_eta1Ev: 77| 44| std::pair sample_polynomial_vector_pair_cbd_eta1() { 78| 44| auto result = std::make_pair(KyberPolyVec(m_mode.k()), KyberPolyVec(m_mode.k())); 79| 44| sample_polys_cbd(concat(result.first.polynomials(), // 80| 44| result.second.polynomials()), 81| 44| m_mode.eta1()); 82| 44| return result; 83| 44| } _ZN5Botan11Kyber_Algos17PolynomialSamplerINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEEE16sample_polys_cbdENS3_4spanIKPNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNSC_6DomainE0EEELm18446744073709551615EEENS_14KyberConstants8KyberEtaE: 108| 44| void sample_polys_cbd(std::span polys, KyberConstants::KyberEta eta) { 109| 44| BOTAN_ASSERT_NOMSG(!polys.empty()); ------------------ | | 84| 44| do { \ | | 85| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 44| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 44] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 44| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 44] | | ------------------ ------------------ 110| 44| const size_t poly_bytes = cbd_randomness_bytes(*polys[0], eta); 111| | 112| 44| KyberSamplingRandomness randomness(polys.size() * poly_bytes); 113| 44| std::vector> outputs(polys.size()); 114| 332| for(size_t i = 0; i < polys.size(); ++i) { ------------------ | Branch (114:28): [True: 288, False: 44] ------------------ 115| 288| outputs[i] = StrongSpan(randomness).subspan(i * poly_bytes, poly_bytes); 116| 288| } 117| | 118| 44| const auto& sym = m_mode.symmetric_primitives(); 119| 44| sym.PRF_batch(outputs, m_seed, m_nonce); 120| 44| m_nonce += static_cast(polys.size()); 121| | 122| 332| for(size_t i = 0; i < polys.size(); ++i) { ------------------ | Branch (122:28): [True: 288, False: 44] ------------------ 123| 288| sample_polynomial_from_cbd(*polys[i], eta, outputs[i]); 124| 288| } 125| 44| } _ZN5Botan11Kyber_Algos17PolynomialSamplerINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEEE20cbd_randomness_bytesERKNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNSB_6DomainE0EEENS_14KyberConstants8KyberEtaE: 95| 44| static size_t cbd_randomness_bytes(const KyberPoly& poly, KyberConstants::KyberEta eta) { 96| 44| switch(eta) { ------------------ | Branch (96:17): [True: 44, False: 0] ------------------ 97| 33| case KyberConstants::KyberEta::_2: ------------------ | Branch (97:13): [True: 33, False: 11] ------------------ 98| 33| return 2 * poly.size() / 4; 99| 11| case KyberConstants::KyberEta::_3: ------------------ | Branch (99:13): [True: 11, False: 33] ------------------ 100| 11| return 3 * poly.size() / 4; 101| 44| } 102| | 103| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 104| 0| } _ZN5Botan11Kyber_Algos24encode_polynomial_vectorITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS3_9allocatorIhEEEEEET_RKNS_8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS9_6DomainE1EEERKNS_14KyberConstantsE: 51| 44|T encode_polynomial_vector(const KyberPolyVecNTT& vec, const KyberConstants& mode) { 52| 44| T r(mode.polynomial_vector_bytes()); 53| 44| encode_polynomial_vector(r, vec); 54| 44| return r; 55| 44|} _ZNK5Botan14KyberConstants4modeEv: 73| 64| KyberMode mode() const { return m_mode; } _ZNK5Botan14KyberConstants1kEv: 81| 2.17k| uint8_t k() const { return m_k; } _ZNK5Botan14KyberConstants23polynomial_vector_bytesEv: 99| 142| size_t polynomial_vector_bytes() const { return m_polynomial_vector_bytes; } _ZNK5Botan14KyberConstants22seed_private_key_bytesEv: 121| 54| size_t seed_private_key_bytes() const { return m_seed_private_key_bytes; } _ZN5Botan14KyberConstantsC2EOS0_: 69| 220| KyberConstants(KyberConstants&& other) = default; _ZNK5Botan14KyberConstants26expanded_private_key_bytesEv: 118| 10| size_t expanded_private_key_bytes() const { return m_expanded_private_key_bytes; } _ZN5Botan14KyberConstantsC2ERKS0_: 67| 44| KyberConstants(const KyberConstants& other) : KyberConstants(other.m_mode) {} _ZNK5Botan14KyberConstants4eta1Ev: 83| 44| KyberEta eta1() const { return m_eta1; } _ZNK5Botan14KyberConstants3d_uEv: 87| 98| KyberDu d_u() const { return m_du; } _ZNK5Botan14KyberConstants3d_vEv: 89| 98| KyberDv d_v() const { return m_dv; } _ZNK5Botan14KyberConstants16public_key_bytesEv: 114| 98| size_t public_key_bytes() const { return polynomial_vector_bytes() + SEED_BYTES; } _ZNK5Botan14KyberConstants20symmetric_primitivesEv: 125| 176| Kyber_Symmetric_Primitives& symmetric_primitives() const { return *m_symmetric_primitives; } _ZN5Botan11Kyber_Algos8load_le3ENSt3__14spanIKhLm3EEE: 23| 94.7k|inline uint32_t load_le3(std::span in) { 24| 94.7k| return Botan::load_le(std::array{in[0], in[1], in[2], 0}); 25| 94.7k|} _ZN5Botan19Kyber_Keypair_CodecD2Ev: 24| 44| virtual ~Kyber_Keypair_Codec() = default; _ZN5Botan24Kyber_PrivateKeyInternalC2ENS_14KyberConstantsENS_8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS2_6DomainE1EEENS_19KyberPrivateKeySeedE: 86| 44| m_mode(std::move(mode)), m_s(std::move(s)), m_seed(std::move(seed)) {} _ZN5Botan15KyberPolyTraits29montgomery_reduce_coefficientEi: 33| 36.8k| constexpr static T montgomery_reduce_coefficient(T2 a) { 34| 36.8k| const T u = static_cast(static_cast(a) * Q_inverse); 35| 36.8k| auto t = static_cast(u) * Q; 36| 36.8k| t = a - t; 37| 36.8k| t >>= sizeof(T) * 8; 38| 36.8k| return static_cast(t); 39| 36.8k| } _ZN5Botan15KyberPolyTraits26barrett_reduce_coefficientEs: 41| 110k| constexpr static T barrett_reduce_coefficient(T a) { 42| 110k| const T t = static_cast(((BARRETT_V * a) >> 26) * Q); 43| 110k| return static_cast(a - t); 44| 110k| } _ZN5Botan15KyberPolyTraits9q_inverseEv: 50| 502| static constexpr T q_inverse() { return Q_inverse; } _ZN5Botan15KyberPolyTraits3nttENSt3__14spanIsLm256EEE: 61| 288| constexpr static void ntt(std::span p) { 62| 288|#if defined(BOTAN_HAS_KYBER_AVX2) 63| 288| if(!std::is_constant_evaluated() && CPUID::has(CPUID::Feature::AVX2)) { ------------------ | Branch (63:13): [True: 288, Folded] | Branch (63:46): [True: 288, False: 0] ------------------ 64| 288| return Kyber_AVX2::ntt(p); 65| 288| } 66| 0|#endif 67| | 68| 0| for(size_t len = N / 2, i = 0; len >= 2; len /= 2) { ------------------ | Branch (68:41): [True: 0, False: 0] ------------------ 69| 0| for(size_t start = 0, j = 0; start < N; start = j + len) { ------------------ | Branch (69:42): [True: 0, False: 0] ------------------ 70| 0| const auto zeta = zetas[++i]; 71| 0| for(j = start; j < start + len; ++j) { ------------------ | Branch (71:31): [True: 0, False: 0] ------------------ 72| 0| const auto t = fqmul(zeta, p[j + len]); 73| 0| p[j + len] = static_cast(p[j] - t); 74| 0| p[j] = static_cast(p[j] + t); 75| 0| } 76| 0| } 77| 0| } 78| | 79| 0| barrett_reduce(p); 80| 0| } _ZN5Botan15KyberPolyTraits25poly_pointwise_montgomeryENSt3__14spanIsLm256EEENS2_IKsLm256EEES5_: 124| 502| std::span rhs) { 125| 502|#if defined(BOTAN_HAS_KYBER_AVX2) 126| 502| if(!std::is_constant_evaluated() && CPUID::has(CPUID::Feature::AVX2)) { ------------------ | Branch (126:13): [True: 502, Folded] | Branch (126:46): [True: 502, False: 0] ------------------ 127| 502| return Kyber_AVX2::poly_pointwise_montgomery(result, lhs, rhs); 128| 502| } 129| 0|#endif 130| | 131| | /** 132| | * NIST FIPS 203, Algorithm 12 (BaseCaseMultiply) 133| | */ 134| 0| const auto basemul = [](const auto a, const auto b, const T zeta) -> std::tuple { 135| 0| return {static_cast(fqmul(a[0], b[0]) + fqmul(fqmul(a[1], b[1]), zeta)), 136| 0| static_cast(fqmul(a[0], b[1]) + fqmul(a[1], b[0]))}; 137| 0| }; 138| | 139| 0| const auto Tq_elem_count = [](auto p) { return p.size() / 2; }; 140| | 141| 0| const auto Tq_elem = [](auto p, size_t i) { 142| 0| if constexpr(std::is_const_v) { 143| 0| return std::array{p[2 * i], p[2 * i + 1]}; 144| 0| } else { 145| 0| return std::tuple{p[2 * i], p[2 * i + 1]}; 146| 0| } 147| 0| }; 148| | 149| 0| for(size_t i = 0; i < Tq_elem_count(result) / 2; ++i) { ------------------ | Branch (149:28): [True: 0, False: 0] ------------------ 150| 0| const T zeta = zetas[64 + i]; 151| 0| const T nzeta = static_cast(-zeta); 152| 0| Tq_elem(result, 2 * i) = basemul(Tq_elem(lhs, 2 * i), Tq_elem(rhs, 2 * i), zeta); 153| 0| Tq_elem(result, 2 * i + 1) = basemul(Tq_elem(lhs, 2 * i + 1), Tq_elem(rhs, 2 * i + 1), nzeta); 154| 0| } 155| 0| } _ZNK5Botan26Kyber_Symmetric_Primitives1HENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS_25KyberSerializedPublicKey_EJEEEEE: 42| 44| KyberHashedPublicKey H(StrongSpan pk) const { 43| 44| return create_H()->process(pk); 44| 44| } _ZNK5Botan26Kyber_Symmetric_Primitives1GENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_20KyberSeedRandomness_EJEEEEERKNS_14KyberConstantsE: 47| 44| const KyberConstants& mode) const { 48| 44| if(auto domsep = seed_expansion_domain_separator(mode)) { ------------------ | Branch (48:18): [True: 44, False: 0] ------------------ 49| 44| return G_split(seed, *domsep); 50| 44| } else { 51| 0| return G_split(seed); 52| 0| } 53| 44| } _ZNK5Botan26Kyber_Symmetric_Primitives9setup_XOFERNSt3__110unique_ptrINS_3XOFENS1_14default_deleteIS3_EEEENS_10StrongSpanIKNS_6StrongINS1_6vectorIhNS1_9allocatorIhEEEENS_13KyberSeedRho_EJEEEEENS1_5tupleIJhhEEE: 88| 70| std::tuple matrix_position) const { 89| 70| if(!xof) { ------------------ | Branch (89:13): [True: 32, False: 38] ------------------ 90| 32| xof = create_XOF(seed, matrix_position); 91| 38| } else { 92| 38| init_XOF(*xof, seed, matrix_position); 93| 38| } 94| 70| } _ZNK5Botan26Kyber_Symmetric_Primitives9setup_PRFERNSt3__110unique_ptrINS_3XOFENS1_14default_deleteIS3_EEEENS1_4spanIKhLm18446744073709551615EEEh: 97| 288| void setup_PRF(std::unique_ptr& xof, std::span seed, uint8_t nonce) const { 98| 288| if(!xof) { ------------------ | Branch (98:13): [True: 44, False: 244] ------------------ 99| 44| xof = create_PRF(seed, nonce); 100| 244| } else { 101| 244| init_PRF(*xof, seed, nonce); 102| 244| } 103| 288| } _ZNK5Botan26Kyber_Symmetric_Primitives9PRF_batchENSt3__14spanIKNS_10StrongSpanINS_6StrongINS1_6vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEEELm18446744073709551615EEENS2_IKhLm18446744073709551615EEEh: 127| 44| uint8_t first_nonce) const { 128| 44| std::unique_ptr xof; 129| 332| for(size_t i = 0; i < outputs.size(); ++i) { ------------------ | Branch (129:28): [True: 288, False: 44] ------------------ 130| 288| BOTAN_DEBUG_ASSERT(outputs[i].size() == outputs[0].size()); ------------------ | | 137| 288| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 288| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 288] | | ------------------ ------------------ 131| 288| setup_PRF(xof, seed, static_cast(first_nonce + i)); 132| 288| xof->output(outputs[i]); 133| 288| } 134| 44| } _ZN5Botan26Kyber_Symmetric_Primitives15shake_XOF_batchENSt3__14spanINS2_IhLm18446744073709551615EEELm18446744073709551615EEENS_10StrongSpanIKNS_6StrongINS1_6vectorIhNS1_9allocatorIhEEEENS_13KyberSeedRho_EJEEEEENS2_IKNS1_5tupleIJhhEEELm18446744073709551615EEE: 158| 44| std::span> positions) { 159| 44| BOTAN_ASSERT_NOMSG(outputs.size() == positions.size()); ------------------ | | 84| 44| do { \ | | 85| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 44| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 44] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 44| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 44] | | ------------------ ------------------ 160| 44| if(outputs.empty()) { ------------------ | Branch (160:13): [True: 0, False: 44] ------------------ 161| 0| return; 162| 0| } 163| | 164| 44| auto engine = Hash_Engine::create_or_throw(fmt("SHAKE-128({})", 8 * outputs[0].size()), seed); 165| | 166| 44| std::vector pos_bytes(2 * positions.size()); 167| 44| std::vector> inputs(positions.size()); 168| 546| for(size_t i = 0; i < positions.size(); ++i) { ------------------ | Branch (168:28): [True: 502, False: 44] ------------------ 169| 502| BOTAN_DEBUG_ASSERT(outputs[i].size() == outputs[0].size()); ------------------ | | 137| 502| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 502| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 502] | | ------------------ ------------------ 170| 502| pos_bytes[2 * i] = std::get<0>(positions[i]); 171| 502| pos_bytes[2 * i + 1] = std::get<1>(positions[i]); 172| 502| inputs[i] = std::span(pos_bytes).subspan(2 * i, 2); 173| 502| } 174| | 175| 44| engine->batch_hash(outputs, inputs); 176| 44| } _ZNK5Botan26Kyber_Symmetric_Primitives7G_splitITkNS_8concepts22contiguous_strong_typeENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_13KyberSeedRho_EJEEETkNS2_22contiguous_strong_typeENS3_INS5_IhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEETpTkNS_6ranges16contiguous_rangeEJNS_10StrongSpanIKNS3_ISD_NS_20KyberSeedRandomness_EJEEEEENS4_5arrayIhLm1EEEEEENS4_4pairIT_T0_EEDpRKT1_: 140| 44| std::pair G_split(const InputTs&... inputs) const { 141| 44| auto g = create_G(); 142| 44| (g->update(inputs), ...); 143| 44| const auto s = g->final(); 144| | 145| 44| BufferSlicer bs(s); 146| 44| std::pair result; 147| 44| result.first = bs.copy(KyberConstants::SEED_BYTES); 148| 44| result.second = bs.copy(KyberConstants::SEED_BYTES); 149| 44| BOTAN_ASSERT_NOMSG(bs.empty()); ------------------ | | 84| 44| do { \ | | 85| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 44| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 44] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 44| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 44] | | ------------------ ------------------ 150| 44| return result; 151| 44| } _ZN5Botan26Kyber_Symmetric_PrimitivesD2Ev: 32| 98| virtual ~Kyber_Symmetric_Primitives() = default; _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETpTkNS0_20unsigned_integralishEJmEQ10all_same_vIDpT1_EEEDaS6_: 696| 996k|inline constexpr auto store_any(Ts... ins) { 697| 996k| return store_any(std::array{ins...}); 698| 996k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayImLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_: 663| 996k|inline constexpr auto store_any(InR&& in_range) { 664| 996k| auto out = []([[maybe_unused]] const auto& in) { 665| 996k| if constexpr(std::same_as) { 666| 996k| if constexpr(ranges::statically_spanable_range) { 667| 996k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 996k| return std::array(); 669| 996k| } else { 670| 996k| static_assert( 671| 996k| !std::same_as, 672| 996k| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 996k| } 674| 996k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 996k| return OutR(std::span{in}.size_bytes()); 676| 996k| } else { 677| 996k| return OutR{}; 678| 996k| } 679| 996k| }(in_range); 680| | 681| 996k| store_any>(out, std::forward(in_range)); 682| 996k| return out; 683| 996k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayImLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSD_: 664| 996k| auto out = []([[maybe_unused]] const auto& in) { 665| 996k| if constexpr(std::same_as) { 666| 996k| if constexpr(ranges::statically_spanable_range) { 667| 996k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 996k| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 996k| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE57005EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm8EEETkNS4_14spanable_rangeENS6_ImLm1EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 1.03M|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 1.03M| ranges::assert_equal_byte_lengths(out, in); 605| 1.03M| using element_type = std::ranges::range_value_t; 606| | 607| 1.03M| const auto store_elementwise = [&] { 608| 1.03M| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.03M| std::span out_s(out); 610| 1.03M| for(const auto in_elem : in) { 611| 1.03M| store_any(out_s.template first(), in_elem); 612| 1.03M| out_s = out_s.subspan(bytes_per_element); 613| 1.03M| } 614| 1.03M| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 1.03M| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 1.03M] ------------------ 620| 0| store_elementwise(); 621| 1.03M| } else { 622| 1.03M| if constexpr(endianness == std::endian::native && !custom_storable) { 623| 1.03M| typecast_copy(out, in); 624| | } else { 625| | store_elementwise(); 626| | } 627| 1.03M| } 628| 1.03M|} _ZN5Botan11make_uint16Ehh: 92| 70|inline constexpr uint16_t make_uint16(uint8_t i0, uint8_t i1) { 93| 70| return static_cast((static_cast(i0) << 8) | i1); 94| 70|} _ZN5Botan11make_uint32Ehhhh: 104| 657k|inline constexpr uint32_t make_uint32(uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3) { 105| 657k| return ((static_cast(i0) << 24) | (static_cast(i1) << 16) | (static_cast(i2) << 8) | 106| 657k| (static_cast(i3))); 107| 657k|} _ZN5Botan6detail26unwrap_strong_type_or_enumITkNS0_20unsigned_integralishEmEEDaT_: 190| 88.3k|constexpr auto unwrap_strong_type_or_enum(InT t) { 191| | if constexpr(std::is_enum_v) { 192| | // TODO: C++23: use std::to_underlying(in) instead 193| | return static_cast>(t); 194| 88.3k| } else { 195| 88.3k| return Botan::unwrap_strong_type(t); 196| 88.3k| } 197| 88.3k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 32.0k|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 32.0k| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 32.0k| using InT = decltype(in); 528| 32.0k| ranges::assert_exact_byte_length(out_range); 529| 32.0k| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 32.0k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 32.0k] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 32.0k| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| 32.0k| } else if constexpr(endianness == std::endian::native) { 540| 32.0k| typecast_copy(out, in); 541| | } else { 542| | static_assert(opposite(endianness) == std::endian::native); 543| | typecast_copy(out, reverse_bytes(in)); 544| | } 545| 32.0k| } 546| 32.0k|} _ZN5Botan12get_byte_varImEEhmT_: 69| 47.0k|inline constexpr uint8_t get_byte_var(size_t byte_num, T input) { 70| 47.0k| return static_cast(input >> (((~byte_num) & (sizeof(T) - 1)) << 3)); 71| 47.0k|} _ZN5Botan8store_leINS_6detail10AutoDetectEJRKmPhEEEDaDpOT0_: 736| 32.0k|inline constexpr auto store_le(ParamTs&&... params) { 737| 32.0k| return detail::store_any(std::forward(params)...); 738| 32.0k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS0_20unsigned_integralishEmQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_EEEvS6_Ph: 711| 32.0k|inline constexpr void store_any(T in, uint8_t out[]) { 712| | // asserts that *out points to enough bytes to write into 713| 32.0k| store_any(in, std::span(out, sizeof(T))); 714| 32.0k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQsr3stdE7same_asIS4_T0_EEEvT1_OT2_: 646| 32.0k|inline constexpr void store_any(T in, OutR&& out_range) { 647| 32.0k| store_any(in, std::forward(out_range)); 648| 32.0k|} _ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEjTkNSt3__117unsigned_integralEjEEDaT0_: 200| 102k|constexpr auto wrap_strong_type_or_enum(T t) { 201| | if constexpr(std::is_enum_v) { 202| | return static_cast(t); 203| 102k| } else { 204| 102k| return Botan::wrap_strong_type(t); 205| 102k| } 206| 102k|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEjTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm4EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 7.80k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 7.80k| using OutT = detail::wrapped_type; 280| 7.80k| ranges::assert_exact_byte_length(in_range); 281| | 282| 7.80k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 7.80k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 7.80k| return fallback_load_any(std::forward(in_range)); 288| 7.80k| } else { 289| 7.80k| const std::span in{in_range}; 290| 7.80k| if constexpr(sizeof(OutT) == 1) { 291| 7.80k| return static_cast(in[0]); 292| 7.80k| } else if constexpr(endianness == std::endian::native) { 293| 7.80k| return typecast_copy(in); 294| 7.80k| } else { 295| 7.80k| static_assert(opposite(endianness) == std::endian::native); 296| 7.80k| return reverse_bytes(typecast_copy(in)); 297| 7.80k| } 298| 7.80k| } 299| 7.80k| }()); 300| 7.80k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJRKmPhEEEDaDpOT0_: 745| 6.82k|inline constexpr auto store_be(ParamTs&&... params) { 746| 6.82k| return detail::store_any(std::forward(params)...); 747| 6.82k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEmQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asIT1_S5_EEEvS6_Ph: 711| 6.82k|inline constexpr void store_any(T in, uint8_t out[]) { 712| | // asserts that *out points to enough bytes to write into 713| 6.82k| store_any(in, std::span(out, sizeof(T))); 714| 6.82k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQsr3stdE7same_asIS4_T0_EEEvT1_OT2_: 646| 6.82k|inline constexpr void store_any(T in, OutR&& out_range) { 647| 6.82k| store_any(in, std::forward(out_range)); 648| 6.82k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 56.2k|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 56.2k| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 56.2k| using InT = decltype(in); 528| 56.2k| ranges::assert_exact_byte_length(out_range); 529| 56.2k| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 56.2k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 56.2k] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 56.2k| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| | } else if constexpr(endianness == std::endian::native) { 540| | typecast_copy(out, in); 541| 56.2k| } else { 542| 56.2k| static_assert(opposite(endianness) == std::endian::native); 543| 56.2k| typecast_copy(out, reverse_bytes(in)); 544| 56.2k| } 545| 56.2k| } 546| 56.2k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 135k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 135k| using OutT = detail::wrapped_type; 280| 135k| ranges::assert_exact_byte_length(in_range); 281| | 282| 135k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 135k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 135k| return fallback_load_any(std::forward(in_range)); 288| 135k| } else { 289| 135k| const std::span in{in_range}; 290| 135k| if constexpr(sizeof(OutT) == 1) { 291| 135k| return static_cast(in[0]); 292| 135k| } else if constexpr(endianness == std::endian::native) { 293| 135k| return typecast_copy(in); 294| 135k| } else { 295| 135k| static_assert(opposite(endianness) == std::endian::native); 296| 135k| return reverse_bytes(typecast_copy(in)); 297| 135k| } 298| 135k| } 299| 135k| }()); 300| 135k|} _ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEmTkNSt3__117unsigned_integralEmEEDaT0_: 200| 209k|constexpr auto wrap_strong_type_or_enum(T t) { 201| | if constexpr(std::is_enum_v) { 202| | return static_cast(t); 203| 209k| } else { 204| 209k| return Botan::wrap_strong_type(t); 205| 209k| } 206| 209k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 135k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 135k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 135k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 135k| } else { 289| 135k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| 135k| } else { 295| 135k| static_assert(opposite(endianness) == std::endian::native); 296| 135k| return reverse_bytes(typecast_copy(in)); 297| 135k| } 298| 135k| } 299| 135k| }()); _ZN5Botan11copy_out_beITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEEEvNS2_4spanIhLm18446744073709551615EEERKT_: 773| 38|inline void copy_out_be(std::span out, const InR& in) { 774| 38| using T = std::ranges::range_value_t; 775| 38| std::span in_s{in}; 776| 38| const auto remaining_bytes = detail::copy_out_any_word_aligned_portion(out, in_s); 777| | 778| | // copy remaining bytes as a partial word 779| 38| for(size_t i = 0; i < remaining_bytes; ++i) { ------------------ | Branch (779:22): [True: 0, False: 38] ------------------ 780| 0| out[i] = get_byte_var(i, in_s.front()); 781| 0| } 782| 38|} _ZN5Botan6detail33copy_out_any_word_aligned_portionILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmEEmRNS2_4spanIhLm18446744073709551615EEERNS4_IKT0_Lm18446744073709551615EEE: 752| 38|inline size_t copy_out_any_word_aligned_portion(std::span& out, std::span& in) { 753| 38| const size_t full_words = out.size() / sizeof(T); 754| 38| const size_t full_word_bytes = full_words * sizeof(T); 755| 38| const size_t remaining_bytes = out.size() - full_word_bytes; 756| 38| BOTAN_ASSERT_NOMSG(in.size_bytes() >= full_word_bytes + remaining_bytes); ------------------ | | 84| 38| do { \ | | 85| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 38| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 38] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 38| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 38] | | ------------------ ------------------ 757| | 758| | // copy full words 759| 38| store_any(out.first(full_word_bytes), in.first(full_words)); 760| 38| out = out.subspan(full_word_bytes); 761| 38| in = in.subspan(full_words); 762| | 763| 38| return remaining_bytes; 764| 38|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm18446744073709551615EEETkNS4_14spanable_rangeENS6_IKmLm18446744073709551615EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 38|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 38| ranges::assert_equal_byte_lengths(out, in); 605| 38| using element_type = std::ranges::range_value_t; 606| | 607| 38| const auto store_elementwise = [&] { 608| 38| constexpr size_t bytes_per_element = sizeof(element_type); 609| 38| std::span out_s(out); 610| 38| for(const auto in_elem : in) { 611| 38| store_any(out_s.template first(), in_elem); 612| 38| out_s = out_s.subspan(bytes_per_element); 613| 38| } 614| 38| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 38| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 38] ------------------ 620| 0| store_elementwise(); 621| 38| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 38| } else { 625| 38| store_elementwise(); 626| 38| } 627| 38| } 628| 38|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm18446744073709551615EEETkNS4_14spanable_rangeENS6_IKmLm18446744073709551615EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 38| const auto store_elementwise = [&] { 608| 38| constexpr size_t bytes_per_element = sizeof(element_type); 609| 38| std::span out_s(out); 610| 304| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 304, False: 38] ------------------ 611| 304| store_any(out_s.template first(), in_elem); 612| 304| out_s = out_s.subspan(bytes_per_element); 613| 304| } 614| 38| }; _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEETpTkNS0_20unsigned_integralishEJmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_: 582| 49.4k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, Ts... ins) { 583| 49.4k| ranges::assert_exact_byte_length<(sizeof(Ts) + ...)>(out); 584| 49.4k| auto store_one = [off = 0](auto o, T i) mutable { 585| 49.4k| store_any(i, o.subspan(off).template first()); 586| 49.4k| off += sizeof(T); 587| 49.4k| }; 588| | 589| 49.4k| (store_one(std::span{out}, ins), ...); 590| 49.4k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEETpTkNS0_20unsigned_integralishEJmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_ENUlTyS9_T_E_clImS7_EEDaS9_SE_: 584| 49.4k| auto store_one = [off = 0](auto o, T i) mutable { 585| 49.4k| store_any(i, o.subspan(off).template first()); 586| 49.4k| off += sizeof(T); 587| 49.4k| }; _ZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 44.5k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 44.5k| using OutT = detail::wrapped_type; 280| 44.5k| ranges::assert_exact_byte_length(in_range); 281| | 282| 44.5k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 44.5k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 44.5k| return fallback_load_any(std::forward(in_range)); 288| 44.5k| } else { 289| 44.5k| const std::span in{in_range}; 290| 44.5k| if constexpr(sizeof(OutT) == 1) { 291| 44.5k| return static_cast(in[0]); 292| 44.5k| } else if constexpr(endianness == std::endian::native) { 293| 44.5k| return typecast_copy(in); 294| 44.5k| } else { 295| 44.5k| static_assert(opposite(endianness) == std::endian::native); 296| 44.5k| return reverse_bytes(typecast_copy(in)); 297| 44.5k| } 298| 44.5k| } 299| 44.5k| }()); 300| 44.5k|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmEET0_PKhm: 454| 200|inline constexpr OutT load_any(const uint8_t in[], size_t off) { 455| | // asserts that *in points to enough bytes to read at offset off 456| 200| constexpr size_t out_size = sizeof(OutT); 457| 200| return load_any(std::span(in + off * out_size, out_size)); 458| 200|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 44.5k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 44.5k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 44.5k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 44.5k| } else { 289| 44.5k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| 44.5k| } else if constexpr(endianness == std::endian::native) { 293| 44.5k| return typecast_copy(in); 294| | } else { 295| | static_assert(opposite(endianness) == std::endian::native); 296| | return reverse_bytes(typecast_copy(in)); 297| | } 298| 44.5k| } 299| 44.5k| }()); _ZN5Botan7load_leImJPKhRmEEEDaDpOT0_: 495| 200|inline constexpr auto load_le(ParamTs&&... params) { 496| 200| return detail::load_any(std::forward(params)...); 497| 200|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmEET0_PKhm: 454| 11.8k|inline constexpr OutT load_any(const uint8_t in[], size_t off) { 455| | // asserts that *in points to enough bytes to read at offset off 456| 11.8k| constexpr size_t out_size = sizeof(OutT); 457| 11.8k| return load_any(std::span(in + off * out_size, out_size)); 458| 11.8k|} _ZN5Botan7load_beImJNSt3__14spanIKhLm8EEEEEEDaDpOT0_: 504| 123k|inline constexpr auto load_be(ParamTs&&... params) { 505| 123k| return detail::load_any(std::forward(params)...); 506| 123k|} _ZN5Botan7load_beImJRNSt3__15arrayIhLm8EEEEEEDaDpOT0_: 504| 25.6k|inline constexpr auto load_be(ParamTs&&... params) { 505| 25.6k| return detail::load_any(std::forward(params)...); 506| 25.6k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 25.6k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 25.6k| using OutT = detail::wrapped_type; 280| 25.6k| ranges::assert_exact_byte_length(in_range); 281| | 282| 25.6k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 25.6k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 25.6k| return fallback_load_any(std::forward(in_range)); 288| 25.6k| } else { 289| 25.6k| const std::span in{in_range}; 290| 25.6k| if constexpr(sizeof(OutT) == 1) { 291| 25.6k| return static_cast(in[0]); 292| 25.6k| } else if constexpr(endianness == std::endian::native) { 293| 25.6k| return typecast_copy(in); 294| 25.6k| } else { 295| 25.6k| static_assert(opposite(endianness) == std::endian::native); 296| 25.6k| return reverse_bytes(typecast_copy(in)); 297| 25.6k| } 298| 25.6k| } 299| 25.6k| }()); 300| 25.6k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 25.6k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 25.6k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 25.6k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 25.6k| } else { 289| 25.6k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| 25.6k| } else { 295| 25.6k| static_assert(opposite(endianness) == std::endian::native); 296| 25.6k| return reverse_bytes(typecast_copy(in)); 297| 25.6k| } 298| 25.6k| } 299| 25.6k| }()); _ZN5Botan7load_beImJPKhmEEEDaDpOT0_: 504| 11.8k|inline constexpr auto load_be(ParamTs&&... params) { 505| 11.8k| return detail::load_any(std::forward(params)...); 506| 11.8k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm32EEERNS3_5arrayImLm4EEEEEEDaDpOT0_: 745| 2.14k|inline constexpr auto store_be(ParamTs&&... params) { 746| 2.14k| return detail::store_any(std::forward(params)...); 747| 2.14k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm32EEETkNS5_14spanable_rangeENS2_5arrayImLm4EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 2.14k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 2.14k| ranges::assert_equal_byte_lengths(out, in); 605| 2.14k| using element_type = std::ranges::range_value_t; 606| | 607| 2.14k| const auto store_elementwise = [&] { 608| 2.14k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 2.14k| std::span out_s(out); 610| 2.14k| for(const auto in_elem : in) { 611| 2.14k| store_any(out_s.template first(), in_elem); 612| 2.14k| out_s = out_s.subspan(bytes_per_element); 613| 2.14k| } 614| 2.14k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 2.14k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 2.14k] ------------------ 620| 0| store_elementwise(); 621| 2.14k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 2.14k| } else { 625| 2.14k| store_elementwise(); 626| 2.14k| } 627| 2.14k| } 628| 2.14k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm32EEETkNS5_14spanable_rangeENS2_5arrayImLm4EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 2.14k| const auto store_elementwise = [&] { 608| 2.14k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 2.14k| std::span out_s(out); 610| 8.59k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 8.59k, False: 2.14k] ------------------ 611| 8.59k| store_any(out_s.template first(), in_elem); 612| 8.59k| out_s = out_s.subspan(bytes_per_element); 613| 8.59k| } 614| 2.14k| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm48EEERNS3_5arrayImLm6EEEEEEDaDpOT0_: 745| 1.37k|inline constexpr auto store_be(ParamTs&&... params) { 746| 1.37k| return detail::store_any(std::forward(params)...); 747| 1.37k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm48EEETkNS5_14spanable_rangeENS2_5arrayImLm6EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 1.37k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 1.37k| ranges::assert_equal_byte_lengths(out, in); 605| 1.37k| using element_type = std::ranges::range_value_t; 606| | 607| 1.37k| const auto store_elementwise = [&] { 608| 1.37k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.37k| std::span out_s(out); 610| 1.37k| for(const auto in_elem : in) { 611| 1.37k| store_any(out_s.template first(), in_elem); 612| 1.37k| out_s = out_s.subspan(bytes_per_element); 613| 1.37k| } 614| 1.37k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 1.37k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 1.37k] ------------------ 620| 0| store_elementwise(); 621| 1.37k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 1.37k| } else { 625| 1.37k| store_elementwise(); 626| 1.37k| } 627| 1.37k| } 628| 1.37k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm48EEETkNS5_14spanable_rangeENS2_5arrayImLm6EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 1.37k| const auto store_elementwise = [&] { 608| 1.37k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.37k| std::span out_s(out); 610| 8.23k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 8.23k, False: 1.37k] ------------------ 611| 8.23k| store_any(out_s.template first(), in_elem); 612| 8.23k| out_s = out_s.subspan(bytes_per_element); 613| 8.23k| } 614| 1.37k| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm64EEERNS3_5arrayImLm8EEEEEEDaDpOT0_: 745| 540|inline constexpr auto store_be(ParamTs&&... params) { 746| 540| return detail::store_any(std::forward(params)...); 747| 540|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm64EEETkNS5_14spanable_rangeENS2_5arrayImLm8EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 540|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 540| ranges::assert_equal_byte_lengths(out, in); 605| 540| using element_type = std::ranges::range_value_t; 606| | 607| 540| const auto store_elementwise = [&] { 608| 540| constexpr size_t bytes_per_element = sizeof(element_type); 609| 540| std::span out_s(out); 610| 540| for(const auto in_elem : in) { 611| 540| store_any(out_s.template first(), in_elem); 612| 540| out_s = out_s.subspan(bytes_per_element); 613| 540| } 614| 540| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 540| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 540] ------------------ 620| 0| store_elementwise(); 621| 540| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 540| } else { 625| 540| store_elementwise(); 626| 540| } 627| 540| } 628| 540|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm64EEETkNS5_14spanable_rangeENS2_5arrayImLm8EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 540| const auto store_elementwise = [&] { 608| 540| constexpr size_t bytes_per_element = sizeof(element_type); 609| 540| std::span out_s(out); 610| 4.32k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 4.32k, False: 540] ------------------ 611| 4.32k| store_any(out_s.template first(), in_elem); 612| 4.32k| out_s = out_s.subspan(bytes_per_element); 613| 4.32k| } 614| 540| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__15arrayImLm9EEEEEEDaDpOT0_: 745| 2.47k|inline constexpr auto store_be(ParamTs&&... params) { 746| 2.47k| return detail::store_any(std::forward(params)...); 747| 2.47k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm9EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_: 663| 2.47k|inline constexpr auto store_any(InR&& in_range) { 664| 2.47k| auto out = []([[maybe_unused]] const auto& in) { 665| 2.47k| if constexpr(std::same_as) { 666| 2.47k| if constexpr(ranges::statically_spanable_range) { 667| 2.47k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 2.47k| return std::array(); 669| 2.47k| } else { 670| 2.47k| static_assert( 671| 2.47k| !std::same_as, 672| 2.47k| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 2.47k| } 674| 2.47k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 2.47k| return OutR(std::span{in}.size_bytes()); 676| 2.47k| } else { 677| 2.47k| return OutR{}; 678| 2.47k| } 679| 2.47k| }(in_range); 680| | 681| 2.47k| store_any>(out, std::forward(in_range)); 682| 2.47k| return out; 683| 2.47k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm9EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSE_: 664| 2.47k| auto out = []([[maybe_unused]] const auto& in) { 665| 2.47k| if constexpr(std::same_as) { 666| 2.47k| if constexpr(ranges::statically_spanable_range) { 667| 2.47k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 2.47k| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 2.47k| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm72EEETkNS4_14spanable_rangeENS6_ImLm9EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 2.47k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 2.47k| ranges::assert_equal_byte_lengths(out, in); 605| 2.47k| using element_type = std::ranges::range_value_t; 606| | 607| 2.47k| const auto store_elementwise = [&] { 608| 2.47k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 2.47k| std::span out_s(out); 610| 2.47k| for(const auto in_elem : in) { 611| 2.47k| store_any(out_s.template first(), in_elem); 612| 2.47k| out_s = out_s.subspan(bytes_per_element); 613| 2.47k| } 614| 2.47k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 2.47k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 2.47k] ------------------ 620| 0| store_elementwise(); 621| 2.47k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 2.47k| } else { 625| 2.47k| store_elementwise(); 626| 2.47k| } 627| 2.47k| } 628| 2.47k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm72EEETkNS4_14spanable_rangeENS6_ImLm9EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 2.47k| const auto store_elementwise = [&] { 608| 2.47k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 2.47k| std::span out_s(out); 610| 22.2k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 22.2k, False: 2.47k] ------------------ 611| 22.2k| store_any(out_s.template first(), in_elem); 612| 22.2k| out_s = out_s.subspan(bytes_per_element); 613| 22.2k| } 614| 2.47k| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__15arrayImLm4EEEEEEDaDpOT0_: 745| 1.44k|inline constexpr auto store_be(ParamTs&&... params) { 746| 1.44k| return detail::store_any(std::forward(params)...); 747| 1.44k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm4EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_: 663| 1.44k|inline constexpr auto store_any(InR&& in_range) { 664| 1.44k| auto out = []([[maybe_unused]] const auto& in) { 665| 1.44k| if constexpr(std::same_as) { 666| 1.44k| if constexpr(ranges::statically_spanable_range) { 667| 1.44k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 1.44k| return std::array(); 669| 1.44k| } else { 670| 1.44k| static_assert( 671| 1.44k| !std::same_as, 672| 1.44k| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 1.44k| } 674| 1.44k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 1.44k| return OutR(std::span{in}.size_bytes()); 676| 1.44k| } else { 677| 1.44k| return OutR{}; 678| 1.44k| } 679| 1.44k| }(in_range); 680| | 681| 1.44k| store_any>(out, std::forward(in_range)); 682| 1.44k| return out; 683| 1.44k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm4EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSE_: 664| 1.44k| auto out = []([[maybe_unused]] const auto& in) { 665| 1.44k| if constexpr(std::same_as) { 666| 1.44k| if constexpr(ranges::statically_spanable_range) { 667| 1.44k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 1.44k| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 1.44k| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm32EEETkNS4_14spanable_rangeENS6_ImLm4EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 1.44k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 1.44k| ranges::assert_equal_byte_lengths(out, in); 605| 1.44k| using element_type = std::ranges::range_value_t; 606| | 607| 1.44k| const auto store_elementwise = [&] { 608| 1.44k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.44k| std::span out_s(out); 610| 1.44k| for(const auto in_elem : in) { 611| 1.44k| store_any(out_s.template first(), in_elem); 612| 1.44k| out_s = out_s.subspan(bytes_per_element); 613| 1.44k| } 614| 1.44k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 1.44k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 1.44k] ------------------ 620| 0| store_elementwise(); 621| 1.44k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 1.44k| } else { 625| 1.44k| store_elementwise(); 626| 1.44k| } 627| 1.44k| } 628| 1.44k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm32EEETkNS4_14spanable_rangeENS6_ImLm4EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 1.44k| const auto store_elementwise = [&] { 608| 1.44k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.44k| std::span out_s(out); 610| 5.77k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 5.77k, False: 1.44k] ------------------ 611| 5.77k| store_any(out_s.template first(), in_elem); 612| 5.77k| out_s = out_s.subspan(bytes_per_element); 613| 5.77k| } 614| 1.44k| }; _ZN5Botan7load_leINS_6detail10AutoDetectEJRNSt3__15arrayIhLm8EEEEEEDaDpOT0_: 495| 3.88k|inline constexpr auto load_le(ParamTs&&... params) { 496| 3.88k| return detail::load_any(std::forward(params)...); 497| 3.88k|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeISA_Esr8conceptsE19resizable_containerISA_E20unsigned_integralishINSA_10value_typeEEEEDaOT1_: 397| 3.88k|inline constexpr auto load_any(InR&& in_range) { 398| 3.88k| auto out = []([[maybe_unused]] const auto& in) { 399| 3.88k| if constexpr(std::same_as) { 400| 3.88k| if constexpr(ranges::statically_spanable_range) { 401| 3.88k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 3.88k| using type = 405| 3.88k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 3.88k| static_assert( 412| 3.88k| !std::is_void_v, 413| 3.88k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 3.88k| return type{}; 416| 3.88k| } else { 417| 3.88k| static_assert( 418| 3.88k| !std::same_as, 419| 3.88k| "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| 3.88k| } 421| 3.88k| } else if constexpr(concepts::resizable_container) { 422| 3.88k| const size_t in_bytes = std::span{in}.size_bytes(); 423| 3.88k| constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| 3.88k| BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| 3.88k| "Input range is not word-aligned with the requested output range"); 426| 3.88k| return OutT(in_bytes / out_elem_bytes); 427| 3.88k| } else { 428| 3.88k| return OutT{}; 429| 3.88k| } 430| 3.88k| }(in_range); 431| | 432| 3.88k| using out_type = decltype(out); 433| 3.88k| if constexpr(unsigned_integralish) { 434| 3.88k| out = load_any(std::forward(in_range)); 435| | } else { 436| | static_assert(ranges::contiguous_range); 437| | using out_range_type = std::ranges::range_value_t; 438| | load_any(out, std::forward(in_range)); 439| | } 440| 3.88k| return out; 441| 3.88k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeISA_Esr8conceptsE19resizable_containerISA_E20unsigned_integralishINSA_10value_typeEEEEDaOT1_ENKUlRKT_E_clIS8_EEDaSG_: 398| 3.88k| auto out = []([[maybe_unused]] const auto& in) { 399| 3.88k| if constexpr(std::same_as) { 400| 3.88k| if constexpr(ranges::statically_spanable_range) { 401| 3.88k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 3.88k| using type = 405| 3.88k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 3.88k| static_assert( 412| 3.88k| !std::is_void_v, 413| 3.88k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 3.88k| return type{}; 416| | } else { 417| | static_assert( 418| | !std::same_as, 419| | "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| | } 421| | } else if constexpr(concepts::resizable_container) { 422| | const size_t in_bytes = std::span{in}.size_bytes(); 423| | constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| | BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| | "Input range is not word-aligned with the requested output range"); 426| | return OutT(in_bytes / out_elem_bytes); 427| | } else { 428| | return OutT{}; 429| | } 430| 3.88k| }(in_range); _ZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 3.88k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 3.88k| using OutT = detail::wrapped_type; 280| 3.88k| ranges::assert_exact_byte_length(in_range); 281| | 282| 3.88k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 3.88k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 3.88k| return fallback_load_any(std::forward(in_range)); 288| 3.88k| } else { 289| 3.88k| const std::span in{in_range}; 290| 3.88k| if constexpr(sizeof(OutT) == 1) { 291| 3.88k| return static_cast(in[0]); 292| 3.88k| } else if constexpr(endianness == std::endian::native) { 293| 3.88k| return typecast_copy(in); 294| 3.88k| } else { 295| 3.88k| static_assert(opposite(endianness) == std::endian::native); 296| 3.88k| return reverse_bytes(typecast_copy(in)); 297| 3.88k| } 298| 3.88k| } 299| 3.88k| }()); 300| 3.88k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 3.88k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 3.88k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 3.88k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 3.88k| } else { 289| 3.88k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| 3.88k| } else if constexpr(endianness == std::endian::native) { 293| 3.88k| return typecast_copy(in); 294| | } else { 295| | static_assert(opposite(endianness) == std::endian::native); 296| | return reverse_bytes(typecast_copy(in)); 297| | } 298| 3.88k| } 299| 3.88k| }()); _ZN5Botan7load_leINS_6detail10AutoDetectEJNSt3__14spanIKhLm8EEEEEEDaDpOT0_: 495| 44.3k|inline constexpr auto load_le(ParamTs&&... params) { 496| 44.3k| return detail::load_any(std::forward(params)...); 497| 44.3k|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeISA_Esr8conceptsE19resizable_containerISA_E20unsigned_integralishINSA_10value_typeEEEEDaOT1_: 397| 44.3k|inline constexpr auto load_any(InR&& in_range) { 398| 44.3k| auto out = []([[maybe_unused]] const auto& in) { 399| 44.3k| if constexpr(std::same_as) { 400| 44.3k| if constexpr(ranges::statically_spanable_range) { 401| 44.3k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 44.3k| using type = 405| 44.3k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 44.3k| static_assert( 412| 44.3k| !std::is_void_v, 413| 44.3k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 44.3k| return type{}; 416| 44.3k| } else { 417| 44.3k| static_assert( 418| 44.3k| !std::same_as, 419| 44.3k| "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| 44.3k| } 421| 44.3k| } else if constexpr(concepts::resizable_container) { 422| 44.3k| const size_t in_bytes = std::span{in}.size_bytes(); 423| 44.3k| constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| 44.3k| BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| 44.3k| "Input range is not word-aligned with the requested output range"); 426| 44.3k| return OutT(in_bytes / out_elem_bytes); 427| 44.3k| } else { 428| 44.3k| return OutT{}; 429| 44.3k| } 430| 44.3k| }(in_range); 431| | 432| 44.3k| using out_type = decltype(out); 433| 44.3k| if constexpr(unsigned_integralish) { 434| 44.3k| out = load_any(std::forward(in_range)); 435| | } else { 436| | static_assert(ranges::contiguous_range); 437| | using out_range_type = std::ranges::range_value_t; 438| | load_any(out, std::forward(in_range)); 439| | } 440| 44.3k| return out; 441| 44.3k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeISA_Esr8conceptsE19resizable_containerISA_E20unsigned_integralishINSA_10value_typeEEEEDaOT1_ENKUlRKT_E_clIS9_EEDaSG_: 398| 44.3k| auto out = []([[maybe_unused]] const auto& in) { 399| 44.3k| if constexpr(std::same_as) { 400| 44.3k| if constexpr(ranges::statically_spanable_range) { 401| 44.3k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 44.3k| using type = 405| 44.3k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 44.3k| static_assert( 412| 44.3k| !std::is_void_v, 413| 44.3k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 44.3k| return type{}; 416| | } else { 417| | static_assert( 418| | !std::same_as, 419| | "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| | } 421| | } else if constexpr(concepts::resizable_container) { 422| | const size_t in_bytes = std::span{in}.size_bytes(); 423| | constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| | BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| | "Input range is not word-aligned with the requested output range"); 426| | return OutT(in_bytes / out_elem_bytes); 427| | } else { 428| | return OutT{}; 429| | } 430| 44.3k| }(in_range); _ZN5Botan8store_leINS_6detail10AutoDetectEJRmEEEDaDpOT0_: 736| 996k|inline constexpr auto store_le(ParamTs&&... params) { 737| 996k| return detail::store_any(std::forward(params)...); 738| 996k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJRKhEEEDaDpOT0_: 745| 288|inline constexpr auto store_be(ParamTs&&... params) { 746| 288| return detail::store_any(std::forward(params)...); 747| 288|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETpTkNS0_20unsigned_integralishEJhEQ10all_same_vIDpT1_EEEDaS6_: 696| 288|inline constexpr auto store_any(Ts... ins) { 697| 288| return store_any(std::array{ins...}); 698| 288|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayIhLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_: 663| 288|inline constexpr auto store_any(InR&& in_range) { 664| 288| auto out = []([[maybe_unused]] const auto& in) { 665| 288| if constexpr(std::same_as) { 666| 288| if constexpr(ranges::statically_spanable_range) { 667| 288| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 288| return std::array(); 669| 288| } else { 670| 288| static_assert( 671| 288| !std::same_as, 672| 288| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 288| } 674| 288| } else if constexpr(concepts::resizable_byte_buffer) { 675| 288| return OutR(std::span{in}.size_bytes()); 676| 288| } else { 677| 288| return OutR{}; 678| 288| } 679| 288| }(in_range); 680| | 681| 288| store_any>(out, std::forward(in_range)); 682| 288| return out; 683| 288|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayIhLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSD_: 664| 288| auto out = []([[maybe_unused]] const auto& in) { 665| 288| if constexpr(std::same_as) { 666| 288| if constexpr(ranges::statically_spanable_range) { 667| 288| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 288| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 288| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EhTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm1EEETkNS4_14spanable_rangeES7_Qoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISA_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEEEvOT1_RKSF_: 603| 288|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 288| ranges::assert_equal_byte_lengths(out, in); 605| 288| using element_type = std::ranges::range_value_t; 606| | 607| 288| const auto store_elementwise = [&] { 608| 288| constexpr size_t bytes_per_element = sizeof(element_type); 609| 288| std::span out_s(out); 610| 288| for(const auto in_elem : in) { 611| 288| store_any(out_s.template first(), in_elem); 612| 288| out_s = out_s.subspan(bytes_per_element); 613| 288| } 614| 288| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 288| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 288] ------------------ 620| 0| store_elementwise(); 621| 288| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 288| } else { 625| 288| store_elementwise(); 626| 288| } 627| 288| } 628| 288|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EhTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm1EEETkNS4_14spanable_rangeES7_Qoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISA_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISI_EESJ_E4type10value_typeEEEEvOT1_RKSF_ENKUlvE_clEv: 607| 288| const auto store_elementwise = [&] { 608| 288| constexpr size_t bytes_per_element = sizeof(element_type); 609| 288| std::span out_s(out); 610| 288| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 288, False: 288] ------------------ 611| 288| store_any(out_s.template first(), in_elem); 612| 288| out_s = out_s.subspan(bytes_per_element); 613| 288| } 614| 288| }; _ZN5Botan6detail9store_anyILNSt3__16endianE64206EhTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm1EEETpTkNS0_20unsigned_integralishEJhEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_: 582| 288|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, Ts... ins) { 583| 288| ranges::assert_exact_byte_length<(sizeof(Ts) + ...)>(out); 584| 288| auto store_one = [off = 0](auto o, T i) mutable { 585| 288| store_any(i, o.subspan(off).template first()); 586| 288| off += sizeof(T); 587| 288| }; 588| | 589| 288| (store_one(std::span{out}, ins), ...); 590| 288|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EhTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm1EEETpTkNS0_20unsigned_integralishEJhEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_ENUlTyS9_T_E_clIhS7_EEDaS9_SE_: 584| 288| auto store_one = [off = 0](auto o, T i) mutable { 585| 288| store_any(i, o.subspan(off).template first()); 586| 288| off += sizeof(T); 587| 288| }; _ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEhTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm1EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 288|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 288| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 288| using InT = decltype(in); 528| 288| ranges::assert_exact_byte_length(out_range); 529| 288| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 288| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 288] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 288| } else { 537| 288| if constexpr(sizeof(InT) == 1) { 538| 288| out[0] = static_cast(in); 539| | } else if constexpr(endianness == std::endian::native) { 540| | typecast_copy(out, in); 541| | } else { 542| | static_assert(opposite(endianness) == std::endian::native); 543| | typecast_copy(out, reverse_bytes(in)); 544| | } 545| 288| } 546| 288|} _ZN5Botan6detail26unwrap_strong_type_or_enumITkNS0_20unsigned_integralishEhEEDaT_: 190| 288|constexpr auto unwrap_strong_type_or_enum(InT t) { 191| | if constexpr(std::is_enum_v) { 192| | // TODO: C++23: use std::to_underlying(in) instead 193| | return static_cast>(t); 194| 288| } else { 195| 288| return Botan::unwrap_strong_type(t); 196| 288| } 197| 288|} _ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEtTkNSt3__117unsigned_integralEtEEDaT0_: 200| 2.56k|constexpr auto wrap_strong_type_or_enum(T t) { 201| | if constexpr(std::is_enum_v) { 202| | return static_cast(t); 203| 2.56k| } else { 204| 2.56k| return Botan::wrap_strong_type(t); 205| 2.56k| } 206| 2.56k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEtTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm2EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 70|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 70| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 70| using InT = decltype(in); 528| 70| ranges::assert_exact_byte_length(out_range); 529| 70| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 70| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 70] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 70| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| | } else if constexpr(endianness == std::endian::native) { 540| | typecast_copy(out, in); 541| 70| } else { 542| 70| static_assert(opposite(endianness) == std::endian::native); 543| 70| typecast_copy(out, reverse_bytes(in)); 544| 70| } 545| 70| } 546| 70|} _ZN5Botan6detail26unwrap_strong_type_or_enumITkNS0_20unsigned_integralishEtEEDaT_: 190| 70|constexpr auto unwrap_strong_type_or_enum(InT t) { 191| | if constexpr(std::is_enum_v) { 192| | // TODO: C++23: use std::to_underlying(in) instead 193| | return static_cast>(t); 194| 70| } else { 195| 70| return Botan::unwrap_strong_type(t); 196| 70| } 197| 70|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEjTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm4EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 7.80k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 7.80k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 7.80k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 7.80k| } else { 289| 7.80k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| 7.80k| } else if constexpr(endianness == std::endian::native) { 293| 7.80k| return typecast_copy(in); 294| | } else { 295| | static_assert(opposite(endianness) == std::endian::native); 296| | return reverse_bytes(typecast_copy(in)); 297| | } 298| 7.80k| } 299| 7.80k| }()); _ZN5Botan8store_leINS_6detail10AutoDetectEJRNSt3__15arrayImLm1EEEEEEDaDpOT0_: 736| 38.1k|inline constexpr auto store_le(ParamTs&&... params) { 737| 38.1k| return detail::store_any(std::forward(params)...); 738| 38.1k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_: 663| 38.1k|inline constexpr auto store_any(InR&& in_range) { 664| 38.1k| auto out = []([[maybe_unused]] const auto& in) { 665| 38.1k| if constexpr(std::same_as) { 666| 38.1k| if constexpr(ranges::statically_spanable_range) { 667| 38.1k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 38.1k| return std::array(); 669| 38.1k| } else { 670| 38.1k| static_assert( 671| 38.1k| !std::same_as, 672| 38.1k| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 38.1k| } 674| 38.1k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 38.1k| return OutR(std::span{in}.size_bytes()); 676| 38.1k| } else { 677| 38.1k| return OutR{}; 678| 38.1k| } 679| 38.1k| }(in_range); 680| | 681| 38.1k| store_any>(out, std::forward(in_range)); 682| 38.1k| return out; 683| 38.1k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSE_: 664| 38.1k| auto out = []([[maybe_unused]] const auto& in) { 665| 38.1k| if constexpr(std::same_as) { 666| 38.1k| if constexpr(ranges::statically_spanable_range) { 667| 38.1k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 38.1k| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 38.1k| }(in_range); _ZN5Botan7load_leINS_6detail10AutoDetectEJNSt3__15arrayIhLm2EEEEEEDaDpOT0_: 495| 2.56k|inline constexpr auto load_le(ParamTs&&... params) { 496| 2.56k| return detail::load_any(std::forward(params)...); 497| 2.56k|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEENS2_5arrayIhLm2EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeIS9_Esr8conceptsE19resizable_containerIS9_E20unsigned_integralishINS9_10value_typeEEEEDaOT1_: 397| 2.56k|inline constexpr auto load_any(InR&& in_range) { 398| 2.56k| auto out = []([[maybe_unused]] const auto& in) { 399| 2.56k| if constexpr(std::same_as) { 400| 2.56k| if constexpr(ranges::statically_spanable_range) { 401| 2.56k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 2.56k| using type = 405| 2.56k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 2.56k| static_assert( 412| 2.56k| !std::is_void_v, 413| 2.56k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 2.56k| return type{}; 416| 2.56k| } else { 417| 2.56k| static_assert( 418| 2.56k| !std::same_as, 419| 2.56k| "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| 2.56k| } 421| 2.56k| } else if constexpr(concepts::resizable_container) { 422| 2.56k| const size_t in_bytes = std::span{in}.size_bytes(); 423| 2.56k| constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| 2.56k| BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| 2.56k| "Input range is not word-aligned with the requested output range"); 426| 2.56k| return OutT(in_bytes / out_elem_bytes); 427| 2.56k| } else { 428| 2.56k| return OutT{}; 429| 2.56k| } 430| 2.56k| }(in_range); 431| | 432| 2.56k| using out_type = decltype(out); 433| 2.56k| if constexpr(unsigned_integralish) { 434| 2.56k| out = load_any(std::forward(in_range)); 435| | } else { 436| | static_assert(ranges::contiguous_range); 437| | using out_range_type = std::ranges::range_value_t; 438| | load_any(out, std::forward(in_range)); 439| | } 440| 2.56k| return out; 441| 2.56k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEENS2_5arrayIhLm2EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeIS9_Esr8conceptsE19resizable_containerIS9_E20unsigned_integralishINS9_10value_typeEEEEDaOT1_ENKUlRKT_E_clIS8_EEDaSF_: 398| 2.56k| auto out = []([[maybe_unused]] const auto& in) { 399| 2.56k| if constexpr(std::same_as) { 400| 2.56k| if constexpr(ranges::statically_spanable_range) { 401| 2.56k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 2.56k| using type = 405| 2.56k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 2.56k| static_assert( 412| 2.56k| !std::is_void_v, 413| 2.56k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 2.56k| return type{}; 416| | } else { 417| | static_assert( 418| | !std::same_as, 419| | "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| | } 421| | } else if constexpr(concepts::resizable_container) { 422| | const size_t in_bytes = std::span{in}.size_bytes(); 423| | constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| | BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| | "Input range is not word-aligned with the requested output range"); 426| | return OutT(in_bytes / out_elem_bytes); 427| | } else { 428| | return OutT{}; 429| | } 430| 2.56k| }(in_range); _ZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEtTkNS_6ranges16contiguous_rangeIhEENS2_5arrayIhLm2EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEES9_OT1_: 278| 2.56k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 2.56k| using OutT = detail::wrapped_type; 280| 2.56k| ranges::assert_exact_byte_length(in_range); 281| | 282| 2.56k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 2.56k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 2.56k| return fallback_load_any(std::forward(in_range)); 288| 2.56k| } else { 289| 2.56k| const std::span in{in_range}; 290| 2.56k| if constexpr(sizeof(OutT) == 1) { 291| 2.56k| return static_cast(in[0]); 292| 2.56k| } else if constexpr(endianness == std::endian::native) { 293| 2.56k| return typecast_copy(in); 294| 2.56k| } else { 295| 2.56k| static_assert(opposite(endianness) == std::endian::native); 296| 2.56k| return reverse_bytes(typecast_copy(in)); 297| 2.56k| } 298| 2.56k| } 299| 2.56k| }()); 300| 2.56k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEtTkNS_6ranges16contiguous_rangeIhEENS2_5arrayIhLm2EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEES9_OT1_ENKUlvE_clEv: 282| 2.56k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 2.56k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 2.56k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 2.56k| } else { 289| 2.56k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| 2.56k| } else if constexpr(endianness == std::endian::native) { 293| 2.56k| return typecast_copy(in); 294| | } else { 295| | static_assert(opposite(endianness) == std::endian::native); 296| | return reverse_bytes(typecast_copy(in)); 297| | } 298| 2.56k| } 299| 2.56k| }()); _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayItLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSD_: 664| 70| auto out = []([[maybe_unused]] const auto& in) { 665| 70| if constexpr(std::same_as) { 666| 70| if constexpr(ranges::statically_spanable_range) { 667| 70| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 70| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 70| }(in_range); _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EtTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm2EEETpTkNS0_20unsigned_integralishEJtEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_ENUlTyS9_T_E_clItS7_EEDaS9_SE_: 584| 70| auto store_one = [off = 0](auto o, T i) mutable { 585| 70| store_any(i, o.subspan(off).template first()); 586| 70| off += sizeof(T); 587| 70| }; _ZN5Botan6detail9store_anyILNSt3__16endianE64206EtTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm2EEETpTkNS0_20unsigned_integralishEJtEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_: 582| 70|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, Ts... ins) { 583| 70| ranges::assert_exact_byte_length<(sizeof(Ts) + ...)>(out); 584| 70| auto store_one = [off = 0](auto o, T i) mutable { 585| 70| store_any(i, o.subspan(off).template first()); 586| 70| off += sizeof(T); 587| 70| }; 588| | 589| 70| (store_one(std::span{out}, ins), ...); 590| 70|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206EtTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm2EEETkNS4_14spanable_rangeENS6_ItLm1EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 70|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 70| ranges::assert_equal_byte_lengths(out, in); 605| 70| using element_type = std::ranges::range_value_t; 606| | 607| 70| const auto store_elementwise = [&] { 608| 70| constexpr size_t bytes_per_element = sizeof(element_type); 609| 70| std::span out_s(out); 610| 70| for(const auto in_elem : in) { 611| 70| store_any(out_s.template first(), in_elem); 612| 70| out_s = out_s.subspan(bytes_per_element); 613| 70| } 614| 70| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 70| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 70] ------------------ 620| 0| store_elementwise(); 621| 70| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 70| } else { 625| 70| store_elementwise(); 626| 70| } 627| 70| } 628| 70|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayItLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_: 663| 70|inline constexpr auto store_any(InR&& in_range) { 664| 70| auto out = []([[maybe_unused]] const auto& in) { 665| 70| if constexpr(std::same_as) { 666| 70| if constexpr(ranges::statically_spanable_range) { 667| 70| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 70| return std::array(); 669| 70| } else { 670| 70| static_assert( 671| 70| !std::same_as, 672| 70| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 70| } 674| 70| } else if constexpr(concepts::resizable_byte_buffer) { 675| 70| return OutR(std::span{in}.size_bytes()); 676| 70| } else { 677| 70| return OutR{}; 678| 70| } 679| 70| }(in_range); 680| | 681| 70| store_any>(out, std::forward(in_range)); 682| 70| return out; 683| 70|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETpTkNS0_20unsigned_integralishEJtEQ10all_same_vIDpT1_EEEDaS6_: 696| 70|inline constexpr auto store_any(Ts... ins) { 697| 70| return store_any(std::array{ins...}); 698| 70|} _ZN5Botan8store_beINS_6detail10AutoDetectEJtEEEDaDpOT0_: 745| 70|inline constexpr auto store_be(ParamTs&&... params) { 746| 70| return detail::store_any(std::forward(params)...); 747| 70|} _ZN5Botan7load_leINS_6detail10AutoDetectEJNSt3__15arrayIhLm4EEEEEEDaDpOT0_: 495| 94.7k|inline constexpr auto load_le(ParamTs&&... params) { 496| 94.7k| return detail::load_any(std::forward(params)...); 497| 94.7k|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEENS2_5arrayIhLm4EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeIS9_Esr8conceptsE19resizable_containerIS9_E20unsigned_integralishINS9_10value_typeEEEEDaOT1_: 397| 94.7k|inline constexpr auto load_any(InR&& in_range) { 398| 94.7k| auto out = []([[maybe_unused]] const auto& in) { 399| 94.7k| if constexpr(std::same_as) { 400| 94.7k| if constexpr(ranges::statically_spanable_range) { 401| 94.7k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 94.7k| using type = 405| 94.7k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 94.7k| static_assert( 412| 94.7k| !std::is_void_v, 413| 94.7k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 94.7k| return type{}; 416| 94.7k| } else { 417| 94.7k| static_assert( 418| 94.7k| !std::same_as, 419| 94.7k| "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| 94.7k| } 421| 94.7k| } else if constexpr(concepts::resizable_container) { 422| 94.7k| const size_t in_bytes = std::span{in}.size_bytes(); 423| 94.7k| constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| 94.7k| BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| 94.7k| "Input range is not word-aligned with the requested output range"); 426| 94.7k| return OutT(in_bytes / out_elem_bytes); 427| 94.7k| } else { 428| 94.7k| return OutT{}; 429| 94.7k| } 430| 94.7k| }(in_range); 431| | 432| 94.7k| using out_type = decltype(out); 433| 94.7k| if constexpr(unsigned_integralish) { 434| 94.7k| out = load_any(std::forward(in_range)); 435| | } else { 436| | static_assert(ranges::contiguous_range); 437| | using out_range_type = std::ranges::range_value_t; 438| | load_any(out, std::forward(in_range)); 439| | } 440| 94.7k| return out; 441| 94.7k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEENS2_5arrayIhLm4EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeIS9_Esr8conceptsE19resizable_containerIS9_E20unsigned_integralishINS9_10value_typeEEEEDaOT1_ENKUlRKT_E_clIS8_EEDaSF_: 398| 94.7k| auto out = []([[maybe_unused]] const auto& in) { 399| 94.7k| if constexpr(std::same_as) { 400| 94.7k| if constexpr(ranges::statically_spanable_range) { 401| 94.7k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 94.7k| using type = 405| 94.7k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 94.7k| static_assert( 412| 94.7k| !std::is_void_v, 413| 94.7k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 94.7k| return type{}; 416| | } else { 417| | static_assert( 418| | !std::same_as, 419| | "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| | } 421| | } else if constexpr(concepts::resizable_container) { 422| | const size_t in_bytes = std::span{in}.size_bytes(); 423| | constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| | BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| | "Input range is not word-aligned with the requested output range"); 426| | return OutT(in_bytes / out_elem_bytes); 427| | } else { 428| | return OutT{}; 429| | } 430| 94.7k| }(in_range); _ZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEjTkNS_6ranges16contiguous_rangeIhEENS2_5arrayIhLm4EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEES9_OT1_: 278| 94.7k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 94.7k| using OutT = detail::wrapped_type; 280| 94.7k| ranges::assert_exact_byte_length(in_range); 281| | 282| 94.7k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 94.7k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 94.7k| return fallback_load_any(std::forward(in_range)); 288| 94.7k| } else { 289| 94.7k| const std::span in{in_range}; 290| 94.7k| if constexpr(sizeof(OutT) == 1) { 291| 94.7k| return static_cast(in[0]); 292| 94.7k| } else if constexpr(endianness == std::endian::native) { 293| 94.7k| return typecast_copy(in); 294| 94.7k| } else { 295| 94.7k| static_assert(opposite(endianness) == std::endian::native); 296| 94.7k| return reverse_bytes(typecast_copy(in)); 297| 94.7k| } 298| 94.7k| } 299| 94.7k| }()); 300| 94.7k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ETkNS0_20unsigned_integralishEjTkNS_6ranges16contiguous_rangeIhEENS2_5arrayIhLm4EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEES9_OT1_ENKUlvE_clEv: 282| 94.7k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 94.7k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 94.7k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 94.7k| } else { 289| 94.7k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| 94.7k| } else if constexpr(endianness == std::endian::native) { 293| 94.7k| return typecast_copy(in); 294| | } else { 295| | static_assert(opposite(endianness) == std::endian::native); 296| | return reverse_bytes(typecast_copy(in)); 297| | } 298| 94.7k| } 299| 94.7k| }()); _ZN5Botan7load_leINS_6detail10AutoDetectEJNSt3__14spanIKhLm4EEEEEEDaDpOT0_: 495| 7.80k|inline constexpr auto load_le(ParamTs&&... params) { 496| 7.80k| return detail::load_any(std::forward(params)...); 497| 7.80k|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm4EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeISA_Esr8conceptsE19resizable_containerISA_E20unsigned_integralishINSA_10value_typeEEEEDaOT1_: 397| 7.80k|inline constexpr auto load_any(InR&& in_range) { 398| 7.80k| auto out = []([[maybe_unused]] const auto& in) { 399| 7.80k| if constexpr(std::same_as) { 400| 7.80k| if constexpr(ranges::statically_spanable_range) { 401| 7.80k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 7.80k| using type = 405| 7.80k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 7.80k| static_assert( 412| 7.80k| !std::is_void_v, 413| 7.80k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 7.80k| return type{}; 416| 7.80k| } else { 417| 7.80k| static_assert( 418| 7.80k| !std::same_as, 419| 7.80k| "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| 7.80k| } 421| 7.80k| } else if constexpr(concepts::resizable_container) { 422| 7.80k| const size_t in_bytes = std::span{in}.size_bytes(); 423| 7.80k| constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| 7.80k| BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| 7.80k| "Input range is not word-aligned with the requested output range"); 426| 7.80k| return OutT(in_bytes / out_elem_bytes); 427| 7.80k| } else { 428| 7.80k| return OutT{}; 429| 7.80k| } 430| 7.80k| }(in_range); 431| | 432| 7.80k| using out_type = decltype(out); 433| 7.80k| if constexpr(unsigned_integralish) { 434| 7.80k| out = load_any(std::forward(in_range)); 435| | } else { 436| | static_assert(ranges::contiguous_range); 437| | using out_range_type = std::ranges::range_value_t; 438| | load_any(out, std::forward(in_range)); 439| | } 440| 7.80k| return out; 441| 7.80k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm4EEEQoosr3stdE7same_asIS4_T0_Eaaoosr6rangesE25statically_spanable_rangeISA_Esr8conceptsE19resizable_containerISA_E20unsigned_integralishINSA_10value_typeEEEEDaOT1_ENKUlRKT_E_clIS9_EEDaSG_: 398| 7.80k| auto out = []([[maybe_unused]] const auto& in) { 399| 7.80k| if constexpr(std::same_as) { 400| 7.80k| if constexpr(ranges::statically_spanable_range) { 401| 7.80k| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 7.80k| using type = 405| 7.80k| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 7.80k| static_assert( 412| 7.80k| !std::is_void_v, 413| 7.80k| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 7.80k| return type{}; 416| | } else { 417| | static_assert( 418| | !std::same_as, 419| | "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| | } 421| | } else if constexpr(concepts::resizable_container) { 422| | const size_t in_bytes = std::span{in}.size_bytes(); 423| | constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| | BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| | "Input range is not word-aligned with the requested output range"); 426| | return OutT(in_bytes / out_elem_bytes); 427| | } else { 428| | return OutT{}; 429| | } 430| 7.80k| }(in_range); _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EtTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm2EEETkNS4_14spanable_rangeENS6_ItLm1EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 70| const auto store_elementwise = [&] { 608| 70| constexpr size_t bytes_per_element = sizeof(element_type); 609| 70| std::span out_s(out); 610| 70| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 70, False: 70] ------------------ 611| 70| store_any(out_s.template first(), in_elem); 612| 70| out_s = out_s.subspan(bytes_per_element); 613| 70| } 614| 70| }; _ZN5Botan7load_leINS_6detail10AutoDetectEJRNSt3__15arrayImLm7EEERNS3_4spanIKhLm56EEEEEEDaDpOT0_: 495| 2|inline constexpr auto load_le(ParamTs&&... params) { 496| 2| return detail::load_any(std::forward(params)...); 497| 2|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeERNS2_5arrayImLm7EEETkNS5_16contiguous_rangeIhEENS2_4spanIKhLm56EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISR_SQ_EEEvOSH_RKT2_: 355| 2|inline constexpr void load_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 356| 2| ranges::assert_equal_byte_lengths(out, in); 357| 2| using element_type = std::ranges::range_value_t; 358| | 359| 2| const auto load_elementwise = [&] { 360| 2| constexpr size_t bytes_per_element = sizeof(element_type); 361| 2| std::span in_s(in); 362| 2| for(auto& out_elem : out) { 363| 2| out_elem = load_any(in_s.template first()); 364| 2| in_s = in_s.subspan(bytes_per_element); 365| 2| } 366| 2| }; 367| | 368| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 369| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 370| | // in a `constexpr` context. 371| 2| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (371:7): [Folded, False: 2] ------------------ 372| 0| load_elementwise(); 373| 2| } else { 374| 2| if constexpr(endianness == std::endian::native && !custom_loadable) { 375| 2| typecast_copy(out, in); 376| | } else { 377| | load_elementwise(); 378| | } 379| 2| } 380| 2|} _ZN5Botan8store_leINS_6detail10AutoDetectEJRNSt3__14spanIhLm56EEENS3_5arrayImLm7EEEEEEDaDpOT0_: 736| 3|inline constexpr auto store_le(ParamTs&&... params) { 737| 3| return detail::store_any(std::forward(params)...); 738| 3|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm56EEETkNS5_14spanable_rangeENS2_5arrayImLm7EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 3|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 3| ranges::assert_equal_byte_lengths(out, in); 605| 3| using element_type = std::ranges::range_value_t; 606| | 607| 3| const auto store_elementwise = [&] { 608| 3| constexpr size_t bytes_per_element = sizeof(element_type); 609| 3| std::span out_s(out); 610| 3| for(const auto in_elem : in) { 611| 3| store_any(out_s.template first(), in_elem); 612| 3| out_s = out_s.subspan(bytes_per_element); 613| 3| } 614| 3| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 3| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 3] ------------------ 620| 0| store_elementwise(); 621| 3| } else { 622| 3| if constexpr(endianness == std::endian::native && !custom_storable) { 623| 3| typecast_copy(out, in); 624| | } else { 625| | store_elementwise(); 626| | } 627| 3| } 628| 3|} _ZN5Botan7load_leINSt3__15arrayImLm15EEEJRNS2_IhLm120EEEEEEDaDpOT0_: 495| 2|inline constexpr auto load_le(ParamTs&&... params) { 496| 2| return detail::load_any(std::forward(params)...); 497| 2|} _ZN5Botan6detail8load_anyILNSt3__16endianE57005ENS2_5arrayImLm15EEETkNS_6ranges16contiguous_rangeIhEERNS4_IhLm120EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Eaaoosr6rangesE25statically_spanable_rangeISB_Esr8conceptsE19resizable_containerISB_E20unsigned_integralishINSB_10value_typeEEEEDaOT1_: 397| 2|inline constexpr auto load_any(InR&& in_range) { 398| 2| auto out = []([[maybe_unused]] const auto& in) { 399| 2| if constexpr(std::same_as) { 400| 2| if constexpr(ranges::statically_spanable_range) { 401| 2| constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| 2| using type = 405| 2| std::conditional_t>>>; 409| | // clang-format on 410| | 411| 2| static_assert( 412| 2| !std::is_void_v, 413| 2| "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| 2| return type{}; 416| 2| } else { 417| 2| static_assert( 418| 2| !std::same_as, 419| 2| "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| 2| } 421| 2| } else if constexpr(concepts::resizable_container) { 422| 2| const size_t in_bytes = std::span{in}.size_bytes(); 423| 2| constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| 2| BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| 2| "Input range is not word-aligned with the requested output range"); 426| 2| return OutT(in_bytes / out_elem_bytes); 427| 2| } else { 428| 2| return OutT{}; 429| 2| } 430| 2| }(in_range); 431| | 432| 2| using out_type = decltype(out); 433| | if constexpr(unsigned_integralish) { 434| | out = load_any(std::forward(in_range)); 435| 2| } else { 436| 2| static_assert(ranges::contiguous_range); 437| 2| using out_range_type = std::ranges::range_value_t; 438| 2| load_any(out, std::forward(in_range)); 439| 2| } 440| 2| return out; 441| 2|} _ZZN5Botan6detail8load_anyILNSt3__16endianE57005ENS2_5arrayImLm15EEETkNS_6ranges16contiguous_rangeIhEERNS4_IhLm120EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Eaaoosr6rangesE25statically_spanable_rangeISB_Esr8conceptsE19resizable_containerISB_E20unsigned_integralishINSB_10value_typeEEEEDaOT1_ENKUlRKT_E_clIS8_EEDaSH_: 398| 2| auto out = []([[maybe_unused]] const auto& in) { 399| | if constexpr(std::same_as) { 400| | if constexpr(ranges::statically_spanable_range) { 401| | constexpr size_t extent = decltype(std::span{in})::extent; 402| | 403| | // clang-format off 404| | using type = 405| | std::conditional_t>>>; 409| | // clang-format on 410| | 411| | static_assert( 412| | !std::is_void_v, 413| | "Cannot determine the output type based on a statically sized bytearray with length other than those: 1, 2, 4, 8"); 414| | 415| | return type{}; 416| | } else { 417| | static_assert( 418| | !std::same_as, 419| | "cannot infer return type from a dynamic range at compile time, please specify it explicitly"); 420| | } 421| | } else if constexpr(concepts::resizable_container) { 422| | const size_t in_bytes = std::span{in}.size_bytes(); 423| | constexpr size_t out_elem_bytes = sizeof(typename OutT::value_type); 424| | BOTAN_ARG_CHECK(in_bytes % out_elem_bytes == 0, 425| | "Input range is not word-aligned with the requested output range"); 426| | return OutT(in_bytes / out_elem_bytes); 427| 2| } else { 428| 2| return OutT{}; 429| 2| } 430| 2| }(in_range); _ZN5Botan6detail8load_anyILNSt3__16endianE57005EmTkNS_6ranges23contiguous_output_rangeERNS2_5arrayImLm15EEETkNS4_16contiguous_rangeIhEENS5_IhLm120EEEQaa20unsigned_integralishINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT1_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISH_EESI_E4type10value_typeEEoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISP_SN_EEEvOSE_RKT2_: 355| 2|inline constexpr void load_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 356| 2| ranges::assert_equal_byte_lengths(out, in); 357| 2| using element_type = std::ranges::range_value_t; 358| | 359| 2| const auto load_elementwise = [&] { 360| 2| constexpr size_t bytes_per_element = sizeof(element_type); 361| 2| std::span in_s(in); 362| 2| for(auto& out_elem : out) { 363| 2| out_elem = load_any(in_s.template first()); 364| 2| in_s = in_s.subspan(bytes_per_element); 365| 2| } 366| 2| }; 367| | 368| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 369| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 370| | // in a `constexpr` context. 371| 2| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (371:7): [Folded, False: 2] ------------------ 372| 0| load_elementwise(); 373| 2| } else { 374| 2| if constexpr(endianness == std::endian::native && !custom_loadable) { 375| 2| typecast_copy(out, in); 376| | } else { 377| | load_elementwise(); 378| | } 379| 2| } 380| 2|} _ZN5Botan8store_leINS_6detail10AutoDetectEJRtEEEDaDpOT0_: 736| 3.40k|inline constexpr auto store_le(ParamTs&&... params) { 737| 3.40k| return detail::store_any(std::forward(params)...); 738| 3.40k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETpTkNS0_20unsigned_integralishEJtEQ10all_same_vIDpT1_EEEDaS6_: 696| 3.40k|inline constexpr auto store_any(Ts... ins) { 697| 3.40k| return store_any(std::array{ins...}); 698| 3.40k|} _ZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayItLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_: 663| 3.40k|inline constexpr auto store_any(InR&& in_range) { 664| 3.40k| auto out = []([[maybe_unused]] const auto& in) { 665| 3.40k| if constexpr(std::same_as) { 666| 3.40k| if constexpr(ranges::statically_spanable_range) { 667| 3.40k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 3.40k| return std::array(); 669| 3.40k| } else { 670| 3.40k| static_assert( 671| 3.40k| !std::same_as, 672| 3.40k| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 3.40k| } 674| 3.40k| } else if constexpr(concepts::resizable_byte_buffer) { 675| 3.40k| return OutR(std::span{in}.size_bytes()); 676| 3.40k| } else { 677| 3.40k| return OutR{}; 678| 3.40k| } 679| 3.40k| }(in_range); 680| | 681| 3.40k| store_any>(out, std::forward(in_range)); 682| 3.40k| return out; 683| 3.40k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE57005ENS0_10AutoDetectETkNS_6ranges14spanable_rangeENS2_5arrayItLm1EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS8_Esr3stdE21default_initializableIS8_Esr8conceptsE21resizable_byte_bufferIS8_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSD_: 664| 3.40k| auto out = []([[maybe_unused]] const auto& in) { 665| 3.40k| if constexpr(std::same_as) { 666| 3.40k| if constexpr(ranges::statically_spanable_range) { 667| 3.40k| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 3.40k| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 3.40k| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE57005EtTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm2EEETkNS4_14spanable_rangeENS6_ItLm1EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 3.40k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 3.40k| ranges::assert_equal_byte_lengths(out, in); 605| 3.40k| using element_type = std::ranges::range_value_t; 606| | 607| 3.40k| const auto store_elementwise = [&] { 608| 3.40k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 3.40k| std::span out_s(out); 610| 3.40k| for(const auto in_elem : in) { 611| 3.40k| store_any(out_s.template first(), in_elem); 612| 3.40k| out_s = out_s.subspan(bytes_per_element); 613| 3.40k| } 614| 3.40k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 3.40k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 3.40k] ------------------ 620| 0| store_elementwise(); 621| 3.40k| } else { 622| 3.40k| if constexpr(endianness == std::endian::native && !custom_storable) { 623| 3.40k| typecast_copy(out, in); 624| | } else { 625| | store_elementwise(); 626| | } 627| 3.40k| } 628| 3.40k|} _ZN5Botan18MerkleDamgard_HashINS_7SHA_512EEC2Ev: 42| 38| MerkleDamgard_Hash() { clear(); } _ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE5clearEv: 70| 76| void clear() { 71| 76| MD::init(m_digest); 72| 76| m_buffer.clear(); 73| 76| m_count = 0; 74| 76| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE6updateENSt3__14spanIKhLm18446744073709551615EEE: 44| 38| void update(std::span input) { 45| 38| BufferSlicer in(input); 46| | 47| 76| while(!in.empty()) { ------------------ | Branch (47:16): [True: 38, False: 38] ------------------ 48| 38| if(const auto one_block = m_buffer.handle_unaligned_data(in)) { ------------------ | Branch (48:27): [True: 0, False: 38] ------------------ 49| 0| MD::compress_n(m_digest, one_block.value(), 1); 50| 0| } 51| | 52| 38| if(m_buffer.in_alignment()) { ------------------ | Branch (52:16): [True: 0, False: 38] ------------------ 53| 0| const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in); 54| 0| if(full_blocks > 0) { ------------------ | Branch (54:19): [True: 0, False: 0] ------------------ 55| 0| MD::compress_n(m_digest, aligned_data, full_blocks); 56| 0| } 57| 0| } 58| 38| } 59| | 60| 38| m_count += input.size(); 61| 38| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE5finalENSt3__14spanIhLm18446744073709551615EEE: 63| 38| void final(std::span output) { 64| 38| append_padding_bit(); 65| 38| append_counter_and_finalize(); 66| 38| copy_output(output); 67| 38| clear(); 68| 38| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE18append_padding_bitEv: 77| 38| void append_padding_bit() { 78| 38| BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume()); ------------------ | | 84| 38| do { \ | | 85| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 38| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 38] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 38| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 38] | | ------------------ ------------------ 79| 38| if constexpr(MD::bit_endianness == MD_Endian::Big) { 80| 38| const uint8_t final_byte = 0x80; 81| 38| m_buffer.append({&final_byte, 1}); 82| | } else { 83| | const uint8_t final_byte = 0x01; 84| | m_buffer.append({&final_byte, 1}); 85| | } 86| 38| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE27append_counter_and_finalizeEv: 88| 38| void append_counter_and_finalize() { 89| | // Compress the remaining data if the final data block does not provide 90| | // enough space for the counter bytes. 91| 38| if(m_buffer.elements_until_alignment() < MD::ctr_bytes) { ------------------ | Branch (91:13): [True: 0, False: 38] ------------------ 92| 0| m_buffer.fill_up_with_zeros(); 93| 0| MD::compress_n(m_digest, m_buffer.consume(), 1); 94| 0| } 95| | 96| | // Make sure that any remaining bytes in the very last block are zero. 97| 38| BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes); ------------------ | | 84| 38| do { \ | | 85| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 38| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 38] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 38| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 38] | | ------------------ ------------------ 98| 38| m_buffer.fill_up_with_zeros(); 99| | 100| | // Replace a bunch of the right-most zero-padding with the counter bytes. 101| 38| const uint64_t bit_count = m_count * 8; 102| 38| const auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count)); 103| 38| if constexpr(MD::byte_endianness == MD_Endian::Big) { 104| 38| store_be(bit_count, last_bytes.data()); 105| | } else { 106| | store_le(bit_count, last_bytes.data()); 107| | } 108| | 109| | // Compress the very last block. 110| 38| MD::compress_n(m_digest, m_buffer.consume(), 1); 111| 38| } _ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE: 113| 38| void copy_output(std::span output) { 114| 38| BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes); ------------------ | | 84| 38| do { \ | | 85| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 38| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 38] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 38| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 38] | | ------------------ ------------------ 115| | 116| 38| if constexpr(MD::byte_endianness == MD_Endian::Big) { 117| 38| copy_out_be(output.first(MD::output_bytes), m_digest); 118| | } else { 119| | copy_out_le(output.first(MD::output_bytes), m_digest); 120| | } 121| 38| } _ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEhEEvPT_m: 37| 114|inline void zeroize_buffer(T buf[], size_t n) { 38| 114| if(n > 0) { ------------------ | Branch (38:7): [True: 114, False: 0] ------------------ 39| 114| std::memset(buf, 0, sizeof(T) * n); 40| 114| } 41| 114|} _ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEmEEvPT_m: 37| 29.5M|inline void zeroize_buffer(T buf[], size_t n) { 38| 29.5M| if(n > 0) { ------------------ | Branch (38:7): [True: 28.8M, False: 751k] ------------------ 39| 28.8M| std::memset(buf, 0, sizeof(T) * n); 40| 28.8M| } 41| 29.5M|} _ZN5Botan21unchecked_copy_memoryITkNSt3__117unsigned_integralEmEEvPT_PKS2_m: 44| 2.67M|inline void unchecked_copy_memory(T* out, const T* in, size_t n) { 45| 2.67M| if(in != nullptr && out != nullptr && n > 0) { ------------------ | Branch (45:7): [True: 2.67M, False: 0] | Branch (45:24): [True: 2.67M, False: 0] | Branch (45:42): [True: 2.67M, False: 0] ------------------ 46| 2.67M| std::memmove(out, in, sizeof(T) * n); 47| 2.67M| } 48| 2.67M|} _ZN5Botan27ML_DSA_Symmetric_PrimitivesC2ERKNS_18DilithiumConstantsE: 65| 149| Dilithium_Symmetric_Primitives_Base(mode, std::make_unique()), 66| 149| m_seed_expansion_domain_separator({mode.k(), mode.l()}) {} _ZNK5Botan27ML_DSA_Symmetric_Primitives31seed_expansion_domain_separatorEv: 93| 72| std::optional> seed_expansion_domain_separator() const override { 94| 72| return m_seed_expansion_domain_separator; 95| 72| } _ZNK5Botan27ML_KEM_Symmetric_Primitives31seed_expansion_domain_separatorERKNS_14KyberConstantsE: 59| 44| std::optional> seed_expansion_domain_separator(const KyberConstants& mode) const override { 60| | // NIST FIPS 203, Algorithm 13 (K-PKE.KeyGen) 61| | // Byte 33 of the input to G is the module dimension k from {2,3,4}. 62| | // This is included to establish domain separation between the three 63| | // parameter sets 64| 44| return std::array{mode.k()}; 65| 44| } _ZNK5Botan27ML_KEM_Symmetric_Primitives8create_GEv: 67| 44| std::unique_ptr create_G() const override { return HashFunction::create_or_throw("SHA-3(512)"); } _ZNK5Botan27ML_KEM_Symmetric_Primitives8create_HEv: 69| 44| std::unique_ptr create_H() const override { return HashFunction::create_or_throw("SHA-3(256)"); } _ZNK5Botan27ML_KEM_Symmetric_Primitives10create_PRFENSt3__14spanIKhLm18446744073709551615EEEh: 79| 44| std::unique_ptr create_PRF(std::span seed, const uint8_t nonce) const override { 80| 44| auto xof = Botan::XOF::create_or_throw("SHAKE-256"); 81| 44| init_PRF(*xof, seed, nonce); 82| 44| return xof; 83| 44| } _ZNK5Botan27ML_KEM_Symmetric_Primitives8init_PRFERNS_3XOFENSt3__14spanIKhLm18446744073709551615EEEh: 85| 288| void init_PRF(Botan::XOF& xof, std::span seed, const uint8_t nonce) const override { 86| 288| xof.clear(); 87| 288| xof.update(seed); 88| 288| xof.update(store_be(nonce)); 89| 288| } _ZNK5Botan27ML_KEM_Symmetric_Primitives10create_XOFENSt3__14spanIKhLm18446744073709551615EEENS1_5tupleIJhhEEE: 92| 32| std::tuple matrix_position) const override { 93| 32| auto xof = Botan::XOF::create_or_throw("SHAKE-128"); 94| 32| init_XOF(*xof, seed, matrix_position); 95| 32| return xof; 96| 32| } _ZNK5Botan27ML_KEM_Symmetric_Primitives8init_XOFERNS_3XOFENSt3__14spanIKhLm18446744073709551615EEENS3_5tupleIJhhEEE: 100| 70| std::tuple matrix_position) const override { 101| 70| xof.clear(); 102| 70| xof.update(seed); 103| 70| xof.update(store_be(make_uint16(std::get<0>(matrix_position), std::get<1>(matrix_position)))); 104| 70| } _ZNK5Botan27ML_KEM_Symmetric_Primitives9XOF_batchENSt3__14spanINS2_IhLm18446744073709551615EEELm18446744073709551615EEENS_10StrongSpanIKNS_6StrongINS1_6vectorIhNS1_9allocatorIhEEEENS_13KyberSeedRho_EJEEEEENS2_IKNS1_5tupleIJhhEEELm18446744073709551615EEE: 108| 44| std::span> positions) const override { 109| 44| shake_XOF_batch(outputs, seed, positions); 110| 44| } _ZNK5Botan17Montgomery_Params1pEv: 41| 8.77M| const BigInt& p() const { return m_data->p(); } _ZNK5Botan17Montgomery_Params2R1Ev: 43| 11.5k| const BigInt& R1() const { return m_data->r1(); } _ZNK5Botan17Montgomery_Params2R2Ev: 45| 17.8k| const BigInt& R2() const { return m_data->r2(); } _ZNK5Botan17Montgomery_Params2R3Ev: 47| 1.57k| const BigInt& R3() const { return m_data->r3(); } _ZNK5Botan17Montgomery_Params6p_dashEv: 49| 7.04M| word p_dash() const { return m_data->p_dash(); } _ZNK5Botan17Montgomery_Params7p_wordsEv: 51| 9.72M| size_t p_words() const { return m_data->p_size(); } _ZNK5Botan17Montgomery_Params4Data1pEv: 76| 8.77M| const BigInt& p() const { return m_p; } _ZNK5Botan17Montgomery_Params4Data2r1Ev: 78| 11.5k| const BigInt& r1() const { return m_r1; } _ZNK5Botan17Montgomery_Params4Data2r2Ev: 80| 17.8k| const BigInt& r2() const { return m_r2; } _ZNK5Botan17Montgomery_Params4Data2r3Ev: 82| 1.57k| const BigInt& r3() const { return m_r3; } _ZNK5Botan17Montgomery_Params4Data6p_dashEv: 84| 7.04M| word p_dash() const { return m_p_dash; } _ZNK5Botan17Montgomery_Params4Data6p_sizeEv: 86| 9.72M| size_t p_size() const { return m_p_words; } _ZNK5Botan14Montgomery_Int4reprEv: 143| 39.8k| const secure_vector& repr() const { return m_v; } _ZNK5Botan14Montgomery_Int18_const_time_poisonEv: 180| 3.74k| void _const_time_poison() const { CT::poison(m_v); } _ZNK5Botan14Montgomery_Int20_const_time_unpoisonEv: 182| 1.33k| void _const_time_unpoison() const { CT::unpoison(m_v); } _ZNK5Botan14Montgomery_Int7_paramsEv: 184| 1.37k| const Montgomery_Params& _params() const { return m_params; } _ZN5Botan17monty_exp_vartimeERKNS_17Montgomery_ParamsERKNS_6BigIntES5_: 79| 226|inline Montgomery_Int monty_exp_vartime(const Montgomery_Params& params_p, const BigInt& g, const BigInt& k) { 80| 226| const auto precomputed = monty_precompute(params_p, g, 4, false); 81| 226| return monty_execute_vartime(*precomputed, k); 82| 226|} _ZN5Botan31Montgomery_Exponentiation_StateC2Ev: 41| 1.37k| Montgomery_Exponentiation_State() = default; _ZN5Botan31Montgomery_Exponentiation_StateD2Ev: 22| 1.37k| virtual ~Montgomery_Exponentiation_State() = default; _ZN5Botan10word8_add2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_: 276| 471|inline constexpr auto word8_add2(W x[8], const W y[8], W carry) -> W { 277| 471|#if defined(BOTAN_MP_USE_X86_64_ASM) 278| 471| if constexpr(std::same_as) { 279| 471| if(!std::is_constant_evaluated()) { ------------------ | Branch (279:10): [True: 471, Folded] ------------------ 280| 471| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq")) 281| 471| : [carry] "=r"(carry) 282| 471| : [x] "r"(x), [y] "r"(y), "0"(carry) 283| 471| : "cc", "memory"); 284| 471| return carry; 285| 471| } 286| 471| } 287| 0|#endif 288| | 289| 0| x[0] = word_add(x[0], y[0], &carry); 290| 471| x[1] = word_add(x[1], y[1], &carry); 291| 471| x[2] = word_add(x[2], y[2], &carry); 292| 471| x[3] = word_add(x[3], y[3], &carry); 293| 471| x[4] = word_add(x[4], y[4], &carry); 294| 471| x[5] = word_add(x[5], y[5], &carry); 295| 471| x[6] = word_add(x[6], y[6], &carry); 296| 471| x[7] = word_add(x[7], y[7], &carry); 297| 471| return carry; 298| 471|} _ZN5Botan8word_addITkNS_8WordTypeEmEET_S1_S1_PS1_: 239| 63.0M|inline constexpr auto word_add(W x, W y, W* carry) -> W { 240| 63.0M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc) 241| 63.0M| if(!std::is_constant_evaluated()) { ------------------ | Branch (241:7): [True: 63.0M, Folded] ------------------ 242| | if constexpr(std::same_as) { 243| | return __builtin_addc(x, y, *carry & 1, carry); 244| 63.0M| } else if constexpr(std::same_as) { 245| 63.0M| return __builtin_addcl(x, y, *carry & 1, carry); 246| | } else if constexpr(std::same_as) { 247| | return __builtin_addcll(x, y, *carry & 1, carry); 248| | } 249| 63.0M| } 250| 0|#endif 251| | 252| | if constexpr(WordInfo::dword_is_native && use_dword_for_word_add) { 253| | /* 254| | TODO(Botan4) this is largely a performance hack for GCCs that don't 255| | support __builtin_addc, if we increase the minimum supported version of 256| | GCC to GCC 14 then we can remove this and not worry about it 257| | */ 258| | const W cb = *carry & 1; 259| | const auto s = typename WordInfo::dword(x) + y + cb; 260| | *carry = static_cast(s >> WordInfo::bits); 261| | return static_cast(s); 262| 63.0M| } else { 263| 63.0M| const W cb = *carry & 1; 264| 63.0M| W z = x + y; 265| 63.0M| W c1 = (z < x); 266| 63.0M| z += cb; 267| 63.0M| *carry = c1 | (z < cb); 268| 63.0M| return z; 269| 63.0M| } 270| 63.0M|} _ZN5Botan10word8_sub2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_: 357| 87.0k|inline constexpr auto word8_sub2(W x[8], const W y[8], W carry) -> W { 358| 87.0k|#if defined(BOTAN_MP_USE_X86_64_ASM) 359| 87.0k| if constexpr(std::same_as) { 360| 87.0k| if(!std::is_constant_evaluated()) { ------------------ | Branch (360:10): [True: 87.0k, Folded] ------------------ 361| 87.0k| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq")) 362| 87.0k| : [carry] "=r"(carry) 363| 87.0k| : [x] "r"(x), [y] "r"(y), "0"(carry) 364| 87.0k| : "cc", "memory"); 365| 87.0k| return carry; 366| 87.0k| } 367| 87.0k| } 368| 0|#endif 369| | 370| 0| x[0] = word_sub(x[0], y[0], &carry); 371| 87.0k| x[1] = word_sub(x[1], y[1], &carry); 372| 87.0k| x[2] = word_sub(x[2], y[2], &carry); 373| 87.0k| x[3] = word_sub(x[3], y[3], &carry); 374| 87.0k| x[4] = word_sub(x[4], y[4], &carry); 375| 87.0k| x[5] = word_sub(x[5], y[5], &carry); 376| 87.0k| x[6] = word_sub(x[6], y[6], &carry); 377| 87.0k| x[7] = word_sub(x[7], y[7], &carry); 378| 87.0k| return carry; 379| 87.0k|} _ZN5Botan8word_subITkNS_8WordTypeEmEET_S1_S1_PS1_: 332| 137M|inline constexpr auto word_sub(W x, W y, W* carry) -> W { 333| 137M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc) 334| 137M| if(!std::is_constant_evaluated()) { ------------------ | Branch (334:7): [True: 137M, Folded] ------------------ 335| | if constexpr(std::same_as) { 336| | return __builtin_subc(x, y, *carry & 1, carry); 337| 137M| } else if constexpr(std::same_as) { 338| 137M| return __builtin_subcl(x, y, *carry & 1, carry); 339| | } else if constexpr(std::same_as) { 340| | return __builtin_subcll(x, y, *carry & 1, carry); 341| | } 342| 137M| } 343| 0|#endif 344| | 345| 0| const W cb = *carry & 1; 346| 137M| W t0 = x - y; 347| 137M| W c1 = (t0 > x); 348| 137M| W z = t0 - cb; 349| 137M| *carry = c1 | (z > t0); 350| 137M| return z; 351| 137M|} _ZN5Botan10word8_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_: 385| 4.55M|inline constexpr auto word8_sub3(W z[8], const W x[8], const W y[8], W carry) -> W { 386| 4.55M|#if defined(BOTAN_MP_USE_X86_64_ASM) 387| 4.55M| if constexpr(std::same_as) { 388| 4.55M| if(!std::is_constant_evaluated()) { ------------------ | Branch (388:10): [True: 4.55M, Folded] ------------------ 389| 4.55M| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq")) 390| 4.55M| : [carry] "=r"(carry) 391| 4.55M| : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry) 392| 4.55M| : "cc", "memory"); 393| 4.55M| return carry; 394| 4.55M| } 395| 4.55M| } 396| 0|#endif 397| | 398| 0| z[0] = word_sub(x[0], y[0], &carry); 399| 4.55M| z[1] = word_sub(x[1], y[1], &carry); 400| 4.55M| z[2] = word_sub(x[2], y[2], &carry); 401| 4.55M| z[3] = word_sub(x[3], y[3], &carry); 402| 4.55M| z[4] = word_sub(x[4], y[4], &carry); 403| 4.55M| z[5] = word_sub(x[5], y[5], &carry); 404| 4.55M| z[6] = word_sub(x[6], y[6], &carry); 405| 4.55M| z[7] = word_sub(x[7], y[7], &carry); 406| 4.55M| return carry; 407| 4.55M|} _ZN5Botan10word8_add3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_: 304| 570k|inline constexpr auto word8_add3(W z[8], const W x[8], const W y[8], W carry) -> W { 305| 570k|#if defined(BOTAN_MP_USE_X86_64_ASM) 306| 570k| if constexpr(std::same_as) { 307| 570k| if(!std::is_constant_evaluated()) { ------------------ | Branch (307:10): [True: 570k, Folded] ------------------ 308| 570k| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq")) 309| 570k| : [carry] "=r"(carry) 310| 570k| : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry) 311| 570k| : "cc", "memory"); 312| 570k| return carry; 313| 570k| } 314| 570k| } 315| 0|#endif 316| | 317| 0| z[0] = word_add(x[0], y[0], &carry); 318| 570k| z[1] = word_add(x[1], y[1], &carry); 319| 570k| z[2] = word_add(x[2], y[2], &carry); 320| 570k| z[3] = word_add(x[3], y[3], &carry); 321| 570k| z[4] = word_add(x[4], y[4], &carry); 322| 570k| z[5] = word_add(x[5], y[5], &carry); 323| 570k| z[6] = word_add(x[6], y[6], &carry); 324| 570k| z[7] = word_add(x[7], y[7], &carry); 325| 570k| return carry; 326| 570k|} _ZN5Botan13word8_linmul3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_: 413| 230|inline constexpr auto word8_linmul3(W z[8], const W x[8], W y, W carry) -> W { 414| 230|#if defined(BOTAN_MP_USE_X86_64_ASM) 415| 230| if constexpr(std::same_as) { 416| 230| if(!std::is_constant_evaluated()) { ------------------ | Branch (416:10): [True: 230, Folded] ------------------ 417| 230| asm volatile(DO_8_TIMES(LINMUL_OP, "z") 418| 230| : [carry] "=r"(carry) 419| 230| : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry) 420| 230| : "cc", "%rax", "%rdx", "memory"); 421| 230| return carry; 422| 230| } 423| 230| } 424| 0|#endif 425| | 426| 0| z[0] = word_madd2(x[0], y, &carry); 427| 230| z[1] = word_madd2(x[1], y, &carry); 428| 230| z[2] = word_madd2(x[2], y, &carry); 429| 230| z[3] = word_madd2(x[3], y, &carry); 430| 230| z[4] = word_madd2(x[4], y, &carry); 431| 230| z[5] = word_madd2(x[5], y, &carry); 432| 230| z[6] = word_madd2(x[6], y, &carry); 433| 230| z[7] = word_madd2(x[7], y, &carry); 434| 230| return carry; 435| 230|} _ZN5Botan10word_madd2ITkNS_8WordTypeEmEET_S1_S1_PS1_: 90| 7.09M|inline constexpr auto word_madd2(W a, W b, W* c) -> W { 91| 7.09M|#if defined(BOTAN_MP_USE_X86_64_ASM) 92| 7.09M| if constexpr(std::same_as) { 93| 7.09M| if(!std::is_constant_evaluated()) { ------------------ | Branch (93:10): [True: 7.09M, Folded] ------------------ 94| 7.09M| asm(R"( 95| 7.09M| mulq %[b] 96| 7.09M| addq %[c],%[a] 97| 7.09M| adcq $0,%[carry] 98| 7.09M| )" 99| 7.09M| : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c) 100| 7.09M| : "0"(a), "1"(b), [c] "g"(*c) 101| 7.09M| : "cc"); 102| | 103| 7.09M| return a; 104| 7.09M| } 105| 7.09M| } 106| |#elif defined(BOTAN_MP_USE_AARCH64_ASM) 107| | if constexpr(std::same_as) { 108| | if(!std::is_constant_evaluated()) { 109| | W lo = 0; 110| | W hi = 0; 111| | asm(R"( 112| | mul %[lo], %[a], %[b] 113| | umulh %[hi], %[a], %[b] 114| | adds %[lo], %[lo], %[c] 115| | adc %[hi], %[hi], xzr 116| | )" 117| | : [lo] "=&r"(lo), [hi] "=&r"(hi) 118| | : [a] "r"(a), [b] "r"(b), [c] "r"(*c) 119| | : "cc"); 120| | 121| | *c = hi; 122| | return lo; 123| | } 124| | } 125| |#endif 126| | 127| 0| typedef typename WordInfo::dword dword; 128| 7.09M| const dword s = dword(a) * b + *c; 129| 7.09M| *c = static_cast(s >> WordInfo::bits); 130| 7.09M| return static_cast(s); 131| 7.09M|} _ZN5Botan11word8_madd3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_: 441| 80.6k|inline constexpr auto word8_madd3(W z[8], const W x[8], W y, W carry) -> W { 442| 80.6k|#if defined(BOTAN_MP_USE_X86_64_ASM) 443| 80.6k| if constexpr(std::same_as) { 444| 80.6k| if(!std::is_constant_evaluated()) { ------------------ | Branch (444:10): [True: 80.6k, Folded] ------------------ 445| 80.6k| asm volatile(DO_8_TIMES(MULADD_OP, "") 446| 80.6k| : [carry] "=r"(carry) 447| 80.6k| : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry) 448| 80.6k| : "cc", "%rax", "%rdx", "memory"); 449| 80.6k| return carry; 450| 80.6k| } 451| 80.6k| } 452| 0|#endif 453| | 454| 0| z[0] = word_madd3(x[0], y, z[0], &carry); 455| 80.6k| z[1] = word_madd3(x[1], y, z[1], &carry); 456| 80.6k| z[2] = word_madd3(x[2], y, z[2], &carry); 457| 80.6k| z[3] = word_madd3(x[3], y, z[3], &carry); 458| 80.6k| z[4] = word_madd3(x[4], y, z[4], &carry); 459| 80.6k| z[5] = word_madd3(x[5], y, z[5], &carry); 460| 80.6k| z[6] = word_madd3(x[6], y, z[6], &carry); 461| 80.6k| z[7] = word_madd3(x[7], y, z[7], &carry); 462| 80.6k| return carry; 463| 80.6k|} _ZN5Botan10word_madd3ITkNS_8WordTypeEmEET_S1_S1_S1_PS1_: 137| 121M|inline constexpr auto word_madd3(W a, W b, W c, W* d) -> W { 138| 121M|#if defined(BOTAN_MP_USE_X86_64_ASM) 139| 121M| if constexpr(std::same_as) { 140| 121M| if(!std::is_constant_evaluated()) { ------------------ | Branch (140:10): [True: 121M, Folded] ------------------ 141| 121M| asm(R"( 142| 121M| mulq %[b] 143| 121M| 144| 121M| addq %[c],%[a] 145| 121M| adcq $0,%[carry] 146| 121M| 147| 121M| addq %[d],%[a] 148| 121M| adcq $0,%[carry] 149| 121M| )" 150| 121M| : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d) 151| 121M| : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d) 152| 121M| : "cc"); 153| | 154| 121M| return a; 155| 121M| } 156| 121M| } 157| |#elif defined(BOTAN_MP_USE_AARCH64_ASM) 158| | if constexpr(std::same_as) { 159| | if(!std::is_constant_evaluated()) { 160| | W lo = 0; 161| | W hi = 0; 162| | asm(R"( 163| | mul %[lo], %[a], %[b] 164| | umulh %[hi], %[a], %[b] 165| | adds %[lo], %[lo], %[c] 166| | adc %[hi], %[hi], xzr 167| | adds %[lo], %[lo], %[d] 168| | adc %[hi], %[hi], xzr 169| | )" 170| | : [lo] "=&r"(lo), [hi] "=&r"(hi) 171| | : [a] "r"(a), [b] "r"(b), [c] "r"(c), [d] "r"(*d) 172| | : "cc"); 173| | 174| | *d = hi; 175| | return lo; 176| | } 177| | } 178| |#endif 179| | 180| 0| typedef typename WordInfo::dword dword; 181| 121M| const dword s = dword(a) * b + c + *d; 182| 121M| *d = static_cast(s >> WordInfo::bits); 183| 121M| return static_cast(s); 184| 121M|} _ZN5Botan5word3ImE3mulEmm: 480| 334M| inline constexpr void mul(W x, W y) { m_w += static_cast(x) * y; } _ZN5Botan5word3ImE7extractEv: 486| 89.8M| inline constexpr W extract() { 487| 89.8M| W r = static_cast(m_w); 488| 89.8M| m_w >>= WordInfo::bits; 489| 89.8M| return r; 490| 89.8M| } _ZN5Botan5word3ImE3addEm: 484| 144M| inline constexpr void add(W x) { m_w += x; } _ZN5Botan5word3ImE10monty_stepEmm: 492| 72.1M| inline constexpr W monty_step(W p0, W p_dash) { 493| 72.1M| const W w0 = static_cast(m_w); 494| 72.1M| const W r = w0 * p_dash; 495| 72.1M| mul(r, p0); 496| 72.1M| m_w >>= WordInfo::bits; 497| 72.1M| return r; 498| 72.1M| } _ZN5Botan5word3ImEC2Ev: 478| 17.3M| constexpr word3() : m_w(0) {} _ZN5Botan5word3ImE6mul_x2Emm: 482| 162k| inline constexpr void mul_x2(W x, W y) { m_w += static_cast(x) * y * 2; } _ZN5Botan11bigint_add2ITkNS_8WordTypeEmEET_PS1_mPKS1_m: 97| 171k|inline constexpr auto bigint_add2(W x[], size_t x_size, const W y[], size_t y_size) -> W { 98| 171k| W carry = 0; 99| | 100| 171k| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 71| 171k| do { \ | | 72| 171k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 171k| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 171k] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 171k| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 171k] | | ------------------ ------------------ 101| | 102| 171k| const size_t blocks = y_size - (y_size % 8); 103| | 104| 171k| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (104:22): [True: 471, False: 171k] ------------------ 105| 471| carry = word8_add2(x + i, y + i, carry); 106| 471| } 107| | 108| 516k| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (108:27): [True: 345k, False: 171k] ------------------ 109| 345k| x[i] = word_add(x[i], y[i], &carry); 110| 345k| } 111| | 112| 514k| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (112:27): [True: 343k, False: 171k] ------------------ 113| 343k| x[i] = word_add(x[i], static_cast(0), &carry); 114| 343k| } 115| | 116| 171k| return carry; 117| 171k|} _ZN5Botan10bigint_cmpITkNS_8WordTypeEmEEiPKT_mS3_m: 462| 79.8k|inline constexpr int32_t bigint_cmp(const W x[], size_t x_size, const W y[], size_t y_size) { 463| 79.8k| static_assert(sizeof(W) >= sizeof(uint32_t), "Size assumption"); 464| | 465| 79.8k| const W LT = static_cast(-1); 466| 79.8k| const W EQ = 0; 467| 79.8k| const W GT = 1; 468| | 469| 79.8k| const size_t common_elems = std::min(x_size, y_size); 470| | 471| 79.8k| W result = EQ; // until found otherwise 472| | 473| 421k| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (473:22): [True: 341k, False: 79.8k] ------------------ 474| 341k| const auto is_eq = CT::Mask::is_equal(x[i], y[i]); 475| 341k| const auto is_lt = CT::Mask::is_lt(x[i], y[i]); 476| | 477| 341k| result = is_eq.select(result, is_lt.select(LT, GT)); 478| 341k| } 479| | 480| 79.8k| if(x_size < y_size) { ------------------ | Branch (480:7): [True: 2.36k, False: 77.5k] ------------------ 481| 2.36k| W mask = 0; 482| 10.0k| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (482:30): [True: 7.72k, False: 2.36k] ------------------ 483| 7.72k| mask |= y[i]; 484| 7.72k| } 485| | 486| | // If any bits were set in high part of y, then x < y 487| 2.36k| result = CT::Mask::is_zero(mask).select(result, LT); 488| 77.5k| } else if(y_size < x_size) { ------------------ | Branch (488:14): [True: 5.84k, False: 71.6k] ------------------ 489| 5.84k| W mask = 0; 490| 30.3k| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (490:30): [True: 24.4k, False: 5.84k] ------------------ 491| 24.4k| mask |= x[i]; 492| 24.4k| } 493| | 494| | // If any bits were set in high part of x, then x > y 495| 5.84k| result = CT::Mask::is_zero(mask).select(result, GT); 496| 5.84k| } 497| | 498| 79.8k| CT::unpoison(result); 499| 79.8k| BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ); ------------------ | | 137| 79.8k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 79.8k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 79.8k] | | ------------------ ------------------ 500| 79.8k| return static_cast(result); 501| 79.8k|} _ZN5Botan11bigint_sub2ITkNS_8WordTypeEmEET_PS1_mPKS1_m: 151| 208k|inline constexpr auto bigint_sub2(W x[], size_t x_size, const W y[], size_t y_size) -> W { 152| 208k| W borrow = 0; 153| | 154| 208k| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 71| 208k| do { \ | | 72| 208k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 208k| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 208k] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 208k| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 208k] | | ------------------ ------------------ 155| | 156| 208k| const size_t blocks = y_size - (y_size % 8); 157| | 158| 295k| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (158:22): [True: 87.0k, False: 208k] ------------------ 159| 87.0k| borrow = word8_sub2(x + i, y + i, borrow); 160| 87.0k| } 161| | 162| 865k| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (162:27): [True: 656k, False: 208k] ------------------ 163| 656k| x[i] = word_sub(x[i], y[i], &borrow); 164| 656k| } 165| | 166| 208k| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (166:27): [True: 330, False: 208k] ------------------ 167| 330| x[i] = word_sub(x[i], static_cast(0), &borrow); 168| 330| } 169| | 170| 208k| return borrow; 171| 208k|} _ZN5Botan15bigint_sub2_revITkNS_8WordTypeEmEEvPT_PKS1_m: 177| 984|inline constexpr void bigint_sub2_rev(W x[], const W y[], size_t y_size) { 178| 984| W borrow = 0; 179| | 180| 1.96k| for(size_t i = 0; i != y_size; ++i) { ------------------ | Branch (180:22): [True: 984, False: 984] ------------------ 181| 984| x[i] = word_sub(y[i], x[i], &borrow); 182| 984| } 183| | 184| 984| BOTAN_ASSERT(borrow == 0, "y must be greater than x"); ------------------ | | 71| 984| do { \ | | 72| 984| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 984| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 984] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 984| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 984] | | ------------------ ------------------ 185| 984|} _ZN5Botan11bigint_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m: 195| 5.78M|inline constexpr auto bigint_sub3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W { 196| 5.78M| W borrow = 0; 197| | 198| 5.78M| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 71| 5.78M| do { \ | | 72| 5.78M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 5.78M| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 5.78M] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 5.78M| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 5.78M] | | ------------------ ------------------ 199| | 200| 5.78M| const size_t blocks = y_size - (y_size % 8); 201| | 202| 8.61M| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (202:22): [True: 2.82M, False: 5.78M] ------------------ 203| 2.82M| borrow = word8_sub3(z + i, x + i, y + i, borrow); 204| 2.82M| } 205| | 206| 20.1M| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (206:27): [True: 14.3M, False: 5.78M] ------------------ 207| 14.3M| z[i] = word_sub(x[i], y[i], &borrow); 208| 14.3M| } 209| | 210| 7.29M| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (210:27): [True: 1.50M, False: 5.78M] ------------------ 211| 1.50M| z[i] = word_sub(x[i], static_cast(0), &borrow); 212| 1.50M| } 213| | 214| 5.78M| return borrow; 215| 5.78M|} _ZN5Botan11bigint_add3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m: 123| 4.25M|inline constexpr auto bigint_add3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W { 124| 4.25M| if(x_size < y_size) { ------------------ | Branch (124:7): [True: 193, False: 4.25M] ------------------ 125| 193| return bigint_add3(z, y, y_size, x, x_size); 126| 193| } 127| | 128| 4.25M| W carry = 0; 129| | 130| 4.25M| const size_t blocks = y_size - (y_size % 8); 131| | 132| 4.82M| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (132:22): [True: 570k, False: 4.25M] ------------------ 133| 570k| carry = word8_add3(z + i, x + i, y + i, carry); 134| 570k| } 135| | 136| 19.0M| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (136:27): [True: 14.7M, False: 4.25M] ------------------ 137| 14.7M| z[i] = word_add(x[i], y[i], &carry); 138| 14.7M| } 139| | 140| 4.26M| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (140:27): [True: 16.7k, False: 4.25M] ------------------ 141| 16.7k| z[i] = word_add(x[i], static_cast(0), &carry); 142| 16.7k| } 143| | 144| 4.25M| return carry; 145| 4.25M|} _ZN5Botan14bigint_cnd_addITkNS_8WordTypeEmEET_S1_PS1_PKS1_m: 48| 3.59M|inline constexpr W bigint_cnd_add(W cnd, W x[], const W y[], size_t size) { 49| 3.59M| const auto mask = CT::Mask::expand(cnd).value(); 50| | 51| 3.59M| W carry = 0; 52| | 53| 20.4M| for(size_t i = 0; i != size; ++i) { ------------------ | Branch (53:22): [True: 16.8M, False: 3.59M] ------------------ 54| 16.8M| x[i] = word_add(x[i], y[i] & mask, &carry); 55| 16.8M| } 56| | 57| 3.59M| return (mask & carry); 58| 3.59M|} _ZN5Botan14bigint_linmul3ITkNS_8WordTypeEmEEvPT_PKS1_mS1_: 419| 3.93k|inline constexpr void bigint_linmul3(W z[], const W x[], size_t x_size, W y) { 420| 3.93k| const size_t blocks = x_size - (x_size % 8); 421| | 422| 3.93k| W carry = 0; 423| | 424| 4.16k| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (424:22): [True: 230, False: 3.93k] ------------------ 425| 230| carry = word8_linmul3(z + i, x + i, y, carry); 426| 230| } 427| | 428| 11.8k| for(size_t i = blocks; i != x_size; ++i) { ------------------ | Branch (428:27): [True: 7.88k, False: 3.93k] ------------------ 429| 7.88k| z[i] = word_madd2(x[i], y, &carry); 430| 7.88k| } 431| | 432| 3.93k| z[x_size] = carry; 433| 3.93k|} _ZN5Botan14bigint_linmul2ITkNS_8WordTypeEmEET_PS1_mS1_: 408| 546k|[[nodiscard]] inline constexpr auto bigint_linmul2(W x[], size_t x_size, W y) -> W { 409| 546k| W carry = 0; 410| | 411| 6.29M| for(size_t i = 0; i != x_size; ++i) { ------------------ | Branch (411:22): [True: 5.75M, False: 546k] ------------------ 412| 5.75M| x[i] = word_madd2(x[i], y, &carry); 413| 5.75M| } 414| | 415| 546k| return carry; 416| 546k|} _ZN5Botan14divide_precompImE13setup_vartimeEm: 686| 8.71k| static constexpr divide_precomp setup_vartime(W divisor) { 687| 8.71k| const size_t shift = WordInfo::bits - high_bit(divisor); 688| 8.71k| const W norm_divisor = divisor << shift; 689| 8.71k| const W reciprocal = reciprocal_word(norm_divisor); 690| 8.71k| return divide_precomp(divisor, shift, norm_divisor, reciprocal); 691| 8.71k| } _ZN5Botan15reciprocal_wordITkNS_8WordTypeEmEET_S1_: 577| 8.71k|constexpr W reciprocal_word(W D) { 578| 8.71k| BOTAN_DEBUG_ASSERT((D & WordInfo::top_bit) != 0); ------------------ | | 137| 8.71k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 8.71k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 8.71k] | | ------------------ ------------------ 579| | 580| | /* 581| | * Subtracting 2^b*D from the numerator gives 582| | * v = floor(((~D)*2^b + (2^b - 1)) / D). Since D is normalized, ~D < D 583| | * and the quotient fits in a word. See the first part of Section III A 584| | * in the paper. 585| | */ 586| | if constexpr(sizeof(W) == 4) { 587| | const auto nD = ~D; // Work around spurious MSVC warning 588| | const typename WordInfo::dword n = 589| | (static_cast::dword>(nD) << WordInfo::bits) | WordInfo::max; 590| | return static_cast(n / D); 591| 8.71k| } else { 592| 8.71k| if(!std::is_constant_evaluated()) { ------------------ | Branch (592:10): [True: 8.71k, Folded] ------------------ 593| 8.71k|#if defined(BOTAN_MP_USE_X86_64_ASM) 594| 8.71k| W quotient = 0; 595| 8.71k| W remainder = 0; 596| | // NOLINTNEXTLINE(*-no-assembler) 597| 8.71k| asm("divq %[d]" 598| 8.71k| : "=a"(quotient), "=d"(remainder) 599| 8.71k| : [d] "r"(D), "a"(WordInfo::max), "d"(static_cast(~D)) 600| 8.71k| : "cc"); 601| 8.71k| return quotient; 602| |#elif !defined(BOTAN_BUILD_COMPILER_IS_CLANGCL) 603| | /* clang-cl has a bug where on encountering a 128/64 division it emits 604| | * a call to __udivti3() but then fails to link the relevant builtin into 605| | * the binary, causing a link failure. Work around this by simply omitting 606| | * such code for clang-cl 607| | * 608| | * See https://github.com/llvm/llvm-project/issues/25679 609| | */ 610| | if constexpr(WordInfo::dword_is_native) { 611| | typename WordInfo::dword n = 612| | (static_cast::dword>(~D) << WordInfo::bits) | WordInfo::max; 613| | return static_cast(n / D); 614| | } 615| |#endif 616| 8.71k| } 617| | 618| | // Algorithm 2 of Möller and Granlund 619| 0| const W d0 = D & 1; 620| 0| const W d9 = D >> 55; 621| 0| const W d40 = (D >> 24) + 1; 622| 0| const W d63 = (D >> 1) + d0; // ceil(D/2) 623| | 624| | // This division is done with a table lookup in the paper 625| 0| const W v0 = ((W(1) << 19) - (W(3) << 8)) / d9; 626| 0| const W v1 = (v0 << 11) - ((v0 * v0 * d40) >> 40) - 1; 627| 0| const W v2 = (v1 << 13) + ((v1 * ((W(1) << 60) - v1 * d40)) >> 47); 628| | 629| 0| const W e = W(0) - v2 * d63 + (v2 >> 1) * d0; 630| | 631| 0| W product_hi = 0; 632| 0| word_madd2(v2, e, &product_hi); 633| 0| const W v3 = (v2 << 31) + (product_hi >> 1); 634| | 635| | // Compute floor((v3 + 2^64 + 1) * D / 2^64) modulo 2^64 636| 0| product_hi = D; 637| 0| word_madd2(v3, D, &product_hi); 638| 0| return v3 - D - product_hi; 639| 8.71k| } 640| 8.71k|} _ZN5Botan14divide_precompImEC2Emmmm: 771| 31.2k| m_divisor(divisor), m_shift(shift), m_norm_divisor(norm_divisor), m_reciprocal(reciprocal) {} _ZNK5Botan14divide_precompImE8mod_2to1Emm: 767| 17.4k| inline constexpr W mod_2to1(W n1, W n0) const { return this->divmod_2to1_vartime(n1, n0).second; } _ZNK5Botan14divide_precompImE19divmod_2to1_vartimeEmm: 709| 21.5k| inline constexpr std::pair divmod_2to1_vartime(W n1, W n0) const { 710| 21.5k| if(m_divisor == WordInfo::max) { ------------------ | Branch (710:13): [True: 0, False: 21.5k] ------------------ 711| 0| const W q = div_2to1_max_d(n1, n0); 712| 0| const W r = static_cast(n0 + q); 713| 0| return std::make_pair(q, r); 714| 0| } 715| | 716| 21.5k| if(m_divisor == WordInfo::top_bit) { ------------------ | Branch (716:13): [True: 0, False: 21.5k] ------------------ 717| | // Simply a shift by N-1 bits 718| 0| const W q = (n1 << 1) | (n0 >> (WordInfo::bits - 1)); 719| 0| const W r = static_cast(n0 & (WordInfo::top_bit - 1)); 720| 0| return std::make_pair(q, r); 721| 0| } 722| | 723| 21.5k| return divmod_2to1_ct(n1, n0); 724| 21.5k| } _ZNK5Botan14divide_precompImE14divmod_2to1_ctEmm: 731| 109k| inline constexpr std::pair divmod_2to1_ct(W n1, W n0) const { 732| | /* 733| | * Scale the numerator to match the normalized divisor; the scaling cancels 734| | * in the quotient and is removed from the remainder by the final shift. 735| | */ 736| 109k| n1 <<= m_shift; 737| 109k| const size_t rshift = WordInfo::bits - m_shift; 738| | /* 739| | * We can't just `n0 >> rshift` because m_shift may be 0 (high bit divisor) 740| | * in which case rshift will be the maximum bit length, and >> by the maximum 741| | * bitlength is undefined behavior despite having an entirely obvious meaning. 742| | * 743| | * However we know m_shift is not equal to the bit length of the word, because 744| | * that would imply that the divisor is 0. Thus rshift must be >= 1. So split 745| | * the shift into two phases (first rshift-1, then 1) 746| | */ 747| 109k| n1 |= (n0 >> 1) >> (rshift - 1); 748| 109k| n0 <<= m_shift; 749| | 750| 109k| const auto [q, scaled_r] = div2by1_preinv(n1, n0, m_norm_divisor, m_reciprocal); 751| 109k| const W r = scaled_r >> m_shift; 752| 109k| return std::make_pair(q, r); 753| 109k| } _ZN5Botan14divide_precompImE14div2by1_preinvEmmmm: 782| 109k| static constexpr std::pair div2by1_preinv(W u1, W u0, W D, W v) { 783| | // Steps 1-3: = v*u1; += ; q1 += 1 784| 109k| W q1 = u0; 785| 109k| const W q0 = word_madd2(u1, v, &q1); // = u1*v + u0 786| 109k| q1 += u1 + 1; 787| | 788| | // Step 4 789| 109k| W r = u0 - q1 * D; 790| | 791| | // Steps 5-7: If r >= q0 { q1 -= 1; r += d; } 792| 109k| const auto fix_down = CT::Mask::is_gt(r, q0); 793| 109k| q1 -= fix_down.if_set_return(1); 794| 109k| r += fix_down.if_set_return(D); 795| | 796| | // Steps 8-10: if r >= D { q1 += 1; r -= D; } 797| 109k| const auto fix_up = CT::Mask::is_gte(r, D); 798| 109k| q1 += fix_up.if_set_return(1); 799| 109k| r -= fix_up.if_set_return(D); 800| | 801| | // Step 11 802| 109k| return std::make_pair(q1, r); 803| 109k| } _ZN5Botan11bigint_shl1ITkNS_8WordTypeEmEEvPT_mmm: 312| 270|inline constexpr void bigint_shl1(W x[], size_t x_size, size_t x_words, size_t shift) { 313| 270| const size_t word_shift = shift / WordInfo::bits; 314| 270| const size_t bit_shift = shift % WordInfo::bits; 315| | 316| 270| BOTAN_ASSERT_NOMSG(word_shift <= x_size); ------------------ | | 84| 270| do { \ | | 85| 270| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 270| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 270] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 270| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 270] | | ------------------ ------------------ 317| 270| BOTAN_ASSERT_NOMSG(x_words <= x_size - word_shift); ------------------ | | 84| 270| do { \ | | 85| 270| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 270| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 270] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 270| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 270] | | ------------------ ------------------ 318| | 319| 270| unchecked_copy_memory(x + word_shift, x, x_words); 320| 270| zeroize_buffer(x, word_shift); 321| | 322| 270| const auto carry_mask = CT::Mask::expand(bit_shift); 323| 270| const W carry_shift = carry_mask.if_set_return(WordInfo::bits - bit_shift); 324| | 325| 270| W carry = 0; 326| 2.70k| for(size_t i = word_shift; i != x_size; ++i) { ------------------ | Branch (326:31): [True: 2.43k, False: 270] ------------------ 327| 2.43k| const W w = x[i]; 328| 2.43k| x[i] = (w << bit_shift) | carry; 329| 2.43k| carry = carry_mask.if_set_return(w >> carry_shift); 330| 2.43k| } 331| 270|} _ZN5Botan11bigint_shr1ITkNS_8WordTypeEmEEvPT_mm: 334| 750k|inline constexpr void bigint_shr1(W x[], size_t x_size, size_t shift) { 335| 750k| const size_t word_shift = shift / WordInfo::bits; 336| 750k| const size_t bit_shift = shift % WordInfo::bits; 337| | 338| 750k| const size_t top = x_size >= word_shift ? (x_size - word_shift) : 0; ------------------ | Branch (338:23): [True: 750k, False: 0] ------------------ 339| | 340| 750k| if(top > 0) { ------------------ | Branch (340:7): [True: 750k, False: 0] ------------------ 341| 750k| unchecked_copy_memory(x, x + word_shift, top); 342| 750k| } 343| 750k| zeroize_buffer(x + top, std::min(word_shift, x_size)); 344| | 345| 750k| const auto carry_mask = CT::Mask::expand(bit_shift); 346| 750k| const W carry_shift = carry_mask.if_set_return(WordInfo::bits - bit_shift); 347| | 348| 750k| W carry = 0; 349| | 350| 3.88M| for(size_t i = 0; i != top; ++i) { ------------------ | Branch (350:22): [True: 3.13M, False: 750k] ------------------ 351| 3.13M| const W w = x[top - i - 1]; 352| 3.13M| x[top - i - 1] = (w >> bit_shift) | carry; 353| 3.13M| carry = carry_mask.if_set_return(w << carry_shift); 354| 3.13M| } 355| 750k|} _ZN5Botan17bigint_monty_redcEPmPKmS2_mmS0_m: 1077| 16.6M| word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) { 1078| 16.6M| const size_t z_size = 2 * p_size; 1079| | 1080| 16.6M| BOTAN_ARG_CHECK(ws_size >= p_size, "Montgomery reduction workspace too small"); ------------------ | | 35| 16.6M| do { \ | | 36| 16.6M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 16.6M| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 16.6M] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 16.6M| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 16.6M] | | ------------------ ------------------ 1081| | 1082| 16.6M| if(p_size == 4) { ------------------ | Branch (1082:7): [True: 7.30M, False: 9.39M] ------------------ 1083| 7.30M| bigint_monty_redc_4(r, z, p, p_dash, ws); 1084| 9.39M| } else if(p_size == 6) { ------------------ | Branch (1084:14): [True: 2.22k, False: 9.38M] ------------------ 1085| 2.22k| bigint_monty_redc_6(r, z, p, p_dash, ws); 1086| 9.38M| } else if(p_size == 8) { ------------------ | Branch (1086:14): [True: 1.14k, False: 9.38M] ------------------ 1087| 1.14k| bigint_monty_redc_8(r, z, p, p_dash, ws); 1088| 9.38M| } else if(p_size == 12) { ------------------ | Branch (1088:14): [True: 71, False: 9.38M] ------------------ 1089| 71| bigint_monty_redc_12(r, z, p, p_dash, ws); 1090| 9.38M| } else if(p_size == 16) { ------------------ | Branch (1090:14): [True: 3, False: 9.38M] ------------------ 1091| 3| bigint_monty_redc_16(r, z, p, p_dash, ws); 1092| 9.38M| } else if(p_size == 24) { ------------------ | Branch (1092:14): [True: 0, False: 9.38M] ------------------ 1093| 0| bigint_monty_redc_24(r, z, p, p_dash, ws); 1094| 9.38M| } else if(p_size == 32) { ------------------ | Branch (1094:14): [True: 0, False: 9.38M] ------------------ 1095| 0| bigint_monty_redc_32(r, z, p, p_dash, ws); 1096| 9.38M| } else { 1097| 9.38M| bigint_monty_redc_generic(r, z, z_size, p, p_size, p_dash, ws); 1098| 9.38M| } 1099| 16.6M|} _ZN5Botan25bigint_monty_redc_inplaceEPmPKmmmS0_m: 1101| 6.12M|inline void bigint_monty_redc_inplace(word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) { 1102| 6.12M| bigint_monty_redc(z, z, p, p_size, p_dash, ws, ws_size); 1103| 6.12M| zeroize_buffer(z + p_size, p_size); 1104| 6.12M|} _ZN5Botan12booth_recodeEmm: 1302| 104k|inline constexpr std::pair booth_recode(size_t x, size_t window_bits) { 1303| 104k| const auto sign = CT::Mask::expand(x >> window_bits); 1304| 104k| const size_t neg_x = (static_cast(1) << (window_bits + 1)) - x - 1; 1305| 104k| size_t digit = sign.select(neg_x, x); 1306| 104k| digit = (digit >> 1) + (digit & 1); 1307| 104k| return {digit, sign.as_choice()}; 1308| 104k|} _ZN5Botan11bigint_shl2ITkNS_8WordTypeEmEEvPT_mPKS1_mm: 358| 58|inline constexpr void bigint_shl2(W y[], size_t y_size, const W x[], size_t x_size, size_t shift) { 359| 58| const size_t word_shift = shift / WordInfo::bits; 360| 58| const size_t bit_shift = shift % WordInfo::bits; 361| | 362| 58| BOTAN_ASSERT_NOMSG(word_shift <= y_size); ------------------ | | 84| 58| do { \ | | 85| 58| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 58| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 58] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 58| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 58] | | ------------------ ------------------ 363| 58| BOTAN_ASSERT_NOMSG(x_size < y_size - word_shift); ------------------ | | 84| 58| do { \ | | 85| 58| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 58| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 58] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 58| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 58] | | ------------------ ------------------ 364| | 365| 58| unchecked_copy_memory(y + word_shift, x, x_size); 366| 58| zeroize_buffer(y, word_shift); 367| 58| zeroize_buffer(y + word_shift + x_size, y_size - word_shift - x_size); 368| | 369| 58| const auto carry_mask = CT::Mask::expand(bit_shift); 370| 58| const W carry_shift = carry_mask.if_set_return(WordInfo::bits - bit_shift); 371| | 372| 58| W carry = 0; 373| 348| for(size_t i = word_shift; i != x_size + word_shift + 1; ++i) { ------------------ | Branch (373:31): [True: 290, False: 58] ------------------ 374| 290| const W w = y[i]; 375| 290| y[i] = (w << bit_shift) | carry; 376| 290| carry = carry_mask.if_set_return(w >> carry_shift); 377| 290| } 378| 58|} _ZN5Botan11bigint_shr2ITkNS_8WordTypeEmEEvPT_mPKS1_mm: 381| 1.03k|inline constexpr void bigint_shr2(W y[], size_t y_size, const W x[], size_t x_size, size_t shift) { 382| 1.03k| const size_t word_shift = shift / WordInfo::bits; 383| 1.03k| const size_t bit_shift = shift % WordInfo::bits; 384| 1.03k| const size_t new_size = x_size < word_shift ? 0 : (x_size - word_shift); ------------------ | Branch (384:28): [True: 0, False: 1.03k] ------------------ 385| | 386| 1.03k| BOTAN_ASSERT_NOMSG(new_size <= y_size); ------------------ | | 84| 1.03k| do { \ | | 85| 1.03k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 1.03k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 1.03k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 1.03k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 1.03k] | | ------------------ ------------------ 387| | 388| 1.03k| if(new_size > 0) { ------------------ | Branch (388:7): [True: 1.03k, False: 0] ------------------ 389| 1.03k| unchecked_copy_memory(y, x + word_shift, new_size); 390| 1.03k| } 391| 1.03k| zeroize_buffer(y + new_size, y_size - new_size); 392| | 393| 1.03k| const auto carry_mask = CT::Mask::expand(bit_shift); 394| 1.03k| const W carry_shift = carry_mask.if_set_return(WordInfo::bits - bit_shift); 395| | 396| 1.03k| W carry = 0; 397| 6.22k| for(size_t i = new_size; i > 0; --i) { ------------------ | Branch (397:29): [True: 5.19k, False: 1.03k] ------------------ 398| 5.19k| W w = y[i - 1]; 399| 5.19k| y[i - 1] = (w >> bit_shift) | carry; 400| 5.19k| carry = carry_mask.if_set_return(w << carry_shift); 401| 5.19k| } 402| 1.03k|} _ZN5Botan15bigint_ct_is_eqITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_m: 542| 10.0k|inline constexpr auto bigint_ct_is_eq(const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask { 543| 10.0k| const size_t common_elems = std::min(x_size, y_size); 544| | 545| 10.0k| W diff = 0; 546| | 547| 119k| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (547:22): [True: 109k, False: 10.0k] ------------------ 548| 109k| diff |= (x[i] ^ y[i]); 549| 109k| } 550| | 551| | // If any bits were set in high part of x/y, then they are not equal 552| 10.0k| if(x_size < y_size) { ------------------ | Branch (552:7): [True: 325, False: 9.73k] ------------------ 553| 2.17k| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (553:30): [True: 1.85k, False: 325] ------------------ 554| 1.85k| diff |= y[i]; 555| 1.85k| } 556| 9.73k| } else if(y_size < x_size) { ------------------ | Branch (556:14): [True: 305, False: 9.42k] ------------------ 557| 2.76k| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (557:30): [True: 2.45k, False: 305] ------------------ 558| 2.45k| diff |= x[i]; 559| 2.45k| } 560| 305| } 561| | 562| 10.0k| return CT::Mask::is_zero(diff); 563| 10.0k|} _ZN5Botan15bigint_ct_is_ltITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_mb: 510| 66.8k| -> CT::Mask { 511| 66.8k| const size_t common_elems = std::min(x_size, y_size); 512| | 513| 66.8k| auto is_lt = CT::Mask::expand(lt_or_equal); 514| | 515| 445k| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (515:22): [True: 378k, False: 66.8k] ------------------ 516| 378k| const auto eq = CT::Mask::is_equal(x[i], y[i]); 517| 378k| const auto lt = CT::Mask::is_lt(x[i], y[i]); 518| 378k| is_lt = eq.select_mask(is_lt, lt); 519| 378k| } 520| | 521| 66.8k| if(x_size < y_size) { ------------------ | Branch (521:7): [True: 1.76k, False: 65.0k] ------------------ 522| 1.76k| W mask = 0; 523| 11.2k| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (523:30): [True: 9.46k, False: 1.76k] ------------------ 524| 9.46k| mask |= y[i]; 525| 9.46k| } 526| | // If any bits were set in high part of y, then is_lt should be forced true 527| 1.76k| is_lt |= CT::Mask::expand(mask); 528| 65.0k| } else if(y_size < x_size) { ------------------ | Branch (528:14): [True: 36.5k, False: 28.5k] ------------------ 529| 36.5k| W mask = 0; 530| 276k| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (530:30): [True: 240k, False: 36.5k] ------------------ 531| 240k| mask |= x[i]; 532| 240k| } 533| | 534| | // If any bits were set in high part of x, then is_lt should be false 535| 36.5k| is_lt &= CT::Mask::is_zero(mask); 536| 36.5k| } 537| | 538| 66.8k| return is_lt; 539| 66.8k|} _ZN5Botan15bigint_cnd_swapITkNS_8WordTypeEmEEvT_PS1_S2_m: 32| 363k|inline constexpr void bigint_cnd_swap(W cnd, W x[], W y[], size_t size) { 33| 363k| const auto mask = CT::Mask::expand(cnd); 34| | 35| 1.87M| for(size_t i = 0; i != size; ++i) { ------------------ | Branch (35:22): [True: 1.50M, False: 363k] ------------------ 36| 1.50M| const W a = x[i]; 37| 1.50M| const W b = y[i]; 38| 1.50M| x[i] = mask.select(b, a); 39| 1.50M| y[i] = mask.select(a, b); 40| 1.50M| } 41| 363k|} _ZN5Botan14divide_precompImE5setupEm: 694| 22.5k| static constexpr divide_precomp setup(W divisor) { 695| 22.5k| const size_t shift = WordInfo::bits - high_bit(divisor); 696| 22.5k| const W norm_divisor = divisor << shift; 697| 22.5k| const W reciprocal = reciprocal_word_ct(norm_divisor); 698| 22.5k| return divide_precomp(divisor, shift, norm_divisor, reciprocal); 699| 22.5k| } _ZN5Botan18reciprocal_word_ctITkNS_8WordTypeEmEET_S1_: 649| 22.5k|constexpr W reciprocal_word_ct(W D) { 650| 22.5k| BOTAN_DEBUG_ASSERT((D & WordInfo::top_bit) != 0); ------------------ | | 137| 22.5k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 22.5k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 22.5k] | | ------------------ ------------------ 651| | 652| | // Bit serial long division of ((~D) || (2^b - 1)) / D, with all of the 653| | // conditional logic computed via masks 654| 22.5k| W remainder = static_cast(~D); 655| 22.5k| W quotient = 0; 656| | 657| 1.46M| for(size_t i = 0; i != WordInfo::bits; ++i) { ------------------ | Branch (657:22): [True: 1.44M, False: 22.5k] ------------------ 658| 1.44M| const auto carry = CT::Mask::expand_top_bit(remainder); 659| 1.44M| remainder = static_cast((remainder << 1) | 1); 660| 1.44M| quotient <<= 1; 661| | 662| 1.44M| const auto sub = carry | CT::Mask::is_gte(remainder, D); 663| 1.44M| remainder -= sub.if_set_return(D); 664| 1.44M| quotient |= sub.if_set_return(1); 665| 1.44M| } 666| | 667| 22.5k| return quotient; 668| 22.5k|} _ZN5Botan13bigint_submulITkNS_8WordTypeEmEET_PS1_PKS1_mS1_: 442| 87.8k|inline constexpr auto bigint_submul(W z[], const W y[], size_t N, W q) -> W { 443| 87.8k| W mul_carry = 0; 444| 87.8k| W borrow = 0; 445| | 446| 548k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (446:22): [True: 460k, False: 87.8k] ------------------ 447| 460k| const W t = word_madd2(y[i], q, &mul_carry); 448| 460k| z[i] = word_sub(z[i], t, &borrow); 449| 460k| } 450| | 451| | // Both mul_carry <= W_max - 1 and borrow <= 1, so this cannot overflow 452| 87.8k| return mul_carry + borrow; 453| 87.8k|} _ZN5Botan14bigint_sub_absITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPS3_PKS3_S7_mS5_: 282| 29.3k|inline constexpr auto bigint_sub_abs(W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask { 283| | // Subtract in both direction then conditional copy out the result 284| | 285| 29.3k| W* ws0 = ws; 286| 29.3k| W* ws1 = ws + N; 287| | 288| 29.3k| W borrow0 = 0; 289| 29.3k| W borrow1 = 0; 290| | 291| 29.3k| const size_t blocks = N - (N % 8); 292| | 293| 34.2k| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (293:22): [True: 4.93k, False: 29.3k] ------------------ 294| 4.93k| borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0); 295| 4.93k| borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1); 296| 4.93k| } 297| | 298| 163k| for(size_t i = blocks; i != N; ++i) { ------------------ | Branch (298:27): [True: 134k, False: 29.3k] ------------------ 299| 134k| ws0[i] = word_sub(x[i], y[i], &borrow0); 300| 134k| ws1[i] = word_sub(y[i], x[i], &borrow1); 301| 134k| } 302| | 303| 29.3k| return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N); 304| 29.3k|} _ZN5Botan14bigint_cnd_subITkNS_8WordTypeEmEET_S1_PS1_PKS1_m: 65| 727k|inline constexpr auto bigint_cnd_sub(W cnd, W x[], const W y[], size_t size) -> W { 66| 727k| const auto mask = CT::Mask::expand(cnd).value(); 67| | 68| 727k| W carry = 0; 69| | 70| 3.74M| for(size_t i = 0; i != size; ++i) { ------------------ | Branch (70:22): [True: 3.01M, False: 727k] ------------------ 71| 3.01M| x[i] = word_sub(x[i], y[i] & mask, &carry); 72| 3.01M| } 73| | 74| 727k| return (mask & carry); 75| 727k|} _ZN5Botan14bigint_cnd_absITkNS_8WordTypeEmEEvT_PS1_m: 83| 363k|inline constexpr void bigint_cnd_abs(W cnd, W x[], size_t size) { 84| 363k| const auto mask = CT::Mask::expand(cnd); 85| | 86| 363k| W carry = mask.if_set_return(1); 87| 1.87M| for(size_t i = 0; i != size; ++i) { ------------------ | Branch (87:22): [True: 1.50M, False: 363k] ------------------ 88| 1.50M| const W z = word_add(~x[i], static_cast(0), &carry); 89| 1.50M| x[i] = mask.select(z, x[i]); 90| 1.50M| } 91| 363k|} _ZN5Botan13monty_inverseITkNS_8WordTypeEmEET_S1_: 856| 4.47k|inline constexpr auto monty_inverse(W a) -> W { 857| 4.47k| BOTAN_ARG_CHECK(a % 2 == 1, "Cannot compute Montgomery inverse of an even integer"); ------------------ | | 35| 4.47k| do { \ | | 36| 4.47k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 4.47k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 4.47k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 4.47k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 4.47k] | | ------------------ ------------------ 858| | 859| | // Newton's Method, following https://lemire.me/blog/2017/09/18/computing-the-inverse-of-odd-integers/ 860| | 861| 4.47k| constexpr size_t iter = WordInfo::bits == 64 ? 4 : 3; ------------------ | Branch (861:28): [True: 0, Folded] ------------------ 862| | 863| | // Initial guess provides 5 bits of accuracy 864| 4.47k| W r = (3 * a) ^ 2; 865| | 866| | // Each iteration doubles the accuracy 867| 22.3k| for(size_t i = 0; i != iter; ++i) { ------------------ | Branch (867:22): [True: 17.9k, False: 4.47k] ------------------ 868| 17.9k| r = r * (2 - r * a); 869| 17.9k| } 870| | 871| | // Now invert in addition space 872| 4.47k| r = (WordInfo::max - r) + 1; 873| | 874| 4.47k| return r; 875| 4.47k|} _ZN5Botan22bigint_monty_maybe_subITkNS_8WordTypeEmEEvmPT_S1_PKS1_S4_: 228| 13.9M|inline constexpr void bigint_monty_maybe_sub(size_t N, W z[], W x0, const W x[], const W p[]) { 229| 13.9M| W borrow = 0; 230| | 231| 13.9M| const size_t blocks = N - (N % 8); 232| | 233| 15.6M| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (233:22): [True: 1.71M, False: 13.9M] ------------------ 234| 1.71M| borrow = word8_sub3(z + i, x + i, p + i, borrow); 235| 1.71M| } 236| | 237| 60.8M| for(size_t i = blocks; i != N; ++i) { ------------------ | Branch (237:27): [True: 46.8M, False: 13.9M] ------------------ 238| 46.8M| z[i] = word_sub(x[i], p[i], &borrow); 239| 46.8M| } 240| | 241| 13.9M| borrow = (x0 - borrow) > x0; 242| | 243| 13.9M| CT::conditional_assign_mem(borrow, z, x, N); 244| 13.9M|} _ZN5Botan9comba_sqrILm4ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 1.05M|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 1.05M| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 1.05M, Folded] ------------------ 1009| 1.05M| if constexpr(std::same_as && N == 4) { 1010| 1.05M| return bigint_comba_sqr4(z, x); 1011| 1.05M| } 1012| | if constexpr(std::same_as && N == 6) { 1013| | return bigint_comba_sqr6(z, x); 1014| | } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| | if constexpr(std::same_as && N == 8) { 1019| | return bigint_comba_sqr8(z, x); 1020| | } 1021| | if constexpr(std::same_as && N == 9) { 1022| | return bigint_comba_sqr9(z, x); 1023| | } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 1.05M| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 1.05M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 1.05M] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 1.05M|} _ZN5Botan22bigint_monty_maybe_subILm4ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 7.54M|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 7.54M| W borrow = 0; 259| | 260| 37.7M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 30.1M, False: 7.54M] ------------------ 261| 30.1M| z[i] = word_sub(x[i], y[i], &borrow); 262| 30.1M| } 263| | 264| 7.54M| borrow = (x0 - borrow) > x0; 265| | 266| 7.54M| CT::conditional_assign_mem(borrow, z, x, N); 267| 7.54M|} _ZN5Botan9comba_mulILm4ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 444k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 444k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 444k, Folded] ------------------ 973| 444k| if constexpr(std::same_as && N == 4) { 974| 444k| return bigint_comba_mul4(z, x, y); 975| 444k| } 976| | if constexpr(std::same_as && N == 6) { 977| | return bigint_comba_mul6(z, x, y); 978| | } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| | if constexpr(std::same_as && N == 8) { 983| | return bigint_comba_mul8(z, x, y); 984| | } 985| | if constexpr(std::same_as && N == 9) { 986| | return bigint_comba_mul9(z, x, y); 987| | } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 444k| } 992| | 993| 0| word3 accum; 994| | 995| 444k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 444k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 444k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 25.8k|inline constexpr W shift_left(std::array& x) { 879| 25.8k| static_assert(N >= 1, "Invalid input size"); 880| 25.8k| static_assert(S > 0, "Zero shift not supported"); 881| 25.8k| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 25.8k| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 103k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 77.5k, False: 25.8k] ------------------ 886| 77.5k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 77.5k| } 888| 25.8k| x[0] <<= S; 889| | 890| 25.8k| return carry; 891| 25.8k|} _ZN5Botan16read_window_bitsILm4EmLm4EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 19.3k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 19.3k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 19.3k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 19.3k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 19.3k| const auto bit_shift = offset % W_bits; 1281| 19.3k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 19.3k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 19.3k, False: 0] | Branch (1283:74): [True: 0, False: 0] ------------------ 1284| | 1285| 19.3k| const auto w0 = words[word_offset]; 1286| | 1287| 19.3k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 19.3k, False: 0] ------------------ 1288| 19.3k| return (w0 >> bit_shift) & WindowMask; 1289| 19.3k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 0| const auto w1 = words[word_offset - 1]; 1292| 0| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 0| return combined & WindowMask; 1294| 0| } 1295| 19.3k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 2.86k|inline constexpr W shift_right(std::array& x) { 895| 2.86k| static_assert(N >= 1, "Invalid input size"); 896| 2.86k| static_assert(S > 0, "Zero shift not supported"); 897| 2.86k| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 2.86k| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 11.4k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 8.59k, False: 2.86k] ------------------ 902| 8.59k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 8.59k| } 904| 2.86k| x[N - 1] >>= S; 905| | 906| 2.86k| return carry; 907| 2.86k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm8ELm64EEEDaNSt3__14spanIKhXT1_EEE: 1245| 136|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 136| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 136| std::array r = {}; 1249| | 1250| 136| constexpr size_t full_words = L / WordInfo::bytes; 1251| 136| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 136| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 1.22k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 1.08k, False: 136] ------------------ 1256| 1.08k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 1.08k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 136| return r; 1270| 136|} _ZN5Botan16read_window_bitsILm7EhLm18446744073709551615EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 104k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 104k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 104k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 104k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 104k| const auto bit_shift = offset % W_bits; 1281| 104k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 104k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 26.9k, False: 77.4k] | Branch (1283:74): [True: 1.70k, False: 75.7k] ------------------ 1284| | 1285| 104k| const auto w0 = words[word_offset]; 1286| | 1287| 104k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 28.6k, False: 75.7k] ------------------ 1288| 28.6k| return (w0 >> bit_shift) & WindowMask; 1289| 75.7k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 75.7k| const auto w1 = words[word_offset - 1]; 1292| 75.7k| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 75.7k| return combined & WindowMask; 1294| 75.7k| } 1295| 104k|} _ZN5Botan12booth_recodeILm6ETkNSt3__117unsigned_integralEmEENS1_4pairImNS_2CT6ChoiceEEET0_: 1311| 104k|constexpr std::pair booth_recode(T x) { 1312| 104k| static_assert(WindowBits >= 1 && WindowBits <= 16); 1313| 104k| return booth_recode(static_cast(x), WindowBits); 1314| 104k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm4ELm32EEEDaNSt3__14spanIKhXT1_EEE: 1245| 541|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 541| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 541| std::array r = {}; 1249| | 1250| 541| constexpr size_t full_words = L / WordInfo::bytes; 1251| 541| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 541| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 2.70k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 2.16k, False: 541] ------------------ 1256| 2.16k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 2.16k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 541| return r; 1270| 541|} _ZN5Botan9comba_sqrILm6ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 225k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 225k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 225k, Folded] ------------------ 1009| | if constexpr(std::same_as && N == 4) { 1010| | return bigint_comba_sqr4(z, x); 1011| | } 1012| 225k| if constexpr(std::same_as && N == 6) { 1013| 225k| return bigint_comba_sqr6(z, x); 1014| 225k| } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| | if constexpr(std::same_as && N == 8) { 1019| | return bigint_comba_sqr8(z, x); 1020| | } 1021| | if constexpr(std::same_as && N == 9) { 1022| | return bigint_comba_sqr9(z, x); 1023| | } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 225k| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 225k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 225k] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 225k|} _ZN5Botan22bigint_monty_maybe_subILm6ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 279k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 279k| W borrow = 0; 259| | 260| 1.95M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 1.67M, False: 279k] ------------------ 261| 1.67M| z[i] = word_sub(x[i], y[i], &borrow); 262| 1.67M| } 263| | 264| 279k| borrow = (x0 - borrow) > x0; 265| | 266| 279k| CT::conditional_assign_mem(borrow, z, x, N); 267| 279k|} _ZN5Botan9comba_mulILm6ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 257k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 257k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 257k, Folded] ------------------ 973| | if constexpr(std::same_as && N == 4) { 974| | return bigint_comba_mul4(z, x, y); 975| | } 976| 257k| if constexpr(std::same_as && N == 6) { 977| 257k| return bigint_comba_mul6(z, x, y); 978| 257k| } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| | if constexpr(std::same_as && N == 8) { 983| | return bigint_comba_mul8(z, x, y); 984| | } 985| | if constexpr(std::same_as && N == 9) { 986| | return bigint_comba_mul9(z, x, y); 987| | } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 257k| } 992| | 993| 0| word3 accum; 994| | 995| 257k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 257k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 257k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm6EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 19.8k|inline constexpr W shift_left(std::array& x) { 879| 19.8k| static_assert(N >= 1, "Invalid input size"); 880| 19.8k| static_assert(S > 0, "Zero shift not supported"); 881| 19.8k| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 19.8k| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 119k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 99.2k, False: 19.8k] ------------------ 886| 99.2k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 99.2k| } 888| 19.8k| x[0] <<= S; 889| | 890| 19.8k| return carry; 891| 19.8k|} _ZN5Botan16read_window_bitsILm5EmLm6EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 11.5k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 11.5k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 11.5k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 11.5k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 11.5k| const auto bit_shift = offset % W_bits; 1281| 11.5k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 11.5k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 10.8k, False: 750] | Branch (1283:74): [True: 150, False: 600] ------------------ 1284| | 1285| 11.5k| const auto w0 = words[word_offset]; 1286| | 1287| 11.5k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 10.9k, False: 600] ------------------ 1288| 10.9k| return (w0 >> bit_shift) & WindowMask; 1289| 10.9k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 600| const auto w1 = words[word_offset - 1]; 1292| 600| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 600| return combined & WindowMask; 1294| 600| } 1295| 11.5k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm6EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 2.21k|inline constexpr W shift_right(std::array& x) { 895| 2.21k| static_assert(N >= 1, "Invalid input size"); 896| 2.21k| static_assert(S > 0, "Zero shift not supported"); 897| 2.21k| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 2.21k| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 13.2k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 11.0k, False: 2.21k] ------------------ 902| 11.0k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 11.0k| } 904| 2.21k| x[N - 1] >>= S; 905| | 906| 2.21k| return carry; 907| 2.21k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm6ELm48EEEDaNSt3__14spanIKhXT1_EEE: 1245| 346|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 346| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 346| std::array r = {}; 1249| | 1250| 346| constexpr size_t full_words = L / WordInfo::bytes; 1251| 346| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 346| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 2.42k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 2.07k, False: 346] ------------------ 1256| 2.07k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 2.07k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 346| return r; 1270| 346|} _ZN5Botan9comba_sqrILm8ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 124k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 124k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 124k, Folded] ------------------ 1009| | if constexpr(std::same_as && N == 4) { 1010| | return bigint_comba_sqr4(z, x); 1011| | } 1012| | if constexpr(std::same_as && N == 6) { 1013| | return bigint_comba_sqr6(z, x); 1014| | } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| 124k| if constexpr(std::same_as && N == 8) { 1019| 124k| return bigint_comba_sqr8(z, x); 1020| 124k| } 1021| | if constexpr(std::same_as && N == 9) { 1022| | return bigint_comba_sqr9(z, x); 1023| | } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 124k| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 124k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 124k] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 124k|} _ZN5Botan22bigint_monty_maybe_subILm8ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 306k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 306k| W borrow = 0; 259| | 260| 2.76M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 2.45M, False: 306k] ------------------ 261| 2.45M| z[i] = word_sub(x[i], y[i], &borrow); 262| 2.45M| } 263| | 264| 306k| borrow = (x0 - borrow) > x0; 265| | 266| 306k| CT::conditional_assign_mem(borrow, z, x, N); 267| 306k|} _ZN5Botan9comba_mulILm8ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 150k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 150k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 150k, Folded] ------------------ 973| | if constexpr(std::same_as && N == 4) { 974| | return bigint_comba_mul4(z, x, y); 975| | } 976| | if constexpr(std::same_as && N == 6) { 977| | return bigint_comba_mul6(z, x, y); 978| | } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| 150k| if constexpr(std::same_as && N == 8) { 983| 150k| return bigint_comba_mul8(z, x, y); 984| 150k| } 985| | if constexpr(std::same_as && N == 9) { 986| | return bigint_comba_mul9(z, x, y); 987| | } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 150k| } 992| | 993| 0| word3 accum; 994| | 995| 150k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 150k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 150k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm8EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 13.1k|inline constexpr W shift_left(std::array& x) { 879| 13.1k| static_assert(N >= 1, "Invalid input size"); 880| 13.1k| static_assert(S > 0, "Zero shift not supported"); 881| 13.1k| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 13.1k| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 105k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 92.3k, False: 13.1k] ------------------ 886| 92.3k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 92.3k| } 888| 13.1k| x[0] <<= S; 889| | 890| 13.1k| return carry; 891| 13.1k|} _ZN5Botan16read_window_bitsILm5EmLm8EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 13.9k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 13.9k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 13.9k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 13.9k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 13.9k| const auto bit_shift = offset % W_bits; 1281| 13.9k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 13.9k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 12.9k, False: 945] | Branch (1283:74): [True: 135, False: 810] ------------------ 1284| | 1285| 13.9k| const auto w0 = words[word_offset]; 1286| | 1287| 13.9k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 13.0k, False: 810] ------------------ 1288| 13.0k| return (w0 >> bit_shift) & WindowMask; 1289| 13.0k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 810| const auto w1 = words[word_offset - 1]; 1292| 810| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 810| return combined & WindowMask; 1294| 810| } 1295| 13.9k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm8EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 1.42k|inline constexpr W shift_right(std::array& x) { 895| 1.42k| static_assert(N >= 1, "Invalid input size"); 896| 1.42k| static_assert(S > 0, "Zero shift not supported"); 897| 1.42k| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 1.42k| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 11.4k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 9.98k, False: 1.42k] ------------------ 902| 9.98k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 9.98k| } 904| 1.42k| x[N - 1] >>= S; 905| | 906| 1.42k| return carry; 907| 1.42k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 2.15M|inline constexpr W shift_left(std::array& x) { 879| 2.15M| static_assert(N >= 1, "Invalid input size"); 880| 2.15M| static_assert(S > 0, "Zero shift not supported"); 881| 2.15M| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 2.15M| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 19.3M| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 17.2M, False: 2.15M] ------------------ 886| 17.2M| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 17.2M| } 888| 2.15M| x[0] <<= S; 889| | 890| 2.15M| return carry; 891| 2.15M|} _ZN5Botan22bigint_monty_maybe_subILm9ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 2.17M|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 2.17M| W borrow = 0; 259| | 260| 21.7M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 19.6M, False: 2.17M] ------------------ 261| 19.6M| z[i] = word_sub(x[i], y[i], &borrow); 262| 19.6M| } 263| | 264| 2.17M| borrow = (x0 - borrow) > x0; 265| | 266| 2.17M| CT::conditional_assign_mem(borrow, z, x, N); 267| 2.17M|} _ZN5Botan16read_window_bitsILm4EmLm18446744073709551615EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 40.1k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 40.1k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 40.1k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 40.1k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 40.1k| const auto bit_shift = offset % W_bits; 1281| 40.1k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 40.1k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 40.1k, False: 0] | Branch (1283:74): [True: 0, False: 0] ------------------ 1284| | 1285| 40.1k| const auto w0 = words[word_offset]; 1286| | 1287| 40.1k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 40.1k, False: 0] ------------------ 1288| 40.1k| return (w0 >> bit_shift) & WindowMask; 1289| 40.1k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 0| const auto w1 = words[word_offset - 1]; 1292| 0| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 0| return combined & WindowMask; 1294| 0| } 1295| 40.1k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 1.48k|inline constexpr W shift_right(std::array& x) { 895| 1.48k| static_assert(N >= 1, "Invalid input size"); 896| 1.48k| static_assert(S > 0, "Zero shift not supported"); 897| 1.48k| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 1.48k| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 13.3k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 11.8k, False: 1.48k] ------------------ 902| 11.8k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 11.8k| } 904| 1.48k| x[N - 1] >>= S; 905| | 906| 1.48k| return carry; 907| 1.48k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm4ELm28EEEDaNSt3__14spanIKhXT1_EEE: 1245| 563|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 563| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 563| std::array r = {}; 1249| | 1250| 563| constexpr size_t full_words = L / WordInfo::bytes; 1251| 563| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 563| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 2.25k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 1.68k, False: 563] ------------------ 1256| 1.68k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 1.68k| } 1258| | 1259| 563| if constexpr(extra_bytes > 0) { 1260| 563| constexpr size_t shift = extra_bytes * 8; 1261| 563| shift_left(r); 1262| | 1263| 2.81k| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (1263:25): [True: 2.25k, False: 563] ------------------ 1264| 2.25k| const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| 2.25k| r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| 2.25k| } 1267| 563| } 1268| | 1269| 563| return r; 1270| 563|} _ZN5Botan10shift_leftILm32ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 563|inline constexpr W shift_left(std::array& x) { 879| 563| static_assert(N >= 1, "Invalid input size"); 880| 563| static_assert(S > 0, "Zero shift not supported"); 881| 563| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 563| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 2.25k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 1.68k, False: 563] ------------------ 886| 1.68k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 1.68k| } 888| 563| x[0] <<= S; 889| | 890| 563| return carry; 891| 563|} _ZN5Botan13redc_crandallITkNS_8WordTypeEmLm4ETnT_Lm4294968273EEENSt3__15arrayIS1_XT0_EEENS2_4spanIKS1_XmlLi2ET0_EEE: 1167| 168k|constexpr std::array redc_crandall(std::span z) { 1168| 168k| static_assert(N >= 2); 1169| | 1170| 168k| std::array hi = {}; 1171| | 1172| | // hi = hi * c + lo 1173| | 1174| 168k| W carry = 0; 1175| 840k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (1175:22): [True: 672k, False: 168k] ------------------ 1176| 672k| hi[i] = word_madd3(z[i + N], C, z[i], &carry); 1177| 672k| } 1178| | 1179| | // hi += carry * C 1180| 168k| W carry_c[2] = {0}; 1181| 168k| carry_c[0] = word_madd2(carry, C, &carry_c[1]); 1182| | 1183| 168k| carry = bigint_add2(hi.data(), N, carry_c, 2); 1184| | 1185| 168k| constexpr W P0 = WordInfo::max - (C - 1); 1186| | 1187| 168k| std::array r = {}; 1188| | 1189| 168k| W borrow = 0; 1190| | 1191| | /* 1192| | * For undetermined reasons, on GCC (only) removing this asm block causes 1193| | * massive (up to 20%) performance regressions in secp256k1. 1194| | * 1195| | * The generated code without the asm seems quite reasonable, and timing 1196| | * repeated calls to redc_crandall with the cycle counter show that GCC 1197| | * computes it in about the same number of cycles with or without the asm. 1198| | * 1199| | * So the cause of the regression is unclear. But it is reproducible across 1200| | * machines and GCC versions. 1201| | */ 1202| |#if defined(BOTAN_MP_USE_X86_64_ASM) && defined(__GNUC__) && !defined(__clang__) 1203| | if constexpr(N == 4 && std::same_as) { 1204| | if(!std::is_constant_evaluated()) { 1205| | asm volatile(R"( 1206| | movq 0(%[x]), %[borrow] 1207| | subq %[p0], %[borrow] 1208| | movq %[borrow], 0(%[r]) 1209| | movq 8(%[x]), %[borrow] 1210| | sbbq $-1, %[borrow] 1211| | movq %[borrow], 8(%[r]) 1212| | movq 16(%[x]), %[borrow] 1213| | sbbq $-1, %[borrow] 1214| | movq %[borrow], 16(%[r]) 1215| | movq 24(%[x]), %[borrow] 1216| | sbbq $-1, %[borrow] 1217| | movq %[borrow], 24(%[r]) 1218| | sbbq %[borrow],%[borrow] 1219| | negq %[borrow] 1220| | )" 1221| | : [borrow] "=r"(borrow) 1222| | : [x] "r"(hi.data()), [p0] "r"(P0), [r] "r"(r.data()), "0"(borrow) 1223| | : "cc", "memory"); 1224| | 1225| | borrow = (carry - borrow) > carry; 1226| | CT::conditional_assign_mem(borrow, r.data(), hi.data(), N); 1227| | return r; 1228| | } 1229| | } 1230| |#endif 1231| | 1232| 168k| r[0] = word_sub(hi[0], P0, &borrow); 1233| 672k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (1233:22): [True: 504k, False: 168k] ------------------ 1234| 504k| r[i] = word_sub(hi[i], WordInfo::max, &borrow); 1235| 504k| } 1236| | 1237| 168k| borrow = (carry - borrow) > carry; 1238| | 1239| 168k| CT::conditional_assign_mem(borrow, r.data(), hi.data(), N); 1240| | 1241| 168k| return r; 1242| 168k|} _ZN5Botan9comba_sqrILm9ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 210k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 210k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 210k, Folded] ------------------ 1009| | if constexpr(std::same_as && N == 4) { 1010| | return bigint_comba_sqr4(z, x); 1011| | } 1012| | if constexpr(std::same_as && N == 6) { 1013| | return bigint_comba_sqr6(z, x); 1014| | } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| | if constexpr(std::same_as && N == 8) { 1019| | return bigint_comba_sqr8(z, x); 1020| | } 1021| 210k| if constexpr(std::same_as && N == 9) { 1022| 210k| return bigint_comba_sqr9(z, x); 1023| 210k| } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 210k| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 210k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 210k] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 210k|} _ZN5Botan9comba_mulILm9ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 219k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 219k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 219k, Folded] ------------------ 973| | if constexpr(std::same_as && N == 4) { 974| | return bigint_comba_mul4(z, x, y); 975| | } 976| | if constexpr(std::same_as && N == 6) { 977| | return bigint_comba_mul6(z, x, y); 978| | } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| | if constexpr(std::same_as && N == 8) { 983| | return bigint_comba_mul8(z, x, y); 984| | } 985| 219k| if constexpr(std::same_as && N == 9) { 986| 219k| return bigint_comba_mul9(z, x, y); 987| 219k| } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 219k| } 992| | 993| 0| word3 accum; 994| | 995| 219k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 219k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 219k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm9ELm66EEEDaNSt3__14spanIKhXT1_EEE: 1245| 408|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 408| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 408| std::array r = {}; 1249| | 1250| 408| constexpr size_t full_words = L / WordInfo::bytes; 1251| 408| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 408| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 3.67k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 3.26k, False: 408] ------------------ 1256| 3.26k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 3.26k| } 1258| | 1259| 408| if constexpr(extra_bytes > 0) { 1260| 408| constexpr size_t shift = extra_bytes * 8; 1261| 408| shift_left(r); 1262| | 1263| 1.22k| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (1263:25): [True: 816, False: 408] ------------------ 1264| 816| const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| 816| r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| 816| } 1267| 408| } 1268| | 1269| 408| return r; 1270| 408|} _ZN5Botan10shift_leftILm16ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 408|inline constexpr W shift_left(std::array& x) { 879| 408| static_assert(N >= 1, "Invalid input size"); 880| 408| static_assert(S > 0, "Zero shift not supported"); 881| 408| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 408| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 3.67k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 3.26k, False: 408] ------------------ 886| 3.26k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 3.26k| } 888| 408| x[0] <<= S; 889| | 890| 408| return carry; 891| 408|} _ZN5Botan22bigint_monty_maybe_subILm12ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 71|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 71| W borrow = 0; 259| | 260| 923| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 852, False: 71] ------------------ 261| 852| z[i] = word_sub(x[i], y[i], &borrow); 262| 852| } 263| | 264| 71| borrow = (x0 - borrow) > x0; 265| | 266| 71| CT::conditional_assign_mem(borrow, z, x, N); 267| 71|} _ZN5Botan22bigint_monty_maybe_subILm16ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 3|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 3| W borrow = 0; 259| | 260| 51| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 48, False: 3] ------------------ 261| 48| z[i] = word_sub(x[i], y[i], &borrow); 262| 48| } 263| | 264| 3| borrow = (x0 - borrow) > x0; 265| | 266| 3| CT::conditional_assign_mem(borrow, z, x, N); 267| 3|} _ZN5Botan9comba_mulILm7ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 15.0k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 15.0k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 15.0k, Folded] ------------------ 973| | if constexpr(std::same_as && N == 4) { 974| | return bigint_comba_mul4(z, x, y); 975| | } 976| | if constexpr(std::same_as && N == 6) { 977| | return bigint_comba_mul6(z, x, y); 978| | } 979| 15.0k| if constexpr(std::same_as && N == 7) { 980| 15.0k| return bigint_comba_mul7(z, x, y); 981| 15.0k| } 982| | if constexpr(std::same_as && N == 8) { 983| | return bigint_comba_mul8(z, x, y); 984| | } 985| | if constexpr(std::same_as && N == 9) { 986| | return bigint_comba_mul9(z, x, y); 987| | } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 15.0k| } 992| | 993| 0| word3 accum; 994| | 995| 15.0k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 15.0k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 15.0k|} _ZN5Botan9comba_sqrILm7ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 7.72k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 7.72k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 7.72k, Folded] ------------------ 1009| | if constexpr(std::same_as && N == 4) { 1010| | return bigint_comba_sqr4(z, x); 1011| | } 1012| | if constexpr(std::same_as && N == 6) { 1013| | return bigint_comba_sqr6(z, x); 1014| | } 1015| 7.72k| if constexpr(std::same_as && N == 7) { 1016| 7.72k| return bigint_comba_sqr7(z, x); 1017| 7.72k| } 1018| | if constexpr(std::same_as && N == 8) { 1019| | return bigint_comba_sqr8(z, x); 1020| | } 1021| | if constexpr(std::same_as && N == 9) { 1022| | return bigint_comba_sqr9(z, x); 1023| | } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 7.72k| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 7.72k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 7.72k] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 7.72k|} _ZN5Botan14use_mulx_montyEm: 33| 918k|inline bool use_mulx_monty(size_t p_size) { 34| 918k| return p_size >= MulxMontyMinWords && CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX); ------------------ | Branch (34:11): [True: 318k, False: 600k] | Branch (34:42): [True: 318k, False: 0] ------------------ 35| 918k|} _ZN5Botan6PCurve15PrimeOrderCurve6ScalarD2Ev: 73| 11.7k| ~Scalar() { _zeroize(); } _ZN5Botan6PCurve15PrimeOrderCurve11AffinePointD2Ev: 101| 6.57k| ~AffinePoint() = default; _ZN5Botan6PCurve15PrimeOrderCurve15ProjectivePointD2Ev: 135| 1.95k| ~ProjectivePoint() = default; _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2EOS2_: 68| 5.86k| Scalar(Scalar&& other) = default; _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2ERKS2_: 67| 3.89k| Scalar(const Scalar& other) = default; _ZN5Botan6PCurve15PrimeOrderCurve11AffinePointC2EOS2_: 98| 4.15k| AffinePoint(AffinePoint&& other) = default; _ZN5Botan6PCurve15PrimeOrderCurve11AffinePointC2ERKS2_: 97| 4| AffinePoint(const AffinePoint& other) = default; _ZNK5Botan6PCurve15PrimeOrderCurve6Scalar6_curveEv: 77| 5.85k| const auto& _curve() const { return m_curve; } _ZNK5Botan6PCurve15PrimeOrderCurve6Scalar6_valueEv: 79| 5.85k| const auto& _value() const { return m_value; } _ZN5Botan6PCurve15PrimeOrderCurve6Scalar7_createENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEE: 81| 1.95k| static Scalar _create(CurvePtr curve, StorageUnit v) { return Scalar(std::move(curve), v); } _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2ENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEE: 84| 1.95k| Scalar(CurvePtr curve, StorageUnit v) : m_curve(std::move(curve)), m_value(v) {} _ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint6_curveEv: 105| 4.45k| const auto& _curve() const { return m_curve; } _ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint2_xEv: 107| 4.45k| const auto& _x() const { return m_x; } _ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint2_yEv: 109| 4.45k| const auto& _y() const { return m_y; } _ZN5Botan6PCurve15PrimeOrderCurve11AffinePoint7_createENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_: 111| 2.41k| static AffinePoint _create(CurvePtr curve, StorageUnit x, StorageUnit y) { 112| 2.41k| return AffinePoint(std::move(curve), x, y); 113| 2.41k| } _ZN5Botan6PCurve15PrimeOrderCurve11AffinePointC2ENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_: 116| 2.41k| AffinePoint(CurvePtr curve, StorageUnit x, StorageUnit y) : m_curve(std::move(curve)), m_x(x), m_y(y) {} _ZNK5Botan6PCurve15PrimeOrderCurve15ProjectivePoint6_curveEv: 137| 1.95k| const auto& _curve() const { return m_curve; } _ZNK5Botan6PCurve15PrimeOrderCurve15ProjectivePoint2_xEv: 139| 1.95k| const auto& _x() const { return m_x; } _ZNK5Botan6PCurve15PrimeOrderCurve15ProjectivePoint2_yEv: 141| 1.95k| const auto& _y() const { return m_y; } _ZNK5Botan6PCurve15PrimeOrderCurve15ProjectivePoint2_zEv: 143| 1.95k| const auto& _z() const { return m_z; } _ZN5Botan6PCurve15PrimeOrderCurve15ProjectivePoint7_createENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_S8_: 145| 1.95k| static ProjectivePoint _create(CurvePtr curve, StorageUnit x, StorageUnit y, StorageUnit z) { 146| 1.95k| return ProjectivePoint(std::move(curve), x, y, z); 147| 1.95k| } _ZN5Botan6PCurve15PrimeOrderCurve15ProjectivePointC2ENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_S8_: 151| 1.95k| m_curve(std::move(curve)), m_x(x), m_y(y), m_z(z) {} _ZN5Botan6PCurve15PrimeOrderCurveD2Ev: 164| 387| virtual ~PrimeOrderCurve() = default; pcurves_brainpool256r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 419| 833|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 420| | // Cost: 1M + 3S + 1A + 1*3 421| 833| const auto z2 = pt.z().square(); 422| 833| const auto m = pt.x().square().mul3() + A * z2.square(); 423| | 424| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 425| 833| const auto y2 = pt.y().square(); 426| 833| const auto s = pt.x().mul4() * y2; 427| 833| const auto nx = m.square() - s.mul2(); 428| 833| const auto ny = m * (s - nx) - y2.square().mul8(); 429| 833| const auto nz = pt.y().mul2() * pt.z(); 430| | 431| 833| return ProjectivePoint(nx, ny, nz); 432| 833|} pcurves_brainpool256r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 735| const auto a_is_identity = a.is_identity(); 190| 735| const auto b_is_identity = b.is_identity(); 191| | 192| 735| const auto Z1Z1 = a.z().square(); 193| 735| const auto Z2Z2 = b.z().square(); 194| 735| const auto U1 = a.x() * Z2Z2; 195| 735| const auto U2 = b.x() * Z1Z1; 196| 735| const auto S1 = a.y() * b.z() * Z2Z2; 197| 735| const auto S2 = b.y() * a.z() * Z1Z1; 198| 735| const auto H = U2 - U1; 199| 735| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 735] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 735| const auto HH = H.square(); 216| 735| const auto HHH = H * HH; 217| 735| const auto V = U1 * HH; 218| 735| const auto t2 = r.square(); 219| 735| const auto t3 = V + V; 220| 735| const auto t4 = t2 - HHH; 221| 735| auto X3 = t4 - t3; 222| 735| const auto t5 = V - X3; 223| 735| const auto t6 = S1 * HHH; 224| 735| const auto t7 = r * t5; 225| 735| auto Y3 = t7 - t6; 226| 735| const auto t8 = b.z() * H; 227| 735| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 735| return ProjectivePoint(X3, Y3, Z3); 236| 735|} pcurves_brainpool256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.56k, False: 1] ------------------ 118| 1.56k| any_identity = any_identity || pt.is_identity(); 119| 1.56k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.56k, False: 1] ------------------ 147| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.56k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.56k, False: 1] ------------------ 159| 1.56k| const auto& p = projective[i]; 160| | 161| 1.56k| const auto z_inv = s_inv * c[i - 1]; 162| 1.56k| const auto z2_inv = z_inv.square(); 163| 1.56k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.56k| s_inv = s_inv * p.z(); 166| | 167| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.56k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_brainpool256r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveEEEDaRKNT_15ProjectivePointE: 77| 175|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| | if constexpr(curve_supports_fe_invert2) { 82| | const auto z2_inv = C::fe_invert2(pt.z()); 83| | const auto z3_inv = z2_inv.square() * pt.z(); 84| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| 175| } else { 86| 175| const auto z_inv = invert_field_element(pt.z()); 87| 175| const auto z2_inv = z_inv.square(); 88| 175| const auto z3_inv = z_inv * z2_inv; 89| 175| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| 175| } 91| 175|} pcurves_brainpool256r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveEEEDaRKNT_12FieldElementE: 36| 175|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 37| | if constexpr(curve_supports_fe_invert2) { 38| | return C::fe_invert2(fe) * fe; 39| 175| } else { 40| 175| return fe.invert(); 41| 175| } 42| 175|} pcurves_brainpool256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_brainpool256r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_SQ_: 318| 7.35k| const FieldElement& curve_a) { 319| 7.35k| const auto a_is_identity = a.is_identity(); 320| 7.35k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 7.35k| auto by = b.y(); 329| 7.35k| by.conditional_assign(sub, by.negate()); 330| | 331| 7.35k| const auto Z1Z1 = a.z().square(); 332| 7.35k| const auto U2 = b.x() * Z1Z1; 333| 7.35k| const auto S2 = by * a.z() * Z1Z1; 334| 7.35k| const auto H = U2 - a.x(); 335| 7.35k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 7.35k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 7.35k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 7.35k| const auto HH = H.square(); 352| 7.35k| const auto HHH = H * HH; 353| 7.35k| const auto V = a.x() * HH; 354| 7.35k| const auto t2 = r.square(); 355| 7.35k| const auto t3 = V + V; 356| 7.35k| const auto t4 = t2 - HHH; 357| 7.35k| auto X3 = t4 - t3; 358| 7.35k| const auto t5 = V - X3; 359| 7.35k| const auto t6 = a.y() * HHH; 360| 7.35k| const auto t7 = r * t5; 361| 7.35k| auto Y3 = t7 - t6; 362| 7.35k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 7.35k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 7.35k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 7.35k| return ProjectivePoint(X3, Y3, Z3); 371| 7.35k|} pcurves_brainpool384r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 419| 1.24k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 420| | // Cost: 1M + 3S + 1A + 1*3 421| 1.24k| const auto z2 = pt.z().square(); 422| 1.24k| const auto m = pt.x().square().mul3() + A * z2.square(); 423| | 424| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 425| 1.24k| const auto y2 = pt.y().square(); 426| 1.24k| const auto s = pt.x().mul4() * y2; 427| 1.24k| const auto nx = m.square() - s.mul2(); 428| 1.24k| const auto ny = m * (s - nx) - y2.square().mul8(); 429| 1.24k| const auto nz = pt.y().mul2() * pt.z(); 430| | 431| 1.24k| return ProjectivePoint(nx, ny, nz); 432| 1.24k|} pcurves_brainpool384r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.09k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.09k| const auto a_is_identity = a.is_identity(); 190| 1.09k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.09k| const auto Z1Z1 = a.z().square(); 193| 1.09k| const auto Z2Z2 = b.z().square(); 194| 1.09k| const auto U1 = a.x() * Z2Z2; 195| 1.09k| const auto U2 = b.x() * Z1Z1; 196| 1.09k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.09k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.09k| const auto H = U2 - U1; 199| 1.09k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.09k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.09k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.09k| const auto HH = H.square(); 216| 1.09k| const auto HHH = H * HH; 217| 1.09k| const auto V = U1 * HH; 218| 1.09k| const auto t2 = r.square(); 219| 1.09k| const auto t3 = V + V; 220| 1.09k| const auto t4 = t2 - HHH; 221| 1.09k| auto X3 = t4 - t3; 222| 1.09k| const auto t5 = V - X3; 223| 1.09k| const auto t6 = S1 * HHH; 224| 1.09k| const auto t7 = r * t5; 225| 1.09k| auto Y3 = t7 - t6; 226| 1.09k| const auto t8 = b.z() * H; 227| 1.09k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.09k| return ProjectivePoint(X3, Y3, Z3); 236| 1.09k|} pcurves_brainpool384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 2.33k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 2.33k, False: 1] ------------------ 118| 2.33k| any_identity = any_identity || pt.is_identity(); 119| 2.33k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 2.33k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 2.33k, False: 1] ------------------ 147| 2.33k| c.push_back(c[i - 1] * projective[i].z()); 148| 2.33k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 2.33k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 2.33k, False: 1] ------------------ 159| 2.33k| const auto& p = projective[i]; 160| | 161| 2.33k| const auto z_inv = s_inv * c[i - 1]; 162| 2.33k| const auto z2_inv = z_inv.square(); 163| 2.33k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 2.33k| s_inv = s_inv * p.z(); 166| | 167| 2.33k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 2.33k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_brainpool384r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveEEEDaRKNT_15ProjectivePointE: 77| 150|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| | if constexpr(curve_supports_fe_invert2) { 82| | const auto z2_inv = C::fe_invert2(pt.z()); 83| | const auto z3_inv = z2_inv.square() * pt.z(); 84| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| 150| } else { 86| 150| const auto z_inv = invert_field_element(pt.z()); 87| 150| const auto z2_inv = z_inv.square(); 88| 150| const auto z3_inv = z_inv * z2_inv; 89| 150| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| 150| } 91| 150|} pcurves_brainpool384r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveEEEDaRKNT_12FieldElementE: 36| 150|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 37| | if constexpr(curve_supports_fe_invert2) { 38| | return C::fe_invert2(fe) * fe; 39| 150| } else { 40| 150| return fe.invert(); 41| 150| } 42| 150|} pcurves_brainpool384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_brainpool384r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_SQ_: 318| 9.60k| const FieldElement& curve_a) { 319| 9.60k| const auto a_is_identity = a.is_identity(); 320| 9.60k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 9.60k| auto by = b.y(); 329| 9.60k| by.conditional_assign(sub, by.negate()); 330| | 331| 9.60k| const auto Z1Z1 = a.z().square(); 332| 9.60k| const auto U2 = b.x() * Z1Z1; 333| 9.60k| const auto S2 = by * a.z() * Z1Z1; 334| 9.60k| const auto H = U2 - a.x(); 335| 9.60k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 9.60k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 9.60k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 9.60k| const auto HH = H.square(); 352| 9.60k| const auto HHH = H * HH; 353| 9.60k| const auto V = a.x() * HH; 354| 9.60k| const auto t2 = r.square(); 355| 9.60k| const auto t3 = V + V; 356| 9.60k| const auto t4 = t2 - HHH; 357| 9.60k| auto X3 = t4 - t3; 358| 9.60k| const auto t5 = V - X3; 359| 9.60k| const auto t6 = a.y() * HHH; 360| 9.60k| const auto t7 = r * t5; 361| 9.60k| auto Y3 = t7 - t6; 362| 9.60k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 9.60k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 9.60k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 9.60k| return ProjectivePoint(X3, Y3, Z3); 371| 9.60k|} pcurves_brainpool512r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 419| 1.64k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 420| | // Cost: 1M + 3S + 1A + 1*3 421| 1.64k| const auto z2 = pt.z().square(); 422| 1.64k| const auto m = pt.x().square().mul3() + A * z2.square(); 423| | 424| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 425| 1.64k| const auto y2 = pt.y().square(); 426| 1.64k| const auto s = pt.x().mul4() * y2; 427| 1.64k| const auto nx = m.square() - s.mul2(); 428| 1.64k| const auto ny = m * (s - nx) - y2.square().mul8(); 429| 1.64k| const auto nz = pt.y().mul2() * pt.z(); 430| | 431| 1.64k| return ProjectivePoint(nx, ny, nz); 432| 1.64k|} pcurves_brainpool512r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.45k| const auto a_is_identity = a.is_identity(); 190| 1.45k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.45k| const auto Z1Z1 = a.z().square(); 193| 1.45k| const auto Z2Z2 = b.z().square(); 194| 1.45k| const auto U1 = a.x() * Z2Z2; 195| 1.45k| const auto U2 = b.x() * Z1Z1; 196| 1.45k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.45k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.45k| const auto H = U2 - U1; 199| 1.45k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.45k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.45k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.45k| const auto HH = H.square(); 216| 1.45k| const auto HHH = H * HH; 217| 1.45k| const auto V = U1 * HH; 218| 1.45k| const auto t2 = r.square(); 219| 1.45k| const auto t3 = V + V; 220| 1.45k| const auto t4 = t2 - HHH; 221| 1.45k| auto X3 = t4 - t3; 222| 1.45k| const auto t5 = V - X3; 223| 1.45k| const auto t6 = S1 * HHH; 224| 1.45k| const auto t7 = r * t5; 225| 1.45k| auto Y3 = t7 - t6; 226| 1.45k| const auto t8 = b.z() * H; 227| 1.45k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.45k| return ProjectivePoint(X3, Y3, Z3); 236| 1.45k|} pcurves_brainpool512r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 3.10k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 3.10k, False: 1] ------------------ 118| 3.10k| any_identity = any_identity || pt.is_identity(); 119| 3.10k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 3.10k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 3.10k, False: 1] ------------------ 147| 3.10k| c.push_back(c[i - 1] * projective[i].z()); 148| 3.10k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 3.10k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 3.10k, False: 1] ------------------ 159| 3.10k| const auto& p = projective[i]; 160| | 161| 3.10k| const auto z_inv = s_inv * c[i - 1]; 162| 3.10k| const auto z2_inv = z_inv.square(); 163| 3.10k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 3.10k| s_inv = s_inv * p.z(); 166| | 167| 3.10k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 3.10k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_brainpool512r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveEEEDaRKNT_15ProjectivePointE: 77| 135|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| | if constexpr(curve_supports_fe_invert2) { 82| | const auto z2_inv = C::fe_invert2(pt.z()); 83| | const auto z3_inv = z2_inv.square() * pt.z(); 84| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| 135| } else { 86| 135| const auto z_inv = invert_field_element(pt.z()); 87| 135| const auto z2_inv = z_inv.square(); 88| 135| const auto z3_inv = z_inv * z2_inv; 89| 135| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| 135| } 91| 135|} pcurves_brainpool512r1.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveEEEDaRKNT_12FieldElementE: 36| 135|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 37| | if constexpr(curve_supports_fe_invert2) { 38| | return C::fe_invert2(fe) * fe; 39| 135| } else { 40| 135| return fe.invert(); 41| 135| } 42| 135|} pcurves_brainpool512r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_brainpool512r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_SQ_: 318| 11.4k| const FieldElement& curve_a) { 319| 11.4k| const auto a_is_identity = a.is_identity(); 320| 11.4k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 11.4k| auto by = b.y(); 329| 11.4k| by.conditional_assign(sub, by.negate()); 330| | 331| 11.4k| const auto Z1Z1 = a.z().square(); 332| 11.4k| const auto U2 = b.x() * Z1Z1; 333| 11.4k| const auto S2 = by * a.z() * Z1Z1; 334| 11.4k| const auto H = U2 - a.x(); 335| 11.4k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 11.4k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 11.4k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 11.4k| const auto HH = H.square(); 352| 11.4k| const auto HHH = H * HH; 353| 11.4k| const auto V = a.x() * HH; 354| 11.4k| const auto t2 = r.square(); 355| 11.4k| const auto t3 = V + V; 356| 11.4k| const auto t4 = t2 - HHH; 357| 11.4k| auto X3 = t4 - t3; 358| 11.4k| const auto t5 = V - X3; 359| 11.4k| const auto t6 = a.y() * HHH; 360| 11.4k| const auto t7 = r * t5; 361| 11.4k| auto Y3 = t7 - t6; 362| 11.4k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 11.4k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 11.4k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 11.4k| return ProjectivePoint(X3, Y3, Z3); 371| 11.4k|} pcurves_generic.cpp:_ZN5Botan22point_add_or_sub_mixedINS_6PCurve22GenericProjectivePointENS1_18GenericAffinePointENS1_12_GLOBAL__N_112GenericFieldEEET_RKS6_RKT0_NS_2CT6ChoiceERKT1_SG_: 318| 13.0k| const FieldElement& curve_a) { 319| 13.0k| const auto a_is_identity = a.is_identity(); 320| 13.0k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 13.0k| auto by = b.y(); 329| 13.0k| by.conditional_assign(sub, by.negate()); 330| | 331| 13.0k| const auto Z1Z1 = a.z().square(); 332| 13.0k| const auto U2 = b.x() * Z1Z1; 333| 13.0k| const auto S2 = by * a.z() * Z1Z1; 334| 13.0k| const auto H = U2 - a.x(); 335| 13.0k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 13.0k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 13.0k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 13.0k| const auto HH = H.square(); 352| 13.0k| const auto HHH = H * HH; 353| 13.0k| const auto V = a.x() * HH; 354| 13.0k| const auto t2 = r.square(); 355| 13.0k| const auto t3 = V + V; 356| 13.0k| const auto t4 = t2 - HHH; 357| 13.0k| auto X3 = t4 - t3; 358| 13.0k| const auto t5 = V - X3; 359| 13.0k| const auto t6 = a.y() * HHH; 360| 13.0k| const auto t7 = r * t5; 361| 13.0k| auto Y3 = t7 - t6; 362| 13.0k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 13.0k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 13.0k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 13.0k| return ProjectivePoint(X3, Y3, Z3); 371| 13.0k|} _ZN5Botan10dbl_a_zeroINS_6PCurve22GenericProjectivePointEEET_RKS3_: 403| 111k|inline constexpr ProjectivePoint dbl_a_zero(const ProjectivePoint& pt) { 404| | // If a == 0 then 3*x^2 + a*z^4 == 3*x^2 405| | // Cost: 1S + 1*3 406| 111k| const auto m = pt.x().square().mul3(); 407| | 408| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 409| 111k| const auto y2 = pt.y().square(); 410| 111k| const auto s = pt.x().mul4() * y2; 411| 111k| const auto nx = m.square() - s.mul2(); 412| 111k| const auto ny = m * (s - nx) - y2.square().mul8(); 413| 111k| const auto nz = pt.y().mul2() * pt.z(); 414| | 415| 111k| return ProjectivePoint(nx, ny, nz); 416| 111k|} pcurves_generic.cpp:_ZN5Botan11dbl_genericINS_6PCurve22GenericProjectivePointENS1_12_GLOBAL__N_112GenericFieldEEET_RKS5_RKT0_: 419| 150k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 420| | // Cost: 1M + 3S + 1A + 1*3 421| 150k| const auto z2 = pt.z().square(); 422| 150k| const auto m = pt.x().square().mul3() + A * z2.square(); 423| | 424| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 425| 150k| const auto y2 = pt.y().square(); 426| 150k| const auto s = pt.x().mul4() * y2; 427| 150k| const auto nx = m.square() - s.mul2(); 428| 150k| const auto ny = m * (s - nx) - y2.square().mul8(); 429| 150k| const auto nz = pt.y().mul2() * pt.z(); 430| | 431| 150k| return ProjectivePoint(nx, ny, nz); 432| 150k|} pcurves_generic.cpp:_ZN5Botan20invert_field_elementINS_6PCurve12_GLOBAL__N_112GenericCurveEEEDaRKNT_12FieldElementE: 36| 364|inline constexpr auto invert_field_element(const typename C::FieldElement& fe) { 37| | if constexpr(curve_supports_fe_invert2) { 38| | return C::fe_invert2(fe) * fe; 39| 364| } else { 40| 364| return fe.invert(); 41| 364| } 42| 364|} _ZN5Botan13dbl_a_minus_3INS_6PCurve22GenericProjectivePointEEET_RKS3_: 384| 4.96k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 4.96k| const auto z2 = pt.z().square(); 390| 4.96k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 4.96k| const auto y2 = pt.y().square(); 394| 4.96k| const auto s = pt.x().mul4() * y2; 395| 4.96k| const auto nx = m.square() - s.mul2(); 396| 4.96k| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 4.96k| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 4.96k| return ProjectivePoint(nx, ny, nz); 400| 4.96k|} pcurves_generic.cpp:_ZN5Botan9point_addINS_6PCurve22GenericProjectivePointENS1_12_GLOBAL__N_112GenericFieldEEET_RKS5_S7_: 188| 235k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 235k| const auto a_is_identity = a.is_identity(); 190| 235k| const auto b_is_identity = b.is_identity(); 191| | 192| 235k| const auto Z1Z1 = a.z().square(); 193| 235k| const auto Z2Z2 = b.z().square(); 194| 235k| const auto U1 = a.x() * Z2Z2; 195| 235k| const auto U2 = b.x() * Z1Z1; 196| 235k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 235k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 235k| const auto H = U2 - U1; 199| 235k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 235k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 235k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 235k| const auto HH = H.square(); 216| 235k| const auto HHH = H * HH; 217| 235k| const auto V = U1 * HH; 218| 235k| const auto t2 = r.square(); 219| 235k| const auto t3 = V + V; 220| 235k| const auto t4 = t2 - HHH; 221| 235k| auto X3 = t4 - t3; 222| 235k| const auto t5 = V - X3; 223| 235k| const auto t6 = S1 * HHH; 224| 235k| const auto t7 = r * t5; 225| 235k| auto Y3 = t7 - t6; 226| 235k| const auto t8 = b.z() * H; 227| 235k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 235k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 235k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 235k| return ProjectivePoint(X3, Y3, Z3); 236| 235k|} pcurves_generic.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_112GenericCurveEEEDaRKNT_15ProjectivePointE: 77| 364|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| | if constexpr(curve_supports_fe_invert2) { 82| | const auto z2_inv = C::fe_invert2(pt.z()); 83| | const auto z3_inv = z2_inv.square() * pt.z(); 84| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| 364| } else { 86| 364| const auto z_inv = invert_field_element(pt.z()); 87| 364| const auto z2_inv = z_inv.square(); 88| 364| const auto z3_inv = z_inv * z2_inv; 89| 364| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| 364| } 91| 364|} pcurves_generic.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_112GenericCurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 379|auto to_affine_batch(std::span projective) { 109| 379| using AffinePoint = typename C::AffinePoint; 110| | 111| 379| const size_t N = projective.size(); 112| 379| std::vector affine; 113| 379| affine.reserve(N); 114| | 115| 379| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 502k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 502k, False: 379] ------------------ 118| 502k| any_identity = any_identity || pt.is_identity(); 119| 502k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 379| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 379] | Branch (127:17): [True: 0, False: 379] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 379| } else { 135| 379| std::vector c; 136| 379| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 379| c.push_back(projective[0].z()); 146| 502k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 502k, False: 379] ------------------ 147| 502k| c.push_back(c[i - 1] * projective[i].z()); 148| 502k| } 149| | 150| 379| auto s_inv = [&]() { 151| 379| if constexpr(VariableTime) { 152| 379| return c[N - 1].invert_vartime(); 153| 379| } else { 154| 379| return invert_field_element(c[N - 1]); 155| 379| } 156| 379| }(); 157| | 158| 502k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 502k, False: 379] ------------------ 159| 502k| const auto& p = projective[i]; 160| | 161| 502k| const auto z_inv = s_inv * c[i - 1]; 162| 502k| const auto z2_inv = z_inv.square(); 163| 502k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 502k| s_inv = s_inv * p.z(); 166| | 167| 502k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 502k| } 169| | 170| 379| const auto z2_inv = s_inv.square(); 171| 379| const auto z3_inv = s_inv * z2_inv; 172| 379| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 379| std::reverse(affine.begin(), affine.end()); 174| 379| return affine; 175| 379| } 176| | 177| 0| return affine; 178| 379|} pcurves_generic.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_112GenericCurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 379| auto s_inv = [&]() { 151| 379| if constexpr(VariableTime) { 152| 379| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 379| }(); pcurves_secp224r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 731|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 731| const auto z2 = pt.z().square(); 390| 731| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 731| const auto y2 = pt.y().square(); 394| 731| const auto s = pt.x().mul4() * y2; 395| 731| const auto nx = m.square() - s.mul2(); 396| 731| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 731| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 731| return ProjectivePoint(nx, ny, nz); 400| 731|} pcurves_secp224r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 645|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 645| const auto a_is_identity = a.is_identity(); 190| 645| const auto b_is_identity = b.is_identity(); 191| | 192| 645| const auto Z1Z1 = a.z().square(); 193| 645| const auto Z2Z2 = b.z().square(); 194| 645| const auto U1 = a.x() * Z2Z2; 195| 645| const auto U2 = b.x() * Z1Z1; 196| 645| const auto S1 = a.y() * b.z() * Z2Z2; 197| 645| const auto S2 = b.y() * a.z() * Z1Z1; 198| 645| const auto H = U2 - U1; 199| 645| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 645| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 645] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 645| const auto HH = H.square(); 216| 645| const auto HHH = H * HH; 217| 645| const auto V = U1 * HH; 218| 645| const auto t2 = r.square(); 219| 645| const auto t3 = V + V; 220| 645| const auto t4 = t2 - HHH; 221| 645| auto X3 = t4 - t3; 222| 645| const auto t5 = V - X3; 223| 645| const auto t6 = S1 * HHH; 224| 645| const auto t7 = r * t5; 225| 645| auto Y3 = t7 - t6; 226| 645| const auto t8 = b.z() * H; 227| 645| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 645| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 645| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 645| return ProjectivePoint(X3, Y3, Z3); 236| 645|} pcurves_secp224r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp224r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.37k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.37k, False: 1] ------------------ 118| 1.37k| any_identity = any_identity || pt.is_identity(); 119| 1.37k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.37k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.37k, False: 1] ------------------ 147| 1.37k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.37k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.37k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.37k, False: 1] ------------------ 159| 1.37k| const auto& p = projective[i]; 160| | 161| 1.37k| const auto z_inv = s_inv * c[i - 1]; 162| 1.37k| const auto z2_inv = z_inv.square(); 163| 1.37k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.37k| s_inv = s_inv * p.z(); 166| | 167| 1.37k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.37k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp224r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_19secp224r15CurveEEEDaRKNT_15ProjectivePointE: 77| 323|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| 323| if constexpr(curve_supports_fe_invert2) { 82| 323| const auto z2_inv = C::fe_invert2(pt.z()); 83| 323| const auto z3_inv = z2_inv.square() * pt.z(); 84| 323| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| | } else { 86| | const auto z_inv = invert_field_element(pt.z()); 87| | const auto z2_inv = z_inv.square(); 88| | const auto z3_inv = z_inv * z2_inv; 89| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| | } 91| 323|} pcurves_secp224r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp224r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp224r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_SQ_: 318| 11.9k| const FieldElement& curve_a) { 319| 11.9k| const auto a_is_identity = a.is_identity(); 320| 11.9k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 11.9k| auto by = b.y(); 329| 11.9k| by.conditional_assign(sub, by.negate()); 330| | 331| 11.9k| const auto Z1Z1 = a.z().square(); 332| 11.9k| const auto U2 = b.x() * Z1Z1; 333| 11.9k| const auto S2 = by * a.z() * Z1Z1; 334| 11.9k| const auto H = U2 - a.x(); 335| 11.9k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 11.9k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 11.9k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 11.9k| const auto HH = H.square(); 352| 11.9k| const auto HHH = H * HH; 353| 11.9k| const auto V = a.x() * HH; 354| 11.9k| const auto t2 = r.square(); 355| 11.9k| const auto t3 = V + V; 356| 11.9k| const auto t4 = t2 - HHH; 357| 11.9k| auto X3 = t4 - t3; 358| 11.9k| const auto t5 = V - X3; 359| 11.9k| const auto t6 = a.y() * HHH; 360| 11.9k| const auto t7 = r * t5; 361| 11.9k| auto Y3 = t7 - t6; 362| 11.9k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 11.9k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 11.9k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 11.9k| return ProjectivePoint(X3, Y3, Z3); 371| 11.9k|} pcurves_secp224r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp224r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_: 61| 145|inline constexpr CT::Option sqrt_field_element(const typename C::FieldElement& fe) { 62| | if constexpr(curve_supports_fe_sqrt) { 63| | auto z = C::fe_sqrt(fe); 64| | // Zero out the return value if it would otherwise be incorrect 65| | const CT::Choice correct = (z.square() == fe); 66| | z.conditional_assign(!correct, C::FieldElement::zero()); 67| | return CT::Option(z, correct); 68| 145| } else { 69| 145| return fe.sqrt(); 70| 145| } 71| 145|} pcurves_secp256k1.cpp:_ZN5Botan10dbl_a_zeroINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 403| 833|inline constexpr ProjectivePoint dbl_a_zero(const ProjectivePoint& pt) { 404| | // If a == 0 then 3*x^2 + a*z^4 == 3*x^2 405| | // Cost: 1S + 1*3 406| 833| const auto m = pt.x().square().mul3(); 407| | 408| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 409| 833| const auto y2 = pt.y().square(); 410| 833| const auto s = pt.x().mul4() * y2; 411| 833| const auto nx = m.square() - s.mul2(); 412| 833| const auto ny = m * (s - nx) - y2.square().mul8(); 413| 833| const auto nz = pt.y().mul2() * pt.z(); 414| | 415| 833| return ProjectivePoint(nx, ny, nz); 416| 833|} pcurves_secp256k1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 735| const auto a_is_identity = a.is_identity(); 190| 735| const auto b_is_identity = b.is_identity(); 191| | 192| 735| const auto Z1Z1 = a.z().square(); 193| 735| const auto Z2Z2 = b.z().square(); 194| 735| const auto U1 = a.x() * Z2Z2; 195| 735| const auto U2 = b.x() * Z1Z1; 196| 735| const auto S1 = a.y() * b.z() * Z2Z2; 197| 735| const auto S2 = b.y() * a.z() * Z1Z1; 198| 735| const auto H = U2 - U1; 199| 735| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 735] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 735| const auto HH = H.square(); 216| 735| const auto HHH = H * HH; 217| 735| const auto V = U1 * HH; 218| 735| const auto t2 = r.square(); 219| 735| const auto t3 = V + V; 220| 735| const auto t4 = t2 - HHH; 221| 735| auto X3 = t4 - t3; 222| 735| const auto t5 = V - X3; 223| 735| const auto t6 = S1 * HHH; 224| 735| const auto t7 = r * t5; 225| 735| auto Y3 = t7 - t6; 226| 735| const auto t8 = b.z() * H; 227| 735| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 735| return ProjectivePoint(X3, Y3, Z3); 236| 735|} pcurves_secp256k1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256k15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.56k, False: 1] ------------------ 118| 1.56k| any_identity = any_identity || pt.is_identity(); 119| 1.56k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.56k, False: 1] ------------------ 147| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.56k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.56k, False: 1] ------------------ 159| 1.56k| const auto& p = projective[i]; 160| | 161| 1.56k| const auto z_inv = s_inv * c[i - 1]; 162| 1.56k| const auto z2_inv = z_inv.square(); 163| 1.56k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.56k| s_inv = s_inv * p.z(); 166| | 167| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.56k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp256k1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_19secp256k15CurveEEEDaRKNT_15ProjectivePointE: 77| 189|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| 189| if constexpr(curve_supports_fe_invert2) { 82| 189| const auto z2_inv = C::fe_invert2(pt.z()); 83| 189| const auto z3_inv = z2_inv.square() * pt.z(); 84| 189| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| | } else { 86| | const auto z_inv = invert_field_element(pt.z()); 87| | const auto z2_inv = z_inv.square(); 88| | const auto z3_inv = z_inv * z2_inv; 89| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| | } 91| 189|} pcurves_secp256k1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256k15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp256k1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_SQ_: 318| 7.93k| const FieldElement& curve_a) { 319| 7.93k| const auto a_is_identity = a.is_identity(); 320| 7.93k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 7.93k| auto by = b.y(); 329| 7.93k| by.conditional_assign(sub, by.negate()); 330| | 331| 7.93k| const auto Z1Z1 = a.z().square(); 332| 7.93k| const auto U2 = b.x() * Z1Z1; 333| 7.93k| const auto S2 = by * a.z() * Z1Z1; 334| 7.93k| const auto H = U2 - a.x(); 335| 7.93k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 7.93k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 7.93k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 7.93k| const auto HH = H.square(); 352| 7.93k| const auto HHH = H * HH; 353| 7.93k| const auto V = a.x() * HH; 354| 7.93k| const auto t2 = r.square(); 355| 7.93k| const auto t3 = V + V; 356| 7.93k| const auto t4 = t2 - HHH; 357| 7.93k| auto X3 = t4 - t3; 358| 7.93k| const auto t5 = V - X3; 359| 7.93k| const auto t6 = a.y() * HHH; 360| 7.93k| const auto t7 = r * t5; 361| 7.93k| auto Y3 = t7 - t6; 362| 7.93k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 7.93k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 7.93k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 7.93k| return ProjectivePoint(X3, Y3, Z3); 371| 7.93k|} pcurves_secp256r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 833|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 833| const auto z2 = pt.z().square(); 390| 833| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 833| const auto y2 = pt.y().square(); 394| 833| const auto s = pt.x().mul4() * y2; 395| 833| const auto nx = m.square() - s.mul2(); 396| 833| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 833| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 833| return ProjectivePoint(nx, ny, nz); 400| 833|} pcurves_secp256r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 735| const auto a_is_identity = a.is_identity(); 190| 735| const auto b_is_identity = b.is_identity(); 191| | 192| 735| const auto Z1Z1 = a.z().square(); 193| 735| const auto Z2Z2 = b.z().square(); 194| 735| const auto U1 = a.x() * Z2Z2; 195| 735| const auto U2 = b.x() * Z1Z1; 196| 735| const auto S1 = a.y() * b.z() * Z2Z2; 197| 735| const auto S2 = b.y() * a.z() * Z1Z1; 198| 735| const auto H = U2 - U1; 199| 735| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 735] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 735| const auto HH = H.square(); 216| 735| const auto HHH = H * HH; 217| 735| const auto V = U1 * HH; 218| 735| const auto t2 = r.square(); 219| 735| const auto t3 = V + V; 220| 735| const auto t4 = t2 - HHH; 221| 735| auto X3 = t4 - t3; 222| 735| const auto t5 = V - X3; 223| 735| const auto t6 = S1 * HHH; 224| 735| const auto t7 = r * t5; 225| 735| auto Y3 = t7 - t6; 226| 735| const auto t8 = b.z() * H; 227| 735| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 735| return ProjectivePoint(X3, Y3, Z3); 236| 735|} pcurves_secp256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.56k, False: 1] ------------------ 118| 1.56k| any_identity = any_identity || pt.is_identity(); 119| 1.56k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.56k, False: 1] ------------------ 147| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.56k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.56k, False: 1] ------------------ 159| 1.56k| const auto& p = projective[i]; 160| | 161| 1.56k| const auto z_inv = s_inv * c[i - 1]; 162| 1.56k| const auto z2_inv = z_inv.square(); 163| 1.56k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.56k| s_inv = s_inv * p.z(); 166| | 167| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.56k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp256r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_19secp256r15CurveEEEDaRKNT_15ProjectivePointE: 77| 173|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| 173| if constexpr(curve_supports_fe_invert2) { 82| 173| const auto z2_inv = C::fe_invert2(pt.z()); 83| 173| const auto z3_inv = z2_inv.square() * pt.z(); 84| 173| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| | } else { 86| | const auto z_inv = invert_field_element(pt.z()); 87| | const auto z2_inv = z_inv.square(); 88| | const auto z3_inv = z_inv * z2_inv; 89| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| | } 91| 173|} pcurves_secp256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp256r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_SQ_: 318| 7.26k| const FieldElement& curve_a) { 319| 7.26k| const auto a_is_identity = a.is_identity(); 320| 7.26k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 7.26k| auto by = b.y(); 329| 7.26k| by.conditional_assign(sub, by.negate()); 330| | 331| 7.26k| const auto Z1Z1 = a.z().square(); 332| 7.26k| const auto U2 = b.x() * Z1Z1; 333| 7.26k| const auto S2 = by * a.z() * Z1Z1; 334| 7.26k| const auto H = U2 - a.x(); 335| 7.26k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 7.26k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 7.26k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 7.26k| const auto HH = H.square(); 352| 7.26k| const auto HHH = H * HH; 353| 7.26k| const auto V = a.x() * HH; 354| 7.26k| const auto t2 = r.square(); 355| 7.26k| const auto t3 = V + V; 356| 7.26k| const auto t4 = t2 - HHH; 357| 7.26k| auto X3 = t4 - t3; 358| 7.26k| const auto t5 = V - X3; 359| 7.26k| const auto t6 = a.y() * HHH; 360| 7.26k| const auto t7 = r * t5; 361| 7.26k| auto Y3 = t7 - t6; 362| 7.26k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 7.26k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 7.26k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 7.26k| return ProjectivePoint(X3, Y3, Z3); 371| 7.26k|} pcurves_secp384r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 1.24k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 1.24k| const auto z2 = pt.z().square(); 390| 1.24k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 1.24k| const auto y2 = pt.y().square(); 394| 1.24k| const auto s = pt.x().mul4() * y2; 395| 1.24k| const auto nx = m.square() - s.mul2(); 396| 1.24k| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 1.24k| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 1.24k| return ProjectivePoint(nx, ny, nz); 400| 1.24k|} pcurves_secp384r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.09k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.09k| const auto a_is_identity = a.is_identity(); 190| 1.09k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.09k| const auto Z1Z1 = a.z().square(); 193| 1.09k| const auto Z2Z2 = b.z().square(); 194| 1.09k| const auto U1 = a.x() * Z2Z2; 195| 1.09k| const auto U2 = b.x() * Z1Z1; 196| 1.09k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.09k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.09k| const auto H = U2 - U1; 199| 1.09k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.09k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.09k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.09k| const auto HH = H.square(); 216| 1.09k| const auto HHH = H * HH; 217| 1.09k| const auto V = U1 * HH; 218| 1.09k| const auto t2 = r.square(); 219| 1.09k| const auto t3 = V + V; 220| 1.09k| const auto t4 = t2 - HHH; 221| 1.09k| auto X3 = t4 - t3; 222| 1.09k| const auto t5 = V - X3; 223| 1.09k| const auto t6 = S1 * HHH; 224| 1.09k| const auto t7 = r * t5; 225| 1.09k| auto Y3 = t7 - t6; 226| 1.09k| const auto t8 = b.z() * H; 227| 1.09k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.09k| return ProjectivePoint(X3, Y3, Z3); 236| 1.09k|} pcurves_secp384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 2.33k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 2.33k, False: 1] ------------------ 118| 2.33k| any_identity = any_identity || pt.is_identity(); 119| 2.33k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 2.33k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 2.33k, False: 1] ------------------ 147| 2.33k| c.push_back(c[i - 1] * projective[i].z()); 148| 2.33k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 2.33k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 2.33k, False: 1] ------------------ 159| 2.33k| const auto& p = projective[i]; 160| | 161| 2.33k| const auto z_inv = s_inv * c[i - 1]; 162| 2.33k| const auto z2_inv = z_inv.square(); 163| 2.33k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 2.33k| s_inv = s_inv * p.z(); 166| | 167| 2.33k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 2.33k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp384r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_19secp384r15CurveEEEDaRKNT_15ProjectivePointE: 77| 193|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| 193| if constexpr(curve_supports_fe_invert2) { 82| 193| const auto z2_inv = C::fe_invert2(pt.z()); 83| 193| const auto z3_inv = z2_inv.square() * pt.z(); 84| 193| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| | } else { 86| | const auto z_inv = invert_field_element(pt.z()); 87| | const auto z2_inv = z_inv.square(); 88| | const auto z3_inv = z_inv * z2_inv; 89| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| | } 91| 193|} pcurves_secp384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp384r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_SQ_: 318| 12.3k| const FieldElement& curve_a) { 319| 12.3k| const auto a_is_identity = a.is_identity(); 320| 12.3k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 12.3k| auto by = b.y(); 329| 12.3k| by.conditional_assign(sub, by.negate()); 330| | 331| 12.3k| const auto Z1Z1 = a.z().square(); 332| 12.3k| const auto U2 = b.x() * Z1Z1; 333| 12.3k| const auto S2 = by * a.z() * Z1Z1; 334| 12.3k| const auto H = U2 - a.x(); 335| 12.3k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 12.3k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 12.3k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 12.3k| const auto HH = H.square(); 352| 12.3k| const auto HHH = H * HH; 353| 12.3k| const auto V = a.x() * HH; 354| 12.3k| const auto t2 = r.square(); 355| 12.3k| const auto t3 = V + V; 356| 12.3k| const auto t4 = t2 - HHH; 357| 12.3k| auto X3 = t4 - t3; 358| 12.3k| const auto t5 = V - X3; 359| 12.3k| const auto t6 = a.y() * HHH; 360| 12.3k| const auto t7 = r * t5; 361| 12.3k| auto Y3 = t7 - t6; 362| 12.3k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 12.3k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 12.3k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 12.3k| return ProjectivePoint(X3, Y3, Z3); 371| 12.3k|} pcurves_secp521r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 1.64k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 1.64k| const auto z2 = pt.z().square(); 390| 1.64k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 1.64k| const auto y2 = pt.y().square(); 394| 1.64k| const auto s = pt.x().mul4() * y2; 395| 1.64k| const auto nx = m.square() - s.mul2(); 396| 1.64k| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 1.64k| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 1.64k| return ProjectivePoint(nx, ny, nz); 400| 1.64k|} pcurves_secp521r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.45k| const auto a_is_identity = a.is_identity(); 190| 1.45k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.45k| const auto Z1Z1 = a.z().square(); 193| 1.45k| const auto Z2Z2 = b.z().square(); 194| 1.45k| const auto U1 = a.x() * Z2Z2; 195| 1.45k| const auto U2 = b.x() * Z1Z1; 196| 1.45k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.45k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.45k| const auto H = U2 - U1; 199| 1.45k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.45k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.45k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.45k| const auto HH = H.square(); 216| 1.45k| const auto HHH = H * HH; 217| 1.45k| const auto V = U1 * HH; 218| 1.45k| const auto t2 = r.square(); 219| 1.45k| const auto t3 = V + V; 220| 1.45k| const auto t4 = t2 - HHH; 221| 1.45k| auto X3 = t4 - t3; 222| 1.45k| const auto t5 = V - X3; 223| 1.45k| const auto t6 = S1 * HHH; 224| 1.45k| const auto t7 = r * t5; 225| 1.45k| auto Y3 = t7 - t6; 226| 1.45k| const auto t8 = b.z() * H; 227| 1.45k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.45k| return ProjectivePoint(X3, Y3, Z3); 236| 1.45k|} pcurves_secp521r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 3.10k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 3.10k, False: 1] ------------------ 118| 3.10k| any_identity = any_identity || pt.is_identity(); 119| 3.10k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 3.10k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 3.10k, False: 1] ------------------ 147| 3.10k| c.push_back(c[i - 1] * projective[i].z()); 148| 3.10k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 3.10k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 3.10k, False: 1] ------------------ 159| 3.10k| const auto& p = projective[i]; 160| | 161| 3.10k| const auto z_inv = s_inv * c[i - 1]; 162| 3.10k| const auto z2_inv = z_inv.square(); 163| 3.10k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 3.10k| s_inv = s_inv * p.z(); 166| | 167| 3.10k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 3.10k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp521r1.cpp:_ZN5Botan9to_affineINS_6PCurve12_GLOBAL__N_19secp521r15CurveEEEDaRKNT_15ProjectivePointE: 77| 250|inline constexpr auto to_affine(const typename C::ProjectivePoint& pt) { 78| | // Not strictly required right? - default should work as long 79| | // as (0,0) is identity and invert returns 0 on 0 80| | 81| 250| if constexpr(curve_supports_fe_invert2) { 82| 250| const auto z2_inv = C::fe_invert2(pt.z()); 83| 250| const auto z3_inv = z2_inv.square() * pt.z(); 84| 250| return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 85| | } else { 86| | const auto z_inv = invert_field_element(pt.z()); 87| | const auto z2_inv = z_inv.square(); 88| | const auto z3_inv = z_inv * z2_inv; 89| | return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv); 90| | } 91| 250|} pcurves_secp521r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp521r1.cpp:_ZN5Botan22point_add_or_sub_mixedINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EENS_16AffineCurvePointISC_EESC_EET_RKSG_RKT0_NS_2CT6ChoiceERKT1_SQ_: 318| 21.5k| const FieldElement& curve_a) { 319| 21.5k| const auto a_is_identity = a.is_identity(); 320| 21.5k| const auto b_is_identity = b.is_identity(); 321| | 322| | /* 323| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 324| | 325| | Cost: 8M + 3S + 6add + 1*2 326| | */ 327| | 328| 21.5k| auto by = b.y(); 329| 21.5k| by.conditional_assign(sub, by.negate()); 330| | 331| 21.5k| const auto Z1Z1 = a.z().square(); 332| 21.5k| const auto U2 = b.x() * Z1Z1; 333| 21.5k| const auto S2 = by * a.z() * Z1Z1; 334| 21.5k| const auto H = U2 - a.x(); 335| 21.5k| const auto r = S2 - a.y(); 336| | 337| | /* Risky conditional 338| | * 339| | * This implementation uses projective coordinates, which do not have an efficient complete 340| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 341| | * 342| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 343| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 344| | * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output 345| | * (the identity element) 346| | */ 347| 21.5k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (347:7): [True: 0, False: 21.5k] ------------------ 348| 0| return a.dbl_iso(curve_a); 349| 0| } 350| | 351| 21.5k| const auto HH = H.square(); 352| 21.5k| const auto HHH = H * HH; 353| 21.5k| const auto V = a.x() * HH; 354| 21.5k| const auto t2 = r.square(); 355| 21.5k| const auto t3 = V + V; 356| 21.5k| const auto t4 = t2 - HHH; 357| 21.5k| auto X3 = t4 - t3; 358| 21.5k| const auto t5 = V - X3; 359| 21.5k| const auto t6 = a.y() * HHH; 360| 21.5k| const auto t7 = r * t5; 361| 21.5k| auto Y3 = t7 - t6; 362| 21.5k| auto Z3 = a.z() * H; 363| | 364| | // if a is identity then return b 365| 21.5k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one); 366| | 367| | // if b is identity then return a 368| 21.5k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 369| | 370| 21.5k| return ProjectivePoint(X3, Y3, Z3); 371| 21.5k|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve7_paramsEv: 119| 52.5M| const GenericCurveParams& _params() const { return *m_params; } pcurves_brainpool256r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 176| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 176| const auto x = pt.x(); 1038| 176| auto y = pt.y(); 1039| 176| auto z = FieldElement::one(); 1040| | 1041| 176| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 176| return ProjectiveCurvePoint(x, y, z); 1044| 176| } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE1xEv: 982| 264k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE1yEv: 987| 256k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE3oneEv: 202| 7.87k| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE3oneEv: 101| 7.87k| constexpr static std::array one() { return R1; } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 215k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 176| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 176| const W mask = cond.into_bitmask(); 414| | 415| 880| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 704, False: 176] ------------------ 416| 704| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 704| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 704| x.m_val[i] = nx; 419| 704| y.m_val[i] = ny; 420| 704| } 421| 176| } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 939| 8.05k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 227| 42.6k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 9.44k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1181| 833| constexpr Self dbl() const { 1182| | if constexpr(Self::A_is_minus_3) { 1183| | return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| 833| } else { 1187| 833| return dbl_generic(*this, A); 1188| 833| } 1189| 833| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1224| 51.1k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6squareEv: 428| 33.3k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 33.3k| std::array z; // NOLINT(*-member-init) 430| 33.3k| comba_sqr(z.data(), this->data()); 431| 33.3k| return Self(Rep::redc(z)); 432| 33.3k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4dataEv: 898| 271k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 170k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 170k| } else { 110| 170k| return monty_redc(z, P, P_dash); 111| 170k| } 112| 170k| } pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 267| 10.2k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 10.2k| std::array t; // NOLINT(*-member-init) 269| | 270| 10.2k| W carry = 0; 271| 51.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 41.1k, False: 10.2k] ------------------ 272| 41.1k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 41.1k| } 274| | 275| 10.2k| std::array r; // NOLINT(*-member-init) 276| 10.2k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 10.2k| return Self(r); 278| 10.2k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1214| 28.9k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 337| 833| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 348| 82.2k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 82.2k| std::array z; // NOLINT(*-member-init) 350| 82.2k| comba_mul(z.data(), a.data(), b.data()); 351| 82.2k| return Self(Rep::redc(z)); 352| 82.2k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1219| 28.9k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 340| 833| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 283| 51.0k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 51.0k| std::array r; // NOLINT(*-member-init) 285| 51.0k| W carry = 0; 286| 255k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 204k, False: 51.0k] ------------------ 287| 204k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 204k| } 289| | 290| 51.0k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 51.0k| carry = 0; 293| | 294| 255k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 204k, False: 51.0k] ------------------ 295| 204k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 204k| } 297| | 298| 51.0k| return Self(r); 299| 51.0k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 327| 6.66k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 6.66k| std::array t = value(); 329| 6.66k| const W carry = shift_left<1>(t); 330| | 331| 6.66k| std::array r; // NOLINT(*-member-init) 332| 6.66k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 6.66k| return Self(r); 334| 6.66k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE5valueEv: 896| 6.66k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 343| 833| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1075| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 10.3k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 16.3k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 16.3k| const W mask = cond.into_bitmask(); 399| | 400| 81.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 65.3k, False: 16.3k] ------------------ 401| 65.3k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 65.3k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 65.3k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 65.3k| } 405| 16.3k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6invertEv: 540| 175| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm4EEE: 479| 175| constexpr Self pow_vartime(const std::array& exp) const { 480| 175| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [True: 0, Folded] ------------------ 481| 175| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 175| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 175| std::array tbl; 492| | 493| 175| tbl[0] = (*this); 494| | 495| 2.62k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 2.45k, False: 175] ------------------ 496| | // Conditional ok: table indexes are public here 497| 2.45k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 1.22k, False: 1.22k] ------------------ 498| 1.22k| tbl[i] = tbl[i / 2].square(); 499| 1.22k| } else { 500| 1.22k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 1.22k| } 502| 2.45k| } 503| | 504| 175| auto r = Self::one(); 505| | 506| 175| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 175| if(w0 > 0) { ------------------ | Branch (509:13): [True: 175, False: 0] ------------------ 510| 175| r = tbl[w0 - 1]; 511| 175| } 512| | 513| 11.2k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 11.0k, False: 175] ------------------ 514| 11.0k| r.square_n(WindowBits); 515| | 516| 11.0k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 11.0k| if(w > 0) { ------------------ | Branch (519:16): [True: 10.3k, False: 700] ------------------ 520| 10.3k| r *= tbl[w - 1]; 521| 10.3k| } 522| 11.0k| } 523| | 524| 175| return r; 525| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEC2Ev: 182| 3.32k| constexpr IntMod() : m_val({}) {} pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE8square_nEm: 441| 11.0k| constexpr void square_n(size_t n) { 442| 11.0k| std::array z; // NOLINT(*-member-init) 443| 55.1k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 44.1k, False: 11.0k] ------------------ 444| 44.1k| comba_sqr(z.data(), this->data()); 445| 44.1k| m_val = Rep::redc(z); 446| 44.1k| } 447| 11.0k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEmLERKSA_: 357| 10.3k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 10.3k| std::array z; // NOLINT(*-member-init) 359| 10.3k| comba_mul(z.data(), data(), other.data()); 360| 10.3k| m_val = Rep::redc(z); 361| 10.3k| return (*this); 362| 10.3k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 177| for(;;) { 620| | // Conditional ok: this function is variable time 621| 177| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 176] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 176| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 176| std::array r; // NOLINT(*-member-init) 642| 176| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 176| if(carry == 0) { ------------------ | Branch (645:16): [True: 94, False: 82] ------------------ 646| | // b > a 647| 94| b.m_val = r; 648| 94| x = nx; 649| 94| Self::_invert_vartime_div2_helper(b, x); 650| 94| } else { 651| | // We know this can't underflow because a > b 652| 82| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 82| a.m_val = r; 654| 82| y = nx; 655| 82| Self::_invert_vartime_div2_helper(a, y); 656| 82| } 657| 176| } 658| 1| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4zeroEv: 197| 15.0k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 351| constexpr static std::array from_rep(const std::array& z) { 140| 351| std::array ze = {}; 141| 351| copy_mem(std::span{ze}.template first(), z); 142| 351| return Self::redc(ze); 143| 351| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 178| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 178| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 553| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 375, False: 178] ------------------ 554| 375| shift_right<1>(a.m_val); 555| | 556| 375| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 375| if(borrow) { ------------------ | Branch (559:16): [True: 193, False: 182] ------------------ 560| 193| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 193| } 562| 375| } 563| 178| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6negateEv: 454| 7.52k| constexpr Self negate() const { 455| 7.52k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 7.52k| std::array r; // NOLINT(*-member-init) 458| 7.52k| W carry = 0; 459| 37.6k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 30.1k, False: 7.52k] ------------------ 460| 30.1k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 30.1k| } 462| | 463| 7.52k| return Self(r); 464| 7.52k| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 1| constexpr static std::array to_rep(const std::array& x) { 118| 1| std::array z; // NOLINT(*-member-init) 119| 1| comba_mul(z.data(), x.data(), R2.data()); 120| 1| return Self::redc(z); 121| 1| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 9.61k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 875| std::array stash_value() const { 762| 875| static_assert(L >= N); 763| 875| std::array stash = {}; 764| 4.37k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 3.50k, False: 875] ------------------ 765| 3.50k| stash[i] = m_val[i]; 766| 3.50k| } 767| 875| return stash; 768| 875| } pcurves_brainpool256r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1632| 175| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1633| 175| const BlindingRandomness blinding(rng); 1634| 175| const BlindedScalar scalar(s, blinding); 1635| 175| return basemul_booth_exec(m_table, scalar, blinding); 1636| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EEELm1EEC2ERNS_21RandomNumberGeneratorE: 1455| 175| explicit BlindingRandomness(RandomNumberGenerator& rng) : m_seeded(rng.is_seeded()) { 1456| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1457| 175| if(m_seeded) { ------------------ | Branch (1457:13): [True: 0, False: 175] ------------------ 1458| 0| std::array buf{}; 1459| 0| rng.randomize(buf); 1460| | 1461| 0| const std::span bytes(buf); 1462| | 1463| 0| copy_mem(m_masks, bytes.first()); 1464| | 1465| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1465:31): [True: 0, False: 0] ------------------ 1466| 0| const auto wide = bytes.subspan(Scalars * MaskBytes + i * WideBytes).first(); 1467| 0| m_rerandomizers[i] = FieldElement::from_wide_bytes(wide); 1468| 0| } 1469| | 1470| 0| const auto iso = bytes.subspan(Scalars * MaskBytes + Rerandomizations * WideBytes).first(); 1471| 0| m_isomorphism = FieldElement::from_wide_bytes(iso); 1472| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), FieldElement::one()); 1473| 0| } 1474| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 369| 7.35k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 370| 7.35k| const W mask = cond.into_bitmask(); 371| | 372| 36.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (372:28): [True: 29.4k, False: 7.35k] ------------------ 373| 29.4k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 374| 29.4k| } 375| 7.35k| } pcurves_brainpool256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EEC2INS_18BlindingRandomnessIS5_Lm1EEEEERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsESA_E12ScalarParamsEEEEERKT_m: 1368| 175| BlindedScalarBits(const typename C::Scalar& scalar, const Randomness& randomness, size_t idx = 0) { 1369| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1370| 175| if(BlindingBits > 0 && randomness.seeded()) { ------------------ | Branch (1370:13): [True: 175, Folded] | Branch (1370:33): [True: 0, False: 175] ------------------ 1371| 0| constexpr size_t n_words = C::Words; 1372| | 1373| 0| W mask[n_words] = {0}; 1374| 0| load_le(mask, randomness.mask(idx).data(), MaskWords); 1375| | 1376| | // Mask to exactly BlindingBits 1377| 0| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1378| 0| if constexpr(ExcessBits > 0) { 1379| 0| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1380| 0| mask[MaskWords - 1] &= ExcessMask; 1381| 0| } 1382| | 1383| | // Set top and bottom bits of mask 1384| 0| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1385| 0| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1386| 0| mask[0] |= 1; 1387| | 1388| 0| W mask_n[2 * n_words] = {0}; 1389| | 1390| 0| const auto sw = scalar.to_words(); 1391| | 1392| | // Compute masked scalar s + k*n 1393| 0| comba_mul(mask_n, mask, C::NW.data()); 1394| 0| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1395| | 1396| 0| std::reverse(mask_n, mask_n + 2 * n_words); 1397| 0| m_bytes = store_be>(mask_n); 1398| 0| m_bits = C::Scalar::BITS + BlindingBits; 1399| 175| } else { 1400| | // No RNG available, skip blinding 1401| 175| m_bytes.resize(C::Scalar::BYTES); 1402| 175| scalar.serialize_to(std::span{m_bytes}.template first()); 1403| 175| m_bits = C::Scalar::BITS; 1404| 175| } 1405| | 1406| 175| CT::poison(m_bytes.data(), m_bytes.size()); 1407| 175| } pcurves_brainpool256r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EEELm1EE6seededEv: 1476| 175| bool seeded() const { return m_seeded; } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 350| constexpr static std::array from_rep(const std::array& z) { 140| 350| std::array ze = {}; 141| 350| copy_mem(std::span{ze}.template first(), z); 142| 350| return Self::redc(ze); 143| 350| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 526| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 526| } else { 110| 526| return monty_redc(z, P, P_dash); 111| 526| } 112| 526| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 350| constexpr void serialize_to(std::span bytes) const { 742| 350| auto v = Rep::from_rep(m_val); 743| 350| std::reverse(v.begin(), v.end()); 744| | 745| 350| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 350| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 350| } pcurves_brainpool256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EE4bitsEv: 1362| 175| size_t bits() const { return m_bits; } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1095| 175| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1096| 175| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1097| 175| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E6negateEv: 1194| 175| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1226| 175| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18_const_time_poisonEv: 891| 525| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_brainpool256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EE10get_windowEm: 1409| 7.52k| size_t get_window(size_t offset) const { 1410| | // Extract a WindowBits sized window out of s, depending on offset. 1411| 7.52k| return read_window_bits(std::span{m_bytes}, offset); 1412| 7.52k| } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1121| 7.35k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1122| 7.35k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one(), A); 1123| 7.35k| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 966| 7.52k| static constexpr auto ct_select(std::span pts, size_t idx) { 967| 7.52k| auto result = Self::identity(pts[0]); 968| | 969| | // Intentionally wrapping; set to maximum size_t if idx == 0 970| 7.52k| const size_t idx1 = idx - 1; 971| 248k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (971:28): [True: 240k, False: 7.52k] ------------------ 972| 240k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 973| 240k| result.conditional_assign(found, pts[i]); 974| 240k| } 975| | 976| 7.52k| return result; 977| 7.52k| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE8identityERKSC_: 935| 7.52k| static constexpr Self identity(const Self& /*unused*/) { 936| 7.52k| return Self(FieldElement::zero(), FieldElement::zero()); 937| 7.52k| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 992| 240k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 993| 240k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 994| 240k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 382| 240k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 383| 240k| const W mask = cond.into_bitmask(); 384| | 385| 1.20M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (385:28): [True: 963k, False: 240k] ------------------ 386| 963k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 387| 963k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 388| 963k| } 389| 240k| } pcurves_brainpool256r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EEELm1EE13randomize_repERNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS4_6ParamsESA_E11FieldParamsEEEEESC_EEm: 1486| 700| void randomize_rep(typename C::ProjectivePoint& pt, size_t idx) const { 1487| 700| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 700| do { \ | | 85| 700| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 700| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 700] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 700| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 700] | | ------------------ ------------------ 1488| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1489| 700| if(m_seeded) { ------------------ | Branch (1489:13): [True: 0, False: 700] ------------------ 1490| 0| pt.randomize_rep(m_rerandomizers[idx]); 1491| 0| } 1492| 700| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1228| 175| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE20_const_time_unpoisonEv: 893| 525| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_brainpool256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm7EED2Ev: 1414| 175| ~BlindedScalarBits() { 1415| 175| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1416| 175| CT::unpoison(m_bytes.data(), m_bytes.size()); 1417| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 525| static Self from_stash(const std::array& stash) { 777| 525| static_assert(L >= N); 778| 525| std::array val = {}; 779| 2.62k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 2.10k, False: 525] ------------------ 780| 2.10k| val[i] = stash[i]; 781| 2.10k| } 782| 525| return Self(val); 783| 525| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 701| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 350| constexpr void serialize_to(std::span bytes) const { 742| 350| auto v = Rep::from_rep(m_val); 743| 350| std::reverse(v.begin(), v.end()); 744| | 745| 350| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 350| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 350| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 175| std::array stash_value() const { 762| 175| static_assert(L >= N); 763| 175| std::array stash = {}; 764| 875| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 700, False: 175] ------------------ 765| 700| stash[i] = m_val[i]; 766| 700| } 767| 175| return stash; 768| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 1.22k| static Self from_stash(const std::array& stash) { 777| 1.22k| static_assert(L >= N); 778| 1.22k| std::array val = {}; 779| 6.12k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 4.90k, False: 1.22k] ------------------ 780| 4.90k| val[i] = stash[i]; 781| 4.90k| } 782| 1.22k| return Self(val); 783| 1.22k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 227| 351| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEeqERKSA_: 724| 175| constexpr CT::Choice operator==(const Self& other) const { 725| 175| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsENS_13MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1327| 175| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 176| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 176| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 176] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 176| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 176| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 176] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 176| return Self::from_words(words); 809| 176| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE: 213| 176| static constexpr Self from_words(std::array w) { 214| 176| if constexpr(L == N) { 215| 176| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 176| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 176| constexpr static std::array to_rep(const std::array& x) { 118| 176| std::array z; // NOLINT(*-member-init) 119| 176| comba_mul(z.data(), x.data(), R2.data()); 120| 176| return Self::redc(z); 121| 176| } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm65EEE: 952| 175| constexpr void serialize_to(std::span bytes) const { 953| 175| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 175| do { \ | | 52| 175| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 175| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 175] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 175| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 175] | | ------------------ ------------------ 954| 175| BufferStuffer pack(bytes); 955| 175| pack.append(0x04); 956| 175| x().serialize_to(pack.next()); 957| 175| y().serialize_to(pack.next()); 958| 175| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 175| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 175| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 175] | | ------------------ ------------------ 959| 175| } pcurves_brainpool384r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 151| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 151| const auto x = pt.x(); 1038| 151| auto y = pt.y(); 1039| 151| auto z = FieldElement::one(); 1040| | 1041| 151| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 151| return ProjectiveCurvePoint(x, y, z); 1044| 151| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE1xEv: 982| 342k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE1yEv: 987| 332k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE3oneEv: 202| 10.0k| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE3oneEv: 101| 10.0k| constexpr static std::array one() { return R1; } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm6EEE: 908| 289k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 151| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 151| const W mask = cond.into_bitmask(); 414| | 415| 1.05k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 906, False: 151] ------------------ 416| 906| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 906| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 906| x.m_val[i] = nx; 419| 906| y.m_val[i] = ny; 420| 906| } 421| 151| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 939| 10.2k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 227| 55.9k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 12.3k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.24k| constexpr Self dbl() const { 1182| | if constexpr(Self::A_is_minus_3) { 1183| | return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| 1.24k| } else { 1187| 1.24k| return dbl_generic(*this, A); 1188| 1.24k| } 1189| 1.24k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1224| 69.0k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6squareEv: 428| 45.6k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 45.6k| std::array z; // NOLINT(*-member-init) 430| 45.6k| comba_sqr(z.data(), this->data()); 431| 45.6k| return Self(Rep::redc(z)); 432| 45.6k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4dataEv: 898| 358k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm12EEE: 106| 225k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 225k| } else { 110| 225k| return monty_redc(z, P, P_dash); 111| 225k| } 112| 225k| } pcurves_brainpool384r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 267| 13.7k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 13.7k| std::array t; // NOLINT(*-member-init) 269| | 270| 13.7k| W carry = 0; 271| 96.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 82.4k, False: 13.7k] ------------------ 272| 82.4k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 82.4k| } 274| | 275| 13.7k| std::array r; // NOLINT(*-member-init) 276| 13.7k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 13.7k| return Self(r); 278| 13.7k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1214| 38.5k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 337| 1.24k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 348| 111k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 111k| std::array z; // NOLINT(*-member-init) 350| 111k| comba_mul(z.data(), a.data(), b.data()); 351| 111k| return Self(Rep::redc(z)); 352| 111k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1219| 38.5k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 340| 1.24k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 283| 67.8k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 67.8k| std::array r; // NOLINT(*-member-init) 285| 67.8k| W carry = 0; 286| 475k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 407k, False: 67.8k] ------------------ 287| 407k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 407k| } 289| | 290| 67.8k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 67.8k| carry = 0; 293| | 294| 475k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 407k, False: 67.8k] ------------------ 295| 407k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 407k| } 297| | 298| 67.8k| return Self(r); 299| 67.8k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 327| 9.92k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 9.92k| std::array t = value(); 329| 9.92k| const W carry = shift_left<1>(t); 330| | 331| 9.92k| std::array r; // NOLINT(*-member-init) 332| 9.92k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 9.92k| return Self(r); 334| 9.92k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE5valueEv: 896| 9.92k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 343| 1.24k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1075| 1.09k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.09k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 14.1k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 21.5k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 21.5k| const W mask = cond.into_bitmask(); 399| | 400| 150k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 129k, False: 21.5k] ------------------ 401| 129k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 129k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 129k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 129k| } 405| 21.5k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6invertEv: 540| 150| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm6EEE: 479| 150| constexpr Self pow_vartime(const std::array& exp) const { 480| 150| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [Folded, False: 150] ------------------ 481| 150| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 150| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 150| std::array tbl; 492| | 493| 150| tbl[0] = (*this); 494| | 495| 4.65k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 4.50k, False: 150] ------------------ 496| | // Conditional ok: table indexes are public here 497| 4.50k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 2.25k, False: 2.25k] ------------------ 498| 2.25k| tbl[i] = tbl[i / 2].square(); 499| 2.25k| } else { 500| 2.25k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 2.25k| } 502| 4.50k| } 503| | 504| 150| auto r = Self::one(); 505| | 506| 150| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 150| if(w0 > 0) { ------------------ | Branch (509:13): [True: 150, False: 0] ------------------ 510| 150| r = tbl[w0 - 1]; 511| 150| } 512| | 513| 11.5k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 11.4k, False: 150] ------------------ 514| 11.4k| r.square_n(WindowBits); 515| | 516| 11.4k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 11.4k| if(w > 0) { ------------------ | Branch (519:16): [True: 10.9k, False: 450] ------------------ 520| 10.9k| r *= tbl[w - 1]; 521| 10.9k| } 522| 11.4k| } 523| | 524| 150| return r; 525| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEC2Ev: 182| 5.25k| constexpr IntMod() : m_val({}) {} pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE8square_nEm: 441| 11.4k| constexpr void square_n(size_t n) { 442| 11.4k| std::array z; // NOLINT(*-member-init) 443| 68.4k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 57.0k, False: 11.4k] ------------------ 444| 57.0k| comba_sqr(z.data(), this->data()); 445| 57.0k| m_val = Rep::redc(z); 446| 57.0k| } 447| 11.4k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEmLERKSA_: 357| 10.9k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 10.9k| std::array z; // NOLINT(*-member-init) 359| 10.9k| comba_mul(z.data(), data(), other.data()); 360| 10.9k| m_val = Rep::redc(z); 361| 10.9k| return (*this); 362| 10.9k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 262| for(;;) { 620| | // Conditional ok: this function is variable time 621| 262| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 261] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 261| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 261| std::array r; // NOLINT(*-member-init) 642| 261| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 261| if(carry == 0) { ------------------ | Branch (645:16): [True: 128, False: 133] ------------------ 646| | // b > a 647| 128| b.m_val = r; 648| 128| x = nx; 649| 128| Self::_invert_vartime_div2_helper(b, x); 650| 133| } else { 651| | // We know this can't underflow because a > b 652| 133| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 133| a.m_val = r; 654| 133| y = nx; 655| 133| Self::_invert_vartime_div2_helper(a, y); 656| 133| } 657| 261| } 658| 1| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4zeroEv: 197| 19.5k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm6EEE: 139| 301| constexpr static std::array from_rep(const std::array& z) { 140| 301| std::array ze = {}; 141| 301| copy_mem(std::span{ze}.template first(), z); 142| 301| return Self::redc(ze); 143| 301| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 263| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 263| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 814| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 551, False: 263] ------------------ 554| 551| shift_right<1>(a.m_val); 555| | 556| 551| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 551| if(borrow) { ------------------ | Branch (559:16): [True: 291, False: 260] ------------------ 560| 291| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 291| } 562| 551| } 563| 263| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6negateEv: 454| 9.75k| constexpr Self negate() const { 455| 9.75k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 9.75k| std::array r; // NOLINT(*-member-init) 458| 9.75k| W carry = 0; 459| 68.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 58.5k, False: 9.75k] ------------------ 460| 58.5k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 58.5k| } 462| | 463| 9.75k| return Self(r); 464| 9.75k| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm6EEE: 117| 1| constexpr static std::array to_rep(const std::array& x) { 118| 1| std::array z; // NOLINT(*-member-init) 119| 1| comba_mul(z.data(), x.data(), R2.data()); 120| 1| return Self::redc(z); 121| 1| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 12.5k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 750| std::array stash_value() const { 762| 750| static_assert(L >= N); 763| 750| std::array stash = {}; 764| 5.25k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 4.50k, False: 750] ------------------ 765| 4.50k| stash[i] = m_val[i]; 766| 4.50k| } 767| 750| return stash; 768| 750| } pcurves_brainpool384r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1632| 150| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1633| 150| const BlindingRandomness blinding(rng); 1634| 150| const BlindedScalar scalar(s, blinding); 1635| 150| return basemul_booth_exec(m_table, scalar, blinding); 1636| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EEELm1EEC2ERNS_21RandomNumberGeneratorE: 1455| 150| explicit BlindingRandomness(RandomNumberGenerator& rng) : m_seeded(rng.is_seeded()) { 1456| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1457| 150| if(m_seeded) { ------------------ | Branch (1457:13): [True: 0, False: 150] ------------------ 1458| 0| std::array buf{}; 1459| 0| rng.randomize(buf); 1460| | 1461| 0| const std::span bytes(buf); 1462| | 1463| 0| copy_mem(m_masks, bytes.first()); 1464| | 1465| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1465:31): [True: 0, False: 0] ------------------ 1466| 0| const auto wide = bytes.subspan(Scalars * MaskBytes + i * WideBytes).first(); 1467| 0| m_rerandomizers[i] = FieldElement::from_wide_bytes(wide); 1468| 0| } 1469| | 1470| 0| const auto iso = bytes.subspan(Scalars * MaskBytes + Rerandomizations * WideBytes).first(); 1471| 0| m_isomorphism = FieldElement::from_wide_bytes(iso); 1472| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), FieldElement::one()); 1473| 0| } 1474| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 369| 9.60k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 370| 9.60k| const W mask = cond.into_bitmask(); 371| | 372| 67.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (372:28): [True: 57.6k, False: 9.60k] ------------------ 373| 57.6k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 374| 57.6k| } 375| 9.60k| } pcurves_brainpool384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EEC2INS_18BlindingRandomnessIS5_Lm1EEEEERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsESA_E12ScalarParamsEEEEERKT_m: 1368| 150| BlindedScalarBits(const typename C::Scalar& scalar, const Randomness& randomness, size_t idx = 0) { 1369| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1370| 150| if(BlindingBits > 0 && randomness.seeded()) { ------------------ | Branch (1370:13): [True: 150, Folded] | Branch (1370:33): [True: 0, False: 150] ------------------ 1371| 0| constexpr size_t n_words = C::Words; 1372| | 1373| 0| W mask[n_words] = {0}; 1374| 0| load_le(mask, randomness.mask(idx).data(), MaskWords); 1375| | 1376| | // Mask to exactly BlindingBits 1377| 0| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1378| 0| if constexpr(ExcessBits > 0) { 1379| 0| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1380| 0| mask[MaskWords - 1] &= ExcessMask; 1381| 0| } 1382| | 1383| | // Set top and bottom bits of mask 1384| 0| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1385| 0| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1386| 0| mask[0] |= 1; 1387| | 1388| 0| W mask_n[2 * n_words] = {0}; 1389| | 1390| 0| const auto sw = scalar.to_words(); 1391| | 1392| | // Compute masked scalar s + k*n 1393| 0| comba_mul(mask_n, mask, C::NW.data()); 1394| 0| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1395| | 1396| 0| std::reverse(mask_n, mask_n + 2 * n_words); 1397| 0| m_bytes = store_be>(mask_n); 1398| 0| m_bits = C::Scalar::BITS + BlindingBits; 1399| 150| } else { 1400| | // No RNG available, skip blinding 1401| 150| m_bytes.resize(C::Scalar::BYTES); 1402| 150| scalar.serialize_to(std::span{m_bytes}.template first()); 1403| 150| m_bits = C::Scalar::BITS; 1404| 150| } 1405| | 1406| 150| CT::poison(m_bytes.data(), m_bytes.size()); 1407| 150| } pcurves_brainpool384r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EEELm1EE6seededEv: 1476| 150| bool seeded() const { return m_seeded; } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm6EEE: 139| 300| constexpr static std::array from_rep(const std::array& z) { 140| 300| std::array ze = {}; 141| 300| copy_mem(std::span{ze}.template first(), z); 142| 300| return Self::redc(ze); 143| 300| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm12EEE: 106| 451| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 451| } else { 110| 451| return monty_redc(z, P, P_dash); 111| 451| } 112| 451| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 741| 300| constexpr void serialize_to(std::span bytes) const { 742| 300| auto v = Rep::from_rep(m_val); 743| 300| std::reverse(v.begin(), v.end()); 744| | 745| 300| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 300| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 300| } pcurves_brainpool384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EE4bitsEv: 1362| 150| size_t bits() const { return m_bits; } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1095| 150| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1096| 150| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1097| 150| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E6negateEv: 1194| 150| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1226| 150| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18_const_time_poisonEv: 891| 450| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_brainpool384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EE10get_windowEm: 1409| 9.75k| size_t get_window(size_t offset) const { 1410| | // Extract a WindowBits sized window out of s, depending on offset. 1411| 9.75k| return read_window_bits(std::span{m_bytes}, offset); 1412| 9.75k| } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1121| 9.60k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1122| 9.60k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one(), A); 1123| 9.60k| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 966| 9.75k| static constexpr auto ct_select(std::span pts, size_t idx) { 967| 9.75k| auto result = Self::identity(pts[0]); 968| | 969| | // Intentionally wrapping; set to maximum size_t if idx == 0 970| 9.75k| const size_t idx1 = idx - 1; 971| 321k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (971:28): [True: 312k, False: 9.75k] ------------------ 972| 312k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 973| 312k| result.conditional_assign(found, pts[i]); 974| 312k| } 975| | 976| 9.75k| return result; 977| 9.75k| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE8identityERKSC_: 935| 9.75k| static constexpr Self identity(const Self& /*unused*/) { 936| 9.75k| return Self(FieldElement::zero(), FieldElement::zero()); 937| 9.75k| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 992| 312k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 993| 312k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 994| 312k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 382| 312k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 383| 312k| const W mask = cond.into_bitmask(); 384| | 385| 2.18M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (385:28): [True: 1.87M, False: 312k] ------------------ 386| 1.87M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 387| 1.87M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 388| 1.87M| } 389| 312k| } pcurves_brainpool384r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EEELm1EE13randomize_repERNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS4_6ParamsESA_E11FieldParamsEEEEESC_EEm: 1486| 600| void randomize_rep(typename C::ProjectivePoint& pt, size_t idx) const { 1487| 600| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 600| do { \ | | 85| 600| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 600| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 600] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 600| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 600] | | ------------------ ------------------ 1488| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1489| 600| if(m_seeded) { ------------------ | Branch (1489:13): [True: 0, False: 600] ------------------ 1490| 0| pt.randomize_rep(m_rerandomizers[idx]); 1491| 0| } 1492| 600| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1228| 150| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE20_const_time_unpoisonEv: 893| 450| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_brainpool384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm7EED2Ev: 1414| 150| ~BlindedScalarBits() { 1415| 150| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1416| 150| CT::unpoison(m_bytes.data(), m_bytes.size()); 1417| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 450| static Self from_stash(const std::array& stash) { 777| 450| static_assert(L >= N); 778| 450| std::array val = {}; 779| 3.15k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 2.70k, False: 450] ------------------ 780| 2.70k| val[i] = stash[i]; 781| 2.70k| } 782| 450| return Self(val); 783| 450| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm6EEE: 908| 601| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 741| 300| constexpr void serialize_to(std::span bytes) const { 742| 300| auto v = Rep::from_rep(m_val); 743| 300| std::reverse(v.begin(), v.end()); 744| | 745| 300| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 300| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 300| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 150| std::array stash_value() const { 762| 150| static_assert(L >= N); 763| 150| std::array stash = {}; 764| 1.05k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 900, False: 150] ------------------ 765| 900| stash[i] = m_val[i]; 766| 900| } 767| 150| return stash; 768| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 1.05k| static Self from_stash(const std::array& stash) { 777| 1.05k| static_assert(L >= N); 778| 1.05k| std::array val = {}; 779| 7.35k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 6.30k, False: 1.05k] ------------------ 780| 6.30k| val[i] = stash[i]; 781| 6.30k| } 782| 1.05k| return Self(val); 783| 1.05k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 227| 301| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEeqERKSA_: 724| 150| constexpr CT::Choice operator==(const Self& other) const { 725| 150| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsENS_13MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1327| 150| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 151| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 151| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 151] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 151| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 151| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 151] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 151| return Self::from_words(words); 809| 151| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm6EEESA_NSt3__15arrayImXT_EEE: 213| 151| static constexpr Self from_words(std::array w) { 214| 151| if constexpr(L == N) { 215| 151| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 151| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm6EEE: 117| 151| constexpr static std::array to_rep(const std::array& x) { 118| 151| std::array z; // NOLINT(*-member-init) 119| 151| comba_mul(z.data(), x.data(), R2.data()); 120| 151| return Self::redc(z); 121| 151| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm97EEE: 952| 150| constexpr void serialize_to(std::span bytes) const { 953| 150| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 150| do { \ | | 52| 150| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 150| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 150] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 150| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 150] | | ------------------ ------------------ 954| 150| BufferStuffer pack(bytes); 955| 150| pack.append(0x04); 956| 150| x().serialize_to(pack.next()); 957| 150| y().serialize_to(pack.next()); 958| 150| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 150| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 150| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 150] | | ------------------ ------------------ 959| 150| } pcurves_brainpool512r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 136| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 136| const auto x = pt.x(); 1038| 136| auto y = pt.y(); 1039| 136| auto z = FieldElement::one(); 1040| | 1041| 136| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 136| return ProjectiveCurvePoint(x, y, z); 1044| 136| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE1xEv: 982| 407k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE1yEv: 987| 395k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE3oneEv: 202| 11.8k| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE3oneEv: 101| 11.8k| constexpr static std::array one() { return R1; } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm8EEE: 908| 352k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 136| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 136| const W mask = cond.into_bitmask(); 414| | 415| 1.22k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 1.08k, False: 136] ------------------ 416| 1.08k| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 1.08k| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 1.08k| x.m_val[i] = nx; 419| 1.08k| y.m_val[i] = ny; 420| 1.08k| } 421| 136| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 939| 12.0k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 227| 67.3k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 14.9k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.64k| constexpr Self dbl() const { 1182| | if constexpr(Self::A_is_minus_3) { 1183| | return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| 1.64k| } else { 1187| 1.64k| return dbl_generic(*this, A); 1188| 1.64k| } 1189| 1.64k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1224| 85.0k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6squareEv: 428| 55.6k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 55.6k| std::array z; // NOLINT(*-member-init) 430| 55.6k| comba_sqr(z.data(), this->data()); 431| 55.6k| return Self(Rep::redc(z)); 432| 55.6k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4dataEv: 898| 438k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm16EEE: 106| 275k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 275k| } else { 110| 275k| return monty_redc(z, P, P_dash); 111| 275k| } 112| 275k| } pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 267| 16.8k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 16.8k| std::array t; // NOLINT(*-member-init) 269| | 270| 16.8k| W carry = 0; 271| 151k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 134k, False: 16.8k] ------------------ 272| 134k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 134k| } 274| | 275| 16.8k| std::array r; // NOLINT(*-member-init) 276| 16.8k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 16.8k| return Self(r); 278| 16.8k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1214| 47.1k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 337| 1.64k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool512r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 348| 137k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 137k| std::array z; // NOLINT(*-member-init) 350| 137k| comba_mul(z.data(), a.data(), b.data()); 351| 137k| return Self(Rep::redc(z)); 352| 137k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1219| 47.1k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 340| 1.64k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool512r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 283| 82.5k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 82.5k| std::array r; // NOLINT(*-member-init) 285| 82.5k| W carry = 0; 286| 742k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 660k, False: 82.5k] ------------------ 287| 660k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 660k| } 289| | 290| 82.5k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 82.5k| carry = 0; 293| | 294| 742k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 660k, False: 82.5k] ------------------ 295| 660k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 660k| } 297| | 298| 82.5k| return Self(r); 299| 82.5k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 327| 13.1k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 13.1k| std::array t = value(); 329| 13.1k| const W carry = shift_left<1>(t); 330| | 331| 13.1k| std::array r; // NOLINT(*-member-init) 332| 13.1k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 13.1k| return Self(r); 334| 13.1k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE5valueEv: 896| 13.1k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 343| 1.64k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1075| 1.45k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.45k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 17.4k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 25.9k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 25.9k| const W mask = cond.into_bitmask(); 399| | 400| 233k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 207k, False: 25.9k] ------------------ 401| 207k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 207k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 207k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 207k| } 405| 25.9k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6invertEv: 540| 135| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm8EEE: 479| 135| constexpr Self pow_vartime(const std::array& exp) const { 480| 135| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [Folded, False: 135] ------------------ 481| 135| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 135| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 135| std::array tbl; 492| | 493| 135| tbl[0] = (*this); 494| | 495| 4.18k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 4.05k, False: 135] ------------------ 496| | // Conditional ok: table indexes are public here 497| 4.05k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 2.02k, False: 2.02k] ------------------ 498| 2.02k| tbl[i] = tbl[i / 2].square(); 499| 2.02k| } else { 500| 2.02k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 2.02k| } 502| 4.05k| } 503| | 504| 135| auto r = Self::one(); 505| | 506| 135| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 135| if(w0 > 0) { ------------------ | Branch (509:13): [True: 135, False: 0] ------------------ 510| 135| r = tbl[w0 - 1]; 511| 135| } 512| | 513| 13.9k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 13.7k, False: 135] ------------------ 514| 13.7k| r.square_n(WindowBits); 515| | 516| 13.7k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 13.7k| if(w > 0) { ------------------ | Branch (519:16): [True: 13.5k, False: 270] ------------------ 520| 13.5k| r *= tbl[w - 1]; 521| 13.5k| } 522| 13.7k| } 523| | 524| 135| return r; 525| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEC2Ev: 182| 4.72k| constexpr IntMod() : m_val({}) {} pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE8square_nEm: 441| 13.7k| constexpr void square_n(size_t n) { 442| 13.7k| std::array z; // NOLINT(*-member-init) 443| 82.6k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 68.8k, False: 13.7k] ------------------ 444| 68.8k| comba_sqr(z.data(), this->data()); 445| 68.8k| m_val = Rep::redc(z); 446| 68.8k| } 447| 13.7k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEmLERKSA_: 357| 13.5k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 13.5k| std::array z; // NOLINT(*-member-init) 359| 13.5k| comba_mul(z.data(), data(), other.data()); 360| 13.5k| m_val = Rep::redc(z); 361| 13.5k| return (*this); 362| 13.5k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 366| for(;;) { 620| | // Conditional ok: this function is variable time 621| 366| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 365] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 365| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 365| std::array r; // NOLINT(*-member-init) 642| 365| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 365| if(carry == 0) { ------------------ | Branch (645:16): [True: 175, False: 190] ------------------ 646| | // b > a 647| 175| b.m_val = r; 648| 175| x = nx; 649| 175| Self::_invert_vartime_div2_helper(b, x); 650| 190| } else { 651| | // We know this can't underflow because a > b 652| 190| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 190| a.m_val = r; 654| 190| y = nx; 655| 190| Self::_invert_vartime_div2_helper(a, y); 656| 190| } 657| 365| } 658| 1| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4zeroEv: 197| 23.2k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm8EEE: 139| 271| constexpr static std::array from_rep(const std::array& z) { 140| 271| std::array ze = {}; 141| 271| copy_mem(std::span{ze}.template first(), z); 142| 271| return Self::redc(ze); 143| 271| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 367| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 367| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 1.08k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 713, False: 367] ------------------ 554| 713| shift_right<1>(a.m_val); 555| | 556| 713| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 713| if(borrow) { ------------------ | Branch (559:16): [True: 362, False: 351] ------------------ 560| 362| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 362| } 562| 713| } 563| 367| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6negateEv: 454| 11.6k| constexpr Self negate() const { 455| 11.6k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 11.6k| std::array r; // NOLINT(*-member-init) 458| 11.6k| W carry = 0; 459| 104k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 92.8k, False: 11.6k] ------------------ 460| 92.8k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 92.8k| } 462| | 463| 11.6k| return Self(r); 464| 11.6k| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm8EEE: 117| 1| constexpr static std::array to_rep(const std::array& x) { 118| 1| std::array z; // NOLINT(*-member-init) 119| 1| comba_mul(z.data(), x.data(), R2.data()); 120| 1| return Self::redc(z); 121| 1| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 15.1k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 675| std::array stash_value() const { 762| 675| static_assert(L >= N); 763| 675| std::array stash = {}; 764| 6.07k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 5.40k, False: 675] ------------------ 765| 5.40k| stash[i] = m_val[i]; 766| 5.40k| } 767| 675| return stash; 768| 675| } pcurves_brainpool512r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1632| 135| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1633| 135| const BlindingRandomness blinding(rng); 1634| 135| const BlindedScalar scalar(s, blinding); 1635| 135| return basemul_booth_exec(m_table, scalar, blinding); 1636| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EEELm1EEC2ERNS_21RandomNumberGeneratorE: 1455| 135| explicit BlindingRandomness(RandomNumberGenerator& rng) : m_seeded(rng.is_seeded()) { 1456| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1457| 135| if(m_seeded) { ------------------ | Branch (1457:13): [True: 0, False: 135] ------------------ 1458| 0| std::array buf{}; 1459| 0| rng.randomize(buf); 1460| | 1461| 0| const std::span bytes(buf); 1462| | 1463| 0| copy_mem(m_masks, bytes.first()); 1464| | 1465| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1465:31): [True: 0, False: 0] ------------------ 1466| 0| const auto wide = bytes.subspan(Scalars * MaskBytes + i * WideBytes).first(); 1467| 0| m_rerandomizers[i] = FieldElement::from_wide_bytes(wide); 1468| 0| } 1469| | 1470| 0| const auto iso = bytes.subspan(Scalars * MaskBytes + Rerandomizations * WideBytes).first(); 1471| 0| m_isomorphism = FieldElement::from_wide_bytes(iso); 1472| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), FieldElement::one()); 1473| 0| } 1474| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 369| 11.4k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 370| 11.4k| const W mask = cond.into_bitmask(); 371| | 372| 103k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (372:28): [True: 91.8k, False: 11.4k] ------------------ 373| 91.8k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 374| 91.8k| } 375| 11.4k| } pcurves_brainpool512r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EEC2INS_18BlindingRandomnessIS5_Lm1EEEEERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsESA_E12ScalarParamsEEEEERKT_m: 1368| 135| BlindedScalarBits(const typename C::Scalar& scalar, const Randomness& randomness, size_t idx = 0) { 1369| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1370| 135| if(BlindingBits > 0 && randomness.seeded()) { ------------------ | Branch (1370:13): [True: 135, Folded] | Branch (1370:33): [True: 0, False: 135] ------------------ 1371| 0| constexpr size_t n_words = C::Words; 1372| | 1373| 0| W mask[n_words] = {0}; 1374| 0| load_le(mask, randomness.mask(idx).data(), MaskWords); 1375| | 1376| | // Mask to exactly BlindingBits 1377| 0| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1378| | if constexpr(ExcessBits > 0) { 1379| | constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1380| | mask[MaskWords - 1] &= ExcessMask; 1381| | } 1382| | 1383| | // Set top and bottom bits of mask 1384| 0| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1385| 0| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1386| 0| mask[0] |= 1; 1387| | 1388| 0| W mask_n[2 * n_words] = {0}; 1389| | 1390| 0| const auto sw = scalar.to_words(); 1391| | 1392| | // Compute masked scalar s + k*n 1393| 0| comba_mul(mask_n, mask, C::NW.data()); 1394| 0| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1395| | 1396| 0| std::reverse(mask_n, mask_n + 2 * n_words); 1397| 0| m_bytes = store_be>(mask_n); 1398| 0| m_bits = C::Scalar::BITS + BlindingBits; 1399| 135| } else { 1400| | // No RNG available, skip blinding 1401| 135| m_bytes.resize(C::Scalar::BYTES); 1402| 135| scalar.serialize_to(std::span{m_bytes}.template first()); 1403| 135| m_bits = C::Scalar::BITS; 1404| 135| } 1405| | 1406| 135| CT::poison(m_bytes.data(), m_bytes.size()); 1407| 135| } pcurves_brainpool512r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EEELm1EE6seededEv: 1476| 135| bool seeded() const { return m_seeded; } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm8EEE: 139| 270| constexpr static std::array from_rep(const std::array& z) { 140| 270| std::array ze = {}; 141| 270| copy_mem(std::span{ze}.template first(), z); 142| 270| return Self::redc(ze); 143| 270| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm16EEE: 106| 406| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 406| } else { 110| 406| return monty_redc(z, P, P_dash); 111| 406| } 112| 406| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm64EEE: 741| 270| constexpr void serialize_to(std::span bytes) const { 742| 270| auto v = Rep::from_rep(m_val); 743| 270| std::reverse(v.begin(), v.end()); 744| | 745| 270| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 270| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 270| } pcurves_brainpool512r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EE4bitsEv: 1362| 135| size_t bits() const { return m_bits; } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1095| 135| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1096| 135| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1097| 135| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E6negateEv: 1194| 135| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1226| 135| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18_const_time_poisonEv: 891| 405| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_brainpool512r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EE10get_windowEm: 1409| 11.6k| size_t get_window(size_t offset) const { 1410| | // Extract a WindowBits sized window out of s, depending on offset. 1411| 11.6k| return read_window_bits(std::span{m_bytes}, offset); 1412| 11.6k| } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1121| 11.4k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1122| 11.4k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one(), A); 1123| 11.4k| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 966| 11.6k| static constexpr auto ct_select(std::span pts, size_t idx) { 967| 11.6k| auto result = Self::identity(pts[0]); 968| | 969| | // Intentionally wrapping; set to maximum size_t if idx == 0 970| 11.6k| const size_t idx1 = idx - 1; 971| 383k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (971:28): [True: 371k, False: 11.6k] ------------------ 972| 371k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 973| 371k| result.conditional_assign(found, pts[i]); 974| 371k| } 975| | 976| 11.6k| return result; 977| 11.6k| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE8identityERKSC_: 935| 11.6k| static constexpr Self identity(const Self& /*unused*/) { 936| 11.6k| return Self(FieldElement::zero(), FieldElement::zero()); 937| 11.6k| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 992| 371k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 993| 371k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 994| 371k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 382| 371k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 383| 371k| const W mask = cond.into_bitmask(); 384| | 385| 3.34M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (385:28): [True: 2.97M, False: 371k] ------------------ 386| 2.97M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 387| 2.97M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 388| 2.97M| } 389| 371k| } pcurves_brainpool512r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EEELm1EE13randomize_repERNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS4_6ParamsESA_E11FieldParamsEEEEESC_EEm: 1486| 540| void randomize_rep(typename C::ProjectivePoint& pt, size_t idx) const { 1487| 540| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 540| do { \ | | 85| 540| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 540| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 540] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 540| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 540] | | ------------------ ------------------ 1488| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1489| 540| if(m_seeded) { ------------------ | Branch (1489:13): [True: 0, False: 540] ------------------ 1490| 0| pt.randomize_rep(m_rerandomizers[idx]); 1491| 0| } 1492| 540| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1228| 135| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE20_const_time_unpoisonEv: 893| 405| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_brainpool512r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm7EED2Ev: 1414| 135| ~BlindedScalarBits() { 1415| 135| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1416| 135| CT::unpoison(m_bytes.data(), m_bytes.size()); 1417| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 405| static Self from_stash(const std::array& stash) { 777| 405| static_assert(L >= N); 778| 405| std::array val = {}; 779| 3.64k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 3.24k, False: 405] ------------------ 780| 3.24k| val[i] = stash[i]; 781| 3.24k| } 782| 405| return Self(val); 783| 405| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm8EEE: 908| 541| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm64EEE: 741| 270| constexpr void serialize_to(std::span bytes) const { 742| 270| auto v = Rep::from_rep(m_val); 743| 270| std::reverse(v.begin(), v.end()); 744| | 745| 270| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 270| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 270| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 135| std::array stash_value() const { 762| 135| static_assert(L >= N); 763| 135| std::array stash = {}; 764| 1.21k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 1.08k, False: 135] ------------------ 765| 1.08k| stash[i] = m_val[i]; 766| 1.08k| } 767| 135| return stash; 768| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 945| static Self from_stash(const std::array& stash) { 777| 945| static_assert(L >= N); 778| 945| std::array val = {}; 779| 8.50k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 7.56k, False: 945] ------------------ 780| 7.56k| val[i] = stash[i]; 781| 7.56k| } 782| 945| return Self(val); 783| 945| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 227| 271| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEeqERKSA_: 724| 135| constexpr CT::Choice operator==(const Self& other) const { 725| 135| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsENS_13MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1327| 135| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 136| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 136| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 136] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 136| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 136| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 136] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 136| return Self::from_words(words); 809| 136| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm8EEESA_NSt3__15arrayImXT_EEE: 213| 136| static constexpr Self from_words(std::array w) { 214| 136| if constexpr(L == N) { 215| 136| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 136| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm8EEE: 117| 136| constexpr static std::array to_rep(const std::array& x) { 118| 136| std::array z; // NOLINT(*-member-init) 119| 136| comba_mul(z.data(), x.data(), R2.data()); 120| 136| return Self::redc(z); 121| 136| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm129EEE: 952| 135| constexpr void serialize_to(std::span bytes) const { 953| 135| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 135| do { \ | | 52| 135| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 135| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 135] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 135| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 135] | | ------------------ ------------------ 954| 135| BufferStuffer pack(bytes); 955| 135| pack.append(0x04); 956| 135| x().serialize_to(pack.next()); 957| 135| y().serialize_to(pack.next()); 958| 135| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 135| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 135| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 135] | | ------------------ ------------------ 959| 135| } pcurves_secp224r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_12Secp224r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 324| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 324| const auto x = pt.x(); 1038| 324| auto y = pt.y(); 1039| 324| auto z = FieldElement::one(); 1040| | 1041| 324| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 324| return ProjectiveCurvePoint(x, y, z); 1044| 324| } pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 431k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 419k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 26.5k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 357k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 324| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 324| const W mask = cond.into_bitmask(); 414| | 415| 1.62k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 1.29k, False: 324] ------------------ 416| 1.29k| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 1.29k| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 1.29k| x.m_val[i] = nx; 419| 1.29k| y.m_val[i] = ny; 420| 1.29k| } 421| 324| } pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 13.3k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 66.6k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 14.2k| m_x(x), m_y(y), m_z(z) {} pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 731| constexpr Self dbl() const { 1182| 731| if constexpr(Self::A_is_minus_3) { 1183| 731| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 731| } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 73.4k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 46.8k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 46.8k| std::array z; // NOLINT(*-member-init) 430| 46.8k| comba_sqr(z.data(), this->data()); 431| 46.8k| return Self(Rep::redc(z)); 432| 46.8k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 1.15M| constexpr const W* data() const { return m_val.data(); } pcurves_secp224r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 144k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 144k| std::array z; // NOLINT(*-member-init) 350| 144k| comba_mul(z.data(), a.data(), b.data()); 351| 144k| return Self(Rep::redc(z)); 352| 144k| } pcurves_secp224r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 78.5k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 78.5k| std::array r; // NOLINT(*-member-init) 285| 78.5k| W carry = 0; 286| 392k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 314k, False: 78.5k] ------------------ 287| 314k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 314k| } 289| | 290| 78.5k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 78.5k| carry = 0; 293| | 294| 392k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 314k, False: 78.5k] ------------------ 295| 314k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 314k| } 297| | 298| 78.5k| return Self(r); 299| 78.5k| } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 43.2k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 731| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp224r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 15.2k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 15.2k| std::array t; // NOLINT(*-member-init) 269| | 270| 15.2k| W carry = 0; 271| 76.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 60.9k, False: 15.2k] ------------------ 272| 60.9k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 60.9k| } 274| | 275| 15.2k| std::array r; // NOLINT(*-member-init) 276| 15.2k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 15.2k| return Self(r); 278| 15.2k| } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 42.5k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 731| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 5.84k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 5.84k| std::array t = value(); 329| 5.84k| const W carry = shift_left<1>(t); 330| | 331| 5.84k| std::array r; // NOLINT(*-member-init) 332| 5.84k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 5.84k| return Self(r); 334| 5.84k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 5.84k| constexpr const std::array& value() const { return m_val; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 731| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp224r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 645| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 645| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 14.6k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 25.5k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 25.5k| const W mask = cond.into_bitmask(); 399| | 400| 127k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 102k, False: 25.5k] ------------------ 401| 102k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 102k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 102k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 102k| } 405| 25.5k| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEmLERKSA_: 357| 8.80k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 8.80k| std::array z; // NOLINT(*-member-init) 359| 8.80k| comba_mul(z.data(), data(), other.data()); 360| 8.80k| m_val = Rep::redc(z); 361| 8.80k| return (*this); 362| 8.80k| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8square_nEm: 441| 38.1k| constexpr void square_n(size_t n) { 442| 38.1k| std::array z; // NOLINT(*-member-init) 443| 801k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 763k, False: 38.1k] ------------------ 444| 763k| comba_sqr(z.data(), this->data()); 445| 763k| m_val = Rep::redc(z); 446| 763k| } 447| 38.1k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 153| for(;;) { 620| | // Conditional ok: this function is variable time 621| 153| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 152] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 152| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 152| std::array r; // NOLINT(*-member-init) 642| 152| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 152| if(carry == 0) { ------------------ | Branch (645:16): [True: 81, False: 71] ------------------ 646| | // b > a 647| 81| b.m_val = r; 648| 81| x = nx; 649| 81| Self::_invert_vartime_div2_helper(b, x); 650| 81| } else { 651| | // We know this can't underflow because a > b 652| 71| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 71| a.m_val = r; 654| 71| y = nx; 655| 71| Self::_invert_vartime_div2_helper(a, y); 656| 71| } 657| 152| } 658| 1| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4zeroEv: 197| 24.6k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 154| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 154| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 479| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 325, False: 154] ------------------ 554| 325| shift_right<1>(a.m_val); 555| | 556| 325| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 325| if(borrow) { ------------------ | Branch (559:16): [True: 200, False: 125] ------------------ 560| 200| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 200| } 562| 325| } 563| 154| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 12.3k| constexpr Self negate() const { 455| 12.3k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 12.3k| std::array r; // NOLINT(*-member-init) 458| 12.3k| W carry = 0; 459| 61.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 49.4k, False: 12.3k] ------------------ 460| 49.4k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 49.4k| } 462| | 463| 12.3k| return Self(r); 464| 12.3k| } pcurves_secp224r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 14.8k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 1.76k| std::array stash_value() const { 762| 1.76k| static_assert(L >= N); 763| 1.76k| std::array stash = {}; 764| 8.83k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 7.06k, False: 1.76k] ------------------ 765| 7.06k| stash[i] = m_val[i]; 766| 7.06k| } 767| 1.76k| return stash; 768| 1.76k| } pcurves_secp224r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp224r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1632| 323| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1633| 323| const BlindingRandomness blinding(rng); 1634| 323| const BlindedScalar scalar(s, blinding); 1635| 323| return basemul_booth_exec(m_table, scalar, blinding); 1636| 323| } pcurves_secp224r1.cpp:_ZN5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm7EEELm1EEC2ERNS_21RandomNumberGeneratorE: 1455| 323| explicit BlindingRandomness(RandomNumberGenerator& rng) : m_seeded(rng.is_seeded()) { 1456| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1457| 323| if(m_seeded) { ------------------ | Branch (1457:13): [True: 0, False: 323] ------------------ 1458| 0| std::array buf{}; 1459| 0| rng.randomize(buf); 1460| | 1461| 0| const std::span bytes(buf); 1462| | 1463| 0| copy_mem(m_masks, bytes.first()); 1464| | 1465| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1465:31): [True: 0, False: 0] ------------------ 1466| 0| const auto wide = bytes.subspan(Scalars * MaskBytes + i * WideBytes).first(); 1467| 0| m_rerandomizers[i] = FieldElement::from_wide_bytes(wide); 1468| 0| } 1469| | 1470| 0| const auto iso = bytes.subspan(Scalars * MaskBytes + Rerandomizations * WideBytes).first(); 1471| 0| m_isomorphism = FieldElement::from_wide_bytes(iso); 1472| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), FieldElement::one()); 1473| 0| } 1474| 323| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2Ev: 182| 3.46k| constexpr IntMod() : m_val({}) {} pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 369| 39.7k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 370| 39.7k| const W mask = cond.into_bitmask(); 371| | 372| 198k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (372:28): [True: 158k, False: 39.7k] ------------------ 373| 158k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 374| 158k| } 375| 39.7k| } pcurves_secp224r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm7EEC2INS_18BlindingRandomnessIS5_Lm1EEEEERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp224r1RepEE12ScalarParamsEEEEERKT_m: 1368| 323| BlindedScalarBits(const typename C::Scalar& scalar, const Randomness& randomness, size_t idx = 0) { 1369| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1370| 323| if(BlindingBits > 0 && randomness.seeded()) { ------------------ | Branch (1370:13): [True: 323, Folded] | Branch (1370:33): [True: 0, False: 323] ------------------ 1371| 0| constexpr size_t n_words = C::Words; 1372| | 1373| 0| W mask[n_words] = {0}; 1374| 0| load_le(mask, randomness.mask(idx).data(), MaskWords); 1375| | 1376| | // Mask to exactly BlindingBits 1377| 0| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1378| 0| if constexpr(ExcessBits > 0) { 1379| 0| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1380| 0| mask[MaskWords - 1] &= ExcessMask; 1381| 0| } 1382| | 1383| | // Set top and bottom bits of mask 1384| 0| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1385| 0| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1386| 0| mask[0] |= 1; 1387| | 1388| 0| W mask_n[2 * n_words] = {0}; 1389| | 1390| 0| const auto sw = scalar.to_words(); 1391| | 1392| | // Compute masked scalar s + k*n 1393| 0| comba_mul(mask_n, mask, C::NW.data()); 1394| 0| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1395| | 1396| 0| std::reverse(mask_n, mask_n + 2 * n_words); 1397| 0| m_bytes = store_be>(mask_n); 1398| 0| m_bits = C::Scalar::BITS + BlindingBits; 1399| 323| } else { 1400| | // No RNG available, skip blinding 1401| 323| m_bytes.resize(C::Scalar::BYTES); 1402| 323| scalar.serialize_to(std::span{m_bytes}.template first()); 1403| 323| m_bits = C::Scalar::BITS; 1404| 323| } 1405| | 1406| 323| CT::poison(m_bytes.data(), m_bytes.size()); 1407| 323| } pcurves_secp224r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm7EEELm1EE6seededEv: 1476| 323| bool seeded() const { return m_seeded; } pcurves_secp224r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS4_12Secp224r1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 646| constexpr static std::array from_rep(const std::array& z) { 140| 646| std::array ze = {}; 141| 646| copy_mem(std::span{ze}.template first(), z); 142| 646| return Self::redc(ze); 143| 646| } pcurves_secp224r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS4_12Secp224r1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 970| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 970| } else { 110| 970| return monty_redc(z, P, P_dash); 111| 970| } 112| 970| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm28EEE: 741| 646| constexpr void serialize_to(std::span bytes) const { 742| 646| auto v = Rep::from_rep(m_val); 743| 646| std::reverse(v.begin(), v.end()); 744| | 745| | if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| | store_be(bytes, v); 747| 646| } else { 748| | // Remove leading zero bytes 749| 646| const auto padded_bytes = store_be(v); 750| 646| constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| 646| copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| 646| } 753| 646| } pcurves_secp224r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm7EE4bitsEv: 1362| 323| size_t bits() const { return m_bits; } pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1095| 323| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1096| 323| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1097| 323| } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E6negateEv: 1194| 323| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1226| 323| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18_const_time_poisonEv: 891| 969| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_secp224r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm7EE10get_windowEm: 1409| 12.2k| size_t get_window(size_t offset) const { 1410| | // Extract a WindowBits sized window out of s, depending on offset. 1411| 12.2k| return read_window_bits(std::span{m_bytes}, offset); 1412| 12.2k| } pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1121| 11.9k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1122| 11.9k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one(), A); 1123| 11.9k| } pcurves_secp224r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 966| 12.2k| static constexpr auto ct_select(std::span pts, size_t idx) { 967| 12.2k| auto result = Self::identity(pts[0]); 968| | 969| | // Intentionally wrapping; set to maximum size_t if idx == 0 970| 12.2k| const size_t idx1 = idx - 1; 971| 405k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (971:28): [True: 392k, False: 12.2k] ------------------ 972| 392k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 973| 392k| result.conditional_assign(found, pts[i]); 974| 392k| } 975| | 976| 12.2k| return result; 977| 12.2k| } pcurves_secp224r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE8identityERKSC_: 935| 12.2k| static constexpr Self identity(const Self& /*unused*/) { 936| 12.2k| return Self(FieldElement::zero(), FieldElement::zero()); 937| 12.2k| } pcurves_secp224r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 992| 392k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 993| 392k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 994| 392k| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 382| 392k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 383| 392k| const W mask = cond.into_bitmask(); 384| | 385| 1.96M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (385:28): [True: 1.57M, False: 392k] ------------------ 386| 1.57M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 387| 1.57M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 388| 1.57M| } 389| 392k| } pcurves_secp224r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm7EEELm1EE13randomize_repERNS_20ProjectiveCurvePointINS_6IntModINS4_12Secp224r1RepINS_13EllipticCurveINS4_6ParamsESA_E11FieldParamsEEEEESC_EEm: 1486| 1.29k| void randomize_rep(typename C::ProjectivePoint& pt, size_t idx) const { 1487| 1.29k| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 1.29k| do { \ | | 85| 1.29k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 1.29k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 1.29k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 1.29k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 1.29k] | | ------------------ ------------------ 1488| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1489| 1.29k| if(m_seeded) { ------------------ | Branch (1489:13): [True: 0, False: 1.29k] ------------------ 1490| 0| pt.randomize_rep(m_rerandomizers[idx]); 1491| 0| } 1492| 1.29k| } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1228| 323| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE20_const_time_unpoisonEv: 893| 969| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_secp224r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm7EED2Ev: 1414| 323| ~BlindedScalarBits() { 1415| 323| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1416| 323| CT::unpoison(m_bytes.data(), m_bytes.size()); 1417| 323| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 969| static Self from_stash(const std::array& stash) { 777| 969| static_assert(L >= N); 778| 969| std::array val = {}; 779| 4.84k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 3.87k, False: 969] ------------------ 780| 3.87k| val[i] = stash[i]; 781| 3.87k| } 782| 969| return Self(val); 783| 969| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 1.29k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm28EEE: 741| 798| constexpr void serialize_to(std::span bytes) const { 742| 798| auto v = Rep::from_rep(m_val); 743| 798| std::reverse(v.begin(), v.end()); 744| | 745| | if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| | store_be(bytes, v); 747| 798| } else { 748| | // Remove leading zero bytes 749| 798| const auto padded_bytes = store_be(v); 750| 798| constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| 798| copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| 798| } 753| 798| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 323| std::array stash_value() const { 762| 323| static_assert(L >= N); 763| 323| std::array stash = {}; 764| 1.61k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 1.29k, False: 323] ------------------ 765| 1.29k| stash[i] = m_val[i]; 766| 1.29k| } 767| 323| return stash; 768| 323| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 2.56k| static Self from_stash(const std::array& stash) { 777| 2.56k| static_assert(L >= N); 778| 2.56k| std::array val = {}; 779| 12.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 10.2k, False: 2.56k] ------------------ 780| 10.2k| val[i] = stash[i]; 781| 10.2k| } 782| 2.56k| return Self(val); 783| 2.56k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE7is_zeroEv: 227| 647| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 238| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 238| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 238] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 238| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 238| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 7, False: 231] ------------------ 804| 7| return {}; 805| 7| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 231| return Self::from_words(words); 809| 238| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEeqERKSA_: 724| 14.2k| constexpr CT::Choice operator==(const Self& other) const { 725| 14.2k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 14.2k| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE: 213| 231| static constexpr Self from_words(std::array w) { 214| 231| if constexpr(L == N) { 215| 231| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 231| } pcurves_secp224r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS3_12Secp224r1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1327| 509| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4sqrtEv: 665| 145| constexpr CT::Option sqrt() const { 666| | if constexpr(Self::P_MOD_4 == 3) { 667| | // The easy case for square root is when p == 3 (mod 4) 668| | 669| | constexpr auto P_PLUS_1_OVER_4 = p_plus_1_over_4(P); 670| | auto z = pow_vartime(P_PLUS_1_OVER_4); 671| | 672| | // Zero out the return value if it would otherwise be incorrect 673| | const CT::Choice correct = (z.square() == *this); 674| | z.conditional_assign(!correct, Self::zero()); 675| | return CT::Option(z, correct); 676| 145| } else { 677| | // Shanks-Tonelli, following I.4 in RFC 9380 678| | 679| | /* 680| | Constants: 681| | 1. c1, the largest integer such that 2^c1 divides q - 1. 682| | 2. c2 = (q - 1) / (2^c1) # Integer arithmetic 683| | 3. c3 = (c2 - 1) / 2 # Integer arithmetic 684| | 4. c4, a non-square value in F 685| | 5. c5 = c4^c2 in F 686| | */ 687| 145| constexpr auto C1_C2 = shanks_tonelli_c1c2(Self::P); 688| 145| constexpr std::array C3 = shanks_tonelli_c3(C1_C2.second); 689| 145| constexpr std::array P_MINUS_1_OVER_2 = p_minus_1_over_2(Self::P); 690| 145| constexpr Self C4 = shanks_tonelli_c4(P_MINUS_1_OVER_2); 691| 145| constexpr Self C5 = C4.pow_vartime(C1_C2.second); 692| | 693| 145| const Self& x = (*this); 694| | 695| 145| auto z = x.pow_vartime(C3); 696| 145| auto t = z.square(); 697| 145| t *= x; 698| 145| z *= x; 699| 145| auto b = t; 700| 145| auto c = C5; 701| | 702| 13.9k| for(size_t i = C1_C2.first; i >= 2; i--) { ------------------ | Branch (702:41): [True: 13.7k, False: 145] ------------------ 703| 13.7k| b.square_n(i - 2); 704| 13.7k| const CT::Choice e = b.is_one(); 705| 13.7k| z.conditional_assign(!e, z * c); 706| 13.7k| c.square_n(1); 707| 13.7k| t.conditional_assign(!e, t * c); 708| 13.7k| b = t; 709| 13.7k| } 710| | 711| | // Zero out the return value if it would otherwise be incorrect 712| 145| const CT::Choice correct = (z.square() == *this); 713| 145| z.conditional_assign(!correct, Self::zero()); 714| 145| return CT::Option(z, correct); 715| 145| } 716| 145| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm4EEE: 479| 145| constexpr Self pow_vartime(const std::array& exp) const { 480| 145| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [True: 0, Folded] ------------------ 481| 145| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 145| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 145| std::array tbl; 492| | 493| 145| tbl[0] = (*this); 494| | 495| 2.17k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 2.03k, False: 145] ------------------ 496| | // Conditional ok: table indexes are public here 497| 2.03k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 1.01k, False: 1.01k] ------------------ 498| 1.01k| tbl[i] = tbl[i / 2].square(); 499| 1.01k| } else { 500| 1.01k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 1.01k| } 502| 2.03k| } 503| | 504| 145| auto r = Self::one(); 505| | 506| 145| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 145| if(w0 > 0) { ------------------ | Branch (509:13): [True: 0, False: 145] ------------------ 510| 0| r = tbl[w0 - 1]; 511| 0| } 512| | 513| 8.12k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 7.97k, False: 145] ------------------ 514| 7.97k| r.square_n(WindowBits); 515| | 516| 7.97k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 7.97k| if(w > 0) { ------------------ | Branch (519:16): [True: 4.64k, False: 3.33k] ------------------ 520| 4.64k| r *= tbl[w - 1]; 521| 4.64k| } 522| 7.97k| } 523| | 524| 145| return r; 525| 145| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6is_oneEv: 237| 13.7k| constexpr CT::Choice is_one() const { return (*this == Self::one()); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE: 250| 76| constexpr Self correct_sign(CT::Choice even) const { 251| 76| const auto flip = (even != this->is_even()); 252| 76| return Self::choose(flip, this->negate(), *this); 253| 76| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_evenEv: 242| 76| constexpr CT::Choice is_even() const { 243| 76| auto v = Rep::from_rep(m_val); 244| 76| return !CT::Choice::from_int(v[0] & 0x01); 245| 76| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_: 258| 76| static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) { 259| 76| auto r = y; 260| 76| r.conditional_assign(choice, x); 261| 76| return r; 262| 76| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 325| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 325| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 325] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 325| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 325| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 1, False: 324] ------------------ 804| 1| return {}; 805| 1| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 324| return Self::from_words(words); 809| 325| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE10from_wordsILm4EEESB_NSt3__15arrayImXT_EEE: 213| 324| static constexpr Self from_words(std::array w) { 214| 324| if constexpr(L == N) { 215| 324| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 324| } pcurves_secp224r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS4_12Secp224r1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 324| constexpr static std::array to_rep(const std::array& x) { 118| 324| std::array z; // NOLINT(*-member-init) 119| 324| comba_mul(z.data(), x.data(), R2.data()); 120| 324| return Self::redc(z); 121| 324| } pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm57EEE: 952| 399| constexpr void serialize_to(std::span bytes) const { 953| 399| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 399| do { \ | | 52| 399| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 399| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 399] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 399| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 399] | | ------------------ ------------------ 954| 399| BufferStuffer pack(bytes); 955| 399| pack.append(0x04); 956| 399| x().serialize_to(pack.next()); 957| 399| y().serialize_to(pack.next()); 958| 399| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 399| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 399| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 399] | | ------------------ ------------------ 959| 399| } pcurves_secp256k1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_12Secp256k1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp256k1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 190| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 190| const auto x = pt.x(); 1038| 190| auto y = pt.y(); 1039| 190| auto z = FieldElement::one(); 1040| | 1041| 190| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 190| return ProjectiveCurvePoint(x, y, z); 1044| 190| } pcurves_secp256k1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 285k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256k1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 277k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 8.31k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 223k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 190| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 190| const W mask = cond.into_bitmask(); 414| | 415| 950| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 760, False: 190] ------------------ 416| 760| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 760| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 760| x.m_val[i] = nx; 419| 760| y.m_val[i] = ny; 420| 760| } 421| 190| } pcurves_secp256k1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 8.69k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 45.7k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256k1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 10.0k| m_x(x), m_y(y), m_z(z) {} pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 833| constexpr Self dbl() const { 1182| | if constexpr(Self::A_is_minus_3) { 1183| | return dbl_a_minus_3(*this); 1184| 833| } else if constexpr(Self::A_is_zero) { 1185| 833| return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 833| } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 30.7k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 32.5k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 32.5k| std::array z; // NOLINT(*-member-init) 430| 32.5k| comba_sqr(z.data(), this->data()); 431| 32.5k| return Self(Rep::redc(z)); 432| 32.5k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 264k| constexpr const W* data() const { return m_val.data(); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 833| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp256k1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 10.0k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 10.0k| std::array t; // NOLINT(*-member-init) 269| | 270| 10.0k| W carry = 0; 271| 50.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 40.2k, False: 10.0k] ------------------ 272| 40.2k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 40.2k| } 274| | 275| 10.0k| std::array r; // NOLINT(*-member-init) 276| 10.0k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 10.0k| return Self(r); 278| 10.0k| } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 30.7k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256k1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 85.1k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 85.1k| std::array z; // NOLINT(*-member-init) 350| 85.1k| comba_mul(z.data(), a.data(), b.data()); 351| 85.1k| return Self(Rep::redc(z)); 352| 85.1k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 833| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp256k1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 54.5k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 54.5k| std::array r; // NOLINT(*-member-init) 285| 54.5k| W carry = 0; 286| 272k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 218k, False: 54.5k] ------------------ 287| 218k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 218k| } 289| | 290| 54.5k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 54.5k| carry = 0; 293| | 294| 272k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 218k, False: 54.5k] ------------------ 295| 218k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 218k| } 297| | 298| 54.5k| return Self(r); 299| 54.5k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 6.66k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 6.66k| std::array t = value(); 329| 6.66k| const W carry = shift_left<1>(t); 330| | 331| 6.66k| std::array r; // NOLINT(*-member-init) 332| 6.66k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 6.66k| return Self(r); 334| 6.66k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 6.66k| constexpr const std::array& value() const { return m_val; } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 833| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 53.5k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp256k1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp256k1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 10.9k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 17.5k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 17.5k| const W mask = cond.into_bitmask(); 399| | 400| 87.6k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 70.1k, False: 17.5k] ------------------ 401| 70.1k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 70.1k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 70.1k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 70.1k| } 405| 17.5k| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEmLERKSA_: 357| 2.45k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 2.45k| std::array z; // NOLINT(*-member-init) 359| 2.45k| comba_mul(z.data(), data(), other.data()); 360| 2.45k| m_val = Rep::redc(z); 361| 2.45k| return (*this); 362| 2.45k| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8square_nEm: 441| 2.45k| constexpr void square_n(size_t n) { 442| 2.45k| std::array z; // NOLINT(*-member-init) 443| 50.2k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 47.8k, False: 2.45k] ------------------ 444| 47.8k| comba_sqr(z.data(), this->data()); 445| 47.8k| m_val = Rep::redc(z); 446| 47.8k| } 447| 2.45k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 176| for(;;) { 620| | // Conditional ok: this function is variable time 621| 176| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 175] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 175| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 175| std::array r; // NOLINT(*-member-init) 642| 175| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 175| if(carry == 0) { ------------------ | Branch (645:16): [True: 105, False: 70] ------------------ 646| | // b > a 647| 105| b.m_val = r; 648| 105| x = nx; 649| 105| Self::_invert_vartime_div2_helper(b, x); 650| 105| } else { 651| | // We know this can't underflow because a > b 652| 70| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 70| a.m_val = r; 654| 70| y = nx; 655| 70| Self::_invert_vartime_div2_helper(a, y); 656| 70| } 657| 175| } 658| 1| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4zeroEv: 197| 16.2k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 177| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 177| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 541| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 364, False: 177] ------------------ 554| 364| shift_right<1>(a.m_val); 555| | 556| 364| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 364| if(borrow) { ------------------ | Branch (559:16): [True: 186, False: 178] ------------------ 560| 186| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 186| } 562| 364| } 563| 177| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 8.12k| constexpr Self negate() const { 455| 8.12k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 8.12k| std::array r; // NOLINT(*-member-init) 458| 8.12k| W carry = 0; 459| 40.6k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 32.5k, False: 8.12k] ------------------ 460| 32.5k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 32.5k| } 462| | 463| 8.12k| return Self(r); 464| 8.12k| } pcurves_secp256k1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 10.2k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 945| std::array stash_value() const { 762| 945| static_assert(L >= N); 763| 945| std::array stash = {}; 764| 4.72k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 3.78k, False: 945] ------------------ 765| 3.78k| stash[i] = m_val[i]; 766| 3.78k| } 767| 945| return stash; 768| 945| } pcurves_secp256k1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp256k1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1632| 189| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1633| 189| const BlindingRandomness blinding(rng); 1634| 189| const BlindedScalar scalar(s, blinding); 1635| 189| return basemul_booth_exec(m_table, scalar, blinding); 1636| 189| } pcurves_secp256k1.cpp:_ZN5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm7EEELm1EEC2ERNS_21RandomNumberGeneratorE: 1455| 189| explicit BlindingRandomness(RandomNumberGenerator& rng) : m_seeded(rng.is_seeded()) { 1456| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1457| 189| if(m_seeded) { ------------------ | Branch (1457:13): [True: 0, False: 189] ------------------ 1458| 0| std::array buf{}; 1459| 0| rng.randomize(buf); 1460| | 1461| 0| const std::span bytes(buf); 1462| | 1463| 0| copy_mem(m_masks, bytes.first()); 1464| | 1465| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1465:31): [True: 0, False: 0] ------------------ 1466| 0| const auto wide = bytes.subspan(Scalars * MaskBytes + i * WideBytes).first(); 1467| 0| m_rerandomizers[i] = FieldElement::from_wide_bytes(wide); 1468| 0| } 1469| | 1470| 0| const auto iso = bytes.subspan(Scalars * MaskBytes + Rerandomizations * WideBytes).first(); 1471| 0| m_isomorphism = FieldElement::from_wide_bytes(iso); 1472| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), FieldElement::one()); 1473| 0| } 1474| 189| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2Ev: 182| 756| constexpr IntMod() : m_val({}) {} pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 369| 7.93k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 370| 7.93k| const W mask = cond.into_bitmask(); 371| | 372| 39.6k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (372:28): [True: 31.7k, False: 7.93k] ------------------ 373| 31.7k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 374| 31.7k| } 375| 7.93k| } pcurves_secp256k1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm7EEC2INS_18BlindingRandomnessIS5_Lm1EEEEERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp256k1RepEE12ScalarParamsEEEEERKT_m: 1368| 189| BlindedScalarBits(const typename C::Scalar& scalar, const Randomness& randomness, size_t idx = 0) { 1369| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1370| 189| if(BlindingBits > 0 && randomness.seeded()) { ------------------ | Branch (1370:13): [True: 189, Folded] | Branch (1370:33): [True: 0, False: 189] ------------------ 1371| 0| constexpr size_t n_words = C::Words; 1372| | 1373| 0| W mask[n_words] = {0}; 1374| 0| load_le(mask, randomness.mask(idx).data(), MaskWords); 1375| | 1376| | // Mask to exactly BlindingBits 1377| 0| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1378| 0| if constexpr(ExcessBits > 0) { 1379| 0| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1380| 0| mask[MaskWords - 1] &= ExcessMask; 1381| 0| } 1382| | 1383| | // Set top and bottom bits of mask 1384| 0| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1385| 0| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1386| 0| mask[0] |= 1; 1387| | 1388| 0| W mask_n[2 * n_words] = {0}; 1389| | 1390| 0| const auto sw = scalar.to_words(); 1391| | 1392| | // Compute masked scalar s + k*n 1393| 0| comba_mul(mask_n, mask, C::NW.data()); 1394| 0| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1395| | 1396| 0| std::reverse(mask_n, mask_n + 2 * n_words); 1397| 0| m_bytes = store_be>(mask_n); 1398| 0| m_bits = C::Scalar::BITS + BlindingBits; 1399| 189| } else { 1400| | // No RNG available, skip blinding 1401| 189| m_bytes.resize(C::Scalar::BYTES); 1402| 189| scalar.serialize_to(std::span{m_bytes}.template first()); 1403| 189| m_bits = C::Scalar::BITS; 1404| 189| } 1405| | 1406| 189| CT::poison(m_bytes.data(), m_bytes.size()); 1407| 189| } pcurves_secp256k1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm7EEELm1EE6seededEv: 1476| 189| bool seeded() const { return m_seeded; } pcurves_secp256k1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS4_12Secp256k1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 378| constexpr static std::array from_rep(const std::array& z) { 140| 378| std::array ze = {}; 141| 378| copy_mem(std::span{ze}.template first(), z); 142| 378| return Self::redc(ze); 143| 378| } pcurves_secp256k1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS4_12Secp256k1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 568| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 568| } else { 110| 568| return monty_redc(z, P, P_dash); 111| 568| } 112| 568| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 378| constexpr void serialize_to(std::span bytes) const { 742| 378| auto v = Rep::from_rep(m_val); 743| 378| std::reverse(v.begin(), v.end()); 744| | 745| 378| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 378| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 378| } pcurves_secp256k1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm7EE4bitsEv: 1362| 189| size_t bits() const { return m_bits; } pcurves_secp256k1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1095| 189| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1096| 189| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1097| 189| } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E6negateEv: 1194| 189| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1226| 189| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18_const_time_poisonEv: 891| 567| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_secp256k1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm7EE10get_windowEm: 1409| 8.12k| size_t get_window(size_t offset) const { 1410| | // Extract a WindowBits sized window out of s, depending on offset. 1411| 8.12k| return read_window_bits(std::span{m_bytes}, offset); 1412| 8.12k| } pcurves_secp256k1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1121| 7.93k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1122| 7.93k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one(), A); 1123| 7.93k| } pcurves_secp256k1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 966| 8.12k| static constexpr auto ct_select(std::span pts, size_t idx) { 967| 8.12k| auto result = Self::identity(pts[0]); 968| | 969| | // Intentionally wrapping; set to maximum size_t if idx == 0 970| 8.12k| const size_t idx1 = idx - 1; 971| 268k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (971:28): [True: 260k, False: 8.12k] ------------------ 972| 260k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 973| 260k| result.conditional_assign(found, pts[i]); 974| 260k| } 975| | 976| 8.12k| return result; 977| 8.12k| } pcurves_secp256k1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE8identityERKSC_: 935| 8.12k| static constexpr Self identity(const Self& /*unused*/) { 936| 8.12k| return Self(FieldElement::zero(), FieldElement::zero()); 937| 8.12k| } pcurves_secp256k1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 992| 260k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 993| 260k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 994| 260k| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 382| 260k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 383| 260k| const W mask = cond.into_bitmask(); 384| | 385| 1.30M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (385:28): [True: 1.04M, False: 260k] ------------------ 386| 1.04M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 387| 1.04M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 388| 1.04M| } 389| 260k| } pcurves_secp256k1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm7EEELm1EE13randomize_repERNS_20ProjectiveCurvePointINS_6IntModINS4_12Secp256k1RepINS_13EllipticCurveINS4_6ParamsESA_E11FieldParamsEEEEESC_EEm: 1486| 756| void randomize_rep(typename C::ProjectivePoint& pt, size_t idx) const { 1487| 756| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 756| do { \ | | 85| 756| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 756| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 756] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 756| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 756] | | ------------------ ------------------ 1488| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1489| 756| if(m_seeded) { ------------------ | Branch (1489:13): [True: 0, False: 756] ------------------ 1490| 0| pt.randomize_rep(m_rerandomizers[idx]); 1491| 0| } 1492| 756| } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1228| 189| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE20_const_time_unpoisonEv: 893| 567| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_secp256k1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm7EED2Ev: 1414| 189| ~BlindedScalarBits() { 1415| 189| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1416| 189| CT::unpoison(m_bytes.data(), m_bytes.size()); 1417| 189| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 567| static Self from_stash(const std::array& stash) { 777| 567| static_assert(L >= N); 778| 567| std::array val = {}; 779| 2.83k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 2.26k, False: 567] ------------------ 780| 2.26k| val[i] = stash[i]; 781| 2.26k| } 782| 567| return Self(val); 783| 567| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 757| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 378| constexpr void serialize_to(std::span bytes) const { 742| 378| auto v = Rep::from_rep(m_val); 743| 378| std::reverse(v.begin(), v.end()); 744| | 745| 378| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 378| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 378| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 189| std::array stash_value() const { 762| 189| static_assert(L >= N); 763| 189| std::array stash = {}; 764| 945| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 756, False: 189] ------------------ 765| 756| stash[i] = m_val[i]; 766| 756| } 767| 189| return stash; 768| 189| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 1.32k| static Self from_stash(const std::array& stash) { 777| 1.32k| static_assert(L >= N); 778| 1.32k| std::array val = {}; 779| 6.61k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 5.29k, False: 1.32k] ------------------ 780| 5.29k| val[i] = stash[i]; 781| 5.29k| } 782| 1.32k| return Self(val); 783| 1.32k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE7is_zeroEv: 227| 379| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEeqERKSA_: 724| 189| constexpr CT::Choice operator==(const Self& other) const { 725| 189| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 189| } pcurves_secp256k1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS3_12Secp256k1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1327| 189| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 190| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 190| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 190] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 190| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 190| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 190] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 190| return Self::from_words(words); 809| 190| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE10from_wordsILm4EEESB_NSt3__15arrayImXT_EEE: 213| 190| static constexpr Self from_words(std::array w) { 214| 190| if constexpr(L == N) { 215| 190| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 190| } pcurves_secp256k1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS4_12Secp256k1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 190| constexpr static std::array to_rep(const std::array& x) { 118| 190| std::array z; // NOLINT(*-member-init) 119| 190| comba_mul(z.data(), x.data(), R2.data()); 120| 190| return Self::redc(z); 121| 190| } pcurves_secp256k1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm65EEE: 952| 189| constexpr void serialize_to(std::span bytes) const { 953| 189| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 189| do { \ | | 52| 189| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 189| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 189] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 189| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 189] | | ------------------ ------------------ 954| 189| BufferStuffer pack(bytes); 955| 189| pack.append(0x04); 956| 189| x().serialize_to(pack.next()); 957| 189| y().serialize_to(pack.next()); 958| 189| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 189| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 189| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 189] | | ------------------ ------------------ 959| 189| } pcurves_secp256r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_22Secp256r1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 174| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 174| const auto x = pt.x(); 1038| 174| auto y = pt.y(); 1039| 174| auto z = FieldElement::one(); 1040| | 1041| 174| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 174| return ProjectiveCurvePoint(x, y, z); 1044| 174| } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE1xEv: 982| 261k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE1yEv: 987| 253k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE3oneEv: 202| 7.61k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 210k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 174| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 174| const W mask = cond.into_bitmask(); 414| | 415| 870| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 696, False: 174] ------------------ 416| 696| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 696| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 696| x.m_val[i] = nx; 419| 696| y.m_val[i] = ny; 420| 696| } 421| 174| } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE11is_identityEv: 939| 7.95k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE7is_zeroEv: 227| 42.2k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 9.35k| m_x(x), m_y(y), m_z(z) {} pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E3dblEv: 1181| 833| constexpr Self dbl() const { 1182| 833| if constexpr(Self::A_is_minus_3) { 1183| 833| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 833| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1zEv: 1224| 50.9k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6squareEv: 428| 30.6k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 30.6k| std::array z; // NOLINT(*-member-init) 430| 30.6k| comba_sqr(z.data(), this->data()); 431| 30.6k| return Self(Rep::redc(z)); 432| 30.6k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4dataEv: 898| 247k| constexpr const W* data() const { return m_val.data(); } pcurves_secp256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 348| 80.3k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 80.3k| std::array z; // NOLINT(*-member-init) 350| 80.3k| comba_mul(z.data(), a.data(), b.data()); 351| 80.3k| return Self(Rep::redc(z)); 352| 80.3k| } pcurves_secp256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 283| 51.3k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 51.3k| std::array r; // NOLINT(*-member-init) 285| 51.3k| W carry = 0; 286| 256k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 205k, False: 51.3k] ------------------ 287| 205k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 205k| } 289| | 290| 51.3k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 51.3k| carry = 0; 293| | 294| 256k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 205k, False: 51.3k] ------------------ 295| 205k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 205k| } 297| | 298| 51.3k| return Self(r); 299| 51.3k| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1xEv: 1214| 29.4k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul3Ev: 337| 833| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp256r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 267| 10.1k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 10.1k| std::array t; // NOLINT(*-member-init) 269| | 270| 10.1k| W carry = 0; 271| 50.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 40.7k, False: 10.1k] ------------------ 272| 40.7k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 40.7k| } 274| | 275| 10.1k| std::array r; // NOLINT(*-member-init) 276| 10.1k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 10.1k| return Self(r); 278| 10.1k| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1yEv: 1219| 28.6k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul4Ev: 340| 833| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul2Ev: 327| 6.66k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 6.66k| std::array t = value(); 329| 6.66k| const W carry = shift_left<1>(t); 330| | 331| 6.66k| std::array r; // NOLINT(*-member-init) 332| 6.66k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 6.66k| return Self(r); 334| 6.66k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE5valueEv: 896| 6.66k| constexpr const std::array& value() const { return m_val; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul8Ev: 343| 833| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EESE_: 1075| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 10.3k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 16.1k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 16.1k| const W mask = cond.into_bitmask(); 399| | 400| 80.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 64.7k, False: 16.1k] ------------------ 401| 64.7k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 64.7k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 64.7k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 64.7k| } 405| 16.1k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEmLERKSA_: 357| 1.90k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 1.90k| std::array z; // NOLINT(*-member-init) 359| 1.90k| comba_mul(z.data(), data(), other.data()); 360| 1.90k| m_val = Rep::redc(z); 361| 1.90k| return (*this); 362| 1.90k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE8square_nEm: 441| 1.55k| constexpr void square_n(size_t n) { 442| 1.55k| std::array z; // NOLINT(*-member-init) 443| 45.1k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 43.5k, False: 1.55k] ------------------ 444| 43.5k| comba_sqr(z.data(), this->data()); 445| 43.5k| m_val = Rep::redc(z); 446| 43.5k| } 447| 1.55k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 176| for(;;) { 620| | // Conditional ok: this function is variable time 621| 176| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 175] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 175| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 175| std::array r; // NOLINT(*-member-init) 642| 175| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 175| if(carry == 0) { ------------------ | Branch (645:16): [True: 85, False: 90] ------------------ 646| | // b > a 647| 85| b.m_val = r; 648| 85| x = nx; 649| 85| Self::_invert_vartime_div2_helper(b, x); 650| 90| } else { 651| | // We know this can't underflow because a > b 652| 90| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 90| a.m_val = r; 654| 90| y = nx; 655| 90| Self::_invert_vartime_div2_helper(a, y); 656| 90| } 657| 175| } 658| 1| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4zeroEv: 197| 14.8k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 177| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 177| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 545| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 368, False: 177] ------------------ 554| 368| shift_right<1>(a.m_val); 555| | 556| 368| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 368| if(borrow) { ------------------ | Branch (559:16): [True: 129, False: 239] ------------------ 560| 129| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 129| } 562| 368| } 563| 177| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6negateEv: 454| 7.44k| constexpr Self negate() const { 455| 7.44k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 7.44k| std::array r; // NOLINT(*-member-init) 458| 7.44k| W carry = 0; 459| 37.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 29.7k, False: 7.44k] ------------------ 460| 29.7k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 29.7k| } 462| | 463| 7.44k| return Self(r); 464| 7.44k| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 9.52k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 865| std::array stash_value() const { 762| 865| static_assert(L >= N); 763| 865| std::array stash = {}; 764| 4.32k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 3.46k, False: 865] ------------------ 765| 3.46k| stash[i] = m_val[i]; 766| 3.46k| } 767| 865| return stash; 768| 865| } pcurves_secp256r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1632| 173| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1633| 173| const BlindingRandomness blinding(rng); 1634| 173| const BlindedScalar scalar(s, blinding); 1635| 173| return basemul_booth_exec(m_table, scalar, blinding); 1636| 173| } pcurves_secp256r1.cpp:_ZN5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EEELm1EEC2ERNS_21RandomNumberGeneratorE: 1455| 173| explicit BlindingRandomness(RandomNumberGenerator& rng) : m_seeded(rng.is_seeded()) { 1456| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1457| 173| if(m_seeded) { ------------------ | Branch (1457:13): [True: 0, False: 173] ------------------ 1458| 0| std::array buf{}; 1459| 0| rng.randomize(buf); 1460| | 1461| 0| const std::span bytes(buf); 1462| | 1463| 0| copy_mem(m_masks, bytes.first()); 1464| | 1465| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1465:31): [True: 0, False: 0] ------------------ 1466| 0| const auto wide = bytes.subspan(Scalars * MaskBytes + i * WideBytes).first(); 1467| 0| m_rerandomizers[i] = FieldElement::from_wide_bytes(wide); 1468| 0| } 1469| | 1470| 0| const auto iso = bytes.subspan(Scalars * MaskBytes + Rerandomizations * WideBytes).first(); 1471| 0| m_isomorphism = FieldElement::from_wide_bytes(iso); 1472| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), FieldElement::one()); 1473| 0| } 1474| 173| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEC2Ev: 182| 692| constexpr IntMod() : m_val({}) {} pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 369| 7.26k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 370| 7.26k| const W mask = cond.into_bitmask(); 371| | 372| 36.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (372:28): [True: 29.0k, False: 7.26k] ------------------ 373| 29.0k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 374| 29.0k| } 375| 7.26k| } pcurves_secp256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EEC2INS_18BlindingRandomnessIS5_Lm1EEEEERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEERKT_m: 1368| 173| BlindedScalarBits(const typename C::Scalar& scalar, const Randomness& randomness, size_t idx = 0) { 1369| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1370| 173| if(BlindingBits > 0 && randomness.seeded()) { ------------------ | Branch (1370:13): [True: 173, Folded] | Branch (1370:33): [True: 0, False: 173] ------------------ 1371| 0| constexpr size_t n_words = C::Words; 1372| | 1373| 0| W mask[n_words] = {0}; 1374| 0| load_le(mask, randomness.mask(idx).data(), MaskWords); 1375| | 1376| | // Mask to exactly BlindingBits 1377| 0| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1378| 0| if constexpr(ExcessBits > 0) { 1379| 0| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1380| 0| mask[MaskWords - 1] &= ExcessMask; 1381| 0| } 1382| | 1383| | // Set top and bottom bits of mask 1384| 0| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1385| 0| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1386| 0| mask[0] |= 1; 1387| | 1388| 0| W mask_n[2 * n_words] = {0}; 1389| | 1390| 0| const auto sw = scalar.to_words(); 1391| | 1392| | // Compute masked scalar s + k*n 1393| 0| comba_mul(mask_n, mask, C::NW.data()); 1394| 0| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1395| | 1396| 0| std::reverse(mask_n, mask_n + 2 * n_words); 1397| 0| m_bytes = store_be>(mask_n); 1398| 0| m_bits = C::Scalar::BITS + BlindingBits; 1399| 173| } else { 1400| | // No RNG available, skip blinding 1401| 173| m_bytes.resize(C::Scalar::BYTES); 1402| 173| scalar.serialize_to(std::span{m_bytes}.template first()); 1403| 173| m_bits = C::Scalar::BITS; 1404| 173| } 1405| | 1406| 173| CT::poison(m_bytes.data(), m_bytes.size()); 1407| 173| } pcurves_secp256r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EEELm1EE6seededEv: 1476| 173| bool seeded() const { return m_seeded; } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_22Secp256r1MontgomeryRepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 346| constexpr static std::array from_rep(const std::array& z) { 140| 346| std::array ze = {}; 141| 346| copy_mem(std::span{ze}.template first(), z); 142| 346| return Self::redc(ze); 143| 346| } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_22Secp256r1MontgomeryRepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 520| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 520| } else { 110| 520| return monty_redc(z, P, P_dash); 111| 520| } 112| 520| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 346| constexpr void serialize_to(std::span bytes) const { 742| 346| auto v = Rep::from_rep(m_val); 743| 346| std::reverse(v.begin(), v.end()); 744| | 745| 346| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 346| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 346| } pcurves_secp256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EE4bitsEv: 1362| 173| size_t bits() const { return m_bits; } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1095| 173| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1096| 173| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1097| 173| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E6negateEv: 1194| 173| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1226| 173| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18_const_time_poisonEv: 891| 519| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_secp256r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EE10get_windowEm: 1409| 7.43k| size_t get_window(size_t offset) const { 1410| | // Extract a WindowBits sized window out of s, depending on offset. 1411| 7.43k| return read_window_bits(std::span{m_bytes}, offset); 1412| 7.43k| } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1121| 7.26k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1122| 7.26k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one(), A); 1123| 7.26k| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 966| 7.43k| static constexpr auto ct_select(std::span pts, size_t idx) { 967| 7.43k| auto result = Self::identity(pts[0]); 968| | 969| | // Intentionally wrapping; set to maximum size_t if idx == 0 970| 7.43k| const size_t idx1 = idx - 1; 971| 245k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (971:28): [True: 238k, False: 7.43k] ------------------ 972| 238k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 973| 238k| result.conditional_assign(found, pts[i]); 974| 238k| } 975| | 976| 7.43k| return result; 977| 7.43k| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE8identityERKSC_: 935| 7.43k| static constexpr Self identity(const Self& /*unused*/) { 936| 7.43k| return Self(FieldElement::zero(), FieldElement::zero()); 937| 7.43k| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 992| 238k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 993| 238k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 994| 238k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 382| 238k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 383| 238k| const W mask = cond.into_bitmask(); 384| | 385| 1.19M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (385:28): [True: 952k, False: 238k] ------------------ 386| 952k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 387| 952k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 388| 952k| } 389| 238k| } pcurves_secp256r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EEELm1EE13randomize_repERNS_20ProjectiveCurvePointINS_6IntModINS3_22Secp256r1MontgomeryRepINS_13EllipticCurveINS4_6ParamsESA_E11FieldParamsEEEEESC_EEm: 1486| 692| void randomize_rep(typename C::ProjectivePoint& pt, size_t idx) const { 1487| 692| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 692| do { \ | | 85| 692| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 692| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 692] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 692| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 692] | | ------------------ ------------------ 1488| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1489| 692| if(m_seeded) { ------------------ | Branch (1489:13): [True: 0, False: 692] ------------------ 1490| 0| pt.randomize_rep(m_rerandomizers[idx]); 1491| 0| } 1492| 692| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1228| 173| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE20_const_time_unpoisonEv: 893| 519| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_secp256r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm7EED2Ev: 1414| 173| ~BlindedScalarBits() { 1415| 173| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1416| 173| CT::unpoison(m_bytes.data(), m_bytes.size()); 1417| 173| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 519| static Self from_stash(const std::array& stash) { 777| 519| static_assert(L >= N); 778| 519| std::array val = {}; 779| 2.59k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 2.07k, False: 519] ------------------ 780| 2.07k| val[i] = stash[i]; 781| 2.07k| } 782| 519| return Self(val); 783| 519| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 693| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 346| constexpr void serialize_to(std::span bytes) const { 742| 346| auto v = Rep::from_rep(m_val); 743| 346| std::reverse(v.begin(), v.end()); 744| | 745| 346| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 346| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 346| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 173| std::array stash_value() const { 762| 173| static_assert(L >= N); 763| 173| std::array stash = {}; 764| 865| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 692, False: 173] ------------------ 765| 692| stash[i] = m_val[i]; 766| 692| } 767| 173| return stash; 768| 173| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 1.21k| static Self from_stash(const std::array& stash) { 777| 1.21k| static_assert(L >= N); 778| 1.21k| std::array val = {}; 779| 6.05k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 4.84k, False: 1.21k] ------------------ 780| 4.84k| val[i] = stash[i]; 781| 4.84k| } 782| 1.21k| return Self(val); 783| 1.21k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE7is_zeroEv: 227| 347| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEeqERKSA_: 724| 173| constexpr CT::Choice operator==(const Self& other) const { 725| 173| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 173| } pcurves_secp256r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS2_22Secp256r1MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1327| 173| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 175| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 175| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 175] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 175| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 175| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 1, False: 174] ------------------ 804| 1| return {}; 805| 1| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 174| return Self::from_words(words); 809| 175| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE10from_wordsILm4EEESB_NSt3__15arrayImXT_EEE: 213| 174| static constexpr Self from_words(std::array w) { 214| 174| if constexpr(L == N) { 215| 174| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 174| } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_22Secp256r1MontgomeryRepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 174| constexpr static std::array to_rep(const std::array& x) { 118| 174| std::array z; // NOLINT(*-member-init) 119| 174| comba_mul(z.data(), x.data(), R2.data()); 120| 174| return Self::redc(z); 121| 174| } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm65EEE: 952| 173| constexpr void serialize_to(std::span bytes) const { 953| 173| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 173| do { \ | | 52| 173| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 173| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 173] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 173| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 173] | | ------------------ ------------------ 954| 173| BufferStuffer pack(bytes); 955| 173| pack.append(0x04); 956| 173| x().serialize_to(pack.next()); 957| 173| y().serialize_to(pack.next()); 958| 173| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 173| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 173| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 173] | | ------------------ ------------------ 959| 173| } pcurves_secp384r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 194| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 194| const auto x = pt.x(); 1038| 194| auto y = pt.y(); 1039| 194| auto z = FieldElement::one(); 1040| | 1041| 194| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 194| return ProjectiveCurvePoint(x, y, z); 1044| 194| } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE1xEv: 982| 440k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE1yEv: 987| 427k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE3oneEv: 202| 12.7k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEC2ENSt3__15arrayImLm6EEE: 908| 345k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 194| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 194| const W mask = cond.into_bitmask(); 414| | 415| 1.35k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 1.16k, False: 194] ------------------ 416| 1.16k| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 1.16k| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 1.16k| x.m_val[i] = nx; 419| 1.16k| y.m_val[i] = ny; 420| 1.16k| } 421| 194| } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE11is_identityEv: 939| 13.1k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE7is_zeroEv: 227| 70.0k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 15.2k| m_x(x), m_y(y), m_z(z) {} pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.24k| constexpr Self dbl() const { 1182| 1.24k| if constexpr(Self::A_is_minus_3) { 1183| 1.24k| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 1.24k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1zEv: 1224| 83.1k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6squareEv: 428| 49.7k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 49.7k| std::array z; // NOLINT(*-member-init) 430| 49.7k| comba_sqr(z.data(), this->data()); 431| 49.7k| return Self(Rep::redc(z)); 432| 49.7k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4dataEv: 898| 405k| constexpr const W* data() const { return m_val.data(); } pcurves_secp384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 348| 131k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 131k| std::array z; // NOLINT(*-member-init) 350| 131k| comba_mul(z.data(), a.data(), b.data()); 351| 131k| return Self(Rep::redc(z)); 352| 131k| } pcurves_secp384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 283| 85.6k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 85.6k| std::array r; // NOLINT(*-member-init) 285| 85.6k| W carry = 0; 286| 599k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 513k, False: 85.6k] ------------------ 287| 513k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 513k| } 289| | 290| 85.6k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 85.6k| carry = 0; 293| | 294| 599k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 513k, False: 85.6k] ------------------ 295| 513k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 513k| } 297| | 298| 85.6k| return Self(r); 299| 85.6k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1xEv: 1214| 48.2k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul3Ev: 337| 1.24k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp384r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 267| 16.5k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 16.5k| std::array t; // NOLINT(*-member-init) 269| | 270| 16.5k| W carry = 0; 271| 115k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 99.3k, False: 16.5k] ------------------ 272| 99.3k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 99.3k| } 274| | 275| 16.5k| std::array r; // NOLINT(*-member-init) 276| 16.5k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 16.5k| return Self(r); 278| 16.5k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1yEv: 1219| 47.0k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul4Ev: 340| 1.24k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul2Ev: 327| 9.92k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 9.92k| std::array t = value(); 329| 9.92k| const W carry = shift_left<1>(t); 330| | 331| 9.92k| std::array r; // NOLINT(*-member-init) 332| 9.92k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 9.92k| return Self(r); 334| 9.92k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE5valueEv: 896| 9.92k| constexpr const std::array& value() const { return m_val; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul8Ev: 343| 1.24k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EESE_: 1075| 1.09k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.09k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 16.8k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 27.0k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 27.0k| const W mask = cond.into_bitmask(); 399| | 400| 189k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 162k, False: 27.0k] ------------------ 401| 162k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 162k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 162k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 162k| } 405| 27.0k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEmLERKSA_: 357| 2.50k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 2.50k| std::array z; // NOLINT(*-member-init) 359| 2.50k| comba_mul(z.data(), data(), other.data()); 360| 2.50k| m_val = Rep::redc(z); 361| 2.50k| return (*this); 362| 2.50k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE8square_nEm: 441| 2.31k| constexpr void square_n(size_t n) { 442| 2.31k| std::array z; // NOLINT(*-member-init) 443| 75.8k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 73.5k, False: 2.31k] ------------------ 444| 73.5k| comba_sqr(z.data(), this->data()); 445| 73.5k| m_val = Rep::redc(z); 446| 73.5k| } 447| 2.31k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 252| for(;;) { 620| | // Conditional ok: this function is variable time 621| 252| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 251] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 251| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 251| std::array r; // NOLINT(*-member-init) 642| 251| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 251| if(carry == 0) { ------------------ | Branch (645:16): [True: 118, False: 133] ------------------ 646| | // b > a 647| 118| b.m_val = r; 648| 118| x = nx; 649| 118| Self::_invert_vartime_div2_helper(b, x); 650| 133| } else { 651| | // We know this can't underflow because a > b 652| 133| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 133| a.m_val = r; 654| 133| y = nx; 655| 133| Self::_invert_vartime_div2_helper(a, y); 656| 133| } 657| 251| } 658| 1| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4zeroEv: 197| 25.0k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 253| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 253| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 809| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 556, False: 253] ------------------ 554| 556| shift_right<1>(a.m_val); 555| | 556| 556| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 556| if(borrow) { ------------------ | Branch (559:16): [True: 248, False: 308] ------------------ 560| 248| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 248| } 562| 556| } 563| 253| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6negateEv: 454| 12.5k| constexpr Self negate() const { 455| 12.5k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 12.5k| std::array r; // NOLINT(*-member-init) 458| 12.5k| W carry = 0; 459| 87.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 75.2k, False: 12.5k] ------------------ 460| 75.2k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 75.2k| } 462| | 463| 12.5k| return Self(r); 464| 12.5k| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 15.4k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 965| std::array stash_value() const { 762| 965| static_assert(L >= N); 763| 965| std::array stash = {}; 764| 6.75k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 5.79k, False: 965] ------------------ 765| 5.79k| stash[i] = m_val[i]; 766| 5.79k| } 767| 965| return stash; 768| 965| } pcurves_secp384r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1632| 193| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1633| 193| const BlindingRandomness blinding(rng); 1634| 193| const BlindedScalar scalar(s, blinding); 1635| 193| return basemul_booth_exec(m_table, scalar, blinding); 1636| 193| } pcurves_secp384r1.cpp:_ZN5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EEELm1EEC2ERNS_21RandomNumberGeneratorE: 1455| 193| explicit BlindingRandomness(RandomNumberGenerator& rng) : m_seeded(rng.is_seeded()) { 1456| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1457| 193| if(m_seeded) { ------------------ | Branch (1457:13): [True: 0, False: 193] ------------------ 1458| 0| std::array buf{}; 1459| 0| rng.randomize(buf); 1460| | 1461| 0| const std::span bytes(buf); 1462| | 1463| 0| copy_mem(m_masks, bytes.first()); 1464| | 1465| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1465:31): [True: 0, False: 0] ------------------ 1466| 0| const auto wide = bytes.subspan(Scalars * MaskBytes + i * WideBytes).first(); 1467| 0| m_rerandomizers[i] = FieldElement::from_wide_bytes(wide); 1468| 0| } 1469| | 1470| 0| const auto iso = bytes.subspan(Scalars * MaskBytes + Rerandomizations * WideBytes).first(); 1471| 0| m_isomorphism = FieldElement::from_wide_bytes(iso); 1472| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), FieldElement::one()); 1473| 0| } 1474| 193| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEC2Ev: 182| 772| constexpr IntMod() : m_val({}) {} pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 369| 12.3k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 370| 12.3k| const W mask = cond.into_bitmask(); 371| | 372| 86.4k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (372:28): [True: 74.1k, False: 12.3k] ------------------ 373| 74.1k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 374| 74.1k| } 375| 12.3k| } pcurves_secp384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EEC2INS_18BlindingRandomnessIS5_Lm1EEEEERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEERKT_m: 1368| 193| BlindedScalarBits(const typename C::Scalar& scalar, const Randomness& randomness, size_t idx = 0) { 1369| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1370| 193| if(BlindingBits > 0 && randomness.seeded()) { ------------------ | Branch (1370:13): [True: 193, Folded] | Branch (1370:33): [True: 0, False: 193] ------------------ 1371| 0| constexpr size_t n_words = C::Words; 1372| | 1373| 0| W mask[n_words] = {0}; 1374| 0| load_le(mask, randomness.mask(idx).data(), MaskWords); 1375| | 1376| | // Mask to exactly BlindingBits 1377| 0| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1378| 0| if constexpr(ExcessBits > 0) { 1379| 0| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1380| 0| mask[MaskWords - 1] &= ExcessMask; 1381| 0| } 1382| | 1383| | // Set top and bottom bits of mask 1384| 0| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1385| 0| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1386| 0| mask[0] |= 1; 1387| | 1388| 0| W mask_n[2 * n_words] = {0}; 1389| | 1390| 0| const auto sw = scalar.to_words(); 1391| | 1392| | // Compute masked scalar s + k*n 1393| 0| comba_mul(mask_n, mask, C::NW.data()); 1394| 0| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1395| | 1396| 0| std::reverse(mask_n, mask_n + 2 * n_words); 1397| 0| m_bytes = store_be>(mask_n); 1398| 0| m_bits = C::Scalar::BITS + BlindingBits; 1399| 193| } else { 1400| | // No RNG available, skip blinding 1401| 193| m_bytes.resize(C::Scalar::BYTES); 1402| 193| scalar.serialize_to(std::span{m_bytes}.template first()); 1403| 193| m_bits = C::Scalar::BITS; 1404| 193| } 1405| | 1406| 193| CT::poison(m_bytes.data(), m_bytes.size()); 1407| 193| } pcurves_secp384r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EEELm1EE6seededEv: 1476| 193| bool seeded() const { return m_seeded; } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm6EEE: 139| 386| constexpr static std::array from_rep(const std::array& z) { 140| 386| std::array ze = {}; 141| 386| copy_mem(std::span{ze}.template first(), z); 142| 386| return Self::redc(ze); 143| 386| } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm12EEE: 106| 581| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 581| } else { 110| 581| return monty_redc(z, P, P_dash); 111| 581| } 112| 581| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 741| 386| constexpr void serialize_to(std::span bytes) const { 742| 386| auto v = Rep::from_rep(m_val); 743| 386| std::reverse(v.begin(), v.end()); 744| | 745| 386| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 386| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 386| } pcurves_secp384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EE4bitsEv: 1362| 193| size_t bits() const { return m_bits; } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1095| 193| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1096| 193| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1097| 193| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E6negateEv: 1194| 193| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1226| 193| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18_const_time_poisonEv: 891| 579| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_secp384r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EE10get_windowEm: 1409| 12.5k| size_t get_window(size_t offset) const { 1410| | // Extract a WindowBits sized window out of s, depending on offset. 1411| 12.5k| return read_window_bits(std::span{m_bytes}, offset); 1412| 12.5k| } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1121| 12.3k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1122| 12.3k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one(), A); 1123| 12.3k| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 966| 12.5k| static constexpr auto ct_select(std::span pts, size_t idx) { 967| 12.5k| auto result = Self::identity(pts[0]); 968| | 969| | // Intentionally wrapping; set to maximum size_t if idx == 0 970| 12.5k| const size_t idx1 = idx - 1; 971| 413k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (971:28): [True: 401k, False: 12.5k] ------------------ 972| 401k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 973| 401k| result.conditional_assign(found, pts[i]); 974| 401k| } 975| | 976| 12.5k| return result; 977| 12.5k| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE8identityERKSC_: 935| 12.5k| static constexpr Self identity(const Self& /*unused*/) { 936| 12.5k| return Self(FieldElement::zero(), FieldElement::zero()); 937| 12.5k| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 992| 401k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 993| 401k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 994| 401k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 382| 401k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 383| 401k| const W mask = cond.into_bitmask(); 384| | 385| 2.81M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (385:28): [True: 2.40M, False: 401k] ------------------ 386| 2.40M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 387| 2.40M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 388| 2.40M| } 389| 401k| } pcurves_secp384r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EEELm1EE13randomize_repERNS_20ProjectiveCurvePointINS_6IntModINS3_12Secp384r1RepINS_13EllipticCurveINS4_6ParamsESA_E11FieldParamsEEEEESC_EEm: 1486| 772| void randomize_rep(typename C::ProjectivePoint& pt, size_t idx) const { 1487| 772| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 772| do { \ | | 85| 772| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 772| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 772] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 772| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 772] | | ------------------ ------------------ 1488| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1489| 772| if(m_seeded) { ------------------ | Branch (1489:13): [True: 0, False: 772] ------------------ 1490| 0| pt.randomize_rep(m_rerandomizers[idx]); 1491| 0| } 1492| 772| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1228| 193| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE20_const_time_unpoisonEv: 893| 579| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_secp384r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm7EED2Ev: 1414| 193| ~BlindedScalarBits() { 1415| 193| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1416| 193| CT::unpoison(m_bytes.data(), m_bytes.size()); 1417| 193| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 579| static Self from_stash(const std::array& stash) { 777| 579| static_assert(L >= N); 778| 579| std::array val = {}; 779| 4.05k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 3.47k, False: 579] ------------------ 780| 3.47k| val[i] = stash[i]; 781| 3.47k| } 782| 579| return Self(val); 783| 579| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm6EEE: 908| 774| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 741| 386| constexpr void serialize_to(std::span bytes) const { 742| 386| auto v = Rep::from_rep(m_val); 743| 386| std::reverse(v.begin(), v.end()); 744| | 745| 386| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 386| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 386| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 193| std::array stash_value() const { 762| 193| static_assert(L >= N); 763| 193| std::array stash = {}; 764| 1.35k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 1.15k, False: 193] ------------------ 765| 1.15k| stash[i] = m_val[i]; 766| 1.15k| } 767| 193| return stash; 768| 193| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 1.35k| static Self from_stash(const std::array& stash) { 777| 1.35k| static_assert(L >= N); 778| 1.35k| std::array val = {}; 779| 9.45k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 8.10k, False: 1.35k] ------------------ 780| 8.10k| val[i] = stash[i]; 781| 8.10k| } 782| 1.35k| return Self(val); 783| 1.35k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE7is_zeroEv: 227| 388| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEeqERKSA_: 724| 193| constexpr CT::Choice operator==(const Self& other) const { 725| 193| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 193| } pcurves_secp384r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS2_12Secp384r1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1327| 193| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 195| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 195| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 195] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 195| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 195| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 195] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 195| return Self::from_words(words); 809| 195| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE10from_wordsILm6EEESB_NSt3__15arrayImXT_EEE: 213| 195| static constexpr Self from_words(std::array w) { 214| 195| if constexpr(L == N) { 215| 195| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 195| } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm6EEE: 117| 195| constexpr static std::array to_rep(const std::array& x) { 118| 195| std::array z; // NOLINT(*-member-init) 119| 195| comba_mul(z.data(), x.data(), R2.data()); 120| 195| return Self::redc(z); 121| 195| } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm97EEE: 952| 193| constexpr void serialize_to(std::span bytes) const { 953| 193| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 193| do { \ | | 52| 193| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 193| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 193] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 193| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 193] | | ------------------ ------------------ 954| 193| BufferStuffer pack(bytes); 955| 193| pack.append(0x04); 956| 193| x().serialize_to(pack.next()); 957| 193| y().serialize_to(pack.next()); 958| 193| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 193| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 193| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 193] | | ------------------ ------------------ 959| 193| } pcurves_secp521r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 251| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 251| const auto x = pt.x(); 1038| 251| auto y = pt.y(); 1039| 251| auto z = FieldElement::one(); 1040| | 1041| 251| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 251| return ProjectiveCurvePoint(x, y, z); 1044| 251| } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 762k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 741k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 22.0k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm9EEE: 908| 571k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 251| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 251| const W mask = cond.into_bitmask(); 414| | 415| 2.51k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 2.25k, False: 251] ------------------ 416| 2.25k| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 2.25k| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 2.25k| x.m_val[i] = nx; 419| 2.25k| y.m_val[i] = ny; 420| 2.25k| } 421| 251| } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 22.5k| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 118k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 25.3k| m_x(x), m_y(y), m_z(z) {} pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.64k| constexpr Self dbl() const { 1182| 1.64k| if constexpr(Self::A_is_minus_3) { 1183| 1.64k| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 1.64k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 135k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 81.4k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 81.4k| std::array z; // NOLINT(*-member-init) 430| 81.4k| comba_sqr(z.data(), this->data()); 431| 81.4k| return Self(Rep::redc(z)); 432| 81.4k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 671k| constexpr const W* data() const { return m_val.data(); } pcurves_secp521r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 215k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 215k| std::array z; // NOLINT(*-member-init) 350| 215k| comba_mul(z.data(), a.data(), b.data()); 351| 215k| return Self(Rep::redc(z)); 352| 215k| } pcurves_secp521r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 144k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 144k| std::array r; // NOLINT(*-member-init) 285| 144k| W carry = 0; 286| 1.44M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 1.29M, False: 144k] ------------------ 287| 1.29M| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 1.29M| } 289| | 290| 144k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 144k| carry = 0; 293| | 294| 1.44M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 1.29M, False: 144k] ------------------ 295| 1.29M| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 1.29M| } 297| | 298| 144k| return Self(r); 299| 144k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 79.3k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 1.64k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp521r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 27.2k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 27.2k| std::array t; // NOLINT(*-member-init) 269| | 270| 27.2k| W carry = 0; 271| 272k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 245k, False: 27.2k] ------------------ 272| 245k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 245k| } 274| | 275| 27.2k| std::array r; // NOLINT(*-member-init) 276| 27.2k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 27.2k| return Self(r); 278| 27.2k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 77.7k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 1.64k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 13.1k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 13.1k| std::array t = value(); 329| 13.1k| const W carry = shift_left<1>(t); 330| | 331| 13.1k| std::array r; // NOLINT(*-member-init) 332| 13.1k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 13.1k| return Self(r); 334| 13.1k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 13.1k| constexpr const std::array& value() const { return m_val; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 1.64k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp521r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 1.45k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.45k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 27.5k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 46.1k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 46.1k| const W mask = cond.into_bitmask(); 399| | 400| 461k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 415k, False: 46.1k] ------------------ 401| 415k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 415k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 415k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 415k| } 405| 46.1k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEmLERKSA_: 357| 3.00k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 3.00k| std::array z; // NOLINT(*-member-init) 359| 3.00k| comba_mul(z.data(), data(), other.data()); 360| 3.00k| m_val = Rep::redc(z); 361| 3.00k| return (*this); 362| 3.00k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8square_nEm: 441| 2.75k| constexpr void square_n(size_t n) { 442| 2.75k| std::array z; // NOLINT(*-member-init) 443| 132k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 129k, False: 2.75k] ------------------ 444| 129k| comba_sqr(z.data(), this->data()); 445| 129k| m_val = Rep::redc(z); 446| 129k| } 447| 2.75k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 350| for(;;) { 620| | // Conditional ok: this function is variable time 621| 350| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 349] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 349| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 349| std::array r; // NOLINT(*-member-init) 642| 349| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 349| if(carry == 0) { ------------------ | Branch (645:16): [True: 170, False: 179] ------------------ 646| | // b > a 647| 170| b.m_val = r; 648| 170| x = nx; 649| 170| Self::_invert_vartime_div2_helper(b, x); 650| 179| } else { 651| | // We know this can't underflow because a > b 652| 179| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 179| a.m_val = r; 654| 179| y = nx; 655| 179| Self::_invert_vartime_div2_helper(a, y); 656| 179| } 657| 349| } 658| 1| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4zeroEv: 197| 43.5k| static constexpr Self zero() { return Self(std::array{0}); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 351| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 351| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 1.09k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 742, False: 351] ------------------ 554| 742| shift_right<1>(a.m_val); 555| | 556| 742| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 742| if(borrow) { ------------------ | Branch (559:16): [True: 109, False: 633] ------------------ 560| 109| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 109| } 562| 742| } 563| 351| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 21.7k| constexpr Self negate() const { 455| 21.7k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 21.7k| std::array r; // NOLINT(*-member-init) 458| 21.7k| W carry = 0; 459| 217k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 195k, False: 21.7k] ------------------ 460| 195k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 195k| } 462| | 463| 21.7k| return Self(r); 464| 21.7k| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 25.6k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 1.25k| std::array stash_value() const { 762| 1.25k| static_assert(L >= N); 763| 1.25k| std::array stash = {}; 764| 12.5k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 11.2k, False: 1.25k] ------------------ 765| 11.2k| stash[i] = m_val[i]; 766| 11.2k| } 767| 1.25k| return stash; 768| 1.25k| } pcurves_secp521r1.cpp:_ZNK5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EE3mulERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEERNS_21RandomNumberGeneratorE: 1632| 250| ProjectivePoint mul(const Scalar& s, RandomNumberGenerator& rng) const { 1633| 250| const BlindingRandomness blinding(rng); 1634| 250| const BlindedScalar scalar(s, blinding); 1635| 250| return basemul_booth_exec(m_table, scalar, blinding); 1636| 250| } pcurves_secp521r1.cpp:_ZN5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EEELm1EEC2ERNS_21RandomNumberGeneratorE: 1455| 250| explicit BlindingRandomness(RandomNumberGenerator& rng) : m_seeded(rng.is_seeded()) { 1456| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1457| 250| if(m_seeded) { ------------------ | Branch (1457:13): [True: 0, False: 250] ------------------ 1458| 0| std::array buf{}; 1459| 0| rng.randomize(buf); 1460| | 1461| 0| const std::span bytes(buf); 1462| | 1463| 0| copy_mem(m_masks, bytes.first()); 1464| | 1465| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1465:31): [True: 0, False: 0] ------------------ 1466| 0| const auto wide = bytes.subspan(Scalars * MaskBytes + i * WideBytes).first(); 1467| 0| m_rerandomizers[i] = FieldElement::from_wide_bytes(wide); 1468| 0| } 1469| | 1470| 0| const auto iso = bytes.subspan(Scalars * MaskBytes + Rerandomizations * WideBytes).first(); 1471| 0| m_isomorphism = FieldElement::from_wide_bytes(iso); 1472| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), FieldElement::one()); 1473| 0| } 1474| 250| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2Ev: 182| 1.00k| constexpr IntMod() : m_val({}) {} pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_: 369| 21.5k| constexpr void conditional_assign(CT::Choice cond, const Self& nx) { 370| 21.5k| const W mask = cond.into_bitmask(); 371| | 372| 215k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (372:28): [True: 193k, False: 21.5k] ------------------ 373| 193k| m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]); 374| 193k| } 375| 21.5k| } pcurves_secp521r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EEC2INS_18BlindingRandomnessIS5_Lm1EEEEERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEERKT_m: 1368| 250| BlindedScalarBits(const typename C::Scalar& scalar, const Randomness& randomness, size_t idx = 0) { 1369| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1370| 250| if(BlindingBits > 0 && randomness.seeded()) { ------------------ | Branch (1370:13): [True: 250, Folded] | Branch (1370:33): [True: 0, False: 250] ------------------ 1371| 0| constexpr size_t n_words = C::Words; 1372| | 1373| 0| W mask[n_words] = {0}; 1374| 0| load_le(mask, randomness.mask(idx).data(), MaskWords); 1375| | 1376| | // Mask to exactly BlindingBits 1377| 0| constexpr size_t ExcessBits = MaskWords * WordInfo::bits - BlindingBits; 1378| 0| if constexpr(ExcessBits > 0) { 1379| 0| constexpr W ExcessMask = (static_cast(1) << (WordInfo::bits - ExcessBits)) - 1; 1380| 0| mask[MaskWords - 1] &= ExcessMask; 1381| 0| } 1382| | 1383| | // Set top and bottom bits of mask 1384| 0| constexpr size_t TopMaskBit = (BlindingBits - 1) % WordInfo::bits; 1385| 0| mask[(BlindingBits - 1) / WordInfo::bits] |= static_cast(1) << TopMaskBit; 1386| 0| mask[0] |= 1; 1387| | 1388| 0| W mask_n[2 * n_words] = {0}; 1389| | 1390| 0| const auto sw = scalar.to_words(); 1391| | 1392| | // Compute masked scalar s + k*n 1393| 0| comba_mul(mask_n, mask, C::NW.data()); 1394| 0| bigint_add2(mask_n, 2 * n_words, sw.data(), sw.size()); 1395| | 1396| 0| std::reverse(mask_n, mask_n + 2 * n_words); 1397| 0| m_bytes = store_be>(mask_n); 1398| 0| m_bits = C::Scalar::BITS + BlindingBits; 1399| 250| } else { 1400| | // No RNG available, skip blinding 1401| 250| m_bytes.resize(C::Scalar::BYTES); 1402| 250| scalar.serialize_to(std::span{m_bytes}.template first()); 1403| 250| m_bits = C::Scalar::BITS; 1404| 250| } 1405| | 1406| 250| CT::poison(m_bytes.data(), m_bytes.size()); 1407| 250| } pcurves_secp521r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EEELm1EE6seededEv: 1476| 250| bool seeded() const { return m_seeded; } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm9EEE: 139| 500| constexpr static std::array from_rep(const std::array& z) { 140| 500| std::array ze = {}; 141| 500| copy_mem(std::span{ze}.template first(), z); 142| 500| return Self::redc(ze); 143| 500| } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm18EEE: 106| 751| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 751| } else { 110| 751| return monty_redc(z, P, P_dash); 111| 751| } 112| 751| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm66EEE: 741| 500| constexpr void serialize_to(std::span bytes) const { 742| 500| auto v = Rep::from_rep(m_val); 743| 500| std::reverse(v.begin(), v.end()); 744| | 745| | if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| | store_be(bytes, v); 747| 500| } else { 748| | // Remove leading zero bytes 749| 500| const auto padded_bytes = store_be(v); 750| 500| constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| 500| copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| 500| } 753| 500| } pcurves_secp521r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EE4bitsEv: 1362| 250| size_t bits() const { return m_bits; } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E18conditional_assignENS_2CT6ChoiceERKSC_: 1095| 250| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 1096| 250| FieldElement::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1097| 250| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E6negateEv: 1194| 250| constexpr Self negate() const { return Self(x(), y().negate(), z()); } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E18_const_time_poisonEv: 1226| 250| constexpr void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18_const_time_poisonEv: 891| 750| constexpr void _const_time_poison() const { CT::poison(m_val); } pcurves_secp521r1.cpp:_ZNK5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EE10get_windowEm: 1409| 21.7k| size_t get_window(size_t offset) const { 1410| | // Extract a WindowBits sized window out of s, depending on offset. 1411| 21.7k| return read_window_bits(std::span{m_bytes}, offset); 1412| 21.7k| } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E10add_or_subERKSC_RKNS_16AffineCurvePointISB_EENS_2CT6ChoiceE: 1121| 21.5k| constexpr static Self add_or_sub(const Self& a, const AffinePoint& b, CT::Choice sub) { 1122| 21.5k| return point_add_or_sub_mixed(a, b, sub, FieldElement::one(), A); 1123| 21.5k| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE9ct_selectENSt3__14spanIKSC_Lm18446744073709551615EEEm: 966| 21.7k| static constexpr auto ct_select(std::span pts, size_t idx) { 967| 21.7k| auto result = Self::identity(pts[0]); 968| | 969| | // Intentionally wrapping; set to maximum size_t if idx == 0 970| 21.7k| const size_t idx1 = idx - 1; 971| 717k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (971:28): [True: 696k, False: 21.7k] ------------------ 972| 696k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 973| 696k| result.conditional_assign(found, pts[i]); 974| 696k| } 975| | 976| 21.7k| return result; 977| 21.7k| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE8identityERKSC_: 935| 21.7k| static constexpr Self identity(const Self& /*unused*/) { 936| 21.7k| return Self(FieldElement::zero(), FieldElement::zero()); 937| 21.7k| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE18conditional_assignENS_2CT6ChoiceERKSC_: 992| 696k| constexpr void conditional_assign(CT::Choice cond, const Self& pt) { 993| 696k| FieldElement::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 994| 696k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_NS_2CT6ChoiceERKSA_SF_: 382| 696k| static constexpr void conditional_assign(Self& x, Self& y, CT::Choice cond, const Self& nx, const Self& ny) { 383| 696k| const W mask = cond.into_bitmask(); 384| | 385| 6.96M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (385:28): [True: 6.26M, False: 696k] ------------------ 386| 6.26M| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 387| 6.26M| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 388| 6.26M| } 389| 696k| } pcurves_secp521r1.cpp:_ZNK5Botan18BlindingRandomnessINS_17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EEELm1EE13randomize_repERNS_20ProjectiveCurvePointINS_6IntModINS4_7P521RepINS_13EllipticCurveINS4_6ParamsESA_E11FieldParamsEEEEESC_EEm: 1486| 1.00k| void randomize_rep(typename C::ProjectivePoint& pt, size_t idx) const { 1487| 1.00k| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 1.00k| do { \ | | 85| 1.00k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 1.00k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 1.00k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 1.00k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 1.00k] | | ------------------ ------------------ 1488| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1489| 1.00k| if(m_seeded) { ------------------ | Branch (1489:13): [True: 0, False: 1.00k] ------------------ 1490| 0| pt.randomize_rep(m_rerandomizers[idx]); 1491| 0| } 1492| 1.00k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E20_const_time_unpoisonEv: 1228| 250| constexpr void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE20_const_time_unpoisonEv: 893| 750| constexpr void _const_time_unpoison() const { CT::unpoison(m_val); } pcurves_secp521r1.cpp:_ZN5Botan17BlindedScalarBitsINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm7EED2Ev: 1414| 250| ~BlindedScalarBits() { 1415| 250| secure_zeroize_buffer(m_bytes.data(), m_bytes.size()); 1416| 250| CT::unpoison(m_bytes.data(), m_bytes.size()); 1417| 250| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 750| static Self from_stash(const std::array& stash) { 777| 750| static_assert(L >= N); 778| 750| std::array val = {}; 779| 7.50k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 6.75k, False: 750] ------------------ 780| 6.75k| val[i] = stash[i]; 781| 6.75k| } 782| 750| return Self(val); 783| 750| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm9EEE: 908| 1.00k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm66EEE: 741| 502| constexpr void serialize_to(std::span bytes) const { 742| 502| auto v = Rep::from_rep(m_val); 743| 502| std::reverse(v.begin(), v.end()); 744| | 745| | if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| | store_be(bytes, v); 747| 502| } else { 748| | // Remove leading zero bytes 749| 502| const auto padded_bytes = store_be(v); 750| 502| constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| 502| copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| 502| } 753| 502| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 250| std::array stash_value() const { 762| 250| static_assert(L >= N); 763| 250| std::array stash = {}; 764| 2.50k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 2.25k, False: 250] ------------------ 765| 2.25k| stash[i] = m_val[i]; 766| 2.25k| } 767| 250| return stash; 768| 250| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 1.75k| static Self from_stash(const std::array& stash) { 777| 1.75k| static_assert(L >= N); 778| 1.75k| std::array val = {}; 779| 17.5k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 15.7k, False: 1.75k] ------------------ 780| 15.7k| val[i] = stash[i]; 781| 15.7k| } 782| 1.75k| return Self(val); 783| 1.75k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE7is_zeroEv: 227| 501| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 156| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 156| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 156] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 156| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 156| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 3, False: 153] ------------------ 804| 3| return {}; 805| 3| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 153| return Self::from_words(words); 809| 156| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEeqERKSA_: 724| 326| constexpr CT::Choice operator==(const Self& other) const { 725| 326| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 326| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_wordsILm9EEESA_NSt3__15arrayImXT_EEE: 213| 153| static constexpr Self from_words(std::array w) { 214| 153| if constexpr(L == N) { 215| 153| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 153| } pcurves_secp521r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS3_7P521RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE: 1327| 326| static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 252| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 252| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 252] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 252| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 252| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 1, False: 251] ------------------ 804| 1| return {}; 805| 1| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 251| return Self::from_words(words); 809| 252| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE10from_wordsILm9EEESB_NSt3__15arrayImXT_EEE: 213| 251| static constexpr Self from_words(std::array w) { 214| 251| if constexpr(L == N) { 215| 251| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 251| } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm9EEE: 117| 251| constexpr static std::array to_rep(const std::array& x) { 118| 251| std::array z; // NOLINT(*-member-init) 119| 251| comba_mul(z.data(), x.data(), R2.data()); 120| 251| return Self::redc(z); 121| 251| } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm133EEE: 952| 251| constexpr void serialize_to(std::span bytes) const { 953| 251| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 251| do { \ | | 52| 251| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 251| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 251] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 251| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 251] | | ------------------ ------------------ 954| 251| BufferStuffer pack(bytes); 955| 251| pack.append(0x04); 956| 251| x().serialize_to(pack.next()); 957| 251| y().serialize_to(pack.next()); 958| 251| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 251| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 251| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 251] | | ------------------ ------------------ 959| 251| } pcurves_brainpool256r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 49, False: 1] ------------------ 196| 49| table.push_back(accum); 197| | 198| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.51k, False: 49] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.51k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 784, False: 735] ------------------ 201| 784| table.emplace_back(table[i + j / 2].dbl()); 202| 784| } else { 203| 735| table.emplace_back(table[i + j - 1] + table[i]); 204| 735| } 205| 1.51k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 49| accum = table[i + WindowElements - 1].dbl(); 210| 49| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_brainpool256r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 175| const Blinding& blinding) { 220| 175| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 175| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 175| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 175| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 175| const size_t raw = w_bits << 1; 228| 175| const auto [tidx, tneg] = booth_recode(raw); 229| 175| const auto tbl_0 = table.first(WindowElements); 230| | 231| 175| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 175| pt.conditional_assign(tneg, pt.negate()); 233| 175| CT::poison(pt); 234| 175| blinding.randomize_rep(pt, 0); 235| 175| return pt; 236| 175| }(); 237| | 238| 7.52k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 7.35k, False: 175] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 7.35k| const size_t bit_pos = WindowBits * i - 1; 241| 7.35k| const size_t raw = scalar.get_window(bit_pos); 242| 7.35k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 7.35k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 7.35k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 7.35k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 525, False: 6.82k] ------------------ 250| 525| blinding.randomize_rep(accum, i); 251| 525| } 252| 7.35k| } 253| | 254| 175| CT::unpoison(accum); 255| 175| return accum; 256| 175|} pcurves_brainpool256r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 175| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 175| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 175| const size_t raw = w_bits << 1; 228| 175| const auto [tidx, tneg] = booth_recode(raw); 229| 175| const auto tbl_0 = table.first(WindowElements); 230| | 231| 175| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 175| pt.conditional_assign(tneg, pt.negate()); 233| 175| CT::poison(pt); 234| 175| blinding.randomize_rep(pt, 0); 235| 175| return pt; 236| 175| }(); _ZN5Botan20scalar_blinding_bitsEm: 42| 1.10k|constexpr size_t scalar_blinding_bits(size_t scalar_bits) { 43| | // For blinding use 1/8 the order length for most curves; for P-521 we round down a bit 44| | // so the masked scalar fits exactly in 9 or 18 words. 45| | 46| 1.10k| if(scalar_bits == 521) { ------------------ | Branch (46:7): [True: 6, False: 1.10k] ------------------ 47| 6| return 55; 48| 1.10k| } else { 49| 1.10k| return scalar_bits / 8; 50| 1.10k| } 51| 1.10k|} pcurves_brainpool384r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 74| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 73, False: 1] ------------------ 196| 73| table.push_back(accum); 197| | 198| 2.33k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 2.26k, False: 73] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 2.26k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.16k, False: 1.09k] ------------------ 201| 1.16k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.16k| } else { 203| 1.09k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.09k| } 205| 2.26k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 73| accum = table[i + WindowElements - 1].dbl(); 210| 73| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_brainpool384r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 150| const Blinding& blinding) { 220| 150| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 150| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 150| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 150| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 150| const size_t raw = w_bits << 1; 228| 150| const auto [tidx, tneg] = booth_recode(raw); 229| 150| const auto tbl_0 = table.first(WindowElements); 230| | 231| 150| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 150| pt.conditional_assign(tneg, pt.negate()); 233| 150| CT::poison(pt); 234| 150| blinding.randomize_rep(pt, 0); 235| 150| return pt; 236| 150| }(); 237| | 238| 9.75k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 9.60k, False: 150] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 9.60k| const size_t bit_pos = WindowBits * i - 1; 241| 9.60k| const size_t raw = scalar.get_window(bit_pos); 242| 9.60k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 9.60k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 9.60k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 9.60k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 450, False: 9.15k] ------------------ 250| 450| blinding.randomize_rep(accum, i); 251| 450| } 252| 9.60k| } 253| | 254| 150| CT::unpoison(accum); 255| 150| return accum; 256| 150|} pcurves_brainpool384r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 150| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 150| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 150| const size_t raw = w_bits << 1; 228| 150| const auto [tidx, tneg] = booth_recode(raw); 229| 150| const auto tbl_0 = table.first(WindowElements); 230| | 231| 150| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 150| pt.conditional_assign(tneg, pt.negate()); 233| 150| CT::poison(pt); 234| 150| blinding.randomize_rep(pt, 0); 235| 150| return pt; 236| 150| }(); pcurves_brainpool512r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 98| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 97, False: 1] ------------------ 196| 97| table.push_back(accum); 197| | 198| 3.10k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 3.00k, False: 97] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 3.00k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.55k, False: 1.45k] ------------------ 201| 1.55k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.55k| } else { 203| 1.45k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.45k| } 205| 3.00k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 97| accum = table[i + WindowElements - 1].dbl(); 210| 97| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_brainpool512r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 135| const Blinding& blinding) { 220| 135| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 135| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 135| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 135| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 135| const size_t raw = w_bits << 1; 228| 135| const auto [tidx, tneg] = booth_recode(raw); 229| 135| const auto tbl_0 = table.first(WindowElements); 230| | 231| 135| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 135| pt.conditional_assign(tneg, pt.negate()); 233| 135| CT::poison(pt); 234| 135| blinding.randomize_rep(pt, 0); 235| 135| return pt; 236| 135| }(); 237| | 238| 11.6k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 11.4k, False: 135] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 11.4k| const size_t bit_pos = WindowBits * i - 1; 241| 11.4k| const size_t raw = scalar.get_window(bit_pos); 242| 11.4k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 11.4k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 11.4k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 11.4k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 405, False: 11.0k] ------------------ 250| 405| blinding.randomize_rep(accum, i); 251| 405| } 252| 11.4k| } 253| | 254| 135| CT::unpoison(accum); 255| 135| return accum; 256| 135|} pcurves_brainpool512r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 135| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 135| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 135| const size_t raw = w_bits << 1; 228| 135| const auto [tidx, tneg] = booth_recode(raw); 229| 135| const auto tbl_0 = table.first(WindowElements); 230| | 231| 135| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 135| pt.conditional_assign(tneg, pt.negate()); 233| 135| CT::poison(pt); 234| 135| blinding.randomize_rep(pt, 0); 235| 135| return pt; 236| 135| }(); pcurves_generic.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_112GenericCurveELm6ENS2_24GenericBlindedScalarBitsENS2_25GenericBlindingRandomnessEEENT_15ProjectivePointENSt3__14spanIKNS6_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 364| const Blinding& blinding) { 220| 364| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 364| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 364| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 364| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 364| const size_t raw = w_bits << 1; 228| 364| const auto [tidx, tneg] = booth_recode(raw); 229| 364| const auto tbl_0 = table.first(WindowElements); 230| | 231| 364| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 364| pt.conditional_assign(tneg, pt.negate()); 233| 364| CT::poison(pt); 234| 364| blinding.randomize_rep(pt, 0); 235| 364| return pt; 236| 364| }(); 237| | 238| 13.4k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 13.0k, False: 364] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 13.0k| const size_t bit_pos = WindowBits * i - 1; 241| 13.0k| const size_t raw = scalar.get_window(bit_pos); 242| 13.0k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 13.0k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 13.0k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 13.0k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 1.09k, False: 11.9k] ------------------ 250| 1.09k| blinding.randomize_rep(accum, i); 251| 1.09k| } 252| 13.0k| } 253| | 254| 364| CT::unpoison(accum); 255| 364| return accum; 256| 364|} pcurves_generic.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_112GenericCurveELm6ENS2_24GenericBlindedScalarBitsENS2_25GenericBlindingRandomnessEEENT_15ProjectivePointENSt3__14spanIKNS6_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 364| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 364| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 364| const size_t raw = w_bits << 1; 228| 364| const auto [tidx, tneg] = booth_recode(raw); 229| 364| const auto tbl_0 = table.first(WindowElements); 230| | 231| 364| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 364| pt.conditional_assign(tneg, pt.negate()); 233| 364| CT::poison(pt); 234| 364| blinding.randomize_rep(pt, 0); 235| 364| return pt; 236| 364| }(); pcurves_generic.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_112GenericCurveELm6EEENSt3__16vectorINT_11AffinePointENS4_9allocatorIS7_EEEERKS7_m: 180| 379|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 379| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 379| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 379| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 379| const size_t TableSize = Windows * WindowElements; 189| | 190| 379| std::vector table; 191| 379| table.reserve(TableSize); 192| | 193| 379| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 16.0k| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 15.7k, False: 379] ------------------ 196| 15.7k| table.push_back(accum); 197| | 198| 502k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 487k, False: 15.7k] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 487k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 251k, False: 235k] ------------------ 201| 251k| table.emplace_back(table[i + j / 2].dbl()); 202| 251k| } else { 203| 235k| table.emplace_back(table[i + j - 1] + table[i]); 204| 235k| } 205| 487k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 15.7k| accum = table[i + WindowElements - 1].dbl(); 210| 15.7k| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 379| return to_affine_batch(table); 214| 379|} pcurves_secp224r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 44| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 43, False: 1] ------------------ 196| 43| table.push_back(accum); 197| | 198| 1.37k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.33k, False: 43] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.33k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 688, False: 645] ------------------ 201| 688| table.emplace_back(table[i + j / 2].dbl()); 202| 688| } else { 203| 645| table.emplace_back(table[i + j - 1] + table[i]); 204| 645| } 205| 1.33k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 43| accum = table[i + WindowElements - 1].dbl(); 210| 43| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp224r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 323| const Blinding& blinding) { 220| 323| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 323| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 323| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 323| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 323| const size_t raw = w_bits << 1; 228| 323| const auto [tidx, tneg] = booth_recode(raw); 229| 323| const auto tbl_0 = table.first(WindowElements); 230| | 231| 323| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 323| pt.conditional_assign(tneg, pt.negate()); 233| 323| CT::poison(pt); 234| 323| blinding.randomize_rep(pt, 0); 235| 323| return pt; 236| 323| }(); 237| | 238| 12.2k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 11.9k, False: 323] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 11.9k| const size_t bit_pos = WindowBits * i - 1; 241| 11.9k| const size_t raw = scalar.get_window(bit_pos); 242| 11.9k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 11.9k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 11.9k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 11.9k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 969, False: 10.9k] ------------------ 250| 969| blinding.randomize_rep(accum, i); 251| 969| } 252| 11.9k| } 253| | 254| 323| CT::unpoison(accum); 255| 323| return accum; 256| 323|} pcurves_secp224r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 323| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 323| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 323| const size_t raw = w_bits << 1; 228| 323| const auto [tidx, tneg] = booth_recode(raw); 229| 323| const auto tbl_0 = table.first(WindowElements); 230| | 231| 323| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 323| pt.conditional_assign(tneg, pt.negate()); 233| 323| CT::poison(pt); 234| 323| blinding.randomize_rep(pt, 0); 235| 323| return pt; 236| 323| }(); pcurves_secp256k1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 49, False: 1] ------------------ 196| 49| table.push_back(accum); 197| | 198| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.51k, False: 49] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.51k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 784, False: 735] ------------------ 201| 784| table.emplace_back(table[i + j / 2].dbl()); 202| 784| } else { 203| 735| table.emplace_back(table[i + j - 1] + table[i]); 204| 735| } 205| 1.51k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 49| accum = table[i + WindowElements - 1].dbl(); 210| 49| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp256k1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 189| const Blinding& blinding) { 220| 189| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 189| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 189| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 189| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 189| const size_t raw = w_bits << 1; 228| 189| const auto [tidx, tneg] = booth_recode(raw); 229| 189| const auto tbl_0 = table.first(WindowElements); 230| | 231| 189| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 189| pt.conditional_assign(tneg, pt.negate()); 233| 189| CT::poison(pt); 234| 189| blinding.randomize_rep(pt, 0); 235| 189| return pt; 236| 189| }(); 237| | 238| 8.12k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 7.93k, False: 189] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 7.93k| const size_t bit_pos = WindowBits * i - 1; 241| 7.93k| const size_t raw = scalar.get_window(bit_pos); 242| 7.93k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 7.93k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 7.93k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 7.93k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 567, False: 7.37k] ------------------ 250| 567| blinding.randomize_rep(accum, i); 251| 567| } 252| 7.93k| } 253| | 254| 189| CT::unpoison(accum); 255| 189| return accum; 256| 189|} pcurves_secp256k1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 189| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 189| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 189| const size_t raw = w_bits << 1; 228| 189| const auto [tidx, tneg] = booth_recode(raw); 229| 189| const auto tbl_0 = table.first(WindowElements); 230| | 231| 189| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 189| pt.conditional_assign(tneg, pt.negate()); 233| 189| CT::poison(pt); 234| 189| blinding.randomize_rep(pt, 0); 235| 189| return pt; 236| 189| }(); pcurves_secp256r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 49, False: 1] ------------------ 196| 49| table.push_back(accum); 197| | 198| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.51k, False: 49] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.51k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 784, False: 735] ------------------ 201| 784| table.emplace_back(table[i + j / 2].dbl()); 202| 784| } else { 203| 735| table.emplace_back(table[i + j - 1] + table[i]); 204| 735| } 205| 1.51k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 49| accum = table[i + WindowElements - 1].dbl(); 210| 49| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp256r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 173| const Blinding& blinding) { 220| 173| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 173| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 173| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 173| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 173| const size_t raw = w_bits << 1; 228| 173| const auto [tidx, tneg] = booth_recode(raw); 229| 173| const auto tbl_0 = table.first(WindowElements); 230| | 231| 173| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 173| pt.conditional_assign(tneg, pt.negate()); 233| 173| CT::poison(pt); 234| 173| blinding.randomize_rep(pt, 0); 235| 173| return pt; 236| 173| }(); 237| | 238| 7.43k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 7.26k, False: 173] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 7.26k| const size_t bit_pos = WindowBits * i - 1; 241| 7.26k| const size_t raw = scalar.get_window(bit_pos); 242| 7.26k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 7.26k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 7.26k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 7.26k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 519, False: 6.74k] ------------------ 250| 519| blinding.randomize_rep(accum, i); 251| 519| } 252| 7.26k| } 253| | 254| 173| CT::unpoison(accum); 255| 173| return accum; 256| 173|} pcurves_secp256r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 173| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 173| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 173| const size_t raw = w_bits << 1; 228| 173| const auto [tidx, tneg] = booth_recode(raw); 229| 173| const auto tbl_0 = table.first(WindowElements); 230| | 231| 173| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 173| pt.conditional_assign(tneg, pt.negate()); 233| 173| CT::poison(pt); 234| 173| blinding.randomize_rep(pt, 0); 235| 173| return pt; 236| 173| }(); pcurves_secp384r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 74| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 73, False: 1] ------------------ 196| 73| table.push_back(accum); 197| | 198| 2.33k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 2.26k, False: 73] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 2.26k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.16k, False: 1.09k] ------------------ 201| 1.16k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.16k| } else { 203| 1.09k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.09k| } 205| 2.26k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 73| accum = table[i + WindowElements - 1].dbl(); 210| 73| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp384r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 193| const Blinding& blinding) { 220| 193| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 193| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 193| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 193| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 193| const size_t raw = w_bits << 1; 228| 193| const auto [tidx, tneg] = booth_recode(raw); 229| 193| const auto tbl_0 = table.first(WindowElements); 230| | 231| 193| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 193| pt.conditional_assign(tneg, pt.negate()); 233| 193| CT::poison(pt); 234| 193| blinding.randomize_rep(pt, 0); 235| 193| return pt; 236| 193| }(); 237| | 238| 12.5k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 12.3k, False: 193] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 12.3k| const size_t bit_pos = WindowBits * i - 1; 241| 12.3k| const size_t raw = scalar.get_window(bit_pos); 242| 12.3k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 12.3k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 12.3k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 12.3k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 579, False: 11.7k] ------------------ 250| 579| blinding.randomize_rep(accum, i); 251| 579| } 252| 12.3k| } 253| | 254| 193| CT::unpoison(accum); 255| 193| return accum; 256| 193|} pcurves_secp384r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 193| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 193| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 193| const size_t raw = w_bits << 1; 228| 193| const auto [tidx, tneg] = booth_recode(raw); 229| 193| const auto tbl_0 = table.first(WindowElements); 230| | 231| 193| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 193| pt.conditional_assign(tneg, pt.negate()); 233| 193| CT::poison(pt); 234| 193| blinding.randomize_rep(pt, 0); 235| 193| return pt; 236| 193| }(); pcurves_secp521r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 98| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 97, False: 1] ------------------ 196| 97| table.push_back(accum); 197| | 198| 3.10k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 3.00k, False: 97] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 3.00k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.55k, False: 1.45k] ------------------ 201| 1.55k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.55k| } else { 203| 1.45k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.45k| } 205| 3.00k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 97| accum = table[i + WindowElements - 1].dbl(); 210| 97| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp521r1.cpp:_ZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_: 219| 250| const Blinding& blinding) { 220| 250| static constexpr size_t WindowElements = 1 << (WindowBits - 1); 221| | 222| 250| const size_t windows = (scalar.bits() + WindowBits) / WindowBits; 223| | 224| 250| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 250| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 250| const size_t raw = w_bits << 1; 228| 250| const auto [tidx, tneg] = booth_recode(raw); 229| 250| const auto tbl_0 = table.first(WindowElements); 230| | 231| 250| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 250| pt.conditional_assign(tneg, pt.negate()); 233| 250| CT::poison(pt); 234| 250| blinding.randomize_rep(pt, 0); 235| 250| return pt; 236| 250| }(); 237| | 238| 21.7k| for(size_t i = 1; i != windows; ++i) { ------------------ | Branch (238:22): [True: 21.5k, False: 250] ------------------ 239| | // Extract W+1 bits overlapping by 1 with the previous window 240| 21.5k| const size_t bit_pos = WindowBits * i - 1; 241| 21.5k| const size_t raw = scalar.get_window(bit_pos); 242| 21.5k| const auto [tidx, tneg] = booth_recode(raw); 243| | 244| 21.5k| const auto tbl_i = table.subspan(WindowElements * i, WindowElements); 245| | 246| 21.5k| accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg); 247| | 248| | // Conditional ok: loop iteration count is public 249| 21.5k| if(i < Blinding::Rerandomizations) { ------------------ | Branch (249:10): [True: 750, False: 20.7k] ------------------ 250| 750| blinding.randomize_rep(accum, i); 251| 750| } 252| 21.5k| } 253| | 254| 250| CT::unpoison(accum); 255| 250| return accum; 256| 250|} pcurves_secp521r1.cpp:_ZZN5Botan18basemul_booth_execINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6ENS_17BlindedScalarBitsIS4_Lm7EEENS_18BlindingRandomnessIS6_Lm1EEEEENT_15ProjectivePointENSt3__14spanIKNS9_11AffinePointELm18446744073709551615EEERKT1_RKT2_ENKUlvE_clEv: 224| 250| auto accum = [&]() { 225| | // First window: extract W bits, shift left 1 to insert implicit carry in of zero 226| 250| const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1); 227| 250| const size_t raw = w_bits << 1; 228| 250| const auto [tidx, tneg] = booth_recode(raw); 229| 250| const auto tbl_0 = table.first(WindowElements); 230| | 231| 250| auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx)); 232| 250| pt.conditional_assign(tneg, pt.negate()); 233| 250| CT::poison(pt); 234| 250| blinding.randomize_rep(pt, 0); 235| 250| return pt; 236| 250| }(); _ZN5Botan10get_uint32ITkNS_8WordTypeEmEEjPKT_m: 33| 19.6M|constexpr uint32_t get_uint32(const W xw[], size_t i) { 34| 19.6M| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 35| | 36| | if constexpr(WordInfo::bits == 32) { 37| | return xw[i]; 38| 19.6M| } else { 39| 19.6M| return static_cast(xw[i / 2] >> ((i % 2) * 32)); 40| 19.6M| } 41| 19.6M|} _ZN5Botan12SolinasAccumImLm4EEC2ERNSt3__15arrayImLm4EEE: 50| 963k| constexpr explicit SolinasAccum(std::array& r) : m_r(r) {} _ZN5Botan12SolinasAccumImLm4EE5accumEl: 52| 6.74M| constexpr void accum(int64_t v) { 53| 6.74M| BOTAN_DEBUG_ASSERT(m_idx < N32); ------------------ | | 137| 6.74M| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 6.74M| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 6.74M] | | ------------------ ------------------ 54| | 55| 6.74M| m_S += v; 56| 6.74M| const uint32_t r = static_cast(m_S); 57| 6.74M| m_S >>= 32; 58| | 59| | if constexpr(WordInfo::bits == 32) { 60| | m_r[m_idx] = r; 61| 6.74M| } else { 62| 6.74M| m_r[m_idx / 2] |= static_cast(r) << (32 * (m_idx % 2)); 63| 6.74M| } 64| | 65| 6.74M| m_idx += 1; 66| 6.74M| } _ZN5Botan12SolinasAccumImLm4EE11final_carryEl: 68| 963k| constexpr W final_carry(int64_t C) { 69| 963k| m_S += C; 70| 963k| BOTAN_DEBUG_ASSERT(m_S >= 0); ------------------ | | 137| 963k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 963k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 963k] | | ------------------ ------------------ 71| 963k| return static_cast(m_S); 72| 963k| } _ZN5Botan20solinas_correct_redcILm4ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_: 84| 963k|constexpr inline void solinas_correct_redc(std::array& r, const std::array& P, const std::array& C) { 85| 963k| W borrow = 0; 86| 4.81M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (86:22): [True: 3.85M, False: 963k] ------------------ 87| 3.85M| r[i] = word_sub(r[i], C[i], &borrow); 88| 3.85M| } 89| | 90| | // borrow is either 0 or 1, perfect for setting up a mask without extra work 91| 963k| const W mask = CT::value_barrier(0 - borrow); 92| | 93| 963k| W carry = 0; 94| | 95| 4.81M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (95:22): [True: 3.85M, False: 963k] ------------------ 96| 3.85M| r[i] = word_add(r[i], P[i] & mask, &carry); 97| 3.85M| } 98| 963k|} _ZN5Botan12SolinasAccumImLm6EEC2ERNSt3__15arrayImLm6EEE: 50| 257k| constexpr explicit SolinasAccum(std::array& r) : m_r(r) {} _ZN5Botan12SolinasAccumImLm6EE5accumEl: 52| 3.08M| constexpr void accum(int64_t v) { 53| 3.08M| BOTAN_DEBUG_ASSERT(m_idx < N32); ------------------ | | 137| 3.08M| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 3.08M| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 3.08M] | | ------------------ ------------------ 54| | 55| 3.08M| m_S += v; 56| 3.08M| const uint32_t r = static_cast(m_S); 57| 3.08M| m_S >>= 32; 58| | 59| | if constexpr(WordInfo::bits == 32) { 60| | m_r[m_idx] = r; 61| 3.08M| } else { 62| 3.08M| m_r[m_idx / 2] |= static_cast(r) << (32 * (m_idx % 2)); 63| 3.08M| } 64| | 65| 3.08M| m_idx += 1; 66| 3.08M| } _ZN5Botan12SolinasAccumImLm6EE11final_carryEl: 68| 257k| constexpr W final_carry(int64_t C) { 69| 257k| m_S += C; 70| 257k| BOTAN_DEBUG_ASSERT(m_S >= 0); ------------------ | | 137| 257k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 257k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 257k] | | ------------------ ------------------ 71| 257k| return static_cast(m_S); 72| 257k| } _ZN5Botan20solinas_correct_redcILm6ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_: 84| 257k|constexpr inline void solinas_correct_redc(std::array& r, const std::array& P, const std::array& C) { 85| 257k| W borrow = 0; 86| 1.80M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (86:22): [True: 1.54M, False: 257k] ------------------ 87| 1.54M| r[i] = word_sub(r[i], C[i], &borrow); 88| 1.54M| } 89| | 90| | // borrow is either 0 or 1, perfect for setting up a mask without extra work 91| 257k| const W mask = CT::value_barrier(0 - borrow); 92| | 93| 257k| W carry = 0; 94| | 95| 1.80M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (95:22): [True: 1.54M, False: 257k] ------------------ 96| 1.54M| r[i] = word_add(r[i], P[i] & mask, &carry); 97| 1.54M| } 98| 257k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm4EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 172k| -> std::array { 111| 172k| static_assert(N >= 1); 112| | 113| 172k| std::array ws; // NOLINT(*-member-init) 114| 172k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 172k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 172k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| 172k| if constexpr(N == 4) { 120| 172k| bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| 172k| return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 172k| } 136| | 137| 0| word3 accum; 138| | 139| 172k| accum.add(z[0]); 140| | 141| 172k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 172k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 172k] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 172k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 172k] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 172k| accum.add(z[2 * N - 1]); 164| | 165| 172k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 172k| const W w1 = accum.extract(); 168| | 169| 172k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 172k| return r; 172| 172k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm6EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 226k| -> std::array { 111| 226k| static_assert(N >= 1); 112| | 113| 226k| std::array ws; // NOLINT(*-member-init) 114| 226k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 226k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 226k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| 226k| } else if constexpr(N == 6) { 123| 226k| bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| 226k| return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 226k| } 136| | 137| 0| word3 accum; 138| | 139| 226k| accum.add(z[0]); 140| | 141| 226k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 226k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 226k] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 226k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 226k] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 226k| accum.add(z[2 * N - 1]); 164| | 165| 226k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 226k| const W w1 = accum.extract(); 168| | 169| 226k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 226k| return r; 172| 226k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm8EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 275k| -> std::array { 111| 275k| static_assert(N >= 1); 112| | 113| 275k| std::array ws; // NOLINT(*-member-init) 114| 275k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 275k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 275k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| 275k| } else if constexpr(N == 8) { 126| 275k| bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| 275k| return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 275k| } 136| | 137| 0| word3 accum; 138| | 139| 275k| accum.add(z[0]); 140| | 141| 275k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 275k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 275k] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 275k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 275k] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 275k| accum.add(z[2 * N - 1]); 164| | 165| 275k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 275k| const W w1 = accum.extract(); 168| | 169| 275k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 275k| return r; 172| 275k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm9EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 751| -> std::array { 111| 751| static_assert(N >= 1); 112| | 113| 751| std::array ws; // NOLINT(*-member-init) 114| 751| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 751| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 751, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| 751| } else if constexpr(N == 16) { 132| 751| bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| 751| return r; 134| 751| } 135| 751| } 136| | 137| 751| word3 accum; 138| | 139| 751| accum.add(z[0]); 140| | 141| 751| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 6.75k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 6.00k, False: 751] ------------------ 144| 33.0k| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 27.0k, False: 6.00k] ------------------ 145| 27.0k| accum.mul(ws[j], p[i - j]); 146| 27.0k| } 147| | 148| 6.00k| accum.add(z[i]); 149| | 150| 6.00k| ws[i] = accum.monty_step(p[0], p_dash); 151| 6.00k| } 152| | 153| 6.75k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 6.00k, False: 751] ------------------ 154| 33.0k| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 27.0k, False: 6.00k] ------------------ 155| 27.0k| accum.mul(ws[j], p[N + i - j]); 156| 27.0k| } 157| | 158| 6.00k| accum.add(z[N + i]); 159| | 160| 6.00k| ws[i] = accum.extract(); 161| 6.00k| } 162| | 163| 751| accum.add(z[2 * N - 1]); 164| | 165| 751| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 751| const W w1 = accum.extract(); 168| | 169| 751| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 751| return r; 172| 751|} pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE8instanceEv: 341| 1.75k| static std::shared_ptr instance() { 342| 1.75k| static const auto g_curve = std::make_shared>(); 343| 1.75k| return g_curve; 344| 1.75k| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE19field_element_bytesEv: 36| 350| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 175| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 175| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 373| 175| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 374| 175| const auto x_w = pt.x().template stash_value(); 375| 175| const auto y_w = pt.y().template stash_value(); 376| 175| const auto z_w = pt.z().template stash_value(); 377| 175| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 378| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 525| static typename C::Scalar from_stash(const Scalar& s) { 352| 525| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 525] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 525| return C::Scalar::from_stash(s._value()); 356| 525| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 347| 175| static Scalar stash(const typename C::Scalar& s) { 348| 175| return Scalar::_create(instance(), s.template stash_value()); 349| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 364| 350| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 365| 350| if(pt._curve() != instance()) { ------------------ | Branch (365:13): [True: 0, False: 350] ------------------ 366| 0| throw Invalid_Argument("Curve mismatch"); 367| 0| } 368| 350| const auto x = C::FieldElement::from_stash(pt._x()); 369| 350| const auto y = C::FieldElement::from_stash(pt._y()); 370| 350| return typename C::AffinePoint(x, y); 371| 350| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 358| 175| static AffinePoint stash(const typename C::AffinePoint& pt) { 359| 175| const auto x_w = pt.x().template stash_value(); 360| 175| const auto y_w = pt.y().template stash_value(); 361| 175| return AffinePoint::_create(instance(), x_w, y_w); 362| 175| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 176| std::optional deserialize_scalar(std::span bytes) const override { 222| 176| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 176, False: 0] ------------------ 223| 176| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 175, False: 1] ------------------ 224| 175| return stash(*scalar); 225| 175| } 226| 176| } 227| | 228| 1| return {}; 229| 176| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 189| 175| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 190| 175| const auto affine = to_affine(from_stash(pt)); 191| | 192| 175| const auto y2 = affine.y().square(); 193| 175| const auto x3_ax_b = C::x3_ax_b(affine.x()); 194| 175| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 195| | 196| 175| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 175| do { \ | | 72| 175| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 175| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 175] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 175| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 175] | | ------------------ ------------------ 197| | 198| 175| return stash(affine); 199| 175| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 380| 175| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 381| 175| if(pt._curve() != instance()) { ------------------ | Branch (381:13): [True: 0, False: 175] ------------------ 382| 0| throw Invalid_Argument("Curve mismatch"); 383| 0| } 384| 175| const auto x = C::FieldElement::from_stash(pt._x()); 385| 175| const auto y = C::FieldElement::from_stash(pt._y()); 386| 175| const auto z = C::FieldElement::from_stash(pt._z()); 387| 175| return typename C::ProjectivePoint(x, y, z); 388| 175| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 207| 175| bool affine_point_is_identity(const AffinePoint& pt) const override { 208| 175| return from_stash(pt).is_identity().as_bool(); 209| 175| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 211| 175| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 212| 175| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 175| do { \ | | 36| 175| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 175| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 175] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 175| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 175] | | ------------------ ------------------ 213| 175| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 214| 175| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 175| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 175| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 175| do { \ | | 36| 175| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 175| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 175] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 175| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 175] | | ------------------ ------------------ 218| 175| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 175| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 175| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE8instanceEv: 341| 1.50k| static std::shared_ptr instance() { 342| 1.50k| static const auto g_curve = std::make_shared>(); 343| 1.50k| return g_curve; 344| 1.50k| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE19field_element_bytesEv: 36| 300| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 150| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 150| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 373| 150| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 374| 150| const auto x_w = pt.x().template stash_value(); 375| 150| const auto y_w = pt.y().template stash_value(); 376| 150| const auto z_w = pt.z().template stash_value(); 377| 150| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 378| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 450| static typename C::Scalar from_stash(const Scalar& s) { 352| 450| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 450] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 450| return C::Scalar::from_stash(s._value()); 356| 450| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 347| 150| static Scalar stash(const typename C::Scalar& s) { 348| 150| return Scalar::_create(instance(), s.template stash_value()); 349| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 364| 300| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 365| 300| if(pt._curve() != instance()) { ------------------ | Branch (365:13): [True: 0, False: 300] ------------------ 366| 0| throw Invalid_Argument("Curve mismatch"); 367| 0| } 368| 300| const auto x = C::FieldElement::from_stash(pt._x()); 369| 300| const auto y = C::FieldElement::from_stash(pt._y()); 370| 300| return typename C::AffinePoint(x, y); 371| 300| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 358| 150| static AffinePoint stash(const typename C::AffinePoint& pt) { 359| 150| const auto x_w = pt.x().template stash_value(); 360| 150| const auto y_w = pt.y().template stash_value(); 361| 150| return AffinePoint::_create(instance(), x_w, y_w); 362| 150| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 151| std::optional deserialize_scalar(std::span bytes) const override { 222| 151| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 151, False: 0] ------------------ 223| 151| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 150, False: 1] ------------------ 224| 150| return stash(*scalar); 225| 150| } 226| 151| } 227| | 228| 1| return {}; 229| 151| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 189| 150| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 190| 150| const auto affine = to_affine(from_stash(pt)); 191| | 192| 150| const auto y2 = affine.y().square(); 193| 150| const auto x3_ax_b = C::x3_ax_b(affine.x()); 194| 150| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 195| | 196| 150| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 150| do { \ | | 72| 150| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 150| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 150] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 150| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 150] | | ------------------ ------------------ 197| | 198| 150| return stash(affine); 199| 150| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 380| 150| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 381| 150| if(pt._curve() != instance()) { ------------------ | Branch (381:13): [True: 0, False: 150] ------------------ 382| 0| throw Invalid_Argument("Curve mismatch"); 383| 0| } 384| 150| const auto x = C::FieldElement::from_stash(pt._x()); 385| 150| const auto y = C::FieldElement::from_stash(pt._y()); 386| 150| const auto z = C::FieldElement::from_stash(pt._z()); 387| 150| return typename C::ProjectivePoint(x, y, z); 388| 150| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 207| 150| bool affine_point_is_identity(const AffinePoint& pt) const override { 208| 150| return from_stash(pt).is_identity().as_bool(); 209| 150| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 211| 150| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 212| 150| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 150| do { \ | | 36| 150| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 150| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 150] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 150| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 150] | | ------------------ ------------------ 213| 150| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 214| 150| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 150| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 150| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 150| do { \ | | 36| 150| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 150| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 150] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 150| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 150] | | ------------------ ------------------ 218| 150| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 150| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 150| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE8instanceEv: 341| 1.35k| static std::shared_ptr instance() { 342| 1.35k| static const auto g_curve = std::make_shared>(); 343| 1.35k| return g_curve; 344| 1.35k| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE19field_element_bytesEv: 36| 270| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 135| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 135| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 373| 135| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 374| 135| const auto x_w = pt.x().template stash_value(); 375| 135| const auto y_w = pt.y().template stash_value(); 376| 135| const auto z_w = pt.z().template stash_value(); 377| 135| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 378| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 405| static typename C::Scalar from_stash(const Scalar& s) { 352| 405| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 405] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 405| return C::Scalar::from_stash(s._value()); 356| 405| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 347| 135| static Scalar stash(const typename C::Scalar& s) { 348| 135| return Scalar::_create(instance(), s.template stash_value()); 349| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 364| 270| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 365| 270| if(pt._curve() != instance()) { ------------------ | Branch (365:13): [True: 0, False: 270] ------------------ 366| 0| throw Invalid_Argument("Curve mismatch"); 367| 0| } 368| 270| const auto x = C::FieldElement::from_stash(pt._x()); 369| 270| const auto y = C::FieldElement::from_stash(pt._y()); 370| 270| return typename C::AffinePoint(x, y); 371| 270| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 358| 135| static AffinePoint stash(const typename C::AffinePoint& pt) { 359| 135| const auto x_w = pt.x().template stash_value(); 360| 135| const auto y_w = pt.y().template stash_value(); 361| 135| return AffinePoint::_create(instance(), x_w, y_w); 362| 135| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 136| std::optional deserialize_scalar(std::span bytes) const override { 222| 136| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 136, False: 0] ------------------ 223| 136| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 135, False: 1] ------------------ 224| 135| return stash(*scalar); 225| 135| } 226| 136| } 227| | 228| 1| return {}; 229| 136| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 189| 135| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 190| 135| const auto affine = to_affine(from_stash(pt)); 191| | 192| 135| const auto y2 = affine.y().square(); 193| 135| const auto x3_ax_b = C::x3_ax_b(affine.x()); 194| 135| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 195| | 196| 135| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 135| do { \ | | 72| 135| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 135| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 135] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 135| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 135] | | ------------------ ------------------ 197| | 198| 135| return stash(affine); 199| 135| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 380| 135| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 381| 135| if(pt._curve() != instance()) { ------------------ | Branch (381:13): [True: 0, False: 135] ------------------ 382| 0| throw Invalid_Argument("Curve mismatch"); 383| 0| } 384| 135| const auto x = C::FieldElement::from_stash(pt._x()); 385| 135| const auto y = C::FieldElement::from_stash(pt._y()); 386| 135| const auto z = C::FieldElement::from_stash(pt._z()); 387| 135| return typename C::ProjectivePoint(x, y, z); 388| 135| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 207| 135| bool affine_point_is_identity(const AffinePoint& pt) const override { 208| 135| return from_stash(pt).is_identity().as_bool(); 209| 135| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 211| 135| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 212| 135| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 135| do { \ | | 36| 135| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 135| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 135] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 135| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 135] | | ------------------ ------------------ 213| 135| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 214| 135| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 135| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 135| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 135| do { \ | | 36| 135| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 135| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 135] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 135| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 135] | | ------------------ ------------------ 218| 135| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 135| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 135| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE8instanceEv: 341| 3.46k| static std::shared_ptr instance() { 342| 3.46k| static const auto g_curve = std::make_shared>(); 343| 3.46k| return g_curve; 344| 3.46k| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE19field_element_bytesEv: 36| 1.10k| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 323| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 323| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 323| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS3_12Secp224r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 373| 323| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 374| 323| const auto x_w = pt.x().template stash_value(); 375| 323| const auto y_w = pt.y().template stash_value(); 376| 323| const auto z_w = pt.z().template stash_value(); 377| 323| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 378| 323| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 969| static typename C::Scalar from_stash(const Scalar& s) { 352| 969| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 969] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 969| return C::Scalar::from_stash(s._value()); 356| 969| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp224r1RepEE12ScalarParamsEEEEE: 347| 323| static Scalar stash(const typename C::Scalar& s) { 348| 323| return Scalar::_create(instance(), s.template stash_value()); 349| 323| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 364| 798| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 365| 798| if(pt._curve() != instance()) { ------------------ | Branch (365:13): [True: 0, False: 798] ------------------ 366| 0| throw Invalid_Argument("Curve mismatch"); 367| 0| } 368| 798| const auto x = C::FieldElement::from_stash(pt._x()); 369| 798| const auto y = C::FieldElement::from_stash(pt._y()); 370| 798| return typename C::AffinePoint(x, y); 371| 798| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS3_12Secp224r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 358| 399| static AffinePoint stash(const typename C::AffinePoint& pt) { 359| 399| const auto x_w = pt.x().template stash_value(); 360| 399| const auto y_w = pt.y().template stash_value(); 361| 399| return AffinePoint::_create(instance(), x_w, y_w); 362| 399| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 241| 46| std::optional deserialize_point_uncompressed(std::span bytes) const override { 242| 46| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 243| 46| constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1; 244| | 245| 46| if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) { ------------------ | Branch (245:13): [True: 46, False: 0] | Branch (245:50): [True: 46, False: 0] ------------------ 246| 46| const auto encoded_point = bytes.subspan(1); 247| 46| auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes)); 248| 46| auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes)); 249| | 250| 46| if(x && y) { ------------------ | Branch (250:16): [True: 44, False: 2] | Branch (250:21): [True: 41, False: 3] ------------------ 251| | // Check that y^2 = x^3 + ax + b 252| 41| const auto lhs = (*y).square(); 253| 41| const auto rhs = C::x3_ax_b(*x); 254| 41| const auto valid = (lhs == rhs); 255| 41| if(valid.as_bool()) { ------------------ | Branch (255:19): [True: 0, False: 41] ------------------ 256| 0| return stash(typename C::AffinePoint(*x, *y)); 257| 0| } 258| 41| } 259| 46| } 260| | 261| 46| return {}; 262| 46| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE28deserialize_point_compressedENSt3__14spanIKhLm18446744073709551615EEE: 264| 146| std::optional deserialize_point_compressed(std::span bytes) const override { 265| 146| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 266| 146| constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1; 267| | 268| 146| if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) { ------------------ | Branch (268:13): [True: 146, False: 0] | Branch (268:49): [True: 12, False: 134] | Branch (268:69): [True: 134, False: 0] ------------------ 269| 146| const CT::Choice y_is_even = CT::Mask::is_equal(bytes[0], 0x02).as_choice(); 270| | 271| 146| if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) { ------------------ | Branch (271:21): [True: 145, False: 1] ------------------ 272| 145| if(auto y = sqrt_field_element(C::x3_ax_b(*x)).as_optional_vartime()) { ------------------ | Branch (272:24): [True: 76, False: 69] ------------------ 273| 76| return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even))); 274| 76| } 275| 145| } 276| 146| } 277| | 278| 70| return {}; 279| 146| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 325| std::optional deserialize_scalar(std::span bytes) const override { 222| 325| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 324, False: 1] ------------------ 223| 324| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 323, False: 1] ------------------ 224| 323| return stash(*scalar); 225| 323| } 226| 324| } 227| | 228| 2| return {}; 229| 325| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 189| 323| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 190| 323| const auto affine = to_affine(from_stash(pt)); 191| | 192| 323| const auto y2 = affine.y().square(); 193| 323| const auto x3_ax_b = C::x3_ax_b(affine.x()); 194| 323| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 195| | 196| 323| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 323| do { \ | | 72| 323| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 323| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 323] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 323| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 323] | | ------------------ ------------------ 197| | 198| 323| return stash(affine); 199| 323| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 380| 323| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 381| 323| if(pt._curve() != instance()) { ------------------ | Branch (381:13): [True: 0, False: 323] ------------------ 382| 0| throw Invalid_Argument("Curve mismatch"); 383| 0| } 384| 323| const auto x = C::FieldElement::from_stash(pt._x()); 385| 323| const auto y = C::FieldElement::from_stash(pt._y()); 386| 323| const auto z = C::FieldElement::from_stash(pt._z()); 387| 323| return typename C::ProjectivePoint(x, y, z); 388| 323| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 207| 399| bool affine_point_is_identity(const AffinePoint& pt) const override { 208| 399| return from_stash(pt).is_identity().as_bool(); 209| 399| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 211| 399| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 212| 399| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 399| do { \ | | 36| 399| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 399| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 399] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 399| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 399] | | ------------------ ------------------ 213| 399| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 214| 399| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 323| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 323| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 323| do { \ | | 36| 323| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 323| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 323] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 323| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 323] | | ------------------ ------------------ 218| 323| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 323| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 323| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE8instanceEv: 341| 1.89k| static std::shared_ptr instance() { 342| 1.89k| static const auto g_curve = std::make_shared>(); 343| 1.89k| return g_curve; 344| 1.89k| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE19field_element_bytesEv: 36| 378| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 189| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 189| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 189| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS3_12Secp256k1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 373| 189| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 374| 189| const auto x_w = pt.x().template stash_value(); 375| 189| const auto y_w = pt.y().template stash_value(); 376| 189| const auto z_w = pt.z().template stash_value(); 377| 189| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 378| 189| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 567| static typename C::Scalar from_stash(const Scalar& s) { 352| 567| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 567] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 567| return C::Scalar::from_stash(s._value()); 356| 567| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp256k1RepEE12ScalarParamsEEEEE: 347| 189| static Scalar stash(const typename C::Scalar& s) { 348| 189| return Scalar::_create(instance(), s.template stash_value()); 349| 189| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 364| 378| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 365| 378| if(pt._curve() != instance()) { ------------------ | Branch (365:13): [True: 0, False: 378] ------------------ 366| 0| throw Invalid_Argument("Curve mismatch"); 367| 0| } 368| 378| const auto x = C::FieldElement::from_stash(pt._x()); 369| 378| const auto y = C::FieldElement::from_stash(pt._y()); 370| 378| return typename C::AffinePoint(x, y); 371| 378| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS3_12Secp256k1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 358| 189| static AffinePoint stash(const typename C::AffinePoint& pt) { 359| 189| const auto x_w = pt.x().template stash_value(); 360| 189| const auto y_w = pt.y().template stash_value(); 361| 189| return AffinePoint::_create(instance(), x_w, y_w); 362| 189| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 190| std::optional deserialize_scalar(std::span bytes) const override { 222| 190| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 190, False: 0] ------------------ 223| 190| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 189, False: 1] ------------------ 224| 189| return stash(*scalar); 225| 189| } 226| 190| } 227| | 228| 1| return {}; 229| 190| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 189| 189| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 190| 189| const auto affine = to_affine(from_stash(pt)); 191| | 192| 189| const auto y2 = affine.y().square(); 193| 189| const auto x3_ax_b = C::x3_ax_b(affine.x()); 194| 189| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 195| | 196| 189| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 189| do { \ | | 72| 189| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 189| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 189] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 189| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 189] | | ------------------ ------------------ 197| | 198| 189| return stash(affine); 199| 189| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 380| 189| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 381| 189| if(pt._curve() != instance()) { ------------------ | Branch (381:13): [True: 0, False: 189] ------------------ 382| 0| throw Invalid_Argument("Curve mismatch"); 383| 0| } 384| 189| const auto x = C::FieldElement::from_stash(pt._x()); 385| 189| const auto y = C::FieldElement::from_stash(pt._y()); 386| 189| const auto z = C::FieldElement::from_stash(pt._z()); 387| 189| return typename C::ProjectivePoint(x, y, z); 388| 189| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 207| 189| bool affine_point_is_identity(const AffinePoint& pt) const override { 208| 189| return from_stash(pt).is_identity().as_bool(); 209| 189| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 211| 189| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 212| 189| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 189| do { \ | | 36| 189| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 189| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 189] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 189| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 189] | | ------------------ ------------------ 213| 189| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 214| 189| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 189| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 189| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 189| do { \ | | 36| 189| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 189| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 189] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 189| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 189] | | ------------------ ------------------ 218| 189| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 189| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 189| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE8instanceEv: 341| 1.78k| static std::shared_ptr instance() { 342| 1.78k| static const auto g_curve = std::make_shared>(); 343| 1.78k| return g_curve; 344| 1.78k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE19field_element_bytesEv: 36| 346| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 173| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 173| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 173| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS2_22Secp256r1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 373| 173| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 374| 173| const auto x_w = pt.x().template stash_value(); 375| 173| const auto y_w = pt.y().template stash_value(); 376| 173| const auto z_w = pt.z().template stash_value(); 377| 173| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 378| 173| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 519| static typename C::Scalar from_stash(const Scalar& s) { 352| 519| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 519] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 519| return C::Scalar::from_stash(s._value()); 356| 519| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEE: 347| 173| static Scalar stash(const typename C::Scalar& s) { 348| 173| return Scalar::_create(instance(), s.template stash_value()); 349| 173| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 364| 346| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 365| 346| if(pt._curve() != instance()) { ------------------ | Branch (365:13): [True: 0, False: 346] ------------------ 366| 0| throw Invalid_Argument("Curve mismatch"); 367| 0| } 368| 346| const auto x = C::FieldElement::from_stash(pt._x()); 369| 346| const auto y = C::FieldElement::from_stash(pt._y()); 370| 346| return typename C::AffinePoint(x, y); 371| 346| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS2_22Secp256r1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 358| 173| static AffinePoint stash(const typename C::AffinePoint& pt) { 359| 173| const auto x_w = pt.x().template stash_value(); 360| 173| const auto y_w = pt.y().template stash_value(); 361| 173| return AffinePoint::_create(instance(), x_w, y_w); 362| 173| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 175| std::optional deserialize_scalar(std::span bytes) const override { 222| 175| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 174, False: 1] ------------------ 223| 174| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 173, False: 1] ------------------ 224| 173| return stash(*scalar); 225| 173| } 226| 174| } 227| | 228| 2| return {}; 229| 175| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 189| 173| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 190| 173| const auto affine = to_affine(from_stash(pt)); 191| | 192| 173| const auto y2 = affine.y().square(); 193| 173| const auto x3_ax_b = C::x3_ax_b(affine.x()); 194| 173| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 195| | 196| 173| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 173| do { \ | | 72| 173| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 173| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 173] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 173| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 173] | | ------------------ ------------------ 197| | 198| 173| return stash(affine); 199| 173| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 380| 173| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 381| 173| if(pt._curve() != instance()) { ------------------ | Branch (381:13): [True: 0, False: 173] ------------------ 382| 0| throw Invalid_Argument("Curve mismatch"); 383| 0| } 384| 173| const auto x = C::FieldElement::from_stash(pt._x()); 385| 173| const auto y = C::FieldElement::from_stash(pt._y()); 386| 173| const auto z = C::FieldElement::from_stash(pt._z()); 387| 173| return typename C::ProjectivePoint(x, y, z); 388| 173| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 207| 173| bool affine_point_is_identity(const AffinePoint& pt) const override { 208| 173| return from_stash(pt).is_identity().as_bool(); 209| 173| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 211| 173| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 212| 173| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 173| do { \ | | 36| 173| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 173| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 173] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 173| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 173] | | ------------------ ------------------ 213| 173| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 214| 173| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 173| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 173| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 173| do { \ | | 36| 173| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 173| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 173] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 173| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 173] | | ------------------ ------------------ 218| 173| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 173| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 173| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE8instanceEv: 341| 1.93k| static std::shared_ptr instance() { 342| 1.93k| static const auto g_curve = std::make_shared>(); 343| 1.93k| return g_curve; 344| 1.93k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE19field_element_bytesEv: 36| 386| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 193| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 193| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 193| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 373| 193| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 374| 193| const auto x_w = pt.x().template stash_value(); 375| 193| const auto y_w = pt.y().template stash_value(); 376| 193| const auto z_w = pt.z().template stash_value(); 377| 193| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 378| 193| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 579| static typename C::Scalar from_stash(const Scalar& s) { 352| 579| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 579] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 579| return C::Scalar::from_stash(s._value()); 356| 579| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEE: 347| 193| static Scalar stash(const typename C::Scalar& s) { 348| 193| return Scalar::_create(instance(), s.template stash_value()); 349| 193| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 364| 386| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 365| 386| if(pt._curve() != instance()) { ------------------ | Branch (365:13): [True: 0, False: 386] ------------------ 366| 0| throw Invalid_Argument("Curve mismatch"); 367| 0| } 368| 386| const auto x = C::FieldElement::from_stash(pt._x()); 369| 386| const auto y = C::FieldElement::from_stash(pt._y()); 370| 386| return typename C::AffinePoint(x, y); 371| 386| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 358| 193| static AffinePoint stash(const typename C::AffinePoint& pt) { 359| 193| const auto x_w = pt.x().template stash_value(); 360| 193| const auto y_w = pt.y().template stash_value(); 361| 193| return AffinePoint::_create(instance(), x_w, y_w); 362| 193| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 195| std::optional deserialize_scalar(std::span bytes) const override { 222| 195| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 195, False: 0] ------------------ 223| 195| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 193, False: 2] ------------------ 224| 193| return stash(*scalar); 225| 193| } 226| 195| } 227| | 228| 2| return {}; 229| 195| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 189| 193| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 190| 193| const auto affine = to_affine(from_stash(pt)); 191| | 192| 193| const auto y2 = affine.y().square(); 193| 193| const auto x3_ax_b = C::x3_ax_b(affine.x()); 194| 193| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 195| | 196| 193| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 193| do { \ | | 72| 193| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 193| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 193] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 193| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 193] | | ------------------ ------------------ 197| | 198| 193| return stash(affine); 199| 193| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 380| 193| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 381| 193| if(pt._curve() != instance()) { ------------------ | Branch (381:13): [True: 0, False: 193] ------------------ 382| 0| throw Invalid_Argument("Curve mismatch"); 383| 0| } 384| 193| const auto x = C::FieldElement::from_stash(pt._x()); 385| 193| const auto y = C::FieldElement::from_stash(pt._y()); 386| 193| const auto z = C::FieldElement::from_stash(pt._z()); 387| 193| return typename C::ProjectivePoint(x, y, z); 388| 193| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 207| 193| bool affine_point_is_identity(const AffinePoint& pt) const override { 208| 193| return from_stash(pt).is_identity().as_bool(); 209| 193| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 211| 193| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 212| 193| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 193| do { \ | | 36| 193| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 193| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 193] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 193| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 193] | | ------------------ ------------------ 213| 193| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 214| 193| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 193| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 193| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 193| do { \ | | 36| 193| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 193| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 193] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 193| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 193] | | ------------------ ------------------ 218| 193| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 193| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 193| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE8instanceEv: 341| 2.53k| static std::shared_ptr instance() { 342| 2.53k| static const auto g_curve = std::make_shared>(); 343| 2.53k| return g_curve; 344| 2.53k| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE19field_element_bytesEv: 36| 506| size_t field_element_bytes() const override { return C::FieldElement::BYTES; } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 38| 250| ProjectivePoint mul_by_g(const Scalar& scalar, RandomNumberGenerator& rng) const override { 39| 250| return stash(m_mul_by_g.mul(from_stash(scalar), rng)); 40| 250| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE5stashERKNS_20ProjectiveCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEESA_EE: 373| 250| static ProjectivePoint stash(const typename C::ProjectivePoint& pt) { 374| 250| const auto x_w = pt.x().template stash_value(); 375| 250| const auto y_w = pt.y().template stash_value(); 376| 250| const auto z_w = pt.z().template stash_value(); 377| 250| return ProjectivePoint::_create(instance(), x_w, y_w, z_w); 378| 250| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 750| static typename C::Scalar from_stash(const Scalar& s) { 352| 750| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 750] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 750| return C::Scalar::from_stash(s._value()); 356| 750| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEE: 347| 250| static Scalar stash(const typename C::Scalar& s) { 348| 250| return Scalar::_create(instance(), s.template stash_value()); 349| 250| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 364| 502| static typename C::AffinePoint from_stash(const AffinePoint& pt) { 365| 502| if(pt._curve() != instance()) { ------------------ | Branch (365:13): [True: 0, False: 502] ------------------ 366| 0| throw Invalid_Argument("Curve mismatch"); 367| 0| } 368| 502| const auto x = C::FieldElement::from_stash(pt._x()); 369| 502| const auto y = C::FieldElement::from_stash(pt._y()); 370| 502| return typename C::AffinePoint(x, y); 371| 502| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 358| 251| static AffinePoint stash(const typename C::AffinePoint& pt) { 359| 251| const auto x_w = pt.x().template stash_value(); 360| 251| const auto y_w = pt.y().template stash_value(); 361| 251| return AffinePoint::_create(instance(), x_w, y_w); 362| 251| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 241| 78| std::optional deserialize_point_uncompressed(std::span bytes) const override { 242| 78| constexpr size_t FieldElementBytes = C::FieldElement::BYTES; 243| 78| constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1; 244| | 245| 78| if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) { ------------------ | Branch (245:13): [True: 78, False: 0] | Branch (245:50): [True: 78, False: 0] ------------------ 246| 78| const auto encoded_point = bytes.subspan(1); 247| 78| auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes)); 248| 78| auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes)); 249| | 250| 78| if(x && y) { ------------------ | Branch (250:16): [True: 77, False: 1] | Branch (250:21): [True: 76, False: 1] ------------------ 251| | // Check that y^2 = x^3 + ax + b 252| 76| const auto lhs = (*y).square(); 253| 76| const auto rhs = C::x3_ax_b(*x); 254| 76| const auto valid = (lhs == rhs); 255| 76| if(valid.as_bool()) { ------------------ | Branch (255:19): [True: 1, False: 75] ------------------ 256| 1| return stash(typename C::AffinePoint(*x, *y)); 257| 1| } 258| 76| } 259| 78| } 260| | 261| 77| return {}; 262| 78| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 252| std::optional deserialize_scalar(std::span bytes) const override { 222| 252| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 251, False: 1] ------------------ 223| 251| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 250, False: 1] ------------------ 224| 250| return stash(*scalar); 225| 250| } 226| 251| } 227| | 228| 2| return {}; 229| 252| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 189| 250| AffinePoint point_to_affine(const ProjectivePoint& pt) const override { 190| 250| const auto affine = to_affine(from_stash(pt)); 191| | 192| 250| const auto y2 = affine.y().square(); 193| 250| const auto x3_ax_b = C::x3_ax_b(affine.x()); 194| 250| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 195| | 196| 250| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 250| do { \ | | 72| 250| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 250| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 250] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 250| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 250] | | ------------------ ------------------ 197| | 198| 250| return stash(affine); 199| 250| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 380| 250| static typename C::ProjectivePoint from_stash(const ProjectivePoint& pt) { 381| 250| if(pt._curve() != instance()) { ------------------ | Branch (381:13): [True: 0, False: 250] ------------------ 382| 0| throw Invalid_Argument("Curve mismatch"); 383| 0| } 384| 250| const auto x = C::FieldElement::from_stash(pt._x()); 385| 250| const auto y = C::FieldElement::from_stash(pt._y()); 386| 250| const auto z = C::FieldElement::from_stash(pt._z()); 387| 250| return typename C::ProjectivePoint(x, y, z); 388| 250| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 207| 251| bool affine_point_is_identity(const AffinePoint& pt) const override { 208| 251| return from_stash(pt).is_identity().as_bool(); 209| 251| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 211| 251| void serialize_point(std::span bytes, const AffinePoint& pt) const override { 212| 251| BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point"); ------------------ | | 35| 251| do { \ | | 36| 251| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 251| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 251] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 251| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 251] | | ------------------ ------------------ 213| 251| from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>()); 214| 251| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 250| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 250| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 250| do { \ | | 36| 250| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 250| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 250] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 250| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 250] | | ------------------ ------------------ 218| 250| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 250| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 250| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EEC2EOS4_: 411| 864| PolynomialVector(ThisPolynomialVector&& other) noexcept = default; _ZNK5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE4sizeEv: 416| 812| size_t size() const { return m_vec.size(); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EED2Ev: 414| 1.29k| ~PolynomialVector() = default; _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EED2Ev: 276| 7.92k| ~Polynomial() = default; _ZN5Botan8CRYSTALS3nttITkNS0_14crystals_traitENS_19DilithiumPolyTraitsEEENS0_16PolynomialVectorIT_LNS0_6DomainE1EEENS3_IS4_LS5_0EEE: 586| 72|PolynomialVector ntt(PolynomialVector polyvec) { 587| 72| auto polyvec_ntt = detail::domain_cast(std::move(polyvec)); 588| 392| for(auto& poly : polyvec_ntt) { ------------------ | Branch (588:19): [True: 392, False: 72] ------------------ 589| 392| Trait::ntt(poly.coefficients()); 590| 392| } 591| 72| return polyvec_ntt; 592| 72|} _ZN5Botan8CRYSTALS6detail11domain_castILNS0_6DomainE1ETtTyTnS3_ENS0_16PolynomialVectorETkNS0_14crystals_traitENS_19DilithiumPolyTraitsELS3_0EQneT_T2_EET0_IT1_XT_EEOS6_IS7_XT2_EE: 165| 72|StructureT domain_cast(StructureT&& p) { 166| | // The public factory method `from_domain_cast` is just a workaround for 167| | // Xcode and NDK not understanding the friend declaration to allow this 168| | // to directly call the private constructor. 169| 72| return StructureT::from_domain_cast(std::move(p)); 170| 72|} _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EE16from_domain_castILS3_0EQneT0_TL0__EES4_ONS1_IS2_XT_EEE: 398| 72| static PolynomialVector from_domain_cast(PolynomialVector&& other) { 399| 72| return PolynomialVector(std::move(other)); 400| 72| } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EEC2ILS3_0EQneT0_TL0__EEONS1_IS2_XT_EEE: 381| 72| m_polys_storage(std::move(other.m_polys_storage)) { 382| 72| BOTAN_DEBUG_ASSERT(m_polys_storage.size() % Trait::N == 0); ------------------ | | 137| 72| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 72| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 72] | | ------------------ ------------------ 383| 72| const size_t vecsize = m_polys_storage.size() / Trait::N; 384| 464| for(size_t i = 0; i < vecsize; ++i) { ------------------ | Branch (384:28): [True: 392, False: 72] ------------------ 385| 392| m_vec.emplace_back( 386| 392| Polynomial(std::span{m_polys_storage}.subspan(i * Trait::N).template first())); 387| 392| } 388| 72| } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE1EEC2EOS4_: 263| 7.29k| m_coeffs_storage(std::move(other.m_coeffs_storage)), m_coeffs(other.m_coeffs) {} _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE1EEC2ENSt3__14spanIiLm256EEE: 258| 3.40k| explicit Polynomial(std::span coeffs) : m_coeffs(coeffs) { BOTAN_DEBUG_ASSERT(!owns_storage()); } ------------------ | | 137| 3.40k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 3.40k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 3.40k] | | ------------------ ------------------ _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE1EED2Ev: 276| 10.7k| ~Polynomial() = default; _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EE5beginEv: 493| 72| decltype(auto) begin() { return m_vec.begin(); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EE3endEv: 497| 72| decltype(auto) end() { return m_vec.end(); } _ZN5Botan8CRYSTALS10Trait_BaseINS_18DilithiumConstantsENS_19DilithiumPolyTraitsEE5fqmulEii: 98| 1.63M| static constexpr T fqmul(T a, T b) { return DerivedT::montgomery_reduce_coefficient(static_cast(a) * b); } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE1EE12coefficientsEv: 304| 1.29k| std::span coefficients() { return m_coeffs; } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EEC2Em: 403| 360| explicit PolynomialVector(size_t vecsize) : m_polys_storage(vecsize * Trait::N) { 404| 2.50k| for(size_t i = 0; i < vecsize; ++i) { ------------------ | Branch (404:28): [True: 2.14k, False: 360] ------------------ 405| 2.14k| m_vec.emplace_back( 406| 2.14k| Polynomial(std::span{m_polys_storage}.subspan(i * Trait::N).template first())); 407| 2.14k| } 408| 360| } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EEC2EOS4_: 263| 5.32k| m_coeffs_storage(std::move(other.m_coeffs_storage)), m_coeffs(other.m_coeffs) {} _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EEC2ENSt3__14spanIiLm256EEE: 258| 2.59k| explicit Polynomial(std::span coeffs) : m_coeffs(coeffs) { BOTAN_DEBUG_ASSERT(!owns_storage()); } ------------------ | | 137| 2.59k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 2.59k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 2.59k] | | ------------------ ------------------ _ZNK5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EEixEm: 481| 231k| const Polynomial& operator[](size_t i) const { return m_vec[i]; } _ZNK5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EEixEm: 310| 231k| T operator[](size_t i) const { return m_coeffs[i]; } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EEixEm: 479| 231k| Polynomial& operator[](size_t i) { return m_vec[i]; } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EEixEm: 308| 231k| T& operator[](size_t i) { return m_coeffs[i]; } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EED2Ev: 414| 668| ~PolynomialVector() = default; _ZN5Botan8CRYSTALS16PolynomialMatrixINS_19DilithiumPolyTraitsEED2Ev: 521| 72| ~PolynomialMatrix() = default; _ZN5Botan8CRYSTALSmlITkNS0_14crystals_traitENS_19DilithiumPolyTraitsEEENS0_16PolynomialVectorIT_LNS0_6DomainE1EEERKNS0_16PolynomialMatrixIS4_EERKS6_: 630| 72| const PolynomialVector& vec) { 631| 72| PolynomialVector result(mat.size()); 632| 524| for(size_t i = 0; i < mat.size(); ++i) { ------------------ | Branch (632:22): [True: 452, False: 72] ------------------ 633| 452| Trait::polyvec_pointwise_acc_montgomery(result[i].coefficients(), mat[i].coefficients(), vec.coefficients()); 634| 452| } 635| 72| return result; 636| 72|} _ZNK5Botan8CRYSTALS16PolynomialMatrixINS_19DilithiumPolyTraitsEE4sizeEv: 523| 596| size_t size() const { return m_mat.size(); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EEC2Em: 403| 524| explicit PolynomialVector(size_t vecsize) : m_polys_storage(vecsize * Trait::N) { 404| 3.54k| for(size_t i = 0; i < vecsize; ++i) { ------------------ | Branch (404:28): [True: 3.01k, False: 524] ------------------ 405| 3.01k| m_vec.emplace_back( 406| 3.01k| Polynomial(std::span{m_polys_storage}.subspan(i * Trait::N).template first())); 407| 3.01k| } 408| 524| } _ZN5Botan8CRYSTALS10Trait_BaseINS_18DilithiumConstantsENS_19DilithiumPolyTraitsEE32polyvec_pointwise_acc_montgomeryENSt3__14spanIiLm256EEENS6_IKiLm18446744073709551615EEES9_: 133| 452| std::span v) { 134| 452| clear_mem(w); 135| 452| std::array t{}; 136| 3.01k| for(size_t i = 0; i < polys_in_polyvec(u); ++i) { ------------------ | Branch (136:28): [True: 2.56k, False: 452] ------------------ 137| 2.56k| DerivedT::poly_pointwise_montgomery(t, poly_in_polyvec(u, i), poly_in_polyvec(v, i)); 138| 2.56k| poly_add(w, w, t); 139| 2.56k| } 140| 452| barrett_reduce(w); 141| 452| } _ZN5Botan8CRYSTALS10Trait_BaseINS_18DilithiumConstantsENS_19DilithiumPolyTraitsEE16polys_in_polyvecENSt3__14spanIKiLm18446744073709551615EEE: 83| 3.01k| static constexpr size_t polys_in_polyvec(std::span polyvec) { 84| 3.01k| BOTAN_DEBUG_ASSERT(polyvec.size() % N == 0); ------------------ | | 137| 3.01k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 3.01k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 3.01k] | | ------------------ ------------------ 85| 3.01k| return polyvec.size() / N; 86| 3.01k| } _ZN5Botan8CRYSTALS10Trait_BaseINS_18DilithiumConstantsENS_19DilithiumPolyTraitsEE15poly_in_polyvecIKiQoosr3stdE7same_asINT_1TETL0__Esr3stdE7same_asIKS8_S9_EEENSt3__14spanIS7_Lm256EEENSC_IS7_Lm18446744073709551615EEEm: 91| 5.12k| static constexpr std::span poly_in_polyvec(std::span polyvec, size_t index) { 92| 5.12k| BOTAN_DEBUG_ASSERT(polyvec.size() % N == 0); ------------------ | | 137| 5.12k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 5.12k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 5.12k] | | ------------------ ------------------ 93| 5.12k| BOTAN_DEBUG_ASSERT(polyvec.size() / N > index); ------------------ | | 137| 5.12k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 5.12k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 5.12k] | | ------------------ ------------------ 94| 5.12k| const auto polyspan = polyvec.subspan(index * N, N); 95| 5.12k| return std::span{polyspan.data(), polyspan.size()}; 96| 5.12k| } _ZN5Botan8CRYSTALS10Trait_BaseINS_18DilithiumConstantsENS_19DilithiumPolyTraitsEE8poly_addENSt3__14spanIiLm256EEENS6_IKiLm256EEES9_: 101| 3.01k| static constexpr void poly_add(std::span result, std::span lhs, std::span rhs) { 102| 775k| for(size_t i = 0; i < N; ++i) { ------------------ | Branch (102:28): [True: 772k, False: 3.01k] ------------------ 103| 772k| result[i] = lhs[i] + rhs[i]; 104| 772k| } 105| 3.01k| } _ZN5Botan8CRYSTALS10Trait_BaseINS_18DilithiumConstantsENS_19DilithiumPolyTraitsEE14barrett_reduceENSt3__14spanIiLm256EEE: 124| 904| constexpr static void barrett_reduce(std::span poly) { 125| 231k| for(auto& coeff : poly) { ------------------ | Branch (125:26): [True: 231k, False: 904] ------------------ 126| 231k| coeff = DerivedT::barrett_reduce_coefficient(coeff); 127| 231k| } 128| 904| } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EEixEm: 479| 3.01k| Polynomial& operator[](size_t i) { return m_vec[i]; } _ZNK5Botan8CRYSTALS16PolynomialMatrixINS_19DilithiumPolyTraitsEEixEm: 534| 452| const PolynomialVector& operator[](size_t i) const { return m_mat[i]; } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EE12coefficientsEv: 447| 904| std::span coefficients() const { return m_polys_storage; } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EE6reduceEv: 465| 72| ThisPolynomialVector& reduce() { 466| 452| for(auto& p : m_vec) { ------------------ | Branch (466:22): [True: 452, False: 72] ------------------ 467| 452| Trait::barrett_reduce(p.coefficients()); 468| 452| } 469| 72| return *this; 470| 72| } _ZN5Botan8CRYSTALS11inverse_nttITkNS0_14crystals_traitENS_19DilithiumPolyTraitsEEENS0_16PolynomialVectorIT_LNS0_6DomainE0EEENS3_IS4_LS5_1EEE: 595| 72|PolynomialVector inverse_ntt(PolynomialVector polyvec_ntt) { 596| 72| auto polyvec = detail::domain_cast(std::move(polyvec_ntt)); 597| 452| for(auto& poly : polyvec) { ------------------ | Branch (597:19): [True: 452, False: 72] ------------------ 598| 452| Trait::inverse_ntt(poly.coefficients()); 599| 452| } 600| 72| return polyvec; 601| 72|} _ZN5Botan8CRYSTALS6detail11domain_castILNS0_6DomainE0ETtTyTnS3_ENS0_16PolynomialVectorETkNS0_14crystals_traitENS_19DilithiumPolyTraitsELS3_1EQneT_T2_EET0_IT1_XT_EEOS6_IS7_XT2_EE: 165| 72|StructureT domain_cast(StructureT&& p) { 166| | // The public factory method `from_domain_cast` is just a workaround for 167| | // Xcode and NDK not understanding the friend declaration to allow this 168| | // to directly call the private constructor. 169| 72| return StructureT::from_domain_cast(std::move(p)); 170| 72|} _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE16from_domain_castILS3_1EQneT0_TL0__EES4_ONS1_IS2_XT_EEE: 398| 72| static PolynomialVector from_domain_cast(PolynomialVector&& other) { 399| 72| return PolynomialVector(std::move(other)); 400| 72| } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EEC2ILS3_1EQneT0_TL0__EEONS1_IS2_XT_EEE: 381| 72| m_polys_storage(std::move(other.m_polys_storage)) { 382| 72| BOTAN_DEBUG_ASSERT(m_polys_storage.size() % Trait::N == 0); ------------------ | | 137| 72| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 72| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 72] | | ------------------ ------------------ 383| 72| const size_t vecsize = m_polys_storage.size() / Trait::N; 384| 524| for(size_t i = 0; i < vecsize; ++i) { ------------------ | Branch (384:28): [True: 452, False: 72] ------------------ 385| 452| m_vec.emplace_back( 386| 452| Polynomial(std::span{m_polys_storage}.subspan(i * Trait::N).template first())); 387| 452| } 388| 72| } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE5beginEv: 493| 216| decltype(auto) begin() { return m_vec.begin(); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE3endEv: 497| 216| decltype(auto) end() { return m_vec.end(); } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EE12coefficientsEv: 304| 1.80k| std::span coefficients() { return m_coeffs; } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE1EEC2EOS4_: 411| 72| PolynomialVector(ThisPolynomialVector&& other) noexcept = default; _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE17conditional_add_qEv: 472| 72| ThisPolynomialVector& conditional_add_q() { 473| 452| for(auto& v : m_vec) { ------------------ | Branch (473:22): [True: 452, False: 72] ------------------ 474| 452| Trait::poly_cadd_q(v.coefficients()); 475| 452| } 476| 72| return *this; 477| 72| } _ZN5Botan8CRYSTALS10Trait_BaseINS_18DilithiumConstantsENS_19DilithiumPolyTraitsEE11poly_cadd_qENSt3__14spanIiLm256EEE: 114| 452| static constexpr void poly_cadd_q(std::span coeffs) { 115| 115k| for(auto& coeff : coeffs) { ------------------ | Branch (115:26): [True: 115k, False: 452] ------------------ 116| 115k| using unsigned_T = std::make_unsigned_t; 117| 115k| const auto is_negative = CT::Mask::expand_top_bit(static_cast(coeff)); 118| 115k| coeff += is_negative.if_set_return(Q); 119| 115k| } 120| 452| } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE5cloneEv: 420| 72| ThisPolynomialVector clone() const { 421| 72| ThisPolynomialVector res(size()); 422| | 423| | // The default-constructed PolynomialVector has set up res.m_vec to 424| | // point to res.m_polys_storage. Therefore we can just copy the data 425| | // into res.m_polys_storage to fill the non-owning polynomials. 426| 72| copy_mem(res.m_polys_storage, m_polys_storage); 427| | 428| 72| return res; 429| 72| } _ZNK5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EE18_const_time_poisonEv: 332| 844| void _const_time_poison() const { CT::poison(m_coeffs); } _ZNK5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EE12coefficientsEv: 306| 452| std::span coefficients() const { return m_coeffs; } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE20_const_time_unpoisonEv: 503| 288| void _const_time_unpoison() const { CT::unpoison_range(m_vec); } _ZNK5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EE20_const_time_unpoisonEv: 334| 1.74k| void _const_time_unpoison() const { CT::unpoison(m_coeffs); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EEpLERKS4_: 449| 72| ThisPolynomialVector& operator+=(const ThisPolynomialVector& other) { 450| 72| BOTAN_ASSERT(m_vec.size() == other.m_vec.size(), "cannot add polynomial vectors of differing lengths"); ------------------ | | 71| 72| do { \ | | 72| 72| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 72| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 72] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 72| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 72] | | ------------------ ------------------ 451| 524| for(size_t i = 0; i < m_vec.size(); ++i) { ------------------ | Branch (451:28): [True: 452, False: 72] ------------------ 452| 452| Trait::poly_add(m_vec[i].coefficients(), m_vec[i].coefficients(), other.m_vec[i].coefficients()); 453| 452| } 454| 72| return *this; 455| 72| } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EE5beginEv: 312| 844| decltype(auto) begin() { return m_coeffs.begin(); } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EE3endEv: 316| 844| decltype(auto) end() { return m_coeffs.end(); } _ZNK5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE0EE4sizeEv: 278| 145k| constexpr size_t size() const { return m_coeffs.size(); } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE5beginEv: 495| 72| decltype(auto) begin() const { return m_vec.begin(); } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS0_6DomainE0EE3endEv: 499| 72| decltype(auto) end() const { return m_vec.end(); } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE1EE5beginEv: 312| 2.56k| decltype(auto) begin() { return m_coeffs.begin(); } _ZN5Botan8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS0_6DomainE1EE3endEv: 316| 2.56k| decltype(auto) end() { return m_coeffs.end(); } _ZN5Botan8CRYSTALS16PolynomialMatrixINS_19DilithiumPolyTraitsEEC2Emm: 525| 72| PolynomialMatrix(size_t rows, size_t cols) { 526| 72| m_mat.reserve(rows); 527| 524| for(size_t i = 0; i < rows; ++i) { ------------------ | Branch (527:28): [True: 452, False: 72] ------------------ 528| 452| m_mat.emplace_back(cols); 529| 452| } 530| 72| } _ZN5Botan8CRYSTALS16PolynomialMatrixINS_19DilithiumPolyTraitsEEixEm: 532| 2.56k| PolynomialVector& operator[](size_t i) { return m_mat[i]; } _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EED2Ev: 414| 496| ~PolynomialVector() = default; _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EED2Ev: 276| 2.58k| ~Polynomial() = default; _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EEC2Em: 403| 188| explicit PolynomialVector(size_t vecsize) : m_polys_storage(vecsize * Trait::N) { 404| 834| for(size_t i = 0; i < vecsize; ++i) { ------------------ | Branch (404:28): [True: 646, False: 188] ------------------ 405| 646| m_vec.emplace_back( 406| 646| Polynomial(std::span{m_polys_storage}.subspan(i * Trait::N).template first())); 407| 646| } 408| 188| } _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EEC2EOS4_: 263| 1.65k| m_coeffs_storage(std::move(other.m_coeffs_storage)), m_coeffs(other.m_coeffs) {} _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EEC2ENSt3__14spanIsLm256EEE: 258| 934| explicit Polynomial(std::span coeffs) : m_coeffs(coeffs) { BOTAN_DEBUG_ASSERT(!owns_storage()); } ------------------ | | 137| 934| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 934| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 934] | | ------------------ ------------------ _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EEC2EOS4_: 411| 220| PolynomialVector(ThisPolynomialVector&& other) noexcept = default; _ZN5Botan8CRYSTALS16PolynomialMatrixINS_15KyberPolyTraitsEED2Ev: 521| 44| ~PolynomialMatrix() = default; _ZN5Botan8CRYSTALS10Trait_BaseINS_14KyberConstantsENS_15KyberPolyTraitsEE5fqmulEss: 98| 36.8k| static constexpr T fqmul(T a, T b) { return DerivedT::montgomery_reduce_coefficient(static_cast(a) * b); } _ZN5Botan8CRYSTALS10Trait_BaseINS_14KyberConstantsENS_15KyberPolyTraitsEE14barrett_reduceENSt3__14spanIsLm256EEE: 124| 432| constexpr static void barrett_reduce(std::span poly) { 125| 110k| for(auto& coeff : poly) { ------------------ | Branch (125:26): [True: 110k, False: 432] ------------------ 126| 110k| coeff = DerivedT::barrett_reduce_coefficient(coeff); 127| 110k| } 128| 432| } _ZNK5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE0EE4sizeEv: 278| 10.9k| constexpr size_t size() const { return m_coeffs.size(); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EE5beginEv: 493| 132| decltype(auto) begin() { return m_vec.begin(); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EE3endEv: 497| 132| decltype(auto) end() { return m_vec.end(); } _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EE5beginEv: 312| 716| decltype(auto) begin() { return m_coeffs.begin(); } _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EE3endEv: 316| 716| decltype(auto) end() { return m_coeffs.end(); } _ZNK5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EE4sizeEv: 278| 9.36k| constexpr size_t size() const { return m_coeffs.size(); } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EE20_const_time_unpoisonEv: 503| 88| void _const_time_unpoison() const { CT::unpoison_range(m_vec); } _ZNK5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EE20_const_time_unpoisonEv: 334| 288| void _const_time_unpoison() const { CT::unpoison(m_coeffs); } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EE5beginEv: 495| 44| decltype(auto) begin() const { return m_vec.begin(); } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EE3endEv: 499| 44| decltype(auto) end() const { return m_vec.end(); } _ZNK5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EEixEm: 310| 36.8k| T operator[](size_t i) const { return m_coeffs[i]; } _ZNK5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EE12coefficientsEv: 306| 144| std::span coefficients() const { return m_coeffs; } _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE0EED2Ev: 276| 796| ~Polynomial() = default; _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE0EEC2EOS4_: 411| 176| PolynomialVector(ThisPolynomialVector&& other) noexcept = default; _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE0EED2Ev: 414| 264| ~PolynomialVector() = default; _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE0EEC2Em: 403| 88| explicit PolynomialVector(size_t vecsize) : m_polys_storage(vecsize * Trait::N) { 404| 376| for(size_t i = 0; i < vecsize; ++i) { ------------------ | Branch (404:28): [True: 288, False: 88] ------------------ 405| 288| m_vec.emplace_back( 406| 288| Polynomial(std::span{m_polys_storage}.subspan(i * Trait::N).template first())); 407| 288| } 408| 88| } _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE0EEC2EOS4_: 263| 508| m_coeffs_storage(std::move(other.m_coeffs_storage)), m_coeffs(other.m_coeffs) {} _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE0EEC2ENSt3__14spanIsLm256EEE: 258| 288| explicit Polynomial(std::span coeffs) : m_coeffs(coeffs) { BOTAN_DEBUG_ASSERT(!owns_storage()); } ------------------ | | 137| 288| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 288| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 288] | | ------------------ ------------------ _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE0EEixEm: 308| 73.7k| T& operator[](size_t i) { return m_coeffs[i]; } _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE0EE11polynomialsEv: 484| 88| std::vector*> polynomials() { 485| 88| std::vector*> result; 486| 88| result.reserve(m_vec.size()); 487| 288| for(auto& p : m_vec) { ------------------ | Branch (487:22): [True: 288, False: 88] ------------------ 488| 288| result.push_back(&p); 489| 288| } 490| 88| return result; 491| 88| } _ZN5Botan8CRYSTALS3nttITkNS0_14crystals_traitENS_15KyberPolyTraitsEEENS0_16PolynomialVectorIT_LNS0_6DomainE1EEENS3_IS4_LS5_0EEE: 586| 88|PolynomialVector ntt(PolynomialVector polyvec) { 587| 88| auto polyvec_ntt = detail::domain_cast(std::move(polyvec)); 588| 288| for(auto& poly : polyvec_ntt) { ------------------ | Branch (588:19): [True: 288, False: 88] ------------------ 589| 288| Trait::ntt(poly.coefficients()); 590| 288| } 591| 88| return polyvec_ntt; 592| 88|} _ZN5Botan8CRYSTALS6detail11domain_castILNS0_6DomainE1ETtTyTnS3_ENS0_16PolynomialVectorETkNS0_14crystals_traitENS_15KyberPolyTraitsELS3_0EQneT_T2_EET0_IT1_XT_EEOS6_IS7_XT2_EE: 165| 88|StructureT domain_cast(StructureT&& p) { 166| | // The public factory method `from_domain_cast` is just a workaround for 167| | // Xcode and NDK not understanding the friend declaration to allow this 168| | // to directly call the private constructor. 169| 88| return StructureT::from_domain_cast(std::move(p)); 170| 88|} _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EE16from_domain_castILS3_0EQneT0_TL0__EES4_ONS1_IS2_XT_EEE: 398| 88| static PolynomialVector from_domain_cast(PolynomialVector&& other) { 399| 88| return PolynomialVector(std::move(other)); 400| 88| } _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EEC2ILS3_0EQneT0_TL0__EEONS1_IS2_XT_EEE: 381| 88| m_polys_storage(std::move(other.m_polys_storage)) { 382| 88| BOTAN_DEBUG_ASSERT(m_polys_storage.size() % Trait::N == 0); ------------------ | | 137| 88| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 88| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 88] | | ------------------ ------------------ 383| 88| const size_t vecsize = m_polys_storage.size() / Trait::N; 384| 376| for(size_t i = 0; i < vecsize; ++i) { ------------------ | Branch (384:28): [True: 288, False: 88] ------------------ 385| 288| m_vec.emplace_back( 386| 288| Polynomial(std::span{m_polys_storage}.subspan(i * Trait::N).template first())); 387| 288| } 388| 88| } _ZN5Botan8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS0_6DomainE1EE12coefficientsEv: 304| 1.00k| std::span coefficients() { return m_coeffs; } _ZN5Botan8CRYSTALSmlITkNS0_14crystals_traitENS_15KyberPolyTraitsEEENS0_16PolynomialVectorIT_LNS0_6DomainE1EEERKNS0_16PolynomialMatrixIS4_EERKS6_: 630| 44| const PolynomialVector& vec) { 631| 44| PolynomialVector result(mat.size()); 632| 188| for(size_t i = 0; i < mat.size(); ++i) { ------------------ | Branch (632:22): [True: 144, False: 44] ------------------ 633| 144| Trait::polyvec_pointwise_acc_montgomery(result[i].coefficients(), mat[i].coefficients(), vec.coefficients()); 634| 144| } 635| 44| return result; 636| 44|} _ZNK5Botan8CRYSTALS16PolynomialMatrixINS_15KyberPolyTraitsEE4sizeEv: 523| 232| size_t size() const { return m_mat.size(); } _ZN5Botan8CRYSTALS10Trait_BaseINS_14KyberConstantsENS_15KyberPolyTraitsEE32polyvec_pointwise_acc_montgomeryENSt3__14spanIsLm256EEENS6_IKsLm18446744073709551615EEES9_: 133| 144| std::span v) { 134| 144| clear_mem(w); 135| 144| std::array t{}; 136| 646| for(size_t i = 0; i < polys_in_polyvec(u); ++i) { ------------------ | Branch (136:28): [True: 502, False: 144] ------------------ 137| 502| DerivedT::poly_pointwise_montgomery(t, poly_in_polyvec(u, i), poly_in_polyvec(v, i)); 138| 502| poly_add(w, w, t); 139| 502| } 140| 144| barrett_reduce(w); 141| 144| } _ZN5Botan8CRYSTALS10Trait_BaseINS_14KyberConstantsENS_15KyberPolyTraitsEE16polys_in_polyvecENSt3__14spanIKsLm18446744073709551615EEE: 83| 646| static constexpr size_t polys_in_polyvec(std::span polyvec) { 84| 646| BOTAN_DEBUG_ASSERT(polyvec.size() % N == 0); ------------------ | | 137| 646| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 646| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 646] | | ------------------ ------------------ 85| 646| return polyvec.size() / N; 86| 646| } _ZN5Botan8CRYSTALS10Trait_BaseINS_14KyberConstantsENS_15KyberPolyTraitsEE15poly_in_polyvecIKsQoosr3stdE7same_asINT_1TETL0__Esr3stdE7same_asIKS8_S9_EEENSt3__14spanIS7_Lm256EEENSC_IS7_Lm18446744073709551615EEEm: 91| 1.00k| static constexpr std::span poly_in_polyvec(std::span polyvec, size_t index) { 92| 1.00k| BOTAN_DEBUG_ASSERT(polyvec.size() % N == 0); ------------------ | | 137| 1.00k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 1.00k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 1.00k] | | ------------------ ------------------ 93| 1.00k| BOTAN_DEBUG_ASSERT(polyvec.size() / N > index); ------------------ | | 137| 1.00k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 1.00k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 1.00k] | | ------------------ ------------------ 94| 1.00k| const auto polyspan = polyvec.subspan(index * N, N); 95| 1.00k| return std::span{polyspan.data(), polyspan.size()}; 96| 1.00k| } _ZN5Botan8CRYSTALS10Trait_BaseINS_14KyberConstantsENS_15KyberPolyTraitsEE8poly_addENSt3__14spanIsLm256EEENS6_IKsLm256EEES9_: 101| 646| static constexpr void poly_add(std::span result, std::span lhs, std::span rhs) { 102| 166k| for(size_t i = 0; i < N; ++i) { ------------------ | Branch (102:28): [True: 165k, False: 646] ------------------ 103| 165k| result[i] = lhs[i] + rhs[i]; 104| 165k| } 105| 646| } _ZNK5Botan8CRYSTALS16PolynomialMatrixINS_15KyberPolyTraitsEEixEm: 534| 144| const PolynomialVector& operator[](size_t i) const { return m_mat[i]; } _ZNK5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EE12coefficientsEv: 447| 288| std::span coefficients() const { return m_polys_storage; } _ZN5Botan8CRYSTALS10montgomeryITkNS0_14crystals_traitENS_15KyberPolyTraitsELNS0_6DomainE1EEENS0_16PolynomialVectorIT_XT0_EEES6_: 610| 44|PolynomialVector montgomery(PolynomialVector polyvec) { 611| 144| for(auto& p : polyvec) { ------------------ | Branch (611:16): [True: 144, False: 44] ------------------ 612| 144| detail::montgomery(p); 613| 144| } 614| 44| return polyvec; 615| 44|} _ZN5Botan8CRYSTALS6detail10montgomeryITkNS0_14crystals_traitENS_15KyberPolyTraitsELNS0_6DomainE1EEEvRNS0_10PolynomialIT_XT0_EEE: 552| 144|void montgomery(Polynomial& p) { 553| 36.8k| for(auto& c : p) { ------------------ | Branch (553:16): [True: 36.8k, False: 144] ------------------ 554| 36.8k| c = Trait::to_montgomery(c); 555| 36.8k| } 556| 144|} _ZN5Botan8CRYSTALS10Trait_BaseINS_14KyberConstantsENS_15KyberPolyTraitsEE13to_montgomeryEs: 122| 36.8k| static constexpr T to_montgomery(T a) { return fqmul(a, MONTY_SQUARED); } _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EEpLERKS4_: 449| 44| ThisPolynomialVector& operator+=(const ThisPolynomialVector& other) { 450| 44| BOTAN_ASSERT(m_vec.size() == other.m_vec.size(), "cannot add polynomial vectors of differing lengths"); ------------------ | | 71| 44| do { \ | | 72| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 44| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 44] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 44| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 44] | | ------------------ ------------------ 451| 188| for(size_t i = 0; i < m_vec.size(); ++i) { ------------------ | Branch (451:28): [True: 144, False: 44] ------------------ 452| 144| Trait::poly_add(m_vec[i].coefficients(), m_vec[i].coefficients(), other.m_vec[i].coefficients()); 453| 144| } 454| 44| return *this; 455| 44| } _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EE6reduceEv: 465| 88| ThisPolynomialVector& reduce() { 466| 288| for(auto& p : m_vec) { ------------------ | Branch (466:22): [True: 288, False: 88] ------------------ 467| 288| Trait::barrett_reduce(p.coefficients()); 468| 288| } 469| 88| return *this; 470| 88| } _ZN5Botan8CRYSTALS16PolynomialMatrixINS_15KyberPolyTraitsEEC2Emm: 525| 44| PolynomialMatrix(size_t rows, size_t cols) { 526| 44| m_mat.reserve(rows); 527| 188| for(size_t i = 0; i < rows; ++i) { ------------------ | Branch (527:28): [True: 144, False: 44] ------------------ 528| 144| m_mat.emplace_back(cols); 529| 144| } 530| 44| } _ZN5Botan8CRYSTALS16PolynomialMatrixINS_15KyberPolyTraitsEEixEm: 532| 572| PolynomialVector& operator[](size_t i) { return m_mat[i]; } _ZN5Botan8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS0_6DomainE1EEixEm: 479| 716| Polynomial& operator[](size_t i) { return m_vec[i]; } _ZN5Botan8CRYSTALS4packILi1023ETkNS0_14crystals_traitENS_19DilithiumPolyTraitsELNS0_6DomainE0EEEvRKNS0_10PolynomialIT0_XT1_EEERNS_13BufferStufferE: 223| 452|constexpr void pack(const Polynomial& p, BufferStuffer& stuffer) { 224| 452| using unsigned_T = std::make_unsigned_t; 225| 452| pack(p, stuffer, [](typename PolyTrait::T x) { return static_cast(x); }); 226| 452|} _ZN5Botan8CRYSTALS4packILi1023ETkNS0_14crystals_traitENS_19DilithiumPolyTraitsELNS0_6DomainE0ETkNS0_12coeff_map_fnINT0_1TEEEZNS0_4packILi1023ETkNS0_14crystals_traitES2_LS3_0EEEvRKNS0_10PolynomialIS5_XT1_EEERNS_13BufferStufferEEUliE_EEvSB_SD_T2_: 117| 452|constexpr void pack(const Polynomial& p, BufferStuffer& stuffer, MapFnT map) { 118| 452| using trait = BitPackingTrait; 119| | 120| 452| BOTAN_DEBUG_ASSERT(stuffer.remaining_capacity() >= p.size() * trait::bits_per_coeff / 8); ------------------ | | 137| 452| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 452| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 452] | | ------------------ ------------------ 121| | 122| | // Bit-packing example that shows a coefficients' bit-pack that spills across 123| | // more than one 64-bit collectors. This illustrates the algorithm below. 124| | // 125| | // 0 64 128 126| | // Collectors (64 bits): | collectors[0] | collectors[1] | 127| | // | | | 128| | // Coefficients (11 bits): | c[0] | c[1] | c[2] | c[3] | c[4] | c[5] | c[6] | c[7] | | | | | ... 129| | // | | | 130| | // | < byte-aligned coefficient pack > | < byte-aligned pad. > | 131| | // | (one inner loop iteration) | 132| | // 0 88 (divisible by 8) 133| | 134| 29.3k| for(size_t i = 0; i < p.size(); i += trait::coeffs_per_pack) { ------------------ | Branch (134:22): [True: 28.9k, False: 452] ------------------ 135| | // The collectors array is filled with bit-packed coefficients to produce 136| | // a byte-aligned pack of coefficients. When coefficients fall onto the 137| | // boundary of two collectors, their bits must be split. 138| 28.9k| typename trait::collector_array collectors = {0}; 139| 144k| for(size_t j = 0, bit_offset = 0, c = 0; j < trait::coeffs_per_pack; ++j) { ------------------ | Branch (139:48): [True: 115k, False: 28.9k] ------------------ 140| | // Transform p[i] via a custom map function (that may be a NOOP). 141| 115k| const typename trait::unsigned_T mapped_coeff = map(p[i + j]); 142| 115k| const auto coeff_value = static_cast(mapped_coeff); 143| | 144| | // pack() is called only on data produced by us. If the values returned 145| | // by the map function are not in the range [0, range] we have a bug. 146| 115k| BOTAN_DEBUG_ASSERT(coeff_value <= range); ------------------ | | 137| 115k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 115k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 115k] | | ------------------ ------------------ 147| | 148| | // Bit-pack the coefficient into the collectors array and keep track of 149| | // the bit-offset within the current collector. Note that this might 150| | // shift some high-bits of the coefficient out of the current collector. 151| 115k| collectors[c] |= coeff_value << bit_offset; 152| 115k| bit_offset += trait::bits_per_coeff; 153| | 154| | // If the bit-offset now exceeds the collector's bit-width, we fill the 155| | // next collector with the high-bits that didn't fit into the previous. 156| | // The bit-offset is adjusted to now point into the new collector. 157| 115k| if(bit_offset > trait::bits_in_collector) { ------------------ | Branch (157:13): [True: 0, False: 115k] ------------------ 158| 0| bit_offset = bit_offset - trait::bits_in_collector; 159| 0| collectors[++c] = coeff_value >> (trait::bits_per_coeff - bit_offset); 160| 0| } 161| 115k| } 162| | 163| | // One byte-aligned pack of bit-packed coefficients is now stored in the 164| | // collectors and can be written to an output buffer. Note that we might 165| | // have to remove some padding bytes of unused collector space. 166| 28.9k| const auto bytes = store_le(collectors); 167| 28.9k| stuffer.append(std::span{bytes}.template first()); 168| 28.9k| } 169| 452|} _ZZN5Botan8CRYSTALS4packILi1023ETkNS0_14crystals_traitENS_19DilithiumPolyTraitsELNS0_6DomainE0EEEvRKNS0_10PolynomialIT0_XT1_EEERNS_13BufferStufferEENKUliE_clEi: 225| 115k| pack(p, stuffer, [](typename PolyTrait::T x) { return static_cast(x); }); _ZN5Botan8CRYSTALS4packILi3328ETkNS0_14crystals_traitENS_15KyberPolyTraitsELNS0_6DomainE1EEEvRKNS0_10PolynomialIT0_XT1_EEERNS_13BufferStufferE: 223| 144|constexpr void pack(const Polynomial& p, BufferStuffer& stuffer) { 224| 144| using unsigned_T = std::make_unsigned_t; 225| 144| pack(p, stuffer, [](typename PolyTrait::T x) { return static_cast(x); }); 226| 144|} _ZN5Botan8CRYSTALS4packILi3328ETkNS0_14crystals_traitENS_15KyberPolyTraitsELNS0_6DomainE1ETkNS0_12coeff_map_fnINT0_1TEEEZNS0_4packILi3328ETkNS0_14crystals_traitES2_LS3_1EEEvRKNS0_10PolynomialIS5_XT1_EEERNS_13BufferStufferEEUlsE_EEvSB_SD_T2_: 117| 144|constexpr void pack(const Polynomial& p, BufferStuffer& stuffer, MapFnT map) { 118| 144| using trait = BitPackingTrait; 119| | 120| 144| BOTAN_DEBUG_ASSERT(stuffer.remaining_capacity() >= p.size() * trait::bits_per_coeff / 8); ------------------ | | 137| 144| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 144| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 144] | | ------------------ ------------------ 121| | 122| | // Bit-packing example that shows a coefficients' bit-pack that spills across 123| | // more than one 64-bit collectors. This illustrates the algorithm below. 124| | // 125| | // 0 64 128 126| | // Collectors (64 bits): | collectors[0] | collectors[1] | 127| | // | | | 128| | // Coefficients (11 bits): | c[0] | c[1] | c[2] | c[3] | c[4] | c[5] | c[6] | c[7] | | | | | ... 129| | // | | | 130| | // | < byte-aligned coefficient pack > | < byte-aligned pad. > | 131| | // | (one inner loop iteration) | 132| | // 0 88 (divisible by 8) 133| | 134| 9.36k| for(size_t i = 0; i < p.size(); i += trait::coeffs_per_pack) { ------------------ | Branch (134:22): [True: 9.21k, False: 144] ------------------ 135| | // The collectors array is filled with bit-packed coefficients to produce 136| | // a byte-aligned pack of coefficients. When coefficients fall onto the 137| | // boundary of two collectors, their bits must be split. 138| 9.21k| typename trait::collector_array collectors = {0}; 139| 46.0k| for(size_t j = 0, bit_offset = 0, c = 0; j < trait::coeffs_per_pack; ++j) { ------------------ | Branch (139:48): [True: 36.8k, False: 9.21k] ------------------ 140| | // Transform p[i] via a custom map function (that may be a NOOP). 141| 36.8k| const typename trait::unsigned_T mapped_coeff = map(p[i + j]); 142| 36.8k| const auto coeff_value = static_cast(mapped_coeff); 143| | 144| | // pack() is called only on data produced by us. If the values returned 145| | // by the map function are not in the range [0, range] we have a bug. 146| 36.8k| BOTAN_DEBUG_ASSERT(coeff_value <= range); ------------------ | | 137| 36.8k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 36.8k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 36.8k] | | ------------------ ------------------ 147| | 148| | // Bit-pack the coefficient into the collectors array and keep track of 149| | // the bit-offset within the current collector. Note that this might 150| | // shift some high-bits of the coefficient out of the current collector. 151| 36.8k| collectors[c] |= coeff_value << bit_offset; 152| 36.8k| bit_offset += trait::bits_per_coeff; 153| | 154| | // If the bit-offset now exceeds the collector's bit-width, we fill the 155| | // next collector with the high-bits that didn't fit into the previous. 156| | // The bit-offset is adjusted to now point into the new collector. 157| 36.8k| if(bit_offset > trait::bits_in_collector) { ------------------ | Branch (157:13): [True: 0, False: 36.8k] ------------------ 158| 0| bit_offset = bit_offset - trait::bits_in_collector; 159| 0| collectors[++c] = coeff_value >> (trait::bits_per_coeff - bit_offset); 160| 0| } 161| 36.8k| } 162| | 163| | // One byte-aligned pack of bit-packed coefficients is now stored in the 164| | // collectors and can be written to an output buffer. Note that we might 165| | // have to remove some padding bytes of unused collector space. 166| 9.21k| const auto bytes = store_le(collectors); 167| 9.21k| stuffer.append(std::span{bytes}.template first()); 168| 9.21k| } 169| 144|} _ZZN5Botan8CRYSTALS4packILi3328ETkNS0_14crystals_traitENS_15KyberPolyTraitsELNS0_6DomainE1EEEvRKNS0_10PolynomialIT0_XT1_EEERNS_13BufferStufferEENKUlsE_clEs: 225| 36.8k| pack(p, stuffer, [](typename PolyTrait::T x) { return static_cast(x); }); _ZN5Botan6bitlenEm: 101| 843|constexpr auto bitlen(size_t x) { 102| 843| return ceil_log2(x + 1); 103| 843|} _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm894EEC2ES3_: 173| 2.56k| explicit Bounded_XOF(XofT xof) : m_xof(xof), m_bytes_consumed(0) {} dilithium_algos.cpp:_ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm894EE4nextILm3EZNS_15Dilithium_Algos12_GLOBAL__N_118sample_ntt_uniformENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNSA_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEERNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNSJ_6DomainE1EEEtRKNS_18DilithiumConstantsEE3$_0ZNS7_18sample_ntt_uniformESI_SO_tSR_E3$_1Qaasr3stdE9invocableITL0_0_NSA_5arrayIhXTL0__EEEEsr3stdE9invocableITL0_1_NSA_20__invoke_result_implIvJSU_SW_EE4typeEEEEDaRKT0_RKT1_: 195| 656k| const PredicateFnT& predicate = default_predicate>) { 196| 657k| while(true) { ------------------ | Branch (196:16): [True: 657k, Folded] ------------------ 197| 657k| const auto output = transformer(take()); 198| 657k| if(predicate(output)) { ------------------ | Branch (198:16): [True: 656k, False: 698] ------------------ 199| 656k| return output; 200| 656k| } 201| 657k| } 202| 656k| } _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm894EE4takeILm3EEENSt3__15arrayIhXT_EEEv: 206| 657k| constexpr std::array take() { 207| 657k| m_bytes_consumed += bytes; 208| 657k| if(m_bytes_consumed > bound) { ------------------ | Branch (208:13): [True: 0, False: 657k] ------------------ 209| 0| throw Internal_Error("XOF consumed more bytes than allowed"); 210| 0| } 211| 657k| return m_xof.template output(); 212| 657k| } _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm481EEC2ES3_: 173| 844| explicit Bounded_XOF(XofT xof) : m_xof(xof), m_bytes_consumed(0) {} _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm481EE9next_byteIFbhEQsr3stdE9invocableITL0__hEEEDaOT_: 180| 153k| constexpr auto next_byte(PredicateFnT&& predicate = default_predicate<1, uint8_t>) { 181| 153k| return next<1>([](const auto bytes) { return bytes[0]; }, std::forward(predicate)); 182| 153k| } _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm481EE4nextILm1EZNS4_9next_byteIFbhEQsr3stdE9invocableITL0__hEEEDaOT_EUlS9_E_S7_Qaasr3stdE9invocableITL0_0_NSt3__15arrayIhXTL0__EEEEsr3stdE9invocableITL0_1_NSD_20__invoke_result_implIvJSC_SF_EE4typeEEEEDaRKT0_RKT1_: 195| 153k| const PredicateFnT& predicate = default_predicate>) { 196| 153k| while(true) { ------------------ | Branch (196:16): [True: 153k, Folded] ------------------ 197| 153k| const auto output = transformer(take()); 198| 153k| if(predicate(output)) { ------------------ | Branch (198:16): [True: 153k, False: 0] ------------------ 199| 153k| return output; 200| 153k| } 201| 153k| } 202| 153k| } _ZZN5Botan6detail11Bounded_XOFIRNS_3XOFELm481EE9next_byteIFbhEQsr3stdE9invocableITL0__hEEEDaOT_ENKUlS8_E_clINSt3__15arrayIhLm1EEEEEDaS8_: 181| 153k| return next<1>([](const auto bytes) { return bytes[0]; }, std::forward(predicate)); _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm481EE4takeILm1EEENSt3__15arrayIhXT_EEEv: 206| 153k| constexpr std::array take() { 207| 153k| m_bytes_consumed += bytes; 208| 153k| if(m_bytes_consumed > bound) { ------------------ | Branch (208:13): [True: 0, False: 153k] ------------------ 209| 0| throw Internal_Error("XOF consumed more bytes than allowed"); 210| 0| } 211| 153k| return m_xof.template output(); 212| 153k| } _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm481EE17default_predicateILm1EhEEbT0_: 164| 153k| constexpr static bool default_predicate(T /*v*/) { 165| 153k| return true; 166| 153k| } _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm840EEC2ES3_: 173| 70| explicit Bounded_XOF(XofT xof) : m_xof(xof), m_bytes_consumed(0) {} kyber_algos.cpp:_ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm840EE4nextILm3EZZNS_11Kyber_Algos12_GLOBAL__N_118sample_ntt_uniformERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS8_6DomainE1EEES3_EN3$_0clEvEUlT_E_FbNSt3__14pairINSH_8optionalItEESK_EEEQaasr3stdE9invocableITL0_0_NSH_5arrayIhXTL0__EEEEsr3stdE9invocableITL0_1_NSH_20__invoke_result_implIvJSN_SP_EE4typeEEEEDaRKT0_RKT1_: 195| 11.9k| const PredicateFnT& predicate = default_predicate>) { 196| 11.9k| while(true) { ------------------ | Branch (196:16): [True: 11.9k, Folded] ------------------ 197| 11.9k| const auto output = transformer(take()); 198| 11.9k| if(predicate(output)) { ------------------ | Branch (198:16): [True: 11.9k, False: 0] ------------------ 199| 11.9k| return output; 200| 11.9k| } 201| 11.9k| } 202| 11.9k| } _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm840EE4takeILm3EEENSt3__15arrayIhXT_EEEv: 206| 11.9k| constexpr std::array take() { 207| 11.9k| m_bytes_consumed += bytes; 208| 11.9k| if(m_bytes_consumed > bound) { ------------------ | Branch (208:13): [True: 0, False: 11.9k] ------------------ 209| 0| throw Internal_Error("XOF consumed more bytes than allowed"); 210| 0| } 211| 11.9k| return m_xof.template output(); 212| 11.9k| } _ZN5Botan6detail11Bounded_XOFIRNS_3XOFELm840EE17default_predicateILm3ENSt3__14pairINS6_8optionalItEES9_EEEEbT0_: 164| 11.9k| constexpr static bool default_predicate(T /*v*/) { 165| 11.9k| return true; 166| 11.9k| } _ZN5Botan3rhoILm14ELm18ELm41ETkNSt3__117unsigned_integralEmEET2_S2_: 53| 3.04k|BOTAN_FORCE_INLINE constexpr T rho(T x) { 54| 3.04k| return rotr(x) ^ rotr(x) ^ rotr(x); 55| 3.04k|} _ZN5Botan4rotrILm14ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 3.04k|{ 38| 3.04k| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 3.04k|} _ZN5Botan4rotrILm18ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 3.04k|{ 38| 3.04k| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 3.04k|} _ZN5Botan4rotrILm41ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 3.04k|{ 38| 3.04k| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 3.04k|} _ZN5Botan3rhoILm28ELm34ELm39ETkNSt3__117unsigned_integralEmEET2_S2_: 53| 3.04k|BOTAN_FORCE_INLINE constexpr T rho(T x) { 54| 3.04k| return rotr(x) ^ rotr(x) ^ rotr(x); 55| 3.04k|} _ZN5Botan4rotrILm28ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 3.04k|{ 38| 3.04k| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 3.04k|} _ZN5Botan4rotrILm34ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 3.04k|{ 38| 3.04k| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 3.04k|} _ZN5Botan4rotrILm39ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 37| 3.04k|{ 38| 3.04k| return static_cast((input >> ROT) | (input << (8 * sizeof(T) - ROT))); 39| 3.04k|} _ZN5Botan4rotlILm1ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 2.39M|{ 26| 2.39M| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 2.39M|} _ZN5Botan4rotlILm44ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm43ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm21ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm14ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm28ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm20ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm3ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm45ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm61ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm6ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm25ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm8ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm18ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm27ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm36ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm10ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm15ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm56ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm62ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm55ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm39ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm41ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan4rotlILm2ETkNSt3__117unsigned_integralEmEET0_S2_QaagtT_Li0EltT_mlLi8EstS2_: 25| 399k|{ 26| 399k| return static_cast((input << ROT) | (input >> (8 * sizeof(T) - ROT))); 27| 399k|} _ZN5Botan14scoped_cleanupIZNS_2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS8_EEEDaDpRKS8_EUlvE_EC2ESC_: 26| 1| explicit scoped_cleanup(FunT cleanup) : m_cleanup(std::move(cleanup)) {} _ZN5Botan14scoped_cleanupIZNS_2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS8_EEEDaDpRKS8_EUlvE_EC2EOSD_: 32| 1| scoped_cleanup(scoped_cleanup&& other) noexcept : m_cleanup(std::move(other.m_cleanup)) { other.disengage(); } _ZN5Botan14scoped_cleanupIZNS_2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS8_EEEDaDpRKS8_EUlvE_E9disengageEv: 43| 1| void disengage() noexcept { m_cleanup.reset(); } _ZN5Botan14scoped_cleanupIZNS_2CT13scoped_poisonIJNSt3__16vectorIhNS_16secure_allocatorIhEEEEEQaaaagtsZT_Li0Efraa10poisonableIT_Efraa12unpoisonableIS8_EEEDaDpRKS8_EUlvE_ED2Ev: 34| 2| ~scoped_cleanup() { 35| 2| if(m_cleanup.has_value()) { ------------------ | Branch (35:13): [True: 1, False: 1] ------------------ 36| 1| (*m_cleanup)(); // NOLINT(bugprone-exception-escape) clang-tidy bug 37| 1| } 38| 2| } _ZNK5Botan7SHA_51213output_lengthEv: 74| 76| size_t output_length() const override { return output_bytes; } _ZN5Botan9SHA2_64_FEmmmRmmmmS0_m: 64| 3.04k| uint64_t A, uint64_t B, uint64_t C, uint64_t& D, uint64_t E, uint64_t F, uint64_t G, uint64_t& H, uint64_t M) { 65| 3.04k| H += rho<14, 18, 41>(E) + choose(E, F, G) + M; 66| 3.04k| D += H; 67| 3.04k| H += rho<28, 34, 39>(A) + majority(A, B, C); 68| 3.04k|} _ZNK5Botan5SHA_313output_lengthEv: 31| 88| size_t output_length() const override { return m_output_length; } _ZN5Botan13SHAKE_128_XOFC2Ev: 52| 2.59k| SHAKE_128_XOF() : SHAKE_XOF(256) {} _ZN5Botan13SHAKE_256_XOFC2Ev: 66| 1.03k| SHAKE_256_XOF() : SHAKE_XOF(512) {} _ZN5Botan9SIMD_2x64C2Ev: 61| 304| m_simd(_mm_setzero_si128()) 62| |#elif defined(BOTAN_SIMD_USE_NEON) 63| | m_simd(vdupq_n_u64(0)) 64| |#elif defined(BOTAN_SIMD_USE_SIMD128) 65| | m_simd(wasm_u64x2_const_splat(0)) 66| |#elif defined(BOTAN_SIMD_USE_VSX) 67| | m_simd(vec_splats(static_cast(0))) 68| |#endif 69| 304| { 70| 304| } _ZN5Botan9SIMD_2x647load_beEPKv: 132| 304| static SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 load_be(const void* in) { 133| | if constexpr(std::endian::native == std::endian::big) { 134| | return SIMD_2x64::load_native(in); 135| 304| } else { 136| 304| return SIMD_2x64::load_native(in).bswap(); 137| 304| } 138| 304| } _ZN5Botan9SIMD_2x6411load_nativeEPKv: 112| 1.82k| static SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 load_native(const void* in) { 113| 1.82k|#if defined(BOTAN_SIMD_USE_SSSE3) 114| 1.82k| return SIMD_2x64(_mm_loadu_si128(reinterpret_cast(in))); 115| |#elif defined(BOTAN_SIMD_USE_NEON) 116| | return SIMD_2x64(vld1q_u64(static_cast(in))); 117| |#elif defined(BOTAN_SIMD_USE_SIMD128) 118| | return SIMD_2x64(wasm_v128_load(in)); 119| |#elif defined(BOTAN_SIMD_USE_VSX) 120| | return SIMD_2x64(reinterpret_cast(vec_xl(0, static_cast(in)))); 121| |#endif 122| 1.82k| } _ZN5Botan9SIMD_2x64C2EDv2_x: 507| 11.8k| explicit BOTAN_FN_ISA_SIMD_2X64 SIMD_2x64(native_simd_type x) : m_simd(x) {} _ZNK5Botan9SIMD_2x645bswapEv: 148| 304| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 bswap() const { 149| 304|#if defined(BOTAN_SIMD_USE_SSSE3) 150| 304| const auto idx = _mm_set_epi8(8, 9, 10, 11, 12, 13, 14, 15, 0, 1, 2, 3, 4, 5, 6, 7); 151| 304| return SIMD_2x64(_mm_shuffle_epi8(m_simd, idx)); 152| |#elif defined(BOTAN_SIMD_USE_NEON) 153| | return SIMD_2x64(vreinterpretq_u64_u8(vrev64q_u8(vreinterpretq_u8_u64(m_simd)))); 154| |#elif defined(BOTAN_SIMD_USE_SIMD128) 155| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8)); 156| |#elif defined(BOTAN_SIMD_USE_VSX) 157| | return SIMD_2x64(vec_revb(m_simd)); 158| |#endif 159| 304| } _ZNK5Botan9SIMD_2x64plERKS0_: 224| 5.16k| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 operator+(const SIMD_2x64& other) const { 225| 5.16k| SIMD_2x64 retval(*this); 226| 5.16k| retval += other; 227| 5.16k| return retval; 228| 5.16k| } _ZN5Botan9SIMD_2x64pLERKS0_: 254| 5.16k| void BOTAN_FN_ISA_SIMD_2X64 operator+=(const SIMD_2x64& other) { 255| 5.16k|#if defined(BOTAN_SIMD_USE_SSSE3) 256| 5.16k| m_simd = _mm_add_epi64(m_simd, other.m_simd); 257| |#elif defined(BOTAN_SIMD_USE_NEON) 258| | m_simd = vaddq_u64(m_simd, other.m_simd); 259| |#elif defined(BOTAN_SIMD_USE_SIMD128) 260| | m_simd = wasm_i64x2_add(m_simd, other.m_simd); 261| |#elif defined(BOTAN_SIMD_USE_VSX) 262| | m_simd = vec_add(m_simd, other.m_simd); 263| |#endif 264| 5.16k| } _ZN5Botan9SIMD_2x647load_leEPKv: 124| 1.52k| static SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 load_le(const void* in) { 125| 1.52k| if constexpr(std::endian::native == std::endian::little) { 126| 1.52k| return SIMD_2x64::load_native(in); 127| | } else { 128| | return SIMD_2x64::load_native(in).bswap(); 129| | } 130| 1.52k| } _ZNK5Botan9SIMD_2x648store_leEPm: 200| 1.52k| void BOTAN_FN_ISA_SIMD_2X64 store_le(uint64_t out[2]) const { this->store_le(reinterpret_cast(out)); } _ZNK5Botan9SIMD_2x648store_leEPh: 202| 1.52k| void BOTAN_FN_ISA_SIMD_2X64 store_le(uint8_t out[]) const { 203| 1.52k| if constexpr(std::endian::native == std::endian::little) { 204| 1.52k| this->store_native(out); 205| | } else { 206| | this->bswap().store_native(out); 207| | } 208| 1.52k| } _ZNK5Botan9SIMD_2x6412store_nativeEPv: 188| 1.52k| void BOTAN_FN_ISA_SIMD_2X64 store_native(void* out) const { 189| 1.52k|#if defined(BOTAN_SIMD_USE_SSSE3) 190| 1.52k| _mm_storeu_si128(static_cast<__m128i*>(out), m_simd); 191| |#elif defined(BOTAN_SIMD_USE_NEON) 192| | vst1q_u64(static_cast(out), m_simd); 193| |#elif defined(BOTAN_SIMD_USE_SIMD128) 194| | wasm_v128_store(out, m_simd); 195| |#elif defined(BOTAN_SIMD_USE_VSX) 196| | vec_xst(reinterpret_cast<__vector unsigned char>(m_simd), 0, static_cast(out)); 197| |#endif 198| 1.52k| } _ZN5Botan9SIMD_2x647alignr8ERKS0_S2_: 401| 2.43k| static SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 alignr8(const SIMD_2x64& a, const SIMD_2x64& b) { 402| 2.43k|#if defined(BOTAN_SIMD_USE_SSSE3) 403| 2.43k| return SIMD_2x64(_mm_alignr_epi8(a.m_simd, b.m_simd, 8)); 404| |#elif defined(BOTAN_SIMD_USE_NEON) 405| | return SIMD_2x64(vextq_u64(b.m_simd, a.m_simd, 1)); 406| |#elif defined(BOTAN_SIMD_USE_SIMD128) 407| | return SIMD_2x64( 408| | wasm_i8x16_shuffle(b.m_simd, a.m_simd, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23)); 409| |#elif defined(BOTAN_SIMD_USE_VSX) 410| | const __vector unsigned char mask = {8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23}; 411| | return SIMD_2x64(vec_perm(b.m_simd, a.m_simd, mask)); 412| |#endif 413| 2.43k| } _ZNK5Botan9SIMD_2x644rotrILm1EEES0_vQaagtT_Li0EltT_Li64E: 296| 1.21k| { 297| 1.21k|#if defined(BOTAN_SIMD_USE_SSSE3) 298| | if constexpr(ROT == 8) { 299| | const auto tab = _mm_setr_epi8(1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8); 300| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 301| | } else if constexpr(ROT == 16) { 302| | const auto tab = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9); 303| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 304| | } else if constexpr(ROT == 24) { 305| | const auto tab = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10); 306| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 307| | } else if constexpr(ROT == 32) { 308| | const auto tab = _mm_setr_epi8(4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11); 309| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 310| 1.21k| } else { 311| 1.21k| return SIMD_2x64(_mm_or_si128(_mm_srli_epi64(m_simd, static_cast(ROT)), 312| 1.21k| _mm_slli_epi64(m_simd, static_cast(64 - ROT)))); 313| 1.21k| } 314| |#elif defined(BOTAN_SIMD_USE_NEON) 315| | return SIMD_2x64(vsriq_n_u64(vshlq_n_u64(m_simd, 64 - ROT), m_simd, ROT)); 316| |#elif defined(BOTAN_SIMD_USE_SIMD128) 317| | if constexpr(ROT == 8) { 318| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8)); 319| | } else if constexpr(ROT == 16) { 320| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)); 321| | } else if constexpr(ROT == 24) { 322| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)); 323| | } else if constexpr(ROT == 32) { 324| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11)); 325| | } else { 326| | return SIMD_2x64(wasm_v128_or(wasm_u64x2_shr(m_simd, ROT), wasm_i64x2_shl(m_simd, 64 - ROT))); 327| | } 328| |#elif defined(BOTAN_SIMD_USE_VSX) && defined(__clang__) 329| | // Clang only declares the 64-bit vec_rl if POWER8 is enabled for the whole TU 330| | using s64x2 = __vector signed long long; 331| | const auto rot = vec_splats(static_cast(64 - ROT)); 332| | const auto r = __builtin_altivec_vrld(reinterpret_cast(m_simd), rot); 333| | return SIMD_2x64(reinterpret_cast(r)); 334| |#elif defined(BOTAN_SIMD_USE_VSX) 335| | return SIMD_2x64(vec_rl(m_simd, vec_splats(static_cast(64 - ROT)))); 336| |#endif 337| 1.21k| } _ZNK5Botan9SIMD_2x64eoERKS0_: 230| 4.86k| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 operator^(const SIMD_2x64& other) const { 231| 4.86k| SIMD_2x64 retval(*this); 232| 4.86k| retval ^= other; 233| 4.86k| return retval; 234| 4.86k| } _ZN5Botan9SIMD_2x64eOERKS0_: 266| 4.86k| void BOTAN_FN_ISA_SIMD_2X64 operator^=(const SIMD_2x64& other) { 267| 4.86k|#if defined(BOTAN_SIMD_USE_SSSE3) 268| 4.86k| m_simd = _mm_xor_si128(m_simd, other.m_simd); 269| |#elif defined(BOTAN_SIMD_USE_NEON) 270| | m_simd = veorq_u64(m_simd, other.m_simd); 271| |#elif defined(BOTAN_SIMD_USE_SIMD128) 272| | m_simd = wasm_v128_xor(m_simd, other.m_simd); 273| |#elif defined(BOTAN_SIMD_USE_VSX) 274| | m_simd = vec_xor(m_simd, other.m_simd); 275| |#endif 276| 4.86k| } _ZNK5Botan9SIMD_2x644rotrILm8EEES0_vQaagtT_Li0EltT_Li64E: 296| 1.21k| { 297| 1.21k|#if defined(BOTAN_SIMD_USE_SSSE3) 298| 1.21k| if constexpr(ROT == 8) { 299| 1.21k| const auto tab = _mm_setr_epi8(1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8); 300| 1.21k| return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 301| | } else if constexpr(ROT == 16) { 302| | const auto tab = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9); 303| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 304| | } else if constexpr(ROT == 24) { 305| | const auto tab = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10); 306| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 307| | } else if constexpr(ROT == 32) { 308| | const auto tab = _mm_setr_epi8(4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11); 309| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 310| | } else { 311| | return SIMD_2x64(_mm_or_si128(_mm_srli_epi64(m_simd, static_cast(ROT)), 312| | _mm_slli_epi64(m_simd, static_cast(64 - ROT)))); 313| | } 314| |#elif defined(BOTAN_SIMD_USE_NEON) 315| | return SIMD_2x64(vsriq_n_u64(vshlq_n_u64(m_simd, 64 - ROT), m_simd, ROT)); 316| |#elif defined(BOTAN_SIMD_USE_SIMD128) 317| | if constexpr(ROT == 8) { 318| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8)); 319| | } else if constexpr(ROT == 16) { 320| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)); 321| | } else if constexpr(ROT == 24) { 322| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)); 323| | } else if constexpr(ROT == 32) { 324| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11)); 325| | } else { 326| | return SIMD_2x64(wasm_v128_or(wasm_u64x2_shr(m_simd, ROT), wasm_i64x2_shl(m_simd, 64 - ROT))); 327| | } 328| |#elif defined(BOTAN_SIMD_USE_VSX) && defined(__clang__) 329| | // Clang only declares the 64-bit vec_rl if POWER8 is enabled for the whole TU 330| | using s64x2 = __vector signed long long; 331| | const auto rot = vec_splats(static_cast(64 - ROT)); 332| | const auto r = __builtin_altivec_vrld(reinterpret_cast(m_simd), rot); 333| | return SIMD_2x64(reinterpret_cast(r)); 334| |#elif defined(BOTAN_SIMD_USE_VSX) 335| | return SIMD_2x64(vec_rl(m_simd, vec_splats(static_cast(64 - ROT)))); 336| |#endif 337| 1.21k| } _ZNK5Botan9SIMD_2x643shrILi7EEES0_v: 376| 1.21k| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 shr() const noexcept { 377| 1.21k|#if defined(BOTAN_SIMD_USE_SSSE3) 378| 1.21k| return SIMD_2x64(_mm_srli_epi64(m_simd, SHIFT)); 379| |#elif defined(BOTAN_SIMD_USE_NEON) 380| | return SIMD_2x64(vshrq_n_u64(m_simd, SHIFT)); 381| |#elif defined(BOTAN_SIMD_USE_SIMD128) 382| | return SIMD_2x64(wasm_u64x2_shr(m_simd, SHIFT)); 383| |#elif defined(BOTAN_SIMD_USE_VSX) 384| | return SIMD_2x64(vec_sr(m_simd, vec_splats(static_cast(SHIFT)))); 385| |#endif 386| 1.21k| } _ZNK5Botan9SIMD_2x644rotrILm19EEES0_vQaagtT_Li0EltT_Li64E: 296| 1.21k| { 297| 1.21k|#if defined(BOTAN_SIMD_USE_SSSE3) 298| | if constexpr(ROT == 8) { 299| | const auto tab = _mm_setr_epi8(1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8); 300| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 301| | } else if constexpr(ROT == 16) { 302| | const auto tab = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9); 303| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 304| | } else if constexpr(ROT == 24) { 305| | const auto tab = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10); 306| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 307| | } else if constexpr(ROT == 32) { 308| | const auto tab = _mm_setr_epi8(4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11); 309| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 310| 1.21k| } else { 311| 1.21k| return SIMD_2x64(_mm_or_si128(_mm_srli_epi64(m_simd, static_cast(ROT)), 312| 1.21k| _mm_slli_epi64(m_simd, static_cast(64 - ROT)))); 313| 1.21k| } 314| |#elif defined(BOTAN_SIMD_USE_NEON) 315| | return SIMD_2x64(vsriq_n_u64(vshlq_n_u64(m_simd, 64 - ROT), m_simd, ROT)); 316| |#elif defined(BOTAN_SIMD_USE_SIMD128) 317| | if constexpr(ROT == 8) { 318| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8)); 319| | } else if constexpr(ROT == 16) { 320| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)); 321| | } else if constexpr(ROT == 24) { 322| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)); 323| | } else if constexpr(ROT == 32) { 324| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11)); 325| | } else { 326| | return SIMD_2x64(wasm_v128_or(wasm_u64x2_shr(m_simd, ROT), wasm_i64x2_shl(m_simd, 64 - ROT))); 327| | } 328| |#elif defined(BOTAN_SIMD_USE_VSX) && defined(__clang__) 329| | // Clang only declares the 64-bit vec_rl if POWER8 is enabled for the whole TU 330| | using s64x2 = __vector signed long long; 331| | const auto rot = vec_splats(static_cast(64 - ROT)); 332| | const auto r = __builtin_altivec_vrld(reinterpret_cast(m_simd), rot); 333| | return SIMD_2x64(reinterpret_cast(r)); 334| |#elif defined(BOTAN_SIMD_USE_VSX) 335| | return SIMD_2x64(vec_rl(m_simd, vec_splats(static_cast(64 - ROT)))); 336| |#endif 337| 1.21k| } _ZNK5Botan9SIMD_2x644rotrILm61EEES0_vQaagtT_Li0EltT_Li64E: 296| 1.21k| { 297| 1.21k|#if defined(BOTAN_SIMD_USE_SSSE3) 298| | if constexpr(ROT == 8) { 299| | const auto tab = _mm_setr_epi8(1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8); 300| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 301| | } else if constexpr(ROT == 16) { 302| | const auto tab = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9); 303| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 304| | } else if constexpr(ROT == 24) { 305| | const auto tab = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10); 306| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 307| | } else if constexpr(ROT == 32) { 308| | const auto tab = _mm_setr_epi8(4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11); 309| | return SIMD_2x64(_mm_shuffle_epi8(m_simd, tab)); 310| 1.21k| } else { 311| 1.21k| return SIMD_2x64(_mm_or_si128(_mm_srli_epi64(m_simd, static_cast(ROT)), 312| 1.21k| _mm_slli_epi64(m_simd, static_cast(64 - ROT)))); 313| 1.21k| } 314| |#elif defined(BOTAN_SIMD_USE_NEON) 315| | return SIMD_2x64(vsriq_n_u64(vshlq_n_u64(m_simd, 64 - ROT), m_simd, ROT)); 316| |#elif defined(BOTAN_SIMD_USE_SIMD128) 317| | if constexpr(ROT == 8) { 318| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 1, 2, 3, 4, 5, 6, 7, 0, 9, 10, 11, 12, 13, 14, 15, 8)); 319| | } else if constexpr(ROT == 16) { 320| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)); 321| | } else if constexpr(ROT == 24) { 322| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)); 323| | } else if constexpr(ROT == 32) { 324| | return SIMD_2x64(wasm_i8x16_shuffle(m_simd, m_simd, 4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11)); 325| | } else { 326| | return SIMD_2x64(wasm_v128_or(wasm_u64x2_shr(m_simd, ROT), wasm_i64x2_shl(m_simd, 64 - ROT))); 327| | } 328| |#elif defined(BOTAN_SIMD_USE_VSX) && defined(__clang__) 329| | // Clang only declares the 64-bit vec_rl if POWER8 is enabled for the whole TU 330| | using s64x2 = __vector signed long long; 331| | const auto rot = vec_splats(static_cast(64 - ROT)); 332| | const auto r = __builtin_altivec_vrld(reinterpret_cast(m_simd), rot); 333| | return SIMD_2x64(reinterpret_cast(r)); 334| |#elif defined(BOTAN_SIMD_USE_VSX) 335| | return SIMD_2x64(vec_rl(m_simd, vec_splats(static_cast(64 - ROT)))); 336| |#endif 337| 1.21k| } _ZNK5Botan9SIMD_2x643shrILi6EEES0_v: 376| 1.21k| SIMD_2x64 BOTAN_FN_ISA_SIMD_2X64 shr() const noexcept { 377| 1.21k|#if defined(BOTAN_SIMD_USE_SSSE3) 378| 1.21k| return SIMD_2x64(_mm_srli_epi64(m_simd, SHIFT)); 379| |#elif defined(BOTAN_SIMD_USE_NEON) 380| | return SIMD_2x64(vshrq_n_u64(m_simd, SHIFT)); 381| |#elif defined(BOTAN_SIMD_USE_SIMD128) 382| | return SIMD_2x64(wasm_u64x2_shr(m_simd, SHIFT)); 383| |#elif defined(BOTAN_SIMD_USE_VSX) 384| | return SIMD_2x64(vec_sr(m_simd, vec_splats(static_cast(SHIFT)))); 385| |#endif 386| 1.21k| } _ZN5Botan9SIMD_4x64C2Ev: 33| 23.1k| BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64() : m_simd(_mm256_setzero_si256()) {} _ZN5Botan9SIMD_4x64C2EDv4_x: 267| 539k| explicit BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64(__m256i x) : m_simd(x) {} _ZNK5Botan9SIMD_4x64eoERKS0_: 90| 727k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 operator^(const SIMD_4x64& other) const { 91| 727k| SIMD_4x64 retval(*this); 92| 727k| retval ^= other; 93| 727k| return retval; 94| 727k| } _ZN5Botan9SIMD_4x64eOERKS0_: 112| 730k| BOTAN_FN_ISA_SIMD_4X64 void operator^=(const SIMD_4x64& other) { 113| 730k| m_simd = _mm256_xor_si256(m_simd, other.m_simd); 114| 730k| } _ZNK5Botan9SIMD_4x644rotrILm8EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| 9.57k| if constexpr(ROT == 8) { 135| 9.57k| const auto shuf_rot_8 = 136| 9.57k| _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| 9.57k| return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| | } else { 155| | return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| | _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| | } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm19EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm61EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZN5Botan9SIMD_4x647load_leEPKv: 45| 13.1k| static BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64 load_le(const void* in) { 46| 13.1k| return SIMD_4x64(_mm256_loadu_si256(reinterpret_cast(in))); 47| 13.1k| } _ZNK5Botan9SIMD_4x648store_leEPm: 72| 9.97k| void BOTAN_FN_ISA_SIMD_4X64 store_le(uint64_t out[4]) const { this->store_le(reinterpret_cast(out)); } _ZNK5Botan9SIMD_4x648store_leEPh: 74| 9.97k| BOTAN_FN_ISA_SIMD_4X64 void store_le(uint8_t out[]) const { 75| 9.97k| _mm256_storeu_si256(reinterpret_cast<__m256i*>(out), m_simd); 76| 9.97k| } _ZNK5Botan9SIMD_4x644andcERKS0_: 123| 239k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 andc(const SIMD_4x64& other) const { 124| 239k| return SIMD_4x64(_mm256_andnot_si256(m_simd, other.m_simd)); 125| 239k| } _ZN5Botan9SIMD_4x643chiERKS0_S2_S2_: 183| 239k| static BOTAN_FN_ISA_SIMD_4X64 SIMD_4x64 chi(const SIMD_4x64& x, const SIMD_4x64& y, const SIMD_4x64& z) { 184| |#if defined(__AVX512VL__) 185| | constexpr uint8_t xor_not_and = 0b11010010; 186| | return SIMD_4x64(_mm256_ternarylogic_epi64(x.raw(), y.raw(), z.raw(), xor_not_and)); 187| |#else 188| 239k| return x ^ y.andc(z); 189| 239k|#endif 190| 239k| } _ZN5Botan9SIMD_4x649transposeERS0_S1_S1_S1_: 211| 798| static void transpose(SIMD_4x64& B0, SIMD_4x64& B1, SIMD_4x64& B2, SIMD_4x64& B3) { 212| 798| const __m256i T0 = _mm256_unpacklo_epi64(B0.m_simd, B1.m_simd); 213| 798| const __m256i T1 = _mm256_unpackhi_epi64(B0.m_simd, B1.m_simd); 214| 798| const __m256i T2 = _mm256_unpacklo_epi64(B2.m_simd, B3.m_simd); 215| 798| const __m256i T3 = _mm256_unpackhi_epi64(B2.m_simd, B3.m_simd); 216| | 217| 798| B0.m_simd = _mm256_permute2x128_si256(T0, T2, 0 + (2 << 4)); 218| 798| B1.m_simd = _mm256_permute2x128_si256(T1, T3, 0 + (2 << 4)); 219| 798| B2.m_simd = _mm256_permute2x128_si256(T0, T2, 1 + (3 << 4)); 220| | B3.m_simd = _mm256_permute2x128_si256(T1, T3, 1 + (3 << 4)); 221| 798| } _ZN5Botan9SIMD_4x645splatEm: 263| 9.57k| static SIMD_4x64 splat(uint64_t v) { return SIMD_4x64(_mm256_set1_epi64x(v)); } _ZNK5Botan9SIMD_4x644rotrILm28EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm39EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm1EEES0_v: 162| 57.4k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 57.4k| return this->rotr<64 - ROT>(); 164| 57.4k| } _ZNK5Botan9SIMD_4x644rotrILm63EEES0_vQaagtT_Li0EltT_Li64E: 130| 57.4k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 57.4k| } else { 155| 57.4k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 57.4k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 57.4k| } 158| 57.4k|#endif 159| 57.4k| } _ZNK5Botan9SIMD_4x644rotlILm44EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm20EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm43EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm21EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm21EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm43EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm14EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm50EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm28EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm36EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm20EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm44EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm3EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm45EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm61EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm3EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm6EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm58EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm25EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm8EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm56EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm18EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm46EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm27EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm37EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm36EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm10EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm54EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm15EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm49EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm56EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm62EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm2EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm55EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm9EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm39EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm25EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm41EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm23EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZNK5Botan9SIMD_4x644rotlILm2EEES0_v: 162| 9.57k| SIMD_4x64 BOTAN_FN_ISA_SIMD_4X64 rotl() const { 163| 9.57k| return this->rotr<64 - ROT>(); 164| 9.57k| } _ZNK5Botan9SIMD_4x644rotrILm62EEES0_vQaagtT_Li0EltT_Li64E: 130| 9.57k| { 131| |#if defined(__AVX512VL__) 132| | return SIMD_4x64(_mm256_ror_epi64(m_simd, ROT)); 133| |#else 134| | if constexpr(ROT == 8) { 135| | const auto shuf_rot_8 = 136| | _mm256_set_epi64x(0x080f0e0d0c0b0a09, 0x0007060504030201, 0x080f0e0d0c0b0a09, 0x0007060504030201); 137| | 138| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_8)); 139| | } else if constexpr(ROT == 16) { 140| | const auto shuf_rot_16 = 141| | _mm256_set_epi64x(0x09080f0e0d0c0b0a, 0x0100070605040302, 0x09080f0e0d0c0b0a, 0x0100070605040302); 142| | 143| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_16)); 144| | } else if constexpr(ROT == 24) { 145| | const auto shuf_rot_24 = 146| | _mm256_set_epi64x(0x0a09080f0e0d0c0b, 0x0201000706050403, 0x0a09080f0e0d0c0b, 0x0201000706050403); 147| | 148| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_24)); 149| | } else if constexpr(ROT == 32) { 150| | const auto shuf_rot_32 = 151| | _mm256_set_epi64x(0x0b0a09080f0e0d0c, 0x0302010007060504, 0x0b0a09080f0e0d0c, 0x0302010007060504); 152| | 153| | return SIMD_4x64(_mm256_shuffle_epi8(m_simd, shuf_rot_32)); 154| 9.57k| } else { 155| 9.57k| return SIMD_4x64(_mm256_or_si256(_mm256_srli_epi64(m_simd, static_cast(ROT)), 156| 9.57k| _mm256_slli_epi64(m_simd, static_cast(64 - ROT)))); 157| 9.57k| } 158| 9.57k|#endif 159| 9.57k| } _ZN5Botan6SpongeILm25EmED2Ev: 76| 3.71k| constexpr ~Sponge() { 77| 3.71k| if(!std::is_constant_evaluated()) { ------------------ | Branch (77:13): [True: 3.71k, Folded] ------------------ 78| 3.71k| secure_scrub_memory(m_S); 79| 3.71k| } 80| 3.71k| } _ZN5Botan6SpongeILm25EmE11state_bytesEv: 51| 3.71k| constexpr static size_t state_bytes() { return sizeof(state_t); } _ZN5Botan6SpongeILm25EmE10state_bitsEv: 53| 3.71k| constexpr static size_t state_bits() { return state_bytes() * 8; } _ZNK5Botan6SpongeILm25EmE9byte_rateEv: 57| 835k| constexpr size_t byte_rate() const { return m_bit_rate / 8; } _ZN5Botan6SpongeILm25EmEC2ENS1_6ConfigE: 41| 3.71k| constexpr explicit Sponge(Config config) : m_S(config.initial_state), m_S_cursor(0), m_bit_rate(config.bit_rate) { 42| 3.71k| BOTAN_ARG_CHECK(m_bit_rate > 0 && m_bit_rate % word_bits == 0 && m_bit_rate < words * word_bits, ------------------ | | 35| 3.71k| do { \ | | 36| 3.71k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 14.8k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 3.71k, False: 0] | | | Branch (37:12): [True: 3.71k, False: 0] | | | Branch (37:12): [True: 3.71k, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 3.71k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 3.71k] | | ------------------ ------------------ 43| 3.71k| "Invalid sponge bit rate"); 44| 3.71k| } _ZN5Botan6SpongeILm25EmE5stateEv: 63| 1.23M| constexpr auto& state() { return m_S; } _ZN5Botan6SpongeILm25EmE12reset_cursorEv: 70| 4.44k| void reset_cursor() { m_S_cursor = 0; } _ZN5Botan6SpongeILm25EmE7_cursorEv: 67| 831k| size_t& _cursor() { return m_S_cursor; } _ZNK5Botan6SpongeILm25EmE6cursorEv: 65| 8.00k| size_t cursor() const { return m_S_cursor; } _ZN5Botan18absorb_into_spongeITkNS_6detail28SpongeLikeWithTrivialPermuteENS_18Keccak_PermutationEEEvRT_NSt3__14spanIKhLm18446744073709551615EEE: 232| 7.88k|inline void absorb_into_sponge(detail::SpongeLikeWithTrivialPermute auto& sponge, std::span input) { 233| 7.88k| absorb_into_sponge(sponge, input, [&sponge] { sponge.permute(); }); 234| 7.88k|} _ZN5Botan18absorb_into_spongeITkNS_6detail10SpongeLikeENS_18Keccak_PermutationETkNS1_13PermutationFnEZNS_18absorb_into_spongeITkNS1_28SpongeLikeWithTrivialPermuteES2_EEvRT_NSt3__14spanIKhLm18446744073709551615EEEEUlvE_EEvS5_S9_RKT0_: 222| 7.88k| const detail::PermutationFn auto& permutation_fn) { 223| 7.88k| using word_t = typename SpongeT::word_t; 224| | 225| 7.88k| BufferSlicer input_slicer(input); 226| 7.88k| process_bytes_in_sponge(sponge, input.size(), permutation_fn, [&](word_t state_word, auto bounds) { 227| 7.88k| return state_word ^ bounds.read_from(input_slicer); 228| 7.88k| }); 229| 7.88k| BOTAN_ASSERT_NOMSG(input_slicer.empty()); ------------------ | | 84| 7.88k| do { \ | | 85| 7.88k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 7.88k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 7.88k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 7.88k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 7.88k] | | ------------------ ------------------ 230| 7.88k|} _ZN5Botan23process_bytes_in_spongeITkNS_6detail10SpongeLikeENS_18Keccak_PermutationETkNS1_13PermutationFnEZNS_18absorb_into_spongeITkNS1_28SpongeLikeWithTrivialPermuteES2_EEvRT_NSt3__14spanIKhLm18446744073709551615EEEEUlvE_TkNS1_10ModifierFnIS4_EEZNS_18absorb_into_spongeITkNS1_10SpongeLikeES2_TkNS1_13PermutationFnESA_EEvS5_S9_RKT0_EUlmS4_E_EEvS5_mSF_RKT1_: 138| 7.88k| const detail::ModifierFn auto& modifier_fn) { 139| 7.88k| if(bytes_to_process == 0) { ------------------ | Branch (139:7): [True: 0, False: 7.88k] ------------------ 140| 0| return; 141| 0| } 142| | 143| 7.88k| constexpr auto word_bytes = SpongeT::word_bytes; 144| 7.88k| const auto byte_rate = sponge.byte_rate(); 145| 7.88k| auto& S = sponge.state(); 146| 7.88k| auto& cursor = sponge._cursor(); 147| | 148| | // If necessary, try to get aligned with the sponge state's words array 149| 7.88k| const auto bytes_out_of_word_alignment = static_cast(cursor % word_bytes); 150| 7.88k| if(bytes_out_of_word_alignment > 0) { ------------------ | Branch (150:7): [True: 0, False: 7.88k] ------------------ 151| 0| const auto bytes_until_word_alignment = word_bytes - bytes_out_of_word_alignment; 152| 0| const auto bytes_from_input = std::min(bytes_to_process, bytes_until_word_alignment); 153| 0| BOTAN_DEBUG_ASSERT(bytes_from_input < word_bytes); ------------------ | | 137| 0| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 0| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 0] | | ------------------ ------------------ 154| | 155| 0| S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes], 156| 0| detail::PartialWordBounds{ 157| 0| .offset = bytes_out_of_word_alignment, 158| 0| .length = bytes_from_input, 159| 0| }); 160| 0| cursor += bytes_from_input; 161| 0| bytes_to_process -= bytes_from_input; 162| | 163| 0| if(cursor == byte_rate) { ------------------ | Branch (163:10): [True: 0, False: 0] ------------------ 164| 0| permutation_fn(); 165| 0| cursor = 0; 166| 0| } 167| 0| } 168| | 169| | // If we didn't exhaust the bytes to process for this invocation, we should 170| | // be word-aligned with the sponge state now 171| 7.88k| BOTAN_DEBUG_ASSERT(bytes_to_process == 0 || cursor % word_bytes == 0); ------------------ | | 137| 7.88k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 7.88k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 7.88k] | | ------------------ ------------------ 172| | 173| | // Block-wise incorporation of the input data into the sponge state until 174| | // all input bytes are processed 175| 13.3k| while(bytes_to_process >= word_bytes) { ------------------ | Branch (175:10): [True: 5.44k, False: 7.88k] ------------------ 176| | // Process full words until we either run out of data or reach the 177| | // end of the current sponge state block 178| 49.8k| while(bytes_to_process >= word_bytes && cursor < byte_rate) { ------------------ | Branch (178:13): [True: 45.8k, False: 4.00k] | Branch (178:47): [True: 44.3k, False: 1.44k] ------------------ 179| 44.3k| S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes], detail::FullWordBounds{}); 180| 44.3k| cursor += word_bytes; 181| 44.3k| bytes_to_process -= word_bytes; 182| 44.3k| } 183| | 184| 5.44k| if(cursor == byte_rate) { ------------------ | Branch (184:10): [True: 1.44k, False: 4.00k] ------------------ 185| 1.44k| permutation_fn(); 186| 1.44k| cursor = 0; 187| 1.44k| } 188| 5.44k| } 189| | 190| | // Process the remaining bytes that don't fill an entire word. 191| | // Therefore, leaving the sponge state in an unaligned state that won't 192| | // need another permutation until the next call to process(). 193| 7.88k| BOTAN_DEBUG_ASSERT(bytes_to_process < word_bytes && cursor < byte_rate); ------------------ | | 137| 7.88k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 7.88k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 7.88k] | | ------------------ ------------------ 194| 7.88k| if(bytes_to_process > 0) { ------------------ | Branch (194:7): [True: 3.88k, False: 3.99k] ------------------ 195| 3.88k| S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes], 196| 3.88k| detail::PartialWordBounds{ 197| 3.88k| .offset = 0, 198| 3.88k| .length = bytes_to_process, 199| 3.88k| }); 200| 3.88k| cursor += bytes_to_process; 201| 3.88k| } 202| 7.88k|} _ZZN5Botan18absorb_into_spongeITkNS_6detail10SpongeLikeENS_18Keccak_PermutationETkNS1_13PermutationFnEZNS_18absorb_into_spongeITkNS1_28SpongeLikeWithTrivialPermuteES2_EEvRT_NSt3__14spanIKhLm18446744073709551615EEEEUlvE_EEvS5_S9_RKT0_ENKUlmS4_E_clINS1_17PartialWordBoundsIS2_EEEEDamS4_: 226| 3.88k| process_bytes_in_sponge(sponge, input.size(), permutation_fn, [&](word_t state_word, auto bounds) { 227| 3.88k| return state_word ^ bounds.read_from(input_slicer); 228| 3.88k| }); _ZNK5Botan6detail17PartialWordBoundsINS_18Keccak_PermutationEE9read_fromERNS_12BufferSlicerE: 58| 3.88k| word_t read_from(BufferSlicer& slicer) const { 59| 3.88k| std::array partial_word_bytes{}; 60| 3.88k| slicer.copy_into(std::span{partial_word_bytes}.subspan(offset, length)); 61| 3.88k| return load_le(partial_word_bytes); 62| 3.88k| } _ZZN5Botan18absorb_into_spongeITkNS_6detail28SpongeLikeWithTrivialPermuteENS_18Keccak_PermutationEEEvRT_NSt3__14spanIKhLm18446744073709551615EEEENKUlvE_clEv: 233| 1.44k| absorb_into_sponge(sponge, input, [&sponge] { sponge.permute(); }); _ZZN5Botan18absorb_into_spongeITkNS_6detail10SpongeLikeENS_18Keccak_PermutationETkNS1_13PermutationFnEZNS_18absorb_into_spongeITkNS1_28SpongeLikeWithTrivialPermuteES2_EEvRT_NSt3__14spanIKhLm18446744073709551615EEEEUlvE_EEvS5_S9_RKT0_ENKUlmS4_E_clINS1_14FullWordBoundsIS2_EEEEDamS4_: 226| 44.3k| process_bytes_in_sponge(sponge, input.size(), permutation_fn, [&](word_t state_word, auto bounds) { 227| 44.3k| return state_word ^ bounds.read_from(input_slicer); 228| 44.3k| }); _ZNK5Botan6detail14FullWordBoundsINS_18Keccak_PermutationEE9read_fromERNS_12BufferSlicerE: 96| 44.3k| word_t read_from(BufferSlicer& slicer) const { return load_le(slicer.take()); } _ZN5Botan19squeeze_from_spongeITkNS_6detail28SpongeLikeWithTrivialPermuteENS_18Keccak_PermutationEEEvRT_NSt3__14spanIhLm18446744073709551615EEE: 257| 823k|inline void squeeze_from_sponge(detail::SpongeLikeWithTrivialPermute auto& sponge, std::span output) { 258| 823k| squeeze_from_sponge(sponge, output, [&sponge] { sponge.permute(); }); 259| 823k|} _ZN5Botan19squeeze_from_spongeITkNS_6detail10SpongeLikeENS_18Keccak_PermutationETkNS1_13PermutationFnEZNS_19squeeze_from_spongeITkNS1_28SpongeLikeWithTrivialPermuteES2_EEvRT_NSt3__14spanIhLm18446744073709551615EEEEUlvE_EEvS5_S8_RKT0_: 246| 823k| const detail::PermutationFn auto& permutation_fn) { 247| 823k| using word_t = typename SpongeT::word_t; 248| | 249| 823k| BufferStuffer output_stuffer(output); 250| 823k| process_bytes_in_sponge(sponge, output.size(), permutation_fn, [&](word_t state_word, auto bounds) { 251| 823k| bounds.write_into(output_stuffer, state_word); 252| 823k| return state_word; 253| 823k| }); 254| 823k| BOTAN_ASSERT_NOMSG(output_stuffer.full()); ------------------ | | 84| 823k| do { \ | | 85| 823k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 823k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 823k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 823k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 823k] | | ------------------ ------------------ 255| 823k|} _ZN5Botan23process_bytes_in_spongeITkNS_6detail10SpongeLikeENS_18Keccak_PermutationETkNS1_13PermutationFnEZNS_19squeeze_from_spongeITkNS1_28SpongeLikeWithTrivialPermuteES2_EEvRT_NSt3__14spanIhLm18446744073709551615EEEEUlvE_TkNS1_10ModifierFnIS4_EEZNS_19squeeze_from_spongeITkNS1_10SpongeLikeES2_TkNS1_13PermutationFnES9_EEvS5_S8_RKT0_EUlmS4_E_EEvS5_mSE_RKT1_: 138| 823k| const detail::ModifierFn auto& modifier_fn) { 139| 823k| if(bytes_to_process == 0) { ------------------ | Branch (139:7): [True: 0, False: 823k] ------------------ 140| 0| return; 141| 0| } 142| | 143| 823k| constexpr auto word_bytes = SpongeT::word_bytes; 144| 823k| const auto byte_rate = sponge.byte_rate(); 145| 823k| auto& S = sponge.state(); 146| 823k| auto& cursor = sponge._cursor(); 147| | 148| | // If necessary, try to get aligned with the sponge state's words array 149| 823k| const auto bytes_out_of_word_alignment = static_cast(cursor % word_bytes); 150| 823k| if(bytes_out_of_word_alignment > 0) { ------------------ | Branch (150:7): [True: 718k, False: 104k] ------------------ 151| 718k| const auto bytes_until_word_alignment = word_bytes - bytes_out_of_word_alignment; 152| 718k| const auto bytes_from_input = std::min(bytes_to_process, bytes_until_word_alignment); 153| 718k| BOTAN_DEBUG_ASSERT(bytes_from_input < word_bytes); ------------------ | | 137| 718k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 718k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 718k] | | ------------------ ------------------ 154| | 155| 718k| S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes], 156| 718k| detail::PartialWordBounds{ 157| 718k| .offset = bytes_out_of_word_alignment, 158| 718k| .length = bytes_from_input, 159| 718k| }); 160| 718k| cursor += bytes_from_input; 161| 718k| bytes_to_process -= bytes_from_input; 162| | 163| 718k| if(cursor == byte_rate) { ------------------ | Branch (163:10): [True: 11.1k, False: 707k] ------------------ 164| 11.1k| permutation_fn(); 165| 11.1k| cursor = 0; 166| 11.1k| } 167| 718k| } 168| | 169| | // If we didn't exhaust the bytes to process for this invocation, we should 170| | // be word-aligned with the sponge state now 171| 823k| BOTAN_DEBUG_ASSERT(bytes_to_process == 0 || cursor % word_bytes == 0); ------------------ | | 137| 823k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 823k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 823k] | | ------------------ ------------------ 172| | 173| | // Block-wise incorporation of the input data into the sponge state until 174| | // all input bytes are processed 175| 823k| while(bytes_to_process >= word_bytes) { ------------------ | Branch (175:10): [True: 710, False: 823k] ------------------ 176| | // Process full words until we either run out of data or reach the 177| | // end of the current sponge state block 178| 7.94k| while(bytes_to_process >= word_bytes && cursor < byte_rate) { ------------------ | Branch (178:13): [True: 7.27k, False: 666] | Branch (178:47): [True: 7.23k, False: 44] ------------------ 179| 7.23k| S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes], detail::FullWordBounds{}); 180| 7.23k| cursor += word_bytes; 181| 7.23k| bytes_to_process -= word_bytes; 182| 7.23k| } 183| | 184| 710| if(cursor == byte_rate) { ------------------ | Branch (184:10): [True: 44, False: 666] ------------------ 185| 44| permutation_fn(); 186| 44| cursor = 0; 187| 44| } 188| 710| } 189| | 190| | // Process the remaining bytes that don't fill an entire word. 191| | // Therefore, leaving the sponge state in an unaligned state that won't 192| | // need another permutation until the next call to process(). 193| 823k| BOTAN_DEBUG_ASSERT(bytes_to_process < word_bytes && cursor < byte_rate); ------------------ | | 137| 823k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 823k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 823k] | | ------------------ ------------------ 194| 823k| if(bytes_to_process > 0) { ------------------ | Branch (194:7): [True: 270k, False: 552k] ------------------ 195| 270k| S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes], 196| 270k| detail::PartialWordBounds{ 197| 270k| .offset = 0, 198| 270k| .length = bytes_to_process, 199| 270k| }); 200| 270k| cursor += bytes_to_process; 201| 270k| } 202| 823k|} _ZZN5Botan19squeeze_from_spongeITkNS_6detail10SpongeLikeENS_18Keccak_PermutationETkNS1_13PermutationFnEZNS_19squeeze_from_spongeITkNS1_28SpongeLikeWithTrivialPermuteES2_EEvRT_NSt3__14spanIhLm18446744073709551615EEEEUlvE_EEvS5_S8_RKT0_ENKUlmS4_E_clINS1_17PartialWordBoundsIS2_EEEEDamS4_: 250| 989k| process_bytes_in_sponge(sponge, output.size(), permutation_fn, [&](word_t state_word, auto bounds) { 251| 989k| bounds.write_into(output_stuffer, state_word); 252| 989k| return state_word; 253| 989k| }); _ZNK5Botan6detail17PartialWordBoundsINS_18Keccak_PermutationEE10write_intoERNS_13BufferStufferEm: 68| 989k| void write_into(BufferStuffer& stuffer, word_t partial_word) const { 69| 989k| const auto partial_word_bytes = store_le(partial_word); 70| 989k| stuffer.append(std::span{partial_word_bytes}.subspan(offset, length)); 71| 989k| } _ZZN5Botan19squeeze_from_spongeITkNS_6detail28SpongeLikeWithTrivialPermuteENS_18Keccak_PermutationEEEvRT_NSt3__14spanIhLm18446744073709551615EEEENKUlvE_clEv: 258| 11.2k| squeeze_from_sponge(sponge, output, [&sponge] { sponge.permute(); }); _ZZN5Botan19squeeze_from_spongeITkNS_6detail10SpongeLikeENS_18Keccak_PermutationETkNS1_13PermutationFnEZNS_19squeeze_from_spongeITkNS1_28SpongeLikeWithTrivialPermuteES2_EEvRT_NSt3__14spanIhLm18446744073709551615EEEEUlvE_EEvS5_S8_RKT0_ENKUlmS4_E_clINS1_14FullWordBoundsIS2_EEEEDamS4_: 250| 7.23k| process_bytes_in_sponge(sponge, output.size(), permutation_fn, [&](word_t state_word, auto bounds) { 251| 7.23k| bounds.write_into(output_stuffer, state_word); 252| 7.23k| return state_word; 253| 7.23k| }); _ZNK5Botan6detail14FullWordBoundsINS_18Keccak_PermutationEE10write_intoERNS_13BufferStufferEm: 98| 7.23k| void write_into(BufferStuffer& stuffer, word_t full_word) const { stuffer.append(store_le(full_word)); } _ZN5Botan11Thread_PoolD2Ev: 93| 1| ~Thread_Pool() { shutdown(); } _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEmQntsr3stdE7same_asIbT_EEES3_S3_: 43| 322M|constexpr inline T value_barrier(T x) { 44| 322M| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 322M] ------------------ 45| 0| return x; 46| 322M| } else { 47| 322M|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 322M| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 322M| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 322M| } 64| 322M|} _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEjQntsr3stdE7same_asIbT_EEES3_S3_: 43| 241k|constexpr inline T value_barrier(T x) { 44| 241k| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 241k] ------------------ 45| 0| return x; 46| 241k| } else { 47| 241k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 241k| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 241k| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 241k| } 64| 241k|} _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEhQntsr3stdE7same_asIbT_EEES3_S3_: 43| 225k|constexpr inline T value_barrier(T x) { 44| 225k| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 225k] ------------------ 45| 0| return x; 46| 225k| } else { 47| 225k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 225k| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 225k| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 225k| } 64| 225k|} _ZN5Botan21Allocator_InitializerC2Ev: 57| 1| Allocator_Initializer() { initialize_allocator(); } _ZNK5Botan14ASN1_BitString5bytesEv: 206| 1.89k| std::span bytes() const { return std::span{m_bytes}; } _ZNK5Botan14ASN1_BitString11unused_bitsEv: 211| 950| size_t unused_bits() const { return m_unused_bits; } _ZNK5Botan10BER_Object6is_setEv: 267| 170k| bool is_set() const { return m_type_tag != ASN1_Type::NoObject; } _ZNK5Botan10BER_Object7taggingEv: 272| 67.0k| uint32_t tagging() const { return type_tag() | class_tag(); } _ZNK5Botan10BER_Object8type_tagEv: 277| 70.1k| ASN1_Type type_tag() const { return m_type_tag; } _ZNK5Botan10BER_Object9class_tagEv: 282| 81.7k| ASN1_Class class_tag() const { return m_class_tag; } _ZNK5Botan10BER_Object4bitsEv: 298| 197k| const uint8_t* bits() const { return m_value.data(); } _ZNK5Botan10BER_Object6lengthEv: 303| 493k| size_t length() const { return m_value.size(); } _ZNK5Botan10BER_Object4dataEv: 308| 24.6k| std::span data() const { return std::span{m_value}; } _ZN5Botan10BER_Object12mutable_bitsEm: 344| 57.7k| uint8_t* mutable_bits(size_t length) { 345| 57.7k| m_value.resize(length); 346| 57.7k| return m_value.data(); 347| 57.7k| } _ZNK5Botan3OID5emptyEv: 468| 12.1k| bool empty() const { return m_id.empty(); } _ZNK5Botan3OID9has_valueEv: 474| 5.85k| bool has_value() const { return !empty(); } _ZNK5Botan3OIDeqERKS0_: 510| 38.0k| bool operator==(const OID& other) const { return m_id == other.m_id; } _ZNK5Botan19AlgorithmIdentifier3oidEv: 688| 14.2k| const OID& oid() const { return m_oid; } _ZNK5Botan19AlgorithmIdentifier10parametersEv: 693| 3.44k| const std::vector& parameters() const { return m_parameters; } _ZNK5Botan19AlgorithmIdentifier20parameters_are_emptyEv: 715| 9.31k| bool parameters_are_empty() const { return m_parameters.empty(); } _ZNK5Botan19AlgorithmIdentifier28parameters_are_null_or_emptyEv: 720| 6.00k| bool parameters_are_null_or_empty() const { return parameters_are_empty() || parameters_are_null(); } ------------------ | Branch (720:58): [True: 2.16k, False: 3.84k] | Branch (720:84): [True: 15, False: 3.82k] ------------------ _ZN5BotanorENS_10ASN1_ClassES0_: 91| 22.9k|inline ASN1_Class operator|(ASN1_Class x, ASN1_Class y) { 92| 22.9k| return static_cast(static_cast(x) | static_cast(y)); 93| 22.9k|} _ZN5BotanorENS_9ASN1_TypeENS_10ASN1_ClassE: 98| 67.0k|inline uint32_t operator|(ASN1_Type x, ASN1_Class y) { 99| 67.0k| return static_cast(x) | static_cast(y); 100| 67.0k|} _ZN5BotanorENS_10ASN1_ClassENS_9ASN1_TypeE: 105| 9.24k|inline uint32_t operator|(ASN1_Class x, ASN1_Type y) { 106| 9.24k| return static_cast(x) | static_cast(y); 107| 9.24k|} _ZN5BotanneERKNS_3OIDES2_: 561| 5.55k|inline bool operator!=(const OID& a, const OID& b) { 562| 5.55k| return !(a == b); 563| 5.55k|} _ZNKSt3__14hashIN5Botan3OIDEEclERKS2_: 761| 1.84k| size_t operator()(const Botan::OID& oid) const noexcept { return static_cast(oid.hash_code()); } _ZN5Botan3OIDC2Ev: 423| 24.2k| explicit OID() = default; _ZN5Botan11ASN1_ObjectC2Ev: 146| 74.4k| ASN1_Object() = default; _ZN5Botan11ASN1_ObjectD2Ev: 168| 84.5k| virtual ~ASN1_Object() = default; _ZN5Botan11ASN1_ObjectC2ERKS0_: 151| 2.47k| ASN1_Object(const ASN1_Object&) = default; _ZN5Botan11ASN1_ObjectaSERKS0_: 156| 3.21k| ASN1_Object& operator=(const ASN1_Object&) = default; _ZN5Botan19AlgorithmIdentifierC2Ev: 655| 14.0k| AlgorithmIdentifier() = default; _ZN5Botan11ASN1_ObjectC2EOS0_: 161| 7.67k| ASN1_Object(ASN1_Object&&) = default; _ZN5Botan10BER_ObjectC2Ev: 239| 107k| BER_Object() = default; _ZN5Botan10BER_ObjectaSEOS0_: 259| 25.5k| BER_Object& operator=(BER_Object&& other) = default; _ZN5Botan10BER_ObjectC2EOS0_: 249| 24.1k| BER_Object(BER_Object&& other) = default; _ZN5Botan14ASN1_BitStringC2Ev: 179| 959| ASN1_BitString() = default; _ZN5Botan13ignore_paramsIJPKmmEEEvDpRKT_: 149| 14.7M|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEEEEvDpRKT_: 149| 735|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJmEEEvDpRKT_: 149| 28.4k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJPKhmEEEvDpRKT_: 149| 32.9k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJPKbmEEEvDpRKT_: 149| 306k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJPKimEEEvDpRKT_: 149| 2.59k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJPKsmEEEvDpRKT_: 149| 288|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan13ignore_paramsIJNSt3__14spanIKhLm18446744073709551615EEES4_EEEvDpRKT_: 149| 3.91k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan11BER_Decoder6Limits3DEREv: 44| 13.7k| static Limits DER() { return Limits(false, 0, false, DefaultMaxObjectSize, false); } _ZN5Botan11BER_Decoder6LimitsC2EbmbNSt3__18optionalImEEb: 135| 13.7k| m_allow_ber(allow_ber), 136| 13.7k| m_max_nested_indef(max_nested_indef), 137| 13.7k| m_allow_standalone_eoc(allow_standalone_eoc), 138| 13.7k| m_max_object_size(max_object_size), 139| 13.7k| m_reject_default_value_encoding(reject_default_value_encoding) {} _ZN5Botan11BER_Decoder14start_sequenceEv: 277| 19.2k| BER_Decoder start_sequence() { return start_cons(ASN1_Type::Sequence, ASN1_Class::Universal); } _ZN5Botan11BER_Decoder6decodeERNS_6BigIntE: 369| 4.01k| BER_Decoder& decode(BigInt& out) { return decode(out, ASN1_Type::Integer, ASN1_Class::Universal); } _ZN5Botan11BER_Decoder6decodeINSt3__16vectorIhNS2_9allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_NS_9ASN1_TypeE: 388| 914| BER_Decoder& decode(T& out, ASN1_Type real_type) { 389| 914| return decode(unwrap_strong_type(out), real_type, real_type, ASN1_Class::Universal); 390| 914| } _ZN5Botan11BER_Decoder6decodeINSt3__16vectorIhNS2_9allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_NS_9ASN1_TypeESF_NS_10ASN1_ClassE: 405| 1.82k| ASN1_Class class_tag = ASN1_Class::ContextSpecific) { 406| 1.82k| return decode_into_byte_vector(unwrap_strong_type(v), real_type, type_tag, class_tag); 407| 1.82k| } _ZN5Botan11BER_Decoder16decode_and_checkImEERS0_RKT_NSt3__117basic_string_viewIcNS6_11char_traitsIcEEEE: 696| 10.8k| BER_Decoder& decode_and_check(const T& expected, std::string_view error_msg) { 697| 10.8k| T actual; 698| 10.8k| decode(actual); 699| | 700| 10.8k| if(actual != expected) { ------------------ | Branch (700:13): [True: 83, False: 10.7k] ------------------ 701| 83| throw Decoding_Error(error_msg); 702| 83| } 703| | 704| 10.7k| return (*this); 705| 10.8k| } _ZN5Botan11BER_Decoder6decodeERm: 364| 10.8k| BER_Decoder& decode(size_t& out) { return decode(out, ASN1_Type::Integer, ASN1_Class::Universal); } _ZN5Botan11BER_Decoder16decode_and_checkINS_3OIDEEERS0_RKT_NSt3__117basic_string_viewIcNS7_11char_traitsIcEEEE: 696| 932| BER_Decoder& decode_and_check(const T& expected, std::string_view error_msg) { 697| 932| T actual; 698| 932| decode(actual); 699| | 700| 932| if(actual != expected) { ------------------ | Branch (700:13): [True: 8, False: 924] ------------------ 701| 8| throw Decoding_Error(error_msg); 702| 8| } 703| | 704| 924| return (*this); 705| 932| } _ZN5Botan11BER_Decoder22decode_optional_stringINSt3__16vectorIhNS2_9allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_NS_9ASN1_TypeESF_NS_10ASN1_ClassE: 754| 922| ASN1_Class class_tag = ASN1_Class::ContextSpecific) { 755| 922| return decode_optional_string(out, real_type, static_cast(expected_tag), class_tag); 756| 922| } _ZN5Botan11BER_Decoder22decode_optional_stringINSt3__16vectorIhNS2_9allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_NS_9ASN1_TypeEjNS_10ASN1_ClassE: 720| 922| ASN1_Class class_tag = ASN1_Class::ContextSpecific) { 721| 922| BER_Object obj = get_next_object(); 722| 922| auto& out = unwrap_strong_type(out_wrapped); 723| | 724| 922| const ASN1_Type type_tag = static_cast(expected_tag); 725| | 726| 922| if(obj.is_a(type_tag, class_tag)) { ------------------ | Branch (726:13): [True: 908, False: 14] ------------------ 727| 908| if(class_tag == ASN1_Class::ExplicitContextSpecific) { ------------------ | Branch (727:16): [True: 0, False: 908] ------------------ 728| 0| BER_Decoder(obj, m_limits).decode(out, real_type).verify_end(); 729| 908| } else { 730| 908| push_back(std::move(obj)); 731| 908| decode(out, real_type, type_tag, class_tag); 732| 908| } 733| 908| } else { 734| 14| out.clear(); 735| 14| push_back(std::move(obj)); 736| 14| } 737| | 738| 922| return (*this); 739| 922| } _ZN5Botan11BER_DecoderC2ERKNS_10BER_ObjectENS0_6LimitsE: 169| 1.00k| BER_Decoder(obj.data(), limits) {} _ZNK5Botan11BER_Decoder6Limits18allow_ber_encodingEv: 58| 151k| bool allow_ber_encoding() const { return m_allow_ber; } _ZNK5Botan11BER_Decoder6Limits20require_der_encodingEv: 63| 93.5k| bool require_der_encoding() const { return !allow_ber_encoding(); } _ZNK5Botan11BER_Decoder6Limits15max_object_sizeEv: 82| 57.9k| std::optional max_object_size() const { return m_max_object_size; } _ZNK5Botan11BER_Decoder6limitsEv: 199| 19.0k| Limits limits() const { return m_limits; } _ZN5Botan11BER_Decoder6decodeINSt3__16vectorIhNS_16secure_allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_NS_9ASN1_TypeE: 388| 10.9k| BER_Decoder& decode(T& out, ASN1_Type real_type) { 389| 10.9k| return decode(unwrap_strong_type(out), real_type, real_type, ASN1_Class::Universal); 390| 10.9k| } _ZN5Botan11BER_Decoder6decodeINSt3__16vectorIhNS_16secure_allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_NS_9ASN1_TypeESF_NS_10ASN1_ClassE: 405| 10.9k| ASN1_Class class_tag = ASN1_Class::ContextSpecific) { 406| 10.9k| return decode_into_byte_vector(unwrap_strong_type(v), real_type, type_tag, class_tag); 407| 10.9k| } _ZN5Botan11BER_Decoder9raw_bytesINSt3__16vectorIhNS2_9allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_: 341| 5.99k| BER_Decoder& raw_bytes(T& out_wrapped) { 342| 5.99k| auto& out = unwrap_strong_type(out_wrapped); 343| 5.99k| out.clear(); 344| 5.99k| uint8_t buf[64]; 345| 14.3k| while(const size_t got = this->read_bytes(std::span{buf})) { ------------------ | Branch (345:29): [True: 8.31k, False: 5.99k] ------------------ 346| 8.31k| out.insert(out.end(), buf, buf + got); 347| 8.31k| } 348| 5.99k| return (*this); 349| 5.99k| } _ZN5Botan11BER_Decoder15decode_optionalINS_3OIDEEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassERKS4_: 548| 3.22k| BER_Decoder& decode_optional(T& out, ASN1_Type type_tag, ASN1_Class class_tag, const T& default_value = T()) { 549| 3.22k| std::optional optval; 550| 3.22k| this->decode_optional(optval, type_tag, class_tag); 551| 3.22k| out = optval ? *optval : default_value; ------------------ | Branch (551:16): [True: 43, False: 3.17k] ------------------ 552| 3.22k| return (*this); 553| 3.22k| } _ZN5Botan11BER_Decoder15decode_optionalINS_3OIDEEERS0_RNSt3__18optionalIT_EENS_9ASN1_TypeENS_10ASN1_ClassE: 840| 3.22k|BER_Decoder& BER_Decoder::decode_optional(std::optional& optval, ASN1_Type type_tag, ASN1_Class class_tag) { 841| 3.22k| BER_Object obj = get_next_object(); 842| | 843| 3.22k| if(obj.is_a(type_tag, class_tag)) { ------------------ | Branch (843:7): [True: 45, False: 3.17k] ------------------ 844| 45| T out{}; 845| 45| if(class_tag == ASN1_Class::ExplicitContextSpecific) { ------------------ | Branch (845:10): [True: 45, False: 0] ------------------ 846| 45| BER_Decoder(obj, m_limits).decode(out).verify_end(); 847| 45| } else { 848| 0| this->push_back(std::move(obj)); 849| 0| if constexpr(std::is_base_of_v) { 850| | // Object types check the tag in decode_from; a re-tagging 851| | // implicit override of an object is not supported here 852| 0| this->decode(out); 853| | } else { 854| | this->decode(out, type_tag, class_tag); 855| | } 856| 0| } 857| 45| optval = std::move(out); 858| 3.17k| } else { 859| 3.17k| this->push_back(std::move(obj)); 860| 3.17k| optval = std::nullopt; 861| 3.17k| } 862| | 863| 3.22k| return (*this); 864| 3.22k|} _ZN5Botan11BER_Decoder39decode_optional_octet_aligned_bitstringINSt3__16vectorIhNS_16secure_allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_jNS_10ASN1_ClassE: 770| 3.21k| ASN1_Class class_tag = ASN1_Class::ContextSpecific) { 771| 3.21k| BER_Object obj = get_next_object(); 772| 3.21k| auto& out = unwrap_strong_type(out_wrapped); 773| | 774| 3.21k| const ASN1_Type type_tag = static_cast(expected_tag); 775| | 776| 3.21k| if(obj.is_a(type_tag, class_tag)) { ------------------ | Branch (776:13): [True: 959, False: 2.25k] ------------------ 777| 959| if(class_tag == ASN1_Class::ExplicitContextSpecific) { ------------------ | Branch (777:16): [True: 959, False: 0] ------------------ 778| 959| BER_Decoder(obj, m_limits).decode_octet_aligned_bitstring(out).verify_end(); 779| 959| } else { 780| 0| push_back(std::move(obj)); 781| 0| decode_octet_aligned_bitstring(out, type_tag, class_tag); 782| 0| } 783| 2.25k| } else { 784| 2.25k| out.clear(); 785| 2.25k| push_back(std::move(obj)); 786| 2.25k| } 787| | 788| 3.21k| return (*this); 789| 3.21k| } _ZN5Botan11BER_Decoder30decode_octet_aligned_bitstringINSt3__16vectorIhNS_16secure_allocatorIhEEEEQsr8conceptsE20ordinary_byte_vectorINS_6detail19wrapped_type_helperIu14__remove_cvrefIT_EE4typeEEEERS0_RS9_NS_9ASN1_TypeENS_10ASN1_ClassE: 458| 959| ASN1_Class class_tag = ASN1_Class::Universal) { 459| 959| auto& out = unwrap_strong_type(out_wrapped); 460| 959| ASN1_BitString bits; 461| 959| decode_bitstring(bits, type_tag, class_tag); 462| | 463| 959| if(bits.unused_bits() != 0) { ------------------ | Branch (463:13): [True: 5, False: 954] ------------------ 464| 5| throw Decoding_Error("Expected octet-aligned BIT STRING"); 465| 5| } 466| | 467| 954| out.assign(bits.bytes().begin(), bits.bytes().end()); 468| 954| return (*this); 469| 959| } _ZN5Botan6BigInt4zeroEv: 50| 1.07k| static BigInt zero() { return BigInt(); } _ZN5Botan6BigIntC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 98| 15.0k| explicit BigInt(std::string_view str) { *this = BigInt::from_string(str); } _ZN5Botan6BigIntC2ENSt3__14spanIKhLm18446744073709551615EEE: 139| 337| explicit BigInt(std::span bytes) { assign_from_bytes(bytes); } _ZN5Botan6BigIntC2EOS0_: 183| 40.7k| BigInt(BigInt&& other) noexcept { this->swap(other); } _ZN5Botan6BigIntD2Ev: 185| 3.04M| ~BigInt() { _const_time_unpoison(); } _ZN5Botan6BigIntaSEOS0_: 190| 1.08M| BigInt& operator=(BigInt&& other) noexcept { 191| 1.08M| if(this != &other) { ------------------ | Branch (191:13): [True: 1.08M, False: 0] ------------------ 192| 1.08M| this->swap(other); 193| 1.08M| } 194| | 195| 1.08M| return (*this); 196| 1.08M| } _ZN5Botan6BigInt4swapERS0_: 207| 2.35M| void swap(BigInt& other) noexcept { 208| 2.35M| m_data.swap(other.m_data); 209| 2.35M| std::swap(m_signedness, other.m_signedness); 210| 2.35M| } _ZN5Botan6BigInt8swap_regERNSt3__16vectorImNS_16secure_allocatorImEEEE: 218| 881k| BOTAN_DEPRECATED("Deprecated no replacement") void swap_reg(secure_vector& reg) { 219| 881k| m_data.swap(reg); 220| | // sign left unchanged 221| 881k| } _ZN5Botan6BigIntmIEm: 245| 1.09k| BigInt& operator-=(word y) { return sub(&y, 1, Positive); } _ZN5Botan6BigInt3subEPKmmNS0_4SignE: 358| 1.09k| BigInt& sub(const word y[], size_t y_words, Sign sign) { 359| 1.09k| return add(y, y_words, sign == Positive ? Negative : Positive); ------------------ | Branch (359:33): [True: 1.09k, False: 0] ------------------ 360| 1.09k| } _ZN5Botan6BigInt5clearEv: 441| 38.4k| void clear() { 442| 38.4k| m_data.set_to_zero(); 443| 38.4k| m_signedness = Positive; 444| 38.4k| } _ZNK5Botan6BigInt7is_evenEv: 481| 7.51k| bool is_even() const { return !get_bit(0); } _ZNK5Botan6BigInt6is_oddEv: 487| 24.0k| bool is_odd() const { return get_bit(0); } _ZNK5Botan6BigInt6signumEv: 493| 7.95M| int signum() const { 494| 7.95M| if(sig_words() == 0) { ------------------ | Branch (494:13): [True: 8.65k, False: 7.94M] ------------------ 495| 8.65k| return 0; 496| 8.65k| } 497| 7.94M| return (sign() == Negative) ? -1 : 1; ------------------ | Branch (497:17): [True: 3.14k, False: 7.94M] ------------------ 498| 7.95M| } _ZNK5Botan6BigInt7is_zeroEv: 510| 1.00M| bool is_zero() const { return sig_words() == 0; } _ZN5Botan6BigInt7set_bitEm: 516| 15.3k| void set_bit(size_t n) { conditionally_set_bit(n, true); } _ZN5Botan6BigInt21conditionally_set_bitEmb: 526| 15.3k| void conditionally_set_bit(size_t n, bool set_it) { 527| 15.3k| const size_t which = n / (sizeof(word) * 8); 528| 15.3k| const word mask = static_cast(set_it) << (n % (sizeof(word) * 8)); 529| 15.3k| m_data.set_word_at(which, word_at(which) | mask); 530| 15.3k| } _ZNK5Botan6BigInt7get_bitEm: 549| 216k| bool get_bit(size_t n) const { return ((word_at(n / (sizeof(word) * 8)) >> (n % (sizeof(word) * 8))) & 1) == 1; } _ZNK5Botan6BigInt7word_atEm: 601| 602k| word word_at(size_t n) const { return m_data.get_word_at(n); } _ZN5Botan6BigInt11set_word_atEmm: 608| 556k| BOTAN_DEPRECATED("Deprecated no replacement") void set_word_at(size_t i, word w) { m_data.set_word_at(i, w); } _ZN5Botan6BigInt9set_wordsEPKmm: 615| 29.2k| BOTAN_DEPRECATED("Deprecated no replacement") void set_words(const word w[], size_t len) { 616| 29.2k| m_data.set_words(w, len); 617| 29.2k| } _ZNK5Botan6BigInt4signEv: 641| 8.07M| Sign sign() const { return (m_signedness); } _ZNK5Botan6BigInt12reverse_signEv: 647| 1.32k| Sign reverse_sign() const { 648| 1.32k| if(sign() == Positive) { ------------------ | Branch (648:13): [True: 1.32k, False: 0] ------------------ 649| 1.32k| return Negative; 650| 1.32k| } 651| 0| return Positive; 652| 1.32k| } _ZN5Botan6BigInt9flip_signEv: 657| 92| BOTAN_DEPRECATED("Deprecated no replacement") void flip_sign() { set_sign(reverse_sign()); } _ZN5Botan6BigInt8set_signENS0_4SignE: 663| 52.1k| void set_sign(Sign sign) { 664| 52.1k| if(sign == Negative && is_zero()) { ------------------ | Branch (664:13): [True: 3.21k, False: 48.9k] | Branch (664:33): [True: 984, False: 2.23k] ------------------ 665| 984| sign = Positive; 666| 984| } 667| | 668| 52.1k| m_signedness = sign; 669| 52.1k| } _ZNK5Botan6BigInt4sizeEv: 681| 37.8M| size_t size() const { return m_data.size(); } _ZNK5Botan6BigInt9sig_wordsEv: 687| 12.4M| size_t sig_words() const { return m_data.sig_words(); } _ZN5Botan6BigInt12mutable_dataEv: 712| 16.6M| BOTAN_DEPRECATED("Deprecated no replacement") word* mutable_data() { return m_data.mutable_data(); } _ZNK5Botan6BigInt4dataEv: 718| 11.5k| BOTAN_DEPRECATED("Deprecated no replacement") const word* data() const { return m_data.const_data(); } _ZN5Botan6BigInt15get_word_vectorEv: 723| 664k| BOTAN_DEPRECATED("Deprecated no replacement") secure_vector& get_word_vector() { 724| 664k| return m_data.mutable_vector(); 725| 664k| } _ZNK5Botan6BigInt7grow_toEm: 738| 5.19M| BOTAN_DEPRECATED("Deprecated no replacement") void grow_to(size_t n) const { m_data.grow_to(n); } _ZN5Botan6BigInt10power_of_2Em: 906| 15.3k| static BigInt power_of_2(size_t n) { 907| 15.3k| BigInt b; 908| 15.3k| b.set_bit(n); 909| 15.3k| return b; 910| 15.3k| } _ZN5Botan6BigInt6decodeEPKhm: 943| 366| BOTAN_DEPRECATED("Use BigInt::from_bytes") static BigInt decode(const uint8_t buf[], size_t length) { 944| 366| return BigInt::from_bytes(std::span{buf, length}); 945| 366| } _ZN5Botan6BigInt11encode_1363EPhmRKS0_: 1001| 884| static void encode_1363(uint8_t out[], size_t bytes, const BigInt& n) { 1002| 884| n.serialize_to(std::span{out, bytes}); 1003| 884| } _ZNK5Botan6BigInt8_as_spanEv: 1023| 20.7k| std::span _as_span() const { return m_data.const_span(); } _ZNK5Botan6BigInt5_dataEv: 1033| 29.8M| const word* _data() const { return m_data.const_data(); } _ZN5Botan6BigInt18_assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE: 1044| 14.4k| void _assign_from_bytes(std::span bytes) { assign_from_bytes(bytes); } _ZN5Botan6BigInt11_from_wordsERNSt3__16vectorImNS_16secure_allocatorImEEEE: 1052| 75.9k| static BigInt _from_words(secure_vector& words) { 1053| 75.9k| BigInt bn; 1054| 75.9k| bn.m_data.swap(words); 1055| 75.9k| return bn; 1056| 75.9k| } _ZN5Botan6BigInt4Data12mutable_dataEv: 1083| 16.6M| word* mutable_data() { 1084| 16.6M| invalidate_sig_words(); 1085| 16.6M| return m_reg.data(); 1086| 16.6M| } _ZNK5Botan6BigInt4Data10const_dataEv: 1088| 32.8M| const word* const_data() const { return m_reg.data(); } _ZNK5Botan6BigInt4Data10const_spanEv: 1090| 20.7k| std::span const_span() const { return std::span{m_reg}; } _ZN5Botan6BigInt4Data14mutable_vectorEv: 1092| 664k| secure_vector& mutable_vector() { 1093| 664k| invalidate_sig_words(); 1094| 664k| return m_reg; 1095| 664k| } _ZNK5Botan6BigInt4Data11get_word_atEm: 1099| 602k| word get_word_at(size_t n) const { 1100| 602k| if(n < m_reg.size()) { ------------------ | Branch (1100:19): [True: 587k, False: 15.3k] ------------------ 1101| 587k| return m_reg[n]; 1102| 587k| } 1103| 15.3k| return 0; 1104| 602k| } _ZN5Botan6BigInt4Data11set_word_atEmm: 1106| 575k| void set_word_at(size_t i, word w) { 1107| 575k| invalidate_sig_words(); 1108| 575k| if(i >= m_reg.size()) { ------------------ | Branch (1108:19): [True: 575k, False: 0] ------------------ 1109| 575k| if(w == 0) { ------------------ | Branch (1109:22): [True: 546k, False: 28.7k] ------------------ 1110| 546k| return; 1111| 546k| } 1112| 28.7k| grow_to(i + 1); 1113| 28.7k| } 1114| 28.7k| m_reg[i] = w; 1115| 28.7k| } _ZN5Botan6BigInt4Data9set_wordsEPKmm: 1117| 29.2k| void set_words(const word w[], size_t len) { 1118| 29.2k| invalidate_sig_words(); 1119| 29.2k| m_reg.assign(w, w + len); 1120| 29.2k| } _ZNK5Botan6BigInt4Data7grow_toEm: 1126| 5.22M| void grow_to(size_t n) const { 1127| 5.22M| if(n > size()) { ------------------ | Branch (1127:19): [True: 1.31M, False: 3.90M] ------------------ 1128| 1.31M| if(n <= m_reg.capacity()) { ------------------ | Branch (1128:22): [True: 28.5k, False: 1.28M] ------------------ 1129| 28.5k| m_reg.resize(n); 1130| 1.28M| } else { 1131| 1.28M| m_reg.resize(n + (8 - (n % 8))); 1132| 1.28M| } 1133| 1.31M| } 1134| 5.22M| } _ZNK5Botan6BigInt4Data4sizeEv: 1136| 46.1M| size_t size() const { return m_reg.size(); } _ZN5Botan6BigInt4Data4swapERS1_: 1151| 2.35M| void swap(Data& other) noexcept { 1152| 2.35M| m_reg.swap(other.m_reg); 1153| 2.35M| std::swap(m_sig_words, other.m_sig_words); 1154| 2.35M| } _ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE: 1156| 995k| void swap(secure_vector& reg) noexcept { 1157| 995k| m_reg.swap(reg); 1158| 995k| invalidate_sig_words(); 1159| 995k| } _ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv: 1161| 18.9M| void invalidate_sig_words() const noexcept { m_sig_words = sig_words_npos; } _ZNK5Botan6BigInt4Data9sig_wordsEv: 1163| 12.4M| size_t sig_words() const { 1164| 12.4M| if(m_sig_words == sig_words_npos) { ------------------ | Branch (1164:19): [True: 5.66M, False: 6.78M] ------------------ 1165| 5.66M| m_sig_words = calc_sig_words(); 1166| 5.66M| } 1167| 12.4M| return m_sig_words; 1168| 12.4M| } _ZN5BotanplERKNS_6BigIntES2_: 1189| 7.39k|inline BigInt operator+(const BigInt& x, const BigInt& y) { 1190| 7.39k| return BigInt::add2(x, y._data(), y.sig_words(), y.sign()); 1191| 7.39k|} _ZN5BotanplERKNS_6BigIntEm: 1199| 2.13k|inline BigInt operator+(const BigInt& x, word y) { 1200| 2.13k| return BigInt::add2(x, &y, 1, BigInt::Positive); 1201| 2.13k|} _ZN5BotanmiERKNS_6BigIntES2_: 1219| 1.22k|inline BigInt operator-(const BigInt& x, const BigInt& y) { 1220| 1.22k| return BigInt::add2(x, y._data(), y.sig_words(), y.reverse_sign()); 1221| 1.22k|} _ZN5BotanmiERKNS_6BigIntEm: 1229| 4.52k|inline BigInt operator-(const BigInt& x, word y) { 1230| 4.52k| return BigInt::add2(x, &y, 1, BigInt::Negative); 1231| 4.52k|} _ZN5BotanmlEmRKNS_6BigIntE: 1255| 1.30k|inline BigInt operator*(word x, const BigInt& y) { 1256| 1.30k| return y * x; 1257| 1.30k|} _ZN5BotaneqERKNS_6BigIntES2_: 1313| 5.30k|inline bool operator==(const BigInt& a, const BigInt& b) { 1314| 5.30k| return a.is_equal(b); 1315| 5.30k|} _ZN5BotanneERKNS_6BigIntES2_: 1323| 4.75k|inline bool operator!=(const BigInt& a, const BigInt& b) { 1324| 4.75k| return !a.is_equal(b); 1325| 4.75k|} _ZN5BotangeERKNS_6BigIntES2_: 1343| 15.0k|inline bool operator>=(const BigInt& a, const BigInt& b) { 1344| 15.0k| return (a.cmp(b) >= 0); 1345| 15.0k|} _ZN5BotanltERKNS_6BigIntES2_: 1353| 31.9k|inline bool operator<(const BigInt& a, const BigInt& b) { 1354| 31.9k| return a.is_less_than(b); 1355| 31.9k|} _ZN5BotaneqERKNS_6BigIntEm: 1373| 50.6k|inline bool operator==(const BigInt& a, word b) { 1374| 50.6k| return (a.cmp_word(b) == 0); 1375| 50.6k|} _ZN5BotanneERKNS_6BigIntEm: 1383| 2.57k|inline bool operator!=(const BigInt& a, word b) { 1384| 2.57k| return (a.cmp_word(b) != 0); 1385| 2.57k|} _ZN5BotanleERKNS_6BigIntEm: 1393| 4.01k|inline bool operator<=(const BigInt& a, word b) { 1394| 4.01k| return (a.cmp_word(b) <= 0); 1395| 4.01k|} _ZN5BotangeERKNS_6BigIntEm: 1403| 7.44k|inline bool operator>=(const BigInt& a, word b) { 1404| 7.44k| return (a.cmp_word(b) >= 0); 1405| 7.44k|} _ZN5BotanltERKNS_6BigIntEm: 1413| 16.8k|inline bool operator<(const BigInt& a, word b) { 1414| 16.8k| return (a.cmp_word(b) < 0); 1415| 16.8k|} _ZN5BotangtERKNS_6BigIntEm: 1423| 2.07k|inline bool operator>(const BigInt& a, word b) { 1424| 2.07k| return (a.cmp_word(b) > 0); 1425| 2.07k|} _ZNK5Botan6BigInt9serializeINSt3__16vectorIhNS2_9allocatorIhEEEEEET_m: 790| 602| T serialize(size_t len) const { 791| | // TODO this supports std::vector and secure_vector 792| | // it would be nice if this also could work with std::array as in 793| | // bn.serialize_to>(32); 794| 602| T out(len); 795| 602| this->serialize_to(out); 796| 602| return out; 797| 602| } _ZN5Botan6BigIntC2Ev: 45| 2.41M| BigInt() = default; _ZN5Botan6BigIntC2ERKS0_: 88| 565k| BigInt(const BigInt& other) = default; _ZN5Botan6BigIntaSERKS0_: 201| 849k| BigInt& operator=(const BigInt&) = default; _ZN5Botan20Buffered_Computation6updateENSt3__14spanIKhLm18446744073709551615EEE: 41| 170| void update(std::span in) { add_data(in); } _ZN5Botan20Buffered_ComputationD2Ev: 169| 126| virtual ~Buffered_Computation() = default; _ZN5Botan20Buffered_Computation5finalITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_v: 104| 44| T final() { 105| 44| T output(output_length()); 106| 44| final_result(output); 107| 44| return output; 108| 44| } _ZN5Botan20Buffered_Computation7processITkNS_8concepts21resizable_byte_bufferENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_21KyberHashedPublicKey_EJEEEEET_NS4_4spanIKhLm18446744073709551615EEE: 164| 44| T process(std::span in) { 165| 44| update(in); 166| 44| return final(); 167| 44| } _ZN5Botan20Buffered_Computation5finalITkNS_8concepts21resizable_byte_bufferENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_21KyberHashedPublicKey_EJEEEEET_v: 104| 44| T final() { 105| 44| T output(output_length()); 106| 44| final_result(output); 107| 44| return output; 108| 44| } _ZN5Botan8CurveGFp4swapERS0_: 82| 263k| void swap(CurveGFp& other) noexcept { std::swap(m_group, other.m_group); } _ZNK5Botan8CurveGFpeqERKS0_: 84| 179k| bool operator==(const CurveGFp& other) const { return (m_group == other.m_group); } _ZN5Botan8CurveGFpC2Ev: 75| 309k| CurveGFp() = default; _ZN5Botan17DataSource_MemoryC2ENSt3__14spanIKhLm18446744073709551615EEE: 181| 21.7k| explicit DataSource_Memory(std::span in) : m_offset(0) { 182| | // Guard against forming a range from a null pointer (eg an empty span) 183| 21.7k| if(!in.empty()) { ------------------ | Branch (183:13): [True: 21.7k, False: 32] ------------------ 184| 21.7k| m_source.assign(in.begin(), in.end()); 185| 21.7k| } 186| 21.7k| } _ZN5Botan10DataSourceC2Ev: 107| 47.4k| DataSource() = default; _ZN5Botan10DataSourceD2Ev: 109| 40.8k| virtual ~DataSource() = default; _ZN5Botan17DataSource_MemoryC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 175| 9| explicit DataSource_Memory(secure_vector in) : m_source(std::move(in)), m_offset(0) {} _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassENSt3__14spanIKhLm18446744073709551615EEE: 410| 2.43k| DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, std::span rep) { 411| 2.43k| return add_object(type_tag, class_tag, rep.data(), rep.size()); 412| 2.43k| } _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS3_9allocatorIhEEEE: 421| 2.43k| DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const std::vector& rep) { 422| 2.43k| return add_object(type_tag, class_tag, std::span{rep}); 423| 2.43k| } _ZN5Botan12DH_PublicKeyC2Ev: 68| 199| DH_PublicKey() = default; _ZNK5Botan13DilithiumMode19is_dilithium_round3Ev: 49| 149| bool is_dilithium_round3() const { return !is_ml_dsa(); } _ZNK5Botan13DilithiumMode4modeEv: 53| 447| Mode mode() const { return m_mode; } _ZN5Botan19Dilithium_PublicKeyC2Ev: 101| 77| Dilithium_PublicKey() = default; _ZN5Botan13DSA_PublicKeyC2Ev: 71| 117| DSA_PublicKey() = default; _ZNK5Botan14EC_AffinePointneERKS0_: 263| 185| bool operator!=(const EC_AffinePoint& other) const { return !(*this == other); } _ZNK5Botan14EC_AffinePoint6_innerEv: 340| 8| const EC_AffinePoint_Data& _inner() const { return inner(); } _ZNK5Botan14EC_AffinePoint5innerEv: 357| 6.45k| const EC_AffinePoint_Data& inner() const { return *m_point; } _ZNK5Botan14EC_AffinePoint22serialize_uncompressedITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS3_9allocatorIhEEEEEET_v: 235| 378| T serialize_uncompressed() const { 236| 378| T bytes(1 + 2 * this->field_element_bytes()); 237| 378| this->serialize_uncompressed_to(bytes); 238| 378| return bytes; 239| 378| } _ZN5Botan8EC_GroupC2ERKNS_3OIDE: 236| 37| BOTAN_DEPRECATED("Use EC_Group::from_OID") explicit EC_Group(const OID& oid) { *this = EC_Group::from_OID(oid); } _ZNK5Botan8EC_Group5_dataEv: 604| 10.9k| const std::shared_ptr& _data() const { return m_data; } _ZN5BotanneERKNS_8EC_GroupES2_: 926| 23|inline bool operator!=(const EC_Group& lhs, const EC_Group& rhs) { 927| 23| return !(lhs == rhs); 928| 23|} _ZN5Botan8EC_GroupaSEOS0_: 309| 23| EC_Group& operator=(EC_Group&&) = default; _ZN5Botan8EC_GroupC2EOS0_: 297| 4.74k| EC_Group(EC_Group&&) = default; _ZN5Botan8EC_PointC2EOS0_: 65| 884| EC_Point(EC_Point&& other) noexcept { this->swap(other); } _ZN5Botan8EC_PointaSEOS0_: 75| 219k| EC_Point& operator=(EC_Point&& other) noexcept { 76| 219k| if(this != &other) { ------------------ | Branch (76:13): [True: 219k, False: 0] ------------------ 77| 219k| this->swap(other); 78| 219k| } 79| 219k| return (*this); 80| 219k| } _ZNK5Botan8EC_Point7is_zeroEv: 170| 631k| bool is_zero() const { return m_z.is_zero(); } _ZNK5Botan8EC_Point5get_xEv: 248| 300k| BOTAN_DEPRECATED("Use affine coordinates only") const BigInt& get_x() const { return m_x; } _ZNK5Botan8EC_Point5get_yEv: 255| 300k| BOTAN_DEPRECATED("Use affine coordinates only") const BigInt& get_y() const { return m_y; } _ZNK5Botan8EC_Point4plusERKS0_RNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE: 357| 171k| EC_Point plus(const EC_Point& other, std::vector& workspace) const { 358| 171k| EC_Point x = (*this); 359| 171k| x.add(other, workspace); 360| 171k| return x; 361| 171k| } _ZNK5Botan8EC_Point9get_curveEv: 380| 375| BOTAN_DEPRECATED("Deprecated no replacement") const CurveGFp& get_curve() const { return m_curve; } _ZN5BotanmlERKNS_8EC_PointERKNS_6BigIntE: 438| 15|inline EC_Point operator*(const EC_Point& point, const BigInt& scalar) { 439| 15| return point.mul(scalar); 440| 15|} _ZN5Botan8EC_PointD2Ev: 82| 484k| ~EC_Point() = default; _ZN5Botan8EC_PointC2Ev: 49| 306k| EC_Point() = default; _ZN5Botan8EC_PointC2ERKS0_: 60| 172k| EC_Point(const EC_Point&) = default; _ZN5Botan8EC_PointaSERKS0_: 70| 171k| EC_Point& operator=(const EC_Point&) = default; _ZNK5Botan9EC_Scalar6_innerEv: 282| 2.28k| const EC_Scalar_Data& _inner() const { return inner(); } _ZNK5Botan9EC_Scalar5innerEv: 296| 11.4k| const EC_Scalar_Data& inner() const { return *m_scalar; } _ZN5Botan12EC_PublicKeyC2Ev: 140| 3.25k| EC_PublicKey() = default; _ZN5Botan12EC_PublicKeyD2Ev: 42| 3.25k| ~EC_PublicKey() override = default; _ZN5Botan13EC_PrivateKeyD2Ev: 173| 1.49k| ~EC_PrivateKey() override = default; _ZN5Botan15ECDH_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 87| 741| EC_PrivateKey(alg_id, key_bits) {} _ZN5Botan14ECDH_PublicKeyC2Ev: 67| 497| ECDH_PublicKey() = default; _ZN5Botan16ECDSA_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 98| 2.51k| EC_PrivateKey(assert_algorithm_identifier(alg_id, "ECDSA"), key_bits) {} _ZN5Botan15ECDSA_PublicKeyC2Ev: 79| 2.51k| ECDSA_PublicKey() = default; _ZN5Botan17Ed25519_PublicKeyC2Ev: 72| 42| Ed25519_PublicKey() = default; _ZN5Botan15Ed448_PublicKeyC2Ev: 76| 5| Ed448_PublicKey() = default; _ZNK5Botan9Exception4whatEv: 94| 1.16k| const char* what() const noexcept override { return m_msg.c_str(); } _ZN5Botan19GOST_3410_PublicKeyC2Ev: 72| 2| GOST_3410_PublicKey() = default; _ZN5Botan15Kyber_PublicKeyD2Ev: 105| 54| ~Kyber_PublicKey() override = default; _ZNK5Botan9KyberMode4modeEv: 60| 98| Mode mode() const { return m_mode; } _ZN5Botan15Kyber_PublicKeyC2Ev: 135| 54| Kyber_PublicKey() = default; _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 1.46k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1.46k| ranges::assert_equal_byte_lengths(out, in); 162| 1.46k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1.46k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1.46k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1.46k, False: 0] ------------------ 165| 1.46k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1.46k| } 167| 1.46k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS2_6vectorIhNS_16secure_allocatorIhEEEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISH_EESI_E4type10value_typeENSA_IXsr21__is_primary_templateINSB_Iu14__remove_cvrefIDTclL_ZNSD_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSJ_ISR_EESS_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISW_EEEvOSE_RKSO_: 160| 162|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 162| ranges::assert_equal_byte_lengths(out, in); 162| 162| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 162] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 162| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 162, False: 0] ------------------ 165| 162| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 162| } 167| 162|} _ZN5Botan11clear_bytesEPvm: 101| 11.5M|inline constexpr void clear_bytes(void* ptr, size_t bytes) { 102| 11.5M| if(bytes > 0) { ------------------ | Branch (102:7): [True: 11.5M, False: 38.5k] ------------------ 103| 11.5M| std::memset(ptr, 0, bytes); 104| 11.5M| } 105| 11.5M|} _ZN5Botan9clear_memImEEvPT_m: 118| 1.53M|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 1.53M| clear_bytes(ptr, sizeof(T) * n); 120| 1.53M|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm8EEETkNS1_16contiguous_rangeENS3_ImLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 1.03M|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 1.03M| ranges::assert_equal_byte_lengths(out, in); 178| 1.03M| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 1.03M|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm8EEETkNS1_16contiguous_rangeENS3_IKmLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 88.3k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 88.3k| ranges::assert_equal_byte_lengths(out, in); 178| 88.3k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 88.3k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm8EEEmQaaaasr3stdE23is_trivially_copyable_vIT0_Entsr3std6rangesE5rangeIS7_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvOSC_RKS7_: 199| 88.3k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromT& in) { 200| 88.3k| typecast_copy(out, std::span(&in, 1)); 201| 88.3k|} _ZN5Botan8copy_memIhQsr3stdE12is_trivial_vIu7__decayIT_EEEEvPS1_PKS1_m: 144| 1.14M|inline constexpr void copy_mem(T* out, const T* in, size_t n) { 145| 1.14M| BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null"); ------------------ | | 110| 1.14M| do { \ | | 111| 1.14M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 112| 2.23M| if((expr1) && !(expr2)) { \ | | ------------------ | | | Branch (112:10): [True: 1.11M, False: 25.5k] | | | Branch (112:23): [True: 1.11M, False: 0] | | | Branch (112:23): [True: 1.11M, False: 0] | | ------------------ | | 113| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 114| 0| Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \ | | 115| 0| } \ | | 116| 1.14M| } while(0) | | ------------------ | | | Branch (116:12): [Folded, False: 1.14M] | | ------------------ ------------------ 146| | 147| 1.14M| if(in != nullptr && out != nullptr && n > 0) { ------------------ | Branch (147:7): [True: 1.14M, False: 38] | Branch (147:24): [True: 1.13M, False: 2.13k] | Branch (147:42): [True: 1.11M, False: 23.3k] ------------------ 148| 1.11M| std::memmove(out, in, sizeof(T) * n); 149| 1.11M| } 150| 1.14M|} _ZN5Botan19secure_scrub_memoryITkNS_6ranges23contiguous_output_rangeERNSt3__16vectorIhNS2_9allocatorIhEEEEEEvOT_: 59| 131k|void secure_scrub_memory(ranges::contiguous_output_range auto&& data) { 60| 131k| secure_scrub_memory(std::ranges::data(data), ranges::size_bytes(data)); 61| 131k|} _ZN5Botan9clear_memIhEEvPT_m: 118| 17.5k|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 17.5k| clear_bytes(ptr, sizeof(T) * n); 120| 17.5k|} _ZN5Botan19secure_scrub_memoryITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm25EEEEEvOT_: 59| 3.71k|void secure_scrub_memory(ranges::contiguous_output_range auto&& data) { 60| 3.71k| secure_scrub_memory(std::ranges::data(data), ranges::size_bytes(data)); 61| 3.71k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanIjLm1EEETkNS1_16contiguous_rangeENS3_IKhLm4EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 7.80k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 7.80k| ranges::assert_equal_byte_lengths(out, in); 178| 7.80k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 7.80k|} _ZN5Botan13typecast_copyIjTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm4EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_: 188| 7.80k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 7.80k| typecast_copy(std::span(&out, 1), in); 190| 7.80k|} _ZN5Botan13typecast_copyIjTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm4EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_: 210| 7.80k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 7.80k| ToT dst; // NOLINT(*-member-init) 212| 7.80k| typecast_copy(dst, src); 213| 7.80k| return dst; 214| 7.80k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_: 210| 180k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 180k| ToT dst; // NOLINT(*-member-init) 212| 180k| typecast_copy(dst, src); 213| 180k| return dst; 214| 180k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_: 188| 180k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 180k| typecast_copy(std::span(&out, 1), in); 190| 180k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IKhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 180k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 180k| ranges::assert_equal_byte_lengths(out, in); 178| 180k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 180k|} _ZN5Botan8copy_memImQsr3stdE12is_trivial_vIu7__decayIT_EEEEvPS1_PKS1_m: 144| 1.71M|inline constexpr void copy_mem(T* out, const T* in, size_t n) { 145| 1.71M| BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null"); ------------------ | | 110| 1.71M| do { \ | | 111| 1.71M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 112| 3.43M| if((expr1) && !(expr2)) { \ | | ------------------ | | | Branch (112:10): [True: 1.71M, False: 0] | | | Branch (112:23): [True: 1.71M, False: 0] | | | Branch (112:23): [True: 1.71M, False: 0] | | ------------------ | | 113| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 114| 0| Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \ | | 115| 0| } \ | | 116| 1.71M| } while(0) | | ------------------ | | | Branch (116:12): [Folded, False: 1.71M] | | ------------------ ------------------ 146| | 147| 1.71M| if(in != nullptr && out != nullptr && n > 0) { ------------------ | Branch (147:7): [True: 1.71M, False: 0] | Branch (147:24): [True: 1.71M, False: 0] | Branch (147:42): [True: 1.71M, False: 0] ------------------ 148| 1.71M| std::memmove(out, in, sizeof(T) * n); 149| 1.71M| } 150| 1.71M|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 27.6k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 27.6k| ranges::assert_equal_byte_lengths(out, in); 162| 27.6k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 27.6k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 27.6k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 27.6k, False: 1] ------------------ 165| 27.6k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 27.6k| } 167| 27.6k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_: 210| 29.5k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 29.5k| ToT dst; // NOLINT(*-member-init) 212| 29.5k| typecast_copy(dst, src); 213| 29.5k| return dst; 214| 29.5k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_: 188| 29.5k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 29.5k| typecast_copy(std::span(&out, 1), in); 190| 29.5k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_: 176| 29.5k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 29.5k| ranges::assert_equal_byte_lengths(out, in); 178| 29.5k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 29.5k|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm18446744073709551615EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS5_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEE: 132| 29.3k|{ 133| 29.3k| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 29.3k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKmLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 9.75k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 9.75k| ranges::assert_equal_byte_lengths(out, in); 162| 9.75k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 9.75k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 9.75k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 9.57k, False: 177] ------------------ 165| 9.57k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 9.57k| } 167| 9.75k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm4EEETkNS1_16contiguous_rangeENS2_5arrayImLm4EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 2.41k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 2.41k| ranges::assert_equal_byte_lengths(out, in); 162| 2.41k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 2.41k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 2.41k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 2.41k, False: 0] ------------------ 165| 2.41k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 2.41k| } 167| 2.41k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm6EEETkNS1_16contiguous_rangeENS2_5arrayImLm6EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 987|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 987| ranges::assert_equal_byte_lengths(out, in); 162| 987| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 987] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 987| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 987, False: 0] ------------------ 165| 987| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 987| } 167| 987|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm8EEETkNS1_16contiguous_rangeENS2_5arrayImLm8EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 541|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 541| ranges::assert_equal_byte_lengths(out, in); 162| 541| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 541] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 541| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 541, False: 0] ------------------ 165| 541| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 541| } 167| 541|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm18EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS6_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEE: 132| 9.97M|{ 133| 9.97M| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 9.97M|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm9EEETkNS1_16contiguous_rangeENS2_5arrayImLm9EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 1.96k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1.96k| ranges::assert_equal_byte_lengths(out, in); 162| 1.96k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1.96k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1.96k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1.96k, False: 0] ------------------ 165| 1.96k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1.96k| } 167| 1.96k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm28EEETkNS1_16contiguous_rangeENS3_IKhLm28EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 1.44k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1.44k| ranges::assert_equal_byte_lengths(out, in); 162| 1.44k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1.44k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1.44k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1.44k, False: 0] ------------------ 165| 1.44k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1.44k| } 167| 1.44k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm66EEETkNS1_16contiguous_rangeENS3_IKhLm66EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 1.00k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1.00k| ranges::assert_equal_byte_lengths(out, in); 162| 1.00k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1.00k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1.00k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1.00k, False: 0] ------------------ 165| 1.00k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1.00k| } 167| 1.00k|} _ZN5Botan9clear_memIjEEvPT_m: 118| 6|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 6| clear_bytes(ptr, sizeof(T) * n); 120| 6|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm2EEEtQaaaasr3stdE23is_trivially_copyable_vIT0_Entsr3std6rangesE5rangeIS7_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvOSC_RKS7_: 199| 70|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromT& in) { 200| 70| typecast_copy(out, std::span(&in, 1)); 201| 70|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm2EEETkNS1_16contiguous_rangeENS3_IKtLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 70|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 70| ranges::assert_equal_byte_lengths(out, in); 178| 70| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 70|} _ZN5Botan13typecast_copyIjTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm4EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_: 210| 94.7k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 94.7k| ToT dst; // NOLINT(*-member-init) 212| 94.7k| typecast_copy(dst, src); 213| 94.7k| return dst; 214| 94.7k|} _ZN5Botan13typecast_copyIjTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm4EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_: 188| 94.7k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 94.7k| typecast_copy(std::span(&out, 1), in); 190| 94.7k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanIjLm1EEETkNS1_16contiguous_rangeENS3_IhLm4EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_: 176| 94.7k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 94.7k| ranges::assert_equal_byte_lengths(out, in); 178| 94.7k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 94.7k|} _ZN5Botan13typecast_copyItTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm2EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_: 210| 2.56k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 2.56k| ToT dst; // NOLINT(*-member-init) 212| 2.56k| typecast_copy(dst, src); 213| 2.56k| return dst; 214| 2.56k|} _ZN5Botan13typecast_copyItTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm2EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_: 188| 2.56k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 2.56k| typecast_copy(std::span(&out, 1), in); 190| 2.56k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanItLm1EEETkNS1_16contiguous_rangeENS3_IhLm2EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_: 176| 2.56k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 2.56k| ranges::assert_equal_byte_lengths(out, in); 178| 2.56k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 2.56k|} _ZN5Botan19secure_scrub_memoryITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm64EEEEEvOT_: 59| 38|void secure_scrub_memory(ranges::contiguous_output_range auto&& data) { 60| 38| secure_scrub_memory(std::ranges::data(data), ranges::size_bytes(data)); 61| 38|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm32EEETkNS1_16contiguous_rangeENS2_4spanIKhLm32EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeENS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISV_EEEvOSD_RKSN_: 160| 12|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 12| ranges::assert_equal_byte_lengths(out, in); 162| 12| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 12] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 12| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 12, False: 0] ------------------ 165| 12| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 12| } 167| 12|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm7EEETkNS1_16contiguous_rangeENS2_4spanIKmLm7EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeENS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISV_EEEvOSD_RKSN_: 160| 16|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 16| ranges::assert_equal_byte_lengths(out, in); 162| 16| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 16] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 16| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 16, False: 0] ------------------ 165| 16| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 16| } 167| 16|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm56EEETkNS1_16contiguous_rangeENS2_5arrayImLm7EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEEEvOSM_RKSC_: 176| 3|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 3| ranges::assert_equal_byte_lengths(out, in); 178| 3| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 3|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm56EEETkNS1_16contiguous_rangeENS2_6vectorIhNS_16secure_allocatorIhEEEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISH_EESI_E4type10value_typeENSA_IXsr21__is_primary_templateINSB_Iu14__remove_cvrefIDTclL_ZNSD_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSJ_ISR_EESS_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISW_EEEvOSE_RKSO_: 160| 1|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1| ranges::assert_equal_byte_lengths(out, in); 162| 1| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1, False: 0] ------------------ 165| 1| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1| } 167| 1|} _ZN5Botan13typecast_copyINS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEETkNS_6ranges16contiguous_rangeENS2_4spanIKhLm18446744073709551615EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vISB_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEESB_RKSG_: 210| 1|inline constexpr ToT typecast_copy(const FromR& src) { 211| 1| ToT dst; // NOLINT(*-member-init) 212| 1| typecast_copy(dst, src); 213| 1| return dst; 214| 1|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEETkNS1_16contiguous_rangeENS3_4spanIKhLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINSC_IXsr21__is_primary_templateINSD_Iu14__remove_cvrefIDTclL_ZNSF_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSL_IST_EESU_E4type10value_typeEEEEvOSQ_RKSG_: 176| 1|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 1| ranges::assert_equal_byte_lengths(out, in); 178| 1| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 1|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIiLm256EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS6_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEE: 132| 452|{ 133| 452| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 452|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__16vectorIiNS2_9allocatorIiEEEETkNS1_16contiguous_rangeES6_Qaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 72|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 72| ranges::assert_equal_byte_lengths(out, in); 162| 72| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 72] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 72| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 72, False: 0] ------------------ 165| 72| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 72| } 167| 72|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIsLm256EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS6_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEE: 132| 144|{ 133| 144| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 144|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm7EEETkNS1_16contiguous_rangeENS2_4spanIKhLm56EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 2|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 2| ranges::assert_equal_byte_lengths(out, in); 178| 2| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 2|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm7EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS6_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEE: 132| 40.5k|{ 133| 40.5k| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 40.5k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm7EEETkNS1_16contiguous_rangeENS2_4spanImLm7EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 8|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 8| ranges::assert_equal_byte_lengths(out, in); 162| 8| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 8] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 8| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 8, False: 0] ------------------ 165| 8| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 8| } 167| 8|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm114EEETkNS1_16contiguous_rangeENS3_IKhLm114EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 2|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 2| ranges::assert_equal_byte_lengths(out, in); 162| 2| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 2] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 2| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 2, False: 0] ------------------ 165| 2| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 2| } 167| 2|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayImLm15EEETkNS1_16contiguous_rangeENS3_IhLm120EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 2|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 2| ranges::assert_equal_byte_lengths(out, in); 178| 2| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 2|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERNSt3__15arrayIhLm2EEETkNS1_16contiguous_rangeENS3_ItLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 3.40k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 3.40k| ranges::assert_equal_byte_lengths(out, in); 178| 3.40k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 3.40k|} _ZN5Botan14Asymmetric_KeyD2Ev: 66| 3.84k| virtual ~Asymmetric_Key() = default; _ZN5Botan15PKCS8_ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 30| 1.90k| explicit PKCS8_Exception(std::string_view error) : Decoding_Error("PKCS #8", error) {} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 29.1k|{ 101| 29.1k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 29.1k| } else { 107| 29.1k| const size_t expected_size = s0.size_bytes(); 108| 29.1k| const bool correct_size = 109| 29.1k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 29.1k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 29.1k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 29.1k| } 115| 29.1k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEEEEmRKT_: 59| 58.6k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 58.6k| return std::span{r}.size_bytes(); 61| 58.6k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS2_6vectorIhNS_16secure_allocatorIhEEEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 162|{ 101| 162| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 162| } else { 107| 162| const size_t expected_size = s0.size_bytes(); 108| 162| const bool correct_size = 109| 162| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 162| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 162] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 162| } 115| 162|} _ZN5Botan6ranges24assert_exact_byte_lengthILm32ETkNS0_14spanable_rangeENSt3__14spanIKhLm32EEEEEvRKT0_: 77| 12|inline constexpr void assert_exact_byte_length(const R& r) { 78| 12| const std::span s{r}; 79| 12| if constexpr(statically_spanable_range) { 80| 12| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 12|} _ZN5Botan6ranges24assert_exact_byte_lengthILm32ETkNS0_14spanable_rangeENSt3__15arrayImLm4EEEEEvRKT0_: 77| 6.01k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 6.01k| const std::span s{r}; 79| 6.01k| if constexpr(statically_spanable_range) { 80| 6.01k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 6.01k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm32EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2.14k|{ 101| 2.14k| const std::span s0{r0}; 102| | 103| 2.14k| if constexpr(statically_spanable_range) { 104| 2.14k| constexpr size_t expected_size = s0.size_bytes(); 105| 2.14k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 2.14k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm8EEETpTkNS0_14spanable_rangeEJNS3_ImLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2.06M|{ 101| 2.06M| const std::span s0{r0}; 102| | 103| 2.06M| if constexpr(statically_spanable_range) { 104| 2.06M| constexpr size_t expected_size = s0.size_bytes(); 105| 2.06M| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 2.06M|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayImLm1EEEEEvRKT0_: 77| 2.06M|inline constexpr void assert_exact_byte_length(const R& r) { 78| 2.06M| const std::span s{r}; 79| 2.06M| if constexpr(statically_spanable_range) { 80| 2.06M| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 2.06M|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEmRKT_: 59| 1.03M|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 1.03M| return std::span{r}.size_bytes(); 61| 1.03M|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEvRKT0_: 77| 167k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 167k| const std::span s{r}; 79| 167k| if constexpr(statically_spanable_range) { 80| 167k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 167k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKmLm1EEEEEvRKT0_: 77| 88.3k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 88.3k| const std::span s{r}; 79| 88.3k| if constexpr(statically_spanable_range) { 80| 88.3k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 88.3k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm8EEETpTkNS0_14spanable_rangeEJNS3_IKmLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 88.3k|{ 101| 88.3k| const std::span s0{r0}; 102| | 103| 88.3k| if constexpr(statically_spanable_range) { 104| 88.3k| constexpr size_t expected_size = s0.size_bytes(); 105| 88.3k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 88.3k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEmRKT_: 59| 88.3k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 88.3k| return std::span{r}.size_bytes(); 61| 88.3k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm4ETkNS0_14spanable_rangeENSt3__14spanIhLm4EEEEEvRKT0_: 77| 94.7k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 94.7k| const std::span s{r}; 79| 94.7k| if constexpr(statically_spanable_range) { 80| 94.7k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 94.7k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__16vectorIhNS2_9allocatorIhEEEEEEmRKT_: 59| 131k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 131k| return std::span{r}.size_bytes(); 61| 131k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayImLm25EEEEEmRKT_: 59| 3.71k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 3.71k| return std::span{r}.size_bytes(); 61| 3.71k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm4ETkNS0_14spanable_rangeENSt3__14spanIKhLm4EEEEEvRKT0_: 77| 15.6k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 15.6k| const std::span s{r}; 79| 15.6k| if constexpr(statically_spanable_range) { 80| 15.6k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 15.6k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIjLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 7.80k|{ 101| 7.80k| const std::span s0{r0}; 102| | 103| 7.80k| if constexpr(statically_spanable_range) { 104| 7.80k| constexpr size_t expected_size = s0.size_bytes(); 105| 7.80k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 7.80k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIjLm1EEEEEmRKT_: 59| 102k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 102k| return std::span{r}.size_bytes(); 61| 102k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKhLm8EEEEEvRKT0_: 77| 360k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 360k| const std::span s{r}; 79| 360k| if constexpr(statically_spanable_range) { 80| 360k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 360k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 180k|{ 101| 180k| const std::span s0{r0}; 102| | 103| 180k| if constexpr(statically_spanable_range) { 104| 180k| constexpr size_t expected_size = s0.size_bytes(); 105| 180k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 180k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm1EEEEEmRKT_: 59| 209k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 209k| return std::span{r}.size_bytes(); 61| 209k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKmLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 38|{ 101| 38| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 38| } else { 107| 38| const size_t expected_size = s0.size_bytes(); 108| 38| const bool correct_size = 109| 38| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 38| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 38] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 38| } 115| 38|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm18446744073709551615EEEEEmRKT_: 59| 48.6k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 48.6k| return std::span{r}.size_bytes(); 61| 48.6k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEvRKT0_: 77| 29.5k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 29.5k| const std::span s{r}; 79| 29.5k| if constexpr(statically_spanable_range) { 80| 29.5k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 29.5k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 29.5k|{ 101| 29.5k| const std::span s0{r0}; 102| | 103| 29.5k| if constexpr(statically_spanable_range) { 104| 29.5k| constexpr size_t expected_size = s0.size_bytes(); 105| 29.5k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 29.5k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKmLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 9.75k|{ 101| 9.75k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 9.75k| } else { 107| 9.75k| const size_t expected_size = s0.size_bytes(); 108| 9.75k| const bool correct_size = 109| 9.75k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 9.75k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 9.75k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 9.75k| } 115| 9.75k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm4EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2.41k|{ 101| 2.41k| const std::span s0{r0}; 102| | 103| 2.41k| if constexpr(statically_spanable_range) { 104| 2.41k| constexpr size_t expected_size = s0.size_bytes(); 105| 2.41k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 2.41k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm4EEEEEmRKT_: 59| 4.83k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 4.83k| return std::span{r}.size_bytes(); 61| 4.83k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm6EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm6EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 987|{ 101| 987| const std::span s0{r0}; 102| | 103| 987| if constexpr(statically_spanable_range) { 104| 987| constexpr size_t expected_size = s0.size_bytes(); 105| 987| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 987|} _ZN5Botan6ranges24assert_exact_byte_lengthILm48ETkNS0_14spanable_rangeENSt3__15arrayImLm6EEEEEvRKT0_: 77| 2.35k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 2.35k| const std::span s{r}; 79| 2.35k| if constexpr(statically_spanable_range) { 80| 2.35k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 2.35k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm6EEEEEmRKT_: 59| 1.97k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 1.97k| return std::span{r}.size_bytes(); 61| 1.97k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__14spanIKhLm56EEEEEvRKT0_: 77| 4|inline constexpr void assert_exact_byte_length(const R& r) { 78| 4| const std::span s{r}; 79| 4| if constexpr(statically_spanable_range) { 80| 4| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 4|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm56EEEEEmRKT_: 59| 5|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 5| return std::span{r}.size_bytes(); 61| 5|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm48EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm6EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.37k|{ 101| 1.37k| const std::span s0{r0}; 102| | 103| 1.37k| if constexpr(statically_spanable_range) { 104| 1.37k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.37k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.37k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm8EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 541|{ 101| 541| const std::span s0{r0}; 102| | 103| 541| if constexpr(statically_spanable_range) { 104| 541| constexpr size_t expected_size = s0.size_bytes(); 105| 541| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 541|} _ZN5Botan6ranges24assert_exact_byte_lengthILm64ETkNS0_14spanable_rangeENSt3__15arrayImLm8EEEEEvRKT0_: 77| 1.08k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1.08k| const std::span s{r}; 79| 1.08k| if constexpr(statically_spanable_range) { 80| 1.08k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 1.08k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm8EEEEEmRKT_: 59| 1.08k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 1.08k| return std::span{r}.size_bytes(); 61| 1.08k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm64EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 540|{ 101| 540| const std::span s0{r0}; 102| | 103| 540| if constexpr(statically_spanable_range) { 104| 540| constexpr size_t expected_size = s0.size_bytes(); 105| 540| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 540|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayImLm18EEEEEmRKT_: 59| 9.97M|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 9.97M| return std::span{r}.size_bytes(); 61| 9.97M|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm9EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm9EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.96k|{ 101| 1.96k| const std::span s0{r0}; 102| | 103| 1.96k| if constexpr(statically_spanable_range) { 104| 1.96k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.96k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.96k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm72ETkNS0_14spanable_rangeENSt3__15arrayImLm9EEEEEvRKT0_: 77| 4.43k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 4.43k| const std::span s{r}; 79| 4.43k| if constexpr(statically_spanable_range) { 80| 4.43k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 4.43k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm9EEEEEmRKT_: 59| 3.93k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 3.93k| return std::span{r}.size_bytes(); 61| 3.93k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm72EEETpTkNS0_14spanable_rangeEJNS3_ImLm9EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2.47k|{ 101| 2.47k| const std::span s0{r0}; 102| | 103| 2.47k| if constexpr(statically_spanable_range) { 104| 2.47k| constexpr size_t expected_size = s0.size_bytes(); 105| 2.47k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 2.47k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm32EEETpTkNS0_14spanable_rangeEJNS3_ImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.44k|{ 101| 1.44k| const std::span s0{r0}; 102| | 103| 1.44k| if constexpr(statically_spanable_range) { 104| 1.44k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.44k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.44k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm28EEETpTkNS0_14spanable_rangeEJNS3_IKhLm28EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.44k|{ 101| 1.44k| const std::span s0{r0}; 102| | 103| 1.44k| if constexpr(statically_spanable_range) { 104| 1.44k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.44k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.44k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm28ETkNS0_14spanable_rangeENSt3__14spanIKhLm28EEEEEvRKT0_: 77| 1.44k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1.44k| const std::span s{r}; 79| 1.44k| if constexpr(statically_spanable_range) { 80| 1.44k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 1.44k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm28EEEEEmRKT_: 59| 2.88k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2.88k| return std::span{r}.size_bytes(); 61| 2.88k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm66EEETpTkNS0_14spanable_rangeEJNS3_IKhLm66EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.00k|{ 101| 1.00k| const std::span s0{r0}; 102| | 103| 1.00k| if constexpr(statically_spanable_range) { 104| 1.00k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.00k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.00k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm66ETkNS0_14spanable_rangeENSt3__14spanIKhLm66EEEEEvRKT0_: 77| 1.00k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1.00k| const std::span s{r}; 79| 1.00k| if constexpr(statically_spanable_range) { 80| 1.00k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 1.00k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm66EEEEEmRKT_: 59| 2.00k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2.00k| return std::span{r}.size_bytes(); 61| 2.00k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm1EEETpTkNS0_14spanable_rangeEJS4_EEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 288|{ 101| 288| const std::span s0{r0}; 102| | 103| 288| if constexpr(statically_spanable_range) { 104| 288| constexpr size_t expected_size = s0.size_bytes(); 105| 288| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 288|} _ZN5Botan6ranges24assert_exact_byte_lengthILm1ETkNS0_14spanable_rangeENSt3__15arrayIhLm1EEEEEvRKT0_: 77| 288|inline constexpr void assert_exact_byte_length(const R& r) { 78| 288| const std::span s{r}; 79| 288| if constexpr(statically_spanable_range) { 80| 288| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 288|} _ZN5Botan6ranges24assert_exact_byte_lengthILm1ETkNS0_14spanable_rangeENSt3__14spanIhLm1EEEEEvRKT0_: 77| 576|inline constexpr void assert_exact_byte_length(const R& r) { 78| 576| const std::span s{r}; 79| 576| if constexpr(statically_spanable_range) { 80| 576| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 576|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanItLm1EEEEEmRKT_: 59| 2.56k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2.56k| return std::span{r}.size_bytes(); 61| 2.56k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm2ETkNS0_14spanable_rangeENSt3__14spanIhLm2EEEEEvRKT0_: 77| 2.70k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 2.70k| const std::span s{r}; 79| 2.70k| if constexpr(statically_spanable_range) { 80| 2.70k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 2.70k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm2EEETpTkNS0_14spanable_rangeEJNS3_IKtLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 70|{ 101| 70| const std::span s0{r0}; 102| | 103| 70| if constexpr(statically_spanable_range) { 104| 70| constexpr size_t expected_size = s0.size_bytes(); 105| 70| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 70|} _ZN5Botan6ranges24assert_exact_byte_lengthILm2ETkNS0_14spanable_rangeENSt3__14spanIKtLm1EEEEEvRKT0_: 77| 70|inline constexpr void assert_exact_byte_length(const R& r) { 78| 70| const std::span s{r}; 79| 70| if constexpr(statically_spanable_range) { 80| 70| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 70|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm2EEEEEmRKT_: 59| 70|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 70| return std::span{r}.size_bytes(); 61| 70|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIjLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 94.7k|{ 101| 94.7k| const std::span s0{r0}; 102| | 103| 94.7k| if constexpr(statically_spanable_range) { 104| 94.7k| constexpr size_t expected_size = s0.size_bytes(); 105| 94.7k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 94.7k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanItLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm2EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2.56k|{ 101| 2.56k| const std::span s0{r0}; 102| | 103| 2.56k| if constexpr(statically_spanable_range) { 104| 2.56k| constexpr size_t expected_size = s0.size_bytes(); 105| 2.56k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 2.56k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm4ETkNS0_14spanable_rangeENSt3__15arrayIhLm4EEEEEvRKT0_: 77| 94.7k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 94.7k| const std::span s{r}; 79| 94.7k| if constexpr(statically_spanable_range) { 80| 94.7k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 94.7k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm2ETkNS0_14spanable_rangeENSt3__15arrayIhLm2EEEEEvRKT0_: 77| 2.56k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 2.56k| const std::span s{r}; 79| 2.56k| if constexpr(statically_spanable_range) { 80| 2.56k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 2.56k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayIhLm64EEEEEmRKT_: 59| 38|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 38| return std::span{r}.size_bytes(); 61| 38|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm32EEETpTkNS0_14spanable_rangeEJNS2_4spanIKhLm32EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 12|{ 101| 12| const std::span s0{r0}; 102| | 103| 12| if constexpr(statically_spanable_range) { 104| 12| constexpr size_t expected_size = s0.size_bytes(); 105| 12| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 12|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayIhLm32EEEEEmRKT_: 59| 24|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 24| return std::span{r}.size_bytes(); 61| 24|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__14spanIKmLm7EEEEEvRKT0_: 77| 16|inline constexpr void assert_exact_byte_length(const R& r) { 78| 16| const std::span s{r}; 79| 16| if constexpr(statically_spanable_range) { 80| 16| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 16|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayImLm7EEETpTkNS0_14spanable_rangeEJNS2_4spanIKmLm7EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 16|{ 101| 16| const std::span s0{r0}; 102| | 103| 16| if constexpr(statically_spanable_range) { 104| 16| constexpr size_t expected_size = s0.size_bytes(); 105| 16| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 16|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayImLm7EEEEEmRKT_: 59| 40.6k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 40.6k| return std::span{r}.size_bytes(); 61| 40.6k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm56EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm7EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 6|{ 101| 6| const std::span s0{r0}; 102| | 103| 6| if constexpr(statically_spanable_range) { 104| 6| constexpr size_t expected_size = s0.size_bytes(); 105| 6| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 6|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__15arrayImLm7EEEEEvRKT0_: 77| 6|inline constexpr void assert_exact_byte_length(const R& r) { 78| 6| const std::span s{r}; 79| 6| if constexpr(statically_spanable_range) { 80| 6| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 6|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm56EEETpTkNS0_14spanable_rangeEJNS2_6vectorIhNS_16secure_allocatorIhEEEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1|{ 101| 1| const std::span s0{r0}; 102| | 103| 1| if constexpr(statically_spanable_range) { 104| 1| constexpr size_t expected_size = s0.size_bytes(); 105| 1| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__16vectorIhNS_16secure_allocatorIhEEEEEEvRKT0_: 77| 1|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1| const std::span s{r}; 79| | if constexpr(statically_spanable_range) { 80| | static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| 1| } else { 82| 1| if(s.size_bytes() != expected) { ------------------ | Branch (82:10): [True: 0, False: 1] ------------------ 83| 0| memory_region_size_violation(); 84| 0| } 85| 1| } 86| 1|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEETpTkNS0_14spanable_rangeEJNS3_4spanIKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1|{ 101| 1| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 1| } else { 107| 1| const size_t expected_size = s0.size_bytes(); 108| 1| const bool correct_size = 109| 1| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 1| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 1] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 1| } 115| 1|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEEEEmRKT_: 59| 1|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 1| return std::span{r}.size_bytes(); 61| 1|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIiLm256EEEEEmRKT_: 59| 452|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 452| return std::span{r}.size_bytes(); 61| 452|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__16vectorIiNS2_9allocatorIiEEEETpTkNS0_14spanable_rangeEJS6_EEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 72|{ 101| 72| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 72| } else { 107| 72| const size_t expected_size = s0.size_bytes(); 108| 72| const bool correct_size = 109| 72| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 72| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 72] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 72| } 115| 72|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__16vectorIiNS2_9allocatorIiEEEEEEmRKT_: 59| 144|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 144| return std::span{r}.size_bytes(); 61| 144|} _ZN5Botan6ranges24assert_exact_byte_lengthILm2ETkNS0_14spanable_rangeENSt3__15arrayItLm1EEEEEvRKT0_: 77| 6.88k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 6.88k| const std::span s{r}; 79| 6.88k| if constexpr(statically_spanable_range) { 80| 6.88k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 6.88k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm2EEETpTkNS0_14spanable_rangeEJNS3_ItLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 6.88k|{ 101| 6.88k| const std::span s0{r0}; 102| | 103| 6.88k| if constexpr(statically_spanable_range) { 104| 6.88k| constexpr size_t expected_size = s0.size_bytes(); 105| 6.88k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 6.88k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIsLm256EEEEEmRKT_: 59| 144|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 144| return std::span{r}.size_bytes(); 61| 144|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayImLm7EEETpTkNS0_14spanable_rangeEJNS2_4spanIKhLm56EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4|{ 101| 4| const std::span s0{r0}; 102| | 103| 4| if constexpr(statically_spanable_range) { 104| 4| constexpr size_t expected_size = s0.size_bytes(); 105| 4| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 4|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayImLm7EEETpTkNS0_14spanable_rangeEJNS2_4spanImLm7EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 8|{ 101| 8| const std::span s0{r0}; 102| | 103| 8| if constexpr(statically_spanable_range) { 104| 8| constexpr size_t expected_size = s0.size_bytes(); 105| 8| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 8|} _ZN5Botan6ranges24assert_exact_byte_lengthILm56ETkNS0_14spanable_rangeENSt3__14spanImLm7EEEEEvRKT0_: 77| 8|inline constexpr void assert_exact_byte_length(const R& r) { 78| 8| const std::span s{r}; 79| 8| if constexpr(statically_spanable_range) { 80| 8| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 8|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm114EEETpTkNS0_14spanable_rangeEJNS3_IKhLm114EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 2|{ 101| 2| const std::span s0{r0}; 102| | 103| 2| if constexpr(statically_spanable_range) { 104| 2| constexpr size_t expected_size = s0.size_bytes(); 105| 2| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 2|} _ZN5Botan6ranges24assert_exact_byte_lengthILm114ETkNS0_14spanable_rangeENSt3__14spanIKhLm114EEEEEvRKT0_: 77| 2|inline constexpr void assert_exact_byte_length(const R& r) { 78| 2| const std::span s{r}; 79| 2| if constexpr(statically_spanable_range) { 80| 2| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 2|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm114EEEEEmRKT_: 59| 4|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 4| return std::span{r}.size_bytes(); 61| 4|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayImLm15EEETpTkNS0_14spanable_rangeEJNS3_IhLm120EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4|{ 101| 4| const std::span s0{r0}; 102| | 103| 4| if constexpr(statically_spanable_range) { 104| 4| constexpr size_t expected_size = s0.size_bytes(); 105| 4| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 4|} _ZN5Botan6ranges24assert_exact_byte_lengthILm120ETkNS0_14spanable_rangeENSt3__15arrayIhLm120EEEEEvRKT0_: 77| 4|inline constexpr void assert_exact_byte_length(const R& r) { 78| 4| const std::span s{r}; 79| 4| if constexpr(statically_spanable_range) { 80| 4| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 4|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayImLm15EEEEEmRKT_: 59| 2|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2| return std::span{r}.size_bytes(); 61| 2|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__15arrayIhLm2EEEEEmRKT_: 59| 3.40k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 3.40k| return std::span{r}.size_bytes(); 61| 3.40k|} _ZNK5Botan8Null_RNG9is_seededEv: 420| 2.62k| bool is_seeded() const override { return false; } _ZN5Botan21RandomNumberGeneratorC2Ev: 57| 2.28k| RandomNumberGenerator() = default; _ZN5Botan13RSA_PublicKeyC2Ev: 86| 59| RSA_PublicKey() = default; _ZN5Botan16secure_allocatorIhE10deallocateEPhm: 102| 109k| void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); } _ZN5Botan16secure_allocatorIhE8allocateEm: 95| 109k| T* allocate(std::size_t n) { return static_cast(allocate_memory(n, sizeof(T))); } _ZN5Botan16secure_allocatorImE10deallocateEPmm: 102| 2.79M| void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); } _ZN5Botan16secure_allocatorImE8allocateEm: 95| 2.79M| T* allocate(std::size_t n) { return static_cast(allocate_memory(n, sizeof(T))); } _ZN5BotanneIhhEEbRKNS_16secure_allocatorIT_EERKNS1_IT0_EE: 123| 15.5k|inline bool operator!=(const secure_allocator& /*a*/, const secure_allocator& /*b*/) { 124| 15.5k| return false; 125| 15.5k|} _ZN5BotanpLIhNS_16secure_allocatorIhEES2_EERNSt3__16vectorIT_T0_EES8_RKNS4_IS5_T1_EE: 168| 1.84k|std::vector& operator+=(std::vector& out, const std::vector& in) { 169| 1.84k| out.insert(out.end(), in.begin(), in.end()); 170| 1.84k| return out; 171| 1.84k|} _ZNK5Botan18Sphincs_Parameters9hash_typeEv: 71| 21| Sphincs_Hash_Type hash_type() const { return m_hash_type; } _ZNK5Botan18Sphincs_Parameters13parameter_setEv: 76| 21| Sphincs_Parameter_Set parameter_set() const { return m_set; } _ZNK5Botan18Sphincs_Parameters1nEv: 96| 16| size_t n() const { return m_n; } _ZNK5Botan18Sphincs_Parameters16public_key_bytesEv: 195| 49| uint32_t public_key_bytes() const { return m_n * 2; } _ZNK5Botan18Sphincs_Parameters17private_key_bytesEv: 200| 33| uint32_t private_key_bytes() const { return m_n * 2 + public_key_bytes(); } _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE4sizeEv: 182| 724| size_type size() const noexcept(noexcept(this->get().size())) { return this->get().size(); } _ZNKR5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE3getEv: 85| 1.21k| constexpr const T& get() const& { return m_value; } _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEED2Ev: 73| 712| ~Strong_Base() = default; _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEED2Ev: 73| 1.19k| ~Strong_Base() = default; _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEE4sizeEv: 182| 1.04k| size_type size() const noexcept(noexcept(this->get().size())) { return this->get().size(); } _ZNKR5Botan6detail11Strong_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEE3getEv: 85| 1.58k| constexpr const T& get() const& { return m_value; } _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2Ev: 57| 52| Strong_Base() = default; _ZN5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2INS2_11__wrap_iterIPKhEEEET_SD_: 145| 52| Container_Strong_Adapter_Base(InputIt begin, InputIt end) : Container_Strong_Adapter_Base(T(begin, end)) {} _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2ES6_: 77| 356| constexpr explicit Strong_Base(T v) : m_value(std::move(v)) {} _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEaSEOS7_: 71| 52| Strong_Base& operator=(Strong_Base&&) noexcept = default; _ZN5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2EmQsr8conceptsE19resizable_containerIT_E: 139| 260| : Container_Strong_Adapter_Base(T(size)) {} _ZNR5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE3getEv: 81| 348| constexpr T& get() & { return m_value; } _ZN5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE3endEv: 158| 44| decltype(auto) end() noexcept(noexcept(this->get().end())) { return this->get().end(); } _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2EOS7_: 63| 304| Strong_Base(Strong_Base&&) noexcept = default; _ZNK5Botan6detail14Strong_AdapterINSt3__16vectorIhNS2_9allocatorIhEEEEE4dataEv: 253| 420| decltype(auto) data() const noexcept(noexcept(this->get().data())) { return this->get().data(); } _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEEC2Ev: 57| 52| Strong_Base() = default; _ZN5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEEC2INS2_11__wrap_iterIPKhEEEET_SD_: 145| 140| Container_Strong_Adapter_Base(InputIt begin, InputIt end) : Container_Strong_Adapter_Base(T(begin, end)) {} _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEEC2ES6_: 77| 405| constexpr explicit Strong_Base(T v) : m_value(std::move(v)) {} _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEEaSEOS7_: 71| 52| Strong_Base& operator=(Strong_Base&&) noexcept = default; _ZNR5Botan6detail11Strong_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEE3getEv: 81| 432| constexpr T& get() & { return m_value; } _ZN5Botan6detail14Strong_AdapterINSt3__16vectorIhNS_16secure_allocatorIhEEEEE4dataEv: 251| 432| decltype(auto) data() noexcept(noexcept(this->get().data())) { return this->get().data(); } _ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEEC2EOS7_: 63| 740| Strong_Base(Strong_Base&&) noexcept = default; _ZN5Botan6detail14Strong_AdapterINSt3__16vectorIhNS2_9allocatorIhEEEEE4dataEv: 251| 260| decltype(auto) data() noexcept(noexcept(this->get().data())) { return this->get().data(); } _ZNK5Botan6detail14Strong_AdapterINSt3__16vectorIhNS_16secure_allocatorIhEEEEE4dataEv: 253| 536| decltype(auto) data() const noexcept(noexcept(this->get().data())) { return this->get().data(); } _ZN5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE5beginEv: 150| 44| decltype(auto) begin() noexcept(noexcept(this->get().begin())) { return this->get().begin(); } _ZN5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS_16secure_allocatorIhEEEEEC2EmQsr8conceptsE19resizable_containerIT_E: 139| 188| : Container_Strong_Adapter_Base(T(size)) {} _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEE5beginEv: 154| 1| decltype(auto) begin() const noexcept(noexcept(this->get().begin())) { return this->get().begin(); } _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEE3endEv: 162| 1| decltype(auto) end() const noexcept(noexcept(this->get().end())) { return this->get().end(); } _ZNK5Botan6detail14Strong_AdapterINSt3__15arrayIhLm56EEEE4dataEv: 253| 2| decltype(auto) data() const noexcept(noexcept(this->get().data())) { return this->get().data(); } _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEE4sizeEv: 182| 2| size_type size() const noexcept(noexcept(this->get().size())) { return this->get().size(); } _ZN5Botan6detail14Strong_AdapterINSt3__15arrayIhLm56EEEE4dataEv: 251| 1| decltype(auto) data() noexcept(noexcept(this->get().data())) { return this->get().data(); } _ZNR5Botan6detail11Strong_BaseINSt3__15arrayIhLm56EEEE3getEv: 81| 3| constexpr T& get() & { return m_value; } _ZN5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEEixIiEEDcOT_: 220| 2| decltype(auto) operator[](U&& i) noexcept(noexcept(this->get().operator[](i))) { 221| 2| return this->get()[std::forward(i)]; 222| 2| } _ZNKR5Botan6detail11Strong_BaseINSt3__15arrayIhLm56EEEE3getEv: 85| 456| constexpr const T& get() const& { return m_value; } _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__15arrayIhLm56EEEEixImEEDcOT_: 212| 448| decltype(auto) operator[](U&& i) const noexcept(noexcept(this->get().operator[](i))) { 213| 448| return this->get()[std::forward(i)]; 214| 448| } _ZN5Botan6detail11Strong_BaseINSt3__15arrayIhLm56EEEEC2ES4_: 77| 1| constexpr explicit Strong_Base(T v) : m_value(std::move(v)) {} _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_29DilithiumSerializedPublicKey_EJEEEE4dataEv: 1057| 72| decltype(auto) data() const noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_29DilithiumSerializedPublicKey_EJEEEE4sizeEv: 1061| 72| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_29DilithiumSerializedPublicKey_EJEEEEC2ERS9_: 999| 72| StrongSpan(T& strong) : m_span(strong) {} _ZNK5Botan6detail29Container_Strong_Adapter_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE5emptyEvQsr8conceptsE9has_emptyIT_E: 188| 72| { 189| 72| return this->get().empty(); 190| 72| } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEC2ERS9_: 999| 144| StrongSpan(T& strong) : m_span(strong) {} _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_22DilithiumSeedRhoPrime_EJEEEEC2ERS9_: 999| 72| StrongSpan(T& strong) : m_span(strong) {} _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEEE4dataEv: 1053| 72| decltype(auto) data() noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEEE4sizeEv: 1061| 72| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEE4dataEv: 1053| 2.63k| decltype(auto) data() noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEE4sizeEv: 1061| 2.63k| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_22DilithiumSeedRhoPrime_EJEEEE4dataEv: 1053| 844| decltype(auto) data() noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_22DilithiumSeedRhoPrime_EJEEEE4sizeEv: 1061| 844| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEEEC2ERS9_: 999| 72| StrongSpan(T& strong) : m_span(strong) {} _ZN5Botan6detail14Strong_AdapterINSt3__16vectorIhNS_16secure_allocatorIhEEEEEC2ENS2_4spanIKhLm18446744073709551615EEE: 241| 77| Strong_Adapter(T(span.begin(), span.end())) {} _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_13KyberSeedRho_EJEEEEC2ERS9_: 999| 44| StrongSpan(T& strong) : m_span(strong) {} _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_25KyberSerializedPublicKey_EJEEEE4dataEv: 1053| 44| decltype(auto) data() noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_25KyberSerializedPublicKey_EJEEEE4sizeEv: 1061| 44| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEEE4sizeEv: 1061| 44| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEEE4dataEv: 1053| 44| decltype(auto) data() noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_13KyberSeedRho_EJEEEE4dataEv: 1053| 114| decltype(auto) data() noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_13KyberSeedRho_EJEEEE4sizeEv: 1061| 158| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZNK5Botan10StrongSpanINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEE4dataEv: 1057| 288| decltype(auto) data() const noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEE4sizeEv: 1061| 288| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_20KyberSeedRandomness_EJEEEE4dataEv: 1057| 44| decltype(auto) data() const noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_20KyberSeedRandomness_EJEEEE4sizeEv: 1061| 44| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEE4dataEv: 1053| 288| decltype(auto) data() noexcept(noexcept(this->m_span.data())) { return this->m_span.data(); } _ZNK5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEE4sizeEv: 1061| 288| decltype(auto) size() const noexcept(noexcept(this->m_span.size())) { return this->m_span.size(); } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_20KyberSeedRandomness_EJEEEEC2ERS9_: 999| 44| StrongSpan(T& strong) : m_span(strong) {} _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15KyberSeedSigma_EJEEEEC2ERS9_: 999| 44| StrongSpan(T& strong) : m_span(strong) {} _ZN5Botan10StrongSpanINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEEC2Ev: 990| 288| StrongSpan() = default; _ZN5Botan10StrongSpanINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEEC2ERS8_: 999| 288| StrongSpan(T& strong) : m_span(strong) {} _ZNK5Botan10StrongSpanINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEE7subspanEmm: 1092| 288| StrongSpan subspan(size_type offset, size_type count = std::dynamic_extent) const { 1093| 288| return StrongSpan(m_span.subspan(offset, count)); 1094| 288| } _ZN5Botan10StrongSpanINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEEC2ENS2_4spanIhLm18446744073709551615EEE: 994| 288| explicit StrongSpan(underlying_span span) : m_span(span) {} _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEEC2ITkNS_8concepts22contiguous_strong_typeES8_EERKNS0_IT_EEQsr3stdE9is_same_vITL0__u14__remove_constISD_EE: 1017| 288| : m_span(other.get()) {} _ZNK5Botan10StrongSpanINS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEE3getEv: 1043| 288| underlying_span get() const { return m_span; } _ZN5Botan10StrongSpanIKNS_6StrongINSt3__16vectorIhNS2_9allocatorIhEEEENS_25KyberSerializedPublicKey_EJEEEEC2ERS9_: 999| 44| StrongSpan(T& strong) : m_span(strong) {} _ZN5Botan18unwrap_strong_typeIRNSt3__16vectorIhNS1_9allocatorIhEEEEEEDcOT_: 119| 9.74k|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 120| 9.74k| if constexpr(!concepts::strong_type>) { 121| | // If the parameter type isn't a strong type, return it as is. 122| 9.74k| return std::forward(t); 123| | } else { 124| | // Unwrap the strong type and return the underlying value. 125| | return std::forward(t).get(); 126| | } 127| 9.74k|} _ZN5Botan18unwrap_strong_typeIRNSt3__16vectorIhNS_16secure_allocatorIhEEEEEEDcOT_: 119| 26.1k|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 120| 26.1k| if constexpr(!concepts::strong_type>) { 121| | // If the parameter type isn't a strong type, return it as is. 122| 26.1k| return std::forward(t); 123| | } else { 124| | // Unwrap the strong type and return the underlying value. 125| | return std::forward(t).get(); 126| | } 127| 26.1k|} _ZN5Botan18unwrap_strong_typeIRmEEDcOT_: 119| 88.3k|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 120| 88.3k| if constexpr(!concepts::strong_type>) { 121| | // If the parameter type isn't a strong type, return it as is. 122| 88.3k| return std::forward(t); 123| | } else { 124| | // Unwrap the strong type and return the underlying value. 125| | return std::forward(t).get(); 126| | } 127| 88.3k|} _ZN5Botan16wrap_strong_typeIjRjQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_: 144| 102k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) { 145| 102k| if constexpr(std::same_as, T>) { 146| | // Noop, if the parameter type already is the desired return type. 147| 102k| return std::forward(t); 148| | } else if constexpr(std::constructible_from) { 149| | // Implicit conversion from the parameter type to the return type. 150| | return T{std::forward(t)}; 151| | } else { 152| | // Explicitly calling the wrapped type's constructor to support 153| | // implicit conversions on types that mark their constructors as explicit. 154| | static_assert(concepts::strong_type && std::constructible_from); 155| | return T{typename T::wrapped_type{std::forward(t)}}; 156| | } 157| 102k|} _ZN5Botan16wrap_strong_typeImRmQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_: 144| 209k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) { 145| 209k| if constexpr(std::same_as, T>) { 146| | // Noop, if the parameter type already is the desired return type. 147| 209k| return std::forward(t); 148| | } else if constexpr(std::constructible_from) { 149| | // Implicit conversion from the parameter type to the return type. 150| | return T{std::forward(t)}; 151| | } else { 152| | // Explicitly calling the wrapped type's constructor to support 153| | // implicit conversions on types that mark their constructors as explicit. 154| | static_assert(concepts::strong_type && std::constructible_from); 155| | return T{typename T::wrapped_type{std::forward(t)}}; 156| | } 157| 209k|} _ZN5Botan18unwrap_strong_typeIRhEEDcOT_: 119| 288|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 120| 288| if constexpr(!concepts::strong_type>) { 121| | // If the parameter type isn't a strong type, return it as is. 122| 288| return std::forward(t); 123| | } else { 124| | // Unwrap the strong type and return the underlying value. 125| | return std::forward(t).get(); 126| | } 127| 288|} _ZN5Botan16wrap_strong_typeItRtQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_: 144| 2.56k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) { 145| 2.56k| if constexpr(std::same_as, T>) { 146| | // Noop, if the parameter type already is the desired return type. 147| 2.56k| return std::forward(t); 148| | } else if constexpr(std::constructible_from) { 149| | // Implicit conversion from the parameter type to the return type. 150| | return T{std::forward(t)}; 151| | } else { 152| | // Explicitly calling the wrapped type's constructor to support 153| | // implicit conversions on types that mark their constructors as explicit. 154| | static_assert(concepts::strong_type && std::constructible_from); 155| | return T{typename T::wrapped_type{std::forward(t)}}; 156| | } 157| 2.56k|} _ZN5Botan18unwrap_strong_typeIRtEEDcOT_: 119| 70|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 120| 70| if constexpr(!concepts::strong_type>) { 121| | // If the parameter type isn't a strong type, return it as is. 122| 70| return std::forward(t); 123| | } else { 124| | // Unwrap the strong type and return the underlying value. 125| | return std::forward(t).get(); 126| | } 127| 70|} _ZN5Botan18unwrap_strong_typeIRNSt3__16vectorIPNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS3_6DomainE0EEENS1_9allocatorIS8_EEEEEEDcOT_: 119| 88|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 120| 88| if constexpr(!concepts::strong_type>) { 121| | // If the parameter type isn't a strong type, return it as is. 122| 88| return std::forward(t); 123| | } else { 124| | // Unwrap the strong type and return the underlying value. 125| | return std::forward(t).get(); 126| | } 127| 88|} _ZN5Botan24Key_Length_SpecificationC2Em: 28| 3.91k| explicit Key_Length_Specification(size_t keylen) : m_min_keylen(keylen), m_max_keylen(keylen), m_keylen_mod(1) {} _ZNK5Botan24Key_Length_Specification15valid_keylengthEm: 44| 3.91k| bool valid_keylength(size_t length) const { 45| 3.91k| return ((length >= m_min_keylen) && (length <= m_max_keylen) && (length % m_keylen_mod == 0)); ------------------ | Branch (45:18): [True: 3.91k, False: 0] | Branch (45:46): [True: 3.91k, False: 0] | Branch (45:74): [True: 3.91k, False: 0] ------------------ 46| 3.91k| } _ZN5Botan13Work_ExecutorC2Ev: 37| 1| Work_Executor() = default; _ZN5Botan13Work_ExecutorD2Ev: 38| 1| virtual ~Work_Executor() = default; _ZN5Botan16X25519_PublicKeyC2Ev: 57| 16| X25519_PublicKey() = default; _ZN5Botan14X448_PublicKeyC2Ev: 62| 1| X448_PublicKey() = default; _ZN5Botan3XOF5clearEv: 66| 358| void clear() { 67| 358| m_xof_started = false; 68| 358| reset(); 69| 358| } _ZN5Botan3XOF6updateENSt3__14spanIKhLm18446744073709551615EEE: 147| 7.75k| void update(std::span input) { 148| 7.75k| if(!m_xof_started) { ------------------ | Branch (148:13): [True: 3.91k, False: 3.83k] ------------------ 149| | // If the user didn't start() before the first input, we enforce 150| | // it with a default value, here. 151| 3.91k| start(); 152| 3.91k| } 153| 7.75k| add_data(input); 154| 7.75k| } _ZN5Botan3XOF6outputENSt3__14spanIhLm18446744073709551615EEE: 191| 290| void output(std::span output) { generate_output(output); } _ZN5Botan3XOF15generate_outputENSt3__14spanIhLm18446744073709551615EEE: 204| 823k| void generate_output(std::span output) { 205| 823k| if(!m_xof_started) { ------------------ | Branch (205:13): [True: 0, False: 823k] ------------------ 206| | // As in update(), enforce start() with a default value 207| 0| start(); 208| 0| } 209| 823k| generate_bytes(output); 210| 823k| } _ZN5Botan3XOFD2Ev: 31| 3.63k| virtual ~XOF() = default; _ZNK5Botan3XOF8key_specEv: 102| 3.91k| virtual Key_Length_Specification key_spec() const { 103| | // Keys are not supported by default 104| 3.91k| return Key_Length_Specification(0); 105| 3.91k| } _ZNK5Botan3XOF17valid_salt_lengthEm: 93| 3.91k| virtual bool valid_salt_length(size_t salt_len) const { 94| | // Salts are not supported by default 95| 3.91k| return salt_len == 0; 96| 3.91k| } _ZN5Botan3XOF6outputITkNS_8concepts21resizable_byte_bufferENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_25DilithiumHashedPublicKey_EJEEEEET_m: 161| 72| T output(size_t bytes) { 162| 72| T out(bytes); 163| 72| generate_output(out); 164| 72| return out; 165| 72| } _ZN5Botan3XOF6outputITkNS_8concepts21resizable_byte_bufferENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEET_m: 161| 72| T output(size_t bytes) { 162| 72| T out(bytes); 163| 72| generate_output(out); 164| 72| return out; 165| 72| } _ZN5Botan3XOF6outputITkNS_8concepts21resizable_byte_bufferENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_22DilithiumSeedRhoPrime_EJEEEEET_m: 161| 72| T output(size_t bytes) { 162| 72| T out(bytes); 163| 72| generate_output(out); 164| 72| return out; 165| 72| } _ZN5Botan3XOF6outputITkNS_8concepts21resizable_byte_bufferENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_15DilithiumSeedK_EJEEEEET_m: 161| 72| T output(size_t bytes) { 162| 72| T out(bytes); 163| 72| generate_output(out); 164| 72| return out; 165| 72| } _ZN5Botan3XOF6outputILm1EEENSt3__15arrayIhXT_EEEv: 172| 153k| std::array output() { 173| 153k| std::array out; // NOLINT(*-member-init) 174| 153k| generate_output(out); 175| 153k| return out; 176| 153k| } _ZN5Botan3XOF6outputILm3EEENSt3__15arrayIhXT_EEEv: 172| 669k| std::array output() { 173| 669k| std::array out; // NOLINT(*-member-init) 174| 669k| generate_output(out); 175| 669k| return out; 176| 669k| } LLVMFuzzerInitialize: 28| 2|extern "C" int LLVMFuzzerInitialize(int* /*argc*/, char*** /*argv*/) { 29| | /* 30| | * This disables the mlock pool, as overwrites within the pool are 31| | * opaque to ASan or other instrumentation. 32| | */ 33| 2| ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1); 34| 2| return 0; 35| 2|} LLVMFuzzerTestOneInput: 39| 7.00k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) { 40| 7.00k| if(len <= max_fuzzer_input_size) { ------------------ | Branch (40:7): [True: 7.00k, False: 1] ------------------ 41| 7.00k| try { 42| 7.00k| fuzz(std::span(in, len)); 43| 7.00k| } catch(const std::exception& e) { 44| 0| std::cerr << "Uncaught exception from fuzzer driver " << e.what() << "\n"; 45| 0| abort(); 46| 0| } catch(...) { 47| 0| std::cerr << "Uncaught exception from fuzzer driver (unknown type)\n"; 48| 0| abort(); 49| 0| } 50| 7.00k| } 51| 7.00k| return 0; 52| 7.00k|} _Z4fuzzNSt3__14spanIKhLm18446744073709551615EEE: 14| 7.00k|void fuzz(std::span in) { 15| 7.00k| try { 16| 7.00k| Botan::DataSource_Memory input(in); 17| 7.00k| Botan::PKCS8::load_key(input); 18| 7.00k| } catch(const Botan::Exception& e) {} 19| | 20| | /* 21| | * This avoids OOMs in OSS-Fuzz caused by storing precomputations 22| | * for thousands of curves randomly generated by the fuzzer. 23| | * 24| | * TODO(Botan4) we can remove this call once support for explicit curves 25| | * is removed 26| | */ 27| 7.00k| Botan::EC_Group::clear_registered_curve_data(); 28| 7.00k|} _ZNK5Botan19AlgorithmIdentifier19parameters_are_nullEv: 50| 3.84k|bool AlgorithmIdentifier::parameters_are_null() const { 51| 3.84k| return (m_parameters.size() == 2 && (m_parameters[0] == 0x05) && (m_parameters[1] == 0x00)); ------------------ | Branch (51:12): [True: 92, False: 3.74k] | Branch (51:40): [True: 16, False: 76] | Branch (51:69): [True: 15, False: 1] ------------------ 52| 3.84k|} _ZN5Botan19AlgorithmIdentifier11decode_fromERNS_11BER_DecoderE: 72| 6.10k|void AlgorithmIdentifier::decode_from(BER_Decoder& codec) { 73| 6.10k| codec.start_sequence().decode(m_oid).raw_bytes(m_parameters).end_cons(); 74| | 75| | /* 76| | * The parameters field is OPTIONAL ANY but in practice it is one of 77| | * - empty 78| | * - NULL 79| | * - SEQUENCE 80| | * - OBJECT IDENTIFIER (namedCurve) 81| | * - OCTET STRING (CBC IV in PBES2) 82| | * 83| | * So require it be exactly one of these values. In particular this ensures that 84| | * there is not any additional trailing data (eg after the SEQUENCE encoding) 85| | * that might be otherwise skipped over by a reader. 86| | */ 87| | 88| 6.10k| const bool acceptable_parameters = [&]() { 89| 6.10k| if(this->parameters_are_null_or_empty()) { 90| 6.10k| return true; 91| 6.10k| } 92| 6.10k| if(ASN1::is_der_sequence_header(m_parameters)) { 93| 6.10k| return true; 94| 6.10k| } 95| 6.10k| if(ASN1::is_single_der_object(m_parameters, ASN1_Type::ObjectId, ASN1_Class::Universal)) { 96| 6.10k| return true; 97| 6.10k| } 98| 6.10k| if(ASN1::is_single_der_object(m_parameters, ASN1_Type::OctetString, ASN1_Class::Universal)) { 99| 6.10k| return true; 100| 6.10k| } 101| 6.10k| return false; 102| 6.10k| }(); 103| | 104| 6.10k| if(!acceptable_parameters) { ------------------ | Branch (104:7): [True: 149, False: 5.95k] ------------------ 105| 149| throw Decoding_Error("AlgorithmIdentifier parameters were not NULL, a SEQUENCE, an OID, or an OCTET STRING"); 106| 149| } 107| 6.10k|} alg_id.cpp:_ZZN5Botan19AlgorithmIdentifier11decode_fromERNS_11BER_DecoderEENK3$_0clEv: 88| 5.99k| const bool acceptable_parameters = [&]() { 89| 5.99k| if(this->parameters_are_null_or_empty()) { ------------------ | Branch (89:10): [True: 2.17k, False: 3.82k] ------------------ 90| 2.17k| return true; 91| 2.17k| } 92| 3.82k| if(ASN1::is_der_sequence_header(m_parameters)) { ------------------ | Branch (92:10): [True: 1.29k, False: 2.52k] ------------------ 93| 1.29k| return true; 94| 1.29k| } 95| 2.52k| if(ASN1::is_single_der_object(m_parameters, ASN1_Type::ObjectId, ASN1_Class::Universal)) { ------------------ | Branch (95:10): [True: 2.34k, False: 183] ------------------ 96| 2.34k| return true; 97| 2.34k| } 98| 183| if(ASN1::is_single_der_object(m_parameters, ASN1_Type::OctetString, ASN1_Class::Universal)) { ------------------ | Branch (98:10): [True: 34, False: 149] ------------------ 99| 34| return true; 100| 34| } 101| 149| return false; 102| 183| }(); _ZN5Botan14ASN1_BitStringC2ENSt3__16vectorIhNS1_9allocatorIhEEEEm: 29| 950| m_bytes(std::move(bytes)), m_unused_bits(unused_bits) { 30| 950| if(m_unused_bits >= 8) { ------------------ | Branch (30:7): [True: 0, False: 950] ------------------ 31| 0| throw Invalid_Argument("ASN1_BitString: Invalid unused bit count"); 32| 0| } 33| | 34| 950| if(m_bytes.empty() && m_unused_bits != 0) { ------------------ | Branch (34:7): [True: 1, False: 949] | Branch (34:26): [True: 0, False: 1] ------------------ 35| 0| throw Invalid_Argument("ASN1_BitString: Empty BIT STRING cannot have unused bits"); 36| 0| } 37| | 38| 950| if(m_unused_bits > 0 && (m_bytes.back() & ((1U << m_unused_bits) - 1)) != 0) { ------------------ | Branch (38:7): [True: 5, False: 945] | Branch (38:28): [True: 0, False: 5] ------------------ 39| 0| throw Invalid_Argument("ASN1_BitString: Unused bits must be zero"); 40| 0| } 41| 950|} _ZN5Botan10BER_ObjectD2Ev: 58| 131k|BER_Object::~BER_Object() { 59| 131k| secure_scrub_memory(m_value); 60| 131k|} _ZNK5Botan10BER_Object11assert_is_aENS_9ASN1_TypeENS_10ASN1_ClassENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE: 65| 47.5k|void BER_Object::assert_is_a(ASN1_Type expected_type_tag, ASN1_Class expected_class_tag, std::string_view descr) const { 66| 47.5k| if(!this->is_a(expected_type_tag, expected_class_tag)) { ------------------ | Branch (66:7): [True: 244, False: 47.2k] ------------------ 67| 244| std::stringstream msg; 68| | 69| 244| msg << "Tag mismatch when decoding " << descr << " got "; 70| | 71| 244| if(m_class_tag == ASN1_Class::NoObject && m_type_tag == ASN1_Type::NoObject) { ------------------ | Branch (71:10): [True: 63, False: 181] | Branch (71:49): [True: 63, False: 0] ------------------ 72| 63| msg << "EOF"; 73| 181| } else { 74| 181| if(m_class_tag == ASN1_Class::Universal || m_class_tag == ASN1_Class::Constructed) { ------------------ | Branch (74:13): [True: 81, False: 100] | Branch (74:53): [True: 69, False: 31] ------------------ 75| 150| msg << asn1_tag_to_string(m_type_tag); 76| 150| } else { 77| 31| msg << std::to_string(static_cast(m_type_tag)); 78| 31| } 79| | 80| 181| msg << "/" << asn1_class_to_string(m_class_tag); 81| 181| } 82| | 83| 244| msg << " expected "; 84| | 85| 244| if(expected_class_tag == ASN1_Class::Universal || expected_class_tag == ASN1_Class::Constructed) { ------------------ | Branch (85:10): [True: 192, False: 52] | Branch (85:57): [True: 52, False: 0] ------------------ 86| 244| msg << asn1_tag_to_string(expected_type_tag); 87| 244| } else { 88| 0| msg << std::to_string(static_cast(expected_type_tag)); 89| 0| } 90| | 91| 244| msg << "/" << asn1_class_to_string(expected_class_tag); 92| | 93| 244| throw BER_Decoding_Error(msg.str()); 94| 244| } 95| 47.5k|} _ZNK5Botan10BER_Object4is_aENS_9ASN1_TypeENS_10ASN1_ClassE: 97| 54.8k|bool BER_Object::is_a(ASN1_Type expected_type_tag, ASN1_Class expected_class_tag) const { 98| 54.8k| return (m_type_tag == expected_type_tag && m_class_tag == expected_class_tag); ------------------ | Branch (98:12): [True: 49.1k, False: 5.67k] | Branch (98:47): [True: 49.1k, False: 13] ------------------ 99| 54.8k|} _ZN5Botan10BER_Object11set_taggingENS_9ASN1_TypeENS_10ASN1_ClassE: 105| 62.5k|void BER_Object::set_tagging(ASN1_Type type_tag, ASN1_Class class_tag) { 106| 62.5k| m_type_tag = type_tag; 107| 62.5k| m_class_tag = class_tag; 108| 62.5k|} _ZN5Botan20asn1_class_to_stringENS_10ASN1_ClassE: 110| 425|std::string asn1_class_to_string(ASN1_Class type) { 111| 425| switch(type) { 112| 273| case ASN1_Class::Universal: ------------------ | Branch (112:7): [True: 273, False: 152] ------------------ 113| 273| return "UNIVERSAL"; 114| 121| case ASN1_Class::Constructed: ------------------ | Branch (114:7): [True: 121, False: 304] ------------------ 115| 121| return "CONSTRUCTED"; 116| 6| case ASN1_Class::ContextSpecific: ------------------ | Branch (116:7): [True: 6, False: 419] ------------------ 117| 6| return "CONTEXT_SPECIFIC"; 118| 5| case ASN1_Class::Application: ------------------ | Branch (118:7): [True: 5, False: 420] ------------------ 119| 5| return "APPLICATION"; 120| 4| case ASN1_Class::Private: ------------------ | Branch (120:7): [True: 4, False: 421] ------------------ 121| 4| return "PRIVATE"; 122| 0| case ASN1_Class::NoObject: ------------------ | Branch (122:7): [True: 0, False: 425] ------------------ 123| 0| return "NO_OBJECT"; 124| 16| default: ------------------ | Branch (124:7): [True: 16, False: 409] ------------------ 125| 16| return "CLASS(" + std::to_string(static_cast(type)) + ")"; 126| 425| } 127| 425|} _ZN5Botan18asn1_tag_to_stringENS_9ASN1_TypeE: 129| 395|std::string asn1_tag_to_string(ASN1_Type type) { 130| 395| switch(type) { 131| 48| case ASN1_Type::Sequence: ------------------ | Branch (131:7): [True: 48, False: 347] ------------------ 132| 48| return "SEQUENCE"; 133| | 134| 3| case ASN1_Type::Set: ------------------ | Branch (134:7): [True: 3, False: 392] ------------------ 135| 3| return "SET"; 136| | 137| 2| case ASN1_Type::PrintableString: ------------------ | Branch (137:7): [True: 2, False: 393] ------------------ 138| 2| return "PRINTABLE STRING"; 139| | 140| 1| case ASN1_Type::NumericString: ------------------ | Branch (140:7): [True: 1, False: 394] ------------------ 141| 1| return "NUMERIC STRING"; 142| | 143| 1| case ASN1_Type::Ia5String: ------------------ | Branch (143:7): [True: 1, False: 394] ------------------ 144| 1| return "IA5 STRING"; 145| | 146| 2| case ASN1_Type::TeletexString: ------------------ | Branch (146:7): [True: 2, False: 393] ------------------ 147| 2| return "T61 STRING"; 148| | 149| 1| case ASN1_Type::Utf8String: ------------------ | Branch (149:7): [True: 1, False: 394] ------------------ 150| 1| return "UTF8 STRING"; 151| | 152| 1| case ASN1_Type::VisibleString: ------------------ | Branch (152:7): [True: 1, False: 394] ------------------ 153| 1| return "VISIBLE STRING"; 154| | 155| 1| case ASN1_Type::BmpString: ------------------ | Branch (155:7): [True: 1, False: 394] ------------------ 156| 1| return "BMP STRING"; 157| | 158| 1| case ASN1_Type::UniversalString: ------------------ | Branch (158:7): [True: 1, False: 394] ------------------ 159| 1| return "UNIVERSAL STRING"; 160| | 161| 2| case ASN1_Type::UtcTime: ------------------ | Branch (161:7): [True: 2, False: 393] ------------------ 162| 2| return "UTC TIME"; 163| | 164| 3| case ASN1_Type::GeneralizedTime: ------------------ | Branch (164:7): [True: 3, False: 392] ------------------ 165| 3| return "GENERALIZED TIME"; 166| | 167| 35| case ASN1_Type::OctetString: ------------------ | Branch (167:7): [True: 35, False: 360] ------------------ 168| 35| return "OCTET STRING"; 169| | 170| 3| case ASN1_Type::BitString: ------------------ | Branch (170:7): [True: 3, False: 392] ------------------ 171| 3| return "BIT STRING"; 172| | 173| 5| case ASN1_Type::Enumerated: ------------------ | Branch (173:7): [True: 5, False: 390] ------------------ 174| 5| return "ENUMERATED"; 175| | 176| 171| case ASN1_Type::Integer: ------------------ | Branch (176:7): [True: 171, False: 224] ------------------ 177| 171| return "INTEGER"; 178| | 179| 1| case ASN1_Type::Null: ------------------ | Branch (179:7): [True: 1, False: 394] ------------------ 180| 1| return "NULL"; 181| | 182| 1| case ASN1_Type::ObjectId: ------------------ | Branch (182:7): [True: 1, False: 394] ------------------ 183| 1| return "OBJECT"; 184| | 185| 2| case ASN1_Type::Boolean: ------------------ | Branch (185:7): [True: 2, False: 393] ------------------ 186| 2| return "BOOLEAN"; 187| | 188| 0| case ASN1_Type::NoObject: ------------------ | Branch (188:7): [True: 0, False: 395] ------------------ 189| 0| return "NO_OBJECT"; 190| | 191| 111| default: ------------------ | Branch (191:7): [True: 111, False: 284] ------------------ 192| 111| return "TAG(" + std::to_string(static_cast(type)) + ")"; 193| 395| } 194| 395|} _ZN5Botan18BER_Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 199| 876|BER_Decoding_Error::BER_Decoding_Error(std::string_view err) : Decoding_Error(fmt("BER: {}", err)) {} _ZN5Botan11BER_Bad_TagC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEj: 201| 53|BER_Bad_Tag::BER_Bad_Tag(std::string_view str, uint32_t tagging) : BER_Decoding_Error(fmt("{}: {}", str, tagging)) {} _ZN5Botan4ASN19maybe_BERERNS_10DataSourceE: 231| 7.00k|bool maybe_BER(DataSource& source) { 232| 7.00k| uint8_t first_u8 = 0; 233| 7.00k| if(source.peek_byte(first_u8) == 0) { ------------------ | Branch (233:7): [True: 0, False: 7.00k] ------------------ 234| 0| BOTAN_ASSERT_EQUAL(source.read_byte(first_u8), 0, "Expected EOF"); ------------------ | | 97| 0| do { \ | | 98| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 99| 0| if((expr1) != (expr2)) { \ | | ------------------ | | | Branch (99:10): [True: 0, False: 0] | | ------------------ | | 100| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 101| 0| Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \ | | 102| 0| } \ | | 103| 0| } while(0) | | ------------------ | | | Branch (103:12): [Folded, False: 0] | | ------------------ ------------------ 235| 0| throw Stream_IO_Error("ASN1::maybe_BER: Source was empty"); 236| 0| } 237| | 238| 7.00k| const auto cons_seq = static_cast(ASN1_Class::Constructed) | static_cast(ASN1_Type::Sequence); 239| 7.00k| return first_u8 == cons_seq; 240| 7.00k|} _ZN5Botan3OID11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 80| 2.53k|OID OID::from_string(std::string_view str) { 81| 2.53k| if(str.empty()) { ------------------ | Branch (81:7): [True: 0, False: 2.53k] ------------------ 82| 0| throw Invalid_Argument("OID::from_string argument must be non-empty"); 83| 0| } 84| | 85| 2.53k| OID o = OID_Map::global_registry().str2oid(str); 86| 2.53k| if(o.has_value()) { ------------------ | Branch (86:7): [True: 2.53k, False: 0] ------------------ 87| 2.53k| return o; 88| 2.53k| } 89| | 90| | // Try to parse as a dotted decimal 91| 0| try { 92| 0| return OID(str); 93| 0| } catch(...) {} 94| | 95| 0| throw Lookup_Error(fmt("No OID associated with name '{}'", str)); 96| 0|} _ZN5Botan3OIDC2ESt16initializer_listIjE: 98| 36.2k|OID::OID(std::initializer_list init) : m_id(init) { 99| 36.2k| oid_valid_check(m_id); 100| 36.2k|} _ZNK5Botan3OID9to_stringEv: 123| 1.95k|std::string OID::to_string() const { 124| 1.95k| std::ostringstream out; 125| | 126| 20.8k| for(size_t i = 0; i != m_id.size(); ++i) { ------------------ | Branch (126:22): [True: 18.9k, False: 1.95k] ------------------ 127| | // avoid locale issues with integer formatting 128| 18.9k| out << std::to_string(m_id[i]); 129| 18.9k| if(i != m_id.size() - 1) { ------------------ | Branch (129:10): [True: 16.9k, False: 1.95k] ------------------ 130| 16.9k| out << "."; 131| 16.9k| } 132| 18.9k| } 133| | 134| 1.95k| return out.str(); 135| 1.95k|} _ZNK5Botan3OID15registered_nameEv: 149| 12.3k|std::optional OID::registered_name() const { 150| 12.3k| return OID_Map::global_registry().oid2str(*this); 151| 12.3k|} _ZNK5Botan3OID7matchesESt16initializer_listIjE: 157| 10.9k|bool OID::matches(std::initializer_list other) const { 158| | // TODO: once all target compilers support it, use std::ranges::equal 159| 10.9k| return std::equal(m_id.begin(), m_id.end(), other.begin(), other.end()); 160| 10.9k|} _ZNK5Botan3OID9hash_codeEv: 162| 14.2k|uint64_t OID::hash_code() const { 163| | // If this is changed also update gen_oids.py to match 164| 14.2k| uint64_t hash = 0x621F302327D9A49A; 165| 96.1k| for(const auto id : m_id) { ------------------ | Branch (165:22): [True: 96.1k, False: 14.2k] ------------------ 166| 96.1k| hash *= 193; 167| 96.1k| hash += id; 168| 96.1k| } 169| 14.2k| return hash; 170| 14.2k|} _ZNK5Botan3OID11encode_intoERNS_11DER_EncoderE: 185| 2.43k|void OID::encode_into(DER_Encoder& der) const { 186| 2.43k| if(m_id.size() < 2) { ------------------ | Branch (186:7): [True: 0, False: 2.43k] ------------------ 187| 0| throw Invalid_Argument("OID::encode_into: OID is invalid"); 188| 0| } 189| | 190| 2.43k| const auto append = [](std::vector& encoding, uint32_t z) { 191| 2.43k| if(z <= 0x7F) { 192| 2.43k| encoding.push_back(static_cast(z)); 193| 2.43k| } else { 194| 2.43k| const size_t z7 = (high_bit(z) + 7 - 1) / 7; 195| | 196| 2.43k| for(size_t j = 0; j != z7; ++j) { 197| 2.43k| uint8_t zp = static_cast(z >> (7 * (z7 - j - 1)) & 0x7F); 198| | 199| 2.43k| if(j != z7 - 1) { 200| 2.43k| zp |= 0x80; 201| 2.43k| } 202| | 203| 2.43k| encoding.push_back(zp); 204| 2.43k| } 205| 2.43k| } 206| 2.43k| }; 207| | 208| 2.43k| std::vector encoding; 209| | 210| | // We know 40 * root can't overflow because root is between 0 and 2 211| 2.43k| auto first = checked_add(40 * m_id[0], m_id[1]); 212| 2.43k| BOTAN_ASSERT_NOMSG(first.has_value()); ------------------ | | 84| 2.43k| do { \ | | 85| 2.43k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 2.43k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 2.43k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 2.43k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 2.43k] | | ------------------ ------------------ 213| | 214| 2.43k| append(encoding, *first); 215| | 216| 13.5k| for(size_t i = 2; i != m_id.size(); ++i) { ------------------ | Branch (216:22): [True: 11.0k, False: 2.43k] ------------------ 217| 11.0k| append(encoding, m_id[i]); 218| 11.0k| } 219| 2.43k| der.add_object(ASN1_Type::ObjectId, ASN1_Class::Universal, encoding); 220| 2.43k|} _ZN5Botan3OID11decode_fromERNS_11BER_DecoderE: 225| 9.24k|void OID::decode_from(BER_Decoder& decoder) { 226| 9.24k| const BER_Object obj = decoder.get_next_object(); 227| 9.24k| if(obj.tagging() != (ASN1_Class::Universal | ASN1_Type::ObjectId)) { ------------------ | Branch (227:7): [True: 53, False: 9.19k] ------------------ 228| 53| throw BER_Bad_Tag("Error decoding OID, unknown tag", obj.tagging()); 229| 53| } 230| | 231| 9.19k| if(obj.length() == 0) { ------------------ | Branch (231:7): [True: 1, False: 9.19k] ------------------ 232| 1| throw BER_Decoding_Error("OID encoding is too short"); 233| 1| } 234| | 235| 9.19k| const auto consume = [](BufferSlicer& data) -> uint32_t { 236| 9.19k| BOTAN_ASSERT_NOMSG(!data.empty()); 237| 9.19k| uint32_t b = data.take_byte(); 238| | 239| 9.19k| if(b > 0x7F) { 240| 9.19k| b &= 0x7F; 241| | 242| | // Even BER requires that the OID have minimal length, ie that 243| | // the first byte of a multibyte encoding cannot be zero 244| | // See X.690 section 8.19.2 245| 9.19k| if(b == 0) { 246| 9.19k| throw Decoding_Error("Leading zero byte in multibyte OID encoding"); 247| 9.19k| } 248| | 249| 9.19k| while(true) { 250| 9.19k| if(data.empty()) { 251| 9.19k| throw Decoding_Error("Truncated OID value"); 252| 9.19k| } 253| | 254| 9.19k| const uint8_t next = data.take_byte(); 255| 9.19k| const bool more = (next & 0x80) == 0x80; 256| 9.19k| const uint8_t value = next & 0x7F; 257| | 258| 9.19k| if((b >> (32 - 7)) != 0) { 259| 9.19k| throw Decoding_Error("OID component overflow"); 260| 9.19k| } 261| | 262| 9.19k| b = (b << 7) | value; 263| | 264| 9.19k| if(!more) { 265| 9.19k| break; 266| 9.19k| } 267| 9.19k| } 268| 9.19k| } 269| | 270| 9.19k| return b; 271| 9.19k| }; 272| | 273| 9.19k| BufferSlicer data(obj.data()); 274| 9.19k| std::vector parts; 275| | 276| | // Each byte of the DER encoding can result in at most one additional arc, 277| | // except the first byte which always encodes two. Don't reserve for more than 278| | // 16 arcs though; the longest OID in our current table has just 13 arcs. 279| 9.19k| parts.reserve(std::min(16, obj.length() + 1)); 280| | 281| 63.8k| while(!data.empty()) { ------------------ | Branch (281:10): [True: 54.7k, False: 9.19k] ------------------ 282| 54.7k| const uint32_t comp = consume(data); 283| | 284| 54.7k| if(parts.empty()) { ------------------ | Branch (284:10): [True: 9.18k, False: 45.5k] ------------------ 285| | // divide into root and second arc 286| | 287| 9.18k| const uint32_t root_arc = [](uint32_t b0) -> uint32_t { 288| 9.18k| if(b0 < 40) { 289| 9.18k| return 0; 290| 9.18k| } else if(b0 < 80) { 291| 9.18k| return 1; 292| 9.18k| } else { 293| 9.18k| return 2; 294| 9.18k| } 295| 9.18k| }(comp); 296| | 297| 9.18k| parts.push_back(root_arc); 298| 9.18k| BOTAN_ASSERT_NOMSG(comp >= 40 * root_arc); ------------------ | | 84| 9.18k| do { \ | | 85| 9.18k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 9.18k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 9.18k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 9.18k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 9.18k] | | ------------------ ------------------ 299| 9.18k| parts.push_back(comp - 40 * root_arc); 300| 45.5k| } else { 301| 45.5k| parts.push_back(comp); 302| 45.5k| } 303| 54.7k| } 304| | 305| 9.19k| m_id = std::move(parts); 306| 9.19k|} _ZN5BotanlsERNSt3__113basic_ostreamIcNS0_11char_traitsIcEEEERKNS_3OIDE: 308| 1.84k|std::ostream& operator<<(std::ostream& out, const OID& oid) { 309| 1.84k| out << oid.to_string(); 310| 1.84k| return out; 311| 1.84k|} asn1_oid.cpp:_ZN5Botan12_GLOBAL__N_115oid_valid_checkENSt3__14spanIKjLm18446744073709551615EEE: 26| 36.2k|void oid_valid_check(std::span oid) { 27| 36.2k| BOTAN_ARG_CHECK(oid.size() >= 2, "OID too short to be valid"); ------------------ | | 35| 36.2k| do { \ | | 36| 36.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36.2k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36.2k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36.2k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36.2k] | | ------------------ ------------------ 28| 36.2k| BOTAN_ARG_CHECK(oid[0] <= 2, "OID root out of range"); ------------------ | | 35| 36.2k| do { \ | | 36| 36.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36.2k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36.2k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36.2k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36.2k] | | ------------------ ------------------ 29| 36.2k| BOTAN_ARG_CHECK(oid[1] <= 39 || oid[0] == 2, "OID second arc too large"); ------------------ | | 35| 36.2k| do { \ | | 36| 36.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36.2k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 36.2k, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36.2k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36.2k] | | ------------------ ------------------ 30| | // This last is a limitation of using 32 bit integers when decoding 31| | // not a limitation of ASN.1 object identifiers in general 32| 36.2k| BOTAN_ARG_CHECK(oid[1] <= 0xFFFFFFAF, "OID second arc too large"); ------------------ | | 35| 36.2k| do { \ | | 36| 36.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36.2k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36.2k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36.2k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36.2k] | | ------------------ ------------------ 33| 36.2k|} asn1_oid.cpp:_ZZNK5Botan3OID11encode_intoERNS_11DER_EncoderEENK3$_0clERNSt3__16vectorIhNS4_9allocatorIhEEEEj: 190| 13.5k| const auto append = [](std::vector& encoding, uint32_t z) { 191| 13.5k| if(z <= 0x7F) { ------------------ | Branch (191:10): [True: 11.5k, False: 2.00k] ------------------ 192| 11.5k| encoding.push_back(static_cast(z)); 193| 11.5k| } else { 194| 2.00k| const size_t z7 = (high_bit(z) + 7 - 1) / 7; 195| | 196| 6.00k| for(size_t j = 0; j != z7; ++j) { ------------------ | Branch (196:28): [True: 4.00k, False: 2.00k] ------------------ 197| 4.00k| uint8_t zp = static_cast(z >> (7 * (z7 - j - 1)) & 0x7F); 198| | 199| 4.00k| if(j != z7 - 1) { ------------------ | Branch (199:16): [True: 2.00k, False: 2.00k] ------------------ 200| 2.00k| zp |= 0x80; 201| 2.00k| } 202| | 203| 4.00k| encoding.push_back(zp); 204| 4.00k| } 205| 2.00k| } 206| 13.5k| }; asn1_oid.cpp:_ZZN5Botan3OID11decode_fromERNS_11BER_DecoderEENK3$_0clERNS_12BufferSlicerE: 235| 54.7k| const auto consume = [](BufferSlicer& data) -> uint32_t { 236| 54.7k| BOTAN_ASSERT_NOMSG(!data.empty()); ------------------ | | 84| 54.7k| do { \ | | 85| 54.7k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 54.7k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 54.7k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 54.7k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 54.7k] | | ------------------ ------------------ 237| 54.7k| uint32_t b = data.take_byte(); 238| | 239| 54.7k| if(b > 0x7F) { ------------------ | Branch (239:10): [True: 12.8k, False: 41.8k] ------------------ 240| 12.8k| b &= 0x7F; 241| | 242| | // Even BER requires that the OID have minimal length, ie that 243| | // the first byte of a multibyte encoding cannot be zero 244| | // See X.690 section 8.19.2 245| 12.8k| if(b == 0) { ------------------ | Branch (245:13): [True: 3, False: 12.8k] ------------------ 246| 3| throw Decoding_Error("Leading zero byte in multibyte OID encoding"); 247| 3| } 248| | 249| 13.9k| while(true) { ------------------ | Branch (249:16): [True: 13.9k, Folded] ------------------ 250| 13.9k| if(data.empty()) { ------------------ | Branch (250:16): [True: 25, False: 13.9k] ------------------ 251| 25| throw Decoding_Error("Truncated OID value"); 252| 25| } 253| | 254| 13.9k| const uint8_t next = data.take_byte(); 255| 13.9k| const bool more = (next & 0x80) == 0x80; 256| 13.9k| const uint8_t value = next & 0x7F; 257| | 258| 13.9k| if((b >> (32 - 7)) != 0) { ------------------ | Branch (258:16): [True: 12, False: 13.9k] ------------------ 259| 12| throw Decoding_Error("OID component overflow"); 260| 12| } 261| | 262| 13.9k| b = (b << 7) | value; 263| | 264| 13.9k| if(!more) { ------------------ | Branch (264:16): [True: 12.7k, False: 1.17k] ------------------ 265| 12.7k| break; 266| 12.7k| } 267| 13.9k| } 268| 12.8k| } 269| | 270| 54.6k| return b; 271| 54.7k| }; asn1_oid.cpp:_ZZN5Botan3OID11decode_fromERNS_11BER_DecoderEENK3$_1clEj: 287| 9.18k| const uint32_t root_arc = [](uint32_t b0) -> uint32_t { 288| 9.18k| if(b0 < 40) { ------------------ | Branch (288:16): [True: 592, False: 8.59k] ------------------ 289| 592| return 0; 290| 8.59k| } else if(b0 < 80) { ------------------ | Branch (290:23): [True: 7.20k, False: 1.39k] ------------------ 291| 7.20k| return 1; 292| 7.20k| } else { 293| 1.39k| return 2; 294| 1.39k| } 295| 9.18k| }(comp); _ZN5Botan11BER_DecoderD2Ev: 456| 33.8k|BER_Decoder::~BER_Decoder() = default; _ZN5Botan11BER_Decoder10verify_endEv: 471| 13.6k|BER_Decoder& BER_Decoder::verify_end() { 472| 13.6k| return verify_end("BER_Decoder::verify_end called, but data remains"); 473| 13.6k|} _ZN5Botan11BER_Decoder10verify_endENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 478| 13.6k|BER_Decoder& BER_Decoder::verify_end(std::string_view err) { 479| 13.6k| if(!m_source->end_of_data() || m_pushed.is_set()) { ------------------ | Branch (479:7): [True: 31, False: 13.6k] | Branch (479:35): [True: 0, False: 13.6k] ------------------ 480| 31| throw Decoding_Error(err); 481| 31| } 482| 13.6k| return (*this); 483| 13.6k|} _ZN5Botan11BER_Decoder17discard_remainingEv: 488| 5.99k|BER_Decoder& BER_Decoder::discard_remaining() { 489| 5.99k| m_pushed = BER_Object(); 490| 5.99k| uint8_t buf[64]; 491| 8.59k| while(m_source->read(buf, sizeof(buf)) != 0) {} ------------------ | Branch (491:10): [True: 2.59k, False: 5.99k] ------------------ 492| 5.99k| return (*this); 493| 5.99k|} _ZN5Botan11BER_Decoder10read_bytesENSt3__14spanIhLm18446744073709551615EEE: 505| 14.3k|size_t BER_Decoder::read_bytes(std::span out) { 506| 14.3k| BOTAN_ASSERT_NOMSG(m_source != nullptr); ------------------ | | 84| 14.3k| do { \ | | 85| 14.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 14.3k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 14.3k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 14.3k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 14.3k] | | ------------------ ------------------ 507| 14.3k| return m_source->read(out.data(), out.size()); 508| 14.3k|} _ZN5Botan11BER_Decoder16peek_next_objectEv: 510| 3.12k|const BER_Object& BER_Decoder::peek_next_object() { 511| 3.12k| if(!m_pushed.is_set()) { ------------------ | Branch (511:7): [True: 3.12k, False: 0] ------------------ 512| 3.12k| m_pushed = get_next_object(); 513| 3.12k| } 514| | 515| 3.12k| return m_pushed; 516| 3.12k|} _ZN5Botan11BER_Decoder15get_next_objectEv: 521| 67.6k|BER_Object BER_Decoder::get_next_object() { 522| 67.6k| BER_Object next; 523| | 524| 67.6k| if(m_pushed.is_set()) { ------------------ | Branch (524:7): [True: 5.06k, False: 62.5k] ------------------ 525| 5.06k| std::swap(next, m_pushed); 526| 5.06k| return next; 527| 5.06k| } 528| | 529| 62.5k| for(;;) { 530| 62.5k| ASN1_Type type_tag = ASN1_Type::NoObject; 531| 62.5k| ASN1_Class class_tag = ASN1_Class::NoObject; 532| 62.5k| decode_tag(m_source, type_tag, class_tag); 533| 62.5k| next.set_tagging(type_tag, class_tag); 534| 62.5k| if(next.is_set() == false) { // no more objects ------------------ | Branch (534:10): [True: 4.40k, False: 58.1k] ------------------ 535| 4.40k| return next; 536| 4.40k| } 537| | 538| 58.1k| const size_t allow_indef = m_limits.allow_ber_encoding() ? m_limits.max_nested_indefinite_length() : 0; ------------------ | Branch (538:34): [True: 0, False: 58.1k] ------------------ 539| 58.1k| const bool der_mode = m_limits.require_der_encoding(); 540| 58.1k| const auto dl = decode_length(m_source, allow_indef, der_mode, is_constructed(class_tag)); 541| | 542| | // Per X.690 8.1.5 the only valid EOC encoding is the two-octet 543| | // sequence 0x00 0x00. Reject any other length encoding on a tag of 544| | // (Eoc, Universal) before we consume the "content" bytes. 545| 58.1k| if(type_tag == ASN1_Type::Eoc && class_tag == ASN1_Class::Universal && ------------------ | Branch (545:10): [True: 95, False: 58.0k] | Branch (545:40): [True: 39, False: 56] ------------------ 546| 39| (dl.content_length() != 0 || dl.indefinite_length())) { ------------------ | Branch (546:11): [True: 36, False: 3] | Branch (546:39): [True: 0, False: 3] ------------------ 547| 36| throw BER_Decoding_Error("EOC marker with non-zero length"); 548| 36| } 549| | 550| 58.1k| if(const auto max_size = m_limits.max_object_size(); max_size && dl.content_length() > *max_size) { ------------------ | Branch (550:60): [True: 57.9k, False: 163] | Branch (550:72): [True: 41, False: 57.8k] ------------------ 551| 41| throw BER_Decoding_Error("Encoded object exceeds maximum size"); 552| 41| } 553| | 554| 58.0k| if(!m_source->check_available(dl.total_length())) { ------------------ | Branch (554:10): [True: 131, False: 57.9k] ------------------ 555| 131| throw BER_Decoding_Error("Value truncated"); 556| 131| } 557| | 558| 57.9k| uint8_t* out = next.mutable_bits(dl.content_length()); 559| 57.9k| if(m_source->read(out, dl.content_length()) != dl.content_length()) { ------------------ | Branch (559:10): [True: 0, False: 57.9k] ------------------ 560| 0| throw BER_Decoding_Error("Value truncated"); 561| 0| } 562| | 563| 57.9k| if(dl.indefinite_length()) { ------------------ | Branch (563:10): [True: 0, False: 57.9k] ------------------ 564| | // After reading the data consume the 2-byte EOC 565| 0| uint8_t eoc[2] = {0xFF, 0xFF}; 566| 0| if(m_source->read(eoc, 2) != 2 || eoc[0] != 0x00 || eoc[1] != 0x00) { ------------------ | Branch (566:13): [True: 0, False: 0] | Branch (566:44): [True: 0, False: 0] | Branch (566:62): [True: 0, False: 0] ------------------ 567| 0| throw BER_Decoding_Error("Missing or malformed EOC marker"); 568| 0| } 569| 0| } 570| | 571| 57.9k| if(next.tagging() == static_cast(ASN1_Type::Eoc)) { ------------------ | Branch (571:10): [True: 3, False: 57.9k] ------------------ 572| 3| if(m_limits.require_der_encoding()) { ------------------ | Branch (572:13): [True: 3, False: 0] ------------------ 573| 3| throw BER_Decoding_Error("Detected EOC marker in DER structure"); 574| 3| } 575| | // An EOC marker is only valid as an indefinite-length terminator, which 576| | // is consumed above when reading the indefinite-length object. A 577| | // standalone EOC is rejected unless the caller opted to tolerate it. 578| 0| if(m_limits.allow_standalone_eoc()) { ------------------ | Branch (578:13): [True: 0, False: 0] ------------------ 579| 0| continue; 580| 0| } 581| 0| throw BER_Decoding_Error("Encountered EOC marker outside of indefinite-length encoding"); 582| 0| } 583| | 584| 57.9k| break; 585| 57.9k| } 586| | 587| 57.9k| return next; 588| 62.5k|} _ZN5Botan11BER_Decoder9push_backEONS_10BER_ObjectE: 612| 6.35k|void BER_Decoder::push_back(BER_Object&& obj) { 613| 6.35k| if(m_pushed.is_set()) { ------------------ | Branch (613:7): [True: 0, False: 6.35k] ------------------ 614| 0| throw Invalid_State("BER_Decoder: Only one push back is allowed"); 615| 0| } 616| 6.35k| m_pushed = std::move(obj); 617| 6.35k|} _ZN5Botan11BER_Decoder10start_consENS_9ASN1_TypeENS_10ASN1_ClassE: 619| 19.2k|BER_Decoder BER_Decoder::start_cons(ASN1_Type type_tag, ASN1_Class class_tag) { 620| 19.2k| BER_Object obj = get_next_object(); 621| 19.2k| obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed); 622| | 623| | // In DER mode the elements of a universal SET must appear in sorted order 624| 19.2k| if(m_limits.require_der_encoding() && type_tag == ASN1_Type::Set && class_tag == ASN1_Class::Universal) { ------------------ | Branch (624:7): [True: 19.0k, False: 185] | Branch (624:42): [True: 0, False: 19.0k] | Branch (624:72): [True: 0, False: 0] ------------------ 625| 0| verify_set_is_sorted(std::span{obj.bits(), obj.length()}); 626| 0| } 627| | 628| 19.2k| BER_Decoder child(std::move(obj), this); 629| 19.2k| return child; 630| 19.2k|} _ZN5Botan11BER_Decoder8end_consEv: 635| 17.7k|BER_Decoder& BER_Decoder::end_cons() { 636| 17.7k| if(m_parent == nullptr) { ------------------ | Branch (636:7): [True: 0, False: 17.7k] ------------------ 637| 0| throw Invalid_State("BER_Decoder::end_cons called with null parent"); 638| 0| } 639| 17.7k| if(!m_source->end_of_data() || m_pushed.is_set()) { ------------------ | Branch (639:7): [True: 39, False: 17.7k] | Branch (639:35): [True: 39, False: 17.6k] ------------------ 640| 78| throw Decoding_Error("BER_Decoder::end_cons called with data left"); 641| 78| } 642| 17.6k| return (*m_parent); 643| 17.7k|} _ZN5Botan11BER_DecoderC2EONS_10BER_ObjectEPS0_: 646| 19.0k| m_limits(parent != nullptr ? parent->limits() : BER_Decoder::Limits::BER()), m_parent(parent) { ------------------ | Branch (646:16): [True: 19.0k, False: 0] ------------------ 647| 19.0k| m_data_src = std::make_unique(std::move(obj)); 648| 19.0k| m_source = m_data_src.get(); 649| 19.0k|} _ZN5Botan11BER_DecoderC2ERNS_10DataSourceENS0_6LimitsE: 659| 9|BER_Decoder::BER_Decoder(DataSource& src, Limits limits) : m_limits(limits), m_source(&src) {} _ZN5Botan11BER_DecoderC2ENSt3__14spanIKhLm18446744073709551615EEENS0_6LimitsE: 664| 14.7k|BER_Decoder::BER_Decoder(std::span buf, Limits limits) : m_limits(limits) { 665| 14.7k| m_data_src = std::make_unique(buf); 666| 14.7k| m_source = m_data_src.get(); 667| 14.7k|} _ZN5Botan11BER_Decoder6decodeERNS_11ASN1_ObjectENS_9ASN1_TypeENS_10ASN1_ClassE: 676| 15.3k|BER_Decoder& BER_Decoder::decode(ASN1_Object& obj, ASN1_Type type_tag, ASN1_Class class_tag) { 677| | // TODO support this case properly 678| 15.3k| if(type_tag != ASN1_Type::NoObject || class_tag != ASN1_Class::NoObject) { ------------------ | Branch (678:7): [True: 0, False: 15.3k] | Branch (678:42): [True: 0, False: 15.3k] ------------------ 679| 0| throw Not_Implemented("BER_Decoder::decode(ASN1_Object) does not support implicit tagged decoding"); 680| 0| } 681| 15.3k| obj.decode_from(*this); 682| 15.3k| return (*this); 683| 15.3k|} _ZN5Botan11BER_Decoder26decode_octet_string_bigintERNS_6BigIntE: 697| 1.84k|BER_Decoder& BER_Decoder::decode_octet_string_bigint(BigInt& out) { 698| 1.84k| secure_vector out_vec; 699| 1.84k| decode(out_vec, ASN1_Type::OctetString); 700| 1.84k| out = BigInt::from_bytes(out_vec); 701| 1.84k| return (*this); 702| 1.84k|} _ZN5Botan11BER_Decoder6decodeERmNS_9ASN1_TypeENS_10ASN1_ClassE: 730| 10.8k|BER_Decoder& BER_Decoder::decode(size_t& out, ASN1_Type type_tag, ASN1_Class class_tag) { 731| 10.8k| BigInt integer; 732| 10.8k| decode(integer, type_tag, class_tag); 733| | 734| 10.8k| if(integer.signum() < 0) { ------------------ | Branch (734:7): [True: 77, False: 10.7k] ------------------ 735| 77| throw BER_Decoding_Error("Decoded small integer value was negative"); 736| 77| } 737| | 738| 10.7k| if(integer.bits() > 32) { ------------------ | Branch (738:7): [True: 54, False: 10.7k] ------------------ 739| 54| throw BER_Decoding_Error("Decoded integer value larger than expected"); 740| 54| } 741| | 742| 10.7k| out = 0; 743| 52.1k| for(size_t i = 0; i != 4; ++i) { ------------------ | Branch (743:22): [True: 41.4k, False: 10.7k] ------------------ 744| 41.4k| out = (out << 8) | integer.byte_at(3 - i); 745| 41.4k| } 746| | 747| 10.7k| return (*this); 748| 10.7k|} _ZN5Botan11BER_Decoder6decodeERNS_6BigIntENS_9ASN1_TypeENS_10ASN1_ClassE: 780| 14.8k|BER_Decoder& BER_Decoder::decode(BigInt& out, ASN1_Type type_tag, ASN1_Class class_tag) { 781| 14.8k| const BER_Object obj = get_next_object(); 782| 14.8k| obj.assert_is_a(type_tag, class_tag); 783| | 784| | // An INTEGER must have at least one content octet (X.690 section 8.3.1) 785| 14.8k| if(obj.length() == 0) { ------------------ | Branch (785:7): [True: 4, False: 14.8k] ------------------ 786| 4| throw BER_Decoding_Error("INTEGER encoding has no content octets"); 787| 4| } 788| | 789| | // DER requires minimal INTEGER encoding (X.690 section 8.3.2) 790| 14.8k| if(m_limits.require_der_encoding()) { ------------------ | Branch (790:7): [True: 14.4k, False: 376] ------------------ 791| 14.4k| if(obj.length() > 1) { ------------------ | Branch (791:10): [True: 2.90k, False: 11.5k] ------------------ 792| 2.90k| if(obj.bits()[0] == 0x00 && (obj.bits()[1] & 0x80) == 0) { ------------------ | Branch (792:13): [True: 1.08k, False: 1.81k] | Branch (792:38): [True: 6, False: 1.08k] ------------------ 793| 6| throw BER_Decoding_Error("Detected non-minimal INTEGER encoding in DER structure"); 794| 6| } 795| 2.89k| if(obj.bits()[0] == 0xFF && (obj.bits()[1] & 0x80) != 0) { ------------------ | Branch (795:13): [True: 21, False: 2.87k] | Branch (795:38): [True: 1, False: 20] ------------------ 796| 1| throw BER_Decoding_Error("Detected non-minimal INTEGER encoding in DER structure"); 797| 1| } 798| 2.89k| } 799| 14.4k| } 800| | 801| 14.8k| out = ASN1::integer_from_contents(obj.data()); 802| | 803| 14.8k| return (*this); 804| 14.8k|} _ZN5Botan4ASN121integer_from_contentsENSt3__14spanIKhLm18446744073709551615EEE: 806| 14.4k|BigInt ASN1::integer_from_contents(std::span contents) { 807| 14.4k| if(contents.empty()) { ------------------ | Branch (807:7): [True: 0, False: 14.4k] ------------------ 808| 0| throw BER_Decoding_Error("INTEGER encoding has no content octets"); 809| 0| } 810| | 811| 14.4k| BigInt out; 812| | 813| 14.4k| const bool negative = (contents[0] & 0x80) == 0x80; 814| | 815| 14.4k| if(negative) { ------------------ | Branch (815:7): [True: 143, False: 14.3k] ------------------ 816| 143| secure_vector vec(contents.begin(), contents.end()); 817| 589| for(size_t i = vec.size(); i > 0; --i) { ------------------ | Branch (817:34): [True: 589, False: 0] ------------------ 818| 589| const bool gt0 = (vec[i - 1] > 0); 819| 589| vec[i - 1] -= 1; 820| 589| if(gt0) { ------------------ | Branch (820:13): [True: 143, False: 446] ------------------ 821| 143| break; 822| 143| } 823| 589| } 824| 22.4k| for(auto& byte : vec) { ------------------ | Branch (824:22): [True: 22.4k, False: 143] ------------------ 825| 22.4k| byte = ~byte; 826| 22.4k| } 827| 143| out._assign_from_bytes(vec); 828| 143| out.set_sign(BigInt::Negative); 829| 14.3k| } else { 830| 14.3k| out._assign_from_bytes(contents); 831| 14.3k| } 832| | 833| 14.4k| return out; 834| 14.4k|} _ZN5Botan11BER_Decoder23decode_into_byte_vectorERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS_9ASN1_TypeES7_NS_10ASN1_ClassE: 1026| 10.9k| ASN1_Class class_tag) { 1027| 10.9k| if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) { ------------------ | Branch (1027:7): [True: 0, False: 10.9k] | Branch (1027:46): [True: 0, False: 0] ------------------ 1028| 0| throw BER_Bad_Tag("Bad tag for {BIT,OCTET} STRING", static_cast(real_type)); 1029| 0| } 1030| | 1031| 10.9k| asn1_decode_binary_string(buffer, get_next_object(), real_type, type_tag, class_tag, m_limits); 1032| 10.9k| return (*this); 1033| 10.9k|} _ZN5Botan11BER_Decoder23decode_into_byte_vectorERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeES7_NS_10ASN1_ClassE: 1038| 1.82k| ASN1_Class class_tag) { 1039| 1.82k| if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) { ------------------ | Branch (1039:7): [True: 908, False: 914] | Branch (1039:46): [True: 0, False: 908] ------------------ 1040| 0| throw BER_Bad_Tag("Bad tag for {BIT,OCTET} STRING", static_cast(real_type)); 1041| 0| } 1042| | 1043| 1.82k| asn1_decode_binary_string(buffer, get_next_object(), real_type, type_tag, class_tag, m_limits); 1044| 1.82k| return (*this); 1045| 1.82k|} _ZN5Botan11BER_Decoder16decode_bitstringERNS_14ASN1_BitStringENS_9ASN1_TypeENS_10ASN1_ClassE: 1047| 959|BER_Decoder& BER_Decoder::decode_bitstring(ASN1_BitString& out, ASN1_Type type_tag, ASN1_Class class_tag) { 1048| 959| const BER_Object obj = get_next_object(); 1049| | 1050| 959| std::vector bits; 1051| 959| uint8_t unused_bits = 0; 1052| | 1053| 959| if(is_constructed(obj.class_tag())) { ------------------ | Branch (1053:7): [True: 2, False: 957] ------------------ 1054| 2| obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed); 1055| 2| if(m_limits.require_der_encoding()) { ------------------ | Branch (1055:10): [True: 1, False: 1] ------------------ 1056| 1| throw BER_Decoding_Error("Detected constructed string encoding in DER structure"); 1057| 1| } 1058| 1| bits.reserve(obj.length()); // upper possible bound on the output size 1059| 1| unused_bits = asn1_concat_constructed_bit_string(bits, obj, m_limits, 0); 1060| 957| } else { 1061| 957| unused_bits = asn1_bitstring_unused_bits(obj, type_tag, class_tag, m_limits.require_der_encoding()); 1062| 957| bits.assign(obj.bits() + 1, obj.bits() + obj.length()); 1063| 957| } 1064| | 1065| 958| if(unused_bits > 0 && !bits.empty()) { ------------------ | Branch (1065:7): [True: 5, False: 953] | Branch (1065:26): [True: 5, False: 0] ------------------ 1066| 5| bits.back() &= static_cast(0xFF << unused_bits); 1067| 5| } 1068| | 1069| 958| out = ASN1_BitString(std::move(bits), unused_bits); 1070| 958| return (*this); 1071| 959|} _ZN5Botan4ASN120is_single_der_objectENSt3__14spanIKhLm18446744073709551615EEENS_9ASN1_TypeENS_10ASN1_ClassE: 1105| 6.52k|bool is_single_der_object(std::span bytes, ASN1_Type expected_type, ASN1_Class expected_class) { 1106| 6.52k| if(bytes.empty()) { ------------------ | Branch (1106:7): [True: 0, False: 6.52k] ------------------ 1107| 0| return false; 1108| 0| } 1109| | 1110| 6.52k| try { 1111| 6.52k| DataSource_Span src(bytes); 1112| | 1113| 6.52k| ASN1_Type type_tag = ASN1_Type::NoObject; 1114| 6.52k| ASN1_Class class_tag = ASN1_Class::NoObject; 1115| 6.52k| const size_t tag_bytes = decode_tag(&src, type_tag, class_tag); 1116| | 1117| 6.52k| if(type_tag != expected_type || class_tag != expected_class) { ------------------ | Branch (1117:10): [True: 2.78k, False: 3.74k] | Branch (1117:39): [True: 7, False: 3.74k] ------------------ 1118| 2.74k| return false; 1119| 2.74k| } 1120| | 1121| 3.78k| const auto dl = decode_length(&src, /*allow_indef=*/0, /*der_mode=*/true, is_constructed(expected_class)); 1122| | 1123| 3.78k| const size_t header_bytes = tag_bytes + dl.field_length(); 1124| 3.78k| if(header_bytes > bytes.size()) { ------------------ | Branch (1124:10): [True: 0, False: 3.78k] ------------------ 1125| 0| return false; 1126| 0| } 1127| 3.78k| return dl.content_length() == bytes.size() - header_bytes; 1128| 3.78k| } catch(Decoding_Error&) { 1129| 47| return false; 1130| 47| } 1131| 6.52k|} _ZN5Botan4ASN122is_der_sequence_headerENSt3__14spanIKhLm18446744073709551615EEE: 1133| 3.82k|bool is_der_sequence_header(std::span bytes) { 1134| 3.82k| return is_single_der_object(bytes, ASN1_Type::Sequence, ASN1_Class::Universal | ASN1_Class::Constructed); 1135| 3.82k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_110decode_tagEPNS_10DataSourceERNS_9ASN1_TypeERNS_10ASN1_ClassE: 29| 69.0k|size_t decode_tag(DataSource* ber, ASN1_Type& type_tag, ASN1_Class& class_tag) { 30| 69.0k| auto b = ber->read_byte(); 31| | 32| 69.0k| if(!b) { ------------------ | Branch (32:7): [True: 4.40k, False: 64.6k] ------------------ 33| 4.40k| type_tag = ASN1_Type::NoObject; 34| 4.40k| class_tag = ASN1_Class::NoObject; 35| 4.40k| return 0; 36| 4.40k| } 37| | 38| 64.6k| if((*b & 0x1F) != 0x1F) { ------------------ | Branch (38:7): [True: 64.2k, False: 466] ------------------ 39| 64.2k| type_tag = ASN1_Type(*b & 0x1F); 40| 64.2k| class_tag = ASN1_Class(*b & 0xE0); 41| | // The EOC marker is primitive; a constructed universal tag 0 has no 42| | // valid meaning and would otherwise bypass the EOC handling, which 43| | // matches on (Eoc, Universal) exactly 44| 64.2k| if(type_tag == ASN1_Type::Eoc && class_tag == ASN1_Class::Constructed) { ------------------ | Branch (44:10): [True: 123, False: 64.0k] | Branch (44:40): [True: 7, False: 116] ------------------ 45| 7| throw BER_Decoding_Error("EOC tag with constructed encoding"); 46| 7| } 47| 64.1k| return 1; 48| 64.2k| } 49| | 50| 466| size_t tag_bytes = 1; 51| 466| class_tag = ASN1_Class(*b & 0xE0); 52| | 53| 466| uint32_t tag_buf = 0; 54| 1.67k| while(true) { ------------------ | Branch (54:10): [True: 1.67k, Folded] ------------------ 55| 1.67k| b = ber->read_byte(); 56| 1.67k| if(!b) { ------------------ | Branch (56:10): [True: 15, False: 1.65k] ------------------ 57| 15| throw BER_Decoding_Error("Long-form tag truncated"); 58| 15| } 59| | // Reject if shifting in another 7 bits would overflow the uint32_t tag 60| 1.65k| if((tag_buf >> 25) != 0) { ------------------ | Branch (60:10): [True: 23, False: 1.63k] ------------------ 61| 23| throw BER_Decoding_Error("Long-form tag overflowed 32 bits"); 62| 23| } 63| | // This is required even by BER (see X.690 section 8.1.2.4.2 sentence c). 64| | // Bits 7-1 of the first subsequent octet must not be all zero; this rules 65| | // out both 0x80 (continuation with no data) and 0x00 (a long-form encoding 66| | // of tag value 0, which collides with the EOC marker). 67| 1.63k| if(tag_bytes == 1 && (*b & 0x7F) == 0) { ------------------ | Branch (67:10): [True: 465, False: 1.16k] | Branch (67:28): [True: 11, False: 454] ------------------ 68| 11| throw BER_Decoding_Error("Long form tag with leading zero"); 69| 11| } 70| 1.62k| ++tag_bytes; 71| 1.62k| tag_buf = (tag_buf << 7) | (*b & 0x7F); 72| 1.62k| if((*b & 0x80) == 0) { ------------------ | Branch (72:10): [True: 417, False: 1.20k] ------------------ 73| 417| break; 74| 417| } 75| 1.62k| } 76| | // Per X.690 8.1.2.2, tag values 0-30 shall be encoded in the short form. 77| | // Long-form encoding is reserved for tag values >= 31 (X.690 8.1.2.3). 78| | // This is unconditional and applies to BER as well as DER. 79| 417| if(tag_buf <= 30) { ------------------ | Branch (79:7): [True: 8, False: 409] ------------------ 80| 8| throw BER_Decoding_Error("Long-form tag encoding used for small tag value"); 81| 8| } 82| | 83| 409| if(tag_buf == static_cast(ASN1_Type::NoObject)) { ------------------ | Branch (83:7): [True: 4, False: 405] ------------------ 84| 4| throw BER_Decoding_Error("Tag value collides with internal sentinel"); 85| 4| } 86| | 87| | // NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange) 88| 405| type_tag = ASN1_Type(tag_buf); 89| 405| return tag_bytes; 90| 409|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_113decode_lengthEPNS_10DataSourceEmbb: 135| 61.8k|BerDecodedLength decode_length(DataSource* ber, size_t allow_indef, bool der_mode, bool constructed) { 136| 61.8k| uint8_t b = 0; 137| 61.8k| if(ber->read_byte(b) == 0) { ------------------ | Branch (137:7): [True: 98, False: 61.7k] ------------------ 138| 98| throw BER_Decoding_Error("Length field not found"); 139| 98| } 140| 61.7k| if((b & 0x80) == 0) { ------------------ | Branch (140:7): [True: 55.4k, False: 6.29k] ------------------ 141| 55.4k| return BerDecodedLength(b, 1); 142| 55.4k| } 143| | 144| 6.29k| const size_t num_length_bytes = (b & 0x7F); 145| 6.29k| if(num_length_bytes > 4) { ------------------ | Branch (145:7): [True: 22, False: 6.26k] ------------------ 146| 22| throw BER_Decoding_Error("Length field is too large"); 147| 22| } 148| | 149| 6.26k| const size_t field_size = 1 + num_length_bytes; 150| | 151| 6.26k| if(num_length_bytes == 0) { ------------------ | Branch (151:7): [True: 1, False: 6.26k] ------------------ 152| 1| if(der_mode) { ------------------ | Branch (152:10): [True: 1, False: 0] ------------------ 153| 1| throw BER_Decoding_Error("Detected indefinite-length encoding in DER structure"); 154| 1| } else if(!constructed) { ------------------ | Branch (154:17): [True: 0, False: 0] ------------------ 155| | // Indefinite length is only valid for constructed types (X.690 8.1.3.2) 156| 0| throw BER_Decoding_Error("Indefinite-length encoding used with non-constructed type"); 157| 0| } else if(allow_indef == 0) { ------------------ | Branch (157:17): [True: 0, False: 0] ------------------ 158| 0| throw BER_Decoding_Error("Nested EOC markers too deep, rejecting to avoid stack exhaustion"); 159| 0| } else { 160| | // find_eoc returns bytes up to and including the EOC marker. 161| | // Return the content length; the caller consumes the EOC separately. 162| 0| const size_t eoc_len = find_eoc(ber, /*base_offset=*/0, allow_indef - 1); 163| 0| if(eoc_len < 2) { ------------------ | Branch (163:13): [True: 0, False: 0] ------------------ 164| 0| throw BER_Decoding_Error("Invalid EOC encoding"); 165| 0| } 166| 0| return BerDecodedLength::indefinite(eoc_len - 2, field_size); 167| 0| } 168| 1| } 169| | 170| 6.26k| size_t length = 0; 171| | 172| 15.8k| for(size_t i = 0; i != num_length_bytes; ++i) { ------------------ | Branch (172:22): [True: 9.62k, False: 6.25k] ------------------ 173| 9.62k| if(ber->read_byte(b) == 0) { ------------------ | Branch (173:10): [True: 9, False: 9.61k] ------------------ 174| 9| throw BER_Decoding_Error("Corrupted length field"); 175| 9| } 176| | // Can't overflow since we already checked that num_length_bytes <= 4 177| 9.61k| length = (length << 8) | b; 178| 9.61k| } 179| | 180| | // DER requires shortest possible length encoding 181| 6.25k| if(der_mode) { ------------------ | Branch (181:7): [True: 6.25k, False: 0] ------------------ 182| 6.25k| if(length < 128) { ------------------ | Branch (182:10): [True: 11, False: 6.24k] ------------------ 183| 11| throw BER_Decoding_Error("Detected non-canonical length encoding in DER structure"); 184| 11| } 185| 6.24k| if(num_length_bytes > 1 && length < (size_t(1) << ((num_length_bytes - 1) * 8))) { ------------------ | Branch (185:10): [True: 3.13k, False: 3.11k] | Branch (185:34): [True: 1, False: 3.13k] ------------------ 186| 1| throw BER_Decoding_Error("Detected non-canonical length encoding in DER structure"); 187| 1| } 188| 6.24k| } 189| | 190| 6.24k| return BerDecodedLength(length, field_size); 191| 6.25k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_116BerDecodedLengthC2Emm: 108| 61.7k| BerDecodedLength(content_length, field_length, false) {} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_116BerDecodedLengthC2Emmb: 125| 61.7k| m_content_length(content_length), m_field_length(field_length), m_indefinite(indefinite) {} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_114is_constructedENS_10ASN1_ClassE: 22| 76.5k|bool is_constructed(ASN1_Class class_tag) { 23| 76.5k| return (static_cast(class_tag) & static_cast(ASN1_Class::Constructed)) != 0; 24| 76.5k|} ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_116BerDecodedLength14content_lengthEv: 114| 235k| size_t content_length() const { return m_content_length; } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_116BerDecodedLength17indefinite_lengthEv: 121| 57.7k| bool indefinite_length() const { return m_indefinite; } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_116BerDecodedLength12total_lengthEv: 117| 57.8k| size_t total_length() const { return m_indefinite ? m_content_length + 2 : m_content_length; } ------------------ | Branch (117:44): [True: 0, False: 57.8k] ------------------ ber_dec.cpp:_ZN5Botan12_GLOBAL__N_126asn1_bitstring_unused_bitsERKNS_10BER_ObjectENS_9ASN1_TypeENS_10ASN1_ClassEb: 990| 957|uint8_t asn1_bitstring_unused_bits(const BER_Object& obj, ASN1_Type type_tag, ASN1_Class class_tag, bool require_der) { 991| 957| obj.assert_is_a(type_tag, class_tag); 992| 957| BOTAN_ASSERT_NOMSG(!is_constructed(obj)); ------------------ | | 84| 957| do { \ | | 85| 957| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 957| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 957] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 957| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 957] | | ------------------ ------------------ 993| | 994| 957| if(obj.length() == 0) { ------------------ | Branch (994:7): [True: 1, False: 956] ------------------ 995| 1| throw BER_Decoding_Error("Invalid BIT STRING"); 996| 1| } 997| | 998| 956| const uint8_t unused_bits = obj.bits()[0]; 999| | 1000| 956| if(unused_bits >= 8) { ------------------ | Branch (1000:7): [True: 1, False: 955] ------------------ 1001| 1| throw BER_Decoding_Error("Invalid number of unused bits in BIT STRING"); 1002| 1| } 1003| | 1004| 955| if(obj.length() == 1 && unused_bits != 0) { ------------------ | Branch (1004:7): [True: 3, False: 952] | Branch (1004:28): [True: 2, False: 1] ------------------ 1005| 2| throw BER_Decoding_Error("Invalid BIT STRING"); 1006| 2| } 1007| | 1008| 953| if(require_der && unused_bits > 0) { ------------------ | Branch (1008:7): [True: 952, False: 1] | Branch (1008:22): [True: 7, False: 945] ------------------ 1009| 7| const uint8_t last_byte = obj.bits()[obj.length() - 1]; 1010| 7| if((last_byte & ((1 << unused_bits) - 1)) != 0) { ------------------ | Branch (1010:10): [True: 2, False: 5] ------------------ 1011| 2| throw BER_Decoding_Error("Detected non-zero padding bits in BIT STRING in DER structure"); 1012| 2| } 1013| 7| } 1014| | 1015| 951| return unused_bits; 1016| 953|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_114is_constructedERKNS_10BER_ObjectE: 838| 13.7k|bool is_constructed(const BER_Object& obj) { 839| 13.7k| return is_constructed(obj.class_tag()); 840| 13.7k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_115DataSource_SpanC2ENSt3__14spanIKhLm18446744073709551615EEE: 414| 6.52k| explicit DataSource_Span(std::span buf) : m_buf(buf) {} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_115DataSource_Span4readEPhm: 392| 12.1k| size_t read(uint8_t out[], size_t length) override { 393| 12.1k| const size_t got = std::min(m_buf.size() - m_offset, length); 394| 12.1k| copy_mem(out, m_buf.data() + m_offset, got); 395| 12.1k| m_offset += got; 396| 12.1k| return got; 397| 12.1k| } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_116BerDecodedLength12field_lengthEv: 119| 3.73k| size_t field_length() const { return m_field_length; } ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObjectC2EONS_10BER_ObjectE: 379| 19.0k| explicit DataSource_BERObject(BER_Object&& obj) : m_obj(std::move(obj)) {} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObject4readEPhm: 349| 161k| size_t read(uint8_t out[], size_t length) override { 350| 161k| BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length()); ------------------ | | 84| 161k| do { \ | | 85| 161k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 161k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 161k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 161k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 161k] | | ------------------ ------------------ 351| 161k| const size_t got = std::min(m_obj.length() - m_offset, length); 352| 161k| copy_mem(out, m_obj.bits() + m_offset, got); 353| 161k| m_offset += got; 354| 161k| return got; 355| 161k| } ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObject15check_availableEm: 370| 43.2k| bool check_available(size_t n) override { 371| 43.2k| BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length()); ------------------ | | 84| 43.2k| do { \ | | 85| 43.2k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 43.2k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 43.2k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 43.2k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 43.2k] | | ------------------ ------------------ 372| 43.2k| return (n <= (m_obj.length() - m_offset)); 373| 43.2k| } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject11end_of_dataEv: 375| 17.8k| bool end_of_data() const override { return get_bytes_read() == m_obj.length(); } ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject14get_bytes_readEv: 377| 17.8k| size_t get_bytes_read() const override { return m_offset; } ber_dec.cpp:_ZN5Botan12_GLOBAL__N_125asn1_decode_binary_stringINS_16secure_allocatorIhEEEEvRNSt3__16vectorIhT_EERKNS_10BER_ObjectENS_9ASN1_TypeESC_NS_10ASN1_ClassERKNS_11BER_Decoder6LimitsE: 932| 10.9k| const BER_Decoder::Limits& limits) { 933| | // DER requires BIT STRING and OCTET STRING to use primitive encoding; 934| | // in BER the constructed (fragmented) form is decoded by concatenation 935| 10.9k| if(is_constructed(obj)) { ------------------ | Branch (935:7): [True: 6, False: 10.9k] ------------------ 936| 6| obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed); 937| | 938| 6| if(limits.require_der_encoding()) { ------------------ | Branch (938:10): [True: 1, False: 5] ------------------ 939| 1| throw BER_Decoding_Error("Detected constructed string encoding in DER structure"); 940| 1| } 941| | 942| | // Concatenate into a temporary so a failed decode leaves buffer unmodified 943| 5| std::vector concat; 944| 5| concat.reserve(obj.length()); // upper possible bound on the output size 945| 5| if(real_type == ASN1_Type::OctetString) { ------------------ | Branch (945:10): [True: 0, False: 5] ------------------ 946| 0| asn1_concat_constructed_octet_string(concat, obj, limits, 0); 947| 5| } else { 948| 5| asn1_concat_constructed_bit_string(concat, obj, limits, 0); 949| 5| } 950| 5| buffer = std::move(concat); 951| 5| return; 952| 6| } 953| | 954| 10.9k| obj.assert_is_a(type_tag, class_tag); 955| | 956| 10.9k| if(real_type == ASN1_Type::OctetString) { ------------------ | Branch (956:7): [True: 10.9k, False: 28] ------------------ 957| 10.9k| buffer.assign(obj.bits(), obj.bits() + obj.length()); 958| 10.9k| } else { 959| 28| if(obj.length() == 0) { ------------------ | Branch (959:10): [True: 0, False: 28] ------------------ 960| 0| throw BER_Decoding_Error("Invalid BIT STRING"); 961| 0| } 962| | 963| 28| const uint8_t unused_bits = obj.bits()[0]; 964| | 965| 28| if(unused_bits >= 8) { ------------------ | Branch (965:10): [True: 0, False: 28] ------------------ 966| 0| throw BER_Decoding_Error("Bad number of unused bits in BIT STRING"); 967| 0| } 968| | 969| | // Empty BIT STRING with unused bits > 0 ... 970| 28| if(unused_bits > 0 && obj.length() < 2) { ------------------ | Branch (970:10): [True: 0, False: 28] | Branch (970:29): [True: 0, False: 0] ------------------ 971| 0| throw BER_Decoding_Error("Invalid BIT STRING"); 972| 0| } 973| | 974| | // DER requires unused bits in BIT STRING to be zero (X.690 section 11.2.2) 975| 28| if(limits.require_der_encoding() && unused_bits > 0) { ------------------ | Branch (975:10): [True: 0, False: 28] | Branch (975:43): [True: 0, False: 0] ------------------ 976| 0| const uint8_t last_byte = obj.bits()[obj.length() - 1]; 977| 0| if((last_byte & ((1 << unused_bits) - 1)) != 0) { ------------------ | Branch (977:13): [True: 0, False: 0] ------------------ 978| 0| throw BER_Decoding_Error("Detected non-zero padding bits in BIT STRING in DER structure"); 979| 0| } 980| 0| } 981| | 982| 28| buffer.resize(obj.length() - 1); 983| | 984| 28| if(obj.length() > 1) { ------------------ | Branch (984:10): [True: 0, False: 28] ------------------ 985| 0| copy_mem(buffer.data(), obj.bits() + 1, obj.length() - 1); 986| 0| } 987| 28| } 988| 10.9k|} ber_dec.cpp:_ZN5Botan12_GLOBAL__N_125asn1_decode_binary_stringINSt3__19allocatorIhEEEEvRNS2_6vectorIhT_EERKNS_10BER_ObjectENS_9ASN1_TypeESC_NS_10ASN1_ClassERKNS_11BER_Decoder6LimitsE: 932| 1.82k| const BER_Decoder::Limits& limits) { 933| | // DER requires BIT STRING and OCTET STRING to use primitive encoding; 934| | // in BER the constructed (fragmented) form is decoded by concatenation 935| 1.82k| if(is_constructed(obj)) { ------------------ | Branch (935:7): [True: 1, False: 1.82k] ------------------ 936| 1| obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed); 937| | 938| 1| if(limits.require_der_encoding()) { ------------------ | Branch (938:10): [True: 1, False: 0] ------------------ 939| 1| throw BER_Decoding_Error("Detected constructed string encoding in DER structure"); 940| 1| } 941| | 942| | // Concatenate into a temporary so a failed decode leaves buffer unmodified 943| 0| std::vector concat; 944| 0| concat.reserve(obj.length()); // upper possible bound on the output size 945| 0| if(real_type == ASN1_Type::OctetString) { ------------------ | Branch (945:10): [True: 0, False: 0] ------------------ 946| 0| asn1_concat_constructed_octet_string(concat, obj, limits, 0); 947| 0| } else { 948| 0| asn1_concat_constructed_bit_string(concat, obj, limits, 0); 949| 0| } 950| 0| buffer = std::move(concat); 951| 0| return; 952| 1| } 953| | 954| 1.82k| obj.assert_is_a(type_tag, class_tag); 955| | 956| 1.82k| if(real_type == ASN1_Type::OctetString) { ------------------ | Branch (956:7): [True: 913, False: 908] ------------------ 957| 913| buffer.assign(obj.bits(), obj.bits() + obj.length()); 958| 913| } else { 959| 908| if(obj.length() == 0) { ------------------ | Branch (959:10): [True: 2, False: 906] ------------------ 960| 2| throw BER_Decoding_Error("Invalid BIT STRING"); 961| 2| } 962| | 963| 906| const uint8_t unused_bits = obj.bits()[0]; 964| | 965| 906| if(unused_bits >= 8) { ------------------ | Branch (965:10): [True: 1, False: 905] ------------------ 966| 1| throw BER_Decoding_Error("Bad number of unused bits in BIT STRING"); 967| 1| } 968| | 969| | // Empty BIT STRING with unused bits > 0 ... 970| 905| if(unused_bits > 0 && obj.length() < 2) { ------------------ | Branch (970:10): [True: 20, False: 885] | Branch (970:29): [True: 1, False: 19] ------------------ 971| 1| throw BER_Decoding_Error("Invalid BIT STRING"); 972| 1| } 973| | 974| | // DER requires unused bits in BIT STRING to be zero (X.690 section 11.2.2) 975| 904| if(limits.require_der_encoding() && unused_bits > 0) { ------------------ | Branch (975:10): [True: 904, False: 0] | Branch (975:43): [True: 19, False: 885] ------------------ 976| 19| const uint8_t last_byte = obj.bits()[obj.length() - 1]; 977| 19| if((last_byte & ((1 << unused_bits) - 1)) != 0) { ------------------ | Branch (977:13): [True: 2, False: 17] ------------------ 978| 2| throw BER_Decoding_Error("Detected non-zero padding bits in BIT STRING in DER structure"); 979| 2| } 980| 19| } 981| | 982| 902| buffer.resize(obj.length() - 1); 983| | 984| 902| if(obj.length() > 1) { ------------------ | Branch (984:10): [True: 901, False: 1] ------------------ 985| 901| copy_mem(buffer.data(), obj.bits() + 1, obj.length() - 1); 986| 901| } 987| 902| } 988| 1.82k|} _ZN5Botan11DER_EncoderC2ERNSt3__16vectorIhNS1_9allocatorIhEEEE: 89| 2.43k|DER_Encoder::DER_Encoder(std::vector& vec) { 90| 2.43k| m_append_output = [&vec](const uint8_t b[], size_t l) { 91| 2.43k| if(l > 0) { 92| 2.43k| vec.insert(vec.end(), b, b + l); 93| 2.43k| } 94| 2.43k| }; 95| 2.43k|} _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassEPKhm: 285| 2.43k|DER_Encoder& DER_Encoder::add_object(ASN1_Type type_tag, ASN1_Class class_tag, const uint8_t rep[], size_t length) { 286| 2.43k| std::vector hdr; 287| 2.43k| encode_tag(hdr, type_tag, class_tag); 288| 2.43k| encode_length(hdr, length); 289| | 290| 2.43k| if(!m_subsequences.empty()) { ------------------ | Branch (290:7): [True: 0, False: 2.43k] ------------------ 291| 0| m_subsequences[m_subsequences.size() - 1].add_bytes(hdr.data(), hdr.size(), rep, length); 292| 2.43k| } else if(m_append_output) { ------------------ | Branch (292:14): [True: 2.43k, False: 0] ------------------ 293| 2.43k| m_append_output(hdr.data(), hdr.size()); 294| 2.43k| m_append_output(rep, length); 295| 2.43k| } else { 296| 0| m_default_outbuf += hdr; 297| 0| m_default_outbuf += std::make_pair(rep, length); 298| 0| } 299| | 300| 2.43k| return (*this); 301| 2.43k|} _ZN5Botan11DER_Encoder6encodeERKNS_11ASN1_ObjectE: 467| 2.43k|DER_Encoder& DER_Encoder::encode(const ASN1_Object& obj) { 468| 2.43k| obj.encode_into(*this); 469| 2.43k| return (*this); 470| 2.43k|} der_enc.cpp:_ZN5Botan12_GLOBAL__N_110encode_tagERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeENS_10ASN1_ClassE: 26| 2.43k|void encode_tag(std::vector& encoded_tag, ASN1_Type type_tag_e, ASN1_Class class_tag_e) { 27| 2.43k| const uint32_t type_tag = static_cast(type_tag_e); 28| 2.43k| const uint32_t class_tag = static_cast(class_tag_e); 29| | 30| 2.43k| if((class_tag | 0xE0) != 0xE0) { ------------------ | Branch (30:7): [True: 0, False: 2.43k] ------------------ 31| 0| throw Encoding_Error(fmt("DER_Encoder: Invalid class tag {}", std::to_string(class_tag))); 32| 0| } 33| | 34| 2.43k| if(type_tag <= 30) { ------------------ | Branch (34:7): [True: 2.43k, False: 0] ------------------ 35| 2.43k| encoded_tag.push_back(static_cast(type_tag | class_tag)); 36| 2.43k| } else { 37| 0| size_t blocks = high_bit(static_cast(type_tag)) + 6; 38| 0| blocks = (blocks - (blocks % 7)) / 7; 39| | 40| 0| BOTAN_ASSERT_NOMSG(blocks > 0); ------------------ | | 84| 0| do { \ | | 85| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 0| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 0| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 0] | | ------------------ ------------------ 41| | 42| 0| encoded_tag.push_back(static_cast(class_tag | 0x1F)); 43| 0| for(size_t i = 0; i != blocks - 1; ++i) { ------------------ | Branch (43:25): [True: 0, False: 0] ------------------ 44| 0| encoded_tag.push_back(0x80 | ((type_tag >> 7 * (blocks - i - 1)) & 0x7F)); 45| 0| } 46| 0| encoded_tag.push_back(type_tag & 0x7F); 47| 0| } 48| 2.43k|} der_enc.cpp:_ZN5Botan12_GLOBAL__N_113encode_lengthERNSt3__16vectorIhNS1_9allocatorIhEEEEm: 53| 2.43k|void encode_length(std::vector& encoded_length, size_t length) { 54| 2.43k| if(length <= 127) { ------------------ | Branch (54:7): [True: 2.43k, False: 0] ------------------ 55| 2.43k| encoded_length.push_back(static_cast(length)); 56| 2.43k| } else { 57| 0| const size_t bytes_needed = significant_bytes(length); 58| | 59| 0| encoded_length.push_back(static_cast(0x80 | bytes_needed)); 60| | 61| 0| for(size_t i = sizeof(length) - bytes_needed; i < sizeof(length); ++i) { ------------------ | Branch (61:53): [True: 0, False: 0] ------------------ 62| 0| encoded_length.push_back(get_byte_var(i, length)); 63| 0| } 64| 0| } 65| 2.43k|} der_enc.cpp:_ZZN5Botan11DER_EncoderC1ERNSt3__16vectorIhNS1_9allocatorIhEEEEENK3$_0clEPKhm: 90| 4.87k| m_append_output = [&vec](const uint8_t b[], size_t l) { 91| 4.87k| if(l > 0) { ------------------ | Branch (91:10): [True: 4.87k, False: 0] ------------------ 92| 4.87k| vec.insert(vec.end(), b, b + l); 93| 4.87k| } 94| 4.87k| }; _ZN5Botan7OID_MapC2Ev: 11| 1|OID_Map::OID_Map() { 12| 1| m_str2oid = OID_Map::load_str2oid_map(); 13| 1| m_oid2str = OID_Map::load_oid2str_map(); 14| 1|} _ZN5Botan7OID_Map15global_registryEv: 16| 14.9k|OID_Map& OID_Map::global_registry() { 17| 14.9k| static OID_Map g_map; 18| 14.9k| return g_map; 19| 14.9k|} _ZN5Botan7OID_Map7oid2strERKNS_3OIDE: 73| 12.3k|std::optional OID_Map::oid2str(const OID& oid) { 74| 12.3k| if(auto name = lookup_static_oid(oid)) { ------------------ | Branch (74:12): [True: 10.5k, False: 1.84k] ------------------ 75| 10.5k| return std::string(*name); 76| 10.5k| } 77| | 78| 1.84k| const lock_guard_type lock(m_mutex); 79| | 80| 1.84k| const auto i = m_oid2str.find(oid); 81| 1.84k| if(i != m_oid2str.end()) { ------------------ | Branch (81:7): [True: 0, False: 1.84k] ------------------ 82| 0| return i->second; 83| 0| } 84| | 85| 1.84k| return {}; 86| 1.84k|} _ZN5Botan7OID_Map7str2oidENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 88| 2.53k|OID OID_Map::str2oid(std::string_view str) { 89| 2.53k| if(auto oid = lookup_static_oid_name(str)) { ------------------ | Branch (89:12): [True: 2.53k, False: 0] ------------------ 90| 2.53k| return std::move(*oid); 91| 2.53k| } 92| | 93| 0| const lock_guard_type lock(m_mutex); 94| 0| const auto i = m_str2oid.find(std::string(str)); 95| 0| if(i != m_str2oid.end()) { ------------------ | Branch (95:7): [True: 0, False: 0] ------------------ 96| 0| return i->second; 97| 0| } 98| | 99| 0| return OID(); 100| 0|} _ZN5Botan7OID_Map17lookup_static_oidERKNS_3OIDE: 48| 12.3k|std::optional OID_Map::lookup_static_oid(const OID& oid) { 49| 12.3k| const uint32_t hc = static_cast(oid.hash_code() % 858701); 50| | 51| 12.3k| switch(hc) { 52| 1| case 0x01506: ------------------ | Branch (52:7): [True: 1, False: 12.3k] ------------------ 53| 1| return if_match(oid, {1, 2, 840, 10045, 4, 3, 1}, "ECDSA/SHA-224"); 54| 1| case 0x01507: ------------------ | Branch (54:7): [True: 1, False: 12.3k] ------------------ 55| 1| return if_match(oid, {1, 2, 840, 10045, 4, 3, 2}, "ECDSA/SHA-256"); 56| 1| case 0x01508: ------------------ | Branch (56:7): [True: 1, False: 12.3k] ------------------ 57| 1| return if_match(oid, {1, 2, 840, 10045, 4, 3, 3}, "ECDSA/SHA-384"); 58| 1| case 0x01509: ------------------ | Branch (58:7): [True: 1, False: 12.3k] ------------------ 59| 1| return if_match(oid, {1, 2, 840, 10045, 4, 3, 4}, "ECDSA/SHA-512"); 60| 1| case 0x04C1E: ------------------ | Branch (60:7): [True: 1, False: 12.3k] ------------------ 61| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 3029, 1, 2, 1}, "ElGamal"); 62| 1| case 0x04E61: ------------------ | Branch (62:7): [True: 1, False: 12.3k] ------------------ 63| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 3029, 1, 5, 1}, "OpenPGP.Curve25519"); 64| 1| case 0x0779B: ------------------ | Branch (64:7): [True: 1, False: 12.3k] ------------------ 65| 1| return if_match(oid, {1, 2, 840, 113549, 2, 5}, "MD5"); 66| 1| case 0x0779D: ------------------ | Branch (66:7): [True: 1, False: 12.3k] ------------------ 67| 1| return if_match(oid, {1, 2, 840, 113549, 2, 7}, "HMAC(SHA-1)"); 68| 1| case 0x0779E: ------------------ | Branch (68:7): [True: 1, False: 12.3k] ------------------ 69| 1| return if_match(oid, {1, 2, 840, 113549, 2, 8}, "HMAC(SHA-224)"); 70| 1| case 0x0779F: ------------------ | Branch (70:7): [True: 1, False: 12.3k] ------------------ 71| 1| return if_match(oid, {1, 2, 840, 113549, 2, 9}, "HMAC(SHA-256)"); 72| 1| case 0x077A0: ------------------ | Branch (72:7): [True: 1, False: 12.3k] ------------------ 73| 1| return if_match(oid, {1, 2, 840, 113549, 2, 10}, "HMAC(SHA-384)"); 74| 1| case 0x077A1: ------------------ | Branch (74:7): [True: 1, False: 12.3k] ------------------ 75| 1| return if_match(oid, {1, 2, 840, 113549, 2, 11}, "HMAC(SHA-512)"); 76| 1| case 0x077A3: ------------------ | Branch (76:7): [True: 1, False: 12.3k] ------------------ 77| 1| return if_match(oid, {1, 2, 840, 113549, 2, 13}, "HMAC(SHA-512-256)"); 78| 1| case 0x0785E: ------------------ | Branch (78:7): [True: 1, False: 12.3k] ------------------ 79| 1| return if_match(oid, {1, 2, 840, 113549, 3, 7}, "TripleDES/CBC"); 80| 1| case 0x0C904: ------------------ | Branch (80:7): [True: 1, False: 12.3k] ------------------ 81| 1| return if_match(oid, {1, 0, 14888, 3, 0, 5}, "ECKCDSA"); 82| 1| case 0x11547: ------------------ | Branch (82:7): [True: 1, False: 12.3k] ------------------ 83| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1}, "SphincsPlus-shake-128s-r3.1"); 84| 1| case 0x11548: ------------------ | Branch (84:7): [True: 1, False: 12.3k] ------------------ 85| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2}, "SphincsPlus-shake-128f-r3.1"); 86| 1| case 0x11549: ------------------ | Branch (86:7): [True: 1, False: 12.3k] ------------------ 87| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3}, "SphincsPlus-shake-192s-r3.1"); 88| 1| case 0x1154A: ------------------ | Branch (88:7): [True: 1, False: 12.3k] ------------------ 89| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4}, "SphincsPlus-shake-192f-r3.1"); 90| 1| case 0x1154B: ------------------ | Branch (90:7): [True: 1, False: 12.3k] ------------------ 91| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5}, "SphincsPlus-shake-256s-r3.1"); 92| 1| case 0x1154C: ------------------ | Branch (92:7): [True: 1, False: 12.3k] ------------------ 93| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6}, "SphincsPlus-shake-256f-r3.1"); 94| 1| case 0x11608: ------------------ | Branch (94:7): [True: 1, False: 12.3k] ------------------ 95| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1}, "SphincsPlus-sha2-128s-r3.1"); 96| 1| case 0x11609: ------------------ | Branch (96:7): [True: 1, False: 12.3k] ------------------ 97| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2}, "SphincsPlus-sha2-128f-r3.1"); 98| 1| case 0x1160A: ------------------ | Branch (98:7): [True: 1, False: 12.3k] ------------------ 99| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3}, "SphincsPlus-sha2-192s-r3.1"); 100| 1| case 0x1160B: ------------------ | Branch (100:7): [True: 1, False: 12.3k] ------------------ 101| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4}, "SphincsPlus-sha2-192f-r3.1"); 102| 1| case 0x1160C: ------------------ | Branch (102:7): [True: 1, False: 12.3k] ------------------ 103| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5}, "SphincsPlus-sha2-256s-r3.1"); 104| 1| case 0x1160D: ------------------ | Branch (104:7): [True: 1, False: 12.3k] ------------------ 105| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6}, "SphincsPlus-sha2-256f-r3.1"); 106| 1| case 0x116C9: ------------------ | Branch (106:7): [True: 1, False: 12.3k] ------------------ 107| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1}, "SphincsPlus-haraka-128s-r3.1"); 108| 1| case 0x116CA: ------------------ | Branch (108:7): [True: 1, False: 12.3k] ------------------ 109| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2}, "SphincsPlus-haraka-128f-r3.1"); 110| 1| case 0x116CB: ------------------ | Branch (110:7): [True: 1, False: 12.3k] ------------------ 111| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3}, "SphincsPlus-haraka-192s-r3.1"); 112| 1| case 0x116CC: ------------------ | Branch (112:7): [True: 1, False: 12.3k] ------------------ 113| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4}, "SphincsPlus-haraka-192f-r3.1"); 114| 1| case 0x116CD: ------------------ | Branch (114:7): [True: 1, False: 12.3k] ------------------ 115| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5}, "SphincsPlus-haraka-256s-r3.1"); 116| 1| case 0x116CE: ------------------ | Branch (116:7): [True: 1, False: 12.3k] ------------------ 117| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6}, "SphincsPlus-haraka-256f-r3.1"); 118| 1| case 0x1533B: ------------------ | Branch (118:7): [True: 1, False: 12.3k] ------------------ 119| 1| return if_match(oid, {1, 2, 156, 10197, 1, 104, 2}, "SM4/CBC"); 120| 1| case 0x15341: ------------------ | Branch (120:7): [True: 1, False: 12.3k] ------------------ 121| 1| return if_match(oid, {1, 2, 156, 10197, 1, 104, 8}, "SM4/GCM"); 122| 1| case 0x1539D: ------------------ | Branch (122:7): [True: 1, False: 12.3k] ------------------ 123| 1| return if_match(oid, {1, 2, 156, 10197, 1, 104, 100}, "SM4/OCB"); 124| 1| case 0x187D7: ------------------ | Branch (124:7): [True: 1, False: 12.3k] ------------------ 125| 1| return if_match(oid, {1, 3, 14, 3, 2, 7}, "DES/CBC"); 126| 1| case 0x187EA: ------------------ | Branch (126:7): [True: 1, False: 12.3k] ------------------ 127| 1| return if_match(oid, {1, 3, 14, 3, 2, 26}, "SHA-1"); 128| 16| case 0x19933: ------------------ | Branch (128:7): [True: 16, False: 12.3k] ------------------ 129| 16| return if_match(oid, {1, 3, 132, 0, 8}, "secp160r1"); 130| 18| case 0x19934: ------------------ | Branch (130:7): [True: 18, False: 12.3k] ------------------ 131| 18| return if_match(oid, {1, 3, 132, 0, 9}, "secp160k1"); 132| 197| case 0x19935: ------------------ | Branch (132:7): [True: 197, False: 12.1k] ------------------ 133| 197| return if_match(oid, {1, 3, 132, 0, 10}, "secp256k1"); 134| 27| case 0x19949: ------------------ | Branch (134:7): [True: 27, False: 12.3k] ------------------ 135| 27| return if_match(oid, {1, 3, 132, 0, 30}, "secp160r2"); 136| 180| case 0x1994A: ------------------ | Branch (136:7): [True: 180, False: 12.2k] ------------------ 137| 180| return if_match(oid, {1, 3, 132, 0, 31}, "secp192k1"); 138| 311| case 0x1994B: ------------------ | Branch (138:7): [True: 311, False: 12.0k] ------------------ 139| 311| return if_match(oid, {1, 3, 132, 0, 32}, "secp224k1"); 140| 336| case 0x1994C: ------------------ | Branch (140:7): [True: 336, False: 12.0k] ------------------ 141| 336| return if_match(oid, {1, 3, 132, 0, 33}, "secp224r1"); 142| 204| case 0x1994D: ------------------ | Branch (142:7): [True: 204, False: 12.1k] ------------------ 143| 204| return if_match(oid, {1, 3, 132, 0, 34}, "secp384r1"); 144| 286| case 0x1994E: ------------------ | Branch (144:7): [True: 286, False: 12.0k] ------------------ 145| 286| return if_match(oid, {1, 3, 132, 0, 35}, "secp521r1"); 146| 1.48k| case 0x199F8: ------------------ | Branch (146:7): [True: 1.48k, False: 10.8k] ------------------ 147| 1.48k| return if_match(oid, {1, 3, 132, 1, 12}, "ECDH"); 148| 1| case 0x1E7BF: ------------------ | Branch (148:7): [True: 1, False: 12.3k] ------------------ 149| 1| return if_match(oid, {1, 2, 156, 10197, 1, 301, 1}, "SM2"); 150| 1| case 0x1E7C0: ------------------ | Branch (150:7): [True: 1, False: 12.3k] ------------------ 151| 1| return if_match(oid, {1, 2, 156, 10197, 1, 301, 2}, "SM2_Kex"); 152| 1| case 0x1E7C1: ------------------ | Branch (152:7): [True: 1, False: 12.3k] ------------------ 153| 1| return if_match(oid, {1, 2, 156, 10197, 1, 301, 3}, "SM2_Enc"); 154| 1| case 0x21960: ------------------ | Branch (154:7): [True: 1, False: 12.3k] ------------------ 155| 1| return if_match(oid, {1, 3, 36, 3, 3, 1, 2}, "RSA/PKCS1v15(RIPEMD-160)"); 156| 1| case 0x2198A: ------------------ | Branch (156:7): [True: 1, False: 12.3k] ------------------ 157| 1| return if_match(oid, {1, 2, 840, 113533, 7, 66, 10}, "CAST-128/CBC"); 158| 1| case 0x2198F: ------------------ | Branch (158:7): [True: 1, False: 12.3k] ------------------ 159| 1| return if_match(oid, {1, 2, 840, 113533, 7, 66, 15}, "KeyWrap.CAST-128"); 160| 33| case 0x227C0: ------------------ | Branch (160:7): [True: 33, False: 12.3k] ------------------ 161| 33| return if_match(oid, {1, 3, 101, 110}, "X25519"); 162| 9| case 0x227C1: ------------------ | Branch (162:7): [True: 9, False: 12.3k] ------------------ 163| 9| return if_match(oid, {1, 3, 101, 111}, "X448"); 164| 85| case 0x227C2: ------------------ | Branch (164:7): [True: 85, False: 12.2k] ------------------ 165| 85| return if_match(oid, {1, 3, 101, 112}, "Ed25519"); 166| 11| case 0x227C3: ------------------ | Branch (166:7): [True: 11, False: 12.3k] ------------------ 167| 11| return if_match(oid, {1, 3, 101, 113}, "Ed448"); 168| 1| case 0x27565: ------------------ | Branch (168:7): [True: 1, False: 12.3k] ------------------ 169| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 1}, "PKIX.OCSP.BasicResponse"); 170| 1| case 0x27566: ------------------ | Branch (170:7): [True: 1, False: 12.3k] ------------------ 171| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 2}, "PKIX.OCSP.Nonce"); 172| 1| case 0x27569: ------------------ | Branch (172:7): [True: 1, False: 12.3k] ------------------ 173| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 5}, "PKIX.OCSP.NoCheck"); 174| 1| case 0x29F7C: ------------------ | Branch (174:7): [True: 1, False: 12.3k] ------------------ 175| 1| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 3}, "ECKCDSA/SHA-1"); 176| 1| case 0x29F7D: ------------------ | Branch (176:7): [True: 1, False: 12.3k] ------------------ 177| 1| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 4}, "ECKCDSA/SHA-224"); 178| 1| case 0x29F7E: ------------------ | Branch (178:7): [True: 1, False: 12.3k] ------------------ 179| 1| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 5}, "ECKCDSA/SHA-256"); 180| 1| case 0x2AC3B: ------------------ | Branch (180:7): [True: 1, False: 12.3k] ------------------ 181| 1| return if_match(oid, {2, 5, 29, 32, 0}, "X509v3.AnyPolicy"); 182| 1| case 0x2B000: ------------------ | Branch (182:7): [True: 1, False: 12.3k] ------------------ 183| 1| return if_match(oid, {2, 5, 29, 37, 0}, "X509v3.AnyExtendedKeyUsage"); 184| 5.01k| case 0x2B5C9: ------------------ | Branch (184:7): [True: 5.01k, False: 7.36k] ------------------ 185| 5.01k| return if_match(oid, {1, 2, 840, 10045, 2, 1}, "ECDSA"); 186| 3| case 0x2B74B: ------------------ | Branch (186:7): [True: 3, False: 12.3k] ------------------ 187| 3| return if_match(oid, {1, 2, 840, 10045, 4, 1}, "ECDSA/SHA-1"); 188| 399| case 0x3474A: ------------------ | Branch (188:7): [True: 399, False: 11.9k] ------------------ 189| 399| return if_match(oid, {1, 2, 840, 10046, 2, 1}, "DH"); 190| 1| case 0x38D6D: ------------------ | Branch (190:7): [True: 1, False: 12.3k] ------------------ 191| 1| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 1, 1}, "gost_256A"); 192| 1| case 0x38D6E: ------------------ | Branch (192:7): [True: 1, False: 12.3k] ------------------ 193| 1| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 1, 2}, "gost_256B"); 194| 1| case 0x38E2E: ------------------ | Branch (194:7): [True: 1, False: 12.3k] ------------------ 195| 1| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 2, 1}, "gost_512A"); 196| 1| case 0x38E2F: ------------------ | Branch (196:7): [True: 1, False: 12.3k] ------------------ 197| 1| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 2, 2}, "gost_512B"); 198| 3| case 0x38F2C: ------------------ | Branch (198:7): [True: 3, False: 12.3k] ------------------ 199| 3| return if_match(oid, {1, 2, 643, 2, 2, 3}, "GOST-34.10/GOST-R-34.11-94"); 200| 3| case 0x38F3C: ------------------ | Branch (200:7): [True: 3, False: 12.3k] ------------------ 201| 3| return if_match(oid, {1, 2, 643, 2, 2, 19}, "GOST-34.10"); 202| 1| case 0x3D7B8: ------------------ | Branch (202:7): [True: 1, False: 12.3k] ------------------ 203| 1| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 6}, "Camellia-128/GCM"); 204| 1| case 0x3D7CC: ------------------ | Branch (204:7): [True: 1, False: 12.3k] ------------------ 205| 1| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 26}, "Camellia-192/GCM"); 206| 1| case 0x3D7E0: ------------------ | Branch (206:7): [True: 1, False: 12.3k] ------------------ 207| 1| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 46}, "Camellia-256/GCM"); 208| 3| case 0x3F20F: ------------------ | Branch (208:7): [True: 3, False: 12.3k] ------------------ 209| 3| return if_match(oid, {1, 3, 36, 3, 2, 1}, "RIPEMD-160"); 210| 1| case 0x4266E: ------------------ | Branch (210:7): [True: 1, False: 12.3k] ------------------ 211| 1| return if_match(oid, {0, 4, 0, 127, 0, 15, 1, 1, 13, 0}, "XMSS"); 212| 1| case 0x478C4: ------------------ | Branch (212:7): [True: 1, False: 12.3k] ------------------ 213| 1| return if_match(oid, {1, 2, 410, 200004, 1, 4}, "SEED/CBC"); 214| 1| case 0x47D98: ------------------ | Branch (214:7): [True: 1, False: 12.3k] ------------------ 215| 1| return if_match(oid, {1, 2, 156, 10197, 1, 301}, "sm2p256v1"); 216| 1| case 0x47DFC: ------------------ | Branch (216:7): [True: 1, False: 12.3k] ------------------ 217| 1| return if_match(oid, {1, 2, 156, 10197, 1, 401}, "SM3"); 218| 1| case 0x47E60: ------------------ | Branch (218:7): [True: 1, False: 12.3k] ------------------ 219| 1| return if_match(oid, {1, 2, 156, 10197, 1, 501}, "SM2_Sig/SM3"); 220| 1| case 0x47E63: ------------------ | Branch (220:7): [True: 1, False: 12.3k] ------------------ 221| 1| return if_match(oid, {1, 2, 156, 10197, 1, 504}, "RSA/PKCS1v15(SM3)"); 222| 1| case 0x52B13: ------------------ | Branch (222:7): [True: 1, False: 12.3k] ------------------ 223| 1| return if_match(oid, {1, 2, 643, 3, 131, 1, 1}, "GOST.INN"); 224| 1| case 0x635AE: ------------------ | Branch (224:7): [True: 1, False: 12.3k] ------------------ 225| 1| return if_match(oid, {1, 2, 250, 1, 223, 101, 256, 1}, "frp256v1"); 226| 1| case 0x6A784: ------------------ | Branch (226:7): [True: 1, False: 12.3k] ------------------ 227| 1| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 1}, "PKCS12.KeyBag"); 228| 1| case 0x6A785: ------------------ | Branch (228:7): [True: 1, False: 12.3k] ------------------ 229| 1| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 2}, "PKCS12.PKCS8ShroudedKeyBag"); 230| 1| case 0x6A786: ------------------ | Branch (230:7): [True: 1, False: 12.3k] ------------------ 231| 1| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 3}, "PKCS12.CertBag"); 232| 1| case 0x6A787: ------------------ | Branch (232:7): [True: 1, False: 12.3k] ------------------ 233| 1| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 4}, "PKCS12.CRLBag"); 234| 2| case 0x6A788: ------------------ | Branch (234:7): [True: 2, False: 12.3k] ------------------ 235| 2| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 5}, "PKCS12.SecretBag"); 236| 1| case 0x6A789: ------------------ | Branch (236:7): [True: 1, False: 12.3k] ------------------ 237| 1| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 6}, "PKCS12.SafeContentsBag"); 238| 1| case 0x6EB86: ------------------ | Branch (238:7): [True: 1, False: 12.3k] ------------------ 239| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 6, 1}, "GOST-34.10-2012-256/SHA-256"); 240| 2| case 0x6EC47: ------------------ | Branch (240:7): [True: 2, False: 12.3k] ------------------ 241| 2| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 1}, "Kyber-512-r3"); 242| 1| case 0x6EC48: ------------------ | Branch (242:7): [True: 1, False: 12.3k] ------------------ 243| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 2}, "Kyber-768-r3"); 244| 2| case 0x6EC49: ------------------ | Branch (244:7): [True: 2, False: 12.3k] ------------------ 245| 2| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 3}, "Kyber-1024-r3"); 246| 1| case 0x6EDC9: ------------------ | Branch (246:7): [True: 1, False: 12.3k] ------------------ 247| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 1}, "Dilithium-4x4-r3"); 248| 1| case 0x6EDCA: ------------------ | Branch (248:7): [True: 1, False: 12.3k] ------------------ 249| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 2}, "Dilithium-6x5-r3"); 250| 1| case 0x6EDCB: ------------------ | Branch (250:7): [True: 1, False: 12.3k] ------------------ 251| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 3}, "Dilithium-8x7-r3"); 252| 1| case 0x6EE8A: ------------------ | Branch (252:7): [True: 1, False: 12.3k] ------------------ 253| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 1}, "Dilithium-4x4-AES-r3"); 254| 1| case 0x6EE8B: ------------------ | Branch (254:7): [True: 1, False: 12.3k] ------------------ 255| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 2}, "Dilithium-6x5-AES-r3"); 256| 1| case 0x6EE8C: ------------------ | Branch (256:7): [True: 1, False: 12.3k] ------------------ 257| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 3}, "Dilithium-8x7-AES-r3"); 258| 1| case 0x6EF4B: ------------------ | Branch (258:7): [True: 1, False: 12.3k] ------------------ 259| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 1}, "Kyber-512-90s-r3"); 260| 1| case 0x6EF4C: ------------------ | Branch (260:7): [True: 1, False: 12.3k] ------------------ 261| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 2}, "Kyber-768-90s-r3"); 262| 1| case 0x6EF4D: ------------------ | Branch (262:7): [True: 1, False: 12.3k] ------------------ 263| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 3}, "Kyber-1024-90s-r3"); 264| 1| case 0x6F18E: ------------------ | Branch (264:7): [True: 1, False: 12.3k] ------------------ 265| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 1}, "FrodoKEM-640-SHAKE"); 266| 1| case 0x6F18F: ------------------ | Branch (266:7): [True: 1, False: 12.3k] ------------------ 267| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 2}, "FrodoKEM-976-SHAKE"); 268| 1| case 0x6F190: ------------------ | Branch (268:7): [True: 1, False: 12.3k] ------------------ 269| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 3}, "FrodoKEM-1344-SHAKE"); 270| 1| case 0x6F24F: ------------------ | Branch (270:7): [True: 1, False: 12.3k] ------------------ 271| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 1}, "FrodoKEM-640-AES"); 272| 2| case 0x6F250: ------------------ | Branch (272:7): [True: 2, False: 12.3k] ------------------ 273| 2| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 2}, "FrodoKEM-976-AES"); 274| 1| case 0x6F251: ------------------ | Branch (274:7): [True: 1, False: 12.3k] ------------------ 275| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 3}, "FrodoKEM-1344-AES"); 276| 1| case 0x6F310: ------------------ | Branch (276:7): [True: 1, False: 12.3k] ------------------ 277| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 1}, "eFrodoKEM-640-SHAKE"); 278| 1| case 0x6F311: ------------------ | Branch (278:7): [True: 1, False: 12.3k] ------------------ 279| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 2}, "eFrodoKEM-976-SHAKE"); 280| 1| case 0x6F312: ------------------ | Branch (280:7): [True: 1, False: 12.3k] ------------------ 281| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 3}, "eFrodoKEM-1344-SHAKE"); 282| 1| case 0x6F3D1: ------------------ | Branch (282:7): [True: 1, False: 12.3k] ------------------ 283| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 1}, "eFrodoKEM-640-AES"); 284| 1| case 0x6F3D2: ------------------ | Branch (284:7): [True: 1, False: 12.3k] ------------------ 285| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 2}, "eFrodoKEM-976-AES"); 286| 2| case 0x6F3D3: ------------------ | Branch (286:7): [True: 2, False: 12.3k] ------------------ 287| 2| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 3}, "eFrodoKEM-1344-AES"); 288| 1| case 0x6F492: ------------------ | Branch (288:7): [True: 1, False: 12.3k] ------------------ 289| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 1}, "ClassicMcEliece_6688128pc"); 290| 1| case 0x6F493: ------------------ | Branch (290:7): [True: 1, False: 12.3k] ------------------ 291| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 2}, "ClassicMcEliece_6688128pcf"); 292| 1| case 0x6F494: ------------------ | Branch (292:7): [True: 1, False: 12.3k] ------------------ 293| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 3}, "ClassicMcEliece_6960119pc"); 294| 1| case 0x6F495: ------------------ | Branch (294:7): [True: 1, False: 12.3k] ------------------ 295| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 4}, "ClassicMcEliece_6960119pcf"); 296| 1| case 0x6F496: ------------------ | Branch (296:7): [True: 1, False: 12.3k] ------------------ 297| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 5}, "ClassicMcEliece_8192128pc"); 298| 1| case 0x6F497: ------------------ | Branch (298:7): [True: 1, False: 12.3k] ------------------ 299| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 6}, "ClassicMcEliece_8192128pcf"); 300| 1| case 0x6F79D: ------------------ | Branch (300:7): [True: 1, False: 12.3k] ------------------ 301| 1| return if_match(oid, {2, 16, 840, 1, 113730, 1, 13}, "Certificate Comment"); 302| 1| case 0x701A0: ------------------ | Branch (302:7): [True: 1, False: 12.3k] ------------------ 303| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 2, 1}, "ECGDSA"); 304| 1| case 0x70322: ------------------ | Branch (304:7): [True: 1, False: 12.3k] ------------------ 305| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 1}, "ECGDSA/RIPEMD-160"); 306| 1| case 0x70323: ------------------ | Branch (306:7): [True: 1, False: 12.3k] ------------------ 307| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 2}, "ECGDSA/SHA-1"); 308| 1| case 0x70324: ------------------ | Branch (308:7): [True: 1, False: 12.3k] ------------------ 309| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 3}, "ECGDSA/SHA-224"); 310| 1| case 0x70325: ------------------ | Branch (310:7): [True: 1, False: 12.3k] ------------------ 311| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 4}, "ECGDSA/SHA-256"); 312| 1| case 0x70326: ------------------ | Branch (312:7): [True: 1, False: 12.3k] ------------------ 313| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 5}, "ECGDSA/SHA-384"); 314| 1| case 0x70327: ------------------ | Branch (314:7): [True: 1, False: 12.3k] ------------------ 315| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 6}, "ECGDSA/SHA-512"); 316| 1| case 0x72B21: ------------------ | Branch (316:7): [True: 1, False: 12.3k] ------------------ 317| 1| return if_match(oid, {1, 2, 643, 7, 1, 1, 1, 1}, "GOST-34.10-2012-256"); 318| 1| case 0x72B22: ------------------ | Branch (318:7): [True: 1, False: 12.3k] ------------------ 319| 1| return if_match(oid, {1, 2, 643, 7, 1, 1, 1, 2}, "GOST-34.10-2012-512"); 320| 1| case 0x72BE3: ------------------ | Branch (320:7): [True: 1, False: 12.3k] ------------------ 321| 1| return if_match(oid, {1, 2, 643, 7, 1, 1, 2, 2}, "Streebog-256"); 322| 1| case 0x72BE4: ------------------ | Branch (322:7): [True: 1, False: 12.3k] ------------------ 323| 1| return if_match(oid, {1, 2, 643, 7, 1, 1, 2, 3}, "Streebog-512"); 324| 2| case 0x72CA4: ------------------ | Branch (324:7): [True: 2, False: 12.3k] ------------------ 325| 2| return if_match(oid, {1, 2, 643, 7, 1, 1, 3, 2}, "GOST-34.10-2012-256/Streebog-256"); 326| 1| case 0x72CA5: ------------------ | Branch (326:7): [True: 1, False: 12.3k] ------------------ 327| 1| return if_match(oid, {1, 2, 643, 7, 1, 1, 3, 3}, "GOST-34.10-2012-512/Streebog-512"); 328| 1| case 0x7C7C7: ------------------ | Branch (328:7): [True: 1, False: 12.3k] ------------------ 329| 1| return if_match(oid, {1, 2, 840, 113549, 1, 9, 22, 1}, "PKCS9.X509Certificate"); 330| 1| case 0x7C7C8: ------------------ | Branch (330:7): [True: 1, False: 12.3k] ------------------ 331| 1| return if_match(oid, {1, 2, 840, 113549, 1, 9, 22, 2}, "PKCS9.SDSICertificate"); 332| 1| case 0x7C888: ------------------ | Branch (332:7): [True: 1, False: 12.3k] ------------------ 333| 1| return if_match(oid, {1, 2, 840, 113549, 1, 9, 23, 1}, "PKCS9.X509CRL"); 334| 3| case 0x7E10F: ------------------ | Branch (334:7): [True: 3, False: 12.3k] ------------------ 335| 3| return if_match(oid, {2, 5, 4, 3}, "X520.CommonName"); 336| 3| case 0x7E110: ------------------ | Branch (336:7): [True: 3, False: 12.3k] ------------------ 337| 3| return if_match(oid, {2, 5, 4, 4}, "X520.Surname"); 338| 4| case 0x7E111: ------------------ | Branch (338:7): [True: 4, False: 12.3k] ------------------ 339| 4| return if_match(oid, {2, 5, 4, 5}, "X520.SerialNumber"); 340| 3| case 0x7E112: ------------------ | Branch (340:7): [True: 3, False: 12.3k] ------------------ 341| 3| return if_match(oid, {2, 5, 4, 6}, "X520.Country"); 342| 3| case 0x7E113: ------------------ | Branch (342:7): [True: 3, False: 12.3k] ------------------ 343| 3| return if_match(oid, {2, 5, 4, 7}, "X520.Locality"); 344| 3| case 0x7E114: ------------------ | Branch (344:7): [True: 3, False: 12.3k] ------------------ 345| 3| return if_match(oid, {2, 5, 4, 8}, "X520.State"); 346| 3| case 0x7E115: ------------------ | Branch (346:7): [True: 3, False: 12.3k] ------------------ 347| 3| return if_match(oid, {2, 5, 4, 9}, "X520.StreetAddress"); 348| 3| case 0x7E116: ------------------ | Branch (348:7): [True: 3, False: 12.3k] ------------------ 349| 3| return if_match(oid, {2, 5, 4, 10}, "X520.Organization"); 350| 3| case 0x7E117: ------------------ | Branch (350:7): [True: 3, False: 12.3k] ------------------ 351| 3| return if_match(oid, {2, 5, 4, 11}, "X520.OrganizationalUnit"); 352| 3| case 0x7E118: ------------------ | Branch (352:7): [True: 3, False: 12.3k] ------------------ 353| 3| return if_match(oid, {2, 5, 4, 12}, "X520.Title"); 354| 3| case 0x7E136: ------------------ | Branch (354:7): [True: 3, False: 12.3k] ------------------ 355| 3| return if_match(oid, {2, 5, 4, 42}, "X520.GivenName"); 356| 3| case 0x7E137: ------------------ | Branch (356:7): [True: 3, False: 12.3k] ------------------ 357| 3| return if_match(oid, {2, 5, 4, 43}, "X520.Initials"); 358| 3| case 0x7E138: ------------------ | Branch (358:7): [True: 3, False: 12.3k] ------------------ 359| 3| return if_match(oid, {2, 5, 4, 44}, "X520.GenerationalQualifier"); 360| 4| case 0x7E13A: ------------------ | Branch (360:7): [True: 4, False: 12.3k] ------------------ 361| 4| return if_match(oid, {2, 5, 4, 46}, "X520.DNQualifier"); 362| 3| case 0x7E14D: ------------------ | Branch (362:7): [True: 3, False: 12.3k] ------------------ 363| 3| return if_match(oid, {2, 5, 4, 65}, "X520.Pseudonym"); 364| 3| case 0x7F3F3: ------------------ | Branch (364:7): [True: 3, False: 12.3k] ------------------ 365| 3| return if_match(oid, {2, 5, 29, 14}, "X509v3.SubjectKeyIdentifier"); 366| 4| case 0x7F3F4: ------------------ | Branch (366:7): [True: 4, False: 12.3k] ------------------ 367| 4| return if_match(oid, {2, 5, 29, 15}, "X509v3.KeyUsage"); 368| 3| case 0x7F3F5: ------------------ | Branch (368:7): [True: 3, False: 12.3k] ------------------ 369| 3| return if_match(oid, {2, 5, 29, 16}, "X509v3.PrivateKeyUsagePeriod"); 370| 3| case 0x7F3F6: ------------------ | Branch (370:7): [True: 3, False: 12.3k] ------------------ 371| 3| return if_match(oid, {2, 5, 29, 17}, "X509v3.SubjectAlternativeName"); 372| 3| case 0x7F3F7: ------------------ | Branch (372:7): [True: 3, False: 12.3k] ------------------ 373| 3| return if_match(oid, {2, 5, 29, 18}, "X509v3.IssuerAlternativeName"); 374| 3| case 0x7F3F8: ------------------ | Branch (374:7): [True: 3, False: 12.3k] ------------------ 375| 3| return if_match(oid, {2, 5, 29, 19}, "X509v3.BasicConstraints"); 376| 3| case 0x7F3F9: ------------------ | Branch (376:7): [True: 3, False: 12.3k] ------------------ 377| 3| return if_match(oid, {2, 5, 29, 20}, "X509v3.CRLNumber"); 378| 3| case 0x7F3FA: ------------------ | Branch (378:7): [True: 3, False: 12.3k] ------------------ 379| 3| return if_match(oid, {2, 5, 29, 21}, "X509v3.ReasonCode"); 380| 3| case 0x7F3FC: ------------------ | Branch (380:7): [True: 3, False: 12.3k] ------------------ 381| 3| return if_match(oid, {2, 5, 29, 23}, "X509v3.HoldInstructionCode"); 382| 3| case 0x7F3FD: ------------------ | Branch (382:7): [True: 3, False: 12.3k] ------------------ 383| 3| return if_match(oid, {2, 5, 29, 24}, "X509v3.InvalidityDate"); 384| 3| case 0x7F401: ------------------ | Branch (384:7): [True: 3, False: 12.3k] ------------------ 385| 3| return if_match(oid, {2, 5, 29, 28}, "X509v3.CRLIssuingDistributionPoint"); 386| 3| case 0x7F403: ------------------ | Branch (386:7): [True: 3, False: 12.3k] ------------------ 387| 3| return if_match(oid, {2, 5, 29, 30}, "X509v3.NameConstraints"); 388| 5| case 0x7F404: ------------------ | Branch (388:7): [True: 5, False: 12.3k] ------------------ 389| 5| return if_match(oid, {2, 5, 29, 31}, "X509v3.CRLDistributionPoints"); 390| 3| case 0x7F405: ------------------ | Branch (390:7): [True: 3, False: 12.3k] ------------------ 391| 3| return if_match(oid, {2, 5, 29, 32}, "X509v3.CertificatePolicies"); 392| 3| case 0x7F408: ------------------ | Branch (392:7): [True: 3, False: 12.3k] ------------------ 393| 3| return if_match(oid, {2, 5, 29, 35}, "X509v3.AuthorityKeyIdentifier"); 394| 3| case 0x7F409: ------------------ | Branch (394:7): [True: 3, False: 12.3k] ------------------ 395| 3| return if_match(oid, {2, 5, 29, 36}, "X509v3.PolicyConstraints"); 396| 3| case 0x7F40A: ------------------ | Branch (396:7): [True: 3, False: 12.3k] ------------------ 397| 3| return if_match(oid, {2, 5, 29, 37}, "X509v3.ExtendedKeyUsage"); 398| 3| case 0x7F41D: ------------------ | Branch (398:7): [True: 3, False: 12.3k] ------------------ 399| 3| return if_match(oid, {2, 5, 29, 56}, "X509v3.NoRevocationAvailable"); 400| 1| case 0x80B84: ------------------ | Branch (400:7): [True: 1, False: 12.3k] ------------------ 401| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 1}, "AES-128/OCB"); 402| 1| case 0x80B85: ------------------ | Branch (402:7): [True: 1, False: 12.3k] ------------------ 403| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 2}, "AES-192/OCB"); 404| 1| case 0x80B86: ------------------ | Branch (404:7): [True: 1, False: 12.3k] ------------------ 405| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 3}, "AES-256/OCB"); 406| 1| case 0x80B87: ------------------ | Branch (406:7): [True: 1, False: 12.3k] ------------------ 407| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 4}, "Serpent/OCB"); 408| 1| case 0x80B88: ------------------ | Branch (408:7): [True: 1, False: 12.3k] ------------------ 409| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 5}, "Twofish/OCB"); 410| 1| case 0x80B89: ------------------ | Branch (410:7): [True: 1, False: 12.3k] ------------------ 411| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 6}, "Camellia-128/OCB"); 412| 1| case 0x80B8A: ------------------ | Branch (412:7): [True: 1, False: 12.3k] ------------------ 413| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 7}, "Camellia-192/OCB"); 414| 1| case 0x80B8B: ------------------ | Branch (414:7): [True: 1, False: 12.3k] ------------------ 415| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 8}, "Camellia-256/OCB"); 416| 1| case 0x80D06: ------------------ | Branch (416:7): [True: 1, False: 12.3k] ------------------ 417| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 1}, "AES-128/SIV"); 418| 2| case 0x80D07: ------------------ | Branch (418:7): [True: 2, False: 12.3k] ------------------ 419| 2| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 2}, "AES-192/SIV"); 420| 1| case 0x80D08: ------------------ | Branch (420:7): [True: 1, False: 12.3k] ------------------ 421| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 3}, "AES-256/SIV"); 422| 1| case 0x80D09: ------------------ | Branch (422:7): [True: 1, False: 12.3k] ------------------ 423| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 4}, "Serpent/SIV"); 424| 1| case 0x80D0A: ------------------ | Branch (424:7): [True: 1, False: 12.3k] ------------------ 425| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 5}, "Twofish/SIV"); 426| 1| case 0x80D0B: ------------------ | Branch (426:7): [True: 1, False: 12.3k] ------------------ 427| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 6}, "Camellia-128/SIV"); 428| 1| case 0x80D0C: ------------------ | Branch (428:7): [True: 1, False: 12.3k] ------------------ 429| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 7}, "Camellia-192/SIV"); 430| 1| case 0x80D0D: ------------------ | Branch (430:7): [True: 1, False: 12.3k] ------------------ 431| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 8}, "Camellia-256/SIV"); 432| 1| case 0x80D0E: ------------------ | Branch (432:7): [True: 1, False: 12.3k] ------------------ 433| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 9}, "SM4/SIV"); 434| 1| case 0x84C6A: ------------------ | Branch (434:7): [True: 1, False: 12.3k] ------------------ 435| 1| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 2}, "Camellia-128/CBC"); 436| 1| case 0x84C6B: ------------------ | Branch (436:7): [True: 1, False: 12.3k] ------------------ 437| 1| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 3}, "Camellia-192/CBC"); 438| 1| case 0x84C6C: ------------------ | Branch (438:7): [True: 1, False: 12.3k] ------------------ 439| 1| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 4}, "Camellia-256/CBC"); 440| 1| case 0x88CD3: ------------------ | Branch (440:7): [True: 1, False: 12.3k] ------------------ 441| 1| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 6}, "KeyWrap.TripleDES"); 442| 1| case 0x88CD5: ------------------ | Branch (442:7): [True: 1, False: 12.3k] ------------------ 443| 1| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 8}, "Compression.Zlib"); 444| 1| case 0x88CDE: ------------------ | Branch (444:7): [True: 1, False: 12.3k] ------------------ 445| 1| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 17}, "HSS-LMS"); 446| 1| case 0x88CDF: ------------------ | Branch (446:7): [True: 1, False: 12.3k] ------------------ 447| 1| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 18}, "ChaCha20Poly1305"); 448| 3| case 0x92296: ------------------ | Branch (448:7): [True: 3, False: 12.3k] ------------------ 449| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 2}, "AES-128/CBC"); 450| 3| case 0x92299: ------------------ | Branch (450:7): [True: 3, False: 12.3k] ------------------ 451| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 5}, "KeyWrap.AES-128"); 452| 3| case 0x9229A: ------------------ | Branch (452:7): [True: 3, False: 12.3k] ------------------ 453| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 6}, "AES-128/GCM"); 454| 3| case 0x9229B: ------------------ | Branch (454:7): [True: 3, False: 12.3k] ------------------ 455| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 7}, "AES-128/CCM"); 456| 3| case 0x922AA: ------------------ | Branch (456:7): [True: 3, False: 12.3k] ------------------ 457| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 22}, "AES-192/CBC"); 458| 3| case 0x922AD: ------------------ | Branch (458:7): [True: 3, False: 12.3k] ------------------ 459| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 25}, "KeyWrap.AES-192"); 460| 3| case 0x922AE: ------------------ | Branch (460:7): [True: 3, False: 12.3k] ------------------ 461| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 26}, "AES-192/GCM"); 462| 3| case 0x922AF: ------------------ | Branch (462:7): [True: 3, False: 12.3k] ------------------ 463| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 27}, "AES-192/CCM"); 464| 3| case 0x922BE: ------------------ | Branch (464:7): [True: 3, False: 12.3k] ------------------ 465| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 42}, "AES-256/CBC"); 466| 3| case 0x922C1: ------------------ | Branch (466:7): [True: 3, False: 12.3k] ------------------ 467| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 45}, "KeyWrap.AES-256"); 468| 3| case 0x922C2: ------------------ | Branch (468:7): [True: 3, False: 12.3k] ------------------ 469| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 46}, "AES-256/GCM"); 470| 3| case 0x922C3: ------------------ | Branch (470:7): [True: 3, False: 12.3k] ------------------ 471| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 47}, "AES-256/CCM"); 472| 3| case 0x92356: ------------------ | Branch (472:7): [True: 3, False: 12.3k] ------------------ 473| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 1}, "SHA-256"); 474| 3| case 0x92357: ------------------ | Branch (474:7): [True: 3, False: 12.3k] ------------------ 475| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 2}, "SHA-384"); 476| 3| case 0x92358: ------------------ | Branch (476:7): [True: 3, False: 12.3k] ------------------ 477| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 3}, "SHA-512"); 478| 3| case 0x92359: ------------------ | Branch (478:7): [True: 3, False: 12.3k] ------------------ 479| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 4}, "SHA-224"); 480| 3| case 0x9235B: ------------------ | Branch (480:7): [True: 3, False: 12.3k] ------------------ 481| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 6}, "SHA-512-256"); 482| 3| case 0x9235C: ------------------ | Branch (482:7): [True: 3, False: 12.3k] ------------------ 483| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 7}, "SHA-3(224)"); 484| 3| case 0x9235D: ------------------ | Branch (484:7): [True: 3, False: 12.3k] ------------------ 485| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 8}, "SHA-3(256)"); 486| 4| case 0x9235E: ------------------ | Branch (486:7): [True: 4, False: 12.3k] ------------------ 487| 4| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 9}, "SHA-3(384)"); 488| 3| case 0x9235F: ------------------ | Branch (488:7): [True: 3, False: 12.3k] ------------------ 489| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 10}, "SHA-3(512)"); 490| 3| case 0x92360: ------------------ | Branch (490:7): [True: 3, False: 12.3k] ------------------ 491| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 11}, "SHAKE-128"); 492| 3| case 0x92361: ------------------ | Branch (492:7): [True: 3, False: 12.3k] ------------------ 493| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 12}, "SHAKE-256"); 494| 3| case 0x92417: ------------------ | Branch (494:7): [True: 3, False: 12.3k] ------------------ 495| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 1}, "DSA/SHA-224"); 496| 3| case 0x92418: ------------------ | Branch (496:7): [True: 3, False: 12.3k] ------------------ 497| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 2}, "DSA/SHA-256"); 498| 3| case 0x92419: ------------------ | Branch (498:7): [True: 3, False: 12.3k] ------------------ 499| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 3}, "DSA/SHA-384"); 500| 3| case 0x9241A: ------------------ | Branch (500:7): [True: 3, False: 12.3k] ------------------ 501| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 4}, "DSA/SHA-512"); 502| 3| case 0x9241B: ------------------ | Branch (502:7): [True: 3, False: 12.3k] ------------------ 503| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 5}, "DSA/SHA-3(224)"); 504| 3| case 0x9241C: ------------------ | Branch (504:7): [True: 3, False: 12.3k] ------------------ 505| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 6}, "DSA/SHA-3(256)"); 506| 3| case 0x9241D: ------------------ | Branch (506:7): [True: 3, False: 12.3k] ------------------ 507| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 7}, "DSA/SHA-3(384)"); 508| 3| case 0x9241E: ------------------ | Branch (508:7): [True: 3, False: 12.3k] ------------------ 509| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 8}, "DSA/SHA-3(512)"); 510| 3| case 0x9241F: ------------------ | Branch (510:7): [True: 3, False: 12.3k] ------------------ 511| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 9}, "ECDSA/SHA-3(224)"); 512| 4| case 0x92420: ------------------ | Branch (512:7): [True: 4, False: 12.3k] ------------------ 513| 4| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 10}, "ECDSA/SHA-3(256)"); 514| 3| case 0x92421: ------------------ | Branch (514:7): [True: 3, False: 12.3k] ------------------ 515| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 11}, "ECDSA/SHA-3(384)"); 516| 3| case 0x92422: ------------------ | Branch (516:7): [True: 3, False: 12.3k] ------------------ 517| 3| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 12}, "ECDSA/SHA-3(512)"); 518| 64| case 0x92423: ------------------ | Branch (518:7): [True: 64, False: 12.3k] ------------------ 519| 64| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 13}, "RSA/PKCS1v15(SHA-3(224))"); 520| 34| case 0x92424: ------------------ | Branch (520:7): [True: 34, False: 12.3k] ------------------ 521| 34| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 14}, "RSA/PKCS1v15(SHA-3(256))"); 522| 10| case 0x92425: ------------------ | Branch (522:7): [True: 10, False: 12.3k] ------------------ 523| 10| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 15}, "RSA/PKCS1v15(SHA-3(384))"); 524| 4| case 0x92426: ------------------ | Branch (524:7): [True: 4, False: 12.3k] ------------------ 525| 4| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 16}, "RSA/PKCS1v15(SHA-3(512))"); 526| 43| case 0x92427: ------------------ | Branch (526:7): [True: 43, False: 12.3k] ------------------ 527| 43| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 17}, "ML-DSA-4x4"); 528| 121| case 0x92428: ------------------ | Branch (528:7): [True: 121, False: 12.2k] ------------------ 529| 121| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 18}, "ML-DSA-6x5"); 530| 70| case 0x92429: ------------------ | Branch (530:7): [True: 70, False: 12.3k] ------------------ 531| 70| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 19}, "ML-DSA-8x7"); 532| 25| case 0x9242A: ------------------ | Branch (532:7): [True: 25, False: 12.3k] ------------------ 533| 25| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 20}, "SLH-DSA-SHA2-128s"); 534| 5| case 0x9242B: ------------------ | Branch (534:7): [True: 5, False: 12.3k] ------------------ 535| 5| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 21}, "SLH-DSA-SHA2-128f"); 536| 9| case 0x9242C: ------------------ | Branch (536:7): [True: 9, False: 12.3k] ------------------ 537| 9| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 22}, "SLH-DSA-SHA2-192s"); 538| 9| case 0x9242D: ------------------ | Branch (538:7): [True: 9, False: 12.3k] ------------------ 539| 9| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 23}, "SLH-DSA-SHA2-192f"); 540| 5| case 0x9242E: ------------------ | Branch (540:7): [True: 5, False: 12.3k] ------------------ 541| 5| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 24}, "SLH-DSA-SHA2-256s"); 542| 5| case 0x9242F: ------------------ | Branch (542:7): [True: 5, False: 12.3k] ------------------ 543| 5| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 25}, "SLH-DSA-SHA2-256f"); 544| 5| case 0x92430: ------------------ | Branch (544:7): [True: 5, False: 12.3k] ------------------ 545| 5| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 26}, "SLH-DSA-SHAKE-128s"); 546| 13| case 0x92431: ------------------ | Branch (546:7): [True: 13, False: 12.3k] ------------------ 547| 13| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 27}, "SLH-DSA-SHAKE-128f"); 548| 5| case 0x92432: ------------------ | Branch (548:7): [True: 5, False: 12.3k] ------------------ 549| 5| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 28}, "SLH-DSA-SHAKE-192s"); 550| 5| case 0x92433: ------------------ | Branch (550:7): [True: 5, False: 12.3k] ------------------ 551| 5| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 29}, "SLH-DSA-SHAKE-192f"); 552| 5| case 0x92434: ------------------ | Branch (552:7): [True: 5, False: 12.3k] ------------------ 553| 5| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 30}, "SLH-DSA-SHAKE-256s"); 554| 5| case 0x92435: ------------------ | Branch (554:7): [True: 5, False: 12.3k] ------------------ 555| 5| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 31}, "SLH-DSA-SHAKE-256f"); 556| 43| case 0x924D8: ------------------ | Branch (556:7): [True: 43, False: 12.3k] ------------------ 557| 43| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 1}, "ML-KEM-512"); 558| 43| case 0x924D9: ------------------ | Branch (558:7): [True: 43, False: 12.3k] ------------------ 559| 43| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 2}, "ML-KEM-768"); 560| 79| case 0x924DA: ------------------ | Branch (560:7): [True: 79, False: 12.3k] ------------------ 561| 79| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 3}, "ML-KEM-1024"); 562| 1| case 0x9479F: ------------------ | Branch (562:7): [True: 1, False: 12.3k] ------------------ 563| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 1}, "PKIX.AuthorityInformationAccess"); 564| 1| case 0x947A5: ------------------ | Branch (564:7): [True: 1, False: 12.3k] ------------------ 565| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 7}, "PKIX.IpAddrBlocks"); 566| 1| case 0x947A6: ------------------ | Branch (566:7): [True: 1, False: 12.3k] ------------------ 567| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 8}, "PKIX.AutonomousSysIds"); 568| 1| case 0x947B8: ------------------ | Branch (568:7): [True: 1, False: 12.3k] ------------------ 569| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 26}, "PKIX.TNAuthList"); 570| 1| case 0x94921: ------------------ | Branch (570:7): [True: 1, False: 12.3k] ------------------ 571| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 1}, "PKIX.ServerAuth"); 572| 1| case 0x94922: ------------------ | Branch (572:7): [True: 1, False: 12.3k] ------------------ 573| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 2}, "PKIX.ClientAuth"); 574| 1| case 0x94923: ------------------ | Branch (574:7): [True: 1, False: 12.3k] ------------------ 575| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 3}, "PKIX.CodeSigning"); 576| 1| case 0x94924: ------------------ | Branch (576:7): [True: 1, False: 12.3k] ------------------ 577| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 4}, "PKIX.EmailProtection"); 578| 1| case 0x94925: ------------------ | Branch (578:7): [True: 1, False: 12.3k] ------------------ 579| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 5}, "PKIX.IPsecEndSystem"); 580| 1| case 0x94926: ------------------ | Branch (580:7): [True: 1, False: 12.3k] ------------------ 581| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 6}, "PKIX.IPsecTunnel"); 582| 1| case 0x94927: ------------------ | Branch (582:7): [True: 1, False: 12.3k] ------------------ 583| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 7}, "PKIX.IPsecUser"); 584| 1| case 0x94928: ------------------ | Branch (584:7): [True: 1, False: 12.3k] ------------------ 585| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 8}, "PKIX.TimeStamping"); 586| 1| case 0x94929: ------------------ | Branch (586:7): [True: 1, False: 12.3k] ------------------ 587| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 9}, "PKIX.OCSPSigning"); 588| 1| case 0x94CEA: ------------------ | Branch (588:7): [True: 1, False: 12.3k] ------------------ 589| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 8, 5}, "PKIX.XMPPAddr"); 590| 1| case 0x94CEE: ------------------ | Branch (590:7): [True: 1, False: 12.3k] ------------------ 591| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 8, 9}, "PKIX.SmtpUTF8Mailbox"); 592| 1| case 0x954DB: ------------------ | Branch (592:7): [True: 1, False: 12.3k] ------------------ 593| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 311, 20, 2, 2}, "Microsoft SmartcardLogon"); 594| 1| case 0x954DC: ------------------ | Branch (594:7): [True: 1, False: 12.3k] ------------------ 595| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 311, 20, 2, 3}, "Microsoft UPN"); 596| 1| case 0x96B0E: ------------------ | Branch (596:7): [True: 1, False: 12.3k] ------------------ 597| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1}, "PKIX.OCSP"); 598| 1| case 0x96B0F: ------------------ | Branch (598:7): [True: 1, False: 12.3k] ------------------ 599| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 2}, "PKIX.CertificateAuthorityIssuers"); 600| 1| case 0x96B1B: ------------------ | Branch (600:7): [True: 1, False: 12.3k] ------------------ 601| 1| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 14}, "PKIX.STIRTNList"); 602| 1| case 0x96C77: ------------------ | Branch (602:7): [True: 1, False: 12.3k] ------------------ 603| 1| return if_match(oid, {1, 2, 840, 113549, 1, 12, 1, 3}, "PBE-SHA1-3DES"); 604| 1| case 0x96C78: ------------------ | Branch (604:7): [True: 1, False: 12.3k] ------------------ 605| 1| return if_match(oid, {1, 2, 840, 113549, 1, 12, 1, 4}, "PBE-SHA1-2DES"); 606| 63| case 0x9A008: ------------------ | Branch (606:7): [True: 63, False: 12.3k] ------------------ 607| 63| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 1}, "brainpool160r1"); 608| 6| case 0x9A00A: ------------------ | Branch (608:7): [True: 6, False: 12.3k] ------------------ 609| 6| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 3}, "brainpool192r1"); 610| 77| case 0x9A00C: ------------------ | Branch (610:7): [True: 77, False: 12.3k] ------------------ 611| 77| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 5}, "brainpool224r1"); 612| 179| case 0x9A00E: ------------------ | Branch (612:7): [True: 179, False: 12.2k] ------------------ 613| 179| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 7}, "brainpool256r1"); 614| 64| case 0x9A010: ------------------ | Branch (614:7): [True: 64, False: 12.3k] ------------------ 615| 64| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 9}, "brainpool320r1"); 616| 155| case 0x9A012: ------------------ | Branch (616:7): [True: 155, False: 12.2k] ------------------ 617| 155| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 11}, "brainpool384r1"); 618| 140| case 0x9A014: ------------------ | Branch (618:7): [True: 140, False: 12.2k] ------------------ 619| 140| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 13}, "brainpool512r1"); 620| 1| case 0xA0D61: ------------------ | Branch (620:7): [True: 1, False: 12.3k] ------------------ 621| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 3}, "McEliece"); 622| 1| case 0xA0D63: ------------------ | Branch (622:7): [True: 1, False: 12.3k] ------------------ 623| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 5}, "XMSS-draft6"); 624| 1| case 0xA0D66: ------------------ | Branch (624:7): [True: 1, False: 12.3k] ------------------ 625| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 8}, "XMSS-draft12"); 626| 1| case 0xA0D6B: ------------------ | Branch (626:7): [True: 1, False: 12.3k] ------------------ 627| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 13}, "HSS-LMS-Private-Key"); 628| 1| case 0xA0EE1: ------------------ | Branch (628:7): [True: 1, False: 12.3k] ------------------ 629| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 1}, "Serpent/CBC"); 630| 1| case 0xA0EE2: ------------------ | Branch (630:7): [True: 1, False: 12.3k] ------------------ 631| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2}, "Threefish-512/CBC"); 632| 1| case 0xA0EE3: ------------------ | Branch (632:7): [True: 1, False: 12.3k] ------------------ 633| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 3}, "Twofish/CBC"); 634| 1| case 0xA0F45: ------------------ | Branch (634:7): [True: 1, False: 12.3k] ------------------ 635| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 101}, "Serpent/GCM"); 636| 1| case 0xA0F46: ------------------ | Branch (636:7): [True: 1, False: 12.3k] ------------------ 637| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 102}, "Twofish/GCM"); 638| 1| case 0xA0FA2: ------------------ | Branch (638:7): [True: 1, False: 12.3k] ------------------ 639| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 1}, "numsp256d1"); 640| 1| case 0xA0FA3: ------------------ | Branch (640:7): [True: 1, False: 12.3k] ------------------ 641| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 2}, "numsp384d1"); 642| 1| case 0xA0FA4: ------------------ | Branch (642:7): [True: 1, False: 12.3k] ------------------ 643| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 3}, "numsp512d1"); 644| 1| case 0xA244B: ------------------ | Branch (644:7): [True: 1, False: 12.3k] ------------------ 645| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 1}, "ClassicMcEliece_348864"); 646| 1| case 0xA244C: ------------------ | Branch (646:7): [True: 1, False: 12.3k] ------------------ 647| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 2}, "ClassicMcEliece_348864f"); 648| 1| case 0xA244D: ------------------ | Branch (648:7): [True: 1, False: 12.3k] ------------------ 649| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 3}, "ClassicMcEliece_460896"); 650| 2| case 0xA244E: ------------------ | Branch (650:7): [True: 2, False: 12.3k] ------------------ 651| 2| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 4}, "ClassicMcEliece_460896f"); 652| 1| case 0xA244F: ------------------ | Branch (652:7): [True: 1, False: 12.3k] ------------------ 653| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 5}, "ClassicMcEliece_6688128"); 654| 1| case 0xA2450: ------------------ | Branch (654:7): [True: 1, False: 12.3k] ------------------ 655| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 6}, "ClassicMcEliece_6688128f"); 656| 1| case 0xA2451: ------------------ | Branch (656:7): [True: 1, False: 12.3k] ------------------ 657| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 7}, "ClassicMcEliece_6960119"); 658| 1| case 0xA2452: ------------------ | Branch (658:7): [True: 1, False: 12.3k] ------------------ 659| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 8}, "ClassicMcEliece_6960119f"); 660| 1| case 0xA2453: ------------------ | Branch (660:7): [True: 1, False: 12.3k] ------------------ 661| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 9}, "ClassicMcEliece_8192128"); 662| 1| case 0xA2454: ------------------ | Branch (662:7): [True: 1, False: 12.3k] ------------------ 663| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 10}, "ClassicMcEliece_8192128f"); 664| 38| case 0xAF989: ------------------ | Branch (664:7): [True: 38, False: 12.3k] ------------------ 665| 38| return if_match(oid, {1, 2, 840, 113549, 1, 1, 1}, "RSA"); 666| 4| case 0xAF98A: ------------------ | Branch (666:7): [True: 4, False: 12.3k] ------------------ 667| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 2}, "RSA/PKCS1v15(MD2)"); 668| 4| case 0xAF98C: ------------------ | Branch (668:7): [True: 4, False: 12.3k] ------------------ 669| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 4}, "RSA/PKCS1v15(MD5)"); 670| 5| case 0xAF98D: ------------------ | Branch (670:7): [True: 5, False: 12.3k] ------------------ 671| 5| return if_match(oid, {1, 2, 840, 113549, 1, 1, 5}, "RSA/PKCS1v15(SHA-1)"); 672| 4| case 0xAF98F: ------------------ | Branch (672:7): [True: 4, False: 12.3k] ------------------ 673| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 7}, "RSA/OAEP"); 674| 4| case 0xAF990: ------------------ | Branch (674:7): [True: 4, False: 12.3k] ------------------ 675| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 8}, "MGF1"); 676| 7| case 0xAF992: ------------------ | Branch (676:7): [True: 7, False: 12.3k] ------------------ 677| 7| return if_match(oid, {1, 2, 840, 113549, 1, 1, 10}, "RSA/PSS"); 678| 4| case 0xAF993: ------------------ | Branch (678:7): [True: 4, False: 12.3k] ------------------ 679| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 11}, "RSA/PKCS1v15(SHA-256)"); 680| 4| case 0xAF994: ------------------ | Branch (680:7): [True: 4, False: 12.3k] ------------------ 681| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 12}, "RSA/PKCS1v15(SHA-384)"); 682| 4| case 0xAF995: ------------------ | Branch (682:7): [True: 4, False: 12.3k] ------------------ 683| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 13}, "RSA/PKCS1v15(SHA-512)"); 684| 4| case 0xAF996: ------------------ | Branch (684:7): [True: 4, False: 12.3k] ------------------ 685| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 14}, "RSA/PKCS1v15(SHA-224)"); 686| 4| case 0xAF998: ------------------ | Branch (686:7): [True: 4, False: 12.3k] ------------------ 687| 4| return if_match(oid, {1, 2, 840, 113549, 1, 1, 16}, "RSA/PKCS1v15(SHA-512-256)"); 688| 3| case 0xAFC98: ------------------ | Branch (688:7): [True: 3, False: 12.3k] ------------------ 689| 3| return if_match(oid, {1, 2, 840, 113549, 1, 5, 12}, "PKCS5.PBKDF2"); 690| 3| case 0xAFC99: ------------------ | Branch (690:7): [True: 3, False: 12.3k] ------------------ 691| 3| return if_match(oid, {1, 2, 840, 113549, 1, 5, 13}, "PBE-PKCS5v20"); 692| 3| case 0xAFE0F: ------------------ | Branch (692:7): [True: 3, False: 12.3k] ------------------ 693| 3| return if_match(oid, {1, 2, 840, 113549, 1, 7, 1}, "PKCS7.Data"); 694| 3| case 0xAFE14: ------------------ | Branch (694:7): [True: 3, False: 12.3k] ------------------ 695| 3| return if_match(oid, {1, 2, 840, 113549, 1, 7, 6}, "PKCS7.EncryptedData"); 696| 3| case 0xAFF91: ------------------ | Branch (696:7): [True: 3, False: 12.3k] ------------------ 697| 3| return if_match(oid, {1, 2, 840, 113549, 1, 9, 1}, "PKCS9.EmailAddress"); 698| 3| case 0xAFF92: ------------------ | Branch (698:7): [True: 3, False: 12.3k] ------------------ 699| 3| return if_match(oid, {1, 2, 840, 113549, 1, 9, 2}, "PKCS9.UnstructuredName"); 700| 3| case 0xAFF93: ------------------ | Branch (700:7): [True: 3, False: 12.3k] ------------------ 701| 3| return if_match(oid, {1, 2, 840, 113549, 1, 9, 3}, "PKCS9.ContentType"); 702| 4| case 0xAFF94: ------------------ | Branch (702:7): [True: 4, False: 12.3k] ------------------ 703| 4| return if_match(oid, {1, 2, 840, 113549, 1, 9, 4}, "PKCS9.MessageDigest"); 704| 3| case 0xAFF97: ------------------ | Branch (704:7): [True: 3, False: 12.3k] ------------------ 705| 3| return if_match(oid, {1, 2, 840, 113549, 1, 9, 7}, "PKCS9.ChallengePassword"); 706| 3| case 0xAFF9E: ------------------ | Branch (706:7): [True: 3, False: 12.3k] ------------------ 707| 3| return if_match(oid, {1, 2, 840, 113549, 1, 9, 14}, "PKCS9.ExtensionRequest"); 708| 3| case 0xAFFA4: ------------------ | Branch (708:7): [True: 3, False: 12.3k] ------------------ 709| 3| return if_match(oid, {1, 2, 840, 113549, 1, 9, 20}, "PKCS9.FriendlyName"); 710| 3| case 0xAFFA5: ------------------ | Branch (710:7): [True: 3, False: 12.3k] ------------------ 711| 3| return if_match(oid, {1, 2, 840, 113549, 1, 9, 21}, "PKCS9.LocalKeyId"); 712| 1| case 0xC0226: ------------------ | Branch (712:7): [True: 1, False: 12.3k] ------------------ 713| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 11591, 4, 11}, "Scrypt"); 714| 1| case 0xC0A67: ------------------ | Branch (714:7): [True: 1, False: 12.3k] ------------------ 715| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 11591, 15, 1}, "OpenPGP.Ed25519"); 716| 1| case 0xC4CE5: ------------------ | Branch (716:7): [True: 1, False: 12.3k] ------------------ 717| 1| return if_match(oid, {1, 2, 643, 100, 1}, "GOST.OGRN"); 718| 1| case 0xC4D53: ------------------ | Branch (718:7): [True: 1, False: 12.3k] ------------------ 719| 1| return if_match(oid, {1, 2, 643, 100, 111}, "GOST.SubjectSigningTool"); 720| 1| case 0xC4D54: ------------------ | Branch (720:7): [True: 1, False: 12.3k] ------------------ 721| 1| return if_match(oid, {1, 2, 643, 100, 112}, "GOST.IssuerSigningTool"); 722| 1| case 0xC9C50: ------------------ | Branch (722:7): [True: 1, False: 12.3k] ------------------ 723| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 1}, "secp192r1"); 724| 1| case 0xC9C51: ------------------ | Branch (724:7): [True: 1, False: 12.3k] ------------------ 725| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 2}, "x962_p192v2"); 726| 1| case 0xC9C52: ------------------ | Branch (726:7): [True: 1, False: 12.3k] ------------------ 727| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 3}, "x962_p192v3"); 728| 1| case 0xC9C53: ------------------ | Branch (728:7): [True: 1, False: 12.3k] ------------------ 729| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 4}, "x962_p239v1"); 730| 1| case 0xC9C54: ------------------ | Branch (730:7): [True: 1, False: 12.3k] ------------------ 731| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 5}, "x962_p239v2"); 732| 1| case 0xC9C55: ------------------ | Branch (732:7): [True: 1, False: 12.3k] ------------------ 733| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 6}, "x962_p239v3"); 734| 227| case 0xC9C56: ------------------ | Branch (734:7): [True: 227, False: 12.1k] ------------------ 735| 227| return if_match(oid, {1, 2, 840, 10045, 3, 1, 7}, "secp256r1"); 736| 201| case 0xCFA13: ------------------ | Branch (736:7): [True: 201, False: 12.1k] ------------------ 737| 201| return if_match(oid, {1, 2, 840, 10040, 4, 1}, "DSA"); 738| 19| case 0xCFA15: ------------------ | Branch (738:7): [True: 19, False: 12.3k] ------------------ 739| 19| return if_match(oid, {1, 2, 840, 10040, 4, 3}, "DSA/SHA-1"); 740| 1.48k| default: ------------------ | Branch (740:7): [True: 1.48k, False: 10.9k] ------------------ 741| 1.48k| return {}; 742| 12.3k| } 743| 12.3k|} _ZN5Botan7OID_Map22lookup_static_oid_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 746| 2.53k|std::optional OID_Map::lookup_static_oid_name(std::string_view req) { 747| 2.53k| const uint32_t hc = hash_oid_name(req); 748| | 749| 2.53k| switch(hc) { 750| 0| case 0x00545: ------------------ | Branch (750:7): [True: 0, False: 2.53k] ------------------ 751| 0| return if_match(req, "Twofish/GCM", {1, 3, 6, 1, 4, 1, 25258, 3, 102}); 752| 0| case 0x00CF3: ------------------ | Branch (752:7): [True: 0, False: 2.53k] ------------------ 753| 0| return if_match(req, "SphincsPlus-sha2-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4}); 754| 0| case 0x015FE: ------------------ | Branch (754:7): [True: 0, False: 2.53k] ------------------ 755| 0| return if_match(req, "FrodoKEM-640-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 1}); 756| 0| case 0x01F9E: ------------------ | Branch (756:7): [True: 0, False: 2.53k] ------------------ 757| 0| return if_match(req, "MD5", {1, 2, 840, 113549, 2, 5}); 758| 0| case 0x02293: ------------------ | Branch (758:7): [True: 0, False: 2.53k] ------------------ 759| 0| return if_match(req, "SphincsPlus-shake-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4}); 760| 0| case 0x02B93: ------------------ | Branch (760:7): [True: 0, False: 2.53k] ------------------ 761| 0| return if_match(req, "Microsoft SmartcardLogon", {1, 3, 6, 1, 4, 1, 311, 20, 2, 2}); 762| 0| case 0x041D5: ------------------ | Branch (762:7): [True: 0, False: 2.53k] ------------------ 763| 0| return if_match(req, "secp160k1", {1, 3, 132, 0, 9}); 764| 0| case 0x044B3: ------------------ | Branch (764:7): [True: 0, False: 2.53k] ------------------ 765| 0| return if_match(req, "Camellia-256/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 8}); 766| 0| case 0x048B2: ------------------ | Branch (766:7): [True: 0, False: 2.53k] ------------------ 767| 0| return if_match(req, "secp160r1", {1, 3, 132, 0, 8}); 768| 0| case 0x048B3: ------------------ | Branch (768:7): [True: 0, False: 2.53k] ------------------ 769| 0| return if_match(req, "secp160r2", {1, 3, 132, 0, 30}); 770| 0| case 0x05CDA: ------------------ | Branch (770:7): [True: 0, False: 2.53k] ------------------ 771| 0| return if_match(req, "X520.Country", {2, 5, 4, 6}); 772| 0| case 0x07783: ------------------ | Branch (772:7): [True: 0, False: 2.53k] ------------------ 773| 0| return if_match(req, "PKIX.ServerAuth", {1, 3, 6, 1, 5, 5, 7, 3, 1}); 774| 0| case 0x086C7: ------------------ | Branch (774:7): [True: 0, False: 2.53k] ------------------ 775| 0| return if_match(req, "numsp384d1", {1, 3, 6, 1, 4, 1, 25258, 4, 2}); 776| 0| case 0x08A92: ------------------ | Branch (776:7): [True: 0, False: 2.53k] ------------------ 777| 0| return if_match(req, "RSA/PKCS1v15(SHA-1)", {1, 2, 840, 113549, 1, 1, 5}); 778| 0| case 0x09EA0: ------------------ | Branch (778:7): [True: 0, False: 2.53k] ------------------ 779| 0| return if_match(req, "DES/CBC", {1, 3, 14, 3, 2, 7}); 780| 0| case 0x0B2D6: ------------------ | Branch (780:7): [True: 0, False: 2.53k] ------------------ 781| 0| return if_match(req, "ECDSA/SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 3, 12}); 782| 0| case 0x0BA72: ------------------ | Branch (782:7): [True: 0, False: 2.53k] ------------------ 783| 0| return if_match(req, "SphincsPlus-sha2-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1}); 784| 0| case 0x0BE23: ------------------ | Branch (784:7): [True: 0, False: 2.53k] ------------------ 785| 0| return if_match(req, "ECGDSA", {1, 3, 36, 3, 3, 2, 5, 2, 1}); 786| 0| case 0x0C109: ------------------ | Branch (786:7): [True: 0, False: 2.53k] ------------------ 787| 0| return if_match(req, "PKCS9.FriendlyName", {1, 2, 840, 113549, 1, 9, 20}); 788| 0| case 0x0D012: ------------------ | Branch (788:7): [True: 0, False: 2.53k] ------------------ 789| 0| return if_match(req, "SphincsPlus-shake-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1}); 790| 0| case 0x0DCE9: ------------------ | Branch (790:7): [True: 0, False: 2.53k] ------------------ 791| 0| return if_match(req, "ClassicMcEliece_8192128f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 10}); 792| 0| case 0x0E52A: ------------------ | Branch (792:7): [True: 0, False: 2.53k] ------------------ 793| 0| return if_match(req, "numsp512d1", {1, 3, 6, 1, 4, 1, 25258, 4, 3}); 794| 0| case 0x0F9CC: ------------------ | Branch (794:7): [True: 0, False: 2.53k] ------------------ 795| 0| return if_match(req, "PKCS9.UnstructuredName", {1, 2, 840, 113549, 1, 9, 2}); 796| 0| case 0x0FF45: ------------------ | Branch (796:7): [True: 0, False: 2.53k] ------------------ 797| 0| return if_match(req, "Camellia-256/GCM", {0, 3, 4401, 5, 3, 1, 9, 46}); 798| 0| case 0x1033D: ------------------ | Branch (798:7): [True: 0, False: 2.53k] ------------------ 799| 0| return if_match(req, "DSA/SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 3, 7}); 800| 0| case 0x1139D: ------------------ | Branch (800:7): [True: 0, False: 2.53k] ------------------ 801| 0| return if_match(req, "secp192k1", {1, 3, 132, 0, 31}); 802| 0| case 0x113D6: ------------------ | Branch (802:7): [True: 0, False: 2.53k] ------------------ 803| 0| return if_match(req, "X520.DNQualifier", {2, 5, 4, 46}); 804| 0| case 0x11A7A: ------------------ | Branch (804:7): [True: 0, False: 2.53k] ------------------ 805| 0| return if_match(req, "secp192r1", {1, 2, 840, 10045, 3, 1, 1}); 806| 0| case 0x12096: ------------------ | Branch (806:7): [True: 0, False: 2.53k] ------------------ 807| 0| return if_match(req, "SM2_Kex", {1, 2, 156, 10197, 1, 301, 2}); 808| 0| case 0x13FC1: ------------------ | Branch (808:7): [True: 0, False: 2.53k] ------------------ 809| 0| return if_match(req, "X520.GenerationalQualifier", {2, 5, 4, 44}); 810| 0| case 0x1445B: ------------------ | Branch (810:7): [True: 0, False: 2.53k] ------------------ 811| 0| return if_match(req, "PKCS5.PBKDF2", {1, 2, 840, 113549, 1, 5, 12}); 812| 0| case 0x1495D: ------------------ | Branch (812:7): [True: 0, False: 2.53k] ------------------ 813| 0| return if_match(req, "eFrodoKEM-1344-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 3}); 814| 0| case 0x14E30: ------------------ | Branch (814:7): [True: 0, False: 2.53k] ------------------ 815| 0| return if_match(req, "ClassicMcEliece_460896", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 3}); 816| 0| case 0x14FB1: ------------------ | Branch (816:7): [True: 0, False: 2.53k] ------------------ 817| 0| return if_match(req, "XMSS-draft12", {1, 3, 6, 1, 4, 1, 25258, 1, 8}); 818| 0| case 0x156E3: ------------------ | Branch (818:7): [True: 0, False: 2.53k] ------------------ 819| 0| return if_match(req, "Compression.Zlib", {1, 2, 840, 113549, 1, 9, 16, 3, 8}); 820| 0| case 0x1579E: ------------------ | Branch (820:7): [True: 0, False: 2.53k] ------------------ 821| 0| return if_match(req, "Streebog-512", {1, 2, 643, 7, 1, 1, 2, 3}); 822| 0| case 0x1701A: ------------------ | Branch (822:7): [True: 0, False: 2.53k] ------------------ 823| 0| return if_match(req, "X509v3.AnyExtendedKeyUsage", {2, 5, 29, 37, 0}); 824| 0| case 0x175EF: ------------------ | Branch (824:7): [True: 0, False: 2.53k] ------------------ 825| 0| return if_match(req, "Kyber-1024-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 3}); 826| 0| case 0x17709: ------------------ | Branch (826:7): [True: 0, False: 2.53k] ------------------ 827| 0| return if_match(req, "X520.GivenName", {2, 5, 4, 42}); 828| 0| case 0x17AD9: ------------------ | Branch (828:7): [True: 0, False: 2.53k] ------------------ 829| 0| return if_match(req, "RSA/PKCS1v15(SM3)", {1, 2, 156, 10197, 1, 504}); 830| 1| case 0x17CE2: ------------------ | Branch (830:7): [True: 1, False: 2.53k] ------------------ 831| 1| return if_match(req, "SLH-DSA-SHA2-256f", {2, 16, 840, 1, 101, 3, 4, 3, 25}); 832| 1| case 0x17CEF: ------------------ | Branch (832:7): [True: 1, False: 2.53k] ------------------ 833| 1| return if_match(req, "SLH-DSA-SHA2-256s", {2, 16, 840, 1, 101, 3, 4, 3, 24}); 834| 0| case 0x18618: ------------------ | Branch (834:7): [True: 0, False: 2.53k] ------------------ 835| 0| return if_match(req, "FrodoKEM-976-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 2}); 836| 0| case 0x19480: ------------------ | Branch (836:7): [True: 0, False: 2.53k] ------------------ 837| 0| return if_match(req, "eFrodoKEM-1344-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 3}); 838| 0| case 0x1958A: ------------------ | Branch (838:7): [True: 0, False: 2.53k] ------------------ 839| 0| return if_match(req, "X509v3.InvalidityDate", {2, 5, 29, 24}); 840| 0| case 0x19851: ------------------ | Branch (840:7): [True: 0, False: 2.53k] ------------------ 841| 0| return if_match(req, "DSA/SHA-1", {1, 2, 840, 10040, 4, 3}); 842| 0| case 0x1B2E7: ------------------ | Branch (842:7): [True: 0, False: 2.53k] ------------------ 843| 0| return if_match(req, "KeyWrap.AES-128", {2, 16, 840, 1, 101, 3, 4, 1, 5}); 844| 0| case 0x1B9BE: ------------------ | Branch (844:7): [True: 0, False: 2.53k] ------------------ 845| 0| return if_match(req, "KeyWrap.AES-192", {2, 16, 840, 1, 101, 3, 4, 1, 25}); 846| 0| case 0x1D439: ------------------ | Branch (846:7): [True: 0, False: 2.53k] ------------------ 847| 0| return if_match(req, "SphincsPlus-haraka-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4}); 848| 0| case 0x2065B: ------------------ | Branch (848:7): [True: 0, False: 2.53k] ------------------ 849| 0| return if_match(req, "KeyWrap.CAST-128", {1, 2, 840, 113533, 7, 66, 15}); 850| 0| case 0x216A0: ------------------ | Branch (850:7): [True: 0, False: 2.53k] ------------------ 851| 0| return if_match(req, "ML-KEM-512", {2, 16, 840, 1, 101, 3, 4, 4, 1}); 852| 1| case 0x2216B: ------------------ | Branch (852:7): [True: 1, False: 2.53k] ------------------ 853| 1| return if_match(req, "GOST-34.10-2012-512", {1, 2, 643, 7, 1, 1, 1, 2}); 854| 0| case 0x22C2C: ------------------ | Branch (854:7): [True: 0, False: 2.53k] ------------------ 855| 0| return if_match(req, "ElGamal", {1, 3, 6, 1, 4, 1, 3029, 1, 2, 1}); 856| 0| case 0x2559A: ------------------ | Branch (856:7): [True: 0, False: 2.53k] ------------------ 857| 0| return if_match(req, "X520.Initials", {2, 5, 4, 43}); 858| 0| case 0x271AC: ------------------ | Branch (858:7): [True: 0, False: 2.53k] ------------------ 859| 0| return if_match(req, "PKIX.AutonomousSysIds", {1, 3, 6, 1, 5, 5, 7, 1, 8}); 860| 0| case 0x2808B: ------------------ | Branch (860:7): [True: 0, False: 2.53k] ------------------ 861| 0| return if_match(req, "PKCS7.Data", {1, 2, 840, 113549, 1, 7, 1}); 862| 0| case 0x281B8: ------------------ | Branch (862:7): [True: 0, False: 2.53k] ------------------ 863| 0| return if_match(req, "SphincsPlus-haraka-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1}); 864| 0| case 0x282FE: ------------------ | Branch (864:7): [True: 0, False: 2.53k] ------------------ 865| 0| return if_match(req, "PKIX.OCSP.Nonce", {1, 3, 6, 1, 5, 5, 7, 48, 1, 2}); 866| 0| case 0x29999: ------------------ | Branch (866:7): [True: 0, False: 2.53k] ------------------ 867| 0| return if_match(req, "DSA/SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 3, 6}); 868| 0| case 0x2A83D: ------------------ | Branch (868:7): [True: 0, False: 2.53k] ------------------ 869| 0| return if_match(req, "SHA-224", {2, 16, 840, 1, 101, 3, 4, 2, 4}); 870| 0| case 0x2AB30: ------------------ | Branch (870:7): [True: 0, False: 2.53k] ------------------ 871| 0| return if_match(req, "SHA-256", {2, 16, 840, 1, 101, 3, 4, 2, 1}); 872| 0| case 0x2ABEF: ------------------ | Branch (872:7): [True: 0, False: 2.53k] ------------------ 873| 0| return if_match(req, "KeyWrap.AES-256", {2, 16, 840, 1, 101, 3, 4, 1, 45}); 874| 0| case 0x2BAEF: ------------------ | Branch (874:7): [True: 0, False: 2.53k] ------------------ 875| 0| return if_match(req, "SM2_Sig/SM3", {1, 2, 156, 10197, 1, 501}); 876| 0| case 0x2C39A: ------------------ | Branch (876:7): [True: 0, False: 2.53k] ------------------ 877| 0| return if_match(req, "ECGDSA/RIPEMD-160", {1, 3, 36, 3, 3, 2, 5, 4, 1}); 878| 0| case 0x2C54F: ------------------ | Branch (878:7): [True: 0, False: 2.53k] ------------------ 879| 0| return if_match(req, "ECDSA/SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 3, 9}); 880| 0| case 0x2EEA6: ------------------ | Branch (880:7): [True: 0, False: 2.53k] ------------------ 881| 0| return if_match(req, "RSA/PKCS1v15(RIPEMD-160)", {1, 3, 36, 3, 3, 1, 2}); 882| 0| case 0x2EFBA: ------------------ | Branch (882:7): [True: 0, False: 2.53k] ------------------ 883| 0| return if_match(req, "Kyber-512-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 1}); 884| 0| case 0x2F0AD: ------------------ | Branch (884:7): [True: 0, False: 2.53k] ------------------ 885| 0| return if_match(req, "PKCS7.EncryptedData", {1, 2, 840, 113549, 1, 7, 6}); 886| 0| case 0x2F219: ------------------ | Branch (886:7): [True: 0, False: 2.53k] ------------------ 887| 0| return if_match(req, "PBE-SHA1-2DES", {1, 2, 840, 113549, 1, 12, 1, 4}); 888| 1| case 0x3133E: ------------------ | Branch (888:7): [True: 1, False: 2.53k] ------------------ 889| 1| return if_match(req, "SLH-DSA-SHA2-128f", {2, 16, 840, 1, 101, 3, 4, 3, 21}); 890| 6| case 0x3134B: ------------------ | Branch (890:7): [True: 6, False: 2.53k] ------------------ 891| 6| return if_match(req, "SLH-DSA-SHA2-128s", {2, 16, 840, 1, 101, 3, 4, 3, 20}); 892| 0| case 0x3160D: ------------------ | Branch (892:7): [True: 0, False: 2.53k] ------------------ 893| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(224))", {2, 16, 840, 1, 101, 3, 4, 3, 13}); 894| 0| case 0x319E0: ------------------ | Branch (894:7): [True: 0, False: 2.53k] ------------------ 895| 0| return if_match(req, "GOST-34.10-2012-256/Streebog-256", {1, 2, 643, 7, 1, 1, 3, 2}); 896| 0| case 0x31B3D: ------------------ | Branch (896:7): [True: 0, False: 2.53k] ------------------ 897| 0| return if_match(req, "HMAC(SHA-512)", {1, 2, 840, 113549, 2, 11}); 898| 0| case 0x31C6D: ------------------ | Branch (898:7): [True: 0, False: 2.53k] ------------------ 899| 0| return if_match(req, "secp384r1", {1, 3, 132, 0, 34}); 900| 0| case 0x32899: ------------------ | Branch (900:7): [True: 0, False: 2.53k] ------------------ 901| 0| return if_match(req, "TripleDES/CBC", {1, 2, 840, 113549, 3, 7}); 902| 0| case 0x33C9C: ------------------ | Branch (902:7): [True: 0, False: 2.53k] ------------------ 903| 0| return if_match(req, "PKIX.SmtpUTF8Mailbox", {1, 3, 6, 1, 5, 5, 7, 8, 9}); 904| 0| case 0x33D04: ------------------ | Branch (904:7): [True: 0, False: 2.53k] ------------------ 905| 0| return if_match(req, "PKCS12.SecretBag", {1, 2, 840, 113549, 1, 12, 10, 1, 5}); 906| 0| case 0x3615D: ------------------ | Branch (906:7): [True: 0, False: 2.53k] ------------------ 907| 0| return if_match(req, "FrodoKEM-976-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 2}); 908| 0| case 0x361B8: ------------------ | Branch (908:7): [True: 0, False: 2.53k] ------------------ 909| 0| return if_match(req, "Ed25519", {1, 3, 101, 112}); 910| 0| case 0x3649D: ------------------ | Branch (910:7): [True: 0, False: 2.53k] ------------------ 911| 0| return if_match(req, "SHAKE-128", {2, 16, 840, 1, 101, 3, 4, 2, 11}); 912| 0| case 0x36693: ------------------ | Branch (912:7): [True: 0, False: 2.53k] ------------------ 913| 0| return if_match(req, "ClassicMcEliece_348864", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 1}); 914| 0| case 0x373C7: ------------------ | Branch (914:7): [True: 0, False: 2.53k] ------------------ 915| 0| return if_match(req, "ML-DSA-4x4", {2, 16, 840, 1, 101, 3, 4, 3, 17}); 916| 0| case 0x3750B: ------------------ | Branch (916:7): [True: 0, False: 2.53k] ------------------ 917| 0| return if_match(req, "ClassicMcEliece_8192128", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 9}); 918| 0| case 0x39890: ------------------ | Branch (918:7): [True: 0, False: 2.53k] ------------------ 919| 0| return if_match(req, "Ed448", {1, 3, 101, 113}); 920| 0| case 0x3A438: ------------------ | Branch (920:7): [True: 0, False: 2.53k] ------------------ 921| 0| return if_match(req, "SHA-384", {2, 16, 840, 1, 101, 3, 4, 2, 2}); 922| 0| case 0x3A963: ------------------ | Branch (922:7): [True: 0, False: 2.53k] ------------------ 923| 0| return if_match(req, "DH", {1, 2, 840, 10046, 2, 1}); 924| 0| case 0x3AC83: ------------------ | Branch (924:7): [True: 0, False: 2.53k] ------------------ 925| 0| return if_match(req, "MGF1", {1, 2, 840, 113549, 1, 1, 8}); 926| 0| case 0x3ACBA: ------------------ | Branch (926:7): [True: 0, False: 2.53k] ------------------ 927| 0| return if_match(req, "X509v3.IssuerAlternativeName", {2, 5, 29, 18}); 928| 0| case 0x3B273: ------------------ | Branch (928:7): [True: 0, False: 2.53k] ------------------ 929| 0| return if_match(req, "KeyWrap.TripleDES", {1, 2, 840, 113549, 1, 9, 16, 3, 6}); 930| 0| case 0x3B91E: ------------------ | Branch (930:7): [True: 0, False: 2.53k] ------------------ 931| 0| return if_match(req, "X509v3.PrivateKeyUsagePeriod", {2, 5, 29, 16}); 932| 1| case 0x3BC8A: ------------------ | Branch (932:7): [True: 1, False: 2.53k] ------------------ 933| 1| return if_match(req, "SLH-DSA-SHAKE-192f", {2, 16, 840, 1, 101, 3, 4, 3, 29}); 934| 1| case 0x3BC97: ------------------ | Branch (934:7): [True: 1, False: 2.53k] ------------------ 935| 1| return if_match(req, "SLH-DSA-SHAKE-192s", {2, 16, 840, 1, 101, 3, 4, 3, 28}); 936| 0| case 0x3D127: ------------------ | Branch (936:7): [True: 0, False: 2.53k] ------------------ 937| 0| return if_match(req, "DSA", {1, 2, 840, 10040, 4, 1}); 938| 0| case 0x3E249: ------------------ | Branch (938:7): [True: 0, False: 2.53k] ------------------ 939| 0| return if_match(req, "HSS-LMS", {1, 2, 840, 113549, 1, 9, 16, 3, 17}); 940| 0| case 0x3E7D5: ------------------ | Branch (940:7): [True: 0, False: 2.53k] ------------------ 941| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(256))", {2, 16, 840, 1, 101, 3, 4, 3, 14}); 942| 0| case 0x3F748: ------------------ | Branch (942:7): [True: 0, False: 2.53k] ------------------ 943| 0| return if_match(req, "GOST.OGRN", {1, 2, 643, 100, 1}); 944| 0| case 0x3F99F: ------------------ | Branch (944:7): [True: 0, False: 2.53k] ------------------ 945| 0| return if_match(req, "X509v3.BasicConstraints", {2, 5, 29, 19}); 946| 0| case 0x40726: ------------------ | Branch (946:7): [True: 0, False: 2.53k] ------------------ 947| 0| return if_match(req, "SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 2, 10}); 948| 0| case 0x407BF: ------------------ | Branch (948:7): [True: 0, False: 2.53k] ------------------ 949| 0| return if_match(req, "ML-KEM-768", {2, 16, 840, 1, 101, 3, 4, 4, 2}); 950| 0| case 0x41334: ------------------ | Branch (950:7): [True: 0, False: 2.53k] ------------------ 951| 0| return if_match(req, "ECDSA/SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 3, 11}); 952| 0| case 0x42DF3: ------------------ | Branch (952:7): [True: 0, False: 2.53k] ------------------ 953| 0| return if_match(req, "X509v3.CRLDistributionPoints", {2, 5, 29, 31}); 954| 0| case 0x437FB: ------------------ | Branch (954:7): [True: 0, False: 2.53k] ------------------ 955| 0| return if_match(req, "brainpool160r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 1}); 956| 0| case 0x441F5: ------------------ | Branch (956:7): [True: 0, False: 2.53k] ------------------ 957| 0| return if_match(req, "gost_256A", {1, 2, 643, 7, 1, 2, 1, 1, 1}); 958| 0| case 0x441F6: ------------------ | Branch (958:7): [True: 0, False: 2.53k] ------------------ 959| 0| return if_match(req, "gost_256B", {1, 2, 643, 7, 1, 2, 1, 1, 2}); 960| 0| case 0x44221: ------------------ | Branch (960:7): [True: 0, False: 2.53k] ------------------ 961| 0| return if_match(req, "GOST-34.10-2012-512/Streebog-512", {1, 2, 643, 7, 1, 1, 3, 3}); 962| 0| case 0x44322: ------------------ | Branch (962:7): [True: 0, False: 2.53k] ------------------ 963| 0| return if_match(req, "ClassicMcEliece_6960119pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 3}); 964| 0| case 0x44973: ------------------ | Branch (964:7): [True: 0, False: 2.53k] ------------------ 965| 0| return if_match(req, "Kyber-512-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 1}); 966| 0| case 0x45C27: ------------------ | Branch (966:7): [True: 0, False: 2.53k] ------------------ 967| 0| return if_match(req, "RSA/PKCS1v15(SHA-512-256)", {1, 2, 840, 113549, 1, 1, 16}); 968| 0| case 0x45C85: ------------------ | Branch (968:7): [True: 0, False: 2.53k] ------------------ 969| 0| return if_match(req, "X509v3.ReasonCode", {2, 5, 29, 21}); 970| 0| case 0x45DA5: ------------------ | Branch (970:7): [True: 0, False: 2.53k] ------------------ 971| 0| return if_match(req, "SHAKE-256", {2, 16, 840, 1, 101, 3, 4, 2, 12}); 972| 0| case 0x4663C: ------------------ | Branch (972:7): [True: 0, False: 2.53k] ------------------ 973| 0| return if_match(req, "X509v3.PolicyConstraints", {2, 5, 29, 36}); 974| 0| case 0x480F7: ------------------ | Branch (974:7): [True: 0, False: 2.53k] ------------------ 975| 0| return if_match(req, "Serpent/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 4}); 976| 0| case 0x48627: ------------------ | Branch (976:7): [True: 0, False: 2.53k] ------------------ 977| 0| return if_match(req, "Dilithium-4x4-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 1}); 978| 0| case 0x48861: ------------------ | Branch (978:7): [True: 0, False: 2.53k] ------------------ 979| 0| return if_match(req, "ChaCha20Poly1305", {1, 2, 840, 113549, 1, 9, 16, 3, 18}); 980| 0| case 0x4A292: ------------------ | Branch (980:7): [True: 0, False: 2.53k] ------------------ 981| 0| return if_match(req, "frp256v1", {1, 2, 250, 1, 223, 101, 256, 1}); 982| 0| case 0x4A9EE: ------------------ | Branch (982:7): [True: 0, False: 2.53k] ------------------ 983| 0| return if_match(req, "ClassicMcEliece_6960119f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 8}); 984| 0| case 0x4BF87: ------------------ | Branch (984:7): [True: 0, False: 2.53k] ------------------ 985| 0| return if_match(req, "PKIX.TNAuthList", {1, 3, 6, 1, 5, 5, 7, 1, 26}); 986| 0| case 0x4C088: ------------------ | Branch (986:7): [True: 0, False: 2.53k] ------------------ 987| 0| return if_match(req, "eFrodoKEM-976-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 2}); 988| 0| case 0x4C513: ------------------ | Branch (988:7): [True: 0, False: 2.53k] ------------------ 989| 0| return if_match(req, "DSA/SHA-224", {2, 16, 840, 1, 101, 3, 4, 3, 1}); 990| 0| case 0x4C806: ------------------ | Branch (990:7): [True: 0, False: 2.53k] ------------------ 991| 0| return if_match(req, "DSA/SHA-256", {2, 16, 840, 1, 101, 3, 4, 3, 2}); 992| 0| case 0x4D740: ------------------ | Branch (992:7): [True: 0, False: 2.53k] ------------------ 993| 0| return if_match(req, "X509v3.AnyPolicy", {2, 5, 29, 32, 0}); 994| 0| case 0x4DE49: ------------------ | Branch (994:7): [True: 0, False: 2.53k] ------------------ 995| 0| return if_match(req, "RSA/PKCS1v15(SHA-512)", {1, 2, 840, 113549, 1, 1, 13}); 996| 0| case 0x4ED5D: ------------------ | Branch (996:7): [True: 0, False: 2.53k] ------------------ 997| 0| return if_match(req, "CAST-128/CBC", {1, 2, 840, 113533, 7, 66, 10}); 998| 0| case 0x4FCDC: ------------------ | Branch (998:7): [True: 0, False: 2.53k] ------------------ 999| 0| return if_match(req, "RSA", {1, 2, 840, 113549, 1, 1, 1}); 1000| 0| case 0x501CB: ------------------ | Branch (1000:7): [True: 0, False: 2.53k] ------------------ 1001| 0| return if_match(req, "ECDSA/SHA-224", {1, 2, 840, 10045, 4, 3, 1}); 1002| 0| case 0x50395: ------------------ | Branch (1002:7): [True: 0, False: 2.53k] ------------------ 1003| 0| return if_match(req, "GOST-34.10/GOST-R-34.11-94", {1, 2, 643, 2, 2, 3}); 1004| 0| case 0x504BE: ------------------ | Branch (1004:7): [True: 0, False: 2.53k] ------------------ 1005| 0| return if_match(req, "ECDSA/SHA-256", {1, 2, 840, 10045, 4, 3, 2}); 1006| 0| case 0x509C3: ------------------ | Branch (1006:7): [True: 0, False: 2.53k] ------------------ 1007| 0| return if_match(req, "brainpool192r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 3}); 1008| 0| case 0x509F9: ------------------ | Branch (1008:7): [True: 0, False: 2.53k] ------------------ 1009| 0| return if_match(req, "PKCS9.ContentType", {1, 2, 840, 113549, 1, 9, 3}); 1010| 0| case 0x50B26: ------------------ | Branch (1010:7): [True: 0, False: 2.53k] ------------------ 1011| 0| return if_match(req, "FrodoKEM-640-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 1}); 1012| 0| case 0x50D78: ------------------ | Branch (1012:7): [True: 0, False: 2.53k] ------------------ 1013| 0| return if_match(req, "x962_p192v2", {1, 2, 840, 10045, 3, 1, 2}); 1014| 0| case 0x50D79: ------------------ | Branch (1014:7): [True: 0, False: 2.53k] ------------------ 1015| 0| return if_match(req, "x962_p192v3", {1, 2, 840, 10045, 3, 1, 3}); 1016| 0| case 0x51DC6: ------------------ | Branch (1016:7): [True: 0, False: 2.53k] ------------------ 1017| 0| return if_match(req, "AES-128/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 1}); 1018| 0| case 0x52DB6: ------------------ | Branch (1018:7): [True: 0, False: 2.53k] ------------------ 1019| 0| return if_match(req, "HMAC(SHA-224)", {1, 2, 840, 113549, 2, 8}); 1020| 0| case 0x53E11: ------------------ | Branch (1020:7): [True: 0, False: 2.53k] ------------------ 1021| 0| return if_match(req, "FrodoKEM-1344-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 3}); 1022| 0| case 0x54012: ------------------ | Branch (1022:7): [True: 0, False: 2.53k] ------------------ 1023| 0| return if_match(req, "PKIX.TimeStamping", {1, 3, 6, 1, 5, 5, 7, 3, 8}); 1024| 0| case 0x5407A: ------------------ | Branch (1024:7): [True: 0, False: 2.53k] ------------------ 1025| 0| return if_match(req, "Serpent/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 1}); 1026| 0| case 0x5576D: ------------------ | Branch (1026:7): [True: 0, False: 2.53k] ------------------ 1027| 0| return if_match(req, "SphincsPlus-sha2-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2}); 1028| 0| case 0x55EF6: ------------------ | Branch (1028:7): [True: 0, False: 2.53k] ------------------ 1029| 0| return if_match(req, "AES-192/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 2}); 1030| 0| case 0x55FFA: ------------------ | Branch (1030:7): [True: 0, False: 2.53k] ------------------ 1031| 0| return if_match(req, "ML-DSA-6x5", {2, 16, 840, 1, 101, 3, 4, 3, 18}); 1032| 0| case 0x56826: ------------------ | Branch (1032:7): [True: 0, False: 2.53k] ------------------ 1033| 0| return if_match(req, "brainpool320r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 9}); 1034| 0| case 0x56D0D: ------------------ | Branch (1034:7): [True: 0, False: 2.53k] ------------------ 1035| 0| return if_match(req, "SphincsPlus-shake-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2}); 1036| 0| case 0x57077: ------------------ | Branch (1036:7): [True: 0, False: 2.53k] ------------------ 1037| 0| return if_match(req, "XMSS-draft6", {1, 3, 6, 1, 4, 1, 25258, 1, 5}); 1038| 0| case 0x5818B: ------------------ | Branch (1038:7): [True: 0, False: 2.53k] ------------------ 1039| 0| return if_match(req, "ECGDSA/SHA-224", {1, 3, 36, 3, 3, 2, 5, 4, 3}); 1040| 0| case 0x5847E: ------------------ | Branch (1040:7): [True: 0, False: 2.53k] ------------------ 1041| 0| return if_match(req, "ECGDSA/SHA-256", {1, 3, 36, 3, 3, 2, 5, 4, 4}); 1042| 0| case 0x5898B: ------------------ | Branch (1042:7): [True: 0, False: 2.53k] ------------------ 1043| 0| return if_match(req, "SHA-512", {2, 16, 840, 1, 101, 3, 4, 2, 3}); 1044| 0| case 0x58991: ------------------ | Branch (1044:7): [True: 0, False: 2.53k] ------------------ 1045| 0| return if_match(req, "PKIX.OCSP.NoCheck", {1, 3, 6, 1, 5, 5, 7, 48, 1, 5}); 1046| 0| case 0x59717: ------------------ | Branch (1046:7): [True: 0, False: 2.53k] ------------------ 1047| 0| return if_match(req, "X509v3.SubjectKeyIdentifier", {2, 5, 29, 14}); 1048| 0| case 0x5A1E1: ------------------ | Branch (1048:7): [True: 0, False: 2.53k] ------------------ 1049| 0| return if_match(req, "PKCS12.KeyBag", {1, 2, 840, 113549, 1, 12, 10, 1, 1}); 1050| 0| case 0x5A570: ------------------ | Branch (1050:7): [True: 0, False: 2.53k] ------------------ 1051| 0| return if_match(req, "X520.CommonName", {2, 5, 4, 3}); 1052| 0| case 0x5A990: ------------------ | Branch (1052:7): [True: 0, False: 2.53k] ------------------ 1053| 0| return if_match(req, "ECDSA/SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 3, 10}); 1054| 0| case 0x5AB0E: ------------------ | Branch (1054:7): [True: 0, False: 2.53k] ------------------ 1055| 0| return if_match(req, "SphincsPlus-sha2-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5}); 1056| 0| case 0x5AC4A: ------------------ | Branch (1056:7): [True: 0, False: 2.53k] ------------------ 1057| 0| return if_match(req, "X520.Surname", {2, 5, 4, 4}); 1058| 0| case 0x5AF2C: ------------------ | Branch (1058:7): [True: 0, False: 2.53k] ------------------ 1059| 0| return if_match(req, "ClassicMcEliece_8192128pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 5}); 1060| 0| case 0x5BC39: ------------------ | Branch (1060:7): [True: 0, False: 2.53k] ------------------ 1061| 0| return if_match(req, "X509v3.KeyUsage", {2, 5, 29, 15}); 1062| 0| case 0x5BDDB: ------------------ | Branch (1062:7): [True: 0, False: 2.53k] ------------------ 1063| 0| return if_match(req, "numsp256d1", {1, 3, 6, 1, 4, 1, 25258, 4, 1}); 1064| 0| case 0x5C0AE: ------------------ | Branch (1064:7): [True: 0, False: 2.53k] ------------------ 1065| 0| return if_match(req, "SphincsPlus-shake-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5}); 1066| 0| case 0x5C10E: ------------------ | Branch (1066:7): [True: 0, False: 2.53k] ------------------ 1067| 0| return if_match(req, "DSA/SHA-384", {2, 16, 840, 1, 101, 3, 4, 3, 3}); 1068| 0| case 0x5CFE5: ------------------ | Branch (1068:7): [True: 0, False: 2.53k] ------------------ 1069| 0| return if_match(req, "PKCS9.X509Certificate", {1, 2, 840, 113549, 1, 9, 22, 1}); 1070| 0| case 0x5D1CF: ------------------ | Branch (1070:7): [True: 0, False: 2.53k] ------------------ 1071| 0| return if_match(req, "X520.SerialNumber", {2, 5, 4, 5}); 1072| 0| case 0x5D375: ------------------ | Branch (1072:7): [True: 0, False: 2.53k] ------------------ 1073| 0| return if_match(req, "SM4/OCB", {1, 2, 156, 10197, 1, 104, 100}); 1074| 0| case 0x5DD49: ------------------ | Branch (1074:7): [True: 0, False: 2.53k] ------------------ 1075| 0| return if_match(req, "AES-128/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 2}); 1076| 0| case 0x5DE4E: ------------------ | Branch (1076:7): [True: 0, False: 2.53k] ------------------ 1077| 0| return if_match(req, "AES-128/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 7}); 1078| 0| case 0x5DF23: ------------------ | Branch (1078:7): [True: 0, False: 2.53k] ------------------ 1079| 0| return if_match(req, "HMAC(SHA-512-256)", {1, 2, 840, 113549, 2, 13}); 1080| 0| case 0x5ED04: ------------------ | Branch (1080:7): [True: 0, False: 2.53k] ------------------ 1081| 0| return if_match(req, "SM2", {1, 2, 156, 10197, 1, 301, 1}); 1082| 0| case 0x5ED05: ------------------ | Branch (1082:7): [True: 0, False: 2.53k] ------------------ 1083| 0| return if_match(req, "SM3", {1, 2, 156, 10197, 1, 401}); 1084| 0| case 0x5FDC6: ------------------ | Branch (1084:7): [True: 0, False: 2.53k] ------------------ 1085| 0| return if_match(req, "ECDSA/SHA-384", {1, 2, 840, 10045, 4, 3, 3}); 1086| 0| case 0x6199F: ------------------ | Branch (1086:7): [True: 0, False: 2.53k] ------------------ 1087| 0| return if_match(req, "SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 2, 7}); 1088| 0| case 0x61E79: ------------------ | Branch (1088:7): [True: 0, False: 2.53k] ------------------ 1089| 0| return if_match(req, "AES-192/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 22}); 1090| 0| case 0x61F7E: ------------------ | Branch (1090:7): [True: 0, False: 2.53k] ------------------ 1091| 0| return if_match(req, "AES-192/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 27}); 1092| 0| case 0x64947: ------------------ | Branch (1092:7): [True: 0, False: 2.53k] ------------------ 1093| 0| return if_match(req, "OpenPGP.Ed25519", {1, 3, 6, 1, 4, 1, 11591, 15, 1}); 1094| 0| case 0x652E7: ------------------ | Branch (1094:7): [True: 0, False: 2.53k] ------------------ 1095| 0| return if_match(req, "sm2p256v1", {1, 2, 156, 10197, 1, 301}); 1096| 0| case 0x6697B: ------------------ | Branch (1096:7): [True: 0, False: 2.53k] ------------------ 1097| 0| return if_match(req, "FrodoKEM-1344-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 3}); 1098| 0| case 0x67B2C: ------------------ | Branch (1098:7): [True: 0, False: 2.53k] ------------------ 1099| 0| return if_match(req, "X520.State", {2, 5, 4, 8}); 1100| 0| case 0x67B9B: ------------------ | Branch (1100:7): [True: 0, False: 2.53k] ------------------ 1101| 0| return if_match(req, "HMAC(SHA-384)", {1, 2, 840, 113549, 2, 10}); 1102| 0| case 0x67D86: ------------------ | Branch (1102:7): [True: 0, False: 2.53k] ------------------ 1103| 0| return if_match(req, "ECGDSA/SHA-384", {1, 3, 36, 3, 3, 2, 5, 4, 5}); 1104| 0| case 0x68A0B: ------------------ | Branch (1104:7): [True: 0, False: 2.53k] ------------------ 1105| 0| return if_match(req, "Camellia-128/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 6}); 1106| 0| case 0x68E33: ------------------ | Branch (1106:7): [True: 0, False: 2.53k] ------------------ 1107| 0| return if_match(req, "PKCS9.ExtensionRequest", {1, 2, 840, 113549, 1, 9, 14}); 1108| 0| case 0x69126: ------------------ | Branch (1108:7): [True: 0, False: 2.53k] ------------------ 1109| 0| return if_match(req, "X509v3.SubjectAlternativeName", {2, 5, 29, 17}); 1110| 0| case 0x692F8: ------------------ | Branch (1110:7): [True: 0, False: 2.53k] ------------------ 1111| 0| return if_match(req, "SM4/CBC", {1, 2, 156, 10197, 1, 104, 2}); 1112| 0| case 0x695E1: ------------------ | Branch (1112:7): [True: 0, False: 2.53k] ------------------ 1113| 0| return if_match(req, "Dilithium-4x4-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 1}); 1114| 0| case 0x696DC: ------------------ | Branch (1114:7): [True: 0, False: 2.53k] ------------------ 1115| 0| return if_match(req, "PKIX.IpAddrBlocks", {1, 3, 6, 1, 5, 5, 7, 1, 7}); 1116| 2.51k| case 0x6A7CA: ------------------ | Branch (1116:7): [True: 2.51k, False: 25] ------------------ 1117| 2.51k| return if_match(req, "ECDSA", {1, 2, 840, 10045, 2, 1}); 1118| 0| case 0x6BD26: ------------------ | Branch (1118:7): [True: 0, False: 2.53k] ------------------ 1119| 0| return if_match(req, "GOST.INN", {1, 2, 643, 3, 131, 1, 1}); 1120| 0| case 0x6CB3B: ------------------ | Branch (1120:7): [True: 0, False: 2.53k] ------------------ 1121| 0| return if_match(req, "Camellia-192/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 7}); 1122| 0| case 0x6E602: ------------------ | Branch (1122:7): [True: 0, False: 2.53k] ------------------ 1123| 0| return if_match(req, "Dilithium-8x7-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 3}); 1124| 0| case 0x6F0C2: ------------------ | Branch (1124:7): [True: 0, False: 2.53k] ------------------ 1125| 0| return if_match(req, "RSA/PKCS1v15(SHA-224)", {1, 2, 840, 113549, 1, 1, 14}); 1126| 0| case 0x6F9F8: ------------------ | Branch (1126:7): [True: 0, False: 2.53k] ------------------ 1127| 0| return if_match(req, "PKCS12.SafeContentsBag", {1, 2, 840, 113549, 1, 12, 10, 1, 6}); 1128| 0| case 0x6FB26: ------------------ | Branch (1128:7): [True: 0, False: 2.53k] ------------------ 1129| 0| return if_match(req, "PKIX.AuthorityInformationAccess", {1, 3, 6, 1, 5, 5, 7, 1, 1}); 1130| 0| case 0x70BB6: ------------------ | Branch (1130:7): [True: 0, False: 2.53k] ------------------ 1131| 0| return if_match(req, "brainpool384r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 11}); 1132| 0| case 0x70EA6: ------------------ | Branch (1132:7): [True: 0, False: 2.53k] ------------------ 1133| 0| return if_match(req, "PKCS12.PKCS8ShroudedKeyBag", {1, 2, 840, 113549, 1, 12, 10, 1, 2}); 1134| 0| case 0x71EB3: ------------------ | Branch (1134:7): [True: 0, False: 2.53k] ------------------ 1135| 0| return if_match(req, "SphincsPlus-haraka-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2}); 1136| 0| case 0x7382C: ------------------ | Branch (1136:7): [True: 0, False: 2.53k] ------------------ 1137| 0| return if_match(req, "ML-KEM-1024", {2, 16, 840, 1, 101, 3, 4, 4, 3}); 1138| 0| case 0x743BD: ------------------ | Branch (1138:7): [True: 0, False: 2.53k] ------------------ 1139| 0| return if_match(req, "AES-256/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 3}); 1140| 0| case 0x7498E: ------------------ | Branch (1140:7): [True: 0, False: 2.53k] ------------------ 1141| 0| return if_match(req, "Camellia-128/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 2}); 1142| 0| case 0x74C2E: ------------------ | Branch (1142:7): [True: 0, False: 2.53k] ------------------ 1143| 0| return if_match(req, "ML-DSA-8x7", {2, 16, 840, 1, 101, 3, 4, 3, 19}); 1144| 0| case 0x7505F: ------------------ | Branch (1144:7): [True: 0, False: 2.53k] ------------------ 1145| 0| return if_match(req, "PKIX.XMPPAddr", {1, 3, 6, 1, 5, 5, 7, 8, 5}); 1146| 0| case 0x7517A: ------------------ | Branch (1146:7): [True: 0, False: 2.53k] ------------------ 1147| 0| return if_match(req, "RSA/PKCS1v15(MD2)", {1, 2, 840, 113549, 1, 1, 2}); 1148| 0| case 0x7546B: ------------------ | Branch (1148:7): [True: 0, False: 2.53k] ------------------ 1149| 0| return if_match(req, "RSA/PKCS1v15(MD5)", {1, 2, 840, 113549, 1, 1, 4}); 1150| 0| case 0x75921: ------------------ | Branch (1150:7): [True: 0, False: 2.53k] ------------------ 1151| 0| return if_match(req, "ClassicMcEliece_348864f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 2}); 1152| 0| case 0x76784: ------------------ | Branch (1152:7): [True: 0, False: 2.53k] ------------------ 1153| 0| return if_match(req, "SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 2, 9}); 1154| 0| case 0x768FD: ------------------ | Branch (1154:7): [True: 0, False: 2.53k] ------------------ 1155| 0| return if_match(req, "PKCS9.LocalKeyId", {1, 2, 840, 113549, 1, 9, 21}); 1156| 0| case 0x76A19: ------------------ | Branch (1156:7): [True: 0, False: 2.53k] ------------------ 1157| 0| return if_match(req, "brainpool512r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 13}); 1158| 0| case 0x77254: ------------------ | Branch (1158:7): [True: 0, False: 2.53k] ------------------ 1159| 0| return if_match(req, "SphincsPlus-haraka-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5}); 1160| 0| case 0x77ADC: ------------------ | Branch (1160:7): [True: 0, False: 2.53k] ------------------ 1161| 0| return if_match(req, "secp224k1", {1, 3, 132, 0, 32}); 1162| 0| case 0x781B9: ------------------ | Branch (1162:7): [True: 0, False: 2.53k] ------------------ 1163| 0| return if_match(req, "secp224r1", {1, 3, 132, 0, 33}); 1164| 0| case 0x78ABE: ------------------ | Branch (1164:7): [True: 0, False: 2.53k] ------------------ 1165| 0| return if_match(req, "Camellia-192/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 3}); 1166| 0| case 0x792F2: ------------------ | Branch (1166:7): [True: 0, False: 2.53k] ------------------ 1167| 0| return if_match(req, "ClassicMcEliece_6688128pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 1}); 1168| 0| case 0x7A661: ------------------ | Branch (1168:7): [True: 0, False: 2.53k] ------------------ 1169| 0| return if_match(req, "DSA/SHA-512", {2, 16, 840, 1, 101, 3, 4, 3, 4}); 1170| 0| case 0x7A977: ------------------ | Branch (1170:7): [True: 0, False: 2.53k] ------------------ 1171| 0| return if_match(req, "X509v3.ExtendedKeyUsage", {2, 5, 29, 37}); 1172| 0| case 0x7AE67: ------------------ | Branch (1172:7): [True: 0, False: 2.53k] ------------------ 1173| 0| return if_match(req, "SM2_Enc", {1, 2, 156, 10197, 1, 301, 3}); 1174| 0| case 0x7B602: ------------------ | Branch (1174:7): [True: 0, False: 2.53k] ------------------ 1175| 0| return if_match(req, "Twofish/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 5}); 1176| 0| case 0x7B9A1: ------------------ | Branch (1176:7): [True: 0, False: 2.53k] ------------------ 1177| 0| return if_match(req, "SphincsPlus-sha2-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3}); 1178| 1| case 0x7BB0A: ------------------ | Branch (1178:7): [True: 1, False: 2.53k] ------------------ 1179| 1| return if_match(req, "SLH-DSA-SHAKE-256f", {2, 16, 840, 1, 101, 3, 4, 3, 31}); 1180| 1| case 0x7BB17: ------------------ | Branch (1180:7): [True: 1, False: 2.53k] ------------------ 1181| 1| return if_match(req, "SLH-DSA-SHAKE-256s", {2, 16, 840, 1, 101, 3, 4, 3, 30}); 1182| 0| case 0x7BCF3: ------------------ | Branch (1182:7): [True: 0, False: 2.53k] ------------------ 1183| 0| return if_match(req, "PKIX.EmailProtection", {1, 3, 6, 1, 5, 5, 7, 3, 4}); 1184| 0| case 0x7CC2C: ------------------ | Branch (1184:7): [True: 0, False: 2.53k] ------------------ 1185| 0| return if_match(req, "SHA-512-256", {2, 16, 840, 1, 101, 3, 4, 2, 6}); 1186| 0| case 0x7CF41: ------------------ | Branch (1186:7): [True: 0, False: 2.53k] ------------------ 1187| 0| return if_match(req, "SphincsPlus-shake-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3}); 1188| 2| case 0x7DB91: ------------------ | Branch (1188:7): [True: 2, False: 2.53k] ------------------ 1189| 2| return if_match(req, "GOST-34.10", {1, 2, 643, 2, 2, 19}); 1190| 0| case 0x7E319: ------------------ | Branch (1190:7): [True: 0, False: 2.53k] ------------------ 1191| 0| return if_match(req, "ECDSA/SHA-512", {1, 2, 840, 10045, 4, 3, 4}); 1192| 0| case 0x7E874: ------------------ | Branch (1192:7): [True: 0, False: 2.53k] ------------------ 1193| 0| return if_match(req, "ClassicMcEliece_6688128f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 6}); 1194| 0| case 0x7EAAF: ------------------ | Branch (1194:7): [True: 0, False: 2.53k] ------------------ 1195| 0| return if_match(req, "eFrodoKEM-640-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 1}); 1196| 0| case 0x7F51F: ------------------ | Branch (1196:7): [True: 0, False: 2.53k] ------------------ 1197| 0| return if_match(req, "PKIX.IPsecTunnel", {1, 3, 6, 1, 5, 5, 7, 3, 6}); 1198| 0| case 0x80272: ------------------ | Branch (1198:7): [True: 0, False: 2.53k] ------------------ 1199| 0| return if_match(req, "X520.Organization", {2, 5, 4, 10}); 1200| 0| case 0x80340: ------------------ | Branch (1200:7): [True: 0, False: 2.53k] ------------------ 1201| 0| return if_match(req, "AES-256/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 42}); 1202| 0| case 0x80445: ------------------ | Branch (1202:7): [True: 0, False: 2.53k] ------------------ 1203| 0| return if_match(req, "AES-256/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 47}); 1204| 0| case 0x80E71: ------------------ | Branch (1204:7): [True: 0, False: 2.53k] ------------------ 1205| 0| return if_match(req, "PKIX.STIRTNList", {1, 3, 6, 1, 5, 5, 7, 48, 14}); 1206| 0| case 0x811F7: ------------------ | Branch (1206:7): [True: 0, False: 2.53k] ------------------ 1207| 0| return if_match(req, "HMAC(SHA-256)", {1, 2, 840, 113549, 2, 9}); 1208| 0| case 0x82434: ------------------ | Branch (1208:7): [True: 0, False: 2.53k] ------------------ 1209| 0| return if_match(req, "PKCS9.X509CRL", {1, 2, 840, 113549, 1, 9, 23, 1}); 1210| 0| case 0x82B47: ------------------ | Branch (1210:7): [True: 0, False: 2.53k] ------------------ 1211| 0| return if_match(req, "Threefish-512/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 2}); 1212| 0| case 0x83EA7: ------------------ | Branch (1212:7): [True: 0, False: 2.53k] ------------------ 1213| 0| return if_match(req, "RSA/PKCS1v15(SHA-384)", {1, 2, 840, 113549, 1, 1, 12}); 1214| 0| case 0x84596: ------------------ | Branch (1214:7): [True: 0, False: 2.53k] ------------------ 1215| 0| return if_match(req, "eFrodoKEM-640-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 1}); 1216| 0| case 0x8469F: ------------------ | Branch (1216:7): [True: 0, False: 2.53k] ------------------ 1217| 0| return if_match(req, "ClassicMcEliece_6960119pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 4}); 1218| 0| case 0x84CA4: ------------------ | Branch (1218:7): [True: 0, False: 2.53k] ------------------ 1219| 0| return if_match(req, "secp256k1", {1, 3, 132, 0, 10}); 1220| 0| case 0x85381: ------------------ | Branch (1220:7): [True: 0, False: 2.53k] ------------------ 1221| 0| return if_match(req, "secp256r1", {1, 2, 840, 10045, 3, 1, 7}); 1222| 0| case 0x854FC: ------------------ | Branch (1222:7): [True: 0, False: 2.53k] ------------------ 1223| 0| return if_match(req, "PKIX.IPsecUser", {1, 3, 6, 1, 5, 5, 7, 3, 7}); 1224| 0| case 0x85F51: ------------------ | Branch (1224:7): [True: 0, False: 2.53k] ------------------ 1225| 0| return if_match(req, "Serpent/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 4}); 1226| 0| case 0x862D9: ------------------ | Branch (1226:7): [True: 0, False: 2.53k] ------------------ 1227| 0| return if_match(req, "ECGDSA/SHA-512", {1, 3, 36, 3, 3, 2, 5, 4, 6}); 1228| 0| case 0x87585: ------------------ | Branch (1228:7): [True: 0, False: 2.53k] ------------------ 1229| 0| return if_match(req, "Twofish/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 3}); 1230| 0| case 0x877D1: ------------------ | Branch (1230:7): [True: 0, False: 2.53k] ------------------ 1231| 0| return if_match(req, "PKCS9.EmailAddress", {1, 2, 840, 113549, 1, 9, 1}); 1232| 0| case 0x87D27: ------------------ | Branch (1232:7): [True: 0, False: 2.53k] ------------------ 1233| 0| return if_match(req, "PKIX.CertificateAuthorityIssuers", {1, 3, 6, 1, 5, 5, 7, 48, 2}); 1234| 0| case 0x87E42: ------------------ | Branch (1234:7): [True: 0, False: 2.53k] ------------------ 1235| 0| return if_match(req, "X509v3.AuthorityKeyIdentifier", {2, 5, 29, 35}); 1236| 0| case 0x889B1: ------------------ | Branch (1236:7): [True: 0, False: 2.53k] ------------------ 1237| 0| return if_match(req, "ECDSA/SHA-1", {1, 2, 840, 10045, 4, 1}); 1238| 0| case 0x89658: ------------------ | Branch (1238:7): [True: 0, False: 2.53k] ------------------ 1239| 0| return if_match(req, "PBE-PKCS5v20", {1, 2, 840, 113549, 1, 5, 13}); 1240| 0| case 0x8976D: ------------------ | Branch (1240:7): [True: 0, False: 2.53k] ------------------ 1241| 0| return if_match(req, "PKCS9.MessageDigest", {1, 2, 840, 113549, 1, 9, 4}); 1242| 0| case 0x8B002: ------------------ | Branch (1242:7): [True: 0, False: 2.53k] ------------------ 1243| 0| return if_match(req, "Camellia-256/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 8}); 1244| 0| case 0x8B935: ------------------ | Branch (1244:7): [True: 0, False: 2.53k] ------------------ 1245| 0| return if_match(req, "ClassicMcEliece_6688128", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 5}); 1246| 0| case 0x8BB11: ------------------ | Branch (1246:7): [True: 0, False: 2.53k] ------------------ 1247| 0| return if_match(req, "X509v3.NoRevocationAvailable", {2, 5, 29, 56}); 1248| 0| case 0x8CE3D: ------------------ | Branch (1248:7): [True: 0, False: 2.53k] ------------------ 1249| 0| return if_match(req, "PKCS9.ChallengePassword", {1, 2, 840, 113549, 1, 9, 7}); 1250| 0| case 0x8D45C: ------------------ | Branch (1250:7): [True: 0, False: 2.53k] ------------------ 1251| 0| return if_match(req, "ECKCDSA", {1, 0, 14888, 3, 0, 5}); 1252| 0| case 0x8E0C1: ------------------ | Branch (1252:7): [True: 0, False: 2.53k] ------------------ 1253| 0| return if_match(req, "X509v3.CertificatePolicies", {2, 5, 29, 32}); 1254| 0| case 0x8E39A: ------------------ | Branch (1254:7): [True: 0, False: 2.53k] ------------------ 1255| 0| return if_match(req, "HSS-LMS-Private-Key", {1, 3, 6, 1, 4, 1, 25258, 1, 13}); 1256| 0| case 0x8EC51: ------------------ | Branch (1256:7): [True: 0, False: 2.53k] ------------------ 1257| 0| return if_match(req, "Kyber-768-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 2}); 1258| 0| case 0x8F94A: ------------------ | Branch (1258:7): [True: 0, False: 2.53k] ------------------ 1259| 0| return if_match(req, "Dilithium-6x5-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 2}); 1260| 0| case 0x8FC20: ------------------ | Branch (1260:7): [True: 0, False: 2.53k] ------------------ 1261| 0| return if_match(req, "AES-128/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 1}); 1262| 0| case 0x8FDE0: ------------------ | Branch (1262:7): [True: 0, False: 2.53k] ------------------ 1263| 0| return if_match(req, "SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 2, 8}); 1264| 0| case 0x919E3: ------------------ | Branch (1264:7): [True: 0, False: 2.53k] ------------------ 1265| 0| return if_match(req, "Serpent/GCM", {1, 3, 6, 1, 4, 1, 25258, 3, 101}); 1266| 0| case 0x91C1A: ------------------ | Branch (1266:7): [True: 0, False: 2.53k] ------------------ 1267| 0| return if_match(req, "X25519", {1, 3, 101, 110}); 1268| 0| case 0x91DC4: ------------------ | Branch (1268:7): [True: 0, False: 2.53k] ------------------ 1269| 0| return if_match(req, "McEliece", {1, 3, 6, 1, 4, 1, 25258, 1, 3}); 1270| 0| case 0x93467: ------------------ | Branch (1270:7): [True: 0, False: 2.53k] ------------------ 1271| 0| return if_match(req, "Dilithium-6x5-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 2}); 1272| 0| case 0x93D50: ------------------ | Branch (1272:7): [True: 0, False: 2.53k] ------------------ 1273| 0| return if_match(req, "AES-192/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 2}); 1274| 3| case 0x95166: ------------------ | Branch (1274:7): [True: 3, False: 2.53k] ------------------ 1275| 3| return if_match(req, "SLH-DSA-SHAKE-128f", {2, 16, 840, 1, 101, 3, 4, 3, 27}); 1276| 1| case 0x95173: ------------------ | Branch (1276:7): [True: 1, False: 2.53k] ------------------ 1277| 1| return if_match(req, "SLH-DSA-SHAKE-128s", {2, 16, 840, 1, 101, 3, 4, 3, 26}); 1278| 0| case 0x952D6: ------------------ | Branch (1278:7): [True: 0, False: 2.53k] ------------------ 1279| 0| return if_match(req, "PKIX.OCSP", {1, 3, 6, 1, 5, 5, 7, 48, 1}); 1280| 0| case 0x959B9: ------------------ | Branch (1280:7): [True: 0, False: 2.53k] ------------------ 1281| 0| return if_match(req, "PKIX.IPsecEndSystem", {1, 3, 6, 1, 5, 5, 7, 3, 5}); 1282| 0| case 0x96F85: ------------------ | Branch (1282:7): [True: 0, False: 2.53k] ------------------ 1283| 0| return if_match(req, "Camellia-256/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 4}); 1284| 0| case 0x97D5E: ------------------ | Branch (1284:7): [True: 0, False: 2.53k] ------------------ 1285| 0| return if_match(req, "HMAC(SHA-1)", {1, 2, 840, 113549, 2, 7}); 1286| 0| case 0x9805C: ------------------ | Branch (1286:7): [True: 0, False: 2.53k] ------------------ 1287| 0| return if_match(req, "SEED/CBC", {1, 2, 410, 200004, 1, 4}); 1288| 0| case 0x980E7: ------------------ | Branch (1288:7): [True: 0, False: 2.53k] ------------------ 1289| 0| return if_match(req, "SphincsPlus-haraka-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3}); 1290| 0| case 0x980F5: ------------------ | Branch (1290:7): [True: 0, False: 2.53k] ------------------ 1291| 0| return if_match(req, "GOST.SubjectSigningTool", {1, 2, 643, 100, 111}); 1292| 0| case 0x98B03: ------------------ | Branch (1292:7): [True: 0, False: 2.53k] ------------------ 1293| 0| return if_match(req, "XMSS", {0, 4, 0, 127, 0, 15, 1, 1, 13, 0}); 1294| 0| case 0x9A6B2: ------------------ | Branch (1294:7): [True: 0, False: 2.53k] ------------------ 1295| 0| return if_match(req, "ECKCDSA/SHA-1", {1, 2, 410, 200004, 1, 100, 4, 3}); 1296| 0| case 0x9B1CF: ------------------ | Branch (1296:7): [True: 0, False: 2.53k] ------------------ 1297| 0| return if_match(req, "SM4/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 9}); 1298| 0| case 0x9B6B2: ------------------ | Branch (1298:7): [True: 0, False: 2.53k] ------------------ 1299| 0| return if_match(req, "AES-128/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 6}); 1300| 0| case 0x9B6BB: ------------------ | Branch (1300:7): [True: 0, False: 2.53k] ------------------ 1301| 0| return if_match(req, "X520.OrganizationalUnit", {2, 5, 4, 11}); 1302| 0| case 0x9B851: ------------------ | Branch (1302:7): [True: 0, False: 2.53k] ------------------ 1303| 0| return if_match(req, "OpenPGP.Curve25519", {1, 3, 6, 1, 4, 1, 3029, 1, 5, 1}); 1304| 2| case 0x9C80B: ------------------ | Branch (1304:7): [True: 2, False: 2.53k] ------------------ 1305| 2| return if_match(req, "SLH-DSA-SHA2-192f", {2, 16, 840, 1, 101, 3, 4, 3, 23}); 1306| 2| case 0x9C818: ------------------ | Branch (1306:7): [True: 2, False: 2.53k] ------------------ 1307| 2| return if_match(req, "SLH-DSA-SHA2-192s", {2, 16, 840, 1, 101, 3, 4, 3, 22}); 1308| 0| case 0x9CD2B: ------------------ | Branch (1308:7): [True: 0, False: 2.53k] ------------------ 1309| 0| return if_match(req, "Scrypt", {1, 3, 6, 1, 4, 1, 11591, 4, 11}); 1310| 0| case 0x9CDE1: ------------------ | Branch (1310:7): [True: 0, False: 2.53k] ------------------ 1311| 0| return if_match(req, "GOST-34.10-2012-256/SHA-256", {1, 3, 6, 1, 4, 1, 25258, 1, 6, 1}); 1312| 0| case 0x9CF73: ------------------ | Branch (1312:7): [True: 0, False: 2.53k] ------------------ 1313| 0| return if_match(req, "ClassicMcEliece_460896f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 4}); 1314| 0| case 0x9D354: ------------------ | Branch (1314:7): [True: 0, False: 2.53k] ------------------ 1315| 0| return if_match(req, "RIPEMD-160", {1, 3, 36, 3, 2, 1}); 1316| 0| case 0x9D503: ------------------ | Branch (1316:7): [True: 0, False: 2.53k] ------------------ 1317| 0| return if_match(req, "RSA/PKCS1v15(SHA-256)", {1, 2, 840, 113549, 1, 1, 11}); 1318| 0| case 0x9EC88: ------------------ | Branch (1318:7): [True: 0, False: 2.53k] ------------------ 1319| 0| return if_match(req, "DSA/SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 3, 8}); 1320| 0| case 0x9EF36: ------------------ | Branch (1320:7): [True: 0, False: 2.53k] ------------------ 1321| 0| return if_match(req, "ClassicMcEliece_6960119", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 7}); 1322| 0| case 0x9F764: ------------------ | Branch (1322:7): [True: 0, False: 2.53k] ------------------ 1323| 0| return if_match(req, "X448", {1, 3, 101, 111}); 1324| 0| case 0x9F7E2: ------------------ | Branch (1324:7): [True: 0, False: 2.53k] ------------------ 1325| 0| return if_match(req, "AES-192/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 26}); 1326| 0| case 0x9F9C5: ------------------ | Branch (1326:7): [True: 0, False: 2.53k] ------------------ 1327| 0| return if_match(req, "ClassicMcEliece_6688128pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 2}); 1328| 0| case 0xA0805: ------------------ | Branch (1328:7): [True: 0, False: 2.53k] ------------------ 1329| 0| return if_match(req, "PKCS9.SDSICertificate", {1, 2, 840, 113549, 1, 9, 22, 2}); 1330| 0| case 0xA2B5B: ------------------ | Branch (1330:7): [True: 0, False: 2.53k] ------------------ 1331| 0| return if_match(req, "X509v3.CRLNumber", {2, 5, 29, 20}); 1332| 0| case 0xA3005: ------------------ | Branch (1332:7): [True: 0, False: 2.53k] ------------------ 1333| 0| return if_match(req, "X520.Title", {2, 5, 4, 12}); 1334| 0| case 0xA323F: ------------------ | Branch (1334:7): [True: 0, False: 2.53k] ------------------ 1335| 0| return if_match(req, "X509v3.NameConstraints", {2, 5, 29, 30}); 1336| 0| case 0xA3C55: ------------------ | Branch (1336:7): [True: 0, False: 2.53k] ------------------ 1337| 0| return if_match(req, "X520.Pseudonym", {2, 5, 4, 65}); 1338| 0| case 0xA4809: ------------------ | Branch (1338:7): [True: 0, False: 2.53k] ------------------ 1339| 0| return if_match(req, "SphincsPlus-sha2-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6}); 1340| 0| case 0xA57AF: ------------------ | Branch (1340:7): [True: 0, False: 2.53k] ------------------ 1341| 0| return if_match(req, "secp521r1", {1, 3, 132, 0, 35}); 1342| 0| case 0xA5DA9: ------------------ | Branch (1342:7): [True: 0, False: 2.53k] ------------------ 1343| 0| return if_match(req, "SphincsPlus-shake-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6}); 1344| 0| case 0xA6865: ------------------ | Branch (1344:7): [True: 0, False: 2.53k] ------------------ 1345| 0| return if_match(req, "Camellia-128/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 6}); 1346| 0| case 0xA6C61: ------------------ | Branch (1346:7): [True: 0, False: 2.53k] ------------------ 1347| 0| return if_match(req, "SM4/GCM", {1, 2, 156, 10197, 1, 104, 8}); 1348| 0| case 0xA8439: ------------------ | Branch (1348:7): [True: 0, False: 2.53k] ------------------ 1349| 0| return if_match(req, "PKCS12.CertBag", {1, 2, 840, 113549, 1, 12, 10, 1, 3}); 1350| 0| case 0xA9061: ------------------ | Branch (1350:7): [True: 0, False: 2.53k] ------------------ 1351| 0| return if_match(req, "Kyber-768-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 2}); 1352| 0| case 0xAA995: ------------------ | Branch (1352:7): [True: 0, False: 2.53k] ------------------ 1353| 0| return if_match(req, "Camellia-192/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 7}); 1354| 0| case 0xAAE2B: ------------------ | Branch (1354:7): [True: 0, False: 2.53k] ------------------ 1355| 0| return if_match(req, "Dilithium-8x7-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 3}); 1356| 0| case 0xABCED: ------------------ | Branch (1356:7): [True: 0, False: 2.53k] ------------------ 1357| 0| return if_match(req, "GOST.IssuerSigningTool", {1, 2, 643, 100, 112}); 1358| 0| case 0xABD24: ------------------ | Branch (1358:7): [True: 0, False: 2.53k] ------------------ 1359| 0| return if_match(req, "RSA/OAEP", {1, 2, 840, 113549, 1, 1, 7}); 1360| 0| case 0xAC2EC: ------------------ | Branch (1360:7): [True: 0, False: 2.53k] ------------------ 1361| 0| return if_match(req, "Streebog-256", {1, 2, 643, 7, 1, 1, 2, 2}); 1362| 0| case 0xAC3DD: ------------------ | Branch (1362:7): [True: 0, False: 2.53k] ------------------ 1363| 0| return if_match(req, "Certificate Comment", {2, 16, 840, 1, 113730, 1, 13}); 1364| 0| case 0xAC511: ------------------ | Branch (1364:7): [True: 0, False: 2.53k] ------------------ 1365| 0| return if_match(req, "PBE-SHA1-3DES", {1, 2, 840, 113549, 1, 12, 1, 3}); 1366| 0| case 0xAE6FE: ------------------ | Branch (1366:7): [True: 0, False: 2.53k] ------------------ 1367| 0| return if_match(req, "PKIX.ClientAuth", {1, 3, 6, 1, 5, 5, 7, 3, 2}); 1368| 0| case 0xAE8D3: ------------------ | Branch (1368:7): [True: 0, False: 2.53k] ------------------ 1369| 0| return if_match(req, "ClassicMcEliece_8192128pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 6}); 1370| 0| case 0xAF476: ------------------ | Branch (1370:7): [True: 0, False: 2.53k] ------------------ 1371| 0| return if_match(req, "ECDH", {1, 3, 132, 1, 12}); 1372| 0| case 0xAFA6A: ------------------ | Branch (1372:7): [True: 0, False: 2.53k] ------------------ 1373| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(384))", {2, 16, 840, 1, 101, 3, 4, 3, 15}); 1374| 0| case 0xB2217: ------------------ | Branch (1374:7): [True: 0, False: 2.53k] ------------------ 1375| 0| return if_match(req, "AES-256/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 3}); 1376| 0| case 0xB22F7: ------------------ | Branch (1376:7): [True: 0, False: 2.53k] ------------------ 1377| 0| return if_match(req, "Camellia-128/GCM", {0, 3, 4401, 5, 3, 1, 9, 6}); 1378| 0| case 0xB23DE: ------------------ | Branch (1378:7): [True: 0, False: 2.53k] ------------------ 1379| 0| return if_match(req, "X520.Locality", {2, 5, 4, 7}); 1380| 0| case 0xB2FBD: ------------------ | Branch (1380:7): [True: 0, False: 2.53k] ------------------ 1381| 0| return if_match(req, "ECKCDSA/SHA-224", {1, 2, 410, 200004, 1, 100, 4, 4}); 1382| 0| case 0xB32B0: ------------------ | Branch (1382:7): [True: 0, False: 2.53k] ------------------ 1383| 0| return if_match(req, "ECKCDSA/SHA-256", {1, 2, 410, 200004, 1, 100, 4, 5}); 1384| 0| case 0xB360E: ------------------ | Branch (1384:7): [True: 0, False: 2.53k] ------------------ 1385| 0| return if_match(req, "eFrodoKEM-976-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 2}); 1386| 0| case 0xB4368: ------------------ | Branch (1386:7): [True: 0, False: 2.53k] ------------------ 1387| 0| return if_match(req, "ECGDSA/SHA-1", {1, 3, 36, 3, 3, 2, 5, 4, 2}); 1388| 0| case 0xB58CD: ------------------ | Branch (1388:7): [True: 0, False: 2.53k] ------------------ 1389| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(512))", {2, 16, 840, 1, 101, 3, 4, 3, 16}); 1390| 0| case 0xB6427: ------------------ | Branch (1390:7): [True: 0, False: 2.53k] ------------------ 1391| 0| return if_match(req, "Camellia-192/GCM", {0, 3, 4401, 5, 3, 1, 9, 26}); 1392| 0| case 0xB7102: ------------------ | Branch (1392:7): [True: 0, False: 2.53k] ------------------ 1393| 0| return if_match(req, "brainpool224r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 5}); 1394| 0| case 0xB710D: ------------------ | Branch (1394:7): [True: 0, False: 2.53k] ------------------ 1395| 0| return if_match(req, "X509v3.CRLIssuingDistributionPoint", {2, 5, 29, 28}); 1396| 0| case 0xB72D4: ------------------ | Branch (1396:7): [True: 0, False: 2.53k] ------------------ 1397| 0| return if_match(req, "Microsoft UPN", {1, 3, 6, 1, 4, 1, 311, 20, 2, 3}); 1398| 0| case 0xB73A5: ------------------ | Branch (1398:7): [True: 0, False: 2.53k] ------------------ 1399| 0| return if_match(req, "RSA/PSS", {1, 2, 840, 113549, 1, 1, 10}); 1400| 0| case 0xB84B3: ------------------ | Branch (1400:7): [True: 0, False: 2.53k] ------------------ 1401| 0| return if_match(req, "PKIX.CodeSigning", {1, 3, 6, 1, 5, 5, 7, 3, 3}); 1402| 1| case 0xB8CB9: ------------------ | Branch (1402:7): [True: 1, False: 2.53k] ------------------ 1403| 1| return if_match(req, "GOST-34.10-2012-256", {1, 2, 643, 7, 1, 1, 1, 1}); 1404| 0| case 0xB945C: ------------------ | Branch (1404:7): [True: 0, False: 2.53k] ------------------ 1405| 0| return if_match(req, "Twofish/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 5}); 1406| 0| case 0xB94E4: ------------------ | Branch (1406:7): [True: 0, False: 2.53k] ------------------ 1407| 0| return if_match(req, "gost_512A", {1, 2, 643, 7, 1, 2, 1, 2, 1}); 1408| 0| case 0xB94E5: ------------------ | Branch (1408:7): [True: 0, False: 2.53k] ------------------ 1409| 0| return if_match(req, "gost_512B", {1, 2, 643, 7, 1, 2, 1, 2, 2}); 1410| 0| case 0xBA1D8: ------------------ | Branch (1410:7): [True: 0, False: 2.53k] ------------------ 1411| 0| return if_match(req, "X520.StreetAddress", {2, 5, 4, 9}); 1412| 0| case 0xBCB45: ------------------ | Branch (1412:7): [True: 0, False: 2.53k] ------------------ 1413| 0| return if_match(req, "PKCS12.CRLBag", {1, 2, 840, 113549, 1, 12, 10, 1, 4}); 1414| 0| case 0xBCC82: ------------------ | Branch (1414:7): [True: 0, False: 2.53k] ------------------ 1415| 0| return if_match(req, "x962_p239v1", {1, 2, 840, 10045, 3, 1, 4}); 1416| 0| case 0xBCC83: ------------------ | Branch (1416:7): [True: 0, False: 2.53k] ------------------ 1417| 0| return if_match(req, "x962_p239v2", {1, 2, 840, 10045, 3, 1, 5}); 1418| 0| case 0xBCC84: ------------------ | Branch (1418:7): [True: 0, False: 2.53k] ------------------ 1419| 0| return if_match(req, "x962_p239v3", {1, 2, 840, 10045, 3, 1, 6}); 1420| 0| case 0xBD92B: ------------------ | Branch (1420:7): [True: 0, False: 2.53k] ------------------ 1421| 0| return if_match(req, "X509v3.HoldInstructionCode", {2, 5, 29, 23}); 1422| 0| case 0xBDCA9: ------------------ | Branch (1422:7): [True: 0, False: 2.53k] ------------------ 1423| 0| return if_match(req, "AES-256/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 46}); 1424| 0| case 0xBE48D: ------------------ | Branch (1424:7): [True: 0, False: 2.53k] ------------------ 1425| 0| return if_match(req, "PKIX.OCSP.BasicResponse", {1, 3, 6, 1, 5, 5, 7, 48, 1, 1}); 1426| 0| case 0xBF71E: ------------------ | Branch (1426:7): [True: 0, False: 2.53k] ------------------ 1427| 0| return if_match(req, "Kyber-1024-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 3}); 1428| 0| case 0xBFF01: ------------------ | Branch (1428:7): [True: 0, False: 2.53k] ------------------ 1429| 0| return if_match(req, "DSA/SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 3, 5}); 1430| 0| case 0xC0F4F: ------------------ | Branch (1430:7): [True: 0, False: 2.53k] ------------------ 1431| 0| return if_match(req, "SphincsPlus-haraka-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6}); 1432| 0| case 0xC1875: ------------------ | Branch (1432:7): [True: 0, False: 2.53k] ------------------ 1433| 0| return if_match(req, "SHA-1", {1, 3, 14, 3, 2, 26}); 1434| 0| case 0xC28D1: ------------------ | Branch (1434:7): [True: 0, False: 2.53k] ------------------ 1435| 0| return if_match(req, "PKIX.OCSPSigning", {1, 3, 6, 1, 5, 5, 7, 3, 9}); 1436| 0| case 0xC42CA: ------------------ | Branch (1436:7): [True: 0, False: 2.53k] ------------------ 1437| 0| return if_match(req, "brainpool256r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 7}); 1438| 0| default: ------------------ | Branch (1438:7): [True: 0, False: 2.53k] ------------------ 1439| 0| return {}; 1440| 2.53k| } 1441| 2.53k|} _ZN5Botan7OID_Map16load_oid2str_mapEv: 1443| 1|std::unordered_map OID_Map::load_oid2str_map() { 1444| 1| return { 1445| 1| {OID{2, 5, 8, 1, 1}, "RSA"}, 1446| 1| {OID{1, 3, 6, 1, 4, 1, 8301, 3, 1, 2, 9, 0, 38}, "secp521r1"}, 1447| 1| {OID{1, 2, 643, 2, 2, 35, 1}, "gost_256A"}, 1448| 1| {OID{1, 2, 643, 2, 2, 36, 0}, "gost_256A"}, 1449| 1| }; 1450| 1|} _ZN5Botan7OID_Map16load_str2oid_mapEv: 1452| 1|std::unordered_map OID_Map::load_str2oid_map() { 1453| 1| return { 1454| 1| {"Curve25519", OID{1, 3, 101, 110}}, 1455| 1| {"SM2_Sig", OID{1, 2, 156, 10197, 1, 301, 1}}, 1456| 1| {"RSA/EMSA3(MD2)", OID{1, 2, 840, 113549, 1, 1, 2}}, 1457| 1| {"RSA/EMSA3(MD5)", OID{1, 2, 840, 113549, 1, 1, 4}}, 1458| 1| {"RSA/EMSA3(SHA-1)", OID{1, 2, 840, 113549, 1, 1, 5}}, 1459| 1| {"RSA/EMSA3(SHA-256)", OID{1, 2, 840, 113549, 1, 1, 11}}, 1460| 1| {"RSA/EMSA3(SHA-384)", OID{1, 2, 840, 113549, 1, 1, 12}}, 1461| 1| {"RSA/EMSA3(SHA-512)", OID{1, 2, 840, 113549, 1, 1, 13}}, 1462| 1| {"RSA/EMSA3(SHA-224)", OID{1, 2, 840, 113549, 1, 1, 14}}, 1463| 1| {"RSA/EMSA3(SHA-512-256)", OID{1, 2, 840, 113549, 1, 1, 16}}, 1464| 1| {"RSA/EMSA3(SHA-3(224))", OID{2, 16, 840, 1, 101, 3, 4, 3, 13}}, 1465| 1| {"RSA/EMSA3(SHA-3(256))", OID{2, 16, 840, 1, 101, 3, 4, 3, 14}}, 1466| 1| {"RSA/EMSA3(SHA-3(384))", OID{2, 16, 840, 1, 101, 3, 4, 3, 15}}, 1467| 1| {"RSA/EMSA3(SHA-3(512))", OID{2, 16, 840, 1, 101, 3, 4, 3, 16}}, 1468| 1| {"RSA/EMSA3(SM3)", OID{1, 2, 156, 10197, 1, 504}}, 1469| 1| {"RSA/EMSA3(RIPEMD-160)", OID{1, 3, 36, 3, 3, 1, 2}}, 1470| 1| {"RSA/EMSA4", OID{1, 2, 840, 113549, 1, 1, 10}}, 1471| 1| {"PBES2", OID{1, 2, 840, 113549, 1, 5, 13}}, 1472| 1| }; 1473| 1|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_18if_matchERKNS_3OIDESt16initializer_listIjENSt3__117basic_string_viewIcNS6_11char_traitsIcEEEE: 18| 10.9k|std::optional if_match(const OID& oid, std::initializer_list val, std::string_view name) { 19| 10.9k| if(oid.matches(val)) { ------------------ | Branch (19:7): [True: 10.5k, False: 361] ------------------ 20| 10.5k| return name; 21| 10.5k| } else { 22| 361| return {}; 23| 361| } 24| 10.9k|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_113hash_oid_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 34| 2.53k|uint32_t hash_oid_name(std::string_view s) { 35| 2.53k| uint64_t hash = 0x8188B31879A4879A; 36| | 37| 12.9k| for(const char c : s) { ------------------ | Branch (37:21): [True: 12.9k, False: 2.53k] ------------------ 38| 12.9k| hash *= 251; 39| 12.9k| hash += c; 40| 12.9k| } 41| | 42| 2.53k| return static_cast(hash % 805289); 43| 2.53k|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_18if_matchENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_St16initializer_listIjE: 26| 2.53k|std::optional if_match(std::string_view req, std::string_view actual, std::initializer_list oid) { 27| 2.53k| if(req == actual) { ------------------ | Branch (27:7): [True: 2.53k, False: 0] ------------------ 28| 2.53k| return OID(oid); 29| 2.53k| } else { 30| 0| return {}; 31| 0| } 32| 2.53k|} _ZN5Botan20Buffered_Computation5finalENSt3__14spanIhLm18446744073709551615EEE: 54| 38|void Buffered_Computation::final(std::span out) { 55| 38| BOTAN_ARG_CHECK(out.size() >= output_length(), "Output buffer has insufficient capacity"); ------------------ | | 35| 38| do { \ | | 36| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 38| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 38] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 38| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 38] | | ------------------ ------------------ 56| | // Pass exactly output_length() bytes so that an oversized buffer has the 57| | // result written to its leading bytes with the remainder left untouched. 58| 38| final_result(out.first(output_length())); 59| 38|} _ZN5Botan13base64_decodeEPhPKcmb: 208| 144|size_t base64_decode(uint8_t output[], const char input[], size_t input_length, bool ignore_ws) { 209| 144|#if defined(BOTAN_HAS_BASE64_AVX512) 210| 144| if(input_length >= 128 && CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::POPCNT)) { ------------------ | Branch (210:7): [True: 47, False: 97] | Branch (210:30): [True: 0, False: 47] ------------------ 211| | // Decoding directly stops at the first block containing whitespace, 212| | // padding, or an invalid character 213| 0| const uint8_t* in8 = as_span_of_bytes(input, input_length).data(); 214| 0| const size_t bulk = base64_decode_avx512(output, in8, input_length); 215| 0| size_t written = bulk / 4 * 3; 216| | 217| 0| const uint8_t* rest = in8 + bulk; 218| 0| size_t rest_len = input_length - bulk; 219| | 220| | // If the stop may have been due to whitespace, compact the remainder 221| | // and continue decoding 222| 0| secure_vector compacted; 223| 0| if(ignore_ws && rest_len > 128) { ------------------ | Branch (223:10): [True: 0, False: 0] | Branch (223:23): [True: 0, False: 0] ------------------ 224| 0| compacted.resize(rest_len); 225| 0| const size_t clean_len = base64_strip_ws_avx512(compacted.data(), rest, rest_len); 226| 0| rest = compacted.data(); 227| 0| rest_len = clean_len; 228| | 229| 0| const size_t bulk2 = base64_decode_avx512(output + written, rest, rest_len); 230| 0| written += bulk2 / 4 * 3; 231| 0| rest += bulk2; 232| 0| rest_len -= bulk2; 233| 0| } 234| | 235| | // The scalar decoder handles the final blocks, and with them all of 236| | // the padding logic and error reporting 237| 0| const size_t tail_written = 238| 0| base_decode_full(Base64(), output + written, cast_uint8_ptr_to_char(rest), rest_len, ignore_ws); 239| | 240| 0| return written + tail_written; 241| 0| } 242| 144|#endif 243| | 244| 144| return base_decode_full(Base64(), output, input, input_length, ignore_ws); 245| 144|} _ZN5Botan13base64_decodeEPKcmb: 258| 144|secure_vector base64_decode(const char input[], size_t input_length, bool ignore_ws) { 259| 144| secure_vector bin(Base64::decode_max_output(input_length)); 260| 144| const size_t written = base64_decode(bin.data(), input, input_length, ignore_ws); 261| 144| bin.resize(written); 262| 144| return bin; 263| 144|} base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6417decode_max_outputEm: 49| 288| static constexpr size_t decode_max_output(size_t input_length) { 50| | // Cannot overflow since each block shrinks when decoded 51| 288| return ceil_division(input_length, m_encoding_bytes_out) * m_encoding_bytes_in; 52| 288| } base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6413bits_consumedEv: 40| 45| static constexpr size_t bits_consumed() noexcept { return m_encoding_bits; } base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6419lookup_binary_valueEc: 118| 65.9k|uint8_t Base64::lookup_binary_value(char input) noexcept { 119| 65.9k| const auto has_zero_byte = [](uint64_t v) { return ((v - 0x0101010101010101) & ~(v) & 0x8080808080808080); }; 120| | 121| | // Assumes each byte is either 0x00 or 0x80 122| 65.9k| const auto index_of_first_set_byte = [](uint64_t v) { 123| 65.9k| return ((((v - 1) & 0x0101010101010101) * 0x0101010101010101) >> 56) - 1; 124| 65.9k| }; 125| | 126| 65.9k| constexpr uint64_t lo = 0x0101010101010101; 127| | 128| 65.9k| const uint8_t x = static_cast(input); 129| | 130| 65.9k| const uint64_t x8 = x * lo; 131| | 132| | // Defines the valid ASCII ranges of base64, except the special chars (below) 133| 65.9k| constexpr uint64_t val_l = make_uint64(0, 0, 0, 0, 0, 'A', 'a', '0'); 134| 65.9k| constexpr uint64_t val_u = make_uint64(0, 0, 0, 0, 0, 26, 26, 10); 135| | 136| | // If x is in one of the ranges return a mask. Otherwise we xor in at the 137| | // high word which will be our invalid marker 138| 65.9k| const auto v_mask = swar_in_range(x8, val_l, val_u) ^ 0x80000000; 139| | 140| | // This is the offset added to x to get the value 141| 65.9k| const uint64_t val_v = 0xbfb904 ^ (0xFF000000 - (x << 24)); 142| | 143| 65.9k| const uint8_t z = x + static_cast(val_v >> (8 * index_of_first_set_byte(v_mask))); 144| | 145| | // Valid base64 special characters, and some whitespace chars 146| 65.9k| constexpr uint64_t specials_i = make_uint64(0, '+', '/', '=', ' ', '\n', '\t', '\r'); 147| | 148| 65.9k| const uint64_t specials_v = 0x3e3f8180808080 ^ (static_cast(z) << 56); 149| | 150| 65.9k| const uint64_t smask = has_zero_byte(x8 ^ specials_i) ^ 0x8000000000000000; 151| | 152| 65.9k| return static_cast(specials_v >> (8 * index_of_first_set_byte(smask))); 153| 65.9k|} base64.cpp:_ZZN5Botan12_GLOBAL__N_16Base6419lookup_binary_valueEcENK3$_0clEm: 122| 131k| const auto index_of_first_set_byte = [](uint64_t v) { 123| 131k| return ((((v - 1) & 0x0101010101010101) * 0x0101010101010101) >> 56) - 1; 124| 131k| }; base64.cpp:_ZZN5Botan12_GLOBAL__N_16Base6419lookup_binary_valueEcENK3$_1clEm: 119| 65.9k| const auto has_zero_byte = [](uint64_t v) { return ((v - 0x0101010101010101) & ~(v) & 0x8080808080808080); }; base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6414check_bad_charEhcb: 156| 44.3k|bool Base64::check_bad_char(uint8_t bin, char input, bool ignore_ws) { 157| 44.3k| if(bin <= 0x3F) { ------------------ | Branch (157:7): [True: 11.9k, False: 32.3k] ------------------ 158| 11.9k| return true; 159| 32.3k| } else if(!(bin == 0x81 || (bin == 0x80 && ignore_ws))) { ------------------ | Branch (159:16): [True: 203, False: 32.1k] | Branch (159:32): [True: 32.0k, False: 43] | Branch (159:47): [True: 32.0k, False: 0] ------------------ 160| 43| throw Invalid_Argument(fmt("base64_decode: invalid character '{}'", format_char_for_display(input))); 161| 43| } 162| 32.2k| return false; 163| 44.3k|} base64.cpp:_ZN5Botan12_GLOBAL__N_16Base644nameEv: 30| 19| static std::string name() { return "base64"; } base64.cpp:_ZN5Botan12_GLOBAL__N_16Base646decodeEPhPKh: 60| 2.99k| static void decode(uint8_t* out_ptr, const uint8_t decode_buf[4]) { 61| 2.99k| out_ptr[0] = (decode_buf[0] << 2) | (decode_buf[1] >> 4); 62| 2.99k| out_ptr[1] = (decode_buf[1] << 4) | (decode_buf[2] >> 2); 63| 2.99k| out_ptr[2] = (decode_buf[2] << 6) | decode_buf[3]; 64| 2.99k| } base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6415bytes_to_removeEm: 66| 91| static size_t bytes_to_remove(size_t final_truncate) { return final_truncate; } _ZN5Botan10hex_decodeEPhPKcmRmb: 75| 16.8k|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, size_t& input_consumed, bool ignore_ws) { 76| 16.8k| uint8_t* out_ptr = output; 77| 16.8k| bool top_nibble = true; 78| 16.8k| uint8_t next = 0; 79| | 80| 16.8k| input_consumed = 0; 81| | 82| 16.8k| clear_mem(output, input_length / 2); 83| | 84| 1.08M| for(size_t i = 0; i != input_length; ++i) { ------------------ | Branch (84:22): [True: 1.06M, False: 16.8k] ------------------ 85| 1.06M| const uint8_t bin = hex_char_to_bin(input[i]); 86| | 87| 1.06M| if(bin >= 0x10) { ------------------ | Branch (87:10): [True: 0, False: 1.06M] ------------------ 88| 0| if(bin == 0x80 && ignore_ws) { ------------------ | Branch (88:13): [True: 0, False: 0] | Branch (88:28): [True: 0, False: 0] ------------------ 89| 0| continue; 90| 0| } 91| | 92| 0| throw Invalid_Argument(fmt("hex_decode: invalid character '{}'", format_char_for_display(input[i]))); 93| 0| } 94| | 95| 1.06M| if(top_nibble) { ------------------ | Branch (95:10): [True: 533k, False: 533k] ------------------ 96| 533k| next = bin << 4; 97| 533k| } else { 98| 533k| next |= bin; 99| 533k| *out_ptr = next; 100| 533k| } 101| | 102| 1.06M| top_nibble = !top_nibble; 103| 1.06M| if(top_nibble) { ------------------ | Branch (103:10): [True: 533k, False: 533k] ------------------ 104| 533k| ++out_ptr; 105| 533k| input_consumed = i + 1; 106| 533k| } 107| 1.06M| } 108| | 109| | /* 110| | * Consume trailing whitespace following the last full byte; a leftover 111| | * unpaired nibble (if any) stops the scan and is left unconsumed. 112| | */ 113| 16.8k| while(input_consumed < input_length && hex_char_to_bin(input[input_consumed]) == 0x80) { ------------------ | Branch (113:10): [True: 0, False: 16.8k] | Branch (113:43): [True: 0, False: 0] ------------------ 114| 0| ++input_consumed; 115| 0| } 116| | 117| 16.8k| return (out_ptr - output); 118| 16.8k|} _ZN5Botan10hex_decodeEPhPKcmb: 120| 16.8k|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, bool ignore_ws) { 121| 16.8k| size_t consumed = 0; 122| 16.8k| const size_t written = hex_decode(output, input, input_length, consumed, ignore_ws); 123| | 124| 16.8k| if(consumed != input_length) { ------------------ | Branch (124:7): [True: 0, False: 16.8k] ------------------ 125| 0| throw Invalid_Argument("hex_decode: input did not have full bytes"); 126| 0| } 127| | 128| 16.8k| return written; 129| 16.8k|} _ZN5Botan17hex_decode_lockedEPKcmb: 142| 16.8k|secure_vector hex_decode_locked(const char input[], size_t input_length, bool ignore_ws) { 143| 16.8k| secure_vector bin(1 + input_length / 2); 144| | 145| 16.8k| const size_t written = hex_decode(bin.data(), input, input_length, ignore_ws); 146| | 147| 16.8k| bin.resize(written); 148| 16.8k| return bin; 149| 16.8k|} _ZN5Botan17hex_decode_lockedENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEb: 151| 11.7k|secure_vector hex_decode_locked(std::string_view input, bool ignore_ws) { 152| 11.7k| return hex_decode_locked(input.data(), input.size(), ignore_ws); 153| 11.7k|} hex.cpp:_ZN5Botan12_GLOBAL__N_115hex_char_to_binEc: 55| 1.06M|uint8_t hex_char_to_bin(char input) { 56| | // Starts of valid value ranges (v_lo) and their lengths (v_range) 57| 1.06M| constexpr uint64_t v_lo = make_uint64(0, '0', 'a', 'A', ' ', '\n', '\t', '\r'); 58| 1.06M| constexpr uint64_t v_range = make_uint64(0, 10, 6, 6, 1, 1, 1, 1); 59| 1.06M| constexpr uint64_t expand8 = 0x0101010101010101; 60| 1.06M| constexpr uint64_t top64 = 0x8000000000000000; 61| | 62| 1.06M| const uint8_t x = static_cast(input); 63| 1.06M| const uint64_t x8 = x * expand8; 64| | 65| 1.06M| const uint64_t v_mask = swar_in_range(x8, v_lo, v_range) ^ top64; 66| | 67| | // This is the offset added to x to get the value we need 68| 1.06M| const uint64_t val_v = 0xd0a9c960767773 ^ static_cast(0xFF - x) << 56; 69| | 70| 1.06M| return x + static_cast(val_v >> (8 * index_of_first_set_byte(v_mask))); 71| 1.06M|} _ZN5Botan12HashFunction6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 112| 126|std::unique_ptr HashFunction::create(std::string_view algo_spec, std::string_view provider) { 113| |#if defined(BOTAN_HAS_COMMONCRYPTO) 114| | if(provider.empty() || provider == "commoncrypto") { 115| | if(auto hash = make_commoncrypto_hash(algo_spec)) 116| | return hash; 117| | 118| | if(!provider.empty()) 119| | return nullptr; 120| | } 121| |#endif 122| | 123| 126| if(provider.empty() == false && provider != "base") { ------------------ | Branch (123:7): [True: 0, False: 126] | Branch (123:36): [True: 0, False: 0] ------------------ 124| 0| return nullptr; // unknown provider 125| 0| } 126| | 127| 126|#if defined(BOTAN_HAS_SHA1) 128| 126| if(algo_spec == "SHA-1") { ------------------ | Branch (128:7): [True: 0, False: 126] ------------------ 129| 0| return std::make_unique(); 130| 0| } 131| 126|#endif 132| | 133| 126|#if defined(BOTAN_HAS_SHA2_32) 134| 126| if(algo_spec == "SHA-224") { ------------------ | Branch (134:7): [True: 0, False: 126] ------------------ 135| 0| return std::make_unique(); 136| 0| } 137| | 138| 126| if(algo_spec == "SHA-256") { ------------------ | Branch (138:7): [True: 0, False: 126] ------------------ 139| 0| return std::make_unique(); 140| 0| } 141| 126|#endif 142| | 143| 126|#if defined(BOTAN_HAS_SHA2_64) 144| 126| if(algo_spec == "SHA-384") { ------------------ | Branch (144:7): [True: 0, False: 126] ------------------ 145| 0| return std::make_unique(); 146| 0| } 147| | 148| 126| if(algo_spec == "SHA-512") { ------------------ | Branch (148:7): [True: 38, False: 88] ------------------ 149| 38| return std::make_unique(); 150| 38| } 151| | 152| 88| if(algo_spec == "SHA-512-256") { ------------------ | Branch (152:7): [True: 0, False: 88] ------------------ 153| 0| return std::make_unique(); 154| 0| } 155| 88|#endif 156| | 157| 88|#if defined(BOTAN_HAS_RIPEMD_160) 158| 88| if(algo_spec == "RIPEMD-160") { ------------------ | Branch (158:7): [True: 0, False: 88] ------------------ 159| 0| return std::make_unique(); 160| 0| } 161| 88|#endif 162| | 163| 88|#if defined(BOTAN_HAS_WHIRLPOOL) 164| 88| if(algo_spec == "Whirlpool") { ------------------ | Branch (164:7): [True: 0, False: 88] ------------------ 165| 0| return std::make_unique(); 166| 0| } 167| 88|#endif 168| | 169| 88|#if defined(BOTAN_HAS_MD5) 170| 88| if(algo_spec == "MD5") { ------------------ | Branch (170:7): [True: 0, False: 88] ------------------ 171| 0| return std::make_unique(); 172| 0| } 173| 88|#endif 174| | 175| 88|#if defined(BOTAN_HAS_MD4) 176| 88| if(algo_spec == "MD4") { ------------------ | Branch (176:7): [True: 0, False: 88] ------------------ 177| 0| return std::make_unique(); 178| 0| } 179| 88|#endif 180| | 181| 88|#if defined(BOTAN_HAS_GOST_34_11) 182| 88| if(algo_spec == "GOST-R-34.11-94" || algo_spec == "GOST-34.11") { ------------------ | Branch (182:7): [True: 0, False: 88] | Branch (182:41): [True: 0, False: 88] ------------------ 183| 0| return std::make_unique(); 184| 0| } 185| 88|#endif 186| | 187| 88|#if defined(BOTAN_HAS_ADLER32) 188| 88| if(algo_spec == "Adler32") { ------------------ | Branch (188:7): [True: 0, False: 88] ------------------ 189| 0| return std::make_unique(); 190| 0| } 191| 88|#endif 192| | 193| 88|#if defined(BOTAN_HAS_ASCON_HASH256) 194| 88| if(algo_spec == "Ascon-Hash256") { ------------------ | Branch (194:7): [True: 0, False: 88] ------------------ 195| 0| return std::make_unique(); 196| 0| } 197| 88|#endif 198| | 199| 88|#if defined(BOTAN_HAS_CRC24) 200| 88| if(algo_spec == "CRC24") { ------------------ | Branch (200:7): [True: 0, False: 88] ------------------ 201| 0| return std::make_unique(); 202| 0| } 203| 88|#endif 204| | 205| 88|#if defined(BOTAN_HAS_CRC32) 206| 88| if(algo_spec == "CRC32") { ------------------ | Branch (206:7): [True: 0, False: 88] ------------------ 207| 0| return std::make_unique(); 208| 0| } 209| 88|#endif 210| | 211| 88|#if defined(BOTAN_HAS_STREEBOG) 212| 88| if(algo_spec == "Streebog-256") { ------------------ | Branch (212:7): [True: 0, False: 88] ------------------ 213| 0| return std::make_unique(256); 214| 0| } 215| 88| if(algo_spec == "Streebog-512") { ------------------ | Branch (215:7): [True: 0, False: 88] ------------------ 216| 0| return std::make_unique(512); 217| 0| } 218| 88|#endif 219| | 220| 88|#if defined(BOTAN_HAS_SM3) 221| 88| if(algo_spec == "SM3") { ------------------ | Branch (221:7): [True: 0, False: 88] ------------------ 222| 0| return std::make_unique(); 223| 0| } 224| 88|#endif 225| | 226| 88| const AlgorithmSpec req(algo_spec); 227| | 228| 88|#if defined(BOTAN_HAS_SKEIN_512) 229| 88| if(auto m = req.match("Skein-512({bits:int=512},{personalization:str=})")) { ------------------ | Branch (229:12): [True: 0, False: 88] ------------------ 230| 0| return std::make_unique(m->integer("bits"), m->str("personalization")); 231| 0| } 232| 88|#endif 233| | 234| 88|#if defined(BOTAN_HAS_BLAKE2B) 235| 88| if(auto m = req.match("BLAKE2b|Blake2b({bits:int=512})")) { ------------------ | Branch (235:12): [True: 0, False: 88] ------------------ 236| 0| return std::make_unique(m->integer("bits")); 237| 0| } 238| 88|#endif 239| | 240| 88|#if defined(BOTAN_HAS_BLAKE2S) 241| 88| if(auto m = req.match("BLAKE2s|Blake2s({bits:int=256})")) { ------------------ | Branch (241:12): [True: 0, False: 88] ------------------ 242| 0| return std::make_unique(m->integer("bits")); 243| 0| } 244| 88|#endif 245| | 246| 88|#if defined(BOTAN_HAS_KECCAK) 247| 88| if(auto m = req.match("Keccak-1600({bits:int=512})")) { ------------------ | Branch (247:12): [True: 0, False: 88] ------------------ 248| 0| return std::make_unique(m->integer("bits")); 249| 0| } 250| 88|#endif 251| | 252| 88|#if defined(BOTAN_HAS_SHA3) 253| 88| if(auto m = req.match("SHA-3({bits:int=512})")) { ------------------ | Branch (253:12): [True: 88, False: 0] ------------------ 254| 88| return std::make_unique(m->integer("bits")); 255| 88| } 256| 0|#endif 257| | 258| 0|#if defined(BOTAN_HAS_SHAKE) 259| 0| if(auto m = req.match("SHAKE-128({bits:int})")) { ------------------ | Branch (259:12): [True: 0, False: 0] ------------------ 260| 0| return std::make_unique(m->integer("bits")); 261| 0| } 262| 0| if(auto m = req.match("SHAKE-256({bits:int})")) { ------------------ | Branch (262:12): [True: 0, False: 0] ------------------ 263| 0| return std::make_unique(m->integer("bits")); 264| 0| } 265| 0|#endif 266| | 267| 0|#if defined(BOTAN_HAS_PARALLEL_HASH) 268| 0| if(auto m = req.match("Parallel({hash}...)")) { ------------------ | Branch (268:12): [True: 0, False: 0] ------------------ 269| 0| std::vector> hashes; 270| | 271| 0| for(const auto& hash_spec : m->rest("hash")) { ------------------ | Branch (271:33): [True: 0, False: 0] ------------------ 272| 0| auto h = HashFunction::create(hash_spec.to_string()); 273| 0| if(!h) { ------------------ | Branch (273:13): [True: 0, False: 0] ------------------ 274| 0| return nullptr; 275| 0| } 276| 0| hashes.push_back(std::move(h)); 277| 0| } 278| | 279| 0| return std::make_unique(hashes); 280| 0| } 281| 0|#endif 282| | 283| 0|#if defined(BOTAN_HAS_TRUNCATED_HASH) 284| 0| if(auto m = req.match("Truncated({hash},{bits:int})")) { ------------------ | Branch (284:12): [True: 0, False: 0] ------------------ 285| 0| auto hash = HashFunction::create(m->str("hash")); 286| 0| if(!hash) { ------------------ | Branch (286:10): [True: 0, False: 0] ------------------ 287| 0| return nullptr; 288| 0| } 289| | 290| 0| return std::make_unique(std::move(hash), m->integer("bits")); 291| 0| } 292| 0|#endif 293| | 294| 0|#if defined(BOTAN_HAS_COMB4P) 295| 0| if(auto m = req.match("Comb4P({hash1},{hash2})")) { ------------------ | Branch (295:12): [True: 0, False: 0] ------------------ 296| 0| auto h1 = HashFunction::create(m->str("hash1")); 297| 0| auto h2 = HashFunction::create(m->str("hash2")); 298| | 299| 0| if(h1 && h2) { ------------------ | Branch (299:10): [True: 0, False: 0] | Branch (299:16): [True: 0, False: 0] ------------------ 300| 0| return std::make_unique(std::move(h1), std::move(h2)); 301| 0| } 302| 0| } 303| 0|#endif 304| | 305| 0| BOTAN_UNUSED(req); ------------------ | | 151| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 306| | 307| 0| return nullptr; 308| 0|} _ZN5Botan12HashFunction15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 311| 126|std::unique_ptr HashFunction::create_or_throw(std::string_view algo, std::string_view provider) { 312| 126| if(auto hash = HashFunction::create(algo, provider)) { ------------------ | Branch (312:12): [True: 126, False: 0] ------------------ 313| 126| return hash; 314| 126| } 315| 0| throw Lookup_Error("Hash", algo, provider); 316| 126|} _ZN5Botan7SHA_51215compress_digestERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm: 56| 38|void SHA_512::compress_digest(digest_type& digest, std::span input, size_t blocks) { 57| 38|#if defined(BOTAN_HAS_SHA2_64_X86) 58| 38| if(CPUID::has(CPUID::Feature::SHA512)) { ------------------ | Branch (58:7): [True: 0, False: 38] ------------------ 59| 0| return compress_digest_x86(digest, input, blocks); 60| 0| } 61| 38|#endif 62| | 63| |#if defined(BOTAN_HAS_SHA2_64_ARMV8) 64| | if(CPUID::has(CPUID::Feature::SHA2_512)) { 65| | return compress_digest_armv8(digest, input, blocks); 66| | } 67| |#endif 68| | 69| 38|#if defined(BOTAN_HAS_SHA2_64_X86_AVX512) 70| 38| if(CPUID::has(CPUID::Feature::AVX512, CPUID::Feature::BMI)) { ------------------ | Branch (70:7): [True: 0, False: 38] ------------------ 71| 0| return compress_digest_x86_avx512(digest, input, blocks); 72| 0| } 73| 38|#endif 74| | 75| 38|#if defined(BOTAN_HAS_SHA2_64_X86_AVX2) 76| 38| if(CPUID::has(CPUID::Feature::AVX2, CPUID::Feature::BMI)) { ------------------ | Branch (76:7): [True: 38, False: 0] ------------------ 77| 38| return compress_digest_x86_avx2(digest, input, blocks); 78| 38| } 79| 0|#endif 80| | 81| 0| uint64_t A = digest[0]; 82| 0| uint64_t B = digest[1]; 83| 0| uint64_t C = digest[2]; 84| 0| uint64_t D = digest[3]; 85| 0| uint64_t E = digest[4]; 86| 0| uint64_t F = digest[5]; 87| 0| uint64_t G = digest[6]; 88| 0| uint64_t H = digest[7]; 89| | 90| 0| std::array W{}; 91| | 92| 0| BufferSlicer in(input); 93| | 94| 0| for(size_t i = 0; i != blocks; ++i) { ------------------ | Branch (94:22): [True: 0, False: 0] ------------------ 95| 0| load_be(W, in.take()); 96| | 97| | // clang-format off 98| | 99| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], SHA512_K[ 0]); 100| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], SHA512_K[ 1]); 101| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], SHA512_K[ 2]); 102| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], SHA512_K[ 3]); 103| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], SHA512_K[ 4]); 104| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], SHA512_K[ 5]); 105| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], SHA512_K[ 6]); 106| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], SHA512_K[ 7]); 107| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], SHA512_K[ 8]); 108| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], SHA512_K[ 9]); 109| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], SHA512_K[10]); 110| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], SHA512_K[11]); 111| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], SHA512_K[12]); 112| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], SHA512_K[13]); 113| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], SHA512_K[14]); 114| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], SHA512_K[15]); 115| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], SHA512_K[16]); 116| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], SHA512_K[17]); 117| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], SHA512_K[18]); 118| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], SHA512_K[19]); 119| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], SHA512_K[20]); 120| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], SHA512_K[21]); 121| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], SHA512_K[22]); 122| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], SHA512_K[23]); 123| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], SHA512_K[24]); 124| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], SHA512_K[25]); 125| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], SHA512_K[26]); 126| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], SHA512_K[27]); 127| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], SHA512_K[28]); 128| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], SHA512_K[29]); 129| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], SHA512_K[30]); 130| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], SHA512_K[31]); 131| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], SHA512_K[32]); 132| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], SHA512_K[33]); 133| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], SHA512_K[34]); 134| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], SHA512_K[35]); 135| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], SHA512_K[36]); 136| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], SHA512_K[37]); 137| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], SHA512_K[38]); 138| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], SHA512_K[39]); 139| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], SHA512_K[40]); 140| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], SHA512_K[41]); 141| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], SHA512_K[42]); 142| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], SHA512_K[43]); 143| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], SHA512_K[44]); 144| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], SHA512_K[45]); 145| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], SHA512_K[46]); 146| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], SHA512_K[47]); 147| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], SHA512_K[48]); 148| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], SHA512_K[49]); 149| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], SHA512_K[50]); 150| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], SHA512_K[51]); 151| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], SHA512_K[52]); 152| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], SHA512_K[53]); 153| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], SHA512_K[54]); 154| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], SHA512_K[55]); 155| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], SHA512_K[56]); 156| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], SHA512_K[57]); 157| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], SHA512_K[58]); 158| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], SHA512_K[59]); 159| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], SHA512_K[60]); 160| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], SHA512_K[61]); 161| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], SHA512_K[62]); 162| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], SHA512_K[63]); 163| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 0], W[14], W[ 9], W[ 1], SHA512_K[64]); 164| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 1], W[15], W[10], W[ 2], SHA512_K[65]); 165| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[ 2], W[ 0], W[11], W[ 3], SHA512_K[66]); 166| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[ 3], W[ 1], W[12], W[ 4], SHA512_K[67]); 167| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[ 4], W[ 2], W[13], W[ 5], SHA512_K[68]); 168| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[ 5], W[ 3], W[14], W[ 6], SHA512_K[69]); 169| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[ 6], W[ 4], W[15], W[ 7], SHA512_K[70]); 170| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[ 7], W[ 5], W[ 0], W[ 8], SHA512_K[71]); 171| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[ 8], W[ 6], W[ 1], W[ 9], SHA512_K[72]); 172| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[ 9], W[ 7], W[ 2], W[10], SHA512_K[73]); 173| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10], W[ 8], W[ 3], W[11], SHA512_K[74]); 174| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11], W[ 9], W[ 4], W[12], SHA512_K[75]); 175| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12], W[10], W[ 5], W[13], SHA512_K[76]); 176| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13], W[11], W[ 6], W[14], SHA512_K[77]); 177| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14], W[12], W[ 7], W[15], SHA512_K[78]); 178| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15], W[13], W[ 8], W[ 0], SHA512_K[79]); 179| | 180| | // clang-format on 181| | 182| 0| A = (digest[0] += A); 183| 0| B = (digest[1] += B); 184| 0| C = (digest[2] += C); 185| 0| D = (digest[3] += D); 186| 0| E = (digest[4] += E); 187| 0| F = (digest[5] += F); 188| 0| G = (digest[6] += G); 189| 0| H = (digest[7] += H); 190| 0| } 191| 0|} _ZN5Botan7SHA_51210compress_nERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm: 213| 38|void SHA_512::compress_n(digest_type& digest, std::span input, size_t blocks) { 214| 38| SHA_512::compress_digest(digest, input, blocks); 215| 38|} _ZN5Botan7SHA_5124initERNSt3__16vectorImNS_16secure_allocatorImEEEE: 239| 76|void SHA_512::init(digest_type& digest) { 240| 76| digest.assign({0x6A09E667F3BCC908, 241| 76| 0xBB67AE8584CAA73B, 242| 76| 0x3C6EF372FE94F82B, 243| 76| 0xA54FF53A5F1D36F1, 244| 76| 0x510E527FADE682D1, 245| 76| 0x9B05688C2B3E6C1F, 246| 76| 0x1F83D9ABFB41BD6B, 247| 76| 0x5BE0CD19137E2179}); 248| 76|} _ZN5Botan7SHA_5128add_dataENSt3__14spanIKhLm18446744073709551615EEE: 278| 38|void SHA_512::add_data(std::span input) { 279| 38| m_md.update(input); 280| 38|} _ZN5Botan7SHA_51212final_resultENSt3__14spanIhLm18446744073709551615EEE: 290| 38|void SHA_512::final_result(std::span output) { 291| 38| m_md.final(output); 292| 38|} _ZN5Botan7SHA_51224compress_digest_x86_avx2ERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm: 44| 38| size_t blocks) { 45| 38| alignas(64) uint64_t W[16] = {0}; 46| 38| alignas(64) uint64_t W2[80]; 47| | 48| 38| uint64_t A = digest[0]; 49| 38| uint64_t B = digest[1]; 50| 38| uint64_t C = digest[2]; 51| 38| uint64_t D = digest[3]; 52| 38| uint64_t E = digest[4]; 53| 38| uint64_t F = digest[5]; 54| 38| uint64_t G = digest[6]; 55| 38| uint64_t H = digest[7]; 56| | 57| 38| const uint8_t* data = input.data(); 58| | 59| 38| while(blocks >= 2) { ------------------ | Branch (59:10): [True: 0, False: 38] ------------------ 60| 0| SIMD_4x64 WS[8]; 61| | 62| 0| for(size_t i = 0; i < 8; i++) { ------------------ | Branch (62:25): [True: 0, False: 0] ------------------ 63| 0| WS[i] = SIMD_4x64::load_be2(&data[16 * i], &data[128 + 16 * i]); 64| 0| auto WK = WS[i] + SIMD_4x64::broadcast_2x64(&SHA512_K[2 * i]); 65| 0| WK.store_le2(&W[2 * i], &W2[2 * i]); 66| 0| } 67| | 68| 0| data += 2 * 128; 69| 0| blocks -= 2; 70| | 71| | // First 64 rounds of SHA-512 72| 0| for(size_t r = 0; r != 64; r += 16) { ------------------ | Branch (72:25): [True: 0, False: 0] ------------------ 73| 0| auto w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&SHA512_K[r + 16]); 74| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[0]); 75| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[1]); 76| 0| w.store_le2(&W[0], &W2[r + 16]); 77| | 78| 0| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&SHA512_K[r + 18]); 79| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[2]); 80| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[3]); 81| 0| w.store_le2(&W[2], &W2[r + 18]); 82| | 83| 0| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&SHA512_K[r + 20]); 84| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[4]); 85| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[5]); 86| 0| w.store_le2(&W[4], &W2[r + 20]); 87| | 88| 0| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&SHA512_K[r + 22]); 89| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[6]); 90| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[7]); 91| 0| w.store_le2(&W[6], &W2[r + 22]); 92| | 93| 0| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&SHA512_K[r + 24]); 94| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[8]); 95| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[9]); 96| 0| w.store_le2(&W[8], &W2[r + 24]); 97| | 98| 0| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&SHA512_K[r + 26]); 99| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10]); 100| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11]); 101| 0| w.store_le2(&W[10], &W2[r + 26]); 102| | 103| 0| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&SHA512_K[r + 28]); 104| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12]); 105| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13]); 106| 0| w.store_le2(&W[12], &W2[r + 28]); 107| | 108| 0| w = sha512_next_w(WS) + SIMD_4x64::broadcast_2x64(&SHA512_K[r + 30]); 109| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14]); 110| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15]); 111| 0| w.store_le2(&W[14], &W2[r + 30]); 112| 0| } 113| | 114| | // Final 16 rounds of SHA-512 115| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[0]); 116| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[1]); 117| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[2]); 118| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[3]); 119| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[4]); 120| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[5]); 121| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[6]); 122| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[7]); 123| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W[8]); 124| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W[9]); 125| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W[10]); 126| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W[11]); 127| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W[12]); 128| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W[13]); 129| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W[14]); 130| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W[15]); 131| | 132| 0| A = (digest[0] += A); 133| 0| B = (digest[1] += B); 134| 0| C = (digest[2] += C); 135| 0| D = (digest[3] += D); 136| 0| E = (digest[4] += E); 137| 0| F = (digest[5] += F); 138| 0| G = (digest[6] += G); 139| 0| H = (digest[7] += H); 140| | 141| | // Second block of SHA-512 compression, with pre-expanded message 142| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[0]); 143| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[1]); 144| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[2]); 145| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[3]); 146| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[4]); 147| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[5]); 148| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[6]); 149| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[7]); 150| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[8]); 151| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[9]); 152| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[10]); 153| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[11]); 154| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[12]); 155| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[13]); 156| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[14]); 157| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[15]); 158| | 159| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[16]); 160| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[17]); 161| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[18]); 162| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[19]); 163| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[20]); 164| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[21]); 165| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[22]); 166| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[23]); 167| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[24]); 168| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[25]); 169| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[26]); 170| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[27]); 171| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[28]); 172| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[29]); 173| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[30]); 174| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[31]); 175| | 176| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[32]); 177| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[33]); 178| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[34]); 179| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[35]); 180| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[36]); 181| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[37]); 182| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[38]); 183| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[39]); 184| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[40]); 185| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[41]); 186| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[42]); 187| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[43]); 188| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[44]); 189| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[45]); 190| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[46]); 191| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[47]); 192| | 193| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[48]); 194| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[49]); 195| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[50]); 196| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[51]); 197| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[52]); 198| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[53]); 199| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[54]); 200| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[55]); 201| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[56]); 202| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[57]); 203| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[58]); 204| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[59]); 205| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[60]); 206| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[61]); 207| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[62]); 208| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[63]); 209| | 210| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[64]); 211| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[65]); 212| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[66]); 213| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[67]); 214| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[68]); 215| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[69]); 216| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[70]); 217| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[71]); 218| 0| SHA2_64_F(A, B, C, D, E, F, G, H, W2[72]); 219| 0| SHA2_64_F(H, A, B, C, D, E, F, G, W2[73]); 220| 0| SHA2_64_F(G, H, A, B, C, D, E, F, W2[74]); 221| 0| SHA2_64_F(F, G, H, A, B, C, D, E, W2[75]); 222| 0| SHA2_64_F(E, F, G, H, A, B, C, D, W2[76]); 223| 0| SHA2_64_F(D, E, F, G, H, A, B, C, W2[77]); 224| 0| SHA2_64_F(C, D, E, F, G, H, A, B, W2[78]); 225| 0| SHA2_64_F(B, C, D, E, F, G, H, A, W2[79]); 226| | 227| 0| A = (digest[0] += A); 228| 0| B = (digest[1] += B); 229| 0| C = (digest[2] += C); 230| 0| D = (digest[3] += D); 231| 0| E = (digest[4] += E); 232| 0| F = (digest[5] += F); 233| 0| G = (digest[6] += G); 234| 0| H = (digest[7] += H); 235| 0| } 236| | 237| 76| while(blocks > 0) { ------------------ | Branch (237:10): [True: 38, False: 38] ------------------ 238| 38| SIMD_2x64 WS[8]; 239| | 240| 342| for(size_t i = 0; i < 8; i++) { ------------------ | Branch (240:25): [True: 304, False: 38] ------------------ 241| 304| WS[i] = SIMD_2x64::load_be(&data[16 * i]); 242| 304| const auto WK = WS[i] + SIMD_2x64::load_le(&SHA512_K[2 * i]); 243| 304| WK.store_le(&W[2 * i]); 244| 304| } 245| | 246| 38| data += 128; 247| 38| blocks -= 1; 248| | 249| | // First 64 rounds of SHA-512 250| 190| for(size_t r = 0; r != 64; r += 16) { ------------------ | Branch (250:25): [True: 152, False: 38] ------------------ 251| 152| auto w = sha512_next_w(WS) + SIMD_2x64::load_le(&SHA512_K[r + 16]); 252| 152| SHA2_64_F(A, B, C, D, E, F, G, H, W[0]); 253| 152| SHA2_64_F(H, A, B, C, D, E, F, G, W[1]); 254| 152| w.store_le(&W[0]); 255| | 256| 152| w = sha512_next_w(WS) + SIMD_2x64::load_le(&SHA512_K[r + 18]); 257| 152| SHA2_64_F(G, H, A, B, C, D, E, F, W[2]); 258| 152| SHA2_64_F(F, G, H, A, B, C, D, E, W[3]); 259| 152| w.store_le(&W[2]); 260| | 261| 152| w = sha512_next_w(WS) + SIMD_2x64::load_le(&SHA512_K[r + 20]); 262| 152| SHA2_64_F(E, F, G, H, A, B, C, D, W[4]); 263| 152| SHA2_64_F(D, E, F, G, H, A, B, C, W[5]); 264| 152| w.store_le(&W[4]); 265| | 266| 152| w = sha512_next_w(WS) + SIMD_2x64::load_le(&SHA512_K[r + 22]); 267| 152| SHA2_64_F(C, D, E, F, G, H, A, B, W[6]); 268| 152| SHA2_64_F(B, C, D, E, F, G, H, A, W[7]); 269| 152| w.store_le(&W[6]); 270| | 271| 152| w = sha512_next_w(WS) + SIMD_2x64::load_le(&SHA512_K[r + 24]); 272| 152| SHA2_64_F(A, B, C, D, E, F, G, H, W[8]); 273| 152| SHA2_64_F(H, A, B, C, D, E, F, G, W[9]); 274| 152| w.store_le(&W[8]); 275| | 276| 152| w = sha512_next_w(WS) + SIMD_2x64::load_le(&SHA512_K[r + 26]); 277| 152| SHA2_64_F(G, H, A, B, C, D, E, F, W[10]); 278| 152| SHA2_64_F(F, G, H, A, B, C, D, E, W[11]); 279| 152| w.store_le(&W[10]); 280| | 281| 152| w = sha512_next_w(WS) + SIMD_2x64::load_le(&SHA512_K[r + 28]); 282| 152| SHA2_64_F(E, F, G, H, A, B, C, D, W[12]); 283| 152| SHA2_64_F(D, E, F, G, H, A, B, C, W[13]); 284| 152| w.store_le(&W[12]); 285| | 286| 152| w = sha512_next_w(WS) + SIMD_2x64::load_le(&SHA512_K[r + 30]); 287| 152| SHA2_64_F(C, D, E, F, G, H, A, B, W[14]); 288| 152| SHA2_64_F(B, C, D, E, F, G, H, A, W[15]); 289| 152| w.store_le(&W[14]); 290| 152| } 291| | 292| | // Final 16 rounds of SHA-512 293| 38| SHA2_64_F(A, B, C, D, E, F, G, H, W[0]); 294| 38| SHA2_64_F(H, A, B, C, D, E, F, G, W[1]); 295| 38| SHA2_64_F(G, H, A, B, C, D, E, F, W[2]); 296| 38| SHA2_64_F(F, G, H, A, B, C, D, E, W[3]); 297| 38| SHA2_64_F(E, F, G, H, A, B, C, D, W[4]); 298| 38| SHA2_64_F(D, E, F, G, H, A, B, C, W[5]); 299| 38| SHA2_64_F(C, D, E, F, G, H, A, B, W[6]); 300| 38| SHA2_64_F(B, C, D, E, F, G, H, A, W[7]); 301| 38| SHA2_64_F(A, B, C, D, E, F, G, H, W[8]); 302| 38| SHA2_64_F(H, A, B, C, D, E, F, G, W[9]); 303| 38| SHA2_64_F(G, H, A, B, C, D, E, F, W[10]); 304| 38| SHA2_64_F(F, G, H, A, B, C, D, E, W[11]); 305| 38| SHA2_64_F(E, F, G, H, A, B, C, D, W[12]); 306| 38| SHA2_64_F(D, E, F, G, H, A, B, C, W[13]); 307| 38| SHA2_64_F(C, D, E, F, G, H, A, B, W[14]); 308| 38| SHA2_64_F(B, C, D, E, F, G, H, A, W[15]); 309| | 310| 38| A = (digest[0] += A); 311| 38| B = (digest[1] += B); 312| 38| C = (digest[2] += C); 313| 38| D = (digest[3] += D); 314| 38| E = (digest[4] += E); 315| 38| F = (digest[5] += F); 316| 38| G = (digest[6] += G); 317| 38| H = (digest[7] += H); 318| 38| } 319| 38|} sha2_64_avx2.cpp:_ZN5Botan12_GLOBAL__N_113sha512_next_wINS_9SIMD_2x64EEET_PS3_: 19| 1.21k|BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_BMI2 SIMD_T sha512_next_w(SIMD_T x[8]) { 20| 1.21k| const auto t0 = SIMD_T::alignr8(x[1], x[0]); 21| 1.21k| const auto t1 = SIMD_T::alignr8(x[5], x[4]); 22| | 23| 1.21k| const auto s0 = t0.template rotr<1>() ^ t0.template rotr<8>() ^ t0.template shr<7>(); 24| 1.21k| const auto s1 = x[7].template rotr<19>() ^ x[7].template rotr<61>() ^ x[7].template shr<6>(); 25| | 26| 1.21k| const auto nx = x[0] + s0 + s1 + t1; 27| | 28| 1.21k| x[0] = x[1]; 29| 1.21k| x[1] = x[2]; 30| 1.21k| x[2] = x[3]; 31| 1.21k| x[3] = x[4]; 32| 1.21k| x[4] = x[5]; 33| 1.21k| x[5] = x[6]; 34| 1.21k| x[6] = x[7]; 35| 1.21k| x[7] = nx; 36| | 37| 1.21k| return x[7]; 38| 1.21k|} _ZN5Botan5SHA_3C2Em: 17| 88| m_keccak({.capacity_bits = output_bits * 2, .padding = KeccakPadding::sha3()}), m_output_length(output_bits / 8) { 18| | // We only support the parameters for SHA-3 in this constructor 19| | 20| 88| if(output_bits != 224 && output_bits != 256 && output_bits != 384 && output_bits != 512) { ------------------ | Branch (20:7): [True: 88, False: 0] | Branch (20:29): [True: 44, False: 44] | Branch (20:51): [True: 44, False: 0] | Branch (20:73): [True: 0, False: 44] ------------------ 21| 0| throw Invalid_Argument(fmt("SHA_3: Invalid output length {}", output_bits)); 22| 0| } 23| 88|} _ZN5Botan5SHA_38add_dataENSt3__14spanIKhLm18446744073709551615EEE: 45| 132|void SHA_3::add_data(std::span input) { 46| 132| m_keccak.absorb(input); 47| 132|} _ZN5Botan5SHA_312final_resultENSt3__14spanIhLm18446744073709551615EEE: 49| 88|void SHA_3::final_result(std::span output) { 50| 88| m_keccak.finish(); 51| 88| m_keccak.squeeze(output); 52| 88| m_keccak.clear(); 53| 88|} _ZNK5Botan11Hash_Engine16check_batch_argsENSt3__14spanINS2_IhLm18446744073709551615EEELm18446744073709551615EEENS2_INS2_IKhLm18446744073709551615EEELm18446744073709551615EEES7_: 250| 88| std::span> inputs2) const { 251| 88| BOTAN_ARG_CHECK(outputs.size() == inputs1.size(), ------------------ | | 35| 88| do { \ | | 36| 88| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 88| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 88] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 88| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 88] | | ------------------ ------------------ 252| 88| "Hash_Engine::batch_hash requires same number of inputs and outputs"); 253| 88| BOTAN_ARG_CHECK(inputs2.empty() || inputs2.size() == inputs1.size(), ------------------ | | 35| 88| do { \ | | 36| 88| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 88| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 88, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 88| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 88] | | ------------------ ------------------ 254| 88| "Hash_Engine::batch_hash second inputs must be empty or match first"); 255| | 256| 88| const size_t out_len = output_length(); 257| | 258| 1.09k| for(size_t i = 0; i != inputs1.size(); ++i) { ------------------ | Branch (258:22): [True: 1.00k, False: 88] ------------------ 259| 1.00k| BOTAN_ARG_CHECK(inputs1[i].size() == inputs1[0].size(), "Hash_Engine::batch_hash inputs must be equal length"); ------------------ | | 35| 1.00k| do { \ | | 36| 1.00k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.00k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.00k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.00k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.00k] | | ------------------ ------------------ 260| 1.00k| BOTAN_ARG_CHECK(outputs[i].size() >= out_len, "Hash_Engine::batch_hash output buffer too small"); ------------------ | | 35| 1.00k| do { \ | | 36| 1.00k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.00k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.00k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.00k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.00k] | | ------------------ ------------------ 261| 1.00k| } 262| | 263| 88| for(size_t i = 0; i != inputs2.size(); ++i) { ------------------ | Branch (263:22): [True: 0, False: 88] ------------------ 264| 0| BOTAN_ARG_CHECK(inputs2[i].size() == inputs2[0].size(), "Hash_Engine::batch_hash inputs must be equal length"); ------------------ | | 35| 0| do { \ | | 36| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 0| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 0| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 0] | | ------------------ ------------------ 265| 0| } 266| 88|} _ZN5Botan11Hash_Engine14create_or_nullENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS1_4spanIKhLm18446744073709551615EEES5_: 270| 44| std::string_view provider) { 271| 44|#if defined(BOTAN_HAS_THREAD_UTILS) 272| 44| if(provider.empty() || provider == "threads") { ------------------ | Branch (272:7): [True: 44, False: 0] | Branch (272:27): [True: 0, False: 0] ------------------ 273| | // An explicit request for threads fails if the pool is disabled. The 274| | // default still wraps the engine, since an executor may be installed 275| | // later; the wrapper checks the worker count on each batch. 276| 44| if(provider == "threads" && Thread_Pool::global_instance().worker_count() < 2) { ------------------ | Branch (276:10): [True: 0, False: 44] | Branch (276:35): [True: 0, False: 0] ------------------ 277| 0| return nullptr; 278| 0| } 279| | 280| 44| if(auto engine = make_base_engine(hash_fn, common_prefix, "")) { ------------------ | Branch (280:15): [True: 44, False: 0] ------------------ 281| 44| return std::make_unique(hash_fn, std::move(engine), common_prefix); 282| 44| } 283| | 284| 0| return nullptr; 285| 44| } 286| 0|#endif 287| | 288| 0| return make_base_engine(hash_fn, common_prefix, provider); 289| 44|} _ZN5Botan11Hash_Engine15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS1_4spanIKhLm18446744073709551615EEES5_: 293| 44| std::string_view provider) { 294| 44| if(auto engine = Hash_Engine::create_or_null(hash_fn, common_prefix, provider)) { ------------------ | Branch (294:12): [True: 44, False: 0] ------------------ 295| 44| return engine; 296| 44| } else { 297| 0| throw Lookup_Error("Hash_Engine", hash_fn, provider); 298| 0| } 299| 44|} hash_engine.cpp:_ZN5Botan12_GLOBAL__N_116make_base_engineENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS1_4spanIKhLm18446744073709551615EEES5_: 71| 44| std::string_view provider) { 72| 44|#if defined(BOTAN_HAS_HASH_ENGINE_SHA2_32) 73| 44| if(auto engine = create_sha2_32_mb_engine(hash_fn, common_prefix, provider)) { ------------------ | Branch (73:12): [True: 0, False: 44] ------------------ 74| 0| return engine; 75| 0| } 76| 44|#endif 77| | 78| 44|#if defined(BOTAN_HAS_HASH_ENGINE_SHA2_64) 79| 44| if(auto engine = create_sha2_64_mb_engine(hash_fn, common_prefix, provider)) { ------------------ | Branch (79:12): [True: 0, False: 44] ------------------ 80| 0| return engine; 81| 0| } 82| 44|#endif 83| | 84| 44|#if defined(BOTAN_HAS_HASH_ENGINE_KECCAK) 85| 44| if(auto engine = create_keccak_mb_engine(hash_fn, common_prefix, provider)) { ------------------ | Branch (85:12): [True: 44, False: 0] ------------------ 86| 44| return engine; 87| 44| } 88| 0|#endif 89| | 90| 0| if(provider.empty() || provider == "base") { ------------------ | Branch (90:7): [True: 0, False: 0] | Branch (90:27): [True: 0, False: 0] ------------------ 91| 0| if(auto hash = HashFunction::create(hash_fn)) { ------------------ | Branch (91:15): [True: 0, False: 0] ------------------ 92| 0| return std::make_unique(std::move(hash), common_prefix); 93| 0| } 94| 0| } 95| | 96| 0| return nullptr; 97| 0|} hash_engine.cpp:_ZN5Botan12_GLOBAL__N_120Threaded_Hash_EngineC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEENS2_10unique_ptrINS_11Hash_EngineENS2_14default_deleteIS8_EEEENS2_4spanIKhLm18446744073709551615EEE: 106| 44| Hash_Engine(common_prefix), m_hash_fn(hash_fn), m_pool(Thread_Pool::global_instance()) { 107| | // Engines beyond the first are only instantiated once a batch is 108| | // actually large enough to be worth splitting over threads 109| 44| BOTAN_ASSERT_NONNULL(first_engine); ------------------ | | 123| 44| do { \ | | 124| 44| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 44] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 44| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 44] | | ------------------ ------------------ 110| 44| m_engines.push_back(std::move(first_engine)); 111| 44| } hash_engine.cpp:_ZNK5Botan12_GLOBAL__N_120Threaded_Hash_Engine13output_lengthEv: 117| 88| size_t output_length() const override { return m_engines[0]->output_length(); } hash_engine.cpp:_ZN5Botan12_GLOBAL__N_120Threaded_Hash_Engine10batch_hashENSt3__14spanINS3_IhLm18446744073709551615EEELm18446744073709551615EEENS3_INS3_IKhLm18446744073709551615EEELm18446744073709551615EEES8_: 127| 44| std::span> inputs2) override { 128| 44| check_batch_args(outputs, inputs1, inputs2); 129| | 130| 44| const size_t count = inputs1.size(); 131| 44| if(count == 0) { ------------------ | Branch (131:13): [True: 0, False: 44] ------------------ 132| 0| return; 133| 0| } 134| | 135| | // Both inputs and outputs count towards the work estimate; for 136| | // XOFs with long outputs squeezing dominates. The +64 approximates 137| | // padding and finalization overhead. 138| 44| const size_t per_hash_bytes = m_engines[0]->uncached_prefix_bytes() + inputs1[0].size() + 139| 44| (inputs2.empty() ? 0 : inputs2[0].size()) + output_length() + 64; ------------------ | Branch (139:41): [True: 44, False: 0] ------------------ 140| | 141| | // Chunk work to not spread too thinly since just queuing the work 142| | // in the pool has nonzero overhead. 143| 44| constexpr size_t MIN_BYTES_PER_THREAD = 32 * 1024; 144| 44| const size_t by_bytes = (count * per_hash_bytes) / MIN_BYTES_PER_THREAD; 145| | 146| 44| if(count < 2 || by_bytes < 2) { ------------------ | Branch (146:13): [True: 0, False: 44] | Branch (146:26): [True: 44, False: 0] ------------------ 147| 44| m_engines[0]->batch_hash(outputs, inputs1, inputs2); 148| 44| return; 149| 44| } 150| | 151| | // A SIMD engine hashes a group of lanes at once, so there is no 152| | // point in more threads than groups, nor in threads that do not 153| | // reduce the maximum number of groups any one thread must hash 154| 0| const size_t lanes = m_engines[0]->parallelism(); 155| 0| const size_t groups = (count + lanes - 1) / lanes; 156| | 157| 0| const size_t threads = [&]() { 158| 0| const size_t t = std::min({m_pool.worker_count(), groups, by_bytes}); 159| | 160| 0| if(t <= 1) { 161| 0| return t; 162| 0| } else { 163| 0| const size_t rounds = (groups + t - 1) / t; 164| 0| return (groups + rounds - 1) / rounds; 165| 0| } 166| 0| }(); 167| | 168| 0| if(threads <= 1) { ------------------ | Branch (168:13): [True: 0, False: 0] ------------------ 169| 0| m_engines[0]->batch_hash(outputs, inputs1, inputs2); 170| 0| return; 171| 0| } 172| | 173| 0| while(m_engines.size() < threads) { ------------------ | Branch (173:16): [True: 0, False: 0] ------------------ 174| 0| auto eng = make_base_engine(m_hash_fn, common_prefix(), ""); 175| 0| BOTAN_ASSERT_NONNULL(eng); // previous attempt already succeeded ------------------ | | 123| 0| do { \ | | 124| 0| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 0] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 0| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 0] | | ------------------ ------------------ 176| 0| m_engines.push_back(std::move(eng)); 177| 0| } 178| | 179| 0| dispatch(threads, count, [&](size_t t, size_t offset, size_t n) { 180| 0| const auto in2 = inputs2.empty() ? inputs2 : inputs2.subspan(offset, n); 181| 0| m_engines[t]->batch_hash(outputs.subspan(offset, n), inputs1.subspan(offset, n), in2); 182| 0| }); 183| 0| } _ZN5Botan23create_keccak_mb_engineENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEENS0_4spanIKhLm18446744073709551615EEES4_: 241| 44| std::string_view provider) { 242| 44|#if defined(BOTAN_HASH_ENGINE_KECCAK_HAS_IMPL) 243| 44| size_t output_length = 0; 244| 44| size_t rate = 0; 245| 44| uint8_t suffix = 0; 246| 44| std::string name; 247| | 248| 44| const AlgorithmSpec req(hash_fn); 249| 44| if(auto shake = req.match("SHAKE-128|SHAKE-256({bits:int})")) { ------------------ | Branch (249:12): [True: 44, False: 0] ------------------ 250| 44| const size_t bits = shake->integer("bits"); 251| 44| if(bits == 0 || bits % 8 != 0) { ------------------ | Branch (251:10): [True: 0, False: 44] | Branch (251:23): [True: 0, False: 44] ------------------ 252| 0| return nullptr; 253| 0| } 254| 44| output_length = bits / 8; 255| 44| rate = (shake->head() == "SHAKE-128") ? 168 : 136; ------------------ | Branch (255:14): [True: 44, False: 0] ------------------ 256| 44| suffix = 0x1F; 257| 44| name = fmt("{}({})", shake->head(), bits); 258| 44| } else if(auto sha3 = req.match("SHA-3({bits:int=512})")) { ------------------ | Branch (258:19): [True: 0, False: 0] ------------------ 259| 0| const size_t bits = sha3->integer("bits"); 260| 0| if(bits != 224 && bits != 256 && bits != 384 && bits != 512) { ------------------ | Branch (260:10): [True: 0, False: 0] | Branch (260:25): [True: 0, False: 0] | Branch (260:40): [True: 0, False: 0] | Branch (260:55): [True: 0, False: 0] ------------------ 261| 0| return nullptr; 262| 0| } 263| 0| output_length = bits / 8; 264| 0| rate = 200 - 2 * output_length; 265| 0| suffix = 0x06; 266| 0| name = fmt("SHA-3({})", bits); 267| 0| } else { 268| 0| return nullptr; 269| 0| } 270| | 271| 44| #if defined(BOTAN_HAS_HASH_ENGINE_KECCAK_AVX512) 272| 44| if(auto feat = CPUID::check(CPUID::Feature::AVX512)) { ------------------ | Branch (272:12): [True: 0, False: 44] ------------------ 273| 0| if(provider.empty() || provider == *feat) { ------------------ | Branch (273:10): [True: 0, False: 0] | Branch (273:30): [True: 0, False: 0] ------------------ 274| 0| return std::make_unique( 275| 0| name, output_length, rate, suffix, common_prefix, *feat, 8, keccak_mb_permute_x8, keccak_mb_absorb_x8); 276| 0| } 277| 0| } 278| 44| #endif 279| | 280| 44| #if defined(BOTAN_HAS_HASH_ENGINE_KECCAK_AVX2) 281| 44| if(auto feat = CPUID::check(CPUID::Feature::AVX2)) { ------------------ | Branch (281:12): [True: 44, False: 0] ------------------ 282| 44| if(provider.empty() || provider == *feat) { ------------------ | Branch (282:10): [True: 44, False: 0] | Branch (282:30): [True: 0, False: 0] ------------------ 283| 44| return std::make_unique( 284| 44| name, output_length, rate, suffix, common_prefix, *feat, 4, keccak_mb_permute_x4, keccak_mb_absorb_x4); 285| 44| } 286| 44| } 287| 0| #endif 288| | 289| 0| return nullptr; 290| |#else 291| | BOTAN_UNUSED(hash_fn, common_prefix, provider); 292| | return nullptr; 293| |#endif 294| 44|} hash_engine_keccak.cpp:_ZN5Botan12_GLOBAL__N_116Keccak_MB_EngineC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEmmhNS2_4spanIKhLm18446744073709551615EEES6_mPFvPmEPFvSA_PKPS8_mmE: 46| 44| Hash_Engine(common_prefix), 47| 44| m_name(name), 48| 44| m_provider(provider), 49| 44| m_output_length(output_length), 50| 44| m_rate(rate), 51| 44| m_suffix(suffix), 52| 44| m_lanes(lanes), 53| 44| m_permute(permute), 54| 44| m_absorb(absorb), 55| 44| m_prefix_full_bytes(common_prefix.size() - common_prefix.size() % rate), 56| 44| m_midstate(25), 57| 44| m_states(25 * lanes), 58| 44| m_block_ptrs(STRIP_BLOCKS * lanes), 59| 44| m_scratch(STRIP_BLOCKS * lanes * rate) { 60| | // Absorb any full prefix blocks once, using lane 0 of the kernel 61| 44| for(size_t block = 0; block != m_prefix_full_bytes / m_rate; ++block) { ------------------ | Branch (61:32): [True: 0, False: 44] ------------------ 62| 0| for(size_t w = 0; w != m_rate / 8; ++w) { ------------------ | Branch (62:31): [True: 0, False: 0] ------------------ 63| 0| m_states[w * m_lanes] ^= load_le(common_prefix.data() + block * m_rate, w); 64| 0| } 65| 0| m_permute(m_states.data()); 66| 0| } 67| 1.14k| for(size_t w = 0; w != 25; ++w) { ------------------ | Branch (67:28): [True: 1.10k, False: 44] ------------------ 68| 1.10k| m_midstate[w] = m_states[w * m_lanes]; 69| 1.10k| } 70| 44| } hash_engine_keccak.cpp:_ZNK5Botan12_GLOBAL__N_116Keccak_MB_Engine13output_lengthEv: 76| 132| size_t output_length() const override { return m_output_length; } hash_engine_keccak.cpp:_ZNK5Botan12_GLOBAL__N_116Keccak_MB_Engine21uncached_prefix_bytesEv: 80| 44| size_t uncached_prefix_bytes() const override { return common_prefix().size() - m_prefix_full_bytes; } hash_engine_keccak.cpp:_ZN5Botan12_GLOBAL__N_116Keccak_MB_Engine10batch_hashENSt3__14spanINS3_IhLm18446744073709551615EEELm18446744073709551615EEENS3_INS3_IKhLm18446744073709551615EEELm18446744073709551615EEES8_: 84| 44| std::span> inputs2) override { 85| 44| check_batch_args(outputs, inputs1, inputs2); 86| | 87| 44| const size_t count = inputs1.size(); 88| 44| if(count == 0) { ------------------ | Branch (88:13): [True: 0, False: 44] ------------------ 89| 0| return; 90| 0| } 91| | 92| | // The logical stream absorbed for lane i is 93| | // rem || inputs1[i] || inputs2[i] || padding 94| | // where rem is the part of the prefix not covered by the midstate 95| 44| const auto rem = common_prefix().subspan(m_prefix_full_bytes); 96| 44| const size_t r = rem.size(); 97| 44| const size_t len1 = inputs1[0].size(); 98| 44| const size_t len2 = inputs2.empty() ? 0 : inputs2[0].size(); ------------------ | Branch (98:30): [True: 44, False: 0] ------------------ 99| | 100| | // Checked so that the padded length and the offsets derived from 101| | // it cannot wrap for huge inputs, which matters on 32-bit targets 102| 44| BOTAN_ARG_CHECK(checked_add(r, len1, len2, m_rate).has_value(), "Hash_Engine::batch_hash inputs too long"); ------------------ | | 35| 44| do { \ | | 36| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 44| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 44] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 44| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 44] | | ------------------ ------------------ 103| | 104| 44| const size_t stream_len = r + len1 + len2; 105| 44| const size_t blocks = stream_len / m_rate + 1; 106| | 107| | // Ranges of blocks lying entirely within one input, which are 108| | // absorbed directly from the caller's buffers. All other blocks 109| | // are assembled into scratch. The final block always contains 110| | // padding and so is always assembled. 111| 44| const size_t d1_lo = (r + m_rate - 1) / m_rate; 112| 44| const size_t d1_hi = (r + len1) / m_rate; 113| 44| const size_t d2_lo = (r + len1 + m_rate - 1) / m_rate; 114| 44| const size_t d2_hi = (r + len1 + len2) / m_rate; 115| | 116| 177| for(size_t base = 0; base < count; base += m_lanes) { ------------------ | Branch (116:31): [True: 133, False: 44] ------------------ 117| | // Excess lanes of the last batch just recompute the final message 118| 133| const auto lane_idx = [&](size_t l) { return std::min(base + l, count - 1); }; 119| | 120| 3.45k| for(size_t w = 0; w != 25; ++w) { ------------------ | Branch (120:31): [True: 3.32k, False: 133] ------------------ 121| 16.6k| for(size_t l = 0; l != m_lanes; ++l) { ------------------ | Branch (121:34): [True: 13.3k, False: 3.32k] ------------------ 122| 13.3k| m_states[w * m_lanes + l] = m_midstate[w]; 123| 13.3k| } 124| 3.32k| } 125| | 126| 266| for(size_t b0 = 0; b0 < blocks; b0 += STRIP_BLOCKS) { ------------------ | Branch (126:32): [True: 133, False: 133] ------------------ 127| 133| const size_t strip = std::min(STRIP_BLOCKS, blocks - b0); 128| | 129| 266| for(size_t bi = 0; bi != strip; ++bi) { ------------------ | Branch (129:35): [True: 133, False: 133] ------------------ 130| 133| const size_t b = b0 + bi; 131| | 132| 665| for(size_t l = 0; l != m_lanes; ++l) { ------------------ | Branch (132:37): [True: 532, False: 133] ------------------ 133| 532| const size_t idx = lane_idx(l); 134| | 135| 532| const uint8_t* src = nullptr; 136| 532| if(b >= d1_lo && b < d1_hi) { ------------------ | Branch (136:25): [True: 0, False: 532] | Branch (136:39): [True: 0, False: 0] ------------------ 137| 0| src = inputs1[idx].data() + (m_rate * b - r); 138| 532| } else if(b >= d2_lo && b < d2_hi) { ------------------ | Branch (138:32): [True: 0, False: 532] | Branch (138:46): [True: 0, False: 0] ------------------ 139| 0| src = inputs2[idx].data() + (m_rate * b - r - len1); 140| 532| } else { 141| 532| uint8_t* slot = &m_scratch[(bi * m_lanes + l) * m_rate]; 142| 532| const auto in2 = inputs2.empty() ? std::span() : inputs2[idx]; ------------------ | Branch (142:42): [True: 532, False: 0] ------------------ 143| 532| assemble(slot, m_rate * b, m_rate * (b + 1), rem, inputs1[idx], in2, stream_len); 144| 532| src = slot; 145| 532| } 146| | 147| 532| m_block_ptrs[bi * m_lanes + l] = src; 148| 532| } 149| 133| } 150| | 151| 133| m_absorb(m_states.data(), m_block_ptrs.data(), m_rate / 8, strip); 152| 133| } 153| | 154| 133| const size_t used_lanes = std::min(m_lanes, count - base); 155| | 156| 133| size_t produced = 0; 157| 399| while(true) { ------------------ | Branch (157:19): [True: 399, Folded] ------------------ 158| 399| const size_t take = std::min(m_rate, m_output_length - produced); 159| 1.90k| for(size_t l = 0; l != used_lanes; ++l) { ------------------ | Branch (159:34): [True: 1.50k, False: 399] ------------------ 160| 1.50k| extract(outputs[base + l].subspan(produced, take), l); 161| 1.50k| } 162| 399| produced += take; 163| 399| if(produced == m_output_length) { ------------------ | Branch (163:19): [True: 133, False: 266] ------------------ 164| 133| break; 165| 133| } 166| 266| m_permute(m_states.data()); 167| 266| } 168| 133| } 169| 44| } hash_engine_keccak.cpp:_ZZN5Botan12_GLOBAL__N_116Keccak_MB_Engine10batch_hashENSt3__14spanINS3_IhLm18446744073709551615EEELm18446744073709551615EEENS3_INS3_IKhLm18446744073709551615EEELm18446744073709551615EEES8_ENKUlmE_clEm: 118| 532| const auto lane_idx = [&](size_t l) { return std::min(base + l, count - 1); }; hash_engine_keccak.cpp:_ZNK5Botan12_GLOBAL__N_116Keccak_MB_Engine8assembleEPhmmNSt3__14spanIKhLm18446744073709551615EEES6_S6_m: 181| 532| size_t stream_len) const { 182| 532| clear_mem(dest, hi - lo); 183| | 184| 532| copy_overlap(dest, lo, hi, rem, 0); 185| 532| copy_overlap(dest, lo, hi, in1, rem.size()); 186| 532| copy_overlap(dest, lo, hi, in2, rem.size() + in1.size()); 187| | 188| 532| if(stream_len >= lo && stream_len < hi) { ------------------ | Branch (188:13): [True: 532, False: 0] | Branch (188:33): [True: 532, False: 0] ------------------ 189| 532| dest[stream_len - lo] ^= m_suffix; 190| 532| } 191| | 192| | // The final padding bit lands in the last byte of the last block 193| 532| if(hi == m_rate * (stream_len / m_rate + 1)) { ------------------ | Branch (193:13): [True: 532, False: 0] ------------------ 194| 532| dest[hi - lo - 1] ^= 0x80; 195| 532| } 196| 532| } hash_engine_keccak.cpp:_ZN5Botan12_GLOBAL__N_116Keccak_MB_Engine12copy_overlapEPhmmNSt3__14spanIKhLm18446744073709551615EEEm: 198| 1.59k| static void copy_overlap(uint8_t* dest, size_t lo, size_t hi, std::span src, size_t offset) { 199| 1.59k| const size_t i0 = std::max(lo, offset); 200| 1.59k| const size_t i1 = std::min(hi, offset + src.size()); 201| 1.59k| if(i0 < i1) { ------------------ | Branch (201:13): [True: 1.06k, False: 532] ------------------ 202| 1.06k| copy_mem(dest + (i0 - lo), src.data() + (i0 - offset), i1 - i0); 203| 1.06k| } 204| 1.59k| } hash_engine_keccak.cpp:_ZNK5Botan12_GLOBAL__N_116Keccak_MB_Engine7extractENSt3__14spanIhLm18446744073709551615EEEm: 206| 1.50k| void extract(std::span out, size_t lane) const { 207| 1.50k| const size_t full_words = out.size() / 8; 208| | 209| 33.1k| for(size_t w = 0; w != full_words; ++w) { ------------------ | Branch (209:28): [True: 31.6k, False: 1.50k] ------------------ 210| 31.6k| store_le(m_states[w * m_lanes + lane], out.data() + 8 * w); 211| 31.6k| } 212| | 213| 1.50k| if(out.size() % 8 != 0) { ------------------ | Branch (213:13): [True: 0, False: 1.50k] ------------------ 214| 0| uint8_t last[8]; 215| 0| store_le(m_states[full_words * m_lanes + lane], last); 216| 0| copy_mem(out.data() + 8 * full_words, last, out.size() % 8); 217| 0| } 218| 1.50k| } _ZN5Botan20keccak_mb_permute_x4EPm: 52| 266|BOTAN_FN_ISA_SIMD_4X64 void keccak_mb_permute_x4(uint64_t* states) { 53| 266| SIMD_4x64 A[25]; 54| 266| SIMD_4x64 T[25]; 55| | 56| 6.91k| for(size_t w = 0; w != 25; ++w) { ------------------ | Branch (56:22): [True: 6.65k, False: 266] ------------------ 57| 6.65k| A[w] = SIMD_4x64::load_le(states + 4 * w); 58| 6.65k| } 59| | 60| 3.45k| for(size_t i = 0; i != 24; i += 2) { ------------------ | Branch (60:22): [True: 3.19k, False: 266] ------------------ 61| 3.19k| Keccak_Permutation_round(T, A, KECCAK_RC[i]); 62| 3.19k| Keccak_Permutation_round(A, T, KECCAK_RC[i + 1]); 63| 3.19k| } 64| | 65| 6.91k| for(size_t w = 0; w != 25; ++w) { ------------------ | Branch (65:22): [True: 6.65k, False: 266] ------------------ 66| 6.65k| A[w].store_le(states + 4 * w); 67| 6.65k| } 68| 266|} _ZN5Botan19keccak_mb_absorb_x4EPmPKPKhmm: 73| 133| size_t nblocks) { 74| 133| SIMD_4x64 A[25]; 75| 133| SIMD_4x64 T[25]; 76| | 77| 3.45k| for(size_t w = 0; w != 25; ++w) { ------------------ | Branch (77:22): [True: 3.32k, False: 133] ------------------ 78| 3.32k| A[w] = SIMD_4x64::load_le(states + 4 * w); 79| 3.32k| } 80| | 81| 266| for(size_t b = 0; b != nblocks; ++b) { ------------------ | Branch (81:22): [True: 133, False: 133] ------------------ 82| 133| absorb_block(A, blocks + 4 * b, rate_words); 83| | 84| 1.72k| for(size_t i = 0; i != 24; i += 2) { ------------------ | Branch (84:25): [True: 1.59k, False: 133] ------------------ 85| 1.59k| Keccak_Permutation_round(T, A, KECCAK_RC[i]); 86| 1.59k| Keccak_Permutation_round(A, T, KECCAK_RC[i + 1]); 87| 1.59k| } 88| 133| } 89| | 90| 3.45k| for(size_t w = 0; w != 25; ++w) { ------------------ | Branch (90:22): [True: 3.32k, False: 133] ------------------ 91| 3.32k| A[w].store_le(states + 4 * w); 92| 3.32k| } 93| 133|} hash_engine_keccak_avx2.cpp:_ZN5Botan12_GLOBAL__N_112absorb_blockEPNS_9SIMD_4x64EPKPKhm: 40| 133| size_t rate_words) { 41| 133| size_t w = 0; 42| 798| for(; w + 4 <= rate_words; w += 4) { ------------------ | Branch (42:10): [True: 665, False: 133] ------------------ 43| 665| absorb4(A, blocks, w, 0); 44| 665| } 45| 133| if(w != rate_words) { ------------------ | Branch (45:7): [True: 133, False: 0] ------------------ 46| 133| absorb4(A, blocks, rate_words - 4, 4 - (rate_words - w)); 47| 133| } 48| 133|} hash_engine_keccak_avx2.cpp:_ZN5Botan12_GLOBAL__N_17absorb4EPNS_9SIMD_4x64EPKPKhmm: 20| 798| size_t skip) { 21| 798| SIMD_4x64 M[4]; 22| 3.99k| for(size_t l = 0; l != 4; ++l) { ------------------ | Branch (22:22): [True: 3.19k, False: 798] ------------------ 23| 3.19k| M[l] = SIMD_4x64::load_le(blocks[l] + 8 * w0); 24| 3.19k| } 25| 798| SIMD_4x64::transpose(M[0], M[1], M[2], M[3]); 26| 3.59k| for(size_t w = skip; w != 4; ++w) { ------------------ | Branch (26:25): [True: 2.79k, False: 798] ------------------ 27| 2.79k| A[w0 + w] ^= M[w]; 28| 2.79k| } 29| 798|} _ZN5Botan24create_sha2_32_mb_engineENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEENS0_4spanIKhLm18446744073709551615EEES4_: 23| 44| std::string_view provider) { 24| 44|#if defined(BOTAN_HASH_ENGINE_SHA2_32_HAS_IMPL) 25| 44| size_t output_length = 0; 26| | 27| 44| const AlgorithmSpec req(hash_fn); 28| 44| if(req.matches("SHA-256")) { ------------------ | Branch (28:7): [True: 0, False: 44] ------------------ 29| 0| output_length = 32; 30| 44| } else if(auto m = req.match("Truncated(SHA-256,{bits:int})")) { ------------------ | Branch (30:19): [True: 0, False: 44] ------------------ 31| 0| const size_t bits = m->integer("bits"); 32| 0| if(bits == 0 || bits % 8 != 0 || bits > 256) { ------------------ | Branch (32:10): [True: 0, False: 0] | Branch (32:23): [True: 0, False: 0] | Branch (32:40): [True: 0, False: 0] ------------------ 33| 0| return nullptr; 34| 0| } 35| 0| output_length = bits / 8; 36| 44| } else { 37| 44| return nullptr; 38| 44| } 39| | 40| 0| SHA_256::digest_type midstate; 41| 0| SHA_256::init(midstate); 42| 0| const size_t full_bytes = common_prefix.size() - common_prefix.size() % SHA_256::block_bytes; 43| 0| if(full_bytes > 0) { ------------------ | Branch (43:7): [True: 0, False: 0] ------------------ 44| 0| SHA_256::compress_digest(midstate, common_prefix.first(full_bytes), full_bytes / SHA_256::block_bytes); 45| 0| } 46| | 47| 0| const auto make_engine = [&](std::string_view feat, 48| 0| size_t lanes, 49| 0| MDx_MB_Engine::compress_fn compress, 50| 0| MDx_MB_Engine::extract_fn extract) { 51| 0| return std::make_unique>(hash_fn, 52| 0| output_length, 53| 0| common_prefix, 54| 0| feat, 55| 0| lanes, 56| 0| SHA_256::block_bytes, 57| 0| SHA_256::ctr_bytes, 58| 0| midstate, 59| 0| compress, 60| 0| extract); 61| 0| }; 62| | 63| 0| #if defined(BOTAN_HAS_HASH_ENGINE_SHA2_32_AVX512) 64| 0| if(auto feat = CPUID::check(CPUID::Feature::AVX512)) { ------------------ | Branch (64:12): [True: 0, False: 0] ------------------ 65| 0| if(provider.empty() || provider == *feat) { ------------------ | Branch (65:10): [True: 0, False: 0] | Branch (65:30): [True: 0, False: 0] ------------------ 66| 0| return make_engine(*feat, 16, sha2_32_mb_compress_x16, sha2_32_mb_extract_x16); 67| 0| } 68| 0| } 69| 0| #endif 70| | 71| 0| #if defined(BOTAN_HAS_HASH_ENGINE_SHA2_32_AVX2) 72| 0| if(auto feat = CPUID::check(CPUID::Feature::AVX2)) { ------------------ | Branch (72:12): [True: 0, False: 0] ------------------ 73| 0| if(provider.empty() || provider == *feat) { ------------------ | Branch (73:10): [True: 0, False: 0] | Branch (73:30): [True: 0, False: 0] ------------------ 74| 0| return make_engine(*feat, 8, sha2_32_mb_compress_x8, sha2_32_mb_extract_x8); 75| 0| } 76| 0| } 77| 0| #endif 78| | 79| 0| return nullptr; 80| |#else 81| | BOTAN_UNUSED(hash_fn, common_prefix, provider); 82| | return nullptr; 83| |#endif 84| 0|} _ZN5Botan24create_sha2_64_mb_engineENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEENS0_4spanIKhLm18446744073709551615EEES4_: 23| 44| std::string_view provider) { 24| 44|#if defined(BOTAN_HASH_ENGINE_SHA2_64_HAS_IMPL) 25| 44| size_t output_length = 0; 26| 44| SHA_512::digest_type midstate; 27| | 28| 44| const AlgorithmSpec req(hash_fn); 29| 44| if(req.matches("SHA-512")) { ------------------ | Branch (29:7): [True: 0, False: 44] ------------------ 30| 0| output_length = SHA_512::output_bytes; 31| 0| SHA_512::init(midstate); 32| 44| } else if(req.matches("SHA-384")) { ------------------ | Branch (32:14): [True: 0, False: 44] ------------------ 33| 0| output_length = SHA_384::output_bytes; 34| 0| SHA_384::init(midstate); 35| 44| } else if(req.matches("SHA-512-256")) { ------------------ | Branch (35:14): [True: 0, False: 44] ------------------ 36| 0| output_length = SHA_512_256::output_bytes; 37| 0| SHA_512_256::init(midstate); 38| 44| } else if(auto m = req.match("Truncated(SHA-512,{bits:int})")) { ------------------ | Branch (38:19): [True: 0, False: 44] ------------------ 39| 0| const size_t bits = m->integer("bits"); 40| 0| if(bits == 0 || bits % 8 != 0 || bits > 512) { ------------------ | Branch (40:10): [True: 0, False: 0] | Branch (40:23): [True: 0, False: 0] | Branch (40:40): [True: 0, False: 0] ------------------ 41| 0| return nullptr; 42| 0| } 43| 0| output_length = bits / 8; 44| 0| SHA_512::init(midstate); 45| 44| } else { 46| 44| return nullptr; 47| 44| } 48| | 49| 0| const size_t full_bytes = common_prefix.size() - common_prefix.size() % SHA_512::block_bytes; 50| 0| if(full_bytes > 0) { ------------------ | Branch (50:7): [True: 0, False: 0] ------------------ 51| 0| SHA_512::compress_digest(midstate, common_prefix.first(full_bytes), full_bytes / SHA_512::block_bytes); 52| 0| } 53| | 54| 0| const auto make_engine = [&](std::string_view feat, 55| 0| size_t lanes, 56| 0| MDx_MB_Engine::compress_fn compress, 57| 0| MDx_MB_Engine::extract_fn extract) { 58| 0| return std::make_unique>(hash_fn, 59| 0| output_length, 60| 0| common_prefix, 61| 0| feat, 62| 0| lanes, 63| 0| SHA_512::block_bytes, 64| 0| SHA_512::ctr_bytes, 65| 0| midstate, 66| 0| compress, 67| 0| extract); 68| 0| }; 69| | 70| 0| #if defined(BOTAN_HAS_HASH_ENGINE_SHA2_64_AVX512) 71| 0| if(auto feat = CPUID::check(CPUID::Feature::AVX512)) { ------------------ | Branch (71:12): [True: 0, False: 0] ------------------ 72| 0| if(provider.empty() || provider == *feat) { ------------------ | Branch (72:10): [True: 0, False: 0] | Branch (72:30): [True: 0, False: 0] ------------------ 73| 0| return make_engine(*feat, 8, sha2_64_mb_compress_x8, sha2_64_mb_extract_x8); 74| 0| } 75| 0| } 76| 0| #endif 77| | 78| 0| #if defined(BOTAN_HAS_HASH_ENGINE_SHA2_64_AVX2) 79| 0| if(auto feat = CPUID::check(CPUID::Feature::AVX2)) { ------------------ | Branch (79:12): [True: 0, False: 0] ------------------ 80| 0| if(provider.empty() || provider == *feat) { ------------------ | Branch (80:10): [True: 0, False: 0] | Branch (80:30): [True: 0, False: 0] ------------------ 81| 0| return make_engine(*feat, 4, sha2_64_mb_compress_x4, sha2_64_mb_extract_x4); 82| 0| } 83| 0| } 84| 0| #endif 85| | 86| 0| return nullptr; 87| |#else 88| | BOTAN_UNUSED(hash_fn, common_prefix, provider); 89| | return nullptr; 90| |#endif 91| 0|} _ZN5Botan6BigInt17from_radix_digitsENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEm: 126| 15.0k|BigInt BigInt::from_radix_digits(std::string_view digits, size_t radix) { 127| 15.0k| if(radix == 16) { ------------------ | Branch (127:7): [True: 15.0k, False: 0] ------------------ 128| 15.0k| secure_vector binary; 129| | 130| 15.0k| if(digits.size() % 2 == 1) { ------------------ | Branch (130:10): [True: 3.22k, False: 11.7k] ------------------ 131| | // Handle lack of leading 0 132| 3.22k| const char buf0_with_leading_0[2] = {'0', digits[0]}; 133| | 134| 3.22k| binary = hex_decode_locked(buf0_with_leading_0, 2); 135| | 136| 3.22k| if(digits.size() > 1) { ------------------ | Branch (136:13): [True: 1.84k, False: 1.38k] ------------------ 137| 1.84k| binary += hex_decode_locked(&digits[1], digits.size() - 1, false); 138| 1.84k| } 139| 11.7k| } else { 140| 11.7k| binary = hex_decode_locked(digits, false); 141| 11.7k| } 142| | 143| 15.0k| return BigInt::from_bytes(binary); 144| 15.0k| } else if(radix == 10) { ------------------ | Branch (144:14): [True: 0, False: 0] ------------------ 145| | // Use the largest power of 10 that fits in a word, accumulating 146| | // groups of digits into word-sized chunks to minimize the number 147| | // of multiprecision multiplications. 148| 0| constexpr word conversion_radix = decimal_conversion_radix(); 149| 0| constexpr size_t radix_digits = decimal_conversion_radix_digits(); 150| | 151| 0| BigInt r; 152| | 153| | // Handle the initial partial block (if digit count is not a multiple of radix_digits) 154| 0| const size_t partial_block = digits.size() % radix_digits; 155| | 156| 0| if(partial_block > 0) { ------------------ | Branch (156:10): [True: 0, False: 0] ------------------ 157| 0| word acc = 0; 158| 0| for(size_t i = 0; i < partial_block; ++i) { ------------------ | Branch (158:28): [True: 0, False: 0] ------------------ 159| 0| const char c = digits[i]; 160| 0| BOTAN_ARG_CHECK(c >= '0' && c <= '9', "Invalid decimal character"); ------------------ | | 35| 0| do { \ | | 36| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 0| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 0| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 0] | | ------------------ ------------------ 161| 0| acc = acc * 10 + static_cast(c - '0'); 162| 0| } 163| 0| r += acc; 164| 0| } 165| | 166| | // Process full blocks of radix_digits 167| 0| for(size_t i = partial_block; i != digits.size(); i += radix_digits) { ------------------ | Branch (167:37): [True: 0, False: 0] ------------------ 168| 0| word acc = 0; 169| 0| for(size_t j = 0; j < radix_digits; ++j) { ------------------ | Branch (169:28): [True: 0, False: 0] ------------------ 170| 0| const char c = digits[i + j]; 171| 0| BOTAN_ARG_CHECK(c >= '0' && c <= '9', "Invalid decimal character"); ------------------ | | 35| 0| do { \ | | 36| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 0| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 0| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 0] | | ------------------ ------------------ 172| 0| acc = acc * 10 + static_cast(c - '0'); 173| 0| } 174| 0| r *= conversion_radix; 175| 0| r += acc; 176| 0| } 177| | 178| 0| return r; 179| 0| } else { 180| 0| throw Invalid_Argument("BigInt::from_radix_digits unknown radix"); 181| 0| } 182| 15.0k|} _ZN5Botan6BigIntpLERKS0_: 16| 666|BigInt& BigInt::operator+=(const BigInt& y) { 17| 666| if(&y == this) { ------------------ | Branch (17:7): [True: 0, False: 666] ------------------ 18| 0| return *this <<= 1; 19| 0| } 20| 666| return add(y._data(), y.sig_words(), y.sign()); 21| 666|} _ZN5Botan6BigInt3addEPKmmNS0_4SignE: 32| 1.76k|BigInt& BigInt::add(const word y[], size_t y_words, Sign y_sign) { 33| 1.76k| const size_t x_sw = sig_words(); 34| | 35| 1.76k| grow_to(std::max(x_sw, y_words) + 1); 36| | 37| 1.76k| if(sign() == y_sign) { ------------------ | Branch (37:7): [True: 666, False: 1.09k] ------------------ 38| 666| const word carry = bigint_add2(mutable_data(), size() - 1, y, y_words); 39| 666| mutable_data()[size() - 1] += carry; 40| 1.09k| } else { 41| 1.09k| const int32_t relative_size = bigint_cmp(_data(), x_sw, y, y_words); 42| | 43| 1.09k| if(relative_size >= 0) { ------------------ | Branch (43:10): [True: 110, False: 984] ------------------ 44| | // *this >= y 45| 110| bigint_sub2(mutable_data(), x_sw, y, y_words); 46| 984| } else { 47| | // *this < y: compute *this = y - *this 48| 984| bigint_sub2_rev(mutable_data(), y, y_words); 49| 984| } 50| | 51| 1.09k| if(relative_size < 0) { ------------------ | Branch (51:10): [True: 984, False: 110] ------------------ 52| 984| set_sign(y_sign); 53| 984| } else if(relative_size == 0) { ------------------ | Branch (53:17): [True: 0, False: 110] ------------------ 54| 0| set_sign(Positive); 55| 0| } 56| 1.09k| } 57| | 58| 1.76k| return (*this); 59| 1.76k|} _ZN5Botan6BigInt7mod_addERKS0_S2_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 61| 28.4k|BigInt& BigInt::mod_add(const BigInt& s, const BigInt& mod, secure_vector& ws) { 62| 28.4k| if(this->signum() < 0 || s.signum() < 0 || mod.signum() < 0) { ------------------ | Branch (62:7): [True: 0, False: 28.4k] | Branch (62:29): [True: 0, False: 28.4k] | Branch (62:47): [True: 0, False: 28.4k] ------------------ 63| 0| throw Invalid_Argument("BigInt::mod_add expects all arguments are positive"); 64| 0| } 65| | 66| 28.4k| BOTAN_DEBUG_ASSERT(*this < mod); ------------------ | | 137| 28.4k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 28.4k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 28.4k] | | ------------------ ------------------ 67| 28.4k| BOTAN_DEBUG_ASSERT(s < mod); ------------------ | | 137| 28.4k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 28.4k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 28.4k] | | ------------------ ------------------ 68| | 69| | /* 70| | t + s or t + s - p == t - (p - s) 71| | 72| | So first compute ws = p - s 73| | 74| | Then compute t + s and t - ws 75| | 76| | If t - ws does not borrow, then that is the correct valued 77| | */ 78| | 79| 28.4k| const size_t mod_sw = mod.sig_words(); 80| 28.4k| BOTAN_ARG_CHECK(mod_sw > 0, "BigInt::mod_add modulus must be positive"); ------------------ | | 35| 28.4k| do { \ | | 36| 28.4k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 28.4k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 28.4k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 28.4k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 28.4k] | | ------------------ ------------------ 81| | 82| 28.4k| this->grow_to(mod_sw); 83| 28.4k| s.grow_to(mod_sw); 84| | 85| | // First mod_sw for p - s, 2*mod_sw for bigint_addsub workspace 86| 28.4k| if(ws.size() < 3 * mod_sw) { ------------------ | Branch (86:7): [True: 21.1k, False: 7.30k] ------------------ 87| 21.1k| ws.resize(3 * mod_sw); 88| 21.1k| } 89| | 90| | // NOLINTBEGIN(readability-container-data-pointer) 91| | 92| 28.4k| word borrow = bigint_sub3(&ws[0], mod._data(), mod_sw, s._data(), mod_sw); 93| 28.4k| BOTAN_DEBUG_ASSERT(borrow == 0); ------------------ | | 137| 28.4k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 28.4k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 28.4k] | | ------------------ ------------------ 94| 28.4k| BOTAN_UNUSED(borrow); ------------------ | | 151| 28.4k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 95| | 96| | // Compute t - ws 97| 28.4k| borrow = bigint_sub3(&ws[mod_sw], this->_data(), mod_sw, &ws[0], mod_sw); 98| | 99| | // Compute t + s 100| 28.4k| bigint_add3(&ws[mod_sw * 2], this->_data(), mod_sw, s._data(), mod_sw); 101| | 102| 28.4k| CT::conditional_copy_mem(borrow, &ws[0], &ws[mod_sw * 2], &ws[mod_sw], mod_sw); 103| 28.4k| set_words(&ws[0], mod_sw); 104| | 105| | // NOLINTEND(readability-container-data-pointer) 106| | 107| 28.4k| return (*this); 108| 28.4k|} _ZN5Botan6BigInt7mod_subERKS0_S2_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 110| 1.92M|BigInt& BigInt::mod_sub(const BigInt& s, const BigInt& mod, secure_vector& ws) { 111| 1.92M| if(this->signum() < 0 || s.signum() < 0 || mod.signum() < 0) { ------------------ | Branch (111:7): [True: 0, False: 1.92M] | Branch (111:29): [True: 0, False: 1.92M] | Branch (111:47): [True: 0, False: 1.92M] ------------------ 112| 0| throw Invalid_Argument("BigInt::mod_sub expects all arguments are positive"); 113| 0| } 114| | 115| | // We are assuming in this function that *this and s are no more than mod_sw words long 116| 1.92M| BOTAN_DEBUG_ASSERT(*this < mod); ------------------ | | 137| 1.92M| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 1.92M| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 1.92M] | | ------------------ ------------------ 117| 1.92M| BOTAN_DEBUG_ASSERT(s < mod); ------------------ | | 137| 1.92M| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 1.92M| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 1.92M] | | ------------------ ------------------ 118| | 119| 1.92M| const size_t mod_sw = mod.sig_words(); 120| | 121| 1.92M| this->grow_to(mod_sw); 122| 1.92M| s.grow_to(mod_sw); 123| | 124| 1.92M| if(ws.size() < mod_sw) { ------------------ | Branch (124:7): [True: 0, False: 1.92M] ------------------ 125| 0| ws.resize(mod_sw); 126| 0| } 127| | 128| 1.92M| const word borrow = bigint_sub3(ws.data(), mutable_data(), mod_sw, s._data(), mod_sw); 129| | 130| | // Conditionally add back the modulus 131| 1.92M| bigint_cnd_add(borrow, ws.data(), mod._data(), mod_sw); 132| | 133| 1.92M| unchecked_copy_memory(mutable_data(), ws.data(), mod_sw); 134| | 135| 1.92M| return (*this); 136| 1.92M|} _ZN5Botan6BigInt7mod_mulEhRKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 138| 546k|BigInt& BigInt::mod_mul(uint8_t y, const BigInt& mod, secure_vector& ws) { 139| 546k| BOTAN_ARG_CHECK(this->signum() >= 0, "*this must be positive"); ------------------ | | 35| 546k| do { \ | | 36| 546k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 546k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 546k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 546k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 546k] | | ------------------ ------------------ 140| 546k| BOTAN_ARG_CHECK(y < 16, "y too large"); ------------------ | | 35| 546k| do { \ | | 36| 546k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 546k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 546k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 546k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 546k] | | ------------------ ------------------ 141| | 142| 546k| BOTAN_DEBUG_ASSERT(*this < mod); ------------------ | | 137| 546k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 546k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 546k] | | ------------------ ------------------ 143| | 144| 546k| *this *= static_cast(y); 145| 546k| this->reduce_below(mod, ws); 146| 546k| return (*this); 147| 546k|} _ZN5Botan6BigIntmLEm: 205| 546k|BigInt& BigInt::operator*=(word y) { 206| 546k| if(y == 0) { ------------------ | Branch (206:7): [True: 0, False: 546k] ------------------ 207| 0| clear(); 208| 0| set_sign(Positive); 209| 0| } 210| | 211| 546k| const word carry = bigint_linmul2(mutable_data(), size(), y); 212| 546k| set_word_at(size(), carry); 213| | 214| 546k| return (*this); 215| 546k|} _ZN5Botan6BigIntrMERKS0_: 232| 19.8k|BigInt& BigInt::operator%=(const BigInt& mod) { 233| 19.8k| return (*this = (*this) % mod); 234| 19.8k|} _ZN5Botan6BigIntrSEm: 287| 21.3k|BigInt& BigInt::operator>>=(size_t shift) { 288| 21.3k| bigint_shr1(m_data.mutable_data(), m_data.size(), shift); 289| | 290| 21.3k| if(sig_words() == 0 && m_signedness == Negative) { ------------------ | Branch (290:7): [True: 0, False: 21.3k] | Branch (290:27): [True: 0, False: 0] ------------------ 291| 0| m_signedness = Positive; 292| 0| } 293| | 294| 21.3k| return (*this); 295| 21.3k|} _ZN5Botan6BigInt4add2ERKS0_PKmmNS0_4SignE: 20| 15.2k|BigInt BigInt::add2(const BigInt& x, const word y[], size_t y_size, BigInt::Sign y_sign) { 21| 15.2k| const size_t x_sw = x.sig_words(); 22| | 23| 15.2k| BigInt z = BigInt::with_capacity(std::max(x_sw, y_size) + 1); 24| | 25| 15.2k| if(x.sign() == y_sign) { ------------------ | Branch (25:7): [True: 9.53k, False: 5.75k] ------------------ 26| 9.53k| const word carry = bigint_add3(z.mutable_data(), x._data(), x_sw, y, y_size); 27| 9.53k| z.mutable_data()[std::max(x_sw, y_size)] += carry; 28| 9.53k| z.set_sign(x.sign()); 29| 9.53k| } else { 30| 5.75k| const int32_t relative_size = bigint_cmp(x.data(), x_sw, y, y_size); 31| | 32| 5.75k| if(relative_size < 0) { ------------------ | Branch (32:10): [True: 25, False: 5.73k] ------------------ 33| | // x < y so z = abs(y - x) 34| | // NOLINTNEXTLINE(*-suspicious-call-argument) intentionally swapping x and y here 35| 25| bigint_sub3(z.mutable_data(), y, y_size, x.data(), x_sw); 36| 25| z.set_sign(y_sign); 37| 5.73k| } else if(relative_size == 0) { ------------------ | Branch (37:17): [True: 0, False: 5.73k] ------------------ 38| | // Positive zero (nothing to do in this case) 39| 5.73k| } else { 40| | /* 41| | * We know at this point that x >= y so if y_size is larger than 42| | * x_sw, we are guaranteed they are just leading zeros which can 43| | * be ignored 44| | */ 45| 5.73k| y_size = std::min(x_sw, y_size); 46| 5.73k| bigint_sub3(z.mutable_data(), x.data(), x_sw, y, y_size); 47| 5.73k| z.set_sign(x.sign()); 48| 5.73k| } 49| 5.75k| } 50| | 51| 15.2k| return z; 52| 15.2k|} _ZN5BotanmlERKNS_6BigIntES2_: 57| 1.09k|BigInt operator*(const BigInt& x, const BigInt& y) { 58| 1.09k| const size_t x_sw = x.sig_words(); 59| 1.09k| const size_t y_sw = y.sig_words(); 60| | 61| 1.09k| BigInt z = BigInt::with_capacity(x.size() + y.size()); 62| | 63| 1.09k| if(x_sw == 1 && y_sw > 0) { ------------------ | Branch (63:7): [True: 195, False: 897] | Branch (63:20): [True: 195, False: 0] ------------------ 64| 195| bigint_linmul3(z.mutable_data(), y._data(), y_sw, x.word_at(0)); 65| 897| } else if(y_sw == 1 && x_sw > 0) { ------------------ | Branch (65:14): [True: 1, False: 896] | Branch (65:27): [True: 1, False: 0] ------------------ 66| 1| bigint_linmul3(z.mutable_data(), x._data(), x_sw, y.word_at(0)); 67| 896| } else if(x_sw > 0 && y_sw > 0) { ------------------ | Branch (67:14): [True: 894, False: 2] | Branch (67:26): [True: 894, False: 0] ------------------ 68| 894| secure_vector workspace(z.size()); 69| | 70| 894| bigint_mul(z.mutable_data(), 71| 894| z.size(), 72| 894| x._data(), 73| 894| x.size(), 74| 894| x_sw, 75| 894| y._data(), 76| 894| y.size(), 77| 894| y_sw, 78| 894| workspace.data(), 79| 894| workspace.size()); 80| 894| } 81| | 82| 1.09k| z.cond_flip_sign(x_sw > 0 && y_sw > 0 && x.sign() != y.sign()); ------------------ | Branch (82:21): [True: 1.09k, False: 2] | Branch (82:33): [True: 1.09k, False: 0] | Branch (82:45): [True: 0, False: 1.09k] ------------------ 83| | 84| 1.09k| return z; 85| 1.09k|} _ZN5BotanmlERKNS_6BigIntEm: 90| 1.30k|BigInt operator*(const BigInt& x, word y) { 91| 1.30k| const size_t x_sw = x.sig_words(); 92| | 93| 1.30k| BigInt z = BigInt::with_capacity(x_sw + 1); 94| | 95| 1.30k| if(x_sw > 0 && y > 0) { ------------------ | Branch (95:7): [True: 1.30k, False: 0] | Branch (95:19): [True: 1.30k, False: 0] ------------------ 96| 1.30k| bigint_linmul3(z.mutable_data(), x._data(), x_sw, y); 97| 1.30k| z.set_sign(x.sign()); 98| 1.30k| } 99| | 100| 1.30k| return z; 101| 1.30k|} _ZN5BotandvERKNS_6BigIntES2_: 106| 417|BigInt operator/(const BigInt& x, const BigInt& y) { 107| 417| if(y.sig_words() == 1 && y.signum() >= 0) { ------------------ | Branch (107:7): [True: 0, False: 417] | Branch (107:29): [True: 0, False: 0] ------------------ 108| 0| return x / y.word_at(0); 109| 0| } 110| | 111| 417| BigInt q; 112| 417| BigInt r; 113| 417| ct_divide(x, y, q, r); 114| 417| return q; 115| 417|} _ZN5BotandvERKNS_6BigIntEm: 120| 1.13k|BigInt operator/(const BigInt& x, word y) { 121| 1.13k| if(y == 0) { ------------------ | Branch (121:7): [True: 0, False: 1.13k] ------------------ 122| 0| throw Invalid_Argument("BigInt::operator/ divide by zero"); 123| 0| } 124| | 125| 1.13k| BigInt q; 126| 1.13k| word r = 0; 127| 1.13k| ct_divide_word(x, y, q, r); 128| 1.13k| return q; 129| 1.13k|} _ZN5BotanrmERKNS_6BigIntES2_: 134| 20.0k|BigInt operator%(const BigInt& n, const BigInt& mod) { 135| 20.0k| if(mod.is_zero()) { ------------------ | Branch (135:7): [True: 0, False: 20.0k] ------------------ 136| 0| throw Invalid_Argument("BigInt::operator% divide by zero"); 137| 0| } 138| 20.0k| if(mod.signum() < 0) { ------------------ | Branch (138:7): [True: 0, False: 20.0k] ------------------ 139| 0| throw Invalid_Argument("BigInt::operator% modulus must be > 0"); 140| 0| } 141| 20.0k| if(n.signum() >= 0 && mod.signum() >= 0 && n < mod) { ------------------ | Branch (141:7): [True: 19.0k, False: 988] | Branch (141:26): [True: 19.0k, False: 0] | Branch (141:47): [True: 12, False: 19.0k] ------------------ 142| 12| return n; 143| 12| } 144| | 145| 20.0k| if(mod.sig_words() == 1) { ------------------ | Branch (145:7): [True: 7.58k, False: 12.4k] ------------------ 146| 7.58k| return BigInt::from_word(n % mod.word_at(0)); 147| 7.58k| } 148| | 149| 12.4k| BigInt q; 150| 12.4k| BigInt r; 151| 12.4k| ct_divide(n, mod, q, r); 152| 12.4k| return r; 153| 20.0k|} _ZN5BotanrmERKNS_6BigIntEm: 158| 19.0k|word operator%(const BigInt& n, word mod) { 159| 19.0k| if(mod == 0) { ------------------ | Branch (159:7): [True: 0, False: 19.0k] ------------------ 160| 0| throw Invalid_Argument("BigInt::operator% divide by zero"); 161| 0| } 162| | 163| 19.0k| if(mod == 1) { ------------------ | Branch (163:7): [True: 0, False: 19.0k] ------------------ 164| 0| return 0; 165| 0| } 166| | 167| 19.0k| word remainder = 0; 168| | 169| 19.0k| if(n.signum() >= 0 && is_power_of_2(mod)) { ------------------ | Branch (169:7): [True: 19.0k, False: 4] | Branch (169:26): [True: 11.5k, False: 7.57k] ------------------ 170| 11.5k| remainder = (n.word_at(0) & (mod - 1)); 171| 11.5k| } else { 172| 7.58k| const auto redc_mod = divide_precomp::setup_vartime(mod); 173| 7.58k| const size_t sw = n.sig_words(); 174| 25.0k| for(size_t i = sw; i > 0; --i) { ------------------ | Branch (174:26): [True: 17.4k, False: 7.58k] ------------------ 175| 17.4k| remainder = redc_mod.mod_2to1(remainder, n.word_at(i - 1)); 176| 17.4k| } 177| 7.58k| } 178| | 179| 19.0k| if(remainder != 0 && n.sign() == BigInt::Negative) { ------------------ | Branch (179:7): [True: 19.0k, False: 0] | Branch (179:25): [True: 4, False: 19.0k] ------------------ 180| 4| return mod - remainder; 181| 4| } 182| 19.0k| return remainder; 183| 19.0k|} _ZN5BotanlsERKNS_6BigIntEm: 188| 58|BigInt operator<<(const BigInt& x, size_t shift) { 189| 58| if(shift >= 65536) { ------------------ | Branch (189:7): [True: 0, False: 58] ------------------ 190| 0| throw Invalid_Argument("BigInt left shift count too large"); 191| 0| } 192| | 193| 58| if(x.is_zero()) { ------------------ | Branch (193:7): [True: 0, False: 58] ------------------ 194| 0| return BigInt::zero(); 195| 0| } 196| | 197| 58| const size_t x_sw = x.sig_words(); 198| | 199| 58| const size_t new_size = x_sw + shift / WordInfo::bits + 1; 200| 58| BigInt y = BigInt::with_capacity(new_size); 201| 58| bigint_shl2(y.mutable_data(), new_size, x._data(), x_sw, shift); 202| 58| y.set_sign(x.sign()); 203| 58| return y; 204| 58|} _ZN5BotanrsERKNS_6BigIntEm: 209| 1.02k|BigInt operator>>(const BigInt& x, size_t shift) { 210| 1.02k| const size_t shift_words = shift / WordInfo::bits; 211| 1.02k| const size_t x_sw = x.sig_words(); 212| | 213| 1.02k| if(shift_words >= x_sw) { ------------------ | Branch (213:7): [True: 0, False: 1.02k] ------------------ 214| 0| return BigInt::zero(); 215| 0| } 216| | 217| 1.02k| const size_t new_size = x_sw - shift_words; 218| 1.02k| BigInt y = BigInt::with_capacity(new_size); 219| 1.02k| bigint_shr2(y.mutable_data(), new_size, x._data(), x_sw, shift); 220| | 221| 1.02k| if(x.signum() < 0 && y.is_zero()) { ------------------ | Branch (221:7): [True: 0, False: 1.02k] | Branch (221:25): [True: 0, False: 0] ------------------ 222| 0| y.set_sign(BigInt::Positive); 223| 1.02k| } else { 224| 1.02k| y.set_sign(x.sign()); 225| 1.02k| } 226| | 227| 1.02k| return y; 228| 1.02k|} _ZN5Botan6BigIntC2Em: 18| 3.39k|BigInt::BigInt(uint64_t n) { 19| 3.39k| if constexpr(sizeof(word) == 8) { 20| 3.39k| m_data.set_word_at(0, static_cast(n)); 21| | } else { 22| | m_data.set_word_at(1, static_cast(n >> 32)); 23| | m_data.set_word_at(0, static_cast(n)); 24| | } 25| 3.39k|} _ZN5Botan6BigInt8from_u64Em: 28| 260|BigInt BigInt::from_u64(uint64_t n) { 29| 260| return BigInt(n); 30| 260|} _ZN5Botan6BigInt9from_wordEm: 33| 10.7k|BigInt BigInt::from_word(word n) { 34| 10.7k| BigInt bn; 35| 10.7k| bn.set_word_at(0, n); 36| 10.7k| return bn; 37| 10.7k|} _ZN5Botan6BigInt8from_s32Ei: 40| 260|BigInt BigInt::from_s32(int32_t n) { 41| 260| if(n >= 0) { ------------------ | Branch (41:7): [True: 168, False: 92] ------------------ 42| 168| return BigInt::from_u64(static_cast(n)); 43| 168| } else { 44| 92| return -BigInt::from_u64(static_cast(-static_cast(n))); 45| 92| } 46| 260|} _ZN5Botan6BigInt13with_capacityEm: 49| 930k|BigInt BigInt::with_capacity(size_t size) { 50| 930k| BigInt bn; 51| 930k| bn.grow_to(size); 52| 930k| return bn; 53| 930k|} _ZN5Botan6BigInt11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 55| 15.0k|BigInt BigInt::from_string(std::string_view str) { 56| 15.0k| size_t prefix_bytes = 0; 57| 15.0k| bool negative = false; 58| 15.0k| size_t radix = 10; 59| | 60| 15.0k| if(!str.empty() && str[0] == '-') { ------------------ | Branch (60:7): [True: 15.0k, False: 0] | Branch (60:23): [True: 0, False: 15.0k] ------------------ 61| 0| prefix_bytes += 1; 62| 0| negative = true; 63| 0| } 64| | 65| 15.0k| if(str.length() > prefix_bytes + 2 && str[prefix_bytes] == '0' && str[prefix_bytes + 1] == 'x') { ------------------ | Branch (65:7): [True: 15.0k, False: 0] | Branch (65:42): [True: 15.0k, False: 0] | Branch (65:70): [True: 15.0k, False: 0] ------------------ 66| 15.0k| prefix_bytes += 2; 67| 15.0k| radix = 16; 68| 15.0k| } 69| | 70| 15.0k| BigInt r = BigInt::from_radix_digits(str.substr(prefix_bytes), radix); 71| | 72| 15.0k| if(negative) { ------------------ | Branch (72:7): [True: 0, False: 15.0k] ------------------ 73| 0| r.set_sign(Negative); 74| 15.0k| } else { 75| 15.0k| r.set_sign(Positive); 76| 15.0k| } 77| | 78| 15.0k| return r; 79| 15.0k|} _ZN5Botan6BigInt10from_bytesENSt3__14spanIKhLm18446744073709551615EEE: 81| 23.7k|BigInt BigInt::from_bytes(std::span input) { 82| 23.7k| BigInt r; 83| 23.7k| r.assign_from_bytes(input); 84| 23.7k| return r; 85| 23.7k|} _ZNK5Botan6BigInt7byte_atEm: 116| 41.4k|uint8_t BigInt::byte_at(size_t n) const { 117| 41.4k| return get_byte_var(sizeof(word) - (n % sizeof(word)) - 1, word_at(n / sizeof(word))); 118| 41.4k|} _ZNK5Botan6BigInt8cmp_wordEm: 120| 83.6k|int32_t BigInt::cmp_word(word other) const { 121| 83.6k| if(signum() < 0) { ------------------ | Branch (121:7): [True: 1.08k, False: 82.5k] ------------------ 122| 1.08k| return -1; // other is positive ... 123| 1.08k| } 124| | 125| 82.5k| const size_t sw = this->sig_words(); 126| 82.5k| if(sw > 1) { ------------------ | Branch (126:7): [True: 53.8k, False: 28.6k] ------------------ 127| 53.8k| return 1; // must be larger since other is just one word ... 128| 53.8k| } 129| | 130| 28.6k| return bigint_cmp(this->_data(), sw, &other, 1); 131| 82.5k|} _ZNK5Botan6BigInt3cmpERKS0_b: 136| 15.0k|int32_t BigInt::cmp(const BigInt& other, bool check_signs) const { 137| 15.0k| if(check_signs) { ------------------ | Branch (137:7): [True: 15.0k, False: 0] ------------------ 138| 15.0k| if(other.signum() >= 0 && this->signum() < 0) { ------------------ | Branch (138:10): [True: 15.0k, False: 0] | Branch (138:33): [True: 0, False: 15.0k] ------------------ 139| 0| return -1; 140| 0| } 141| | 142| 15.0k| if(other.signum() < 0 && this->signum() >= 0) { ------------------ | Branch (142:10): [True: 0, False: 15.0k] | Branch (142:32): [True: 0, False: 0] ------------------ 143| 0| return 1; 144| 0| } 145| | 146| 15.0k| if(other.signum() < 0 && this->signum() < 0) { ------------------ | Branch (146:10): [True: 0, False: 15.0k] | Branch (146:32): [True: 0, False: 0] ------------------ 147| 0| return (-bigint_cmp(this->_data(), this->size(), other._data(), other.size())); 148| 0| } 149| 15.0k| } 150| | 151| 15.0k| return bigint_cmp(this->_data(), this->size(), other._data(), other.size()); 152| 15.0k|} _ZNK5Botan6BigInt8is_equalERKS0_: 154| 10.0k|bool BigInt::is_equal(const BigInt& other) const { 155| 10.0k| if(this->sign() != other.sign()) { ------------------ | Branch (155:7): [True: 0, False: 10.0k] ------------------ 156| 0| return false; 157| 0| } 158| | 159| 10.0k| return bigint_ct_is_eq(this->_data(), this->size(), other._data(), other.size()).as_bool(); 160| 10.0k|} _ZNK5Botan6BigInt12is_less_thanERKS0_: 162| 31.9k|bool BigInt::is_less_than(const BigInt& other) const { 163| 31.9k| if(this->signum() < 0 && other.signum() >= 0) { ------------------ | Branch (163:7): [True: 0, False: 31.9k] | Branch (163:29): [True: 0, False: 0] ------------------ 164| 0| return true; 165| 0| } 166| | 167| 31.9k| if(this->signum() >= 0 && other.signum() < 0) { ------------------ | Branch (167:7): [True: 31.9k, False: 0] | Branch (167:30): [True: 0, False: 31.9k] ------------------ 168| 0| return false; 169| 0| } 170| | 171| 31.9k| if(other.signum() < 0 && this->signum() < 0) { ------------------ | Branch (171:7): [True: 0, False: 31.9k] | Branch (171:29): [True: 0, False: 0] ------------------ 172| 0| return bigint_ct_is_lt(other._data(), other.size(), this->_data(), this->size()).as_bool(); 173| 0| } 174| | 175| 31.9k| return bigint_ct_is_lt(this->_data(), this->size(), other._data(), other.size()).as_bool(); 176| 31.9k|} _ZNK5Botan6BigInt12encode_wordsEPmm: 178| 600k|void BigInt::encode_words(word out[], size_t size) const { 179| 600k| const size_t words = sig_words(); 180| | 181| 600k| if(words > size) { ------------------ | Branch (181:7): [True: 0, False: 600k] ------------------ 182| 0| throw Encoding_Error("BigInt::encode_words value too large to encode"); 183| 0| } 184| | 185| 600k| clear_mem(out, size); 186| 600k| copy_mem(out, _data(), words); 187| 600k|} _ZN5Botan6BigInt4Data11set_to_zeroEv: 189| 38.4k|void BigInt::Data::set_to_zero() { 190| 38.4k| m_reg.resize(m_reg.capacity()); 191| 38.4k| clear_mem(m_reg.data(), m_reg.size()); 192| 38.4k| m_sig_words = 0; 193| 38.4k|} _ZNK5Botan6BigInt4Data14calc_sig_wordsEv: 213| 5.66M|size_t BigInt::Data::calc_sig_words() const { 214| 5.66M| const size_t sz = m_reg.size(); 215| 5.66M| size_t sig = sz; 216| | 217| 5.66M| word sub = 1; 218| | 219| 68.0M| for(size_t i = 0; i != sz; ++i) { ------------------ | Branch (219:22): [True: 62.3M, False: 5.66M] ------------------ 220| 62.3M| const word w = m_reg[sz - i - 1]; 221| 62.3M| sub &= ct_is_zero(w); 222| 62.3M| sig -= sub; 223| 62.3M| } 224| | 225| | /* 226| | * This depends on the data so is poisoned, but unpoison it here as 227| | * later conditionals are made on the size. 228| | */ 229| 5.66M| CT::unpoison(sig); 230| | 231| 5.66M| return sig; 232| 5.66M|} _ZNK5Botan6BigInt13get_substringEmm: 237| 94.6k|uint32_t BigInt::get_substring(size_t offset, size_t length) const { 238| 94.6k| if(length == 0 || length > 32) { ------------------ | Branch (238:7): [True: 0, False: 94.6k] | Branch (238:22): [True: 0, False: 94.6k] ------------------ 239| 0| throw Invalid_Argument("BigInt::get_substring invalid substring length"); 240| 0| } 241| | 242| 94.6k| const uint32_t mask = 0xFFFFFFFF >> (32 - length); 243| | 244| 94.6k| const size_t word_offset = offset / WordInfo::bits; 245| 94.6k| const size_t wshift = (offset % WordInfo::bits); 246| | 247| | /* 248| | * The substring is contained within one or at most two words. The 249| | * offset and length are not secret, so we can perform conditional 250| | * operations on those values. 251| | */ 252| 94.6k| const word w0 = word_at(word_offset); 253| | 254| 94.6k| if(wshift == 0 || (offset + length) / WordInfo::bits == word_offset) { ------------------ | Branch (254:7): [True: 4.38k, False: 90.2k] | Branch (254:22): [True: 84.9k, False: 5.35k] ------------------ 255| 89.2k| return static_cast(w0 >> wshift) & mask; 256| 89.2k| } else { 257| 5.35k| const word w1 = word_at(word_offset + 1); 258| 5.35k| return static_cast((w0 >> wshift) | (w1 << (WordInfo::bits - wshift))) & mask; 259| 5.35k| } 260| 94.6k|} _ZNK5Botan6BigInt5bytesEv: 292| 2.95k|size_t BigInt::bytes() const { 293| 2.95k| return ceil_tobytes(bits()); 294| 2.95k|} _ZNK5Botan6BigInt13top_bits_freeEv: 296| 33.1k|size_t BigInt::top_bits_free() const { 297| 33.1k| const size_t words = sig_words(); 298| | 299| 33.1k| const word top_word = word_at(words - 1); 300| 33.1k| const size_t bits_used = high_bit(CT::value_barrier(top_word)); 301| 33.1k| CT::unpoison(bits_used); 302| 33.1k| return WordInfo::bits - bits_used; 303| 33.1k|} _ZNK5Botan6BigInt4bitsEv: 305| 39.3k|size_t BigInt::bits() const { 306| 39.3k| const size_t words = sig_words(); 307| | 308| 39.3k| if(words == 0) { ------------------ | Branch (308:7): [True: 6.11k, False: 33.1k] ------------------ 309| 6.11k| return 0; 310| 6.11k| } 311| | 312| 33.1k| const size_t full_words = (words - 1) * WordInfo::bits; 313| 33.1k| const size_t top_bits = WordInfo::bits - top_bits_free(); 314| | 315| 33.1k| return full_words + top_bits; 316| 39.3k|} _ZNK5Botan6BigIntngEv: 321| 92|BigInt BigInt::operator-() const { 322| 92| BigInt x = (*this); 323| 92| x.flip_sign(); 324| 92| return x; 325| 92|} _ZN5Botan6BigInt12reduce_belowERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 327| 546k|size_t BigInt::reduce_below(const BigInt& p, secure_vector& ws) { 328| 546k| if(p.signum() < 0 || this->signum() < 0) { ------------------ | Branch (328:7): [True: 0, False: 546k] | Branch (328:25): [True: 0, False: 546k] ------------------ 329| 0| throw Invalid_Argument("BigInt::reduce_below both values must be positive"); 330| 0| } 331| | 332| 546k| const size_t p_words = p.sig_words(); 333| | 334| 546k| if(size() < p_words + 1) { ------------------ | Branch (334:7): [True: 0, False: 546k] ------------------ 335| 0| grow_to(p_words + 1); 336| 0| } 337| | 338| 546k| if(ws.size() < p_words + 1) { ------------------ | Branch (338:7): [True: 0, False: 546k] ------------------ 339| 0| ws.resize(p_words + 1); 340| 0| } 341| | 342| 546k| clear_mem(ws.data(), ws.size()); 343| | 344| 546k| size_t reductions = 0; 345| | 346| 1.42M| for(;;) { 347| 1.42M| const word borrow = bigint_sub3(ws.data(), _data(), p_words + 1, p._data(), p_words); 348| 1.42M| if(borrow > 0) { ------------------ | Branch (348:10): [True: 546k, False: 880k] ------------------ 349| 546k| break; 350| 546k| } 351| | 352| 880k| ++reductions; 353| 880k| swap_reg(ws); 354| 880k| } 355| | 356| 546k| return reductions; 357| 546k|} _ZNK5Botan6BigInt3absEv: 384| 2.14k|BigInt BigInt::abs() const { 385| 2.14k| BigInt x = (*this); 386| 2.14k| x.set_sign(Positive); 387| 2.14k| return x; 388| 2.14k|} _ZNK5Botan6BigInt12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 393| 1.82k|void BigInt::serialize_to(std::span output) const { 394| 1.82k| BOTAN_ARG_CHECK(this->bytes() <= output.size(), "Insufficient output space"); ------------------ | | 35| 1.82k| do { \ | | 36| 1.82k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.82k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.82k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.82k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.82k] | | ------------------ ------------------ 395| | 396| 1.82k| this->binary_encode(output.data(), output.size()); 397| 1.82k|} _ZNK5Botan6BigInt13binary_encodeEPhm: 402| 1.82k|void BigInt::binary_encode(uint8_t output[], size_t len) const { 403| 1.82k| const size_t full_words = len / sizeof(word); 404| 1.82k| const size_t extra_bytes = len % sizeof(word); 405| | 406| 8.61k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (406:22): [True: 6.78k, False: 1.82k] ------------------ 407| 6.78k| const word w = word_at(i); 408| 6.78k| store_be(w, output + (len - (i + 1) * sizeof(word))); 409| 6.78k| } 410| | 411| 1.82k| if(extra_bytes > 0) { ------------------ | Branch (411:7): [True: 1.41k, False: 412] ------------------ 412| 1.41k| const word w = word_at(full_words); 413| | 414| 7.01k| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (414:25): [True: 5.60k, False: 1.41k] ------------------ 415| 5.60k| output[extra_bytes - i - 1] = get_byte_var(sizeof(word) - i - 1, w); 416| 5.60k| } 417| 1.41k| } 418| 1.82k|} _ZN5Botan6BigInt17assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE: 423| 38.4k|void BigInt::assign_from_bytes(std::span bytes) { 424| 38.4k| clear(); 425| | 426| 38.4k| const size_t length = bytes.size(); 427| 38.4k| const size_t full_words = length / sizeof(word); 428| 38.4k| const size_t extra_bytes = length % sizeof(word); 429| | 430| 38.4k| const size_t total_words = full_words + (extra_bytes > 0 ? 1 : 0); ------------------ | Branch (430:45): [True: 25.6k, False: 12.8k] ------------------ 431| | 432| 38.4k| secure_vector reg(8 * ceil_division(total_words, 8)); 433| | 434| 162k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (434:22): [True: 123k, False: 38.4k] ------------------ 435| 123k| reg[i] = load_be(bytes.last()); 436| 123k| bytes = bytes.first(bytes.size() - sizeof(word)); 437| 123k| } 438| | 439| 38.4k| if(!bytes.empty()) { ------------------ | Branch (439:7): [True: 25.6k, False: 12.8k] ------------------ 440| 25.6k| BOTAN_ASSERT_NOMSG(extra_bytes == bytes.size()); ------------------ | | 84| 25.6k| do { \ | | 85| 25.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 25.6k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 25.6k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 25.6k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 25.6k] | | ------------------ ------------------ 441| 25.6k| std::array last_partial_word = {0}; 442| 25.6k| copy_mem(std::span{last_partial_word}.last(extra_bytes), bytes); 443| 25.6k| reg[full_words] = load_be(last_partial_word); 444| 25.6k| } 445| | 446| 38.4k| m_data.swap(reg); 447| 38.4k|} _ZN5Botan6BigInt14cond_flip_signEb: 521| 16.0k|void BigInt::cond_flip_sign(bool predicate) { 522| | // This code is assuming Negative == 0, Positive == 1 523| | 524| 16.0k| const auto mask = CT::Mask::expand_bool(predicate); 525| | 526| 16.0k| const uint8_t current_sign = static_cast(sign()); 527| | 528| 16.0k| const uint8_t new_sign = mask.select(current_sign ^ 1, current_sign); 529| | 530| 16.0k| set_sign(static_cast(new_sign)); 531| 16.0k|} _ZNK5Botan6BigInt20_const_time_unpoisonEv: 559| 3.04M|void BigInt::_const_time_unpoison() const { 560| 3.04M| CT::unpoison(m_data.const_data(), m_data.size()); 561| 3.04M|} _ZN5Botan9ct_divideERKNS_6BigIntES2_RS0_S3_: 180| 12.8k|void ct_divide(const BigInt& x, const BigInt& y, BigInt& q_out, BigInt& r_out) { 181| 12.8k| if(y.is_zero()) { ------------------ | Branch (181:7): [True: 0, False: 12.8k] ------------------ 182| 0| throw Invalid_Argument("ct_divide: cannot divide by zero"); 183| 0| } 184| | 185| 12.8k| BigInt q; 186| 12.8k| BigInt r; 187| 12.8k| ct_divide_impl(q, r, x, y); 188| | 189| 12.8k| sign_fixup(x, y, q, r); 190| 12.8k| r_out = std::move(r); 191| 12.8k| q_out = std::move(q); 192| 12.8k|} _ZN5Botan15ct_divide_pow2kEmRKNS_6BigIntE: 194| 10.6k|BigInt ct_divide_pow2k(size_t k, const BigInt& y) { 195| 10.6k| BOTAN_ARG_CHECK(y.signum() != 0, "Cannot divide by zero"); ------------------ | | 35| 10.6k| do { \ | | 36| 10.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.6k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.6k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.6k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.6k] | | ------------------ ------------------ 196| 10.6k| BOTAN_ARG_CHECK(y.signum() >= 0, "Negative divisor not supported"); ------------------ | | 35| 10.6k| do { \ | | 36| 10.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.6k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.6k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.6k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.6k] | | ------------------ ------------------ 197| 10.6k| BOTAN_ARG_CHECK(k > 1, "Invalid k"); ------------------ | | 35| 10.6k| do { \ | | 36| 10.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.6k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.6k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.6k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.6k] | | ------------------ ------------------ 198| | 199| 10.6k| BigInt q; 200| 10.6k| BigInt r; 201| 10.6k| ct_divide_impl(q, r, BigInt::power_of_2(k), y); 202| 10.6k| return q; 203| 10.6k|} _ZN5Botan14ct_divide_wordERKNS_6BigIntEmRS0_Rm: 205| 1.13k|void ct_divide_word(const BigInt& x, word y, BigInt& q_out, word& r_out) { 206| 1.13k| if(y == 0) { ------------------ | Branch (206:7): [True: 0, False: 1.13k] ------------------ 207| 0| throw Invalid_Argument("ct_divide_word: cannot divide by zero"); 208| 0| } 209| | 210| 1.13k| const size_t x_words = x.sig_words(); 211| | 212| | // The divisor is public here; setup is variable time in it 213| 1.13k| const auto div_y = divide_precomp::setup_vartime(y); 214| | 215| 1.13k| secure_vector qw(x_words); 216| 1.13k| word r = 0; 217| | 218| | // Each step depends on r < y, which holds since r is a remainder mod y 219| 5.17k| for(size_t i = x_words; i > 0; --i) { ------------------ | Branch (219:28): [True: 4.04k, False: 1.13k] ------------------ 220| 4.04k| const auto [qi, ri] = div_y.divmod_2to1_vartime(r, x._data()[i - 1]); 221| 4.04k| qw[i - 1] = qi; 222| 4.04k| r = ri; 223| 4.04k| } 224| | 225| 1.13k| BigInt q = BigInt::_from_words(qw); 226| | 227| 1.13k| if(x.signum() < 0) { ------------------ | Branch (227:7): [True: 0, False: 1.13k] ------------------ 228| 0| q.flip_sign(); 229| 0| if(r != 0) { ------------------ | Branch (229:10): [True: 0, False: 0] ------------------ 230| 0| --q; 231| 0| r = y - r; 232| 0| } 233| 0| } 234| | 235| 1.13k| r_out = r; 236| 1.13k| q_out = std::move(q); 237| 1.13k|} divide.cpp:_ZN5Botan12_GLOBAL__N_114ct_divide_implERNS_6BigIntES2_RKS1_S4_: 66| 23.5k|void ct_divide_impl(BigInt& q_out, BigInt& r_out, const BigInt& x, const BigInt& y) { 67| 23.5k| constexpr size_t WB = WordInfo::bits; 68| | 69| 23.5k| const size_t x_words = x.sig_words(); 70| 23.5k| const size_t y_words = y.sig_words(); 71| 23.5k| BOTAN_ASSERT_NOMSG(y_words > 0); ------------------ | | 84| 23.5k| do { \ | | 85| 23.5k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 23.5k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 23.5k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 23.5k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 23.5k] | | ------------------ ------------------ 72| | 73| 23.5k| if(x_words < y_words) { ------------------ | Branch (73:7): [True: 984, False: 22.5k] ------------------ 74| | // Here |x| < |y| so q = 0 and r = |x| 75| 984| r_out = x.abs(); 76| 984| q_out = BigInt::zero(); 77| 984| return; 78| 984| } 79| | 80| 22.5k| const size_t r_words = x_words + 1; 81| 22.5k| const size_t q_words = x_words - y_words + 1; 82| | 83| | // The number of leading zero bits of y, in [0,WB) 84| 22.5k| const word s = static_cast(WB) - static_cast(high_bit(CT::value_barrier(y._data()[y_words - 1]))); 85| 22.5k| const auto s_mask = CT::Mask::expand(s); 86| 22.5k| const word s_comp = s_mask.if_set_return(static_cast(WB) - s); 87| | 88| 22.5k| secure_vector yn(y_words); 89| 22.5k| secure_vector rw(r_words); 90| 22.5k| secure_vector qw(q_words); 91| | 92| | // Normalize: yn = |y| << s (which sets the top bit of yn) and rw = |x| << s; 93| | // shifting y stays within y_words words, shifting x adds at most one word 94| 22.5k| word carry = 0; 95| 111k| for(size_t i = 0; i != y_words; ++i) { ------------------ | Branch (95:22): [True: 88.7k, False: 22.5k] ------------------ 96| 88.7k| const word w = y._data()[i]; 97| 88.7k| yn[i] = (w << s) | carry; 98| 88.7k| carry = s_mask.if_set_return(w >> s_comp); 99| 88.7k| } 100| | 101| 22.5k| carry = 0; 102| 177k| for(size_t i = 0; i != x_words; ++i) { ------------------ | Branch (102:22): [True: 154k, False: 22.5k] ------------------ 103| 154k| const word w = x._data()[i]; 104| 154k| rw[i] = (w << s) | carry; 105| 154k| carry = s_mask.if_set_return(w >> s_comp); 106| 154k| } 107| 22.5k| rw[x_words] = carry; 108| | 109| 22.5k| const auto div_by_yn = divide_precomp::setup(CT::value_barrier(yn[y_words - 1])); 110| | 111| 22.5k| if(y_words == 1) { ------------------ | Branch (111:7): [True: 194, False: 22.3k] ------------------ 112| | /* 113| | * 2/1 word-serial division. The initial remainder is the shift-out 114| | * carry, which is less than 2^s and so less than the divisor. 115| | */ 116| 194| word r = rw[x_words]; 117| 776| for(size_t i = x_words; i > 0; --i) { ------------------ | Branch (117:31): [True: 582, False: 194] ------------------ 118| 582| const auto [qi, ri] = div_by_yn.divmod_2to1_ct(r, rw[i - 1]); 119| 582| qw[i - 1] = qi; 120| 582| r = ri; 121| 582| } 122| | 123| 194| rw[0] = r >> s; 124| 22.3k| } else { 125| 22.3k| const word yn1 = yn[y_words - 1]; 126| 22.3k| const word yn2 = yn[y_words - 2]; 127| | 128| 110k| for(size_t i = q_words; i > 0; --i) { ------------------ | Branch (128:31): [True: 87.8k, False: 22.3k] ------------------ 129| 87.8k| const size_t j = i - 1; // current window is rw[j ... j + y_words] 130| | 131| 87.8k| const word u2 = rw[j + y_words]; 132| 87.8k| const word u1 = rw[j + y_words - 1]; 133| 87.8k| const word u0 = rw[j + y_words - 2]; 134| | 135| | /* 136| | * Estimate the quotient digit from the top two words of the window. 137| | * The window invariant gives u2 <= yn1; if u2 == yn1 the 2/1 138| | * division precondition does not hold, and instead the digit 139| | * estimate is the maximum word value. 140| | */ 141| 87.8k| const auto top_eq = CT::Mask::is_equal(u2, yn1); 142| 87.8k| const word q_est = div_by_yn.divmod_2to1_ct(u2, u1).first; 143| 87.8k| word qhat = top_eq.select(WordInfo::max, q_est); 144| | 145| | // Per HAC 14.23, this correction is required at most twice 146| 87.8k| qhat -= division_check_ct(qhat, yn1, yn2, u2, u1, u0).if_set_return(1); 147| 87.8k| qhat -= division_check_ct(qhat, yn1, yn2, u2, u1, u0).if_set_return(1); 148| | 149| | // Subtract qhat * yn from the window 150| 87.8k| const word bw = bigint_submul(&rw[j], yn.data(), y_words, qhat); 151| 87.8k| word borrow = 0; 152| 87.8k| rw[j + y_words] = word_sub(u2, bw, &borrow); 153| | 154| | // If the digit was still one too large, the subtraction 155| | // underflowed; add back and decrement the digit 156| 87.8k| const word cb = bigint_cnd_add(borrow, &rw[j], yn.data(), y_words); 157| 87.8k| rw[j + y_words] += cb; 158| 87.8k| qhat -= borrow; 159| | 160| 87.8k| qw[j] = qhat; 161| 87.8k| } 162| | 163| | // The remainder is in rw[0:y_words], still shifted left by s, and 164| | // rw[y_words] is zero 165| 110k| for(size_t i = 0; i != y_words; ++i) { ------------------ | Branch (165:25): [True: 88.5k, False: 22.3k] ------------------ 166| 88.5k| rw[i] = (rw[i] >> s) | s_mask.if_set_return(CT::value_barrier(rw[i + 1]) << s_comp); 167| 88.5k| } 168| 22.3k| } 169| | 170| 22.5k| BigInt q = BigInt::_from_words(qw); 171| 22.5k| rw.resize(y_words); 172| 22.5k| BigInt r = BigInt::_from_words(rw); 173| | 174| 22.5k| r_out = std::move(r); 175| 22.5k| q_out = std::move(q); 176| 22.5k|} divide.cpp:_ZN5Botan12_GLOBAL__N_117division_check_ctEmmmmmm: 39| 175k|inline CT::Mask division_check_ct(word q, word y2, word y1, word x3, word x2, word x1) { 40| 175k| word y3 = 0; 41| 175k| y1 = word_madd2(q, y1, &y3); 42| 175k| y2 = word_madd2(q, y2, &y3); 43| | 44| 175k| const auto gt3 = CT::Mask::is_gt(y3, x3); 45| 175k| const auto eq3 = CT::Mask::is_equal(y3, x3); 46| 175k| const auto gt2 = CT::Mask::is_gt(y2, x2); 47| 175k| const auto eq2 = CT::Mask::is_equal(y2, x2); 48| 175k| const auto gt1 = CT::Mask::is_gt(y1, x1); 49| | 50| 175k| return gt3 | (eq3 & (gt2 | (eq2 & gt1))); 51| 175k|} divide.cpp:_ZN5Botan12_GLOBAL__N_110sign_fixupERKNS_6BigIntES3_RS1_S4_: 22| 12.8k|void sign_fixup(const BigInt& x, const BigInt& y, BigInt& q, BigInt& r) { 23| 12.8k| q.cond_flip_sign(x.sign() != y.sign()); 24| | 25| 12.8k| if(x.signum() < 0 && r.signum() != 0) { ------------------ | Branch (25:7): [True: 984, False: 11.8k] | Branch (25:25): [True: 984, False: 0] ------------------ 26| 984| if(y.signum() > 0) { ------------------ | Branch (26:10): [True: 984, False: 0] ------------------ 27| 984| q -= 1; 28| 984| } else { 29| 0| q += 1; 30| 0| } 31| 984| r = y.abs() - r; 32| 984| } 33| 12.8k|} _ZN5Botan17bigint_comba_sqr4EPmPKm: 22| 3.32M|void bigint_comba_sqr4(word z[8], const word x[4]) { 23| 3.32M|#if defined(BOTAN_HAS_MP_MULX) 24| 3.32M| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (24:7): [True: 3.32M, False: 0] ------------------ 25| 3.32M| return bigint_mulx_sqr4(z, x); 26| 3.32M| } 27| 0|#endif 28| | 29| 0| word3 accum; 30| | 31| 0| accum.mul(x[0], x[0]); 32| 0| z[0] = accum.extract(); 33| 0| accum.mul_x2(x[0], x[1]); 34| 0| z[1] = accum.extract(); 35| 0| accum.mul_x2(x[0], x[2]); 36| 0| accum.mul(x[1], x[1]); 37| 0| z[2] = accum.extract(); 38| 0| accum.mul_x2(x[0], x[3]); 39| 0| accum.mul_x2(x[1], x[2]); 40| 0| z[3] = accum.extract(); 41| 0| accum.mul_x2(x[1], x[3]); 42| 0| accum.mul(x[2], x[2]); 43| 0| z[4] = accum.extract(); 44| 0| accum.mul_x2(x[2], x[3]); 45| 0| z[5] = accum.extract(); 46| 0| accum.mul(x[3], x[3]); 47| 0| z[6] = accum.extract(); 48| 0| z[7] = accum.extract(); 49| 0|} _ZN5Botan17bigint_comba_mul4EPmPKmS2_: 54| 5.84M|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) { 55| 5.84M|#if defined(BOTAN_HAS_MP_MULX) 56| 5.84M| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (56:7): [True: 5.84M, False: 0] ------------------ 57| 5.84M| return bigint_mulx_mul4(z, x, y); 58| 5.84M| } 59| 0|#endif 60| | 61| 0| word3 accum; 62| | 63| 0| accum.mul(x[0], y[0]); 64| 0| z[0] = accum.extract(); 65| 0| accum.mul(x[0], y[1]); 66| 0| accum.mul(x[1], y[0]); 67| 0| z[1] = accum.extract(); 68| 0| accum.mul(x[0], y[2]); 69| 0| accum.mul(x[1], y[1]); 70| 0| accum.mul(x[2], y[0]); 71| 0| z[2] = accum.extract(); 72| 0| accum.mul(x[0], y[3]); 73| 0| accum.mul(x[1], y[2]); 74| 0| accum.mul(x[2], y[1]); 75| 0| accum.mul(x[3], y[0]); 76| 0| z[3] = accum.extract(); 77| 0| accum.mul(x[1], y[3]); 78| 0| accum.mul(x[2], y[2]); 79| 0| accum.mul(x[3], y[1]); 80| 0| z[4] = accum.extract(); 81| 0| accum.mul(x[2], y[3]); 82| 0| accum.mul(x[3], y[2]); 83| 0| z[5] = accum.extract(); 84| 0| accum.mul(x[3], y[3]); 85| 0| z[6] = accum.extract(); 86| 0| z[7] = accum.extract(); 87| 0|} _ZN5Botan17bigint_comba_sqr6EPmPKm: 92| 227k|void bigint_comba_sqr6(word z[12], const word x[6]) { 93| 227k|#if defined(BOTAN_HAS_MP_MULX) 94| 227k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (94:7): [True: 227k, False: 0] ------------------ 95| 227k| return bigint_mulx_sqr6(z, x); 96| 227k| } 97| 0|#endif 98| | 99| 0| word3 accum; 100| | 101| 0| accum.mul(x[0], x[0]); 102| 0| z[0] = accum.extract(); 103| 0| accum.mul_x2(x[0], x[1]); 104| 0| z[1] = accum.extract(); 105| 0| accum.mul_x2(x[0], x[2]); 106| 0| accum.mul(x[1], x[1]); 107| 0| z[2] = accum.extract(); 108| 0| accum.mul_x2(x[0], x[3]); 109| 0| accum.mul_x2(x[1], x[2]); 110| 0| z[3] = accum.extract(); 111| 0| accum.mul_x2(x[0], x[4]); 112| 0| accum.mul_x2(x[1], x[3]); 113| 0| accum.mul(x[2], x[2]); 114| 0| z[4] = accum.extract(); 115| 0| accum.mul_x2(x[0], x[5]); 116| 0| accum.mul_x2(x[1], x[4]); 117| 0| accum.mul_x2(x[2], x[3]); 118| 0| z[5] = accum.extract(); 119| 0| accum.mul_x2(x[1], x[5]); 120| 0| accum.mul_x2(x[2], x[4]); 121| 0| accum.mul(x[3], x[3]); 122| 0| z[6] = accum.extract(); 123| 0| accum.mul_x2(x[2], x[5]); 124| 0| accum.mul_x2(x[3], x[4]); 125| 0| z[7] = accum.extract(); 126| 0| accum.mul_x2(x[3], x[5]); 127| 0| accum.mul(x[4], x[4]); 128| 0| z[8] = accum.extract(); 129| 0| accum.mul_x2(x[4], x[5]); 130| 0| z[9] = accum.extract(); 131| 0| accum.mul(x[5], x[5]); 132| 0| z[10] = accum.extract(); 133| 0| z[11] = accum.extract(); 134| 0|} _ZN5Botan17bigint_comba_mul6EPmPKmS2_: 139| 293k|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) { 140| 293k|#if defined(BOTAN_HAS_MP_MULX) 141| 293k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (141:7): [True: 293k, False: 0] ------------------ 142| 293k| return bigint_mulx_mul6(z, x, y); 143| 293k| } 144| 0|#endif 145| | 146| 0| word3 accum; 147| | 148| 0| accum.mul(x[0], y[0]); 149| 0| z[0] = accum.extract(); 150| 0| accum.mul(x[0], y[1]); 151| 0| accum.mul(x[1], y[0]); 152| 0| z[1] = accum.extract(); 153| 0| accum.mul(x[0], y[2]); 154| 0| accum.mul(x[1], y[1]); 155| 0| accum.mul(x[2], y[0]); 156| 0| z[2] = accum.extract(); 157| 0| accum.mul(x[0], y[3]); 158| 0| accum.mul(x[1], y[2]); 159| 0| accum.mul(x[2], y[1]); 160| 0| accum.mul(x[3], y[0]); 161| 0| z[3] = accum.extract(); 162| 0| accum.mul(x[0], y[4]); 163| 0| accum.mul(x[1], y[3]); 164| 0| accum.mul(x[2], y[2]); 165| 0| accum.mul(x[3], y[1]); 166| 0| accum.mul(x[4], y[0]); 167| 0| z[4] = accum.extract(); 168| 0| accum.mul(x[0], y[5]); 169| 0| accum.mul(x[1], y[4]); 170| 0| accum.mul(x[2], y[3]); 171| 0| accum.mul(x[3], y[2]); 172| 0| accum.mul(x[4], y[1]); 173| 0| accum.mul(x[5], y[0]); 174| 0| z[5] = accum.extract(); 175| 0| accum.mul(x[1], y[5]); 176| 0| accum.mul(x[2], y[4]); 177| 0| accum.mul(x[3], y[3]); 178| 0| accum.mul(x[4], y[2]); 179| 0| accum.mul(x[5], y[1]); 180| 0| z[6] = accum.extract(); 181| 0| accum.mul(x[2], y[5]); 182| 0| accum.mul(x[3], y[4]); 183| 0| accum.mul(x[4], y[3]); 184| 0| accum.mul(x[5], y[2]); 185| 0| z[7] = accum.extract(); 186| 0| accum.mul(x[3], y[5]); 187| 0| accum.mul(x[4], y[4]); 188| 0| accum.mul(x[5], y[3]); 189| 0| z[8] = accum.extract(); 190| 0| accum.mul(x[4], y[5]); 191| 0| accum.mul(x[5], y[4]); 192| 0| z[9] = accum.extract(); 193| 0| accum.mul(x[5], y[5]); 194| 0| z[10] = accum.extract(); 195| 0| z[11] = accum.extract(); 196| 0|} _ZN5Botan17bigint_comba_sqr7EPmPKm: 201| 7.72k|void bigint_comba_sqr7(word z[14], const word x[7]) { 202| 7.72k| word3 accum; 203| | 204| 7.72k| accum.mul(x[0], x[0]); 205| 7.72k| z[0] = accum.extract(); 206| 7.72k| accum.mul_x2(x[0], x[1]); 207| 7.72k| z[1] = accum.extract(); 208| 7.72k| accum.mul_x2(x[0], x[2]); 209| 7.72k| accum.mul(x[1], x[1]); 210| 7.72k| z[2] = accum.extract(); 211| 7.72k| accum.mul_x2(x[0], x[3]); 212| 7.72k| accum.mul_x2(x[1], x[2]); 213| 7.72k| z[3] = accum.extract(); 214| 7.72k| accum.mul_x2(x[0], x[4]); 215| 7.72k| accum.mul_x2(x[1], x[3]); 216| 7.72k| accum.mul(x[2], x[2]); 217| 7.72k| z[4] = accum.extract(); 218| 7.72k| accum.mul_x2(x[0], x[5]); 219| 7.72k| accum.mul_x2(x[1], x[4]); 220| 7.72k| accum.mul_x2(x[2], x[3]); 221| 7.72k| z[5] = accum.extract(); 222| 7.72k| accum.mul_x2(x[0], x[6]); 223| 7.72k| accum.mul_x2(x[1], x[5]); 224| 7.72k| accum.mul_x2(x[2], x[4]); 225| 7.72k| accum.mul(x[3], x[3]); 226| 7.72k| z[6] = accum.extract(); 227| 7.72k| accum.mul_x2(x[1], x[6]); 228| 7.72k| accum.mul_x2(x[2], x[5]); 229| 7.72k| accum.mul_x2(x[3], x[4]); 230| 7.72k| z[7] = accum.extract(); 231| 7.72k| accum.mul_x2(x[2], x[6]); 232| 7.72k| accum.mul_x2(x[3], x[5]); 233| 7.72k| accum.mul(x[4], x[4]); 234| 7.72k| z[8] = accum.extract(); 235| 7.72k| accum.mul_x2(x[3], x[6]); 236| 7.72k| accum.mul_x2(x[4], x[5]); 237| 7.72k| z[9] = accum.extract(); 238| 7.72k| accum.mul_x2(x[4], x[6]); 239| 7.72k| accum.mul(x[5], x[5]); 240| 7.72k| z[10] = accum.extract(); 241| 7.72k| accum.mul_x2(x[5], x[6]); 242| 7.72k| z[11] = accum.extract(); 243| 7.72k| accum.mul(x[6], x[6]); 244| 7.72k| z[12] = accum.extract(); 245| 7.72k| z[13] = accum.extract(); 246| 7.72k|} _ZN5Botan17bigint_comba_mul7EPmPKmS2_: 251| 15.0k|void bigint_comba_mul7(word z[14], const word x[7], const word y[7]) { 252| 15.0k| word3 accum; 253| | 254| 15.0k| accum.mul(x[0], y[0]); 255| 15.0k| z[0] = accum.extract(); 256| 15.0k| accum.mul(x[0], y[1]); 257| 15.0k| accum.mul(x[1], y[0]); 258| 15.0k| z[1] = accum.extract(); 259| 15.0k| accum.mul(x[0], y[2]); 260| 15.0k| accum.mul(x[1], y[1]); 261| 15.0k| accum.mul(x[2], y[0]); 262| 15.0k| z[2] = accum.extract(); 263| 15.0k| accum.mul(x[0], y[3]); 264| 15.0k| accum.mul(x[1], y[2]); 265| 15.0k| accum.mul(x[2], y[1]); 266| 15.0k| accum.mul(x[3], y[0]); 267| 15.0k| z[3] = accum.extract(); 268| 15.0k| accum.mul(x[0], y[4]); 269| 15.0k| accum.mul(x[1], y[3]); 270| 15.0k| accum.mul(x[2], y[2]); 271| 15.0k| accum.mul(x[3], y[1]); 272| 15.0k| accum.mul(x[4], y[0]); 273| 15.0k| z[4] = accum.extract(); 274| 15.0k| accum.mul(x[0], y[5]); 275| 15.0k| accum.mul(x[1], y[4]); 276| 15.0k| accum.mul(x[2], y[3]); 277| 15.0k| accum.mul(x[3], y[2]); 278| 15.0k| accum.mul(x[4], y[1]); 279| 15.0k| accum.mul(x[5], y[0]); 280| 15.0k| z[5] = accum.extract(); 281| 15.0k| accum.mul(x[0], y[6]); 282| 15.0k| accum.mul(x[1], y[5]); 283| 15.0k| accum.mul(x[2], y[4]); 284| 15.0k| accum.mul(x[3], y[3]); 285| 15.0k| accum.mul(x[4], y[2]); 286| 15.0k| accum.mul(x[5], y[1]); 287| 15.0k| accum.mul(x[6], y[0]); 288| 15.0k| z[6] = accum.extract(); 289| 15.0k| accum.mul(x[1], y[6]); 290| 15.0k| accum.mul(x[2], y[5]); 291| 15.0k| accum.mul(x[3], y[4]); 292| 15.0k| accum.mul(x[4], y[3]); 293| 15.0k| accum.mul(x[5], y[2]); 294| 15.0k| accum.mul(x[6], y[1]); 295| 15.0k| z[7] = accum.extract(); 296| 15.0k| accum.mul(x[2], y[6]); 297| 15.0k| accum.mul(x[3], y[5]); 298| 15.0k| accum.mul(x[4], y[4]); 299| 15.0k| accum.mul(x[5], y[3]); 300| 15.0k| accum.mul(x[6], y[2]); 301| 15.0k| z[8] = accum.extract(); 302| 15.0k| accum.mul(x[3], y[6]); 303| 15.0k| accum.mul(x[4], y[5]); 304| 15.0k| accum.mul(x[5], y[4]); 305| 15.0k| accum.mul(x[6], y[3]); 306| 15.0k| z[9] = accum.extract(); 307| 15.0k| accum.mul(x[4], y[6]); 308| 15.0k| accum.mul(x[5], y[5]); 309| 15.0k| accum.mul(x[6], y[4]); 310| 15.0k| z[10] = accum.extract(); 311| 15.0k| accum.mul(x[5], y[6]); 312| 15.0k| accum.mul(x[6], y[5]); 313| 15.0k| z[11] = accum.extract(); 314| 15.0k| accum.mul(x[6], y[6]); 315| 15.0k| z[12] = accum.extract(); 316| 15.0k| z[13] = accum.extract(); 317| 15.0k|} _ZN5Botan17bigint_comba_sqr8EPmPKm: 322| 125k|void bigint_comba_sqr8(word z[16], const word x[8]) { 323| 125k|#if defined(BOTAN_HAS_MP_MULX) 324| 125k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (324:7): [True: 125k, False: 0] ------------------ 325| 125k| return bigint_mulx_sqr8(z, x); 326| 125k| } 327| 0|#endif 328| | 329| 0| word3 accum; 330| | 331| 0| accum.mul(x[0], x[0]); 332| 0| z[0] = accum.extract(); 333| 0| accum.mul_x2(x[0], x[1]); 334| 0| z[1] = accum.extract(); 335| 0| accum.mul_x2(x[0], x[2]); 336| 0| accum.mul(x[1], x[1]); 337| 0| z[2] = accum.extract(); 338| 0| accum.mul_x2(x[0], x[3]); 339| 0| accum.mul_x2(x[1], x[2]); 340| 0| z[3] = accum.extract(); 341| 0| accum.mul_x2(x[0], x[4]); 342| 0| accum.mul_x2(x[1], x[3]); 343| 0| accum.mul(x[2], x[2]); 344| 0| z[4] = accum.extract(); 345| 0| accum.mul_x2(x[0], x[5]); 346| 0| accum.mul_x2(x[1], x[4]); 347| 0| accum.mul_x2(x[2], x[3]); 348| 0| z[5] = accum.extract(); 349| 0| accum.mul_x2(x[0], x[6]); 350| 0| accum.mul_x2(x[1], x[5]); 351| 0| accum.mul_x2(x[2], x[4]); 352| 0| accum.mul(x[3], x[3]); 353| 0| z[6] = accum.extract(); 354| 0| accum.mul_x2(x[0], x[7]); 355| 0| accum.mul_x2(x[1], x[6]); 356| 0| accum.mul_x2(x[2], x[5]); 357| 0| accum.mul_x2(x[3], x[4]); 358| 0| z[7] = accum.extract(); 359| 0| accum.mul_x2(x[1], x[7]); 360| 0| accum.mul_x2(x[2], x[6]); 361| 0| accum.mul_x2(x[3], x[5]); 362| 0| accum.mul(x[4], x[4]); 363| 0| z[8] = accum.extract(); 364| 0| accum.mul_x2(x[2], x[7]); 365| 0| accum.mul_x2(x[3], x[6]); 366| 0| accum.mul_x2(x[4], x[5]); 367| 0| z[9] = accum.extract(); 368| 0| accum.mul_x2(x[3], x[7]); 369| 0| accum.mul_x2(x[4], x[6]); 370| 0| accum.mul(x[5], x[5]); 371| 0| z[10] = accum.extract(); 372| 0| accum.mul_x2(x[4], x[7]); 373| 0| accum.mul_x2(x[5], x[6]); 374| 0| z[11] = accum.extract(); 375| 0| accum.mul_x2(x[5], x[7]); 376| 0| accum.mul(x[6], x[6]); 377| 0| z[12] = accum.extract(); 378| 0| accum.mul_x2(x[6], x[7]); 379| 0| z[13] = accum.extract(); 380| 0| accum.mul(x[7], x[7]); 381| 0| z[14] = accum.extract(); 382| 0| z[15] = accum.extract(); 383| 0|} _ZN5Botan17bigint_comba_mul8EPmPKmS2_: 388| 157k|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) { 389| 157k|#if defined(BOTAN_HAS_MP_MULX) 390| 157k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (390:7): [True: 157k, False: 0] ------------------ 391| 157k| return bigint_mulx_mul8(z, x, y); 392| 157k| } 393| 0|#endif 394| | 395| 0| word3 accum; 396| | 397| 0| accum.mul(x[0], y[0]); 398| 0| z[0] = accum.extract(); 399| 0| accum.mul(x[0], y[1]); 400| 0| accum.mul(x[1], y[0]); 401| 0| z[1] = accum.extract(); 402| 0| accum.mul(x[0], y[2]); 403| 0| accum.mul(x[1], y[1]); 404| 0| accum.mul(x[2], y[0]); 405| 0| z[2] = accum.extract(); 406| 0| accum.mul(x[0], y[3]); 407| 0| accum.mul(x[1], y[2]); 408| 0| accum.mul(x[2], y[1]); 409| 0| accum.mul(x[3], y[0]); 410| 0| z[3] = accum.extract(); 411| 0| accum.mul(x[0], y[4]); 412| 0| accum.mul(x[1], y[3]); 413| 0| accum.mul(x[2], y[2]); 414| 0| accum.mul(x[3], y[1]); 415| 0| accum.mul(x[4], y[0]); 416| 0| z[4] = accum.extract(); 417| 0| accum.mul(x[0], y[5]); 418| 0| accum.mul(x[1], y[4]); 419| 0| accum.mul(x[2], y[3]); 420| 0| accum.mul(x[3], y[2]); 421| 0| accum.mul(x[4], y[1]); 422| 0| accum.mul(x[5], y[0]); 423| 0| z[5] = accum.extract(); 424| 0| accum.mul(x[0], y[6]); 425| 0| accum.mul(x[1], y[5]); 426| 0| accum.mul(x[2], y[4]); 427| 0| accum.mul(x[3], y[3]); 428| 0| accum.mul(x[4], y[2]); 429| 0| accum.mul(x[5], y[1]); 430| 0| accum.mul(x[6], y[0]); 431| 0| z[6] = accum.extract(); 432| 0| accum.mul(x[0], y[7]); 433| 0| accum.mul(x[1], y[6]); 434| 0| accum.mul(x[2], y[5]); 435| 0| accum.mul(x[3], y[4]); 436| 0| accum.mul(x[4], y[3]); 437| 0| accum.mul(x[5], y[2]); 438| 0| accum.mul(x[6], y[1]); 439| 0| accum.mul(x[7], y[0]); 440| 0| z[7] = accum.extract(); 441| 0| accum.mul(x[1], y[7]); 442| 0| accum.mul(x[2], y[6]); 443| 0| accum.mul(x[3], y[5]); 444| 0| accum.mul(x[4], y[4]); 445| 0| accum.mul(x[5], y[3]); 446| 0| accum.mul(x[6], y[2]); 447| 0| accum.mul(x[7], y[1]); 448| 0| z[8] = accum.extract(); 449| 0| accum.mul(x[2], y[7]); 450| 0| accum.mul(x[3], y[6]); 451| 0| accum.mul(x[4], y[5]); 452| 0| accum.mul(x[5], y[4]); 453| 0| accum.mul(x[6], y[3]); 454| 0| accum.mul(x[7], y[2]); 455| 0| z[9] = accum.extract(); 456| 0| accum.mul(x[3], y[7]); 457| 0| accum.mul(x[4], y[6]); 458| 0| accum.mul(x[5], y[5]); 459| 0| accum.mul(x[6], y[4]); 460| 0| accum.mul(x[7], y[3]); 461| 0| z[10] = accum.extract(); 462| 0| accum.mul(x[4], y[7]); 463| 0| accum.mul(x[5], y[6]); 464| 0| accum.mul(x[6], y[5]); 465| 0| accum.mul(x[7], y[4]); 466| 0| z[11] = accum.extract(); 467| 0| accum.mul(x[5], y[7]); 468| 0| accum.mul(x[6], y[6]); 469| 0| accum.mul(x[7], y[5]); 470| 0| z[12] = accum.extract(); 471| 0| accum.mul(x[6], y[7]); 472| 0| accum.mul(x[7], y[6]); 473| 0| z[13] = accum.extract(); 474| 0| accum.mul(x[7], y[7]); 475| 0| z[14] = accum.extract(); 476| 0| z[15] = accum.extract(); 477| 0|} _ZN5Botan17bigint_comba_sqr9EPmPKm: 482| 444k|void bigint_comba_sqr9(word z[18], const word x[9]) { 483| 444k|#if defined(BOTAN_HAS_MP_MULX) 484| 444k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (484:7): [True: 444k, False: 0] ------------------ 485| 444k| return bigint_mulx_sqr9(z, x); 486| 444k| } 487| 0|#endif 488| | 489| 0| word3 accum; 490| | 491| 0| accum.mul(x[0], x[0]); 492| 0| z[0] = accum.extract(); 493| 0| accum.mul_x2(x[0], x[1]); 494| 0| z[1] = accum.extract(); 495| 0| accum.mul_x2(x[0], x[2]); 496| 0| accum.mul(x[1], x[1]); 497| 0| z[2] = accum.extract(); 498| 0| accum.mul_x2(x[0], x[3]); 499| 0| accum.mul_x2(x[1], x[2]); 500| 0| z[3] = accum.extract(); 501| 0| accum.mul_x2(x[0], x[4]); 502| 0| accum.mul_x2(x[1], x[3]); 503| 0| accum.mul(x[2], x[2]); 504| 0| z[4] = accum.extract(); 505| 0| accum.mul_x2(x[0], x[5]); 506| 0| accum.mul_x2(x[1], x[4]); 507| 0| accum.mul_x2(x[2], x[3]); 508| 0| z[5] = accum.extract(); 509| 0| accum.mul_x2(x[0], x[6]); 510| 0| accum.mul_x2(x[1], x[5]); 511| 0| accum.mul_x2(x[2], x[4]); 512| 0| accum.mul(x[3], x[3]); 513| 0| z[6] = accum.extract(); 514| 0| accum.mul_x2(x[0], x[7]); 515| 0| accum.mul_x2(x[1], x[6]); 516| 0| accum.mul_x2(x[2], x[5]); 517| 0| accum.mul_x2(x[3], x[4]); 518| 0| z[7] = accum.extract(); 519| 0| accum.mul_x2(x[0], x[8]); 520| 0| accum.mul_x2(x[1], x[7]); 521| 0| accum.mul_x2(x[2], x[6]); 522| 0| accum.mul_x2(x[3], x[5]); 523| 0| accum.mul(x[4], x[4]); 524| 0| z[8] = accum.extract(); 525| 0| accum.mul_x2(x[1], x[8]); 526| 0| accum.mul_x2(x[2], x[7]); 527| 0| accum.mul_x2(x[3], x[6]); 528| 0| accum.mul_x2(x[4], x[5]); 529| 0| z[9] = accum.extract(); 530| 0| accum.mul_x2(x[2], x[8]); 531| 0| accum.mul_x2(x[3], x[7]); 532| 0| accum.mul_x2(x[4], x[6]); 533| 0| accum.mul(x[5], x[5]); 534| 0| z[10] = accum.extract(); 535| 0| accum.mul_x2(x[3], x[8]); 536| 0| accum.mul_x2(x[4], x[7]); 537| 0| accum.mul_x2(x[5], x[6]); 538| 0| z[11] = accum.extract(); 539| 0| accum.mul_x2(x[4], x[8]); 540| 0| accum.mul_x2(x[5], x[7]); 541| 0| accum.mul(x[6], x[6]); 542| 0| z[12] = accum.extract(); 543| 0| accum.mul_x2(x[5], x[8]); 544| 0| accum.mul_x2(x[6], x[7]); 545| 0| z[13] = accum.extract(); 546| 0| accum.mul_x2(x[6], x[8]); 547| 0| accum.mul(x[7], x[7]); 548| 0| z[14] = accum.extract(); 549| 0| accum.mul_x2(x[7], x[8]); 550| 0| z[15] = accum.extract(); 551| 0| accum.mul(x[8], x[8]); 552| 0| z[16] = accum.extract(); 553| 0| z[17] = accum.extract(); 554| 0|} _ZN5Botan17bigint_comba_mul9EPmPKmS2_: 559| 833k|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) { 560| 833k|#if defined(BOTAN_HAS_MP_MULX) 561| 833k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (561:7): [True: 833k, False: 0] ------------------ 562| 833k| return bigint_mulx_mul9(z, x, y); 563| 833k| } 564| 0|#endif 565| | 566| 0| word3 accum; 567| | 568| 0| accum.mul(x[0], y[0]); 569| 0| z[0] = accum.extract(); 570| 0| accum.mul(x[0], y[1]); 571| 0| accum.mul(x[1], y[0]); 572| 0| z[1] = accum.extract(); 573| 0| accum.mul(x[0], y[2]); 574| 0| accum.mul(x[1], y[1]); 575| 0| accum.mul(x[2], y[0]); 576| 0| z[2] = accum.extract(); 577| 0| accum.mul(x[0], y[3]); 578| 0| accum.mul(x[1], y[2]); 579| 0| accum.mul(x[2], y[1]); 580| 0| accum.mul(x[3], y[0]); 581| 0| z[3] = accum.extract(); 582| 0| accum.mul(x[0], y[4]); 583| 0| accum.mul(x[1], y[3]); 584| 0| accum.mul(x[2], y[2]); 585| 0| accum.mul(x[3], y[1]); 586| 0| accum.mul(x[4], y[0]); 587| 0| z[4] = accum.extract(); 588| 0| accum.mul(x[0], y[5]); 589| 0| accum.mul(x[1], y[4]); 590| 0| accum.mul(x[2], y[3]); 591| 0| accum.mul(x[3], y[2]); 592| 0| accum.mul(x[4], y[1]); 593| 0| accum.mul(x[5], y[0]); 594| 0| z[5] = accum.extract(); 595| 0| accum.mul(x[0], y[6]); 596| 0| accum.mul(x[1], y[5]); 597| 0| accum.mul(x[2], y[4]); 598| 0| accum.mul(x[3], y[3]); 599| 0| accum.mul(x[4], y[2]); 600| 0| accum.mul(x[5], y[1]); 601| 0| accum.mul(x[6], y[0]); 602| 0| z[6] = accum.extract(); 603| 0| accum.mul(x[0], y[7]); 604| 0| accum.mul(x[1], y[6]); 605| 0| accum.mul(x[2], y[5]); 606| 0| accum.mul(x[3], y[4]); 607| 0| accum.mul(x[4], y[3]); 608| 0| accum.mul(x[5], y[2]); 609| 0| accum.mul(x[6], y[1]); 610| 0| accum.mul(x[7], y[0]); 611| 0| z[7] = accum.extract(); 612| 0| accum.mul(x[0], y[8]); 613| 0| accum.mul(x[1], y[7]); 614| 0| accum.mul(x[2], y[6]); 615| 0| accum.mul(x[3], y[5]); 616| 0| accum.mul(x[4], y[4]); 617| 0| accum.mul(x[5], y[3]); 618| 0| accum.mul(x[6], y[2]); 619| 0| accum.mul(x[7], y[1]); 620| 0| accum.mul(x[8], y[0]); 621| 0| z[8] = accum.extract(); 622| 0| accum.mul(x[1], y[8]); 623| 0| accum.mul(x[2], y[7]); 624| 0| accum.mul(x[3], y[6]); 625| 0| accum.mul(x[4], y[5]); 626| 0| accum.mul(x[5], y[4]); 627| 0| accum.mul(x[6], y[3]); 628| 0| accum.mul(x[7], y[2]); 629| 0| accum.mul(x[8], y[1]); 630| 0| z[9] = accum.extract(); 631| 0| accum.mul(x[2], y[8]); 632| 0| accum.mul(x[3], y[7]); 633| 0| accum.mul(x[4], y[6]); 634| 0| accum.mul(x[5], y[5]); 635| 0| accum.mul(x[6], y[4]); 636| 0| accum.mul(x[7], y[3]); 637| 0| accum.mul(x[8], y[2]); 638| 0| z[10] = accum.extract(); 639| 0| accum.mul(x[3], y[8]); 640| 0| accum.mul(x[4], y[7]); 641| 0| accum.mul(x[5], y[6]); 642| 0| accum.mul(x[6], y[5]); 643| 0| accum.mul(x[7], y[4]); 644| 0| accum.mul(x[8], y[3]); 645| 0| z[11] = accum.extract(); 646| 0| accum.mul(x[4], y[8]); 647| 0| accum.mul(x[5], y[7]); 648| 0| accum.mul(x[6], y[6]); 649| 0| accum.mul(x[7], y[5]); 650| 0| accum.mul(x[8], y[4]); 651| 0| z[12] = accum.extract(); 652| 0| accum.mul(x[5], y[8]); 653| 0| accum.mul(x[6], y[7]); 654| 0| accum.mul(x[7], y[6]); 655| 0| accum.mul(x[8], y[5]); 656| 0| z[13] = accum.extract(); 657| 0| accum.mul(x[6], y[8]); 658| 0| accum.mul(x[7], y[7]); 659| 0| accum.mul(x[8], y[6]); 660| 0| z[14] = accum.extract(); 661| 0| accum.mul(x[7], y[8]); 662| 0| accum.mul(x[8], y[7]); 663| 0| z[15] = accum.extract(); 664| 0| accum.mul(x[8], y[8]); 665| 0| z[16] = accum.extract(); 666| 0| z[17] = accum.extract(); 667| 0|} _ZN5Botan18bigint_comba_sqr16EPmPKm: 672| 5|void bigint_comba_sqr16(word z[32], const word x[16]) { 673| 5| word3 accum; 674| | 675| 5| accum.mul(x[0], x[0]); 676| 5| z[0] = accum.extract(); 677| 5| accum.mul_x2(x[0], x[1]); 678| 5| z[1] = accum.extract(); 679| 5| accum.mul_x2(x[0], x[2]); 680| 5| accum.mul(x[1], x[1]); 681| 5| z[2] = accum.extract(); 682| 5| accum.mul_x2(x[0], x[3]); 683| 5| accum.mul_x2(x[1], x[2]); 684| 5| z[3] = accum.extract(); 685| 5| accum.mul_x2(x[0], x[4]); 686| 5| accum.mul_x2(x[1], x[3]); 687| 5| accum.mul(x[2], x[2]); 688| 5| z[4] = accum.extract(); 689| 5| accum.mul_x2(x[0], x[5]); 690| 5| accum.mul_x2(x[1], x[4]); 691| 5| accum.mul_x2(x[2], x[3]); 692| 5| z[5] = accum.extract(); 693| 5| accum.mul_x2(x[0], x[6]); 694| 5| accum.mul_x2(x[1], x[5]); 695| 5| accum.mul_x2(x[2], x[4]); 696| 5| accum.mul(x[3], x[3]); 697| 5| z[6] = accum.extract(); 698| 5| accum.mul_x2(x[0], x[7]); 699| 5| accum.mul_x2(x[1], x[6]); 700| 5| accum.mul_x2(x[2], x[5]); 701| 5| accum.mul_x2(x[3], x[4]); 702| 5| z[7] = accum.extract(); 703| 5| accum.mul_x2(x[0], x[8]); 704| 5| accum.mul_x2(x[1], x[7]); 705| 5| accum.mul_x2(x[2], x[6]); 706| 5| accum.mul_x2(x[3], x[5]); 707| 5| accum.mul(x[4], x[4]); 708| 5| z[8] = accum.extract(); 709| 5| accum.mul_x2(x[0], x[9]); 710| 5| accum.mul_x2(x[1], x[8]); 711| 5| accum.mul_x2(x[2], x[7]); 712| 5| accum.mul_x2(x[3], x[6]); 713| 5| accum.mul_x2(x[4], x[5]); 714| 5| z[9] = accum.extract(); 715| 5| accum.mul_x2(x[0], x[10]); 716| 5| accum.mul_x2(x[1], x[9]); 717| 5| accum.mul_x2(x[2], x[8]); 718| 5| accum.mul_x2(x[3], x[7]); 719| 5| accum.mul_x2(x[4], x[6]); 720| 5| accum.mul(x[5], x[5]); 721| 5| z[10] = accum.extract(); 722| 5| accum.mul_x2(x[0], x[11]); 723| 5| accum.mul_x2(x[1], x[10]); 724| 5| accum.mul_x2(x[2], x[9]); 725| 5| accum.mul_x2(x[3], x[8]); 726| 5| accum.mul_x2(x[4], x[7]); 727| 5| accum.mul_x2(x[5], x[6]); 728| 5| z[11] = accum.extract(); 729| 5| accum.mul_x2(x[0], x[12]); 730| 5| accum.mul_x2(x[1], x[11]); 731| 5| accum.mul_x2(x[2], x[10]); 732| 5| accum.mul_x2(x[3], x[9]); 733| 5| accum.mul_x2(x[4], x[8]); 734| 5| accum.mul_x2(x[5], x[7]); 735| 5| accum.mul(x[6], x[6]); 736| 5| z[12] = accum.extract(); 737| 5| accum.mul_x2(x[0], x[13]); 738| 5| accum.mul_x2(x[1], x[12]); 739| 5| accum.mul_x2(x[2], x[11]); 740| 5| accum.mul_x2(x[3], x[10]); 741| 5| accum.mul_x2(x[4], x[9]); 742| 5| accum.mul_x2(x[5], x[8]); 743| 5| accum.mul_x2(x[6], x[7]); 744| 5| z[13] = accum.extract(); 745| 5| accum.mul_x2(x[0], x[14]); 746| 5| accum.mul_x2(x[1], x[13]); 747| 5| accum.mul_x2(x[2], x[12]); 748| 5| accum.mul_x2(x[3], x[11]); 749| 5| accum.mul_x2(x[4], x[10]); 750| 5| accum.mul_x2(x[5], x[9]); 751| 5| accum.mul_x2(x[6], x[8]); 752| 5| accum.mul(x[7], x[7]); 753| 5| z[14] = accum.extract(); 754| 5| accum.mul_x2(x[0], x[15]); 755| 5| accum.mul_x2(x[1], x[14]); 756| 5| accum.mul_x2(x[2], x[13]); 757| 5| accum.mul_x2(x[3], x[12]); 758| 5| accum.mul_x2(x[4], x[11]); 759| 5| accum.mul_x2(x[5], x[10]); 760| 5| accum.mul_x2(x[6], x[9]); 761| 5| accum.mul_x2(x[7], x[8]); 762| 5| z[15] = accum.extract(); 763| 5| accum.mul_x2(x[1], x[15]); 764| 5| accum.mul_x2(x[2], x[14]); 765| 5| accum.mul_x2(x[3], x[13]); 766| 5| accum.mul_x2(x[4], x[12]); 767| 5| accum.mul_x2(x[5], x[11]); 768| 5| accum.mul_x2(x[6], x[10]); 769| 5| accum.mul_x2(x[7], x[9]); 770| 5| accum.mul(x[8], x[8]); 771| 5| z[16] = accum.extract(); 772| 5| accum.mul_x2(x[2], x[15]); 773| 5| accum.mul_x2(x[3], x[14]); 774| 5| accum.mul_x2(x[4], x[13]); 775| 5| accum.mul_x2(x[5], x[12]); 776| 5| accum.mul_x2(x[6], x[11]); 777| 5| accum.mul_x2(x[7], x[10]); 778| 5| accum.mul_x2(x[8], x[9]); 779| 5| z[17] = accum.extract(); 780| 5| accum.mul_x2(x[3], x[15]); 781| 5| accum.mul_x2(x[4], x[14]); 782| 5| accum.mul_x2(x[5], x[13]); 783| 5| accum.mul_x2(x[6], x[12]); 784| 5| accum.mul_x2(x[7], x[11]); 785| 5| accum.mul_x2(x[8], x[10]); 786| 5| accum.mul(x[9], x[9]); 787| 5| z[18] = accum.extract(); 788| 5| accum.mul_x2(x[4], x[15]); 789| 5| accum.mul_x2(x[5], x[14]); 790| 5| accum.mul_x2(x[6], x[13]); 791| 5| accum.mul_x2(x[7], x[12]); 792| 5| accum.mul_x2(x[8], x[11]); 793| 5| accum.mul_x2(x[9], x[10]); 794| 5| z[19] = accum.extract(); 795| 5| accum.mul_x2(x[5], x[15]); 796| 5| accum.mul_x2(x[6], x[14]); 797| 5| accum.mul_x2(x[7], x[13]); 798| 5| accum.mul_x2(x[8], x[12]); 799| 5| accum.mul_x2(x[9], x[11]); 800| 5| accum.mul(x[10], x[10]); 801| 5| z[20] = accum.extract(); 802| 5| accum.mul_x2(x[6], x[15]); 803| 5| accum.mul_x2(x[7], x[14]); 804| 5| accum.mul_x2(x[8], x[13]); 805| 5| accum.mul_x2(x[9], x[12]); 806| 5| accum.mul_x2(x[10], x[11]); 807| 5| z[21] = accum.extract(); 808| 5| accum.mul_x2(x[7], x[15]); 809| 5| accum.mul_x2(x[8], x[14]); 810| 5| accum.mul_x2(x[9], x[13]); 811| 5| accum.mul_x2(x[10], x[12]); 812| 5| accum.mul(x[11], x[11]); 813| 5| z[22] = accum.extract(); 814| 5| accum.mul_x2(x[8], x[15]); 815| 5| accum.mul_x2(x[9], x[14]); 816| 5| accum.mul_x2(x[10], x[13]); 817| 5| accum.mul_x2(x[11], x[12]); 818| 5| z[23] = accum.extract(); 819| 5| accum.mul_x2(x[9], x[15]); 820| 5| accum.mul_x2(x[10], x[14]); 821| 5| accum.mul_x2(x[11], x[13]); 822| 5| accum.mul(x[12], x[12]); 823| 5| z[24] = accum.extract(); 824| 5| accum.mul_x2(x[10], x[15]); 825| 5| accum.mul_x2(x[11], x[14]); 826| 5| accum.mul_x2(x[12], x[13]); 827| 5| z[25] = accum.extract(); 828| 5| accum.mul_x2(x[11], x[15]); 829| 5| accum.mul_x2(x[12], x[14]); 830| 5| accum.mul(x[13], x[13]); 831| 5| z[26] = accum.extract(); 832| 5| accum.mul_x2(x[12], x[15]); 833| 5| accum.mul_x2(x[13], x[14]); 834| 5| z[27] = accum.extract(); 835| 5| accum.mul_x2(x[13], x[15]); 836| 5| accum.mul(x[14], x[14]); 837| 5| z[28] = accum.extract(); 838| 5| accum.mul_x2(x[14], x[15]); 839| 5| z[29] = accum.extract(); 840| 5| accum.mul(x[15], x[15]); 841| 5| z[30] = accum.extract(); 842| 5| z[31] = accum.extract(); 843| 5|} _ZN5Botan18bigint_comba_mul16EPmPKmS2_: 848| 65|void bigint_comba_mul16(word z[32], const word x[16], const word y[16]) { 849| 65| word3 accum; 850| | 851| 65| accum.mul(x[0], y[0]); 852| 65| z[0] = accum.extract(); 853| 65| accum.mul(x[0], y[1]); 854| 65| accum.mul(x[1], y[0]); 855| 65| z[1] = accum.extract(); 856| 65| accum.mul(x[0], y[2]); 857| 65| accum.mul(x[1], y[1]); 858| 65| accum.mul(x[2], y[0]); 859| 65| z[2] = accum.extract(); 860| 65| accum.mul(x[0], y[3]); 861| 65| accum.mul(x[1], y[2]); 862| 65| accum.mul(x[2], y[1]); 863| 65| accum.mul(x[3], y[0]); 864| 65| z[3] = accum.extract(); 865| 65| accum.mul(x[0], y[4]); 866| 65| accum.mul(x[1], y[3]); 867| 65| accum.mul(x[2], y[2]); 868| 65| accum.mul(x[3], y[1]); 869| 65| accum.mul(x[4], y[0]); 870| 65| z[4] = accum.extract(); 871| 65| accum.mul(x[0], y[5]); 872| 65| accum.mul(x[1], y[4]); 873| 65| accum.mul(x[2], y[3]); 874| 65| accum.mul(x[3], y[2]); 875| 65| accum.mul(x[4], y[1]); 876| 65| accum.mul(x[5], y[0]); 877| 65| z[5] = accum.extract(); 878| 65| accum.mul(x[0], y[6]); 879| 65| accum.mul(x[1], y[5]); 880| 65| accum.mul(x[2], y[4]); 881| 65| accum.mul(x[3], y[3]); 882| 65| accum.mul(x[4], y[2]); 883| 65| accum.mul(x[5], y[1]); 884| 65| accum.mul(x[6], y[0]); 885| 65| z[6] = accum.extract(); 886| 65| accum.mul(x[0], y[7]); 887| 65| accum.mul(x[1], y[6]); 888| 65| accum.mul(x[2], y[5]); 889| 65| accum.mul(x[3], y[4]); 890| 65| accum.mul(x[4], y[3]); 891| 65| accum.mul(x[5], y[2]); 892| 65| accum.mul(x[6], y[1]); 893| 65| accum.mul(x[7], y[0]); 894| 65| z[7] = accum.extract(); 895| 65| accum.mul(x[0], y[8]); 896| 65| accum.mul(x[1], y[7]); 897| 65| accum.mul(x[2], y[6]); 898| 65| accum.mul(x[3], y[5]); 899| 65| accum.mul(x[4], y[4]); 900| 65| accum.mul(x[5], y[3]); 901| 65| accum.mul(x[6], y[2]); 902| 65| accum.mul(x[7], y[1]); 903| 65| accum.mul(x[8], y[0]); 904| 65| z[8] = accum.extract(); 905| 65| accum.mul(x[0], y[9]); 906| 65| accum.mul(x[1], y[8]); 907| 65| accum.mul(x[2], y[7]); 908| 65| accum.mul(x[3], y[6]); 909| 65| accum.mul(x[4], y[5]); 910| 65| accum.mul(x[5], y[4]); 911| 65| accum.mul(x[6], y[3]); 912| 65| accum.mul(x[7], y[2]); 913| 65| accum.mul(x[8], y[1]); 914| 65| accum.mul(x[9], y[0]); 915| 65| z[9] = accum.extract(); 916| 65| accum.mul(x[0], y[10]); 917| 65| accum.mul(x[1], y[9]); 918| 65| accum.mul(x[2], y[8]); 919| 65| accum.mul(x[3], y[7]); 920| 65| accum.mul(x[4], y[6]); 921| 65| accum.mul(x[5], y[5]); 922| 65| accum.mul(x[6], y[4]); 923| 65| accum.mul(x[7], y[3]); 924| 65| accum.mul(x[8], y[2]); 925| 65| accum.mul(x[9], y[1]); 926| 65| accum.mul(x[10], y[0]); 927| 65| z[10] = accum.extract(); 928| 65| accum.mul(x[0], y[11]); 929| 65| accum.mul(x[1], y[10]); 930| 65| accum.mul(x[2], y[9]); 931| 65| accum.mul(x[3], y[8]); 932| 65| accum.mul(x[4], y[7]); 933| 65| accum.mul(x[5], y[6]); 934| 65| accum.mul(x[6], y[5]); 935| 65| accum.mul(x[7], y[4]); 936| 65| accum.mul(x[8], y[3]); 937| 65| accum.mul(x[9], y[2]); 938| 65| accum.mul(x[10], y[1]); 939| 65| accum.mul(x[11], y[0]); 940| 65| z[11] = accum.extract(); 941| 65| accum.mul(x[0], y[12]); 942| 65| accum.mul(x[1], y[11]); 943| 65| accum.mul(x[2], y[10]); 944| 65| accum.mul(x[3], y[9]); 945| 65| accum.mul(x[4], y[8]); 946| 65| accum.mul(x[5], y[7]); 947| 65| accum.mul(x[6], y[6]); 948| 65| accum.mul(x[7], y[5]); 949| 65| accum.mul(x[8], y[4]); 950| 65| accum.mul(x[9], y[3]); 951| 65| accum.mul(x[10], y[2]); 952| 65| accum.mul(x[11], y[1]); 953| 65| accum.mul(x[12], y[0]); 954| 65| z[12] = accum.extract(); 955| 65| accum.mul(x[0], y[13]); 956| 65| accum.mul(x[1], y[12]); 957| 65| accum.mul(x[2], y[11]); 958| 65| accum.mul(x[3], y[10]); 959| 65| accum.mul(x[4], y[9]); 960| 65| accum.mul(x[5], y[8]); 961| 65| accum.mul(x[6], y[7]); 962| 65| accum.mul(x[7], y[6]); 963| 65| accum.mul(x[8], y[5]); 964| 65| accum.mul(x[9], y[4]); 965| 65| accum.mul(x[10], y[3]); 966| 65| accum.mul(x[11], y[2]); 967| 65| accum.mul(x[12], y[1]); 968| 65| accum.mul(x[13], y[0]); 969| 65| z[13] = accum.extract(); 970| 65| accum.mul(x[0], y[14]); 971| 65| accum.mul(x[1], y[13]); 972| 65| accum.mul(x[2], y[12]); 973| 65| accum.mul(x[3], y[11]); 974| 65| accum.mul(x[4], y[10]); 975| 65| accum.mul(x[5], y[9]); 976| 65| accum.mul(x[6], y[8]); 977| 65| accum.mul(x[7], y[7]); 978| 65| accum.mul(x[8], y[6]); 979| 65| accum.mul(x[9], y[5]); 980| 65| accum.mul(x[10], y[4]); 981| 65| accum.mul(x[11], y[3]); 982| 65| accum.mul(x[12], y[2]); 983| 65| accum.mul(x[13], y[1]); 984| 65| accum.mul(x[14], y[0]); 985| 65| z[14] = accum.extract(); 986| 65| accum.mul(x[0], y[15]); 987| 65| accum.mul(x[1], y[14]); 988| 65| accum.mul(x[2], y[13]); 989| 65| accum.mul(x[3], y[12]); 990| 65| accum.mul(x[4], y[11]); 991| 65| accum.mul(x[5], y[10]); 992| 65| accum.mul(x[6], y[9]); 993| 65| accum.mul(x[7], y[8]); 994| 65| accum.mul(x[8], y[7]); 995| 65| accum.mul(x[9], y[6]); 996| 65| accum.mul(x[10], y[5]); 997| 65| accum.mul(x[11], y[4]); 998| 65| accum.mul(x[12], y[3]); 999| 65| accum.mul(x[13], y[2]); 1000| 65| accum.mul(x[14], y[1]); 1001| 65| accum.mul(x[15], y[0]); 1002| 65| z[15] = accum.extract(); 1003| 65| accum.mul(x[1], y[15]); 1004| 65| accum.mul(x[2], y[14]); 1005| 65| accum.mul(x[3], y[13]); 1006| 65| accum.mul(x[4], y[12]); 1007| 65| accum.mul(x[5], y[11]); 1008| 65| accum.mul(x[6], y[10]); 1009| 65| accum.mul(x[7], y[9]); 1010| 65| accum.mul(x[8], y[8]); 1011| 65| accum.mul(x[9], y[7]); 1012| 65| accum.mul(x[10], y[6]); 1013| 65| accum.mul(x[11], y[5]); 1014| 65| accum.mul(x[12], y[4]); 1015| 65| accum.mul(x[13], y[3]); 1016| 65| accum.mul(x[14], y[2]); 1017| 65| accum.mul(x[15], y[1]); 1018| 65| z[16] = accum.extract(); 1019| 65| accum.mul(x[2], y[15]); 1020| 65| accum.mul(x[3], y[14]); 1021| 65| accum.mul(x[4], y[13]); 1022| 65| accum.mul(x[5], y[12]); 1023| 65| accum.mul(x[6], y[11]); 1024| 65| accum.mul(x[7], y[10]); 1025| 65| accum.mul(x[8], y[9]); 1026| 65| accum.mul(x[9], y[8]); 1027| 65| accum.mul(x[10], y[7]); 1028| 65| accum.mul(x[11], y[6]); 1029| 65| accum.mul(x[12], y[5]); 1030| 65| accum.mul(x[13], y[4]); 1031| 65| accum.mul(x[14], y[3]); 1032| 65| accum.mul(x[15], y[2]); 1033| 65| z[17] = accum.extract(); 1034| 65| accum.mul(x[3], y[15]); 1035| 65| accum.mul(x[4], y[14]); 1036| 65| accum.mul(x[5], y[13]); 1037| 65| accum.mul(x[6], y[12]); 1038| 65| accum.mul(x[7], y[11]); 1039| 65| accum.mul(x[8], y[10]); 1040| 65| accum.mul(x[9], y[9]); 1041| 65| accum.mul(x[10], y[8]); 1042| 65| accum.mul(x[11], y[7]); 1043| 65| accum.mul(x[12], y[6]); 1044| 65| accum.mul(x[13], y[5]); 1045| 65| accum.mul(x[14], y[4]); 1046| 65| accum.mul(x[15], y[3]); 1047| 65| z[18] = accum.extract(); 1048| 65| accum.mul(x[4], y[15]); 1049| 65| accum.mul(x[5], y[14]); 1050| 65| accum.mul(x[6], y[13]); 1051| 65| accum.mul(x[7], y[12]); 1052| 65| accum.mul(x[8], y[11]); 1053| 65| accum.mul(x[9], y[10]); 1054| 65| accum.mul(x[10], y[9]); 1055| 65| accum.mul(x[11], y[8]); 1056| 65| accum.mul(x[12], y[7]); 1057| 65| accum.mul(x[13], y[6]); 1058| 65| accum.mul(x[14], y[5]); 1059| 65| accum.mul(x[15], y[4]); 1060| 65| z[19] = accum.extract(); 1061| 65| accum.mul(x[5], y[15]); 1062| 65| accum.mul(x[6], y[14]); 1063| 65| accum.mul(x[7], y[13]); 1064| 65| accum.mul(x[8], y[12]); 1065| 65| accum.mul(x[9], y[11]); 1066| 65| accum.mul(x[10], y[10]); 1067| 65| accum.mul(x[11], y[9]); 1068| 65| accum.mul(x[12], y[8]); 1069| 65| accum.mul(x[13], y[7]); 1070| 65| accum.mul(x[14], y[6]); 1071| 65| accum.mul(x[15], y[5]); 1072| 65| z[20] = accum.extract(); 1073| 65| accum.mul(x[6], y[15]); 1074| 65| accum.mul(x[7], y[14]); 1075| 65| accum.mul(x[8], y[13]); 1076| 65| accum.mul(x[9], y[12]); 1077| 65| accum.mul(x[10], y[11]); 1078| 65| accum.mul(x[11], y[10]); 1079| 65| accum.mul(x[12], y[9]); 1080| 65| accum.mul(x[13], y[8]); 1081| 65| accum.mul(x[14], y[7]); 1082| 65| accum.mul(x[15], y[6]); 1083| 65| z[21] = accum.extract(); 1084| 65| accum.mul(x[7], y[15]); 1085| 65| accum.mul(x[8], y[14]); 1086| 65| accum.mul(x[9], y[13]); 1087| 65| accum.mul(x[10], y[12]); 1088| 65| accum.mul(x[11], y[11]); 1089| 65| accum.mul(x[12], y[10]); 1090| 65| accum.mul(x[13], y[9]); 1091| 65| accum.mul(x[14], y[8]); 1092| 65| accum.mul(x[15], y[7]); 1093| 65| z[22] = accum.extract(); 1094| 65| accum.mul(x[8], y[15]); 1095| 65| accum.mul(x[9], y[14]); 1096| 65| accum.mul(x[10], y[13]); 1097| 65| accum.mul(x[11], y[12]); 1098| 65| accum.mul(x[12], y[11]); 1099| 65| accum.mul(x[13], y[10]); 1100| 65| accum.mul(x[14], y[9]); 1101| 65| accum.mul(x[15], y[8]); 1102| 65| z[23] = accum.extract(); 1103| 65| accum.mul(x[9], y[15]); 1104| 65| accum.mul(x[10], y[14]); 1105| 65| accum.mul(x[11], y[13]); 1106| 65| accum.mul(x[12], y[12]); 1107| 65| accum.mul(x[13], y[11]); 1108| 65| accum.mul(x[14], y[10]); 1109| 65| accum.mul(x[15], y[9]); 1110| 65| z[24] = accum.extract(); 1111| 65| accum.mul(x[10], y[15]); 1112| 65| accum.mul(x[11], y[14]); 1113| 65| accum.mul(x[12], y[13]); 1114| 65| accum.mul(x[13], y[12]); 1115| 65| accum.mul(x[14], y[11]); 1116| 65| accum.mul(x[15], y[10]); 1117| 65| z[25] = accum.extract(); 1118| 65| accum.mul(x[11], y[15]); 1119| 65| accum.mul(x[12], y[14]); 1120| 65| accum.mul(x[13], y[13]); 1121| 65| accum.mul(x[14], y[12]); 1122| 65| accum.mul(x[15], y[11]); 1123| 65| z[26] = accum.extract(); 1124| 65| accum.mul(x[12], y[15]); 1125| 65| accum.mul(x[13], y[14]); 1126| 65| accum.mul(x[14], y[13]); 1127| 65| accum.mul(x[15], y[12]); 1128| 65| z[27] = accum.extract(); 1129| 65| accum.mul(x[13], y[15]); 1130| 65| accum.mul(x[14], y[14]); 1131| 65| accum.mul(x[15], y[13]); 1132| 65| z[28] = accum.extract(); 1133| 65| accum.mul(x[14], y[15]); 1134| 65| accum.mul(x[15], y[14]); 1135| 65| z[29] = accum.extract(); 1136| 65| accum.mul(x[15], y[15]); 1137| 65| z[30] = accum.extract(); 1138| 65| z[31] = accum.extract(); 1139| 65|} _ZN5Botan18bigint_comba_mul24EPmPKmS2_: 1500| 12|void bigint_comba_mul24(word z[48], const word x[24], const word y[24]) { 1501| 12| word3 accum; 1502| | 1503| 12| accum.mul(x[0], y[0]); 1504| 12| z[0] = accum.extract(); 1505| 12| accum.mul(x[0], y[1]); 1506| 12| accum.mul(x[1], y[0]); 1507| 12| z[1] = accum.extract(); 1508| 12| accum.mul(x[0], y[2]); 1509| 12| accum.mul(x[1], y[1]); 1510| 12| accum.mul(x[2], y[0]); 1511| 12| z[2] = accum.extract(); 1512| 12| accum.mul(x[0], y[3]); 1513| 12| accum.mul(x[1], y[2]); 1514| 12| accum.mul(x[2], y[1]); 1515| 12| accum.mul(x[3], y[0]); 1516| 12| z[3] = accum.extract(); 1517| 12| accum.mul(x[0], y[4]); 1518| 12| accum.mul(x[1], y[3]); 1519| 12| accum.mul(x[2], y[2]); 1520| 12| accum.mul(x[3], y[1]); 1521| 12| accum.mul(x[4], y[0]); 1522| 12| z[4] = accum.extract(); 1523| 12| accum.mul(x[0], y[5]); 1524| 12| accum.mul(x[1], y[4]); 1525| 12| accum.mul(x[2], y[3]); 1526| 12| accum.mul(x[3], y[2]); 1527| 12| accum.mul(x[4], y[1]); 1528| 12| accum.mul(x[5], y[0]); 1529| 12| z[5] = accum.extract(); 1530| 12| accum.mul(x[0], y[6]); 1531| 12| accum.mul(x[1], y[5]); 1532| 12| accum.mul(x[2], y[4]); 1533| 12| accum.mul(x[3], y[3]); 1534| 12| accum.mul(x[4], y[2]); 1535| 12| accum.mul(x[5], y[1]); 1536| 12| accum.mul(x[6], y[0]); 1537| 12| z[6] = accum.extract(); 1538| 12| accum.mul(x[0], y[7]); 1539| 12| accum.mul(x[1], y[6]); 1540| 12| accum.mul(x[2], y[5]); 1541| 12| accum.mul(x[3], y[4]); 1542| 12| accum.mul(x[4], y[3]); 1543| 12| accum.mul(x[5], y[2]); 1544| 12| accum.mul(x[6], y[1]); 1545| 12| accum.mul(x[7], y[0]); 1546| 12| z[7] = accum.extract(); 1547| 12| accum.mul(x[0], y[8]); 1548| 12| accum.mul(x[1], y[7]); 1549| 12| accum.mul(x[2], y[6]); 1550| 12| accum.mul(x[3], y[5]); 1551| 12| accum.mul(x[4], y[4]); 1552| 12| accum.mul(x[5], y[3]); 1553| 12| accum.mul(x[6], y[2]); 1554| 12| accum.mul(x[7], y[1]); 1555| 12| accum.mul(x[8], y[0]); 1556| 12| z[8] = accum.extract(); 1557| 12| accum.mul(x[0], y[9]); 1558| 12| accum.mul(x[1], y[8]); 1559| 12| accum.mul(x[2], y[7]); 1560| 12| accum.mul(x[3], y[6]); 1561| 12| accum.mul(x[4], y[5]); 1562| 12| accum.mul(x[5], y[4]); 1563| 12| accum.mul(x[6], y[3]); 1564| 12| accum.mul(x[7], y[2]); 1565| 12| accum.mul(x[8], y[1]); 1566| 12| accum.mul(x[9], y[0]); 1567| 12| z[9] = accum.extract(); 1568| 12| accum.mul(x[0], y[10]); 1569| 12| accum.mul(x[1], y[9]); 1570| 12| accum.mul(x[2], y[8]); 1571| 12| accum.mul(x[3], y[7]); 1572| 12| accum.mul(x[4], y[6]); 1573| 12| accum.mul(x[5], y[5]); 1574| 12| accum.mul(x[6], y[4]); 1575| 12| accum.mul(x[7], y[3]); 1576| 12| accum.mul(x[8], y[2]); 1577| 12| accum.mul(x[9], y[1]); 1578| 12| accum.mul(x[10], y[0]); 1579| 12| z[10] = accum.extract(); 1580| 12| accum.mul(x[0], y[11]); 1581| 12| accum.mul(x[1], y[10]); 1582| 12| accum.mul(x[2], y[9]); 1583| 12| accum.mul(x[3], y[8]); 1584| 12| accum.mul(x[4], y[7]); 1585| 12| accum.mul(x[5], y[6]); 1586| 12| accum.mul(x[6], y[5]); 1587| 12| accum.mul(x[7], y[4]); 1588| 12| accum.mul(x[8], y[3]); 1589| 12| accum.mul(x[9], y[2]); 1590| 12| accum.mul(x[10], y[1]); 1591| 12| accum.mul(x[11], y[0]); 1592| 12| z[11] = accum.extract(); 1593| 12| accum.mul(x[0], y[12]); 1594| 12| accum.mul(x[1], y[11]); 1595| 12| accum.mul(x[2], y[10]); 1596| 12| accum.mul(x[3], y[9]); 1597| 12| accum.mul(x[4], y[8]); 1598| 12| accum.mul(x[5], y[7]); 1599| 12| accum.mul(x[6], y[6]); 1600| 12| accum.mul(x[7], y[5]); 1601| 12| accum.mul(x[8], y[4]); 1602| 12| accum.mul(x[9], y[3]); 1603| 12| accum.mul(x[10], y[2]); 1604| 12| accum.mul(x[11], y[1]); 1605| 12| accum.mul(x[12], y[0]); 1606| 12| z[12] = accum.extract(); 1607| 12| accum.mul(x[0], y[13]); 1608| 12| accum.mul(x[1], y[12]); 1609| 12| accum.mul(x[2], y[11]); 1610| 12| accum.mul(x[3], y[10]); 1611| 12| accum.mul(x[4], y[9]); 1612| 12| accum.mul(x[5], y[8]); 1613| 12| accum.mul(x[6], y[7]); 1614| 12| accum.mul(x[7], y[6]); 1615| 12| accum.mul(x[8], y[5]); 1616| 12| accum.mul(x[9], y[4]); 1617| 12| accum.mul(x[10], y[3]); 1618| 12| accum.mul(x[11], y[2]); 1619| 12| accum.mul(x[12], y[1]); 1620| 12| accum.mul(x[13], y[0]); 1621| 12| z[13] = accum.extract(); 1622| 12| accum.mul(x[0], y[14]); 1623| 12| accum.mul(x[1], y[13]); 1624| 12| accum.mul(x[2], y[12]); 1625| 12| accum.mul(x[3], y[11]); 1626| 12| accum.mul(x[4], y[10]); 1627| 12| accum.mul(x[5], y[9]); 1628| 12| accum.mul(x[6], y[8]); 1629| 12| accum.mul(x[7], y[7]); 1630| 12| accum.mul(x[8], y[6]); 1631| 12| accum.mul(x[9], y[5]); 1632| 12| accum.mul(x[10], y[4]); 1633| 12| accum.mul(x[11], y[3]); 1634| 12| accum.mul(x[12], y[2]); 1635| 12| accum.mul(x[13], y[1]); 1636| 12| accum.mul(x[14], y[0]); 1637| 12| z[14] = accum.extract(); 1638| 12| accum.mul(x[0], y[15]); 1639| 12| accum.mul(x[1], y[14]); 1640| 12| accum.mul(x[2], y[13]); 1641| 12| accum.mul(x[3], y[12]); 1642| 12| accum.mul(x[4], y[11]); 1643| 12| accum.mul(x[5], y[10]); 1644| 12| accum.mul(x[6], y[9]); 1645| 12| accum.mul(x[7], y[8]); 1646| 12| accum.mul(x[8], y[7]); 1647| 12| accum.mul(x[9], y[6]); 1648| 12| accum.mul(x[10], y[5]); 1649| 12| accum.mul(x[11], y[4]); 1650| 12| accum.mul(x[12], y[3]); 1651| 12| accum.mul(x[13], y[2]); 1652| 12| accum.mul(x[14], y[1]); 1653| 12| accum.mul(x[15], y[0]); 1654| 12| z[15] = accum.extract(); 1655| 12| accum.mul(x[0], y[16]); 1656| 12| accum.mul(x[1], y[15]); 1657| 12| accum.mul(x[2], y[14]); 1658| 12| accum.mul(x[3], y[13]); 1659| 12| accum.mul(x[4], y[12]); 1660| 12| accum.mul(x[5], y[11]); 1661| 12| accum.mul(x[6], y[10]); 1662| 12| accum.mul(x[7], y[9]); 1663| 12| accum.mul(x[8], y[8]); 1664| 12| accum.mul(x[9], y[7]); 1665| 12| accum.mul(x[10], y[6]); 1666| 12| accum.mul(x[11], y[5]); 1667| 12| accum.mul(x[12], y[4]); 1668| 12| accum.mul(x[13], y[3]); 1669| 12| accum.mul(x[14], y[2]); 1670| 12| accum.mul(x[15], y[1]); 1671| 12| accum.mul(x[16], y[0]); 1672| 12| z[16] = accum.extract(); 1673| 12| accum.mul(x[0], y[17]); 1674| 12| accum.mul(x[1], y[16]); 1675| 12| accum.mul(x[2], y[15]); 1676| 12| accum.mul(x[3], y[14]); 1677| 12| accum.mul(x[4], y[13]); 1678| 12| accum.mul(x[5], y[12]); 1679| 12| accum.mul(x[6], y[11]); 1680| 12| accum.mul(x[7], y[10]); 1681| 12| accum.mul(x[8], y[9]); 1682| 12| accum.mul(x[9], y[8]); 1683| 12| accum.mul(x[10], y[7]); 1684| 12| accum.mul(x[11], y[6]); 1685| 12| accum.mul(x[12], y[5]); 1686| 12| accum.mul(x[13], y[4]); 1687| 12| accum.mul(x[14], y[3]); 1688| 12| accum.mul(x[15], y[2]); 1689| 12| accum.mul(x[16], y[1]); 1690| 12| accum.mul(x[17], y[0]); 1691| 12| z[17] = accum.extract(); 1692| 12| accum.mul(x[0], y[18]); 1693| 12| accum.mul(x[1], y[17]); 1694| 12| accum.mul(x[2], y[16]); 1695| 12| accum.mul(x[3], y[15]); 1696| 12| accum.mul(x[4], y[14]); 1697| 12| accum.mul(x[5], y[13]); 1698| 12| accum.mul(x[6], y[12]); 1699| 12| accum.mul(x[7], y[11]); 1700| 12| accum.mul(x[8], y[10]); 1701| 12| accum.mul(x[9], y[9]); 1702| 12| accum.mul(x[10], y[8]); 1703| 12| accum.mul(x[11], y[7]); 1704| 12| accum.mul(x[12], y[6]); 1705| 12| accum.mul(x[13], y[5]); 1706| 12| accum.mul(x[14], y[4]); 1707| 12| accum.mul(x[15], y[3]); 1708| 12| accum.mul(x[16], y[2]); 1709| 12| accum.mul(x[17], y[1]); 1710| 12| accum.mul(x[18], y[0]); 1711| 12| z[18] = accum.extract(); 1712| 12| accum.mul(x[0], y[19]); 1713| 12| accum.mul(x[1], y[18]); 1714| 12| accum.mul(x[2], y[17]); 1715| 12| accum.mul(x[3], y[16]); 1716| 12| accum.mul(x[4], y[15]); 1717| 12| accum.mul(x[5], y[14]); 1718| 12| accum.mul(x[6], y[13]); 1719| 12| accum.mul(x[7], y[12]); 1720| 12| accum.mul(x[8], y[11]); 1721| 12| accum.mul(x[9], y[10]); 1722| 12| accum.mul(x[10], y[9]); 1723| 12| accum.mul(x[11], y[8]); 1724| 12| accum.mul(x[12], y[7]); 1725| 12| accum.mul(x[13], y[6]); 1726| 12| accum.mul(x[14], y[5]); 1727| 12| accum.mul(x[15], y[4]); 1728| 12| accum.mul(x[16], y[3]); 1729| 12| accum.mul(x[17], y[2]); 1730| 12| accum.mul(x[18], y[1]); 1731| 12| accum.mul(x[19], y[0]); 1732| 12| z[19] = accum.extract(); 1733| 12| accum.mul(x[0], y[20]); 1734| 12| accum.mul(x[1], y[19]); 1735| 12| accum.mul(x[2], y[18]); 1736| 12| accum.mul(x[3], y[17]); 1737| 12| accum.mul(x[4], y[16]); 1738| 12| accum.mul(x[5], y[15]); 1739| 12| accum.mul(x[6], y[14]); 1740| 12| accum.mul(x[7], y[13]); 1741| 12| accum.mul(x[8], y[12]); 1742| 12| accum.mul(x[9], y[11]); 1743| 12| accum.mul(x[10], y[10]); 1744| 12| accum.mul(x[11], y[9]); 1745| 12| accum.mul(x[12], y[8]); 1746| 12| accum.mul(x[13], y[7]); 1747| 12| accum.mul(x[14], y[6]); 1748| 12| accum.mul(x[15], y[5]); 1749| 12| accum.mul(x[16], y[4]); 1750| 12| accum.mul(x[17], y[3]); 1751| 12| accum.mul(x[18], y[2]); 1752| 12| accum.mul(x[19], y[1]); 1753| 12| accum.mul(x[20], y[0]); 1754| 12| z[20] = accum.extract(); 1755| 12| accum.mul(x[0], y[21]); 1756| 12| accum.mul(x[1], y[20]); 1757| 12| accum.mul(x[2], y[19]); 1758| 12| accum.mul(x[3], y[18]); 1759| 12| accum.mul(x[4], y[17]); 1760| 12| accum.mul(x[5], y[16]); 1761| 12| accum.mul(x[6], y[15]); 1762| 12| accum.mul(x[7], y[14]); 1763| 12| accum.mul(x[8], y[13]); 1764| 12| accum.mul(x[9], y[12]); 1765| 12| accum.mul(x[10], y[11]); 1766| 12| accum.mul(x[11], y[10]); 1767| 12| accum.mul(x[12], y[9]); 1768| 12| accum.mul(x[13], y[8]); 1769| 12| accum.mul(x[14], y[7]); 1770| 12| accum.mul(x[15], y[6]); 1771| 12| accum.mul(x[16], y[5]); 1772| 12| accum.mul(x[17], y[4]); 1773| 12| accum.mul(x[18], y[3]); 1774| 12| accum.mul(x[19], y[2]); 1775| 12| accum.mul(x[20], y[1]); 1776| 12| accum.mul(x[21], y[0]); 1777| 12| z[21] = accum.extract(); 1778| 12| accum.mul(x[0], y[22]); 1779| 12| accum.mul(x[1], y[21]); 1780| 12| accum.mul(x[2], y[20]); 1781| 12| accum.mul(x[3], y[19]); 1782| 12| accum.mul(x[4], y[18]); 1783| 12| accum.mul(x[5], y[17]); 1784| 12| accum.mul(x[6], y[16]); 1785| 12| accum.mul(x[7], y[15]); 1786| 12| accum.mul(x[8], y[14]); 1787| 12| accum.mul(x[9], y[13]); 1788| 12| accum.mul(x[10], y[12]); 1789| 12| accum.mul(x[11], y[11]); 1790| 12| accum.mul(x[12], y[10]); 1791| 12| accum.mul(x[13], y[9]); 1792| 12| accum.mul(x[14], y[8]); 1793| 12| accum.mul(x[15], y[7]); 1794| 12| accum.mul(x[16], y[6]); 1795| 12| accum.mul(x[17], y[5]); 1796| 12| accum.mul(x[18], y[4]); 1797| 12| accum.mul(x[19], y[3]); 1798| 12| accum.mul(x[20], y[2]); 1799| 12| accum.mul(x[21], y[1]); 1800| 12| accum.mul(x[22], y[0]); 1801| 12| z[22] = accum.extract(); 1802| 12| accum.mul(x[0], y[23]); 1803| 12| accum.mul(x[1], y[22]); 1804| 12| accum.mul(x[2], y[21]); 1805| 12| accum.mul(x[3], y[20]); 1806| 12| accum.mul(x[4], y[19]); 1807| 12| accum.mul(x[5], y[18]); 1808| 12| accum.mul(x[6], y[17]); 1809| 12| accum.mul(x[7], y[16]); 1810| 12| accum.mul(x[8], y[15]); 1811| 12| accum.mul(x[9], y[14]); 1812| 12| accum.mul(x[10], y[13]); 1813| 12| accum.mul(x[11], y[12]); 1814| 12| accum.mul(x[12], y[11]); 1815| 12| accum.mul(x[13], y[10]); 1816| 12| accum.mul(x[14], y[9]); 1817| 12| accum.mul(x[15], y[8]); 1818| 12| accum.mul(x[16], y[7]); 1819| 12| accum.mul(x[17], y[6]); 1820| 12| accum.mul(x[18], y[5]); 1821| 12| accum.mul(x[19], y[4]); 1822| 12| accum.mul(x[20], y[3]); 1823| 12| accum.mul(x[21], y[2]); 1824| 12| accum.mul(x[22], y[1]); 1825| 12| accum.mul(x[23], y[0]); 1826| 12| z[23] = accum.extract(); 1827| 12| accum.mul(x[1], y[23]); 1828| 12| accum.mul(x[2], y[22]); 1829| 12| accum.mul(x[3], y[21]); 1830| 12| accum.mul(x[4], y[20]); 1831| 12| accum.mul(x[5], y[19]); 1832| 12| accum.mul(x[6], y[18]); 1833| 12| accum.mul(x[7], y[17]); 1834| 12| accum.mul(x[8], y[16]); 1835| 12| accum.mul(x[9], y[15]); 1836| 12| accum.mul(x[10], y[14]); 1837| 12| accum.mul(x[11], y[13]); 1838| 12| accum.mul(x[12], y[12]); 1839| 12| accum.mul(x[13], y[11]); 1840| 12| accum.mul(x[14], y[10]); 1841| 12| accum.mul(x[15], y[9]); 1842| 12| accum.mul(x[16], y[8]); 1843| 12| accum.mul(x[17], y[7]); 1844| 12| accum.mul(x[18], y[6]); 1845| 12| accum.mul(x[19], y[5]); 1846| 12| accum.mul(x[20], y[4]); 1847| 12| accum.mul(x[21], y[3]); 1848| 12| accum.mul(x[22], y[2]); 1849| 12| accum.mul(x[23], y[1]); 1850| 12| z[24] = accum.extract(); 1851| 12| accum.mul(x[2], y[23]); 1852| 12| accum.mul(x[3], y[22]); 1853| 12| accum.mul(x[4], y[21]); 1854| 12| accum.mul(x[5], y[20]); 1855| 12| accum.mul(x[6], y[19]); 1856| 12| accum.mul(x[7], y[18]); 1857| 12| accum.mul(x[8], y[17]); 1858| 12| accum.mul(x[9], y[16]); 1859| 12| accum.mul(x[10], y[15]); 1860| 12| accum.mul(x[11], y[14]); 1861| 12| accum.mul(x[12], y[13]); 1862| 12| accum.mul(x[13], y[12]); 1863| 12| accum.mul(x[14], y[11]); 1864| 12| accum.mul(x[15], y[10]); 1865| 12| accum.mul(x[16], y[9]); 1866| 12| accum.mul(x[17], y[8]); 1867| 12| accum.mul(x[18], y[7]); 1868| 12| accum.mul(x[19], y[6]); 1869| 12| accum.mul(x[20], y[5]); 1870| 12| accum.mul(x[21], y[4]); 1871| 12| accum.mul(x[22], y[3]); 1872| 12| accum.mul(x[23], y[2]); 1873| 12| z[25] = accum.extract(); 1874| 12| accum.mul(x[3], y[23]); 1875| 12| accum.mul(x[4], y[22]); 1876| 12| accum.mul(x[5], y[21]); 1877| 12| accum.mul(x[6], y[20]); 1878| 12| accum.mul(x[7], y[19]); 1879| 12| accum.mul(x[8], y[18]); 1880| 12| accum.mul(x[9], y[17]); 1881| 12| accum.mul(x[10], y[16]); 1882| 12| accum.mul(x[11], y[15]); 1883| 12| accum.mul(x[12], y[14]); 1884| 12| accum.mul(x[13], y[13]); 1885| 12| accum.mul(x[14], y[12]); 1886| 12| accum.mul(x[15], y[11]); 1887| 12| accum.mul(x[16], y[10]); 1888| 12| accum.mul(x[17], y[9]); 1889| 12| accum.mul(x[18], y[8]); 1890| 12| accum.mul(x[19], y[7]); 1891| 12| accum.mul(x[20], y[6]); 1892| 12| accum.mul(x[21], y[5]); 1893| 12| accum.mul(x[22], y[4]); 1894| 12| accum.mul(x[23], y[3]); 1895| 12| z[26] = accum.extract(); 1896| 12| accum.mul(x[4], y[23]); 1897| 12| accum.mul(x[5], y[22]); 1898| 12| accum.mul(x[6], y[21]); 1899| 12| accum.mul(x[7], y[20]); 1900| 12| accum.mul(x[8], y[19]); 1901| 12| accum.mul(x[9], y[18]); 1902| 12| accum.mul(x[10], y[17]); 1903| 12| accum.mul(x[11], y[16]); 1904| 12| accum.mul(x[12], y[15]); 1905| 12| accum.mul(x[13], y[14]); 1906| 12| accum.mul(x[14], y[13]); 1907| 12| accum.mul(x[15], y[12]); 1908| 12| accum.mul(x[16], y[11]); 1909| 12| accum.mul(x[17], y[10]); 1910| 12| accum.mul(x[18], y[9]); 1911| 12| accum.mul(x[19], y[8]); 1912| 12| accum.mul(x[20], y[7]); 1913| 12| accum.mul(x[21], y[6]); 1914| 12| accum.mul(x[22], y[5]); 1915| 12| accum.mul(x[23], y[4]); 1916| 12| z[27] = accum.extract(); 1917| 12| accum.mul(x[5], y[23]); 1918| 12| accum.mul(x[6], y[22]); 1919| 12| accum.mul(x[7], y[21]); 1920| 12| accum.mul(x[8], y[20]); 1921| 12| accum.mul(x[9], y[19]); 1922| 12| accum.mul(x[10], y[18]); 1923| 12| accum.mul(x[11], y[17]); 1924| 12| accum.mul(x[12], y[16]); 1925| 12| accum.mul(x[13], y[15]); 1926| 12| accum.mul(x[14], y[14]); 1927| 12| accum.mul(x[15], y[13]); 1928| 12| accum.mul(x[16], y[12]); 1929| 12| accum.mul(x[17], y[11]); 1930| 12| accum.mul(x[18], y[10]); 1931| 12| accum.mul(x[19], y[9]); 1932| 12| accum.mul(x[20], y[8]); 1933| 12| accum.mul(x[21], y[7]); 1934| 12| accum.mul(x[22], y[6]); 1935| 12| accum.mul(x[23], y[5]); 1936| 12| z[28] = accum.extract(); 1937| 12| accum.mul(x[6], y[23]); 1938| 12| accum.mul(x[7], y[22]); 1939| 12| accum.mul(x[8], y[21]); 1940| 12| accum.mul(x[9], y[20]); 1941| 12| accum.mul(x[10], y[19]); 1942| 12| accum.mul(x[11], y[18]); 1943| 12| accum.mul(x[12], y[17]); 1944| 12| accum.mul(x[13], y[16]); 1945| 12| accum.mul(x[14], y[15]); 1946| 12| accum.mul(x[15], y[14]); 1947| 12| accum.mul(x[16], y[13]); 1948| 12| accum.mul(x[17], y[12]); 1949| 12| accum.mul(x[18], y[11]); 1950| 12| accum.mul(x[19], y[10]); 1951| 12| accum.mul(x[20], y[9]); 1952| 12| accum.mul(x[21], y[8]); 1953| 12| accum.mul(x[22], y[7]); 1954| 12| accum.mul(x[23], y[6]); 1955| 12| z[29] = accum.extract(); 1956| 12| accum.mul(x[7], y[23]); 1957| 12| accum.mul(x[8], y[22]); 1958| 12| accum.mul(x[9], y[21]); 1959| 12| accum.mul(x[10], y[20]); 1960| 12| accum.mul(x[11], y[19]); 1961| 12| accum.mul(x[12], y[18]); 1962| 12| accum.mul(x[13], y[17]); 1963| 12| accum.mul(x[14], y[16]); 1964| 12| accum.mul(x[15], y[15]); 1965| 12| accum.mul(x[16], y[14]); 1966| 12| accum.mul(x[17], y[13]); 1967| 12| accum.mul(x[18], y[12]); 1968| 12| accum.mul(x[19], y[11]); 1969| 12| accum.mul(x[20], y[10]); 1970| 12| accum.mul(x[21], y[9]); 1971| 12| accum.mul(x[22], y[8]); 1972| 12| accum.mul(x[23], y[7]); 1973| 12| z[30] = accum.extract(); 1974| 12| accum.mul(x[8], y[23]); 1975| 12| accum.mul(x[9], y[22]); 1976| 12| accum.mul(x[10], y[21]); 1977| 12| accum.mul(x[11], y[20]); 1978| 12| accum.mul(x[12], y[19]); 1979| 12| accum.mul(x[13], y[18]); 1980| 12| accum.mul(x[14], y[17]); 1981| 12| accum.mul(x[15], y[16]); 1982| 12| accum.mul(x[16], y[15]); 1983| 12| accum.mul(x[17], y[14]); 1984| 12| accum.mul(x[18], y[13]); 1985| 12| accum.mul(x[19], y[12]); 1986| 12| accum.mul(x[20], y[11]); 1987| 12| accum.mul(x[21], y[10]); 1988| 12| accum.mul(x[22], y[9]); 1989| 12| accum.mul(x[23], y[8]); 1990| 12| z[31] = accum.extract(); 1991| 12| accum.mul(x[9], y[23]); 1992| 12| accum.mul(x[10], y[22]); 1993| 12| accum.mul(x[11], y[21]); 1994| 12| accum.mul(x[12], y[20]); 1995| 12| accum.mul(x[13], y[19]); 1996| 12| accum.mul(x[14], y[18]); 1997| 12| accum.mul(x[15], y[17]); 1998| 12| accum.mul(x[16], y[16]); 1999| 12| accum.mul(x[17], y[15]); 2000| 12| accum.mul(x[18], y[14]); 2001| 12| accum.mul(x[19], y[13]); 2002| 12| accum.mul(x[20], y[12]); 2003| 12| accum.mul(x[21], y[11]); 2004| 12| accum.mul(x[22], y[10]); 2005| 12| accum.mul(x[23], y[9]); 2006| 12| z[32] = accum.extract(); 2007| 12| accum.mul(x[10], y[23]); 2008| 12| accum.mul(x[11], y[22]); 2009| 12| accum.mul(x[12], y[21]); 2010| 12| accum.mul(x[13], y[20]); 2011| 12| accum.mul(x[14], y[19]); 2012| 12| accum.mul(x[15], y[18]); 2013| 12| accum.mul(x[16], y[17]); 2014| 12| accum.mul(x[17], y[16]); 2015| 12| accum.mul(x[18], y[15]); 2016| 12| accum.mul(x[19], y[14]); 2017| 12| accum.mul(x[20], y[13]); 2018| 12| accum.mul(x[21], y[12]); 2019| 12| accum.mul(x[22], y[11]); 2020| 12| accum.mul(x[23], y[10]); 2021| 12| z[33] = accum.extract(); 2022| 12| accum.mul(x[11], y[23]); 2023| 12| accum.mul(x[12], y[22]); 2024| 12| accum.mul(x[13], y[21]); 2025| 12| accum.mul(x[14], y[20]); 2026| 12| accum.mul(x[15], y[19]); 2027| 12| accum.mul(x[16], y[18]); 2028| 12| accum.mul(x[17], y[17]); 2029| 12| accum.mul(x[18], y[16]); 2030| 12| accum.mul(x[19], y[15]); 2031| 12| accum.mul(x[20], y[14]); 2032| 12| accum.mul(x[21], y[13]); 2033| 12| accum.mul(x[22], y[12]); 2034| 12| accum.mul(x[23], y[11]); 2035| 12| z[34] = accum.extract(); 2036| 12| accum.mul(x[12], y[23]); 2037| 12| accum.mul(x[13], y[22]); 2038| 12| accum.mul(x[14], y[21]); 2039| 12| accum.mul(x[15], y[20]); 2040| 12| accum.mul(x[16], y[19]); 2041| 12| accum.mul(x[17], y[18]); 2042| 12| accum.mul(x[18], y[17]); 2043| 12| accum.mul(x[19], y[16]); 2044| 12| accum.mul(x[20], y[15]); 2045| 12| accum.mul(x[21], y[14]); 2046| 12| accum.mul(x[22], y[13]); 2047| 12| accum.mul(x[23], y[12]); 2048| 12| z[35] = accum.extract(); 2049| 12| accum.mul(x[13], y[23]); 2050| 12| accum.mul(x[14], y[22]); 2051| 12| accum.mul(x[15], y[21]); 2052| 12| accum.mul(x[16], y[20]); 2053| 12| accum.mul(x[17], y[19]); 2054| 12| accum.mul(x[18], y[18]); 2055| 12| accum.mul(x[19], y[17]); 2056| 12| accum.mul(x[20], y[16]); 2057| 12| accum.mul(x[21], y[15]); 2058| 12| accum.mul(x[22], y[14]); 2059| 12| accum.mul(x[23], y[13]); 2060| 12| z[36] = accum.extract(); 2061| 12| accum.mul(x[14], y[23]); 2062| 12| accum.mul(x[15], y[22]); 2063| 12| accum.mul(x[16], y[21]); 2064| 12| accum.mul(x[17], y[20]); 2065| 12| accum.mul(x[18], y[19]); 2066| 12| accum.mul(x[19], y[18]); 2067| 12| accum.mul(x[20], y[17]); 2068| 12| accum.mul(x[21], y[16]); 2069| 12| accum.mul(x[22], y[15]); 2070| 12| accum.mul(x[23], y[14]); 2071| 12| z[37] = accum.extract(); 2072| 12| accum.mul(x[15], y[23]); 2073| 12| accum.mul(x[16], y[22]); 2074| 12| accum.mul(x[17], y[21]); 2075| 12| accum.mul(x[18], y[20]); 2076| 12| accum.mul(x[19], y[19]); 2077| 12| accum.mul(x[20], y[18]); 2078| 12| accum.mul(x[21], y[17]); 2079| 12| accum.mul(x[22], y[16]); 2080| 12| accum.mul(x[23], y[15]); 2081| 12| z[38] = accum.extract(); 2082| 12| accum.mul(x[16], y[23]); 2083| 12| accum.mul(x[17], y[22]); 2084| 12| accum.mul(x[18], y[21]); 2085| 12| accum.mul(x[19], y[20]); 2086| 12| accum.mul(x[20], y[19]); 2087| 12| accum.mul(x[21], y[18]); 2088| 12| accum.mul(x[22], y[17]); 2089| 12| accum.mul(x[23], y[16]); 2090| 12| z[39] = accum.extract(); 2091| 12| accum.mul(x[17], y[23]); 2092| 12| accum.mul(x[18], y[22]); 2093| 12| accum.mul(x[19], y[21]); 2094| 12| accum.mul(x[20], y[20]); 2095| 12| accum.mul(x[21], y[19]); 2096| 12| accum.mul(x[22], y[18]); 2097| 12| accum.mul(x[23], y[17]); 2098| 12| z[40] = accum.extract(); 2099| 12| accum.mul(x[18], y[23]); 2100| 12| accum.mul(x[19], y[22]); 2101| 12| accum.mul(x[20], y[21]); 2102| 12| accum.mul(x[21], y[20]); 2103| 12| accum.mul(x[22], y[19]); 2104| 12| accum.mul(x[23], y[18]); 2105| 12| z[41] = accum.extract(); 2106| 12| accum.mul(x[19], y[23]); 2107| 12| accum.mul(x[20], y[22]); 2108| 12| accum.mul(x[21], y[21]); 2109| 12| accum.mul(x[22], y[20]); 2110| 12| accum.mul(x[23], y[19]); 2111| 12| z[42] = accum.extract(); 2112| 12| accum.mul(x[20], y[23]); 2113| 12| accum.mul(x[21], y[22]); 2114| 12| accum.mul(x[22], y[21]); 2115| 12| accum.mul(x[23], y[20]); 2116| 12| z[43] = accum.extract(); 2117| 12| accum.mul(x[21], y[23]); 2118| 12| accum.mul(x[22], y[22]); 2119| 12| accum.mul(x[23], y[21]); 2120| 12| z[44] = accum.extract(); 2121| 12| accum.mul(x[22], y[23]); 2122| 12| accum.mul(x[23], y[22]); 2123| 12| z[45] = accum.extract(); 2124| 12| accum.mul(x[23], y[23]); 2125| 12| z[46] = accum.extract(); 2126| 12| z[47] = accum.extract(); 2127| 12|} _ZN5Botan12basecase_mulEPmmPKmmS2_m: 20| 5.63M|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) { 21| 5.63M| if(z_size < x_size + y_size) { ------------------ | Branch (21:7): [True: 0, False: 5.63M] ------------------ 22| 0| throw Invalid_Argument("basecase_mul z_size too small"); 23| 0| } 24| | 25| 5.63M| const size_t x_size_8 = x_size - (x_size % 8); 26| | 27| 5.63M| zeroize_buffer(z, z_size); 28| | 29| 26.0M| for(size_t i = 0; i != y_size; ++i) { ------------------ | Branch (29:22): [True: 20.4M, False: 5.63M] ------------------ 30| 20.4M| const word y_i = y[i]; 31| | 32| 20.4M| word carry = 0; 33| | 34| 20.5M| for(size_t j = 0; j != x_size_8; j += 8) { ------------------ | Branch (34:25): [True: 78.6k, False: 20.4M] ------------------ 35| 78.6k| carry = word8_madd3(z + i + j, x + j, y_i, carry); 36| 78.6k| } 37| | 38| 99.0M| for(size_t j = x_size_8; j != x_size; ++j) { ------------------ | Branch (38:32): [True: 78.5M, False: 20.4M] ------------------ 39| 78.5M| z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry); 40| 78.5M| } 41| | 42| 20.4M| z[x_size + i] = carry; 43| 20.4M| } 44| 5.63M|} _ZN5Botan12basecase_sqrEPmmPKmm: 46| 2.58M|void basecase_sqr(word z[], size_t z_size, const word x[], size_t x_size) { 47| 2.58M| if(z_size < 2 * x_size) { ------------------ | Branch (47:7): [True: 0, False: 2.58M] ------------------ 48| 0| throw Invalid_Argument("basecase_sqr z_size too small"); 49| 0| } 50| | 51| 2.58M| const size_t x_size_8 = x_size - (x_size % 8); 52| | 53| 2.58M| zeroize_buffer(z, z_size); 54| | 55| 12.2M| for(size_t i = 0; i != x_size; ++i) { ------------------ | Branch (55:22): [True: 9.66M, False: 2.58M] ------------------ 56| 9.66M| const word x_i = x[i]; 57| | 58| 9.66M| word carry = 0; 59| | 60| 9.66M| for(size_t j = 0; j != x_size_8; j += 8) { ------------------ | Branch (60:25): [True: 2.00k, False: 9.66M] ------------------ 61| 2.00k| carry = word8_madd3(z + i + j, x + j, x_i, carry); 62| 2.00k| } 63| | 64| 48.3M| for(size_t j = x_size_8; j != x_size; ++j) { ------------------ | Branch (64:32): [True: 38.6M, False: 9.66M] ------------------ 65| 38.6M| z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry); 66| 38.6M| } 67| | 68| 9.66M| z[x_size + i] = carry; 69| 9.66M| } 70| 2.58M|} _ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m: 292| 10.1M| size_t ws_size) { 293| 10.1M| zeroize_buffer(z, z_size); 294| | 295| 10.1M| if(x_sw == 1) { ------------------ | Branch (295:7): [True: 895, False: 10.1M] ------------------ 296| 895| bigint_linmul3(z, y, y_sw, x[0]); 297| 10.1M| } else if(y_sw == 1) { ------------------ | Branch (297:14): [True: 240, False: 10.1M] ------------------ 298| 240| bigint_linmul3(z, x, x_sw, y[0]); 299| 10.1M| } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (299:14): [True: 3.92M, False: 6.20M] ------------------ 300| 3.92M| bigint_comba_mul4(z, x, y); 301| 6.20M| } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (301:14): [True: 36.2k, False: 6.16M] ------------------ 302| 36.2k| bigint_comba_mul6(z, x, y); 303| 6.16M| } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (303:14): [True: 7.17k, False: 6.16M] ------------------ 304| 7.17k| bigint_comba_mul8(z, x, y); 305| 6.16M| } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (305:14): [True: 527k, False: 5.63M] ------------------ 306| 527k| bigint_comba_mul9(z, x, y); 307| 5.63M| } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (307:14): [True: 65, False: 5.63M] ------------------ 308| 65| bigint_comba_mul16(z, x, y); 309| 5.63M| } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (309:14): [True: 12, False: 5.63M] ------------------ 310| 12| bigint_comba_mul24(z, x, y); 311| 5.63M| } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || workspace == nullptr) { ------------------ | Branch (311:14): [True: 5.63M, False: 0] | Branch (311:53): [True: 0, False: 0] | Branch (311:92): [True: 0, False: 0] ------------------ 312| 5.63M| basecase_mul(z, z_size, x, x_sw, y, y_sw); 313| 5.63M| } else { 314| 0| const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw); 315| | 316| 0| if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) { ------------------ | Branch (316:10): [True: 0, False: 0] | Branch (316:19): [True: 0, False: 0] | Branch (316:38): [True: 0, False: 0] ------------------ 317| 0| karatsuba_mul(z, x, y, N, workspace); 318| 0| } else { 319| 0| basecase_mul(z, z_size, x, x_sw, y, y_sw); 320| 0| } 321| 0| } 322| 10.1M|} _ZN5Botan10bigint_sqrEPmmPKmmmS0_m: 327| 4.37M|void bigint_sqr(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size) { 328| 4.37M| zeroize_buffer(z, z_size); 329| | 330| 4.37M| BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient"); ------------------ | | 71| 4.37M| do { \ | | 72| 4.37M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 4.37M| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 4.37M] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 4.37M| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 4.37M] | | ------------------ ------------------ 331| | 332| 4.37M| if(x_sw == 1) { ------------------ | Branch (332:7): [True: 1.29k, False: 4.37M] ------------------ 333| 1.29k| bigint_linmul3(z, x, x_sw, x[0]); 334| 4.37M| } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) { ------------------ | Branch (334:14): [True: 1.58M, False: 2.78M] ------------------ 335| 1.58M| bigint_comba_sqr4(z, x); 336| 2.78M| } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) { ------------------ | Branch (336:14): [True: 1.14k, False: 2.78M] ------------------ 337| 1.14k| bigint_comba_sqr6(z, x); 338| 2.78M| } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) { ------------------ | Branch (338:14): [True: 647, False: 2.78M] ------------------ 339| 647| bigint_comba_sqr8(z, x); 340| 2.78M| } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) { ------------------ | Branch (340:14): [True: 200k, False: 2.58M] ------------------ 341| 200k| bigint_comba_sqr9(z, x); 342| 2.58M| } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) { ------------------ | Branch (342:14): [True: 5, False: 2.58M] ------------------ 343| 5| bigint_comba_sqr16(z, x); 344| 2.58M| } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) { ------------------ | Branch (344:14): [True: 0, False: 2.58M] ------------------ 345| 0| bigint_comba_sqr24(z, x); 346| 2.58M| } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || workspace == nullptr) { ------------------ | Branch (346:14): [True: 2.58M, False: 33] | Branch (346:53): [True: 0, False: 33] ------------------ 347| 2.58M| basecase_sqr(z, z_size, x, x_sw); 348| 2.58M| } else { 349| 33| const size_t N = karatsuba_size(z_size, x_size, x_sw); 350| | 351| 33| if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) { ------------------ | Branch (351:10): [True: 19, False: 14] | Branch (351:19): [True: 19, False: 0] | Branch (351:38): [True: 19, False: 0] ------------------ 352| 19| karatsuba_sqr(z, x, N, workspace); 353| 19| } else { 354| 14| basecase_sqr(z, z_size, x, x_sw); 355| 14| } 356| 33| } 357| 4.37M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmm: 245| 33|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw) { 246| 33| if(x_sw == x_size) { ------------------ | Branch (246:7): [True: 0, False: 33] ------------------ 247| 0| if(x_sw % 2 != 0) { ------------------ | Branch (247:10): [True: 0, False: 0] ------------------ 248| 0| return 0; 249| 0| } 250| 0| return x_sw; 251| 0| } 252| | 253| 47| for(size_t j = x_sw; j <= x_size; ++j) { ------------------ | Branch (253:25): [True: 47, False: 0] ------------------ 254| 47| if(j % 2 != 0) { ------------------ | Branch (254:10): [True: 14, False: 33] ------------------ 255| 14| continue; 256| 14| } 257| | 258| 33| if(2 * j > z_size) { ------------------ | Branch (258:10): [True: 14, False: 19] ------------------ 259| 14| return 0; 260| 14| } 261| | 262| 19| if(j % 4 == 2 && (j + 2) <= x_size && 2 * (j + 2) <= z_size) { ------------------ | Branch (262:10): [True: 11, False: 8] | Branch (262:24): [True: 11, False: 0] | Branch (262:45): [True: 0, False: 11] ------------------ 263| 0| return j + 2; 264| 0| } 265| 19| return j; 266| 19| } 267| | 268| 0| return 0; 269| 33|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_sqrEPmPKmmS1_: 149| 19|void karatsuba_sqr(word z[], const word x[], size_t N, word workspace[]) { 150| 19| if(N < KARATSUBA_SQUARE_THRESHOLD || N % 2 != 0) { ------------------ | Branch (150:7): [True: 19, False: 0] | Branch (150:41): [True: 0, False: 0] ------------------ 151| 19| switch(N) { 152| 0| case 6: ------------------ | Branch (152:10): [True: 0, False: 19] ------------------ 153| 0| return bigint_comba_sqr6(z, x); 154| 0| case 8: ------------------ | Branch (154:10): [True: 0, False: 19] ------------------ 155| 0| return bigint_comba_sqr8(z, x); 156| 0| case 9: ------------------ | Branch (156:10): [True: 0, False: 19] ------------------ 157| 0| return bigint_comba_sqr9(z, x); 158| 0| case 16: ------------------ | Branch (158:10): [True: 0, False: 19] ------------------ 159| 0| return bigint_comba_sqr16(z, x); 160| 0| case 24: ------------------ | Branch (160:10): [True: 0, False: 19] ------------------ 161| 0| return bigint_comba_sqr24(z, x); 162| 19| default: ------------------ | Branch (162:10): [True: 19, False: 0] ------------------ 163| 19| return basecase_sqr(z, 2 * N, x, N); 164| 19| } 165| 19| } 166| | 167| 0| const size_t N2 = N / 2; 168| | 169| 0| const word* x0 = x; 170| 0| const word* x1 = x + N2; 171| 0| word* z0 = z; 172| 0| word* z1 = z + N; 173| | 174| 0| word* ws0 = workspace; 175| 0| word* ws1 = workspace + N; 176| | 177| 0| zeroize_buffer(workspace, 2 * N); 178| | 179| | // See comment in karatsuba_mul 180| 0| bigint_sub_abs(z0, x0, x1, N2, workspace); 181| 0| karatsuba_sqr(ws0, z0, N2, ws1); 182| | 183| 0| karatsuba_sqr(z0, x0, N2, ws1); 184| 0| karatsuba_sqr(z1, x1, N2, ws1); 185| | 186| 0| const word ws_carry = bigint_add3(ws1, z0, N, z1, N); 187| 0| word z_carry = bigint_add2(z + N2, N, ws1, N); 188| | 189| 0| z_carry += bigint_add2(z + N + N2, N2, &ws_carry, 1); 190| 0| bigint_add2(z + N + N2, N2, &z_carry, 1); 191| | 192| | /* 193| | * This is only actually required if cmp (result of bigint_sub_abs) is != 0, 194| | * however if cmp==0 then ws0[0:N] == 0 and avoiding the jump hides a 195| | * timing channel. 196| | */ 197| 0| bigint_sub2(z + N2, 2 * N - N2, ws0, N); 198| 0|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm: 272| 10.1M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 10.1M| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 7.81M, False: 2.31M] | Branch (273:26): [True: 4.09M, False: 3.71M] | Branch (273:42): [True: 4.09M, False: 0] | Branch (273:56): [True: 4.01M, False: 77.8k] | Branch (273:72): [True: 3.92M, False: 92.1k] ------------------ 274| 10.1M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm: 272| 6.20M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 6.20M| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 5.66M, False: 542k] | Branch (273:26): [True: 207k, False: 5.45M] | Branch (273:42): [True: 207k, False: 0] | Branch (273:56): [True: 129k, False: 77.8k] | Branch (273:72): [True: 36.2k, False: 93.1k] ------------------ 274| 6.20M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm: 272| 6.16M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 6.16M| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 5.63M, False: 535k] | Branch (273:26): [True: 97.4k, False: 5.53M] | Branch (273:42): [True: 97.3k, False: 83] | Branch (273:56): [True: 33.1k, False: 64.2k] | Branch (273:72): [True: 7.17k, False: 25.9k] ------------------ 274| 6.16M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm: 272| 6.16M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 6.16M| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 6.15M, False: 7.57k] | Branch (273:26): [True: 557k, False: 5.59M] | Branch (273:42): [True: 557k, False: 0] | Branch (273:56): [True: 533k, False: 24.2k] | Branch (273:72): [True: 527k, False: 5.48k] ------------------ 274| 6.16M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm: 272| 5.63M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 5.63M| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 5.63M, False: 191] | Branch (273:26): [True: 3.77k, False: 5.62M] | Branch (273:42): [True: 3.77k, False: 0] | Branch (273:56): [True: 3.77k, False: 0] | Branch (273:72): [True: 65, False: 3.71k] ------------------ 274| 5.63M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm: 272| 5.63M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 5.63M| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 5.63M, False: 0] | Branch (273:26): [True: 455, False: 5.63M] | Branch (273:42): [True: 455, False: 0] | Branch (273:56): [True: 455, False: 0] | Branch (273:72): [True: 12, False: 443] ------------------ 274| 5.63M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm4EEEbmmm: 277| 4.37M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 4.37M| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 3.20M, False: 1.16M] | Branch (278:26): [True: 1.64M, False: 1.55M] | Branch (278:42): [True: 1.58M, False: 60.3k] ------------------ 279| 4.37M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm6EEEbmmm: 277| 2.78M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 2.78M| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 2.58M, False: 200k] | Branch (278:26): [True: 62.2k, False: 2.51M] | Branch (278:42): [True: 1.14k, False: 61.1k] ------------------ 279| 2.78M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm8EEEbmmm: 277| 2.78M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 2.78M| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 2.58M, False: 200k] | Branch (278:26): [True: 43.5k, False: 2.53M] | Branch (278:42): [True: 647, False: 42.9k] ------------------ 279| 2.78M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm9EEEbmmm: 277| 2.78M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 2.78M| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 2.78M, False: 121] | Branch (278:26): [True: 220k, False: 2.55M] | Branch (278:42): [True: 200k, False: 20.6k] ------------------ 279| 2.78M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm16EEEbmmm: 277| 2.58M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 2.58M| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 2.58M, False: 23] | Branch (278:26): [True: 99, False: 2.57M] | Branch (278:42): [True: 5, False: 94] ------------------ 279| 2.58M|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm24EEEbmmm: 277| 2.58M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 2.58M| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 2.58M, False: 0] | Branch (278:26): [True: 116, False: 2.57M] | Branch (278:42): [True: 0, False: 116] ------------------ 279| 2.58M|} _ZN5Botan25bigint_monty_redc_genericEPmPKmmS2_mmS0_: 95| 9.38M| word r[], const word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[]) { 96| 9.38M| BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic"); ------------------ | | 35| 9.38M| do { \ | | 36| 9.38M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18.7M| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 9.38M, False: 0] | | | Branch (37:12): [True: 9.38M, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 9.38M| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 9.38M] | | ------------------ ------------------ 97| | 98| 9.38M| word3 accum; 99| | 100| 9.38M| accum.add(z[0]); 101| | 102| 9.38M| ws[0] = accum.monty_step(p[0], p_dash); 103| | 104| 38.6M| for(size_t i = 1; i != p_size; ++i) { ------------------ | Branch (104:22): [True: 29.2M, False: 9.38M] ------------------ 105| 29.2M| mul_rev_range(accum, ws, p, i); 106| 29.2M| accum.add(z[i]); 107| 29.2M| ws[i] = accum.monty_step(p[0], p_dash); 108| 29.2M| } 109| | 110| 38.6M| for(size_t i = 0; i != p_size - 1; ++i) { ------------------ | Branch (110:22): [True: 29.2M, False: 9.38M] ------------------ 111| 29.2M| mul_rev_range(accum, &ws[i + 1], &p[i], p_size - (i + 1)); 112| 29.2M| accum.add(z[p_size + i]); 113| 29.2M| ws[i] = accum.extract(); 114| 29.2M| } 115| | 116| 9.38M| accum.add(z[2 * p_size - 1]); 117| | 118| 9.38M| ws[p_size - 1] = accum.extract(); 119| | // w1 is the final part, which is not stored in the workspace 120| 9.38M| const word w1 = accum.extract(); 121| | 122| | /* 123| | * The result might need to be reduced mod p. To avoid a timing 124| | * channel, always perform the subtraction. If in the computation 125| | * of x - p a borrow is required then x was already < p. 126| | * 127| | * x starts at ws[0] and is p_size bytes long plus a possible high 128| | * digit left over in w1. 129| | * 130| | * x - p starts at z[0] and is also p_size bytes long 131| | * 132| | * If borrow was set after the subtraction, then x was already less 133| | * than p and the subtraction was not needed. In that case overwrite 134| | * z[0:p_size] with the original x in ws[0:p_size]. 135| | * 136| | * We only copy out p_size in the final step because we know 137| | * the Montgomery result is < P 138| | */ 139| | 140| 9.38M| bigint_monty_maybe_sub(p_size, r, w1, ws, p); 141| 9.38M|} _ZN5Botan16bigint_monty_mulEPmPKmS2_S2_mmS0_m: 144| 241k| word z[], const word x[], const word y[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) { 145| 241k| BOTAN_ARG_CHECK(ws_size >= 4 * p_size && p_size > 0, "Invalid workspace for Montgomery multiplication"); ------------------ | | 35| 241k| do { \ | | 36| 241k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 483k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 241k, False: 0] | | | Branch (37:12): [True: 241k, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 241k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 241k] | | ------------------ ------------------ 146| | 147| 241k|#if defined(BOTAN_HAS_MP_MULX) 148| 241k| if(use_mulx_monty(p_size)) { ------------------ | Branch (148:7): [True: 88.8k, False: 153k] ------------------ 149| 88.8k| return bigint_mulx_monty_mul(z, x, y, p, p_size, p_dash, ws); 150| 88.8k| } 151| 153k|#endif 152| | 153| 153k| word* prod = ws; 154| 153k| word* mul_ws = ws + 2 * p_size; 155| 153k| bigint_mul(prod, 2 * p_size, x, p_size, p_size, y, p_size, p_size, mul_ws, 2 * p_size); 156| 153k| bigint_monty_redc(z, prod, p, p_size, p_dash, mul_ws, 2 * p_size); 157| 153k|} _ZN5Botan16bigint_monty_sqrEPmPKmS2_mmS0_m: 159| 676k|void bigint_monty_sqr(word z[], const word x[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) { 160| 676k| BOTAN_ARG_CHECK(ws_size >= 4 * p_size && p_size > 0, "Invalid workspace for Montgomery squaring"); ------------------ | | 35| 676k| do { \ | | 36| 676k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.35M| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 676k, False: 0] | | | Branch (37:12): [True: 676k, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 676k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 676k] | | ------------------ ------------------ 161| | 162| 676k| word* prod = ws; 163| | 164| 676k|#if defined(BOTAN_HAS_MP_MULX) 165| 676k| if(use_mulx_monty(p_size)) { ------------------ | Branch (165:7): [True: 229k, False: 447k] ------------------ 166| 229k| return bigint_mulx_monty_sqr(z, x, p, p_size, p_dash, ws); 167| 229k| } 168| 447k|#endif 169| | 170| 447k| word* mul_ws = ws + 2 * p_size; 171| 447k| bigint_sqr(prod, 2 * p_size, x, p_size, p_size, mul_ws, 2 * p_size); 172| 447k| bigint_monty_redc(z, prod, p, p_size, p_dash, mul_ws, 2 * p_size); 173| 447k|} mp_monty.cpp:_ZN5Botan12_GLOBAL__N_113mul_rev_rangeERNS_5word3ImEEPKmS5_m: 22| 58.4M|BOTAN_FORCE_INLINE void mul_rev_range(word3& accum, const word ws[], const word p[], size_t bound) { 23| | /* 24| | Unrolled version of: 25| | 26| | for(size_t i = 0; i < bound; ++i) { 27| | accum.mul(ws[i], p[bound - i]); 28| | } 29| | */ 30| | 31| 58.4M| size_t lower = 0; 32| 130M| while(lower < bound) { ------------------ | Branch (32:10): [True: 72.3M, False: 58.4M] ------------------ 33| 72.3M| const size_t upper = bound - lower; 34| | 35| 72.3M| if(upper >= 16) { ------------------ | Branch (35:10): [True: 110, False: 72.3M] ------------------ 36| 110| accum.mul(ws[lower], p[upper]); 37| 110| accum.mul(ws[lower + 1], p[upper - 1]); 38| 110| accum.mul(ws[lower + 2], p[upper - 2]); 39| 110| accum.mul(ws[lower + 3], p[upper - 3]); 40| 110| accum.mul(ws[lower + 4], p[upper - 4]); 41| 110| accum.mul(ws[lower + 5], p[upper - 5]); 42| 110| accum.mul(ws[lower + 6], p[upper - 6]); 43| 110| accum.mul(ws[lower + 7], p[upper - 7]); 44| 110| accum.mul(ws[lower + 8], p[upper - 8]); 45| 110| accum.mul(ws[lower + 9], p[upper - 9]); 46| 110| accum.mul(ws[lower + 10], p[upper - 10]); 47| 110| accum.mul(ws[lower + 11], p[upper - 11]); 48| 110| accum.mul(ws[lower + 12], p[upper - 12]); 49| 110| accum.mul(ws[lower + 13], p[upper - 13]); 50| 110| accum.mul(ws[lower + 14], p[upper - 14]); 51| 110| accum.mul(ws[lower + 15], p[upper - 15]); 52| 110| lower += 16; 53| 72.3M| } else if(upper >= 8) { ------------------ | Branch (53:17): [True: 1.68M, False: 70.6M] ------------------ 54| 1.68M| accum.mul(ws[lower], p[upper]); 55| 1.68M| accum.mul(ws[lower + 1], p[upper - 1]); 56| 1.68M| accum.mul(ws[lower + 2], p[upper - 2]); 57| 1.68M| accum.mul(ws[lower + 3], p[upper - 3]); 58| 1.68M| accum.mul(ws[lower + 4], p[upper - 4]); 59| 1.68M| accum.mul(ws[lower + 5], p[upper - 5]); 60| 1.68M| accum.mul(ws[lower + 6], p[upper - 6]); 61| 1.68M| accum.mul(ws[lower + 7], p[upper - 7]); 62| 1.68M| lower += 8; 63| 70.6M| } else if(upper >= 4) { ------------------ | Branch (63:17): [True: 12.1M, False: 58.4M] ------------------ 64| 12.1M| accum.mul(ws[lower], p[upper]); 65| 12.1M| accum.mul(ws[lower + 1], p[upper - 1]); 66| 12.1M| accum.mul(ws[lower + 2], p[upper - 2]); 67| 12.1M| accum.mul(ws[lower + 3], p[upper - 3]); 68| 12.1M| lower += 4; 69| 58.4M| } else if(upper >= 2) { ------------------ | Branch (69:17): [True: 29.2M, False: 29.2M] ------------------ 70| 29.2M| accum.mul(ws[lower], p[upper]); 71| 29.2M| accum.mul(ws[lower + 1], p[upper - 1]); 72| 29.2M| lower += 2; 73| 29.2M| } else { 74| 29.2M| accum.mul(ws[lower], p[upper]); 75| 29.2M| lower += 1; 76| 29.2M| } 77| 72.3M| } 78| 58.4M|} _ZN5Botan19bigint_monty_redc_4EPmPKmS2_mS0_: 12| 7.47M|void bigint_monty_redc_4(word r[4], const word z[8], const word p[4], word p_dash, word ws[4]) { 13| 7.47M| word3 accum; 14| 7.47M| accum.add(z[0]); 15| 7.47M| ws[0] = accum.monty_step(p[0], p_dash); 16| 7.47M| accum.mul(ws[0], p[1]); 17| 7.47M| accum.add(z[1]); 18| 7.47M| ws[1] = accum.monty_step(p[0], p_dash); 19| 7.47M| accum.mul(ws[0], p[2]); 20| 7.47M| accum.mul(ws[1], p[1]); 21| 7.47M| accum.add(z[2]); 22| 7.47M| ws[2] = accum.monty_step(p[0], p_dash); 23| 7.47M| accum.mul(ws[0], p[3]); 24| 7.47M| accum.mul(ws[1], p[2]); 25| 7.47M| accum.mul(ws[2], p[1]); 26| 7.47M| accum.add(z[3]); 27| 7.47M| ws[3] = accum.monty_step(p[0], p_dash); 28| 7.47M| accum.mul(ws[1], p[3]); 29| 7.47M| accum.mul(ws[2], p[2]); 30| 7.47M| accum.mul(ws[3], p[1]); 31| 7.47M| accum.add(z[4]); 32| 7.47M| ws[0] = accum.extract(); 33| 7.47M| accum.mul(ws[2], p[3]); 34| 7.47M| accum.mul(ws[3], p[2]); 35| 7.47M| accum.add(z[5]); 36| 7.47M| ws[1] = accum.extract(); 37| 7.47M| accum.mul(ws[3], p[3]); 38| 7.47M| accum.add(z[6]); 39| 7.47M| ws[2] = accum.extract(); 40| 7.47M| accum.add(z[7]); 41| 7.47M| ws[3] = accum.extract(); 42| 7.47M| const word w1 = accum.extract(); 43| 7.47M| bigint_monty_maybe_sub<4>(r, w1, ws, p); 44| 7.47M|} _ZN5Botan19bigint_monty_redc_6EPmPKmS2_mS0_: 46| 228k|void bigint_monty_redc_6(word r[6], const word z[12], const word p[6], word p_dash, word ws[6]) { 47| 228k| word3 accum; 48| 228k| accum.add(z[0]); 49| 228k| ws[0] = accum.monty_step(p[0], p_dash); 50| 228k| accum.mul(ws[0], p[1]); 51| 228k| accum.add(z[1]); 52| 228k| ws[1] = accum.monty_step(p[0], p_dash); 53| 228k| accum.mul(ws[0], p[2]); 54| 228k| accum.mul(ws[1], p[1]); 55| 228k| accum.add(z[2]); 56| 228k| ws[2] = accum.monty_step(p[0], p_dash); 57| 228k| accum.mul(ws[0], p[3]); 58| 228k| accum.mul(ws[1], p[2]); 59| 228k| accum.mul(ws[2], p[1]); 60| 228k| accum.add(z[3]); 61| 228k| ws[3] = accum.monty_step(p[0], p_dash); 62| 228k| accum.mul(ws[0], p[4]); 63| 228k| accum.mul(ws[1], p[3]); 64| 228k| accum.mul(ws[2], p[2]); 65| 228k| accum.mul(ws[3], p[1]); 66| 228k| accum.add(z[4]); 67| 228k| ws[4] = accum.monty_step(p[0], p_dash); 68| 228k| accum.mul(ws[0], p[5]); 69| 228k| accum.mul(ws[1], p[4]); 70| 228k| accum.mul(ws[2], p[3]); 71| 228k| accum.mul(ws[3], p[2]); 72| 228k| accum.mul(ws[4], p[1]); 73| 228k| accum.add(z[5]); 74| 228k| ws[5] = accum.monty_step(p[0], p_dash); 75| 228k| accum.mul(ws[1], p[5]); 76| 228k| accum.mul(ws[2], p[4]); 77| 228k| accum.mul(ws[3], p[3]); 78| 228k| accum.mul(ws[4], p[2]); 79| 228k| accum.mul(ws[5], p[1]); 80| 228k| accum.add(z[6]); 81| 228k| ws[0] = accum.extract(); 82| 228k| accum.mul(ws[2], p[5]); 83| 228k| accum.mul(ws[3], p[4]); 84| 228k| accum.mul(ws[4], p[3]); 85| 228k| accum.mul(ws[5], p[2]); 86| 228k| accum.add(z[7]); 87| 228k| ws[1] = accum.extract(); 88| 228k| accum.mul(ws[3], p[5]); 89| 228k| accum.mul(ws[4], p[4]); 90| 228k| accum.mul(ws[5], p[3]); 91| 228k| accum.add(z[8]); 92| 228k| ws[2] = accum.extract(); 93| 228k| accum.mul(ws[4], p[5]); 94| 228k| accum.mul(ws[5], p[4]); 95| 228k| accum.add(z[9]); 96| 228k| ws[3] = accum.extract(); 97| 228k| accum.mul(ws[5], p[5]); 98| 228k| accum.add(z[10]); 99| 228k| ws[4] = accum.extract(); 100| 228k| accum.add(z[11]); 101| 228k| ws[5] = accum.extract(); 102| 228k| const word w1 = accum.extract(); 103| 228k| bigint_monty_maybe_sub<6>(r, w1, ws, p); 104| 228k|} _ZN5Botan19bigint_monty_redc_8EPmPKmS2_mS0_: 106| 276k|void bigint_monty_redc_8(word r[8], const word z[16], const word p[8], word p_dash, word ws[8]) { 107| 276k| word3 accum; 108| 276k| accum.add(z[0]); 109| 276k| ws[0] = accum.monty_step(p[0], p_dash); 110| 276k| accum.mul(ws[0], p[1]); 111| 276k| accum.add(z[1]); 112| 276k| ws[1] = accum.monty_step(p[0], p_dash); 113| 276k| accum.mul(ws[0], p[2]); 114| 276k| accum.mul(ws[1], p[1]); 115| 276k| accum.add(z[2]); 116| 276k| ws[2] = accum.monty_step(p[0], p_dash); 117| 276k| accum.mul(ws[0], p[3]); 118| 276k| accum.mul(ws[1], p[2]); 119| 276k| accum.mul(ws[2], p[1]); 120| 276k| accum.add(z[3]); 121| 276k| ws[3] = accum.monty_step(p[0], p_dash); 122| 276k| accum.mul(ws[0], p[4]); 123| 276k| accum.mul(ws[1], p[3]); 124| 276k| accum.mul(ws[2], p[2]); 125| 276k| accum.mul(ws[3], p[1]); 126| 276k| accum.add(z[4]); 127| 276k| ws[4] = accum.monty_step(p[0], p_dash); 128| 276k| accum.mul(ws[0], p[5]); 129| 276k| accum.mul(ws[1], p[4]); 130| 276k| accum.mul(ws[2], p[3]); 131| 276k| accum.mul(ws[3], p[2]); 132| 276k| accum.mul(ws[4], p[1]); 133| 276k| accum.add(z[5]); 134| 276k| ws[5] = accum.monty_step(p[0], p_dash); 135| 276k| accum.mul(ws[0], p[6]); 136| 276k| accum.mul(ws[1], p[5]); 137| 276k| accum.mul(ws[2], p[4]); 138| 276k| accum.mul(ws[3], p[3]); 139| 276k| accum.mul(ws[4], p[2]); 140| 276k| accum.mul(ws[5], p[1]); 141| 276k| accum.add(z[6]); 142| 276k| ws[6] = accum.monty_step(p[0], p_dash); 143| 276k| accum.mul(ws[0], p[7]); 144| 276k| accum.mul(ws[1], p[6]); 145| 276k| accum.mul(ws[2], p[5]); 146| 276k| accum.mul(ws[3], p[4]); 147| 276k| accum.mul(ws[4], p[3]); 148| 276k| accum.mul(ws[5], p[2]); 149| 276k| accum.mul(ws[6], p[1]); 150| 276k| accum.add(z[7]); 151| 276k| ws[7] = accum.monty_step(p[0], p_dash); 152| 276k| accum.mul(ws[1], p[7]); 153| 276k| accum.mul(ws[2], p[6]); 154| 276k| accum.mul(ws[3], p[5]); 155| 276k| accum.mul(ws[4], p[4]); 156| 276k| accum.mul(ws[5], p[3]); 157| 276k| accum.mul(ws[6], p[2]); 158| 276k| accum.mul(ws[7], p[1]); 159| 276k| accum.add(z[8]); 160| 276k| ws[0] = accum.extract(); 161| 276k| accum.mul(ws[2], p[7]); 162| 276k| accum.mul(ws[3], p[6]); 163| 276k| accum.mul(ws[4], p[5]); 164| 276k| accum.mul(ws[5], p[4]); 165| 276k| accum.mul(ws[6], p[3]); 166| 276k| accum.mul(ws[7], p[2]); 167| 276k| accum.add(z[9]); 168| 276k| ws[1] = accum.extract(); 169| 276k| accum.mul(ws[3], p[7]); 170| 276k| accum.mul(ws[4], p[6]); 171| 276k| accum.mul(ws[5], p[5]); 172| 276k| accum.mul(ws[6], p[4]); 173| 276k| accum.mul(ws[7], p[3]); 174| 276k| accum.add(z[10]); 175| 276k| ws[2] = accum.extract(); 176| 276k| accum.mul(ws[4], p[7]); 177| 276k| accum.mul(ws[5], p[6]); 178| 276k| accum.mul(ws[6], p[5]); 179| 276k| accum.mul(ws[7], p[4]); 180| 276k| accum.add(z[11]); 181| 276k| ws[3] = accum.extract(); 182| 276k| accum.mul(ws[5], p[7]); 183| 276k| accum.mul(ws[6], p[6]); 184| 276k| accum.mul(ws[7], p[5]); 185| 276k| accum.add(z[12]); 186| 276k| ws[4] = accum.extract(); 187| 276k| accum.mul(ws[6], p[7]); 188| 276k| accum.mul(ws[7], p[6]); 189| 276k| accum.add(z[13]); 190| 276k| ws[5] = accum.extract(); 191| 276k| accum.mul(ws[7], p[7]); 192| 276k| accum.add(z[14]); 193| 276k| ws[6] = accum.extract(); 194| 276k| accum.add(z[15]); 195| 276k| ws[7] = accum.extract(); 196| 276k| const word w1 = accum.extract(); 197| 276k| bigint_monty_maybe_sub<8>(r, w1, ws, p); 198| 276k|} _ZN5Botan20bigint_monty_redc_12EPmPKmS2_mS0_: 200| 71|void bigint_monty_redc_12(word r[12], const word z[24], const word p[12], word p_dash, word ws[12]) { 201| 71| word3 accum; 202| 71| accum.add(z[0]); 203| 71| ws[0] = accum.monty_step(p[0], p_dash); 204| 71| accum.mul(ws[0], p[1]); 205| 71| accum.add(z[1]); 206| 71| ws[1] = accum.monty_step(p[0], p_dash); 207| 71| accum.mul(ws[0], p[2]); 208| 71| accum.mul(ws[1], p[1]); 209| 71| accum.add(z[2]); 210| 71| ws[2] = accum.monty_step(p[0], p_dash); 211| 71| accum.mul(ws[0], p[3]); 212| 71| accum.mul(ws[1], p[2]); 213| 71| accum.mul(ws[2], p[1]); 214| 71| accum.add(z[3]); 215| 71| ws[3] = accum.monty_step(p[0], p_dash); 216| 71| accum.mul(ws[0], p[4]); 217| 71| accum.mul(ws[1], p[3]); 218| 71| accum.mul(ws[2], p[2]); 219| 71| accum.mul(ws[3], p[1]); 220| 71| accum.add(z[4]); 221| 71| ws[4] = accum.monty_step(p[0], p_dash); 222| 71| accum.mul(ws[0], p[5]); 223| 71| accum.mul(ws[1], p[4]); 224| 71| accum.mul(ws[2], p[3]); 225| 71| accum.mul(ws[3], p[2]); 226| 71| accum.mul(ws[4], p[1]); 227| 71| accum.add(z[5]); 228| 71| ws[5] = accum.monty_step(p[0], p_dash); 229| 71| accum.mul(ws[0], p[6]); 230| 71| accum.mul(ws[1], p[5]); 231| 71| accum.mul(ws[2], p[4]); 232| 71| accum.mul(ws[3], p[3]); 233| 71| accum.mul(ws[4], p[2]); 234| 71| accum.mul(ws[5], p[1]); 235| 71| accum.add(z[6]); 236| 71| ws[6] = accum.monty_step(p[0], p_dash); 237| 71| accum.mul(ws[0], p[7]); 238| 71| accum.mul(ws[1], p[6]); 239| 71| accum.mul(ws[2], p[5]); 240| 71| accum.mul(ws[3], p[4]); 241| 71| accum.mul(ws[4], p[3]); 242| 71| accum.mul(ws[5], p[2]); 243| 71| accum.mul(ws[6], p[1]); 244| 71| accum.add(z[7]); 245| 71| ws[7] = accum.monty_step(p[0], p_dash); 246| 71| accum.mul(ws[0], p[8]); 247| 71| accum.mul(ws[1], p[7]); 248| 71| accum.mul(ws[2], p[6]); 249| 71| accum.mul(ws[3], p[5]); 250| 71| accum.mul(ws[4], p[4]); 251| 71| accum.mul(ws[5], p[3]); 252| 71| accum.mul(ws[6], p[2]); 253| 71| accum.mul(ws[7], p[1]); 254| 71| accum.add(z[8]); 255| 71| ws[8] = accum.monty_step(p[0], p_dash); 256| 71| accum.mul(ws[0], p[9]); 257| 71| accum.mul(ws[1], p[8]); 258| 71| accum.mul(ws[2], p[7]); 259| 71| accum.mul(ws[3], p[6]); 260| 71| accum.mul(ws[4], p[5]); 261| 71| accum.mul(ws[5], p[4]); 262| 71| accum.mul(ws[6], p[3]); 263| 71| accum.mul(ws[7], p[2]); 264| 71| accum.mul(ws[8], p[1]); 265| 71| accum.add(z[9]); 266| 71| ws[9] = accum.monty_step(p[0], p_dash); 267| 71| accum.mul(ws[0], p[10]); 268| 71| accum.mul(ws[1], p[9]); 269| 71| accum.mul(ws[2], p[8]); 270| 71| accum.mul(ws[3], p[7]); 271| 71| accum.mul(ws[4], p[6]); 272| 71| accum.mul(ws[5], p[5]); 273| 71| accum.mul(ws[6], p[4]); 274| 71| accum.mul(ws[7], p[3]); 275| 71| accum.mul(ws[8], p[2]); 276| 71| accum.mul(ws[9], p[1]); 277| 71| accum.add(z[10]); 278| 71| ws[10] = accum.monty_step(p[0], p_dash); 279| 71| accum.mul(ws[0], p[11]); 280| 71| accum.mul(ws[1], p[10]); 281| 71| accum.mul(ws[2], p[9]); 282| 71| accum.mul(ws[3], p[8]); 283| 71| accum.mul(ws[4], p[7]); 284| 71| accum.mul(ws[5], p[6]); 285| 71| accum.mul(ws[6], p[5]); 286| 71| accum.mul(ws[7], p[4]); 287| 71| accum.mul(ws[8], p[3]); 288| 71| accum.mul(ws[9], p[2]); 289| 71| accum.mul(ws[10], p[1]); 290| 71| accum.add(z[11]); 291| 71| ws[11] = accum.monty_step(p[0], p_dash); 292| 71| accum.mul(ws[1], p[11]); 293| 71| accum.mul(ws[2], p[10]); 294| 71| accum.mul(ws[3], p[9]); 295| 71| accum.mul(ws[4], p[8]); 296| 71| accum.mul(ws[5], p[7]); 297| 71| accum.mul(ws[6], p[6]); 298| 71| accum.mul(ws[7], p[5]); 299| 71| accum.mul(ws[8], p[4]); 300| 71| accum.mul(ws[9], p[3]); 301| 71| accum.mul(ws[10], p[2]); 302| 71| accum.mul(ws[11], p[1]); 303| 71| accum.add(z[12]); 304| 71| ws[0] = accum.extract(); 305| 71| accum.mul(ws[2], p[11]); 306| 71| accum.mul(ws[3], p[10]); 307| 71| accum.mul(ws[4], p[9]); 308| 71| accum.mul(ws[5], p[8]); 309| 71| accum.mul(ws[6], p[7]); 310| 71| accum.mul(ws[7], p[6]); 311| 71| accum.mul(ws[8], p[5]); 312| 71| accum.mul(ws[9], p[4]); 313| 71| accum.mul(ws[10], p[3]); 314| 71| accum.mul(ws[11], p[2]); 315| 71| accum.add(z[13]); 316| 71| ws[1] = accum.extract(); 317| 71| accum.mul(ws[3], p[11]); 318| 71| accum.mul(ws[4], p[10]); 319| 71| accum.mul(ws[5], p[9]); 320| 71| accum.mul(ws[6], p[8]); 321| 71| accum.mul(ws[7], p[7]); 322| 71| accum.mul(ws[8], p[6]); 323| 71| accum.mul(ws[9], p[5]); 324| 71| accum.mul(ws[10], p[4]); 325| 71| accum.mul(ws[11], p[3]); 326| 71| accum.add(z[14]); 327| 71| ws[2] = accum.extract(); 328| 71| accum.mul(ws[4], p[11]); 329| 71| accum.mul(ws[5], p[10]); 330| 71| accum.mul(ws[6], p[9]); 331| 71| accum.mul(ws[7], p[8]); 332| 71| accum.mul(ws[8], p[7]); 333| 71| accum.mul(ws[9], p[6]); 334| 71| accum.mul(ws[10], p[5]); 335| 71| accum.mul(ws[11], p[4]); 336| 71| accum.add(z[15]); 337| 71| ws[3] = accum.extract(); 338| 71| accum.mul(ws[5], p[11]); 339| 71| accum.mul(ws[6], p[10]); 340| 71| accum.mul(ws[7], p[9]); 341| 71| accum.mul(ws[8], p[8]); 342| 71| accum.mul(ws[9], p[7]); 343| 71| accum.mul(ws[10], p[6]); 344| 71| accum.mul(ws[11], p[5]); 345| 71| accum.add(z[16]); 346| 71| ws[4] = accum.extract(); 347| 71| accum.mul(ws[6], p[11]); 348| 71| accum.mul(ws[7], p[10]); 349| 71| accum.mul(ws[8], p[9]); 350| 71| accum.mul(ws[9], p[8]); 351| 71| accum.mul(ws[10], p[7]); 352| 71| accum.mul(ws[11], p[6]); 353| 71| accum.add(z[17]); 354| 71| ws[5] = accum.extract(); 355| 71| accum.mul(ws[7], p[11]); 356| 71| accum.mul(ws[8], p[10]); 357| 71| accum.mul(ws[9], p[9]); 358| 71| accum.mul(ws[10], p[8]); 359| 71| accum.mul(ws[11], p[7]); 360| 71| accum.add(z[18]); 361| 71| ws[6] = accum.extract(); 362| 71| accum.mul(ws[8], p[11]); 363| 71| accum.mul(ws[9], p[10]); 364| 71| accum.mul(ws[10], p[9]); 365| 71| accum.mul(ws[11], p[8]); 366| 71| accum.add(z[19]); 367| 71| ws[7] = accum.extract(); 368| 71| accum.mul(ws[9], p[11]); 369| 71| accum.mul(ws[10], p[10]); 370| 71| accum.mul(ws[11], p[9]); 371| 71| accum.add(z[20]); 372| 71| ws[8] = accum.extract(); 373| 71| accum.mul(ws[10], p[11]); 374| 71| accum.mul(ws[11], p[10]); 375| 71| accum.add(z[21]); 376| 71| ws[9] = accum.extract(); 377| 71| accum.mul(ws[11], p[11]); 378| 71| accum.add(z[22]); 379| 71| ws[10] = accum.extract(); 380| 71| accum.add(z[23]); 381| 71| ws[11] = accum.extract(); 382| 71| const word w1 = accum.extract(); 383| 71| bigint_monty_maybe_sub<12>(r, w1, ws, p); 384| 71|} _ZN5Botan20bigint_monty_redc_16EPmPKmS2_mS0_: 386| 3|void bigint_monty_redc_16(word r[16], const word z[32], const word p[16], word p_dash, word ws[16]) { 387| 3| word3 accum; 388| 3| accum.add(z[0]); 389| 3| ws[0] = accum.monty_step(p[0], p_dash); 390| 3| accum.mul(ws[0], p[1]); 391| 3| accum.add(z[1]); 392| 3| ws[1] = accum.monty_step(p[0], p_dash); 393| 3| accum.mul(ws[0], p[2]); 394| 3| accum.mul(ws[1], p[1]); 395| 3| accum.add(z[2]); 396| 3| ws[2] = accum.monty_step(p[0], p_dash); 397| 3| accum.mul(ws[0], p[3]); 398| 3| accum.mul(ws[1], p[2]); 399| 3| accum.mul(ws[2], p[1]); 400| 3| accum.add(z[3]); 401| 3| ws[3] = accum.monty_step(p[0], p_dash); 402| 3| accum.mul(ws[0], p[4]); 403| 3| accum.mul(ws[1], p[3]); 404| 3| accum.mul(ws[2], p[2]); 405| 3| accum.mul(ws[3], p[1]); 406| 3| accum.add(z[4]); 407| 3| ws[4] = accum.monty_step(p[0], p_dash); 408| 3| accum.mul(ws[0], p[5]); 409| 3| accum.mul(ws[1], p[4]); 410| 3| accum.mul(ws[2], p[3]); 411| 3| accum.mul(ws[3], p[2]); 412| 3| accum.mul(ws[4], p[1]); 413| 3| accum.add(z[5]); 414| 3| ws[5] = accum.monty_step(p[0], p_dash); 415| 3| accum.mul(ws[0], p[6]); 416| 3| accum.mul(ws[1], p[5]); 417| 3| accum.mul(ws[2], p[4]); 418| 3| accum.mul(ws[3], p[3]); 419| 3| accum.mul(ws[4], p[2]); 420| 3| accum.mul(ws[5], p[1]); 421| 3| accum.add(z[6]); 422| 3| ws[6] = accum.monty_step(p[0], p_dash); 423| 3| accum.mul(ws[0], p[7]); 424| 3| accum.mul(ws[1], p[6]); 425| 3| accum.mul(ws[2], p[5]); 426| 3| accum.mul(ws[3], p[4]); 427| 3| accum.mul(ws[4], p[3]); 428| 3| accum.mul(ws[5], p[2]); 429| 3| accum.mul(ws[6], p[1]); 430| 3| accum.add(z[7]); 431| 3| ws[7] = accum.monty_step(p[0], p_dash); 432| 3| accum.mul(ws[0], p[8]); 433| 3| accum.mul(ws[1], p[7]); 434| 3| accum.mul(ws[2], p[6]); 435| 3| accum.mul(ws[3], p[5]); 436| 3| accum.mul(ws[4], p[4]); 437| 3| accum.mul(ws[5], p[3]); 438| 3| accum.mul(ws[6], p[2]); 439| 3| accum.mul(ws[7], p[1]); 440| 3| accum.add(z[8]); 441| 3| ws[8] = accum.monty_step(p[0], p_dash); 442| 3| accum.mul(ws[0], p[9]); 443| 3| accum.mul(ws[1], p[8]); 444| 3| accum.mul(ws[2], p[7]); 445| 3| accum.mul(ws[3], p[6]); 446| 3| accum.mul(ws[4], p[5]); 447| 3| accum.mul(ws[5], p[4]); 448| 3| accum.mul(ws[6], p[3]); 449| 3| accum.mul(ws[7], p[2]); 450| 3| accum.mul(ws[8], p[1]); 451| 3| accum.add(z[9]); 452| 3| ws[9] = accum.monty_step(p[0], p_dash); 453| 3| accum.mul(ws[0], p[10]); 454| 3| accum.mul(ws[1], p[9]); 455| 3| accum.mul(ws[2], p[8]); 456| 3| accum.mul(ws[3], p[7]); 457| 3| accum.mul(ws[4], p[6]); 458| 3| accum.mul(ws[5], p[5]); 459| 3| accum.mul(ws[6], p[4]); 460| 3| accum.mul(ws[7], p[3]); 461| 3| accum.mul(ws[8], p[2]); 462| 3| accum.mul(ws[9], p[1]); 463| 3| accum.add(z[10]); 464| 3| ws[10] = accum.monty_step(p[0], p_dash); 465| 3| accum.mul(ws[0], p[11]); 466| 3| accum.mul(ws[1], p[10]); 467| 3| accum.mul(ws[2], p[9]); 468| 3| accum.mul(ws[3], p[8]); 469| 3| accum.mul(ws[4], p[7]); 470| 3| accum.mul(ws[5], p[6]); 471| 3| accum.mul(ws[6], p[5]); 472| 3| accum.mul(ws[7], p[4]); 473| 3| accum.mul(ws[8], p[3]); 474| 3| accum.mul(ws[9], p[2]); 475| 3| accum.mul(ws[10], p[1]); 476| 3| accum.add(z[11]); 477| 3| ws[11] = accum.monty_step(p[0], p_dash); 478| 3| accum.mul(ws[0], p[12]); 479| 3| accum.mul(ws[1], p[11]); 480| 3| accum.mul(ws[2], p[10]); 481| 3| accum.mul(ws[3], p[9]); 482| 3| accum.mul(ws[4], p[8]); 483| 3| accum.mul(ws[5], p[7]); 484| 3| accum.mul(ws[6], p[6]); 485| 3| accum.mul(ws[7], p[5]); 486| 3| accum.mul(ws[8], p[4]); 487| 3| accum.mul(ws[9], p[3]); 488| 3| accum.mul(ws[10], p[2]); 489| 3| accum.mul(ws[11], p[1]); 490| 3| accum.add(z[12]); 491| 3| ws[12] = accum.monty_step(p[0], p_dash); 492| 3| accum.mul(ws[0], p[13]); 493| 3| accum.mul(ws[1], p[12]); 494| 3| accum.mul(ws[2], p[11]); 495| 3| accum.mul(ws[3], p[10]); 496| 3| accum.mul(ws[4], p[9]); 497| 3| accum.mul(ws[5], p[8]); 498| 3| accum.mul(ws[6], p[7]); 499| 3| accum.mul(ws[7], p[6]); 500| 3| accum.mul(ws[8], p[5]); 501| 3| accum.mul(ws[9], p[4]); 502| 3| accum.mul(ws[10], p[3]); 503| 3| accum.mul(ws[11], p[2]); 504| 3| accum.mul(ws[12], p[1]); 505| 3| accum.add(z[13]); 506| 3| ws[13] = accum.monty_step(p[0], p_dash); 507| 3| accum.mul(ws[0], p[14]); 508| 3| accum.mul(ws[1], p[13]); 509| 3| accum.mul(ws[2], p[12]); 510| 3| accum.mul(ws[3], p[11]); 511| 3| accum.mul(ws[4], p[10]); 512| 3| accum.mul(ws[5], p[9]); 513| 3| accum.mul(ws[6], p[8]); 514| 3| accum.mul(ws[7], p[7]); 515| 3| accum.mul(ws[8], p[6]); 516| 3| accum.mul(ws[9], p[5]); 517| 3| accum.mul(ws[10], p[4]); 518| 3| accum.mul(ws[11], p[3]); 519| 3| accum.mul(ws[12], p[2]); 520| 3| accum.mul(ws[13], p[1]); 521| 3| accum.add(z[14]); 522| 3| ws[14] = accum.monty_step(p[0], p_dash); 523| 3| accum.mul(ws[0], p[15]); 524| 3| accum.mul(ws[1], p[14]); 525| 3| accum.mul(ws[2], p[13]); 526| 3| accum.mul(ws[3], p[12]); 527| 3| accum.mul(ws[4], p[11]); 528| 3| accum.mul(ws[5], p[10]); 529| 3| accum.mul(ws[6], p[9]); 530| 3| accum.mul(ws[7], p[8]); 531| 3| accum.mul(ws[8], p[7]); 532| 3| accum.mul(ws[9], p[6]); 533| 3| accum.mul(ws[10], p[5]); 534| 3| accum.mul(ws[11], p[4]); 535| 3| accum.mul(ws[12], p[3]); 536| 3| accum.mul(ws[13], p[2]); 537| 3| accum.mul(ws[14], p[1]); 538| 3| accum.add(z[15]); 539| 3| ws[15] = accum.monty_step(p[0], p_dash); 540| 3| accum.mul(ws[1], p[15]); 541| 3| accum.mul(ws[2], p[14]); 542| 3| accum.mul(ws[3], p[13]); 543| 3| accum.mul(ws[4], p[12]); 544| 3| accum.mul(ws[5], p[11]); 545| 3| accum.mul(ws[6], p[10]); 546| 3| accum.mul(ws[7], p[9]); 547| 3| accum.mul(ws[8], p[8]); 548| 3| accum.mul(ws[9], p[7]); 549| 3| accum.mul(ws[10], p[6]); 550| 3| accum.mul(ws[11], p[5]); 551| 3| accum.mul(ws[12], p[4]); 552| 3| accum.mul(ws[13], p[3]); 553| 3| accum.mul(ws[14], p[2]); 554| 3| accum.mul(ws[15], p[1]); 555| 3| accum.add(z[16]); 556| 3| ws[0] = accum.extract(); 557| 3| accum.mul(ws[2], p[15]); 558| 3| accum.mul(ws[3], p[14]); 559| 3| accum.mul(ws[4], p[13]); 560| 3| accum.mul(ws[5], p[12]); 561| 3| accum.mul(ws[6], p[11]); 562| 3| accum.mul(ws[7], p[10]); 563| 3| accum.mul(ws[8], p[9]); 564| 3| accum.mul(ws[9], p[8]); 565| 3| accum.mul(ws[10], p[7]); 566| 3| accum.mul(ws[11], p[6]); 567| 3| accum.mul(ws[12], p[5]); 568| 3| accum.mul(ws[13], p[4]); 569| 3| accum.mul(ws[14], p[3]); 570| 3| accum.mul(ws[15], p[2]); 571| 3| accum.add(z[17]); 572| 3| ws[1] = accum.extract(); 573| 3| accum.mul(ws[3], p[15]); 574| 3| accum.mul(ws[4], p[14]); 575| 3| accum.mul(ws[5], p[13]); 576| 3| accum.mul(ws[6], p[12]); 577| 3| accum.mul(ws[7], p[11]); 578| 3| accum.mul(ws[8], p[10]); 579| 3| accum.mul(ws[9], p[9]); 580| 3| accum.mul(ws[10], p[8]); 581| 3| accum.mul(ws[11], p[7]); 582| 3| accum.mul(ws[12], p[6]); 583| 3| accum.mul(ws[13], p[5]); 584| 3| accum.mul(ws[14], p[4]); 585| 3| accum.mul(ws[15], p[3]); 586| 3| accum.add(z[18]); 587| 3| ws[2] = accum.extract(); 588| 3| accum.mul(ws[4], p[15]); 589| 3| accum.mul(ws[5], p[14]); 590| 3| accum.mul(ws[6], p[13]); 591| 3| accum.mul(ws[7], p[12]); 592| 3| accum.mul(ws[8], p[11]); 593| 3| accum.mul(ws[9], p[10]); 594| 3| accum.mul(ws[10], p[9]); 595| 3| accum.mul(ws[11], p[8]); 596| 3| accum.mul(ws[12], p[7]); 597| 3| accum.mul(ws[13], p[6]); 598| 3| accum.mul(ws[14], p[5]); 599| 3| accum.mul(ws[15], p[4]); 600| 3| accum.add(z[19]); 601| 3| ws[3] = accum.extract(); 602| 3| accum.mul(ws[5], p[15]); 603| 3| accum.mul(ws[6], p[14]); 604| 3| accum.mul(ws[7], p[13]); 605| 3| accum.mul(ws[8], p[12]); 606| 3| accum.mul(ws[9], p[11]); 607| 3| accum.mul(ws[10], p[10]); 608| 3| accum.mul(ws[11], p[9]); 609| 3| accum.mul(ws[12], p[8]); 610| 3| accum.mul(ws[13], p[7]); 611| 3| accum.mul(ws[14], p[6]); 612| 3| accum.mul(ws[15], p[5]); 613| 3| accum.add(z[20]); 614| 3| ws[4] = accum.extract(); 615| 3| accum.mul(ws[6], p[15]); 616| 3| accum.mul(ws[7], p[14]); 617| 3| accum.mul(ws[8], p[13]); 618| 3| accum.mul(ws[9], p[12]); 619| 3| accum.mul(ws[10], p[11]); 620| 3| accum.mul(ws[11], p[10]); 621| 3| accum.mul(ws[12], p[9]); 622| 3| accum.mul(ws[13], p[8]); 623| 3| accum.mul(ws[14], p[7]); 624| 3| accum.mul(ws[15], p[6]); 625| 3| accum.add(z[21]); 626| 3| ws[5] = accum.extract(); 627| 3| accum.mul(ws[7], p[15]); 628| 3| accum.mul(ws[8], p[14]); 629| 3| accum.mul(ws[9], p[13]); 630| 3| accum.mul(ws[10], p[12]); 631| 3| accum.mul(ws[11], p[11]); 632| 3| accum.mul(ws[12], p[10]); 633| 3| accum.mul(ws[13], p[9]); 634| 3| accum.mul(ws[14], p[8]); 635| 3| accum.mul(ws[15], p[7]); 636| 3| accum.add(z[22]); 637| 3| ws[6] = accum.extract(); 638| 3| accum.mul(ws[8], p[15]); 639| 3| accum.mul(ws[9], p[14]); 640| 3| accum.mul(ws[10], p[13]); 641| 3| accum.mul(ws[11], p[12]); 642| 3| accum.mul(ws[12], p[11]); 643| 3| accum.mul(ws[13], p[10]); 644| 3| accum.mul(ws[14], p[9]); 645| 3| accum.mul(ws[15], p[8]); 646| 3| accum.add(z[23]); 647| 3| ws[7] = accum.extract(); 648| 3| accum.mul(ws[9], p[15]); 649| 3| accum.mul(ws[10], p[14]); 650| 3| accum.mul(ws[11], p[13]); 651| 3| accum.mul(ws[12], p[12]); 652| 3| accum.mul(ws[13], p[11]); 653| 3| accum.mul(ws[14], p[10]); 654| 3| accum.mul(ws[15], p[9]); 655| 3| accum.add(z[24]); 656| 3| ws[8] = accum.extract(); 657| 3| accum.mul(ws[10], p[15]); 658| 3| accum.mul(ws[11], p[14]); 659| 3| accum.mul(ws[12], p[13]); 660| 3| accum.mul(ws[13], p[12]); 661| 3| accum.mul(ws[14], p[11]); 662| 3| accum.mul(ws[15], p[10]); 663| 3| accum.add(z[25]); 664| 3| ws[9] = accum.extract(); 665| 3| accum.mul(ws[11], p[15]); 666| 3| accum.mul(ws[12], p[14]); 667| 3| accum.mul(ws[13], p[13]); 668| 3| accum.mul(ws[14], p[12]); 669| 3| accum.mul(ws[15], p[11]); 670| 3| accum.add(z[26]); 671| 3| ws[10] = accum.extract(); 672| 3| accum.mul(ws[12], p[15]); 673| 3| accum.mul(ws[13], p[14]); 674| 3| accum.mul(ws[14], p[13]); 675| 3| accum.mul(ws[15], p[12]); 676| 3| accum.add(z[27]); 677| 3| ws[11] = accum.extract(); 678| 3| accum.mul(ws[13], p[15]); 679| 3| accum.mul(ws[14], p[14]); 680| 3| accum.mul(ws[15], p[13]); 681| 3| accum.add(z[28]); 682| 3| ws[12] = accum.extract(); 683| 3| accum.mul(ws[14], p[15]); 684| 3| accum.mul(ws[15], p[14]); 685| 3| accum.add(z[29]); 686| 3| ws[13] = accum.extract(); 687| 3| accum.mul(ws[15], p[15]); 688| 3| accum.add(z[30]); 689| 3| ws[14] = accum.extract(); 690| 3| accum.add(z[31]); 691| 3| ws[15] = accum.extract(); 692| 3| const word w1 = accum.extract(); 693| 3| bigint_monty_maybe_sub<16>(r, w1, ws, p); 694| 3|} _ZN5Botan21bigint_mulx_monty_mulEPmPKmS2_S2_mmS0_: 111| 88.8k|void bigint_mulx_monty_mul(word z[], const word x[], const word y[], const word p[], size_t N, word p_dash, word ws[]) { 112| | // t[-1] receives the word shifted out by each reduction row 113| 88.8k| word* t = ws + 1; 114| 88.8k| clear_mem(ws, N + 3); 115| | 116| 894k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (116:22): [True: 805k, False: 88.8k] ------------------ 117| 805k| monty_row(t, t, x, N, y[i], 0); 118| 805k| const word m = t[0] * p_dash; 119| 805k| monty_row(t - 1, t, p, N, m, 0); 120| 805k| t[N + 1] = 0; 121| 805k| } 122| | 123| | // The result is below 2p, with t[N] holding its top bit 124| 88.8k| bigint_monty_maybe_sub(N, z, t[N], t, p); 125| 88.8k|} _ZN5Botan21bigint_mulx_monty_sqrEPmPKmS2_mmS0_: 127| 229k|void bigint_mulx_monty_sqr(word z[], const word x[], const word p[], size_t N, word p_dash, word ws[]) { 128| 229k| bigint_mulx_sqr(ws, x, N); 129| 229k| bigint_mulx_monty_redc(z, ws, p, N, p_dash); 130| 229k|} _ZN5Botan15bigint_mulx_sqrEPmPKmm: 132| 229k|void bigint_mulx_sqr(word z[], const word x[], size_t N) { 133| 229k| clear_mem(z, 2 * N + 1); 134| | 135| | /* 136| | * x is split into a leading block of N % 8 words followed by blocks of 8 137| | * words. Rows from the leading block cover every product x[i]*x[j] with 138| | * j > i; rows from the other blocks cover only products with x[j] in a 139| | * later block, so their lengths are multiples of 8. 140| | */ 141| 229k| const size_t lead = N % 8; 142| | 143| 463k| for(size_t i = 0; i != lead; ++i) { ------------------ | Branch (143:22): [True: 234k, False: 229k] ------------------ 144| 234k| monty_row(z + 2 * i + 1, z + 2 * i + 1, x + i + 1, N - i - 1, x[i], 0); 145| 234k| } 146| | 147| 229k| for(size_t b = lead; b + 8 < N; b += 8) { ------------------ | Branch (147:25): [True: 604, False: 229k] ------------------ 148| 5.43k| for(size_t i = b; i != b + 8; ++i) { ------------------ | Branch (148:25): [True: 4.83k, False: 604] ------------------ 149| 4.83k| monty_row(z + i + b + 8, z + i + b + 8, x + b + 8, N - b - 8, x[i], 0); 150| 4.83k| } 151| 604| } 152| | 153| | // Double the products while adding the squares not yet included, which together cover z[0..2N) 154| 229k| word carry = 0; 155| 229k| word top = 0; 156| 229k| auto double_and_add = [&](size_t k, word s) { 157| 229k| const word w = z[k]; 158| 229k| z[k] = word_add((w << 1) | top, s, &carry); 159| 229k| top = w >> (WordInfo::bits - 1); 160| 229k| }; 161| | 162| 463k| for(size_t i = 0; i != lead; ++i) { ------------------ | Branch (162:22): [True: 234k, False: 229k] ------------------ 163| 234k| word hi = 0; 164| 234k| const word lo = word_madd2(x[i], x[i], &hi); 165| 234k| double_and_add(2 * i, lo); 166| 234k| double_and_add(2 * i + 1, hi); 167| 234k| } 168| | 169| 459k| for(size_t b = lead; b != N; b += 8) { ------------------ | Branch (169:25): [True: 229k, False: 229k] ------------------ 170| 229k| std::array sq{}; 171| 229k| bigint_mulx_sqr8(sq.data(), x + b); 172| 3.90M| for(size_t k = 0; k != 16; ++k) { ------------------ | Branch (172:25): [True: 3.67M, False: 229k] ------------------ 173| 3.67M| double_and_add(2 * b + k, sq[k]); 174| 3.67M| } 175| 229k| } 176| | 177| | // The square fits in 2N words 178| 229k| BOTAN_DEBUG_ASSERT(carry == 0 && top == 0); ------------------ | | 137| 229k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 229k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 229k] | | ------------------ ------------------ 179| 229k|} _ZN5Botan22bigint_mulx_monty_redcEPmS0_PKmmm: 181| 229k|void bigint_mulx_monty_redc(word r[], word z[], const word p[], size_t N, word p_dash) { 182| 229k| z[2 * N] = 0; 183| | 184| 229k| word c = 0; 185| 2.30M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (185:22): [True: 2.07M, False: 229k] ------------------ 186| 2.07M| const word m = z[i] * p_dash; 187| 2.07M| c = monty_row(z + i, z + i, p, N, m, c); 188| 2.07M| } 189| | 190| | // The sum is below 2p * B^N, so the final carry is zero and the top bit is z[2N] 191| 229k| BOTAN_DEBUG_ASSERT(c == 0); ------------------ | | 137| 229k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 229k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 229k] | | ------------------ ------------------ 192| 229k| bigint_monty_maybe_sub(N, r, z[2 * N], z + N, p); 193| 229k|} mp_monty_mulx.cpp:_ZN5Botan12_GLOBAL__N_19monty_rowEPmPKmS3_mmm: 84| 3.92M|BOTAN_FORCE_INLINE word monty_row(word* out, const word* t, const word* x, size_t N, word b, word c) { 85| 3.92M| word carry = 0; 86| | // Advancing the pointers, rather than indexing, keeps the compiler from generating a slower loop 87| 7.87M| for(size_t i = N / 8; i != 0; --i) { ------------------ | Branch (87:26): [True: 3.94M, False: 3.92M] ------------------ 88| 3.94M| carry = muladd8(out, t, x, b, carry); 89| 3.94M| out += 8; 90| 3.94M| t += 8; 91| 3.94M| x += 8; 92| 3.94M| } 93| 3.92M| if(N % 8 >= 4) { ------------------ | Branch (93:7): [True: 43.7k, False: 3.88M] ------------------ 94| 43.7k| carry = muladd4(out, t, x, b, carry); 95| 43.7k| out += 4; 96| 43.7k| t += 4; 97| 43.7k| x += 4; 98| 43.7k| } 99| 7.61M| for(size_t i = N % 4; i != 0; --i) { ------------------ | Branch (99:26): [True: 3.69M, False: 3.92M] ------------------ 100| 3.69M| *out++ = word_madd3(*x++, b, *t++, &carry); 101| 3.69M| } 102| | 103| 3.92M| word c2 = 0; 104| 3.92M| out[0] = word_add(t[0], carry, &c2); 105| 3.92M| out[1] = word_add(t[1], c, &c2); 106| 3.92M| return c2; 107| 3.92M|} mp_monty_mulx.cpp:_ZN5Botan12_GLOBAL__N_17muladd8EPmPKmS3_mm: 60| 3.94M|BOTAN_FORCE_INLINE word muladd8(word* out, const word* t, const word* x, word b, word carry) { 61| 3.94M| word tmp = 0; 62| 3.94M| word lo = 0; 63| 3.94M| word zero = 0; 64| 3.94M| BOTAN_MULADD_ASM(BOTAN_MULADD_STEPS8); ------------------ | | 38| 3.94M| asm volatile("xorl %k[zero], %k[zero]\n\t" \ | | 39| 3.94M| STEPS \ | | 40| 3.94M| "adox %[zero], %[carry]\n\t" \ | | 41| 3.94M| "adcx %[zero], %[carry]\n\t" \ | | 42| 3.94M| : [carry] "+&r"(carry), [tmp] "=&r"(tmp), [lo] "=&r"(lo), [zero] "=&r"(zero) \ | | 43| 3.94M| : [out] "r"(out), [t] "r"(t), [x] "r"(x), "d"(b) \ | | 44| 3.94M| : "cc", "memory") ------------------ 65| 3.94M| return carry; 66| 3.94M|} mp_monty_mulx.cpp:_ZN5Botan12_GLOBAL__N_17muladd4EPmPKmS3_mm: 69| 43.7k|BOTAN_FORCE_INLINE word muladd4(word* out, const word* t, const word* x, word b, word carry) { 70| 43.7k| word tmp = 0; 71| 43.7k| word lo = 0; 72| 43.7k| word zero = 0; 73| 43.7k| BOTAN_MULADD_ASM(BOTAN_MULADD_STEPS4); ------------------ | | 38| 43.7k| asm volatile("xorl %k[zero], %k[zero]\n\t" \ | | 39| 43.7k| STEPS \ | | 40| 43.7k| "adox %[zero], %[carry]\n\t" \ | | 41| 43.7k| "adcx %[zero], %[carry]\n\t" \ | | 42| 43.7k| : [carry] "+&r"(carry), [tmp] "=&r"(tmp), [lo] "=&r"(lo), [zero] "=&r"(zero) \ | | 43| 43.7k| : [out] "r"(out), [t] "r"(t), [x] "r"(x), "d"(b) \ | | 44| 43.7k| : "cc", "memory") ------------------ 74| 43.7k| return carry; 75| 43.7k|} mp_monty_mulx.cpp:_ZZN5Botan15bigint_mulx_sqrEPmPKmmENK3$_0clEmm: 156| 4.14M| auto double_and_add = [&](size_t k, word s) { 157| 4.14M| const word w = z[k]; 158| 4.14M| z[k] = word_add((w << 1) | top, s, &carry); 159| 4.14M| top = w >> (WordInfo::bits - 1); 160| 4.14M| }; _ZN5Botan16bigint_mulx_sqr4EPmPKm: 27| 3.32M|void bigint_mulx_sqr4(word z[8], const word x[4]) { 28| | // clang-format off 29| 3.32M| asm( 30| 3.32M| "xorl %%r9d, %%r9d\n\t" 31| 3.32M| "xorl %%r10d, %%r10d\n\t" 32| 3.32M| "xorl %%r8d, %%r8d\n\t" 33| | 34| 3.32M| "movq 0(%[x]), %%rdx\n\t" // x[0] * x[1..3] 35| 3.32M| "xorl %%eax, %%eax\n\t" 36| 3.32M| "mulx 8(%[x]), %%rax, %%rcx\n\t" 37| 3.32M| "adcx %%rax, %%r9\n\t" 38| 3.32M| "movq %%r9, 8(%[z])\n\t" 39| 3.32M| "mulx 16(%[x]), %%rax, %%r9\n\t" 40| 3.32M| "adox %%rcx, %%rax\n\t" 41| 3.32M| "adcx %%rax, %%r10\n\t" 42| 3.32M| "mulx 24(%[x]), %%rax, %%rcx\n\t" 43| 3.32M| "adox %%r9, %%rax\n\t" 44| 3.32M| "adcx %%rax, %%r8\n\t" 45| 3.32M| "movl $0, %%eax\n\t" 46| 3.32M| "adox %%rax, %%rcx\n\t" 47| 3.32M| "adcx %%rax, %%rcx\n\t" 48| 3.32M| "movq %%rcx, %%r9\n\t" 49| 3.32M| "movq %%r10, 16(%[z])\n\t" 50| | 51| 3.32M| "movq 8(%[x]), %%rdx\n\t" // x[1] * x[2..3] 52| 3.32M| "xorl %%eax, %%eax\n\t" 53| 3.32M| "mulx 16(%[x]), %%rax, %%rcx\n\t" 54| 3.32M| "adcx %%rax, %%r8\n\t" 55| 3.32M| "movq %%r8, 24(%[z])\n\t" 56| 3.32M| "mulx 24(%[x]), %%rax, %%r10\n\t" 57| 3.32M| "adox %%rcx, %%rax\n\t" 58| 3.32M| "adcx %%rax, %%r9\n\t" 59| 3.32M| "movl $0, %%eax\n\t" 60| 3.32M| "adox %%rax, %%r10\n\t" 61| 3.32M| "adcx %%rax, %%r10\n\t" 62| 3.32M| "movq %%r9, 32(%[z])\n\t" 63| | 64| 3.32M| "movq 16(%[x]), %%rdx\n\t" // x[2] * x[3..3] 65| 3.32M| "xorl %%eax, %%eax\n\t" 66| 3.32M| "mulx 24(%[x]), %%rax, %%rcx\n\t" 67| 3.32M| "adcx %%rax, %%r10\n\t" 68| 3.32M| "movq %%r10, 40(%[z])\n\t" 69| 3.32M| "movl $0, %%eax\n\t" 70| 3.32M| "adox %%rax, %%rcx\n\t" 71| 3.32M| "adcx %%rax, %%rcx\n\t" 72| 3.32M| "movq %%rcx, %%r8\n\t" 73| 3.32M| "movq %%r8, 48(%[z])\n\t" 74| | 75| 3.32M| "movq $0, 56(%[z])\n\t" 76| 3.32M| "xorl %%eax, %%eax\n\t" // double the cross products and add the squares 77| 3.32M| "movq 0(%[x]), %%rdx\n\t" 78| 3.32M| "mulx %%rdx, %%rax, %%rcx\n\t" 79| 3.32M| "movq %%rax, 0(%[z])\n\t" 80| 3.32M| "movq 8(%[z]), %%r8\n\t" 81| 3.32M| "adcx %%r8, %%r8\n\t" 82| 3.32M| "adox %%rcx, %%r8\n\t" 83| 3.32M| "movq %%r8, 8(%[z])\n\t" 84| 3.32M| "movq 8(%[x]), %%rdx\n\t" 85| 3.32M| "mulx %%rdx, %%rax, %%rcx\n\t" 86| 3.32M| "movq 16(%[z]), %%r8\n\t" 87| 3.32M| "adcx %%r8, %%r8\n\t" 88| 3.32M| "adox %%rax, %%r8\n\t" 89| 3.32M| "movq %%r8, 16(%[z])\n\t" 90| 3.32M| "movq 24(%[z]), %%r8\n\t" 91| 3.32M| "adcx %%r8, %%r8\n\t" 92| 3.32M| "adox %%rcx, %%r8\n\t" 93| 3.32M| "movq %%r8, 24(%[z])\n\t" 94| 3.32M| "movq 16(%[x]), %%rdx\n\t" 95| 3.32M| "mulx %%rdx, %%rax, %%rcx\n\t" 96| 3.32M| "movq 32(%[z]), %%r8\n\t" 97| 3.32M| "adcx %%r8, %%r8\n\t" 98| 3.32M| "adox %%rax, %%r8\n\t" 99| 3.32M| "movq %%r8, 32(%[z])\n\t" 100| 3.32M| "movq 40(%[z]), %%r8\n\t" 101| 3.32M| "adcx %%r8, %%r8\n\t" 102| 3.32M| "adox %%rcx, %%r8\n\t" 103| 3.32M| "movq %%r8, 40(%[z])\n\t" 104| 3.32M| "movq 24(%[x]), %%rdx\n\t" 105| 3.32M| "mulx %%rdx, %%rax, %%rcx\n\t" 106| 3.32M| "movq 48(%[z]), %%r8\n\t" 107| 3.32M| "adcx %%r8, %%r8\n\t" 108| 3.32M| "adox %%rax, %%r8\n\t" 109| 3.32M| "movq %%r8, 48(%[z])\n\t" 110| 3.32M| "movq 56(%[z]), %%r8\n\t" 111| 3.32M| "adcx %%r8, %%r8\n\t" 112| 3.32M| "adox %%rcx, %%r8\n\t" 113| 3.32M| "movq %%r8, 56(%[z])\n\t" 114| 3.32M| : 115| 3.32M| : [z] "r"(z), [x] "r"(x) 116| 3.32M| : "rax", "rcx", "rdx", "r8", "r9", "r10", "cc", "memory"); 117| | // clang-format on 118| 3.32M|} _ZN5Botan16bigint_mulx_mul4EPmPKmS2_: 120| 5.84M|void bigint_mulx_mul4(word z[8], const word x[4], const word y[4]) { 121| | // clang-format off 122| 5.84M| asm( 123| 5.84M| "xorl %%r8d, %%r8d\n\t" 124| 5.84M| "xorl %%r9d, %%r9d\n\t" 125| 5.84M| "xorl %%r10d, %%r10d\n\t" 126| 5.84M| "xorl %%r11d, %%r11d\n\t" 127| | 128| 5.84M| "movq 0(%[y]), %%rdx\n\t" // row 0: x * y[0] 129| 5.84M| "xorl %%eax, %%eax\n\t" 130| 5.84M| "mulx 0(%[x]), %%rax, %%rcx\n\t" 131| 5.84M| "adcx %%rax, %%r8\n\t" 132| 5.84M| "movq %%r8, 0(%[z])\n\t" 133| 5.84M| "mulx 8(%[x]), %%rax, %%r8\n\t" 134| 5.84M| "adox %%rcx, %%rax\n\t" 135| 5.84M| "adcx %%rax, %%r9\n\t" 136| 5.84M| "mulx 16(%[x]), %%rax, %%rcx\n\t" 137| 5.84M| "adox %%r8, %%rax\n\t" 138| 5.84M| "adcx %%rax, %%r10\n\t" 139| 5.84M| "mulx 24(%[x]), %%rax, %%r8\n\t" 140| 5.84M| "adox %%rcx, %%rax\n\t" 141| 5.84M| "adcx %%rax, %%r11\n\t" 142| 5.84M| "movl $0, %%eax\n\t" 143| 5.84M| "adox %%rax, %%r8\n\t" 144| 5.84M| "adcx %%rax, %%r8\n\t" 145| | 146| 5.84M| "movq 8(%[y]), %%rdx\n\t" // row 1: x * y[1] 147| 5.84M| "xorl %%eax, %%eax\n\t" 148| 5.84M| "mulx 0(%[x]), %%rax, %%rcx\n\t" 149| 5.84M| "adcx %%rax, %%r9\n\t" 150| 5.84M| "movq %%r9, 8(%[z])\n\t" 151| 5.84M| "mulx 8(%[x]), %%rax, %%r9\n\t" 152| 5.84M| "adox %%rcx, %%rax\n\t" 153| 5.84M| "adcx %%rax, %%r10\n\t" 154| 5.84M| "mulx 16(%[x]), %%rax, %%rcx\n\t" 155| 5.84M| "adox %%r9, %%rax\n\t" 156| 5.84M| "adcx %%rax, %%r11\n\t" 157| 5.84M| "mulx 24(%[x]), %%rax, %%r9\n\t" 158| 5.84M| "adox %%rcx, %%rax\n\t" 159| 5.84M| "adcx %%rax, %%r8\n\t" 160| 5.84M| "movl $0, %%eax\n\t" 161| 5.84M| "adox %%rax, %%r9\n\t" 162| 5.84M| "adcx %%rax, %%r9\n\t" 163| | 164| 5.84M| "movq 16(%[y]), %%rdx\n\t" // row 2: x * y[2] 165| 5.84M| "xorl %%eax, %%eax\n\t" 166| 5.84M| "mulx 0(%[x]), %%rax, %%rcx\n\t" 167| 5.84M| "adcx %%rax, %%r10\n\t" 168| 5.84M| "movq %%r10, 16(%[z])\n\t" 169| 5.84M| "mulx 8(%[x]), %%rax, %%r10\n\t" 170| 5.84M| "adox %%rcx, %%rax\n\t" 171| 5.84M| "adcx %%rax, %%r11\n\t" 172| 5.84M| "mulx 16(%[x]), %%rax, %%rcx\n\t" 173| 5.84M| "adox %%r10, %%rax\n\t" 174| 5.84M| "adcx %%rax, %%r8\n\t" 175| 5.84M| "mulx 24(%[x]), %%rax, %%r10\n\t" 176| 5.84M| "adox %%rcx, %%rax\n\t" 177| 5.84M| "adcx %%rax, %%r9\n\t" 178| 5.84M| "movl $0, %%eax\n\t" 179| 5.84M| "adox %%rax, %%r10\n\t" 180| 5.84M| "adcx %%rax, %%r10\n\t" 181| | 182| 5.84M| "movq 24(%[y]), %%rdx\n\t" // row 3: x * y[3] 183| 5.84M| "xorl %%eax, %%eax\n\t" 184| 5.84M| "mulx 0(%[x]), %%rax, %%rcx\n\t" 185| 5.84M| "adcx %%rax, %%r11\n\t" 186| 5.84M| "movq %%r11, 24(%[z])\n\t" 187| 5.84M| "mulx 8(%[x]), %%rax, %%r11\n\t" 188| 5.84M| "adox %%rcx, %%rax\n\t" 189| 5.84M| "adcx %%rax, %%r8\n\t" 190| 5.84M| "mulx 16(%[x]), %%rax, %%rcx\n\t" 191| 5.84M| "adox %%r11, %%rax\n\t" 192| 5.84M| "adcx %%rax, %%r9\n\t" 193| 5.84M| "mulx 24(%[x]), %%rax, %%r11\n\t" 194| 5.84M| "adox %%rcx, %%rax\n\t" 195| 5.84M| "adcx %%rax, %%r10\n\t" 196| 5.84M| "movl $0, %%eax\n\t" 197| 5.84M| "adox %%rax, %%r11\n\t" 198| 5.84M| "adcx %%rax, %%r11\n\t" 199| | 200| 5.84M| "movq %%r8, 32(%[z])\n\t" 201| 5.84M| "movq %%r9, 40(%[z])\n\t" 202| 5.84M| "movq %%r10, 48(%[z])\n\t" 203| 5.84M| "movq %%r11, 56(%[z])\n\t" 204| 5.84M| : 205| 5.84M| : [z] "r"(z), [x] "r"(x), [y] "r"(y) 206| 5.84M| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "cc", "memory"); 207| | // clang-format on 208| 5.84M|} _ZN5Botan16bigint_mulx_sqr6EPmPKm: 210| 227k|void bigint_mulx_sqr6(word z[12], const word x[6]) { 211| | // clang-format off 212| 227k| asm( 213| 227k| "xorl %%r9d, %%r9d\n\t" 214| 227k| "xorl %%r10d, %%r10d\n\t" 215| 227k| "xorl %%r11d, %%r11d\n\t" 216| 227k| "xorl %%r12d, %%r12d\n\t" 217| 227k| "xorl %%r8d, %%r8d\n\t" 218| | 219| 227k| "movq 0(%[x]), %%rdx\n\t" // x[0] * x[1..5] 220| 227k| "xorl %%eax, %%eax\n\t" 221| 227k| "mulx 8(%[x]), %%rax, %%rcx\n\t" 222| 227k| "adcx %%rax, %%r9\n\t" 223| 227k| "movq %%r9, 8(%[z])\n\t" 224| 227k| "mulx 16(%[x]), %%rax, %%r9\n\t" 225| 227k| "adox %%rcx, %%rax\n\t" 226| 227k| "adcx %%rax, %%r10\n\t" 227| 227k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 228| 227k| "adox %%r9, %%rax\n\t" 229| 227k| "adcx %%rax, %%r11\n\t" 230| 227k| "mulx 32(%[x]), %%rax, %%r9\n\t" 231| 227k| "adox %%rcx, %%rax\n\t" 232| 227k| "adcx %%rax, %%r12\n\t" 233| 227k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 234| 227k| "adox %%r9, %%rax\n\t" 235| 227k| "adcx %%rax, %%r8\n\t" 236| 227k| "movl $0, %%eax\n\t" 237| 227k| "adox %%rax, %%rcx\n\t" 238| 227k| "adcx %%rax, %%rcx\n\t" 239| 227k| "movq %%rcx, %%r9\n\t" 240| 227k| "movq %%r10, 16(%[z])\n\t" 241| | 242| 227k| "movq 8(%[x]), %%rdx\n\t" // x[1] * x[2..5] 243| 227k| "xorl %%eax, %%eax\n\t" 244| 227k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 245| 227k| "adcx %%rax, %%r11\n\t" 246| 227k| "movq %%r11, 24(%[z])\n\t" 247| 227k| "mulx 24(%[x]), %%rax, %%r10\n\t" 248| 227k| "adox %%rcx, %%rax\n\t" 249| 227k| "adcx %%rax, %%r12\n\t" 250| 227k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 251| 227k| "adox %%r10, %%rax\n\t" 252| 227k| "adcx %%rax, %%r8\n\t" 253| 227k| "mulx 40(%[x]), %%rax, %%r10\n\t" 254| 227k| "adox %%rcx, %%rax\n\t" 255| 227k| "adcx %%rax, %%r9\n\t" 256| 227k| "movl $0, %%eax\n\t" 257| 227k| "adox %%rax, %%r10\n\t" 258| 227k| "adcx %%rax, %%r10\n\t" 259| 227k| "movq %%r12, 32(%[z])\n\t" 260| | 261| 227k| "movq 16(%[x]), %%rdx\n\t" // x[2] * x[3..5] 262| 227k| "xorl %%eax, %%eax\n\t" 263| 227k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 264| 227k| "adcx %%rax, %%r8\n\t" 265| 227k| "movq %%r8, 40(%[z])\n\t" 266| 227k| "mulx 32(%[x]), %%rax, %%r11\n\t" 267| 227k| "adox %%rcx, %%rax\n\t" 268| 227k| "adcx %%rax, %%r9\n\t" 269| 227k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 270| 227k| "adox %%r11, %%rax\n\t" 271| 227k| "adcx %%rax, %%r10\n\t" 272| 227k| "movl $0, %%eax\n\t" 273| 227k| "adox %%rax, %%rcx\n\t" 274| 227k| "adcx %%rax, %%rcx\n\t" 275| 227k| "movq %%rcx, %%r11\n\t" 276| 227k| "movq %%r9, 48(%[z])\n\t" 277| | 278| 227k| "movq 24(%[x]), %%rdx\n\t" // x[3] * x[4..5] 279| 227k| "xorl %%eax, %%eax\n\t" 280| 227k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 281| 227k| "adcx %%rax, %%r10\n\t" 282| 227k| "movq %%r10, 56(%[z])\n\t" 283| 227k| "mulx 40(%[x]), %%rax, %%r12\n\t" 284| 227k| "adox %%rcx, %%rax\n\t" 285| 227k| "adcx %%rax, %%r11\n\t" 286| 227k| "movl $0, %%eax\n\t" 287| 227k| "adox %%rax, %%r12\n\t" 288| 227k| "adcx %%rax, %%r12\n\t" 289| 227k| "movq %%r11, 64(%[z])\n\t" 290| | 291| 227k| "movq 32(%[x]), %%rdx\n\t" // x[4] * x[5..5] 292| 227k| "xorl %%eax, %%eax\n\t" 293| 227k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 294| 227k| "adcx %%rax, %%r12\n\t" 295| 227k| "movq %%r12, 72(%[z])\n\t" 296| 227k| "movl $0, %%eax\n\t" 297| 227k| "adox %%rax, %%rcx\n\t" 298| 227k| "adcx %%rax, %%rcx\n\t" 299| 227k| "movq %%rcx, %%r8\n\t" 300| 227k| "movq %%r8, 80(%[z])\n\t" 301| | 302| 227k| "movq $0, 88(%[z])\n\t" 303| 227k| "xorl %%eax, %%eax\n\t" // double the cross products and add the squares 304| 227k| "movq 0(%[x]), %%rdx\n\t" 305| 227k| "mulx %%rdx, %%rax, %%rcx\n\t" 306| 227k| "movq %%rax, 0(%[z])\n\t" 307| 227k| "movq 8(%[z]), %%r8\n\t" 308| 227k| "adcx %%r8, %%r8\n\t" 309| 227k| "adox %%rcx, %%r8\n\t" 310| 227k| "movq %%r8, 8(%[z])\n\t" 311| 227k| "movq 8(%[x]), %%rdx\n\t" 312| 227k| "mulx %%rdx, %%rax, %%rcx\n\t" 313| 227k| "movq 16(%[z]), %%r8\n\t" 314| 227k| "adcx %%r8, %%r8\n\t" 315| 227k| "adox %%rax, %%r8\n\t" 316| 227k| "movq %%r8, 16(%[z])\n\t" 317| 227k| "movq 24(%[z]), %%r8\n\t" 318| 227k| "adcx %%r8, %%r8\n\t" 319| 227k| "adox %%rcx, %%r8\n\t" 320| 227k| "movq %%r8, 24(%[z])\n\t" 321| 227k| "movq 16(%[x]), %%rdx\n\t" 322| 227k| "mulx %%rdx, %%rax, %%rcx\n\t" 323| 227k| "movq 32(%[z]), %%r8\n\t" 324| 227k| "adcx %%r8, %%r8\n\t" 325| 227k| "adox %%rax, %%r8\n\t" 326| 227k| "movq %%r8, 32(%[z])\n\t" 327| 227k| "movq 40(%[z]), %%r8\n\t" 328| 227k| "adcx %%r8, %%r8\n\t" 329| 227k| "adox %%rcx, %%r8\n\t" 330| 227k| "movq %%r8, 40(%[z])\n\t" 331| 227k| "movq 24(%[x]), %%rdx\n\t" 332| 227k| "mulx %%rdx, %%rax, %%rcx\n\t" 333| 227k| "movq 48(%[z]), %%r8\n\t" 334| 227k| "adcx %%r8, %%r8\n\t" 335| 227k| "adox %%rax, %%r8\n\t" 336| 227k| "movq %%r8, 48(%[z])\n\t" 337| 227k| "movq 56(%[z]), %%r8\n\t" 338| 227k| "adcx %%r8, %%r8\n\t" 339| 227k| "adox %%rcx, %%r8\n\t" 340| 227k| "movq %%r8, 56(%[z])\n\t" 341| 227k| "movq 32(%[x]), %%rdx\n\t" 342| 227k| "mulx %%rdx, %%rax, %%rcx\n\t" 343| 227k| "movq 64(%[z]), %%r8\n\t" 344| 227k| "adcx %%r8, %%r8\n\t" 345| 227k| "adox %%rax, %%r8\n\t" 346| 227k| "movq %%r8, 64(%[z])\n\t" 347| 227k| "movq 72(%[z]), %%r8\n\t" 348| 227k| "adcx %%r8, %%r8\n\t" 349| 227k| "adox %%rcx, %%r8\n\t" 350| 227k| "movq %%r8, 72(%[z])\n\t" 351| 227k| "movq 40(%[x]), %%rdx\n\t" 352| 227k| "mulx %%rdx, %%rax, %%rcx\n\t" 353| 227k| "movq 80(%[z]), %%r8\n\t" 354| 227k| "adcx %%r8, %%r8\n\t" 355| 227k| "adox %%rax, %%r8\n\t" 356| 227k| "movq %%r8, 80(%[z])\n\t" 357| 227k| "movq 88(%[z]), %%r8\n\t" 358| 227k| "adcx %%r8, %%r8\n\t" 359| 227k| "adox %%rcx, %%r8\n\t" 360| 227k| "movq %%r8, 88(%[z])\n\t" 361| 227k| : 362| 227k| : [z] "r"(z), [x] "r"(x) 363| 227k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "cc", "memory"); 364| | // clang-format on 365| 227k|} _ZN5Botan16bigint_mulx_mul6EPmPKmS2_: 367| 293k|void bigint_mulx_mul6(word z[12], const word x[6], const word y[6]) { 368| | // clang-format off 369| 293k| asm( 370| 293k| "xorl %%r8d, %%r8d\n\t" 371| 293k| "xorl %%r9d, %%r9d\n\t" 372| 293k| "xorl %%r10d, %%r10d\n\t" 373| 293k| "xorl %%r11d, %%r11d\n\t" 374| 293k| "xorl %%r12d, %%r12d\n\t" 375| 293k| "xorl %%r13d, %%r13d\n\t" 376| | 377| 293k| "movq 0(%[y]), %%rdx\n\t" // row 0: x * y[0] 378| 293k| "xorl %%eax, %%eax\n\t" 379| 293k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 380| 293k| "adcx %%rax, %%r8\n\t" 381| 293k| "movq %%r8, 0(%[z])\n\t" 382| 293k| "mulx 8(%[x]), %%rax, %%r8\n\t" 383| 293k| "adox %%rcx, %%rax\n\t" 384| 293k| "adcx %%rax, %%r9\n\t" 385| 293k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 386| 293k| "adox %%r8, %%rax\n\t" 387| 293k| "adcx %%rax, %%r10\n\t" 388| 293k| "mulx 24(%[x]), %%rax, %%r8\n\t" 389| 293k| "adox %%rcx, %%rax\n\t" 390| 293k| "adcx %%rax, %%r11\n\t" 391| 293k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 392| 293k| "adox %%r8, %%rax\n\t" 393| 293k| "adcx %%rax, %%r12\n\t" 394| 293k| "mulx 40(%[x]), %%rax, %%r8\n\t" 395| 293k| "adox %%rcx, %%rax\n\t" 396| 293k| "adcx %%rax, %%r13\n\t" 397| 293k| "movl $0, %%eax\n\t" 398| 293k| "adox %%rax, %%r8\n\t" 399| 293k| "adcx %%rax, %%r8\n\t" 400| | 401| 293k| "movq 8(%[y]), %%rdx\n\t" // row 1: x * y[1] 402| 293k| "xorl %%eax, %%eax\n\t" 403| 293k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 404| 293k| "adcx %%rax, %%r9\n\t" 405| 293k| "movq %%r9, 8(%[z])\n\t" 406| 293k| "mulx 8(%[x]), %%rax, %%r9\n\t" 407| 293k| "adox %%rcx, %%rax\n\t" 408| 293k| "adcx %%rax, %%r10\n\t" 409| 293k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 410| 293k| "adox %%r9, %%rax\n\t" 411| 293k| "adcx %%rax, %%r11\n\t" 412| 293k| "mulx 24(%[x]), %%rax, %%r9\n\t" 413| 293k| "adox %%rcx, %%rax\n\t" 414| 293k| "adcx %%rax, %%r12\n\t" 415| 293k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 416| 293k| "adox %%r9, %%rax\n\t" 417| 293k| "adcx %%rax, %%r13\n\t" 418| 293k| "mulx 40(%[x]), %%rax, %%r9\n\t" 419| 293k| "adox %%rcx, %%rax\n\t" 420| 293k| "adcx %%rax, %%r8\n\t" 421| 293k| "movl $0, %%eax\n\t" 422| 293k| "adox %%rax, %%r9\n\t" 423| 293k| "adcx %%rax, %%r9\n\t" 424| | 425| 293k| "movq 16(%[y]), %%rdx\n\t" // row 2: x * y[2] 426| 293k| "xorl %%eax, %%eax\n\t" 427| 293k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 428| 293k| "adcx %%rax, %%r10\n\t" 429| 293k| "movq %%r10, 16(%[z])\n\t" 430| 293k| "mulx 8(%[x]), %%rax, %%r10\n\t" 431| 293k| "adox %%rcx, %%rax\n\t" 432| 293k| "adcx %%rax, %%r11\n\t" 433| 293k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 434| 293k| "adox %%r10, %%rax\n\t" 435| 293k| "adcx %%rax, %%r12\n\t" 436| 293k| "mulx 24(%[x]), %%rax, %%r10\n\t" 437| 293k| "adox %%rcx, %%rax\n\t" 438| 293k| "adcx %%rax, %%r13\n\t" 439| 293k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 440| 293k| "adox %%r10, %%rax\n\t" 441| 293k| "adcx %%rax, %%r8\n\t" 442| 293k| "mulx 40(%[x]), %%rax, %%r10\n\t" 443| 293k| "adox %%rcx, %%rax\n\t" 444| 293k| "adcx %%rax, %%r9\n\t" 445| 293k| "movl $0, %%eax\n\t" 446| 293k| "adox %%rax, %%r10\n\t" 447| 293k| "adcx %%rax, %%r10\n\t" 448| | 449| 293k| "movq 24(%[y]), %%rdx\n\t" // row 3: x * y[3] 450| 293k| "xorl %%eax, %%eax\n\t" 451| 293k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 452| 293k| "adcx %%rax, %%r11\n\t" 453| 293k| "movq %%r11, 24(%[z])\n\t" 454| 293k| "mulx 8(%[x]), %%rax, %%r11\n\t" 455| 293k| "adox %%rcx, %%rax\n\t" 456| 293k| "adcx %%rax, %%r12\n\t" 457| 293k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 458| 293k| "adox %%r11, %%rax\n\t" 459| 293k| "adcx %%rax, %%r13\n\t" 460| 293k| "mulx 24(%[x]), %%rax, %%r11\n\t" 461| 293k| "adox %%rcx, %%rax\n\t" 462| 293k| "adcx %%rax, %%r8\n\t" 463| 293k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 464| 293k| "adox %%r11, %%rax\n\t" 465| 293k| "adcx %%rax, %%r9\n\t" 466| 293k| "mulx 40(%[x]), %%rax, %%r11\n\t" 467| 293k| "adox %%rcx, %%rax\n\t" 468| 293k| "adcx %%rax, %%r10\n\t" 469| 293k| "movl $0, %%eax\n\t" 470| 293k| "adox %%rax, %%r11\n\t" 471| 293k| "adcx %%rax, %%r11\n\t" 472| | 473| 293k| "movq 32(%[y]), %%rdx\n\t" // row 4: x * y[4] 474| 293k| "xorl %%eax, %%eax\n\t" 475| 293k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 476| 293k| "adcx %%rax, %%r12\n\t" 477| 293k| "movq %%r12, 32(%[z])\n\t" 478| 293k| "mulx 8(%[x]), %%rax, %%r12\n\t" 479| 293k| "adox %%rcx, %%rax\n\t" 480| 293k| "adcx %%rax, %%r13\n\t" 481| 293k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 482| 293k| "adox %%r12, %%rax\n\t" 483| 293k| "adcx %%rax, %%r8\n\t" 484| 293k| "mulx 24(%[x]), %%rax, %%r12\n\t" 485| 293k| "adox %%rcx, %%rax\n\t" 486| 293k| "adcx %%rax, %%r9\n\t" 487| 293k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 488| 293k| "adox %%r12, %%rax\n\t" 489| 293k| "adcx %%rax, %%r10\n\t" 490| 293k| "mulx 40(%[x]), %%rax, %%r12\n\t" 491| 293k| "adox %%rcx, %%rax\n\t" 492| 293k| "adcx %%rax, %%r11\n\t" 493| 293k| "movl $0, %%eax\n\t" 494| 293k| "adox %%rax, %%r12\n\t" 495| 293k| "adcx %%rax, %%r12\n\t" 496| | 497| 293k| "movq 40(%[y]), %%rdx\n\t" // row 5: x * y[5] 498| 293k| "xorl %%eax, %%eax\n\t" 499| 293k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 500| 293k| "adcx %%rax, %%r13\n\t" 501| 293k| "movq %%r13, 40(%[z])\n\t" 502| 293k| "mulx 8(%[x]), %%rax, %%r13\n\t" 503| 293k| "adox %%rcx, %%rax\n\t" 504| 293k| "adcx %%rax, %%r8\n\t" 505| 293k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 506| 293k| "adox %%r13, %%rax\n\t" 507| 293k| "adcx %%rax, %%r9\n\t" 508| 293k| "mulx 24(%[x]), %%rax, %%r13\n\t" 509| 293k| "adox %%rcx, %%rax\n\t" 510| 293k| "adcx %%rax, %%r10\n\t" 511| 293k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 512| 293k| "adox %%r13, %%rax\n\t" 513| 293k| "adcx %%rax, %%r11\n\t" 514| 293k| "mulx 40(%[x]), %%rax, %%r13\n\t" 515| 293k| "adox %%rcx, %%rax\n\t" 516| 293k| "adcx %%rax, %%r12\n\t" 517| 293k| "movl $0, %%eax\n\t" 518| 293k| "adox %%rax, %%r13\n\t" 519| 293k| "adcx %%rax, %%r13\n\t" 520| | 521| 293k| "movq %%r8, 48(%[z])\n\t" 522| 293k| "movq %%r9, 56(%[z])\n\t" 523| 293k| "movq %%r10, 64(%[z])\n\t" 524| 293k| "movq %%r11, 72(%[z])\n\t" 525| 293k| "movq %%r12, 80(%[z])\n\t" 526| 293k| "movq %%r13, 88(%[z])\n\t" 527| 293k| : 528| 293k| : [z] "r"(z), [x] "r"(x), [y] "r"(y) 529| 293k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "cc", "memory"); 530| | // clang-format on 531| 293k|} _ZN5Botan16bigint_mulx_sqr8EPmPKm: 533| 355k|void bigint_mulx_sqr8(word z[16], const word x[8]) { 534| | // clang-format off 535| 355k| asm( 536| 355k| "xorl %%r9d, %%r9d\n\t" 537| 355k| "xorl %%r10d, %%r10d\n\t" 538| 355k| "xorl %%r11d, %%r11d\n\t" 539| 355k| "xorl %%r12d, %%r12d\n\t" 540| 355k| "xorl %%r13d, %%r13d\n\t" 541| 355k| "xorl %%r14d, %%r14d\n\t" 542| 355k| "xorl %%r8d, %%r8d\n\t" 543| | 544| 355k| "movq 0(%[x]), %%rdx\n\t" // x[0] * x[1..7] 545| 355k| "xorl %%eax, %%eax\n\t" 546| 355k| "mulx 8(%[x]), %%rax, %%rcx\n\t" 547| 355k| "adcx %%rax, %%r9\n\t" 548| 355k| "movq %%r9, 8(%[z])\n\t" 549| 355k| "mulx 16(%[x]), %%rax, %%r9\n\t" 550| 355k| "adox %%rcx, %%rax\n\t" 551| 355k| "adcx %%rax, %%r10\n\t" 552| 355k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 553| 355k| "adox %%r9, %%rax\n\t" 554| 355k| "adcx %%rax, %%r11\n\t" 555| 355k| "mulx 32(%[x]), %%rax, %%r9\n\t" 556| 355k| "adox %%rcx, %%rax\n\t" 557| 355k| "adcx %%rax, %%r12\n\t" 558| 355k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 559| 355k| "adox %%r9, %%rax\n\t" 560| 355k| "adcx %%rax, %%r13\n\t" 561| 355k| "mulx 48(%[x]), %%rax, %%r9\n\t" 562| 355k| "adox %%rcx, %%rax\n\t" 563| 355k| "adcx %%rax, %%r14\n\t" 564| 355k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 565| 355k| "adox %%r9, %%rax\n\t" 566| 355k| "adcx %%rax, %%r8\n\t" 567| 355k| "movl $0, %%eax\n\t" 568| 355k| "adox %%rax, %%rcx\n\t" 569| 355k| "adcx %%rax, %%rcx\n\t" 570| 355k| "movq %%rcx, %%r9\n\t" 571| 355k| "movq %%r10, 16(%[z])\n\t" 572| | 573| 355k| "movq 8(%[x]), %%rdx\n\t" // x[1] * x[2..7] 574| 355k| "xorl %%eax, %%eax\n\t" 575| 355k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 576| 355k| "adcx %%rax, %%r11\n\t" 577| 355k| "movq %%r11, 24(%[z])\n\t" 578| 355k| "mulx 24(%[x]), %%rax, %%r10\n\t" 579| 355k| "adox %%rcx, %%rax\n\t" 580| 355k| "adcx %%rax, %%r12\n\t" 581| 355k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 582| 355k| "adox %%r10, %%rax\n\t" 583| 355k| "adcx %%rax, %%r13\n\t" 584| 355k| "mulx 40(%[x]), %%rax, %%r10\n\t" 585| 355k| "adox %%rcx, %%rax\n\t" 586| 355k| "adcx %%rax, %%r14\n\t" 587| 355k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 588| 355k| "adox %%r10, %%rax\n\t" 589| 355k| "adcx %%rax, %%r8\n\t" 590| 355k| "mulx 56(%[x]), %%rax, %%r10\n\t" 591| 355k| "adox %%rcx, %%rax\n\t" 592| 355k| "adcx %%rax, %%r9\n\t" 593| 355k| "movl $0, %%eax\n\t" 594| 355k| "adox %%rax, %%r10\n\t" 595| 355k| "adcx %%rax, %%r10\n\t" 596| 355k| "movq %%r12, 32(%[z])\n\t" 597| | 598| 355k| "movq 16(%[x]), %%rdx\n\t" // x[2] * x[3..7] 599| 355k| "xorl %%eax, %%eax\n\t" 600| 355k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 601| 355k| "adcx %%rax, %%r13\n\t" 602| 355k| "movq %%r13, 40(%[z])\n\t" 603| 355k| "mulx 32(%[x]), %%rax, %%r11\n\t" 604| 355k| "adox %%rcx, %%rax\n\t" 605| 355k| "adcx %%rax, %%r14\n\t" 606| 355k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 607| 355k| "adox %%r11, %%rax\n\t" 608| 355k| "adcx %%rax, %%r8\n\t" 609| 355k| "mulx 48(%[x]), %%rax, %%r11\n\t" 610| 355k| "adox %%rcx, %%rax\n\t" 611| 355k| "adcx %%rax, %%r9\n\t" 612| 355k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 613| 355k| "adox %%r11, %%rax\n\t" 614| 355k| "adcx %%rax, %%r10\n\t" 615| 355k| "movl $0, %%eax\n\t" 616| 355k| "adox %%rax, %%rcx\n\t" 617| 355k| "adcx %%rax, %%rcx\n\t" 618| 355k| "movq %%rcx, %%r11\n\t" 619| 355k| "movq %%r14, 48(%[z])\n\t" 620| | 621| 355k| "movq 24(%[x]), %%rdx\n\t" // x[3] * x[4..7] 622| 355k| "xorl %%eax, %%eax\n\t" 623| 355k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 624| 355k| "adcx %%rax, %%r8\n\t" 625| 355k| "movq %%r8, 56(%[z])\n\t" 626| 355k| "mulx 40(%[x]), %%rax, %%r12\n\t" 627| 355k| "adox %%rcx, %%rax\n\t" 628| 355k| "adcx %%rax, %%r9\n\t" 629| 355k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 630| 355k| "adox %%r12, %%rax\n\t" 631| 355k| "adcx %%rax, %%r10\n\t" 632| 355k| "mulx 56(%[x]), %%rax, %%r12\n\t" 633| 355k| "adox %%rcx, %%rax\n\t" 634| 355k| "adcx %%rax, %%r11\n\t" 635| 355k| "movl $0, %%eax\n\t" 636| 355k| "adox %%rax, %%r12\n\t" 637| 355k| "adcx %%rax, %%r12\n\t" 638| 355k| "movq %%r9, 64(%[z])\n\t" 639| | 640| 355k| "movq 32(%[x]), %%rdx\n\t" // x[4] * x[5..7] 641| 355k| "xorl %%eax, %%eax\n\t" 642| 355k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 643| 355k| "adcx %%rax, %%r10\n\t" 644| 355k| "movq %%r10, 72(%[z])\n\t" 645| 355k| "mulx 48(%[x]), %%rax, %%r13\n\t" 646| 355k| "adox %%rcx, %%rax\n\t" 647| 355k| "adcx %%rax, %%r11\n\t" 648| 355k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 649| 355k| "adox %%r13, %%rax\n\t" 650| 355k| "adcx %%rax, %%r12\n\t" 651| 355k| "movl $0, %%eax\n\t" 652| 355k| "adox %%rax, %%rcx\n\t" 653| 355k| "adcx %%rax, %%rcx\n\t" 654| 355k| "movq %%rcx, %%r13\n\t" 655| 355k| "movq %%r11, 80(%[z])\n\t" 656| | 657| 355k| "movq 40(%[x]), %%rdx\n\t" // x[5] * x[6..7] 658| 355k| "xorl %%eax, %%eax\n\t" 659| 355k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 660| 355k| "adcx %%rax, %%r12\n\t" 661| 355k| "movq %%r12, 88(%[z])\n\t" 662| 355k| "mulx 56(%[x]), %%rax, %%r14\n\t" 663| 355k| "adox %%rcx, %%rax\n\t" 664| 355k| "adcx %%rax, %%r13\n\t" 665| 355k| "movl $0, %%eax\n\t" 666| 355k| "adox %%rax, %%r14\n\t" 667| 355k| "adcx %%rax, %%r14\n\t" 668| 355k| "movq %%r13, 96(%[z])\n\t" 669| | 670| 355k| "movq 48(%[x]), %%rdx\n\t" // x[6] * x[7..7] 671| 355k| "xorl %%eax, %%eax\n\t" 672| 355k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 673| 355k| "adcx %%rax, %%r14\n\t" 674| 355k| "movq %%r14, 104(%[z])\n\t" 675| 355k| "movl $0, %%eax\n\t" 676| 355k| "adox %%rax, %%rcx\n\t" 677| 355k| "adcx %%rax, %%rcx\n\t" 678| 355k| "movq %%rcx, %%r8\n\t" 679| 355k| "movq %%r8, 112(%[z])\n\t" 680| | 681| 355k| "movq $0, 120(%[z])\n\t" 682| 355k| "xorl %%eax, %%eax\n\t" // double the cross products and add the squares 683| 355k| "movq 0(%[x]), %%rdx\n\t" 684| 355k| "mulx %%rdx, %%rax, %%rcx\n\t" 685| 355k| "movq %%rax, 0(%[z])\n\t" 686| 355k| "movq 8(%[z]), %%r8\n\t" 687| 355k| "adcx %%r8, %%r8\n\t" 688| 355k| "adox %%rcx, %%r8\n\t" 689| 355k| "movq %%r8, 8(%[z])\n\t" 690| 355k| "movq 8(%[x]), %%rdx\n\t" 691| 355k| "mulx %%rdx, %%rax, %%rcx\n\t" 692| 355k| "movq 16(%[z]), %%r8\n\t" 693| 355k| "adcx %%r8, %%r8\n\t" 694| 355k| "adox %%rax, %%r8\n\t" 695| 355k| "movq %%r8, 16(%[z])\n\t" 696| 355k| "movq 24(%[z]), %%r8\n\t" 697| 355k| "adcx %%r8, %%r8\n\t" 698| 355k| "adox %%rcx, %%r8\n\t" 699| 355k| "movq %%r8, 24(%[z])\n\t" 700| 355k| "movq 16(%[x]), %%rdx\n\t" 701| 355k| "mulx %%rdx, %%rax, %%rcx\n\t" 702| 355k| "movq 32(%[z]), %%r8\n\t" 703| 355k| "adcx %%r8, %%r8\n\t" 704| 355k| "adox %%rax, %%r8\n\t" 705| 355k| "movq %%r8, 32(%[z])\n\t" 706| 355k| "movq 40(%[z]), %%r8\n\t" 707| 355k| "adcx %%r8, %%r8\n\t" 708| 355k| "adox %%rcx, %%r8\n\t" 709| 355k| "movq %%r8, 40(%[z])\n\t" 710| 355k| "movq 24(%[x]), %%rdx\n\t" 711| 355k| "mulx %%rdx, %%rax, %%rcx\n\t" 712| 355k| "movq 48(%[z]), %%r8\n\t" 713| 355k| "adcx %%r8, %%r8\n\t" 714| 355k| "adox %%rax, %%r8\n\t" 715| 355k| "movq %%r8, 48(%[z])\n\t" 716| 355k| "movq 56(%[z]), %%r8\n\t" 717| 355k| "adcx %%r8, %%r8\n\t" 718| 355k| "adox %%rcx, %%r8\n\t" 719| 355k| "movq %%r8, 56(%[z])\n\t" 720| 355k| "movq 32(%[x]), %%rdx\n\t" 721| 355k| "mulx %%rdx, %%rax, %%rcx\n\t" 722| 355k| "movq 64(%[z]), %%r8\n\t" 723| 355k| "adcx %%r8, %%r8\n\t" 724| 355k| "adox %%rax, %%r8\n\t" 725| 355k| "movq %%r8, 64(%[z])\n\t" 726| 355k| "movq 72(%[z]), %%r8\n\t" 727| 355k| "adcx %%r8, %%r8\n\t" 728| 355k| "adox %%rcx, %%r8\n\t" 729| 355k| "movq %%r8, 72(%[z])\n\t" 730| 355k| "movq 40(%[x]), %%rdx\n\t" 731| 355k| "mulx %%rdx, %%rax, %%rcx\n\t" 732| 355k| "movq 80(%[z]), %%r8\n\t" 733| 355k| "adcx %%r8, %%r8\n\t" 734| 355k| "adox %%rax, %%r8\n\t" 735| 355k| "movq %%r8, 80(%[z])\n\t" 736| 355k| "movq 88(%[z]), %%r8\n\t" 737| 355k| "adcx %%r8, %%r8\n\t" 738| 355k| "adox %%rcx, %%r8\n\t" 739| 355k| "movq %%r8, 88(%[z])\n\t" 740| 355k| "movq 48(%[x]), %%rdx\n\t" 741| 355k| "mulx %%rdx, %%rax, %%rcx\n\t" 742| 355k| "movq 96(%[z]), %%r8\n\t" 743| 355k| "adcx %%r8, %%r8\n\t" 744| 355k| "adox %%rax, %%r8\n\t" 745| 355k| "movq %%r8, 96(%[z])\n\t" 746| 355k| "movq 104(%[z]), %%r8\n\t" 747| 355k| "adcx %%r8, %%r8\n\t" 748| 355k| "adox %%rcx, %%r8\n\t" 749| 355k| "movq %%r8, 104(%[z])\n\t" 750| 355k| "movq 56(%[x]), %%rdx\n\t" 751| 355k| "mulx %%rdx, %%rax, %%rcx\n\t" 752| 355k| "movq 112(%[z]), %%r8\n\t" 753| 355k| "adcx %%r8, %%r8\n\t" 754| 355k| "adox %%rax, %%r8\n\t" 755| 355k| "movq %%r8, 112(%[z])\n\t" 756| 355k| "movq 120(%[z]), %%r8\n\t" 757| 355k| "adcx %%r8, %%r8\n\t" 758| 355k| "adox %%rcx, %%r8\n\t" 759| 355k| "movq %%r8, 120(%[z])\n\t" 760| 355k| : 761| 355k| : [z] "r"(z), [x] "r"(x) 762| 355k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc", "memory"); 763| | // clang-format on 764| 355k|} _ZN5Botan16bigint_mulx_mul8EPmPKmS2_: 766| 157k|void bigint_mulx_mul8(word z[16], const word x[8], const word y[8]) { 767| | // clang-format off 768| 157k| asm( 769| 157k| "xorl %%r8d, %%r8d\n\t" 770| 157k| "xorl %%r9d, %%r9d\n\t" 771| 157k| "xorl %%r10d, %%r10d\n\t" 772| 157k| "xorl %%r11d, %%r11d\n\t" 773| 157k| "xorl %%r12d, %%r12d\n\t" 774| 157k| "xorl %%r13d, %%r13d\n\t" 775| 157k| "xorl %%r14d, %%r14d\n\t" 776| 157k| "xorl %%r15d, %%r15d\n\t" 777| | 778| 157k| "movq 0(%[y]), %%rdx\n\t" // row 0: x * y[0] 779| 157k| "xorl %%eax, %%eax\n\t" 780| 157k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 781| 157k| "adcx %%rax, %%r8\n\t" 782| 157k| "movq %%r8, 0(%[z])\n\t" 783| 157k| "mulx 8(%[x]), %%rax, %%r8\n\t" 784| 157k| "adox %%rcx, %%rax\n\t" 785| 157k| "adcx %%rax, %%r9\n\t" 786| 157k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 787| 157k| "adox %%r8, %%rax\n\t" 788| 157k| "adcx %%rax, %%r10\n\t" 789| 157k| "mulx 24(%[x]), %%rax, %%r8\n\t" 790| 157k| "adox %%rcx, %%rax\n\t" 791| 157k| "adcx %%rax, %%r11\n\t" 792| 157k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 793| 157k| "adox %%r8, %%rax\n\t" 794| 157k| "adcx %%rax, %%r12\n\t" 795| 157k| "mulx 40(%[x]), %%rax, %%r8\n\t" 796| 157k| "adox %%rcx, %%rax\n\t" 797| 157k| "adcx %%rax, %%r13\n\t" 798| 157k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 799| 157k| "adox %%r8, %%rax\n\t" 800| 157k| "adcx %%rax, %%r14\n\t" 801| 157k| "mulx 56(%[x]), %%rax, %%r8\n\t" 802| 157k| "adox %%rcx, %%rax\n\t" 803| 157k| "adcx %%rax, %%r15\n\t" 804| 157k| "movl $0, %%eax\n\t" 805| 157k| "adox %%rax, %%r8\n\t" 806| 157k| "adcx %%rax, %%r8\n\t" 807| | 808| 157k| "movq 8(%[y]), %%rdx\n\t" // row 1: x * y[1] 809| 157k| "xorl %%eax, %%eax\n\t" 810| 157k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 811| 157k| "adcx %%rax, %%r9\n\t" 812| 157k| "movq %%r9, 8(%[z])\n\t" 813| 157k| "mulx 8(%[x]), %%rax, %%r9\n\t" 814| 157k| "adox %%rcx, %%rax\n\t" 815| 157k| "adcx %%rax, %%r10\n\t" 816| 157k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 817| 157k| "adox %%r9, %%rax\n\t" 818| 157k| "adcx %%rax, %%r11\n\t" 819| 157k| "mulx 24(%[x]), %%rax, %%r9\n\t" 820| 157k| "adox %%rcx, %%rax\n\t" 821| 157k| "adcx %%rax, %%r12\n\t" 822| 157k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 823| 157k| "adox %%r9, %%rax\n\t" 824| 157k| "adcx %%rax, %%r13\n\t" 825| 157k| "mulx 40(%[x]), %%rax, %%r9\n\t" 826| 157k| "adox %%rcx, %%rax\n\t" 827| 157k| "adcx %%rax, %%r14\n\t" 828| 157k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 829| 157k| "adox %%r9, %%rax\n\t" 830| 157k| "adcx %%rax, %%r15\n\t" 831| 157k| "mulx 56(%[x]), %%rax, %%r9\n\t" 832| 157k| "adox %%rcx, %%rax\n\t" 833| 157k| "adcx %%rax, %%r8\n\t" 834| 157k| "movl $0, %%eax\n\t" 835| 157k| "adox %%rax, %%r9\n\t" 836| 157k| "adcx %%rax, %%r9\n\t" 837| | 838| 157k| "movq 16(%[y]), %%rdx\n\t" // row 2: x * y[2] 839| 157k| "xorl %%eax, %%eax\n\t" 840| 157k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 841| 157k| "adcx %%rax, %%r10\n\t" 842| 157k| "movq %%r10, 16(%[z])\n\t" 843| 157k| "mulx 8(%[x]), %%rax, %%r10\n\t" 844| 157k| "adox %%rcx, %%rax\n\t" 845| 157k| "adcx %%rax, %%r11\n\t" 846| 157k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 847| 157k| "adox %%r10, %%rax\n\t" 848| 157k| "adcx %%rax, %%r12\n\t" 849| 157k| "mulx 24(%[x]), %%rax, %%r10\n\t" 850| 157k| "adox %%rcx, %%rax\n\t" 851| 157k| "adcx %%rax, %%r13\n\t" 852| 157k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 853| 157k| "adox %%r10, %%rax\n\t" 854| 157k| "adcx %%rax, %%r14\n\t" 855| 157k| "mulx 40(%[x]), %%rax, %%r10\n\t" 856| 157k| "adox %%rcx, %%rax\n\t" 857| 157k| "adcx %%rax, %%r15\n\t" 858| 157k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 859| 157k| "adox %%r10, %%rax\n\t" 860| 157k| "adcx %%rax, %%r8\n\t" 861| 157k| "mulx 56(%[x]), %%rax, %%r10\n\t" 862| 157k| "adox %%rcx, %%rax\n\t" 863| 157k| "adcx %%rax, %%r9\n\t" 864| 157k| "movl $0, %%eax\n\t" 865| 157k| "adox %%rax, %%r10\n\t" 866| 157k| "adcx %%rax, %%r10\n\t" 867| | 868| 157k| "movq 24(%[y]), %%rdx\n\t" // row 3: x * y[3] 869| 157k| "xorl %%eax, %%eax\n\t" 870| 157k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 871| 157k| "adcx %%rax, %%r11\n\t" 872| 157k| "movq %%r11, 24(%[z])\n\t" 873| 157k| "mulx 8(%[x]), %%rax, %%r11\n\t" 874| 157k| "adox %%rcx, %%rax\n\t" 875| 157k| "adcx %%rax, %%r12\n\t" 876| 157k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 877| 157k| "adox %%r11, %%rax\n\t" 878| 157k| "adcx %%rax, %%r13\n\t" 879| 157k| "mulx 24(%[x]), %%rax, %%r11\n\t" 880| 157k| "adox %%rcx, %%rax\n\t" 881| 157k| "adcx %%rax, %%r14\n\t" 882| 157k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 883| 157k| "adox %%r11, %%rax\n\t" 884| 157k| "adcx %%rax, %%r15\n\t" 885| 157k| "mulx 40(%[x]), %%rax, %%r11\n\t" 886| 157k| "adox %%rcx, %%rax\n\t" 887| 157k| "adcx %%rax, %%r8\n\t" 888| 157k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 889| 157k| "adox %%r11, %%rax\n\t" 890| 157k| "adcx %%rax, %%r9\n\t" 891| 157k| "mulx 56(%[x]), %%rax, %%r11\n\t" 892| 157k| "adox %%rcx, %%rax\n\t" 893| 157k| "adcx %%rax, %%r10\n\t" 894| 157k| "movl $0, %%eax\n\t" 895| 157k| "adox %%rax, %%r11\n\t" 896| 157k| "adcx %%rax, %%r11\n\t" 897| | 898| 157k| "movq 32(%[y]), %%rdx\n\t" // row 4: x * y[4] 899| 157k| "xorl %%eax, %%eax\n\t" 900| 157k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 901| 157k| "adcx %%rax, %%r12\n\t" 902| 157k| "movq %%r12, 32(%[z])\n\t" 903| 157k| "mulx 8(%[x]), %%rax, %%r12\n\t" 904| 157k| "adox %%rcx, %%rax\n\t" 905| 157k| "adcx %%rax, %%r13\n\t" 906| 157k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 907| 157k| "adox %%r12, %%rax\n\t" 908| 157k| "adcx %%rax, %%r14\n\t" 909| 157k| "mulx 24(%[x]), %%rax, %%r12\n\t" 910| 157k| "adox %%rcx, %%rax\n\t" 911| 157k| "adcx %%rax, %%r15\n\t" 912| 157k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 913| 157k| "adox %%r12, %%rax\n\t" 914| 157k| "adcx %%rax, %%r8\n\t" 915| 157k| "mulx 40(%[x]), %%rax, %%r12\n\t" 916| 157k| "adox %%rcx, %%rax\n\t" 917| 157k| "adcx %%rax, %%r9\n\t" 918| 157k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 919| 157k| "adox %%r12, %%rax\n\t" 920| 157k| "adcx %%rax, %%r10\n\t" 921| 157k| "mulx 56(%[x]), %%rax, %%r12\n\t" 922| 157k| "adox %%rcx, %%rax\n\t" 923| 157k| "adcx %%rax, %%r11\n\t" 924| 157k| "movl $0, %%eax\n\t" 925| 157k| "adox %%rax, %%r12\n\t" 926| 157k| "adcx %%rax, %%r12\n\t" 927| | 928| 157k| "movq 40(%[y]), %%rdx\n\t" // row 5: x * y[5] 929| 157k| "xorl %%eax, %%eax\n\t" 930| 157k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 931| 157k| "adcx %%rax, %%r13\n\t" 932| 157k| "movq %%r13, 40(%[z])\n\t" 933| 157k| "mulx 8(%[x]), %%rax, %%r13\n\t" 934| 157k| "adox %%rcx, %%rax\n\t" 935| 157k| "adcx %%rax, %%r14\n\t" 936| 157k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 937| 157k| "adox %%r13, %%rax\n\t" 938| 157k| "adcx %%rax, %%r15\n\t" 939| 157k| "mulx 24(%[x]), %%rax, %%r13\n\t" 940| 157k| "adox %%rcx, %%rax\n\t" 941| 157k| "adcx %%rax, %%r8\n\t" 942| 157k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 943| 157k| "adox %%r13, %%rax\n\t" 944| 157k| "adcx %%rax, %%r9\n\t" 945| 157k| "mulx 40(%[x]), %%rax, %%r13\n\t" 946| 157k| "adox %%rcx, %%rax\n\t" 947| 157k| "adcx %%rax, %%r10\n\t" 948| 157k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 949| 157k| "adox %%r13, %%rax\n\t" 950| 157k| "adcx %%rax, %%r11\n\t" 951| 157k| "mulx 56(%[x]), %%rax, %%r13\n\t" 952| 157k| "adox %%rcx, %%rax\n\t" 953| 157k| "adcx %%rax, %%r12\n\t" 954| 157k| "movl $0, %%eax\n\t" 955| 157k| "adox %%rax, %%r13\n\t" 956| 157k| "adcx %%rax, %%r13\n\t" 957| | 958| 157k| "movq 48(%[y]), %%rdx\n\t" // row 6: x * y[6] 959| 157k| "xorl %%eax, %%eax\n\t" 960| 157k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 961| 157k| "adcx %%rax, %%r14\n\t" 962| 157k| "movq %%r14, 48(%[z])\n\t" 963| 157k| "mulx 8(%[x]), %%rax, %%r14\n\t" 964| 157k| "adox %%rcx, %%rax\n\t" 965| 157k| "adcx %%rax, %%r15\n\t" 966| 157k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 967| 157k| "adox %%r14, %%rax\n\t" 968| 157k| "adcx %%rax, %%r8\n\t" 969| 157k| "mulx 24(%[x]), %%rax, %%r14\n\t" 970| 157k| "adox %%rcx, %%rax\n\t" 971| 157k| "adcx %%rax, %%r9\n\t" 972| 157k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 973| 157k| "adox %%r14, %%rax\n\t" 974| 157k| "adcx %%rax, %%r10\n\t" 975| 157k| "mulx 40(%[x]), %%rax, %%r14\n\t" 976| 157k| "adox %%rcx, %%rax\n\t" 977| 157k| "adcx %%rax, %%r11\n\t" 978| 157k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 979| 157k| "adox %%r14, %%rax\n\t" 980| 157k| "adcx %%rax, %%r12\n\t" 981| 157k| "mulx 56(%[x]), %%rax, %%r14\n\t" 982| 157k| "adox %%rcx, %%rax\n\t" 983| 157k| "adcx %%rax, %%r13\n\t" 984| 157k| "movl $0, %%eax\n\t" 985| 157k| "adox %%rax, %%r14\n\t" 986| 157k| "adcx %%rax, %%r14\n\t" 987| | 988| 157k| "movq 56(%[y]), %%rdx\n\t" // row 7: x * y[7] 989| 157k| "xorl %%eax, %%eax\n\t" 990| 157k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 991| 157k| "adcx %%rax, %%r15\n\t" 992| 157k| "movq %%r15, 56(%[z])\n\t" 993| 157k| "mulx 8(%[x]), %%rax, %%r15\n\t" 994| 157k| "adox %%rcx, %%rax\n\t" 995| 157k| "adcx %%rax, %%r8\n\t" 996| 157k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 997| 157k| "adox %%r15, %%rax\n\t" 998| 157k| "adcx %%rax, %%r9\n\t" 999| 157k| "mulx 24(%[x]), %%rax, %%r15\n\t" 1000| 157k| "adox %%rcx, %%rax\n\t" 1001| 157k| "adcx %%rax, %%r10\n\t" 1002| 157k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1003| 157k| "adox %%r15, %%rax\n\t" 1004| 157k| "adcx %%rax, %%r11\n\t" 1005| 157k| "mulx 40(%[x]), %%rax, %%r15\n\t" 1006| 157k| "adox %%rcx, %%rax\n\t" 1007| 157k| "adcx %%rax, %%r12\n\t" 1008| 157k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1009| 157k| "adox %%r15, %%rax\n\t" 1010| 157k| "adcx %%rax, %%r13\n\t" 1011| 157k| "mulx 56(%[x]), %%rax, %%r15\n\t" 1012| 157k| "adox %%rcx, %%rax\n\t" 1013| 157k| "adcx %%rax, %%r14\n\t" 1014| 157k| "movl $0, %%eax\n\t" 1015| 157k| "adox %%rax, %%r15\n\t" 1016| 157k| "adcx %%rax, %%r15\n\t" 1017| | 1018| 157k| "movq %%r8, 64(%[z])\n\t" 1019| 157k| "movq %%r9, 72(%[z])\n\t" 1020| 157k| "movq %%r10, 80(%[z])\n\t" 1021| 157k| "movq %%r11, 88(%[z])\n\t" 1022| 157k| "movq %%r12, 96(%[z])\n\t" 1023| 157k| "movq %%r13, 104(%[z])\n\t" 1024| 157k| "movq %%r14, 112(%[z])\n\t" 1025| 157k| "movq %%r15, 120(%[z])\n\t" 1026| 157k| : 1027| 157k| : [z] "r"(z), [x] "r"(x), [y] "r"(y) 1028| 157k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory"); 1029| | // clang-format on 1030| 157k|} _ZN5Botan16bigint_mulx_sqr9EPmPKm: 1032| 444k|void bigint_mulx_sqr9(word z[18], const word x[9]) { 1033| | // clang-format off 1034| 444k| asm( 1035| 444k| "xorl %%r9d, %%r9d\n\t" 1036| 444k| "xorl %%r10d, %%r10d\n\t" 1037| 444k| "xorl %%r11d, %%r11d\n\t" 1038| 444k| "xorl %%r12d, %%r12d\n\t" 1039| 444k| "xorl %%r13d, %%r13d\n\t" 1040| 444k| "xorl %%r14d, %%r14d\n\t" 1041| 444k| "xorl %%r15d, %%r15d\n\t" 1042| 444k| "xorl %%r8d, %%r8d\n\t" 1043| | 1044| 444k| "movq 0(%[x]), %%rdx\n\t" // x[0] * x[1..8] 1045| 444k| "xorl %%eax, %%eax\n\t" 1046| 444k| "mulx 8(%[x]), %%rax, %%rcx\n\t" 1047| 444k| "adcx %%rax, %%r9\n\t" 1048| 444k| "movq %%r9, 8(%[z])\n\t" 1049| 444k| "mulx 16(%[x]), %%rax, %%r9\n\t" 1050| 444k| "adox %%rcx, %%rax\n\t" 1051| 444k| "adcx %%rax, %%r10\n\t" 1052| 444k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 1053| 444k| "adox %%r9, %%rax\n\t" 1054| 444k| "adcx %%rax, %%r11\n\t" 1055| 444k| "mulx 32(%[x]), %%rax, %%r9\n\t" 1056| 444k| "adox %%rcx, %%rax\n\t" 1057| 444k| "adcx %%rax, %%r12\n\t" 1058| 444k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 1059| 444k| "adox %%r9, %%rax\n\t" 1060| 444k| "adcx %%rax, %%r13\n\t" 1061| 444k| "mulx 48(%[x]), %%rax, %%r9\n\t" 1062| 444k| "adox %%rcx, %%rax\n\t" 1063| 444k| "adcx %%rax, %%r14\n\t" 1064| 444k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 1065| 444k| "adox %%r9, %%rax\n\t" 1066| 444k| "adcx %%rax, %%r15\n\t" 1067| 444k| "mulx 64(%[x]), %%rax, %%r9\n\t" 1068| 444k| "adox %%rcx, %%rax\n\t" 1069| 444k| "adcx %%rax, %%r8\n\t" 1070| 444k| "movl $0, %%eax\n\t" 1071| 444k| "adox %%rax, %%r9\n\t" 1072| 444k| "adcx %%rax, %%r9\n\t" 1073| 444k| "movq %%r10, 16(%[z])\n\t" 1074| | 1075| 444k| "movq 8(%[x]), %%rdx\n\t" // x[1] * x[2..8] 1076| 444k| "xorl %%eax, %%eax\n\t" 1077| 444k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1078| 444k| "adcx %%rax, %%r11\n\t" 1079| 444k| "movq %%r11, 24(%[z])\n\t" 1080| 444k| "mulx 24(%[x]), %%rax, %%r10\n\t" 1081| 444k| "adox %%rcx, %%rax\n\t" 1082| 444k| "adcx %%rax, %%r12\n\t" 1083| 444k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1084| 444k| "adox %%r10, %%rax\n\t" 1085| 444k| "adcx %%rax, %%r13\n\t" 1086| 444k| "mulx 40(%[x]), %%rax, %%r10\n\t" 1087| 444k| "adox %%rcx, %%rax\n\t" 1088| 444k| "adcx %%rax, %%r14\n\t" 1089| 444k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1090| 444k| "adox %%r10, %%rax\n\t" 1091| 444k| "adcx %%rax, %%r15\n\t" 1092| 444k| "mulx 56(%[x]), %%rax, %%r10\n\t" 1093| 444k| "adox %%rcx, %%rax\n\t" 1094| 444k| "adcx %%rax, %%r8\n\t" 1095| 444k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1096| 444k| "adox %%r10, %%rax\n\t" 1097| 444k| "adcx %%rax, %%r9\n\t" 1098| 444k| "movl $0, %%eax\n\t" 1099| 444k| "adox %%rax, %%rcx\n\t" 1100| 444k| "adcx %%rax, %%rcx\n\t" 1101| 444k| "movq %%rcx, %%r10\n\t" 1102| 444k| "movq %%r12, 32(%[z])\n\t" 1103| | 1104| 444k| "movq 16(%[x]), %%rdx\n\t" // x[2] * x[3..8] 1105| 444k| "xorl %%eax, %%eax\n\t" 1106| 444k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 1107| 444k| "adcx %%rax, %%r13\n\t" 1108| 444k| "movq %%r13, 40(%[z])\n\t" 1109| 444k| "mulx 32(%[x]), %%rax, %%r11\n\t" 1110| 444k| "adox %%rcx, %%rax\n\t" 1111| 444k| "adcx %%rax, %%r14\n\t" 1112| 444k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 1113| 444k| "adox %%r11, %%rax\n\t" 1114| 444k| "adcx %%rax, %%r15\n\t" 1115| 444k| "mulx 48(%[x]), %%rax, %%r11\n\t" 1116| 444k| "adox %%rcx, %%rax\n\t" 1117| 444k| "adcx %%rax, %%r8\n\t" 1118| 444k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 1119| 444k| "adox %%r11, %%rax\n\t" 1120| 444k| "adcx %%rax, %%r9\n\t" 1121| 444k| "mulx 64(%[x]), %%rax, %%r11\n\t" 1122| 444k| "adox %%rcx, %%rax\n\t" 1123| 444k| "adcx %%rax, %%r10\n\t" 1124| 444k| "movl $0, %%eax\n\t" 1125| 444k| "adox %%rax, %%r11\n\t" 1126| 444k| "adcx %%rax, %%r11\n\t" 1127| 444k| "movq %%r14, 48(%[z])\n\t" 1128| | 1129| 444k| "movq 24(%[x]), %%rdx\n\t" // x[3] * x[4..8] 1130| 444k| "xorl %%eax, %%eax\n\t" 1131| 444k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1132| 444k| "adcx %%rax, %%r15\n\t" 1133| 444k| "movq %%r15, 56(%[z])\n\t" 1134| 444k| "mulx 40(%[x]), %%rax, %%r12\n\t" 1135| 444k| "adox %%rcx, %%rax\n\t" 1136| 444k| "adcx %%rax, %%r8\n\t" 1137| 444k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1138| 444k| "adox %%r12, %%rax\n\t" 1139| 444k| "adcx %%rax, %%r9\n\t" 1140| 444k| "mulx 56(%[x]), %%rax, %%r12\n\t" 1141| 444k| "adox %%rcx, %%rax\n\t" 1142| 444k| "adcx %%rax, %%r10\n\t" 1143| 444k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1144| 444k| "adox %%r12, %%rax\n\t" 1145| 444k| "adcx %%rax, %%r11\n\t" 1146| 444k| "movl $0, %%eax\n\t" 1147| 444k| "adox %%rax, %%rcx\n\t" 1148| 444k| "adcx %%rax, %%rcx\n\t" 1149| 444k| "movq %%rcx, %%r12\n\t" 1150| 444k| "movq %%r8, 64(%[z])\n\t" 1151| | 1152| 444k| "movq 32(%[x]), %%rdx\n\t" // x[4] * x[5..8] 1153| 444k| "xorl %%eax, %%eax\n\t" 1154| 444k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 1155| 444k| "adcx %%rax, %%r9\n\t" 1156| 444k| "movq %%r9, 72(%[z])\n\t" 1157| 444k| "mulx 48(%[x]), %%rax, %%r13\n\t" 1158| 444k| "adox %%rcx, %%rax\n\t" 1159| 444k| "adcx %%rax, %%r10\n\t" 1160| 444k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 1161| 444k| "adox %%r13, %%rax\n\t" 1162| 444k| "adcx %%rax, %%r11\n\t" 1163| 444k| "mulx 64(%[x]), %%rax, %%r13\n\t" 1164| 444k| "adox %%rcx, %%rax\n\t" 1165| 444k| "adcx %%rax, %%r12\n\t" 1166| 444k| "movl $0, %%eax\n\t" 1167| 444k| "adox %%rax, %%r13\n\t" 1168| 444k| "adcx %%rax, %%r13\n\t" 1169| 444k| "movq %%r10, 80(%[z])\n\t" 1170| | 1171| 444k| "movq 40(%[x]), %%rdx\n\t" // x[5] * x[6..8] 1172| 444k| "xorl %%eax, %%eax\n\t" 1173| 444k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1174| 444k| "adcx %%rax, %%r11\n\t" 1175| 444k| "movq %%r11, 88(%[z])\n\t" 1176| 444k| "mulx 56(%[x]), %%rax, %%r14\n\t" 1177| 444k| "adox %%rcx, %%rax\n\t" 1178| 444k| "adcx %%rax, %%r12\n\t" 1179| 444k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1180| 444k| "adox %%r14, %%rax\n\t" 1181| 444k| "adcx %%rax, %%r13\n\t" 1182| 444k| "movl $0, %%eax\n\t" 1183| 444k| "adox %%rax, %%rcx\n\t" 1184| 444k| "adcx %%rax, %%rcx\n\t" 1185| 444k| "movq %%rcx, %%r14\n\t" 1186| 444k| "movq %%r12, 96(%[z])\n\t" 1187| | 1188| 444k| "movq 48(%[x]), %%rdx\n\t" // x[6] * x[7..8] 1189| 444k| "xorl %%eax, %%eax\n\t" 1190| 444k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 1191| 444k| "adcx %%rax, %%r13\n\t" 1192| 444k| "movq %%r13, 104(%[z])\n\t" 1193| 444k| "mulx 64(%[x]), %%rax, %%r15\n\t" 1194| 444k| "adox %%rcx, %%rax\n\t" 1195| 444k| "adcx %%rax, %%r14\n\t" 1196| 444k| "movl $0, %%eax\n\t" 1197| 444k| "adox %%rax, %%r15\n\t" 1198| 444k| "adcx %%rax, %%r15\n\t" 1199| 444k| "movq %%r14, 112(%[z])\n\t" 1200| | 1201| 444k| "movq 56(%[x]), %%rdx\n\t" // x[7] * x[8..8] 1202| 444k| "xorl %%eax, %%eax\n\t" 1203| 444k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1204| 444k| "adcx %%rax, %%r15\n\t" 1205| 444k| "movq %%r15, 120(%[z])\n\t" 1206| 444k| "movl $0, %%eax\n\t" 1207| 444k| "adox %%rax, %%rcx\n\t" 1208| 444k| "adcx %%rax, %%rcx\n\t" 1209| 444k| "movq %%rcx, %%r8\n\t" 1210| 444k| "movq %%r8, 128(%[z])\n\t" 1211| | 1212| 444k| "movq $0, 136(%[z])\n\t" 1213| 444k| "xorl %%eax, %%eax\n\t" // double the cross products and add the squares 1214| 444k| "movq 0(%[x]), %%rdx\n\t" 1215| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1216| 444k| "movq %%rax, 0(%[z])\n\t" 1217| 444k| "movq 8(%[z]), %%r8\n\t" 1218| 444k| "adcx %%r8, %%r8\n\t" 1219| 444k| "adox %%rcx, %%r8\n\t" 1220| 444k| "movq %%r8, 8(%[z])\n\t" 1221| 444k| "movq 8(%[x]), %%rdx\n\t" 1222| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1223| 444k| "movq 16(%[z]), %%r8\n\t" 1224| 444k| "adcx %%r8, %%r8\n\t" 1225| 444k| "adox %%rax, %%r8\n\t" 1226| 444k| "movq %%r8, 16(%[z])\n\t" 1227| 444k| "movq 24(%[z]), %%r8\n\t" 1228| 444k| "adcx %%r8, %%r8\n\t" 1229| 444k| "adox %%rcx, %%r8\n\t" 1230| 444k| "movq %%r8, 24(%[z])\n\t" 1231| 444k| "movq 16(%[x]), %%rdx\n\t" 1232| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1233| 444k| "movq 32(%[z]), %%r8\n\t" 1234| 444k| "adcx %%r8, %%r8\n\t" 1235| 444k| "adox %%rax, %%r8\n\t" 1236| 444k| "movq %%r8, 32(%[z])\n\t" 1237| 444k| "movq 40(%[z]), %%r8\n\t" 1238| 444k| "adcx %%r8, %%r8\n\t" 1239| 444k| "adox %%rcx, %%r8\n\t" 1240| 444k| "movq %%r8, 40(%[z])\n\t" 1241| 444k| "movq 24(%[x]), %%rdx\n\t" 1242| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1243| 444k| "movq 48(%[z]), %%r8\n\t" 1244| 444k| "adcx %%r8, %%r8\n\t" 1245| 444k| "adox %%rax, %%r8\n\t" 1246| 444k| "movq %%r8, 48(%[z])\n\t" 1247| 444k| "movq 56(%[z]), %%r8\n\t" 1248| 444k| "adcx %%r8, %%r8\n\t" 1249| 444k| "adox %%rcx, %%r8\n\t" 1250| 444k| "movq %%r8, 56(%[z])\n\t" 1251| 444k| "movq 32(%[x]), %%rdx\n\t" 1252| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1253| 444k| "movq 64(%[z]), %%r8\n\t" 1254| 444k| "adcx %%r8, %%r8\n\t" 1255| 444k| "adox %%rax, %%r8\n\t" 1256| 444k| "movq %%r8, 64(%[z])\n\t" 1257| 444k| "movq 72(%[z]), %%r8\n\t" 1258| 444k| "adcx %%r8, %%r8\n\t" 1259| 444k| "adox %%rcx, %%r8\n\t" 1260| 444k| "movq %%r8, 72(%[z])\n\t" 1261| 444k| "movq 40(%[x]), %%rdx\n\t" 1262| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1263| 444k| "movq 80(%[z]), %%r8\n\t" 1264| 444k| "adcx %%r8, %%r8\n\t" 1265| 444k| "adox %%rax, %%r8\n\t" 1266| 444k| "movq %%r8, 80(%[z])\n\t" 1267| 444k| "movq 88(%[z]), %%r8\n\t" 1268| 444k| "adcx %%r8, %%r8\n\t" 1269| 444k| "adox %%rcx, %%r8\n\t" 1270| 444k| "movq %%r8, 88(%[z])\n\t" 1271| 444k| "movq 48(%[x]), %%rdx\n\t" 1272| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1273| 444k| "movq 96(%[z]), %%r8\n\t" 1274| 444k| "adcx %%r8, %%r8\n\t" 1275| 444k| "adox %%rax, %%r8\n\t" 1276| 444k| "movq %%r8, 96(%[z])\n\t" 1277| 444k| "movq 104(%[z]), %%r8\n\t" 1278| 444k| "adcx %%r8, %%r8\n\t" 1279| 444k| "adox %%rcx, %%r8\n\t" 1280| 444k| "movq %%r8, 104(%[z])\n\t" 1281| 444k| "movq 56(%[x]), %%rdx\n\t" 1282| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1283| 444k| "movq 112(%[z]), %%r8\n\t" 1284| 444k| "adcx %%r8, %%r8\n\t" 1285| 444k| "adox %%rax, %%r8\n\t" 1286| 444k| "movq %%r8, 112(%[z])\n\t" 1287| 444k| "movq 120(%[z]), %%r8\n\t" 1288| 444k| "adcx %%r8, %%r8\n\t" 1289| 444k| "adox %%rcx, %%r8\n\t" 1290| 444k| "movq %%r8, 120(%[z])\n\t" 1291| 444k| "movq 64(%[x]), %%rdx\n\t" 1292| 444k| "mulx %%rdx, %%rax, %%rcx\n\t" 1293| 444k| "movq 128(%[z]), %%r8\n\t" 1294| 444k| "adcx %%r8, %%r8\n\t" 1295| 444k| "adox %%rax, %%r8\n\t" 1296| 444k| "movq %%r8, 128(%[z])\n\t" 1297| 444k| "movq 136(%[z]), %%r8\n\t" 1298| 444k| "adcx %%r8, %%r8\n\t" 1299| 444k| "adox %%rcx, %%r8\n\t" 1300| 444k| "movq %%r8, 136(%[z])\n\t" 1301| 444k| : 1302| 444k| : [z] "r"(z), [x] "r"(x) 1303| 444k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory"); 1304| | // clang-format on 1305| 444k|} _ZN5Botan16bigint_mulx_mul9EPmPKmS2_: 1307| 833k|void bigint_mulx_mul9(word z[18], const word x[9], const word y[9]) { 1308| 833k| copy_mem(z + 9, y, 9); 1309| | // clang-format off 1310| 833k| asm( 1311| 833k| "xorl %%r8d, %%r8d\n\t" 1312| 833k| "xorl %%r9d, %%r9d\n\t" 1313| 833k| "xorl %%r10d, %%r10d\n\t" 1314| 833k| "xorl %%r11d, %%r11d\n\t" 1315| 833k| "xorl %%r12d, %%r12d\n\t" 1316| 833k| "xorl %%r13d, %%r13d\n\t" 1317| 833k| "xorl %%r14d, %%r14d\n\t" 1318| 833k| "xorl %%r15d, %%r15d\n\t" 1319| 833k| "xorl %%ebx, %%ebx\n\t" 1320| | 1321| 833k| "movq 72(%[z]), %%rdx\n\t" // row 0: x * y[0] 1322| 833k| "xorl %%eax, %%eax\n\t" 1323| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1324| 833k| "adcx %%rax, %%r8\n\t" 1325| 833k| "movq %%r8, 0(%[z])\n\t" 1326| 833k| "mulx 8(%[x]), %%rax, %%r8\n\t" 1327| 833k| "adox %%rcx, %%rax\n\t" 1328| 833k| "adcx %%rax, %%r9\n\t" 1329| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1330| 833k| "adox %%r8, %%rax\n\t" 1331| 833k| "adcx %%rax, %%r10\n\t" 1332| 833k| "mulx 24(%[x]), %%rax, %%r8\n\t" 1333| 833k| "adox %%rcx, %%rax\n\t" 1334| 833k| "adcx %%rax, %%r11\n\t" 1335| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1336| 833k| "adox %%r8, %%rax\n\t" 1337| 833k| "adcx %%rax, %%r12\n\t" 1338| 833k| "mulx 40(%[x]), %%rax, %%r8\n\t" 1339| 833k| "adox %%rcx, %%rax\n\t" 1340| 833k| "adcx %%rax, %%r13\n\t" 1341| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1342| 833k| "adox %%r8, %%rax\n\t" 1343| 833k| "adcx %%rax, %%r14\n\t" 1344| 833k| "mulx 56(%[x]), %%rax, %%r8\n\t" 1345| 833k| "adox %%rcx, %%rax\n\t" 1346| 833k| "adcx %%rax, %%r15\n\t" 1347| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1348| 833k| "adox %%r8, %%rax\n\t" 1349| 833k| "adcx %%rax, %%rbx\n\t" 1350| 833k| "movl $0, %%eax\n\t" 1351| 833k| "adox %%rax, %%rcx\n\t" 1352| 833k| "adcx %%rax, %%rcx\n\t" 1353| 833k| "movq %%rcx, %%r8\n\t" 1354| | 1355| 833k| "movq 80(%[z]), %%rdx\n\t" // row 1: x * y[1] 1356| 833k| "xorl %%eax, %%eax\n\t" 1357| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1358| 833k| "adcx %%rax, %%r9\n\t" 1359| 833k| "movq %%r9, 8(%[z])\n\t" 1360| 833k| "mulx 8(%[x]), %%rax, %%r9\n\t" 1361| 833k| "adox %%rcx, %%rax\n\t" 1362| 833k| "adcx %%rax, %%r10\n\t" 1363| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1364| 833k| "adox %%r9, %%rax\n\t" 1365| 833k| "adcx %%rax, %%r11\n\t" 1366| 833k| "mulx 24(%[x]), %%rax, %%r9\n\t" 1367| 833k| "adox %%rcx, %%rax\n\t" 1368| 833k| "adcx %%rax, %%r12\n\t" 1369| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1370| 833k| "adox %%r9, %%rax\n\t" 1371| 833k| "adcx %%rax, %%r13\n\t" 1372| 833k| "mulx 40(%[x]), %%rax, %%r9\n\t" 1373| 833k| "adox %%rcx, %%rax\n\t" 1374| 833k| "adcx %%rax, %%r14\n\t" 1375| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1376| 833k| "adox %%r9, %%rax\n\t" 1377| 833k| "adcx %%rax, %%r15\n\t" 1378| 833k| "mulx 56(%[x]), %%rax, %%r9\n\t" 1379| 833k| "adox %%rcx, %%rax\n\t" 1380| 833k| "adcx %%rax, %%rbx\n\t" 1381| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1382| 833k| "adox %%r9, %%rax\n\t" 1383| 833k| "adcx %%rax, %%r8\n\t" 1384| 833k| "movl $0, %%eax\n\t" 1385| 833k| "adox %%rax, %%rcx\n\t" 1386| 833k| "adcx %%rax, %%rcx\n\t" 1387| 833k| "movq %%rcx, %%r9\n\t" 1388| | 1389| 833k| "movq 88(%[z]), %%rdx\n\t" // row 2: x * y[2] 1390| 833k| "xorl %%eax, %%eax\n\t" 1391| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1392| 833k| "adcx %%rax, %%r10\n\t" 1393| 833k| "movq %%r10, 16(%[z])\n\t" 1394| 833k| "mulx 8(%[x]), %%rax, %%r10\n\t" 1395| 833k| "adox %%rcx, %%rax\n\t" 1396| 833k| "adcx %%rax, %%r11\n\t" 1397| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1398| 833k| "adox %%r10, %%rax\n\t" 1399| 833k| "adcx %%rax, %%r12\n\t" 1400| 833k| "mulx 24(%[x]), %%rax, %%r10\n\t" 1401| 833k| "adox %%rcx, %%rax\n\t" 1402| 833k| "adcx %%rax, %%r13\n\t" 1403| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1404| 833k| "adox %%r10, %%rax\n\t" 1405| 833k| "adcx %%rax, %%r14\n\t" 1406| 833k| "mulx 40(%[x]), %%rax, %%r10\n\t" 1407| 833k| "adox %%rcx, %%rax\n\t" 1408| 833k| "adcx %%rax, %%r15\n\t" 1409| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1410| 833k| "adox %%r10, %%rax\n\t" 1411| 833k| "adcx %%rax, %%rbx\n\t" 1412| 833k| "mulx 56(%[x]), %%rax, %%r10\n\t" 1413| 833k| "adox %%rcx, %%rax\n\t" 1414| 833k| "adcx %%rax, %%r8\n\t" 1415| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1416| 833k| "adox %%r10, %%rax\n\t" 1417| 833k| "adcx %%rax, %%r9\n\t" 1418| 833k| "movl $0, %%eax\n\t" 1419| 833k| "adox %%rax, %%rcx\n\t" 1420| 833k| "adcx %%rax, %%rcx\n\t" 1421| 833k| "movq %%rcx, %%r10\n\t" 1422| | 1423| 833k| "movq 96(%[z]), %%rdx\n\t" // row 3: x * y[3] 1424| 833k| "xorl %%eax, %%eax\n\t" 1425| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1426| 833k| "adcx %%rax, %%r11\n\t" 1427| 833k| "movq %%r11, 24(%[z])\n\t" 1428| 833k| "mulx 8(%[x]), %%rax, %%r11\n\t" 1429| 833k| "adox %%rcx, %%rax\n\t" 1430| 833k| "adcx %%rax, %%r12\n\t" 1431| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1432| 833k| "adox %%r11, %%rax\n\t" 1433| 833k| "adcx %%rax, %%r13\n\t" 1434| 833k| "mulx 24(%[x]), %%rax, %%r11\n\t" 1435| 833k| "adox %%rcx, %%rax\n\t" 1436| 833k| "adcx %%rax, %%r14\n\t" 1437| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1438| 833k| "adox %%r11, %%rax\n\t" 1439| 833k| "adcx %%rax, %%r15\n\t" 1440| 833k| "mulx 40(%[x]), %%rax, %%r11\n\t" 1441| 833k| "adox %%rcx, %%rax\n\t" 1442| 833k| "adcx %%rax, %%rbx\n\t" 1443| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1444| 833k| "adox %%r11, %%rax\n\t" 1445| 833k| "adcx %%rax, %%r8\n\t" 1446| 833k| "mulx 56(%[x]), %%rax, %%r11\n\t" 1447| 833k| "adox %%rcx, %%rax\n\t" 1448| 833k| "adcx %%rax, %%r9\n\t" 1449| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1450| 833k| "adox %%r11, %%rax\n\t" 1451| 833k| "adcx %%rax, %%r10\n\t" 1452| 833k| "movl $0, %%eax\n\t" 1453| 833k| "adox %%rax, %%rcx\n\t" 1454| 833k| "adcx %%rax, %%rcx\n\t" 1455| 833k| "movq %%rcx, %%r11\n\t" 1456| | 1457| 833k| "movq 104(%[z]), %%rdx\n\t" // row 4: x * y[4] 1458| 833k| "xorl %%eax, %%eax\n\t" 1459| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1460| 833k| "adcx %%rax, %%r12\n\t" 1461| 833k| "movq %%r12, 32(%[z])\n\t" 1462| 833k| "mulx 8(%[x]), %%rax, %%r12\n\t" 1463| 833k| "adox %%rcx, %%rax\n\t" 1464| 833k| "adcx %%rax, %%r13\n\t" 1465| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1466| 833k| "adox %%r12, %%rax\n\t" 1467| 833k| "adcx %%rax, %%r14\n\t" 1468| 833k| "mulx 24(%[x]), %%rax, %%r12\n\t" 1469| 833k| "adox %%rcx, %%rax\n\t" 1470| 833k| "adcx %%rax, %%r15\n\t" 1471| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1472| 833k| "adox %%r12, %%rax\n\t" 1473| 833k| "adcx %%rax, %%rbx\n\t" 1474| 833k| "mulx 40(%[x]), %%rax, %%r12\n\t" 1475| 833k| "adox %%rcx, %%rax\n\t" 1476| 833k| "adcx %%rax, %%r8\n\t" 1477| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1478| 833k| "adox %%r12, %%rax\n\t" 1479| 833k| "adcx %%rax, %%r9\n\t" 1480| 833k| "mulx 56(%[x]), %%rax, %%r12\n\t" 1481| 833k| "adox %%rcx, %%rax\n\t" 1482| 833k| "adcx %%rax, %%r10\n\t" 1483| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1484| 833k| "adox %%r12, %%rax\n\t" 1485| 833k| "adcx %%rax, %%r11\n\t" 1486| 833k| "movl $0, %%eax\n\t" 1487| 833k| "adox %%rax, %%rcx\n\t" 1488| 833k| "adcx %%rax, %%rcx\n\t" 1489| 833k| "movq %%rcx, %%r12\n\t" 1490| | 1491| 833k| "movq 112(%[z]), %%rdx\n\t" // row 5: x * y[5] 1492| 833k| "xorl %%eax, %%eax\n\t" 1493| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1494| 833k| "adcx %%rax, %%r13\n\t" 1495| 833k| "movq %%r13, 40(%[z])\n\t" 1496| 833k| "mulx 8(%[x]), %%rax, %%r13\n\t" 1497| 833k| "adox %%rcx, %%rax\n\t" 1498| 833k| "adcx %%rax, %%r14\n\t" 1499| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1500| 833k| "adox %%r13, %%rax\n\t" 1501| 833k| "adcx %%rax, %%r15\n\t" 1502| 833k| "mulx 24(%[x]), %%rax, %%r13\n\t" 1503| 833k| "adox %%rcx, %%rax\n\t" 1504| 833k| "adcx %%rax, %%rbx\n\t" 1505| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1506| 833k| "adox %%r13, %%rax\n\t" 1507| 833k| "adcx %%rax, %%r8\n\t" 1508| 833k| "mulx 40(%[x]), %%rax, %%r13\n\t" 1509| 833k| "adox %%rcx, %%rax\n\t" 1510| 833k| "adcx %%rax, %%r9\n\t" 1511| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1512| 833k| "adox %%r13, %%rax\n\t" 1513| 833k| "adcx %%rax, %%r10\n\t" 1514| 833k| "mulx 56(%[x]), %%rax, %%r13\n\t" 1515| 833k| "adox %%rcx, %%rax\n\t" 1516| 833k| "adcx %%rax, %%r11\n\t" 1517| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1518| 833k| "adox %%r13, %%rax\n\t" 1519| 833k| "adcx %%rax, %%r12\n\t" 1520| 833k| "movl $0, %%eax\n\t" 1521| 833k| "adox %%rax, %%rcx\n\t" 1522| 833k| "adcx %%rax, %%rcx\n\t" 1523| 833k| "movq %%rcx, %%r13\n\t" 1524| | 1525| 833k| "movq 120(%[z]), %%rdx\n\t" // row 6: x * y[6] 1526| 833k| "xorl %%eax, %%eax\n\t" 1527| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1528| 833k| "adcx %%rax, %%r14\n\t" 1529| 833k| "movq %%r14, 48(%[z])\n\t" 1530| 833k| "mulx 8(%[x]), %%rax, %%r14\n\t" 1531| 833k| "adox %%rcx, %%rax\n\t" 1532| 833k| "adcx %%rax, %%r15\n\t" 1533| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1534| 833k| "adox %%r14, %%rax\n\t" 1535| 833k| "adcx %%rax, %%rbx\n\t" 1536| 833k| "mulx 24(%[x]), %%rax, %%r14\n\t" 1537| 833k| "adox %%rcx, %%rax\n\t" 1538| 833k| "adcx %%rax, %%r8\n\t" 1539| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1540| 833k| "adox %%r14, %%rax\n\t" 1541| 833k| "adcx %%rax, %%r9\n\t" 1542| 833k| "mulx 40(%[x]), %%rax, %%r14\n\t" 1543| 833k| "adox %%rcx, %%rax\n\t" 1544| 833k| "adcx %%rax, %%r10\n\t" 1545| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1546| 833k| "adox %%r14, %%rax\n\t" 1547| 833k| "adcx %%rax, %%r11\n\t" 1548| 833k| "mulx 56(%[x]), %%rax, %%r14\n\t" 1549| 833k| "adox %%rcx, %%rax\n\t" 1550| 833k| "adcx %%rax, %%r12\n\t" 1551| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1552| 833k| "adox %%r14, %%rax\n\t" 1553| 833k| "adcx %%rax, %%r13\n\t" 1554| 833k| "movl $0, %%eax\n\t" 1555| 833k| "adox %%rax, %%rcx\n\t" 1556| 833k| "adcx %%rax, %%rcx\n\t" 1557| 833k| "movq %%rcx, %%r14\n\t" 1558| | 1559| 833k| "movq 128(%[z]), %%rdx\n\t" // row 7: x * y[7] 1560| 833k| "xorl %%eax, %%eax\n\t" 1561| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1562| 833k| "adcx %%rax, %%r15\n\t" 1563| 833k| "movq %%r15, 56(%[z])\n\t" 1564| 833k| "mulx 8(%[x]), %%rax, %%r15\n\t" 1565| 833k| "adox %%rcx, %%rax\n\t" 1566| 833k| "adcx %%rax, %%rbx\n\t" 1567| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1568| 833k| "adox %%r15, %%rax\n\t" 1569| 833k| "adcx %%rax, %%r8\n\t" 1570| 833k| "mulx 24(%[x]), %%rax, %%r15\n\t" 1571| 833k| "adox %%rcx, %%rax\n\t" 1572| 833k| "adcx %%rax, %%r9\n\t" 1573| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1574| 833k| "adox %%r15, %%rax\n\t" 1575| 833k| "adcx %%rax, %%r10\n\t" 1576| 833k| "mulx 40(%[x]), %%rax, %%r15\n\t" 1577| 833k| "adox %%rcx, %%rax\n\t" 1578| 833k| "adcx %%rax, %%r11\n\t" 1579| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1580| 833k| "adox %%r15, %%rax\n\t" 1581| 833k| "adcx %%rax, %%r12\n\t" 1582| 833k| "mulx 56(%[x]), %%rax, %%r15\n\t" 1583| 833k| "adox %%rcx, %%rax\n\t" 1584| 833k| "adcx %%rax, %%r13\n\t" 1585| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1586| 833k| "adox %%r15, %%rax\n\t" 1587| 833k| "adcx %%rax, %%r14\n\t" 1588| 833k| "movl $0, %%eax\n\t" 1589| 833k| "adox %%rax, %%rcx\n\t" 1590| 833k| "adcx %%rax, %%rcx\n\t" 1591| 833k| "movq %%rcx, %%r15\n\t" 1592| | 1593| 833k| "movq 136(%[z]), %%rdx\n\t" // row 8: x * y[8] 1594| 833k| "xorl %%eax, %%eax\n\t" 1595| 833k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1596| 833k| "adcx %%rax, %%rbx\n\t" 1597| 833k| "movq %%rbx, 64(%[z])\n\t" 1598| 833k| "mulx 8(%[x]), %%rax, %%rbx\n\t" 1599| 833k| "adox %%rcx, %%rax\n\t" 1600| 833k| "adcx %%rax, %%r8\n\t" 1601| 833k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1602| 833k| "adox %%rbx, %%rax\n\t" 1603| 833k| "adcx %%rax, %%r9\n\t" 1604| 833k| "mulx 24(%[x]), %%rax, %%rbx\n\t" 1605| 833k| "adox %%rcx, %%rax\n\t" 1606| 833k| "adcx %%rax, %%r10\n\t" 1607| 833k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1608| 833k| "adox %%rbx, %%rax\n\t" 1609| 833k| "adcx %%rax, %%r11\n\t" 1610| 833k| "mulx 40(%[x]), %%rax, %%rbx\n\t" 1611| 833k| "adox %%rcx, %%rax\n\t" 1612| 833k| "adcx %%rax, %%r12\n\t" 1613| 833k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1614| 833k| "adox %%rbx, %%rax\n\t" 1615| 833k| "adcx %%rax, %%r13\n\t" 1616| 833k| "mulx 56(%[x]), %%rax, %%rbx\n\t" 1617| 833k| "adox %%rcx, %%rax\n\t" 1618| 833k| "adcx %%rax, %%r14\n\t" 1619| 833k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1620| 833k| "adox %%rbx, %%rax\n\t" 1621| 833k| "adcx %%rax, %%r15\n\t" 1622| 833k| "movl $0, %%eax\n\t" 1623| 833k| "adox %%rax, %%rcx\n\t" 1624| 833k| "adcx %%rax, %%rcx\n\t" 1625| 833k| "movq %%rcx, %%rbx\n\t" 1626| | 1627| 833k| "movq %%r8, 72(%[z])\n\t" 1628| 833k| "movq %%r9, 80(%[z])\n\t" 1629| 833k| "movq %%r10, 88(%[z])\n\t" 1630| 833k| "movq %%r11, 96(%[z])\n\t" 1631| 833k| "movq %%r12, 104(%[z])\n\t" 1632| 833k| "movq %%r13, 112(%[z])\n\t" 1633| 833k| "movq %%r14, 120(%[z])\n\t" 1634| 833k| "movq %%r15, 128(%[z])\n\t" 1635| 833k| "movq %%rbx, 136(%[z])\n\t" 1636| 833k| : 1637| 833k| : [z] "r"(z), [x] "r"(x) 1638| 833k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "rbx", "cc", "memory"); 1639| | // clang-format on 1640| 833k|} _ZN5Botan17Barrett_ReductionC2ERKNS_6BigIntES1_m: 17| 10.6k| m_modulus(m), m_mu(std::move(mu)), m_mod_words(mw), m_modulus_bits(m.bits()) { 18| | // Give some extra space for Karatsuba 19| 10.6k| m_modulus.grow_to(m_mod_words + 8); 20| 10.6k| m_mu.grow_to(m_mod_words + 8); 21| 10.6k|} _ZN5Botan17Barrett_Reduction18for_secret_modulusERKNS_6BigIntE: 23| 10.6k|Barrett_Reduction Barrett_Reduction::for_secret_modulus(const BigInt& mod) { 24| 10.6k| BOTAN_ARG_CHECK(mod.signum() > 0, "Modulus must be positive"); ------------------ | | 35| 10.6k| do { \ | | 36| 10.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.6k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.6k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.6k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.6k] | | ------------------ ------------------ 25| | 26| 10.6k| const size_t mod_words = mod.sig_words(); 27| | 28| | // Compute mu = floor(2^{2k} / m) 29| 10.6k| const size_t mu_bits = 2 * WordInfo::bits * mod_words; 30| 10.6k| return Barrett_Reduction(mod, ct_divide_pow2k(mu_bits, mod), mod_words); 31| 10.6k|} _ZN5Botan17Barrett_Reduction18for_public_modulusERKNS_6BigIntE: 33| 8.95k|Barrett_Reduction Barrett_Reduction::for_public_modulus(const BigInt& mod) { 34| 8.95k| return Barrett_Reduction::for_secret_modulus(mod); 35| 8.95k|} _ZNK5Botan17Barrett_Reduction8multiplyERKNS_6BigIntES3_: 153| 10.8k|BigInt Barrett_Reduction::multiply(const BigInt& x, const BigInt& y) const { 154| 10.8k| BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett multiply"); ------------------ | | 35| 10.8k| do { \ | | 36| 10.8k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.8k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.8k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.8k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.8k] | | ------------------ ------------------ 155| 10.8k| BOTAN_ARG_CHECK(acceptable_barrett_input(y, m_modulus).as_bool(), "Invalid y param for Barrett multiply"); ------------------ | | 35| 10.8k| do { \ | | 36| 10.8k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.8k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.8k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.8k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.8k] | | ------------------ ------------------ 156| | 157| 10.8k| secure_vector ws(2 * (m_mod_words + 2)); 158| 10.8k| secure_vector xy(2 * m_mod_words); 159| | 160| 10.8k| bigint_mul(xy.data(), 161| 10.8k| xy.size(), 162| 10.8k| x._data(), 163| 10.8k| x.size(), 164| 10.8k| std::min(x.size(), m_mod_words), 165| 10.8k| y._data(), 166| 10.8k| y.size(), 167| 10.8k| std::min(y.size(), m_mod_words), 168| 10.8k| ws.data(), 169| 10.8k| ws.size()); 170| | 171| 10.8k| return barrett_reduce(m_mod_words, m_modulus, m_mu, xy, ws); 172| 10.8k|} _ZNK5Botan17Barrett_Reduction6squareERKNS_6BigIntE: 174| 10.6k|BigInt Barrett_Reduction::square(const BigInt& x) const { 175| 10.6k| BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett square"); ------------------ | | 35| 10.6k| do { \ | | 36| 10.6k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.6k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.6k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.6k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.6k] | | ------------------ ------------------ 176| | 177| 10.6k| secure_vector ws(2 * (m_mod_words + 2)); 178| 10.6k| secure_vector x2(2 * m_mod_words); 179| | 180| 10.6k| bigint_sqr(x2.data(), x2.size(), x._data(), x.size(), std::min(x.size(), m_mod_words), ws.data(), ws.size()); 181| | 182| 10.6k| return barrett_reduce(m_mod_words, m_modulus, m_mu, x2, ws); 183| 10.6k|} _ZNK5Botan17Barrett_Reduction6reduceERKNS_6BigIntE: 185| 7.80k|BigInt Barrett_Reduction::reduce(const BigInt& x) const { 186| 7.80k| BOTAN_ARG_CHECK(x.signum() >= 0, "Argument must be non-negative"); ------------------ | | 35| 7.80k| do { \ | | 36| 7.80k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 7.80k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 7.80k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 7.80k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 7.80k] | | ------------------ ------------------ 187| | 188| 7.80k| const size_t x_sw = x.sig_words(); 189| 7.80k| BOTAN_ARG_CHECK(x_sw <= 2 * m_mod_words, "Argument is too large for Barrett reduction"); ------------------ | | 35| 7.80k| do { \ | | 36| 7.80k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 7.80k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 7.80k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 7.80k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 7.80k] | | ------------------ ------------------ 190| | 191| 7.80k| x.grow_to(2 * m_mod_words); 192| | 193| 7.80k| secure_vector ws; 194| 7.80k| return barrett_reduce(m_mod_words, m_modulus, m_mu, x._as_span(), ws); 195| 7.80k|} barrett.cpp:_ZN5Botan12_GLOBAL__N_124acceptable_barrett_inputERKNS_6BigIntES3_: 145| 32.4k|CT::Choice acceptable_barrett_input(const BigInt& x, const BigInt& modulus) { 146| 32.4k| const auto x_is_positive = CT::Choice::from_int(static_cast(x.signum() >= 0)); 147| 32.4k| const auto x_lt_mod = bigint_ct_is_lt(x._data(), x.size(), modulus._data(), modulus.sig_words()).as_choice(); 148| 32.4k| return x_is_positive && x_lt_mod; 149| 32.4k|} barrett.cpp:_ZN5Botan12_GLOBAL__N_114barrett_reduceEmRKNS_6BigIntES3_NSt3__14spanIKmLm18446744073709551615EEERNS4_6vectorImNS_16secure_allocatorImEEEE: 48| 29.3k| size_t mod_words, const BigInt& modulus, const BigInt& mu, std::span x_words, secure_vector& ws) { 49| 29.3k| BOTAN_ASSERT_NOMSG(modulus.sig_words() == mod_words); ------------------ | | 84| 29.3k| do { \ | | 85| 29.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 29.3k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 29.3k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 29.3k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 29.3k] | | ------------------ ------------------ 50| | 51| | // Caller must expand input to be at least this size 52| 29.3k| BOTAN_ASSERT_NOMSG(x_words.size() >= 2 * mod_words); ------------------ | | 84| 29.3k| do { \ | | 85| 29.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 29.3k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 29.3k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 29.3k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 29.3k] | | ------------------ ------------------ 53| | 54| | // Normally mod_words + 1 but can be + 2 if the modulus is a power of 2 55| 29.3k| const size_t mu_words = mu.sig_words(); 56| 29.3k| BOTAN_ASSERT_NOMSG(mu_words <= mod_words + 2); ------------------ | | 84| 29.3k| do { \ | | 85| 29.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 29.3k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 29.3k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 29.3k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 29.3k] | | ------------------ ------------------ 57| | 58| 29.3k| if(ws.size() < 2 * (mod_words + 2)) { ------------------ | Branch (58:7): [True: 7.80k, False: 21.5k] ------------------ 59| 7.80k| ws.resize(2 * (mod_words + 2)); 60| 7.80k| } 61| | 62| 29.3k| CT::poison(x_words); 63| | 64| | /* 65| | * Following the notation of Handbook of Applied Cryptography 66| | * Algorithm 14.42 "Barrett modular reduction", page 604 67| | * 68| | * 69| | * Using `mu` for µ in the code 70| | */ 71| | 72| | // Compute q1 = floor(x / 2^(k - 1)) which is equivalent to ignoring the low (k-1) words 73| | 74| | // 2 * mod_words + 1 is sufficient, extra is to enable Karatsuba 75| 29.3k| secure_vector r(2 * mu_words + 2); 76| | 77| 29.3k| copy_mem(r.data(), x_words.data() + (mod_words - 1), mod_words + 1); 78| | 79| | // Now compute q2 = q1 * µ 80| | 81| | // We allocate more size than required since this allows Karatsuba more often; 82| | // just `mu_words + (mod_words + 1)` is sufficient 83| 29.3k| const size_t q2_size = 2 * mu_words + 2; 84| | 85| 29.3k| secure_vector q2(q2_size); 86| | 87| 29.3k| bigint_mul( 88| 29.3k| q2.data(), q2.size(), r.data(), r.size(), mod_words + 1, mu._data(), mu.size(), mu_words, ws.data(), ws.size()); 89| | 90| | // Compute r2 = (floor(q2 / b^(k+1)) * m) mod 2^(k+1) 91| | // The division/floor is again effected by just ignoring the low k + 1 words 92| 29.3k| bigint_mul(r.data(), 93| 29.3k| r.size(), 94| 29.3k| &q2[mod_words + 1], // ignoring the low mod_words + 1 words of the first product 95| 29.3k| q2.size() - (mod_words + 1), 96| 29.3k| mod_words + 1, 97| 29.3k| modulus._data(), 98| 29.3k| modulus.size(), 99| 29.3k| mod_words, 100| 29.3k| ws.data(), 101| 29.3k| ws.size()); 102| | 103| | // Clear the high words of the product, equivalent to computing mod 2^(k+1) 104| | // TODO add masked mul to avoid computing high bits at all 105| 29.3k| clear_mem(std::span{r}.subspan(mod_words + 1)); 106| | 107| | // Compute r = r1 - r2 108| | 109| | // The return value of bigint_sub_abs isn't quite right for what we need here so first compare 110| 29.3k| const int32_t relative_size = bigint_cmp(r.data(), mod_words + 1, x_words.data(), mod_words + 1); 111| | 112| 29.3k| bigint_sub_abs(r.data(), r.data(), x_words.data(), mod_words + 1, ws.data()); 113| | 114| | /* 115| | If r is negative then we have to set r to r + 2^(k+1) 116| | 117| | However for r negative computing this sum is equivalent to computing 2^(k+1) - abs(r) 118| | */ 119| 29.3k| clear_mem(ws.data(), mod_words + 2); 120| 29.3k| ws[mod_words + 1] = 1; 121| 29.3k| bigint_sub2(ws.data(), mod_words + 2, r.data(), mod_words + 2); 122| | 123| | // If relative_size > 0 then assign r to 2^(k+1) - r 124| 29.3k| CT::Mask::is_equal(static_cast(relative_size), 1).select_n(r.data(), ws.data(), r.data(), mod_words + 2); 125| | 126| | /* 127| | * Per HAC Note 14.44 (ii) "step 4 is repeated at most twice since 0 <= r < 3m" 128| | */ 129| 29.3k| const size_t bound = 2; 130| | 131| 29.3k| BOTAN_ASSERT_NOMSG(r.size() >= mod_words + 1); ------------------ | | 84| 29.3k| do { \ | | 85| 29.3k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 29.3k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 29.3k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 29.3k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 29.3k] | | ------------------ ------------------ 132| 88.0k| for(size_t i = 0; i != bound; ++i) { ------------------ | Branch (132:22): [True: 58.7k, False: 29.3k] ------------------ 133| 58.7k| const word borrow = bigint_sub3(ws.data(), r.data(), mod_words + 1, modulus._data(), mod_words); 134| 58.7k| CT::Mask::is_zero(borrow).select_n(r.data(), ws.data(), r.data(), mod_words + 1); 135| 58.7k| } 136| | 137| 29.3k| CT::unpoison(q2); 138| 29.3k| CT::unpoison(r); 139| 29.3k| CT::unpoison(ws); 140| 29.3k| CT::unpoison(x_words); 141| | 142| 29.3k| return BigInt::_from_words(r); 143| 29.3k|} _ZN5Botan24inverse_mod_public_primeERKNS_6BigIntES2_: 295| 817|BigInt inverse_mod_public_prime(const BigInt& x, const BigInt& p) { 296| 817| BOTAN_ARG_CHECK(p.signum() > 0, "Modulus must be positive"); ------------------ | | 35| 817| do { \ | | 36| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 817| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 817] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 817| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 817] | | ------------------ ------------------ 297| 817| BOTAN_ARG_CHECK(x.signum() > 0, "Input must be positive"); ------------------ | | 35| 817| do { \ | | 36| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 817| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 817] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 817| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 817] | | ------------------ ------------------ 298| 817| BOTAN_ARG_CHECK(x < p, "Input must be less than modulus"); ------------------ | | 35| 817| do { \ | | 36| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 817| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 817] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 817| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 817] | | ------------------ ------------------ 299| 817| BOTAN_ARG_CHECK(p.is_odd() && p > 1, "Primes are odd integers greater than 1"); ------------------ | | 35| 817| do { \ | | 36| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.63k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 817, False: 0] | | | Branch (37:12): [True: 817, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 817| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 817] | | ------------------ ------------------ 300| | 301| | // TODO possibly use FLT, or the algorithm presented for this case in 302| | // Handbook of Elliptic and Hyperelliptic Curve Cryptography 303| | 304| 817| return inverse_mod_odd_modulus(x, p); 305| 817|} mod_inv.cpp:_ZN5Botan12_GLOBAL__N_123inverse_mod_odd_modulusERKNS_6BigIntES3_: 21| 817|BigInt inverse_mod_odd_modulus(const BigInt& n, const BigInt& mod) { 22| | // Caller should assure these preconditions: 23| 817| BOTAN_ASSERT_NOMSG(n.signum() >= 0); ------------------ | | 84| 817| do { \ | | 85| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 817| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 817] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 817| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 817] | | ------------------ ------------------ 24| 817| BOTAN_ASSERT_NOMSG(mod.signum() > 0); ------------------ | | 84| 817| do { \ | | 85| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 817| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 817] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 817| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 817] | | ------------------ ------------------ 25| 817| BOTAN_ASSERT_NOMSG(n < mod); ------------------ | | 84| 817| do { \ | | 85| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 817| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 817] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 817| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 817] | | ------------------ ------------------ 26| 817| BOTAN_ASSERT_NOMSG(mod >= 3 && mod.is_odd()); ------------------ | | 84| 817| do { \ | | 85| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 1.63k| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 817, False: 0] | | | Branch (86:12): [True: 817, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 817| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 817] | | ------------------ ------------------ 27| | 28| | /* 29| | This uses a modular inversion algorithm designed by Niels Möller 30| | and implemented in Nettle. The same algorithm was later also 31| | adapted to GMP in mpn_sec_invert. 32| | 33| | It can be easily implemented in a way that does not depend on 34| | secret branches or memory lookups, providing resistance against 35| | some forms of side channel attack. 36| | 37| | There is also a description of the algorithm in Appendix 5 of "Fast 38| | Software Polynomial Multiplication on ARM Processors using the NEON Engine" 39| | by Danilo Câmara, Conrado P. L. Gouvêa, Julio López, and Ricardo 40| | Dahab in LNCS 8182 41| | https://inria.hal.science/hal-01506572/document 42| | 43| | Thanks to Niels for creating the algorithm, explaining some things 44| | about it, and the reference to the paper. 45| | */ 46| | 47| 817| const size_t mod_words = mod.sig_words(); 48| 817| BOTAN_ASSERT(mod_words > 0, "Not empty"); ------------------ | | 71| 817| do { \ | | 72| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 817| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 817] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 817| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 817] | | ------------------ ------------------ 49| | 50| 817| secure_vector tmp_mem(5 * mod_words); 51| | 52| 817| word* v_w = &tmp_mem[0]; // NOLINT(readability-container-data-pointer) 53| 817| word* u_w = &tmp_mem[1 * mod_words]; 54| 817| word* b_w = &tmp_mem[2 * mod_words]; 55| 817| word* a_w = &tmp_mem[3 * mod_words]; 56| 817| word* mp1o2 = &tmp_mem[4 * mod_words]; 57| | 58| 817| copy_mem(a_w, n._data(), std::min(n.size(), mod_words)); 59| 817| copy_mem(b_w, mod._data(), std::min(mod.size(), mod_words)); 60| 817| u_w[0] = 1; 61| | // v_w = 0 62| | 63| | // compute (mod + 1) / 2 which [because mod is odd] is equal to 64| | // (mod / 2) + 1 65| 817| copy_mem(mp1o2, mod._data(), std::min(mod.size(), mod_words)); 66| 817| bigint_shr1(mp1o2, mod_words, 1); 67| 817| const word carry = bigint_add2(mp1o2, mod_words, u_w, 1); 68| 817| BOTAN_ASSERT_NOMSG(carry == 0); ------------------ | | 84| 817| do { \ | | 85| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 817| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 817] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 817| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 817] | | ------------------ ------------------ 69| | 70| 817| CT::poison(tmp_mem.data(), tmp_mem.size()); 71| | 72| | // Only n.bits() + mod.bits() iterations are required, but avoid leaking the size of n 73| 817| const size_t execs = 2 * mod.bits(); 74| | 75| 364k| for(size_t i = 0; i != execs; ++i) { ------------------ | Branch (75:22): [True: 363k, False: 817] ------------------ 76| 363k| const word odd_a = a_w[0] & 1; 77| | 78| | //if(odd_a) a -= b 79| 363k| const word underflow = bigint_cnd_sub(odd_a, a_w, b_w, mod_words); 80| | 81| | //if(underflow) { b -= a; a = abs(a); swap(u, v); } 82| 363k| bigint_cnd_add(underflow, b_w, a_w, mod_words); 83| 363k| bigint_cnd_abs(underflow, a_w, mod_words); 84| 363k| bigint_cnd_swap(underflow, u_w, v_w, mod_words); 85| | 86| | // a >>= 1 87| 363k| bigint_shr1(a_w, mod_words, 1); 88| | 89| | //if(odd_a) u -= v; 90| 363k| const word borrow = bigint_cnd_sub(odd_a, u_w, v_w, mod_words); 91| | 92| | // if(borrow) u += p 93| 363k| bigint_cnd_add(borrow, u_w, mod._data(), mod_words); 94| | 95| 363k| const word odd_u = u_w[0] & 1; 96| | 97| | // u >>= 1 98| 363k| bigint_shr1(u_w, mod_words, 1); 99| | 100| | //if(odd_u) u += mp1o2; 101| 363k| bigint_cnd_add(odd_u, u_w, mp1o2, mod_words); 102| 363k| } 103| | 104| 817| const auto a_is_0 = CT::all_zeros(a_w, mod_words); 105| | 106| 817| auto b_is_1 = CT::Mask::is_equal(b_w[0], 1); 107| 3.25k| for(size_t i = 1; i != mod_words; ++i) { ------------------ | Branch (107:22): [True: 2.44k, False: 817] ------------------ 108| 2.44k| b_is_1 &= CT::Mask::is_zero(b_w[i]); 109| 2.44k| } 110| | 111| 817| BOTAN_ASSERT(a_is_0.as_bool(), "A is zero"); ------------------ | | 71| 817| do { \ | | 72| 817| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 817| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 817] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 817| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 817] | | ------------------ ------------------ 112| | 113| | // if b != 1 then gcd(n,mod) > 1 and inverse does not exist 114| | // in which case zero out the result to indicate this 115| 817| (~b_is_1).if_set_zero_out(v_w, mod_words); 116| | 117| | /* 118| | * We've placed the result in the lowest words of the temp buffer. 119| | * So just clear out the other values and then give that buffer to a 120| | * BigInt. 121| | */ 122| 817| clear_mem(&tmp_mem[mod_words], 4 * mod_words); 123| | 124| 817| CT::unpoison(tmp_mem.data(), tmp_mem.size()); 125| | 126| 817| BigInt r; 127| 817| r.swap_reg(tmp_mem); 128| 817| return r; 129| 817|} _ZN5Botan17Montgomery_Params4DataC2ERKNS_6BigIntERKNS_17Barrett_ReductionE: 40| 4.47k|Montgomery_Params::Data::Data(const BigInt& p, const Barrett_Reduction& mod_p) { 41| 4.47k| if(p.is_even() || p < 3) { ------------------ | Branch (41:7): [True: 0, False: 4.47k] | Branch (41:22): [True: 0, False: 4.47k] ------------------ 42| 0| throw Invalid_Argument("Montgomery_Params invalid modulus"); 43| 0| } 44| | 45| 4.47k| m_p = p; 46| 4.47k| m_p_words = m_p.sig_words(); 47| 4.47k| m_p_dash = monty_inverse(m_p.word_at(0)); 48| | 49| 4.47k| const BigInt r = BigInt::power_of_2(m_p_words * WordInfo::bits); 50| | 51| 4.47k| m_r1 = mod_p.reduce(r); 52| 4.47k| m_r2 = mod_p.square(m_r1); 53| 4.47k| m_r3 = mod_p.multiply(m_r1, m_r2); 54| | 55| | // Barrett should be at least zero prefixing up to modulus size 56| 4.47k| BOTAN_ASSERT_NOMSG(m_r1.size() >= m_p_words); ------------------ | | 84| 4.47k| do { \ | | 85| 4.47k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 4.47k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 4.47k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 4.47k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 4.47k] | | ------------------ ------------------ 57| 4.47k| BOTAN_ASSERT_NOMSG(m_r2.size() >= m_p_words); ------------------ | | 84| 4.47k| do { \ | | 85| 4.47k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 4.47k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 4.47k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 4.47k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 4.47k] | | ------------------ ------------------ 58| 4.47k| BOTAN_ASSERT_NOMSG(m_r3.size() >= m_p_words); ------------------ | | 84| 4.47k| do { \ | | 85| 4.47k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 4.47k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 4.47k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 4.47k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 4.47k] | | ------------------ ------------------ 59| 4.47k|} _ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntERKNS_17Barrett_ReductionE: 62| 4.47k| m_data(std::make_shared(p, mod_p)) {} _ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntE: 65| 1.67k| Montgomery_Params(p, Barrett_Reduction::for_secret_modulus(p)) {} _ZNK5Botan17Montgomery_ParamseqERKS0_: 67| 550k|bool Montgomery_Params::operator==(const Montgomery_Params& other) const { 68| 550k| if(this->m_data == other.m_data) { ------------------ | Branch (68:7): [True: 550k, False: 0] ------------------ 69| 550k| return true; 70| 550k| } 71| | 72| 0| return (this->m_data->p() == other.m_data->p()); 73| 550k|} _ZNK5Botan17Montgomery_Params4redcERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE: 75| 1.36k|BigInt Montgomery_Params::redc(const BigInt& x, secure_vector& ws) const { 76| 1.36k| const size_t p_size = this->p_words(); 77| | 78| 1.36k| if(ws.size() < p_size) { ------------------ | Branch (78:7): [True: 884, False: 482] ------------------ 79| 884| ws.resize(p_size); 80| 884| } 81| | 82| 1.36k| BigInt z = x; 83| 1.36k| z.grow_to(2 * p_size); 84| | 85| 1.36k| bigint_monty_redc_inplace(z.mutable_data(), this->p()._data(), p_size, this->p_dash(), ws.data(), ws.size()); 86| | 87| 1.36k| return z; 88| 1.36k|} _ZNK5Botan17Montgomery_Params3mulERKNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 90| 910k|BigInt Montgomery_Params::mul(const BigInt& x, const BigInt& y, secure_vector& ws) const { 91| 910k| const size_t p_size = this->p_words(); 92| 910k| BigInt z = BigInt::with_capacity(2 * p_size); 93| 910k| this->mul(z, x, y, ws); 94| 910k| return z; 95| 910k|} _ZNK5Botan17Montgomery_Params3mulERNS_6BigIntERKS1_S4_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 97| 3.76M|void Montgomery_Params::mul(BigInt& z, const BigInt& x, const BigInt& y, secure_vector& ws) const { 98| 3.76M| BOTAN_ARG_CHECK(&z != &x && &z != &y, "Montgomery_Params::mul output must not alias inputs"); ------------------ | | 35| 3.76M| do { \ | | 36| 3.76M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 7.52M| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 3.76M, False: 0] | | | Branch (37:12): [True: 3.76M, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 3.76M| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 3.76M] | | ------------------ ------------------ 99| | 100| 3.76M| const size_t p_size = this->p_words(); 101| | 102| 3.76M| if(ws.size() < 2 * p_size) { ------------------ | Branch (102:7): [True: 3.27k, False: 3.75M] ------------------ 103| 3.27k| ws.resize(2 * p_size); 104| 3.27k| } 105| | 106| 3.76M| BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size); ------------------ | | 137| 3.76M| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 3.76M| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 3.76M] | | ------------------ ------------------ 107| 3.76M| BOTAN_DEBUG_ASSERT(y.sig_words() <= p_size); ------------------ | | 137| 3.76M| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 3.76M| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 3.76M] | | ------------------ ------------------ 108| | 109| 3.76M| if(z.size() < 2 * p_size) { ------------------ | Branch (109:7): [True: 300k, False: 3.46M] ------------------ 110| 300k| z.grow_to(2 * p_size); 111| 300k| } 112| | 113| 3.76M| bigint_mul(z.mutable_data(), 114| 3.76M| z.size(), 115| 3.76M| x._data(), 116| 3.76M| x.size(), 117| 3.76M| std::min(p_size, x.size()), 118| 3.76M| y._data(), 119| 3.76M| y.size(), 120| 3.76M| std::min(p_size, y.size()), 121| 3.76M| ws.data(), 122| 3.76M| ws.size()); 123| | 124| 3.76M| bigint_monty_redc_inplace(z.mutable_data(), this->p()._data(), p_size, this->p_dash(), ws.data(), ws.size()); 125| 3.76M|} _ZNK5Botan17Montgomery_Params3mulERNS_6BigIntERKS1_NSt3__14spanIKmLm18446744073709551615EEERNS5_6vectorImNS_16secure_allocatorImEEEE: 127| 743k|void Montgomery_Params::mul(BigInt& z, const BigInt& x, std::span y, secure_vector& ws) const { 128| 743k| BOTAN_ARG_CHECK(&z != &x, "Montgomery_Params::mul output must not alias x"); ------------------ | | 35| 743k| do { \ | | 36| 743k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 743k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 743k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 743k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 743k] | | ------------------ ------------------ 129| 743k| BOTAN_ARG_CHECK(!ranges_overlap(z._data(), z.size(), y.data(), y.size()), ------------------ | | 35| 743k| do { \ | | 36| 743k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 743k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 743k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 743k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 743k] | | ------------------ ------------------ 130| 743k| "Montgomery_Params::mul output must not overlap y"); 131| | 132| 743k| const size_t p_size = this->p_words(); 133| | 134| 743k| if(ws.size() < 2 * p_size) { ------------------ | Branch (134:7): [True: 0, False: 743k] ------------------ 135| 0| ws.resize(2 * p_size); 136| 0| } 137| 743k| if(z.size() < 2 * p_size) { ------------------ | Branch (137:7): [True: 0, False: 743k] ------------------ 138| 0| z.grow_to(2 * p_size); 139| 0| } 140| | 141| 743k| BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size); ------------------ | | 137| 743k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 743k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 743k] | | ------------------ ------------------ 142| | 143| 743k| bigint_mul(z.mutable_data(), 144| 743k| z.size(), 145| 743k| x._data(), 146| 743k| x.size(), 147| 743k| std::min(p_size, x.size()), 148| 743k| y.data(), 149| 743k| y.size(), 150| 743k| std::min(p_size, y.size()), 151| 743k| ws.data(), 152| 743k| ws.size()); 153| | 154| 743k| bigint_monty_redc_inplace(z.mutable_data(), this->p()._data(), p_size, this->p_dash(), ws.data(), ws.size()); 155| 743k|} _ZNK5Botan17Montgomery_Params6mul_byERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 157| 9.33k|void Montgomery_Params::mul_by(BigInt& x, const BigInt& y, secure_vector& ws) const { 158| 9.33k| const size_t p_size = this->p_words(); 159| | 160| 9.33k| if(ws.size() < 4 * p_size) { ------------------ | Branch (160:7): [True: 4.66k, False: 4.66k] ------------------ 161| 4.66k| ws.resize(4 * p_size); 162| 4.66k| } 163| | 164| 9.33k| word* z_data = ws.data(); 165| 9.33k| word* ws_data = &ws[2 * p_size]; 166| | 167| 9.33k| BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size); ------------------ | | 137| 9.33k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 9.33k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 9.33k] | | ------------------ ------------------ 168| | 169| 9.33k| bigint_mul(z_data, 170| 9.33k| 2 * p_size, 171| 9.33k| x._data(), 172| 9.33k| x.size(), 173| 9.33k| std::min(p_size, x.size()), 174| 9.33k| y._data(), 175| 9.33k| y.size(), 176| 9.33k| std::min(p_size, y.size()), 177| 9.33k| ws_data, 178| 9.33k| 2 * p_size); 179| | 180| 9.33k| bigint_monty_redc_inplace(z_data, this->p()._data(), p_size, this->p_dash(), ws_data, 2 * p_size); 181| | 182| 9.33k| if(x.size() < 2 * p_size) { ------------------ | Branch (182:7): [True: 3.28k, False: 6.05k] ------------------ 183| 3.28k| x.grow_to(2 * p_size); 184| 3.28k| } 185| 9.33k| copy_mem(x.mutable_data(), z_data, 2 * p_size); 186| 9.33k|} _ZNK5Botan17Montgomery_Params3sqrERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE: 188| 1.21k|BigInt Montgomery_Params::sqr(const BigInt& x, secure_vector& ws) const { 189| 1.21k| BOTAN_DEBUG_ASSERT(x.sig_words() <= this->p_words()); ------------------ | | 137| 1.21k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 1.21k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 1.21k] | | ------------------ ------------------ 190| 1.21k| return this->sqr(std::span{x._data(), x.size()}, ws); 191| 1.21k|} _ZNK5Botan17Montgomery_Params3sqrENSt3__14spanIKmLm18446744073709551615EEERNS1_6vectorImNS_16secure_allocatorImEEEE: 193| 1.21k|BigInt Montgomery_Params::sqr(std::span x, secure_vector& ws) const { 194| 1.21k| const size_t p_size = this->p_words(); 195| 1.21k| BigInt z = BigInt::with_capacity(2 * p_size); 196| 1.21k| this->sqr(z, x, ws); 197| 1.21k| return z; 198| 1.21k|} _ZNK5Botan17Montgomery_Params3sqrERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 200| 1.42M|void Montgomery_Params::sqr(BigInt& z, const BigInt& x, secure_vector& ws) const { 201| 1.42M| BOTAN_ARG_CHECK(&z != &x, "Montgomery_Params::sqr output must not alias input"); ------------------ | | 35| 1.42M| do { \ | | 36| 1.42M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.42M| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.42M] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.42M| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.42M] | | ------------------ ------------------ 202| 1.42M| this->sqr(z, std::span{x._data(), x.size()}, ws); 203| 1.42M|} _ZNK5Botan17Montgomery_Params3sqrERNS_6BigIntENSt3__14spanIKmLm18446744073709551615EEERNS3_6vectorImNS_16secure_allocatorImEEEE: 205| 1.60M|void Montgomery_Params::sqr(BigInt& z, std::span x, secure_vector& ws) const { 206| 1.60M| BOTAN_ARG_CHECK(!ranges_overlap(z._data(), z.size(), x.data(), x.size()), ------------------ | | 35| 1.60M| do { \ | | 36| 1.60M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.60M| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.60M] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.60M| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.60M] | | ------------------ ------------------ 207| 1.60M| "Montgomery_Params::sqr output must not overlap input"); 208| | 209| 1.60M| const size_t p_size = this->p_words(); 210| | 211| 1.60M| if(ws.size() < 2 * p_size) { ------------------ | Branch (211:7): [True: 187, False: 1.60M] ------------------ 212| 187| ws.resize(2 * p_size); 213| 187| } 214| | 215| 1.60M| if(z.size() < 2 * p_size) { ------------------ | Branch (215:7): [True: 29.2k, False: 1.57M] ------------------ 216| 29.2k| z.grow_to(2 * p_size); 217| 29.2k| } 218| | 219| 1.60M| bigint_sqr(z.mutable_data(), z.size(), x.data(), x.size(), std::min(p_size, x.size()), ws.data(), ws.size()); 220| | 221| 1.60M| bigint_monty_redc_inplace(z.mutable_data(), this->p()._data(), p_size, this->p_dash(), ws.data(), ws.size()); 222| 1.60M|} _ZN5Botan14Montgomery_IntC2ERKNS_17Montgomery_ParamsENSt3__16vectorImNS_16secure_allocatorImEEEE: 227| 11.9k| m_params(params), m_v(std::move(words)) { 228| 11.9k| BOTAN_ASSERT_NOMSG(m_v.size() == m_params.p_words()); ------------------ | | 84| 11.9k| do { \ | | 85| 11.9k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 11.9k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 11.9k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 11.9k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 11.9k] | | ------------------ ------------------ 229| 11.9k|} _ZN5Botan14Montgomery_Int3oneERKNS_17Montgomery_ParamsE: 231| 1.93k|Montgomery_Int Montgomery_Int::one(const Montgomery_Params& params) { 232| 1.93k| return Montgomery_Int(params, params.R1(), false); 233| 1.93k|} _ZN5Botan14Montgomery_IntC2ERKNS_17Montgomery_ParamsERKNS_6BigIntEb: 242| 3.31k| m_params(params), m_v(m_params.p_words()) { 243| 3.31k| BOTAN_ARG_CHECK(v.signum() >= 0 && v < m_params.p(), "Input out of range"); ------------------ | | 35| 3.31k| do { \ | | 36| 3.31k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 6.62k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 3.31k, False: 0] | | | Branch (37:12): [True: 3.31k, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 3.31k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 3.31k] | | ------------------ ------------------ 244| | 245| 3.31k| const size_t p_size = m_params.p_words(); 246| | 247| 3.31k| auto v_span = v._as_span(); 248| | 249| 3.31k| if(v_span.size() > p_size) { ------------------ | Branch (249:7): [True: 2.91k, False: 400] ------------------ 250| | // Safe to truncate the span since we already checked v < p 251| 2.91k| v_span = v_span.first(p_size); 252| 2.91k| } 253| | 254| 3.31k| BOTAN_ASSERT_NOMSG(m_v.size() >= v_span.size()); ------------------ | | 84| 3.31k| do { \ | | 85| 3.31k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 3.31k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 3.31k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 3.31k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 3.31k] | | ------------------ ------------------ 255| | 256| 3.31k| copy_mem(std::span{m_v}.first(v_span.size()), v_span); 257| | 258| 3.31k| if(redc_needed) { ------------------ | Branch (258:7): [True: 1.37k, False: 1.93k] ------------------ 259| 1.37k| secure_vector ws; 260| 1.37k| this->mul_by(m_params.R2()._as_span().first(p_size), ws); 261| 1.37k| } 262| 3.31k|} _ZN5Botan14Montgomery_IntC2ERKNS_17Montgomery_ParamsENSt3__14spanIKmLm18446744073709551615EEE: 265| 198| m_params(params), m_v(words.begin(), words.end()) { 266| 198| BOTAN_ARG_CHECK(m_v.size() == m_params.p_words(), "Invalid input span"); ------------------ | | 35| 198| do { \ | | 36| 198| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 198| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 198] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 198| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 198] | | ------------------ ------------------ 267| 198|} _ZNK5Botan14Montgomery_Int5valueEv: 273| 424|BigInt Montgomery_Int::value() const { 274| 424| secure_vector ws(m_params.p_words()); 275| | 276| 424| secure_vector z = m_v; 277| 424| z.resize(2 * m_params.p_words()); // zero extend 278| | 279| 424| bigint_monty_redc_inplace( 280| 424| z.data(), m_params.p()._data(), m_params.p_words(), m_params.p_dash(), ws.data(), ws.size()); 281| | 282| 424| return BigInt::_from_words(z); 283| 424|} _ZNK5Botan14Montgomery_Int3mulERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 320| 11.9k|Montgomery_Int Montgomery_Int::mul(const Montgomery_Int& other, secure_vector& ws) const { 321| 11.9k| BOTAN_STATE_CHECK(other.m_params == m_params); ------------------ | | 51| 11.9k| do { \ | | 52| 11.9k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 11.9k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 11.9k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 11.9k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 11.9k] | | ------------------ ------------------ 322| | 323| 11.9k| const size_t p_size = m_params.p_words(); 324| 11.9k| BOTAN_ASSERT_NOMSG(m_v.size() == p_size && other.m_v.size() == p_size); ------------------ | | 84| 11.9k| do { \ | | 85| 11.9k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 23.8k| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 11.9k, False: 0] | | | Branch (86:12): [True: 11.9k, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 11.9k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 11.9k] | | ------------------ ------------------ 325| | 326| 11.9k| if(ws.size() < 4 * p_size) { ------------------ | Branch (326:7): [True: 0, False: 11.9k] ------------------ 327| 0| ws.resize(4 * p_size); 328| 0| } 329| | 330| 11.9k| secure_vector z(p_size); 331| | 332| 11.9k| bigint_monty_mul( 333| 11.9k| z.data(), m_v.data(), other.m_v.data(), m_params.p()._data(), p_size, m_params.p_dash(), ws.data(), ws.size()); 334| | 335| 11.9k| return Montgomery_Int(m_params, std::move(z)); 336| 11.9k|} _ZN5Botan14Montgomery_Int6mul_byERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 338| 228k|Montgomery_Int& Montgomery_Int::mul_by(const Montgomery_Int& other, secure_vector& ws) { 339| 228k| BOTAN_STATE_CHECK(other.m_params == m_params); ------------------ | | 51| 228k| do { \ | | 52| 228k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 228k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 228k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 228k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 228k] | | ------------------ ------------------ 340| 228k| return this->mul_by(std::span{other.m_v}, ws); 341| 228k|} _ZN5Botan14Montgomery_Int6mul_byENSt3__14spanIKmLm18446744073709551615EEERNS1_6vectorImNS_16secure_allocatorImEEEE: 343| 230k|Montgomery_Int& Montgomery_Int::mul_by(std::span other, secure_vector& ws) { 344| 230k| const size_t p_size = m_params.p_words(); 345| 230k| BOTAN_ASSERT_NOMSG(m_v.size() == p_size && other.size() == p_size); ------------------ | | 84| 230k| do { \ | | 85| 230k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 460k| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 230k, False: 0] | | | Branch (86:12): [True: 230k, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 230k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 230k] | | ------------------ ------------------ 346| | 347| 230k| if(ws.size() < 4 * p_size) { ------------------ | Branch (347:7): [True: 1.93k, False: 228k] ------------------ 348| 1.93k| ws.resize(4 * p_size); 349| 1.93k| } 350| | 351| 230k| bigint_monty_mul( 352| 230k| m_v.data(), m_v.data(), other.data(), m_params.p()._data(), p_size, m_params.p_dash(), ws.data(), ws.size()); 353| | 354| 230k| return (*this); 355| 230k|} _ZN5Botan14Montgomery_Int19square_this_n_timesERNSt3__16vectorImNS_16secure_allocatorImEEEEm: 357| 447k|Montgomery_Int& Montgomery_Int::square_this_n_times(secure_vector& ws, size_t n) { 358| 447k| const size_t p_size = m_params.p_words(); 359| 447k| BOTAN_ASSERT_NOMSG(m_v.size() == p_size); ------------------ | | 84| 447k| do { \ | | 85| 447k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 447k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 447k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 447k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 447k] | | ------------------ ------------------ 360| | 361| 447k| if(ws.size() < 4 * p_size) { ------------------ | Branch (361:7): [True: 3.05k, False: 444k] ------------------ 362| 3.05k| ws.resize(4 * p_size); 363| 3.05k| } 364| | 365| 1.12M| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (365:22): [True: 676k, False: 447k] ------------------ 366| 676k| bigint_monty_sqr(m_v.data(), m_v.data(), m_params.p()._data(), p_size, m_params.p_dash(), ws.data(), ws.size()); 367| 676k| } 368| | 369| 447k| return (*this); 370| 447k|} _ZN5Botan14Montgomery_Int9add_mod_pENSt3__14spanIKmLm18446744073709551615EEE: 372| 1.24M|void Montgomery_Int::add_mod_p(std::span other) { 373| 1.24M| const size_t p_size = m_params.p_words(); 374| 1.24M| BOTAN_ASSERT_NOMSG(m_v.size() == p_size && other.size() == p_size); ------------------ | | 84| 1.24M| do { \ | | 85| 1.24M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 2.48M| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 1.24M, False: 0] | | | Branch (86:12): [True: 1.24M, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 1.24M| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 1.24M] | | ------------------ ------------------ 375| | 376| 1.24M| const auto do_add = [&](std::span t) { 377| 1.24M| const word carry = bigint_add3(t.data(), m_v.data(), p_size, other.data(), p_size); 378| 1.24M| bigint_monty_maybe_sub(p_size, m_v.data(), carry, t.data(), m_params.p()._data()); 379| 1.24M| }; 380| | 381| 1.24M| if(p_size <= MontgomeryUseStackLimit) { ------------------ | Branch (381:7): [True: 1.24M, False: 0] ------------------ 382| 1.24M| std::array t{}; 383| 1.24M| do_add(std::span{t}.first(p_size)); 384| 1.24M| } else { 385| 0| secure_vector t(p_size); 386| 0| do_add(t); 387| 0| } 388| 1.24M|} _ZN5Botan14Montgomery_IntpLERKS0_: 390| 131k|Montgomery_Int& Montgomery_Int::operator+=(const Montgomery_Int& other) { 391| 131k| BOTAN_STATE_CHECK(other.m_params == m_params); ------------------ | | 51| 131k| do { \ | | 52| 131k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 131k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 131k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 131k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 131k] | | ------------------ ------------------ 392| 131k| this->add_mod_p(other.m_v); 393| 131k| return (*this); 394| 131k|} _ZN5Botan14Montgomery_IntmIERKS0_: 396| 179k|Montgomery_Int& Montgomery_Int::operator-=(const Montgomery_Int& other) { 397| 179k| BOTAN_STATE_CHECK(other.m_params == m_params); ------------------ | | 51| 179k| do { \ | | 52| 179k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 179k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 179k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 179k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 179k] | | ------------------ ------------------ 398| | 399| 179k| const size_t p_size = m_params.p_words(); 400| 179k| BOTAN_ASSERT_NOMSG(m_v.size() == p_size && other.m_v.size() == p_size); ------------------ | | 84| 179k| do { \ | | 85| 179k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 358k| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 179k, False: 0] | | | Branch (86:12): [True: 179k, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 179k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 179k] | | ------------------ ------------------ 401| | 402| 179k| const word borrow = bigint_sub2(m_v.data(), p_size, other.m_v.data(), p_size); 403| 179k| bigint_cnd_add(borrow, m_v.data(), m_params.p()._data(), p_size); 404| | 405| 179k| return (*this); 406| 179k|} _ZN5Botan14Montgomery_Int11mul_by_wordEm: 408| 243k|Montgomery_Int& Montgomery_Int::mul_by_word(word d) { 409| 243k| BOTAN_ARG_CHECK(d > 0, "Multiplier must be positive"); ------------------ | | 35| 243k| do { \ | | 36| 243k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 243k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 243k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 243k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 243k] | | ------------------ ------------------ 410| | 411| 243k| const size_t p_size = m_params.p_words(); 412| 243k| BOTAN_ASSERT_NOMSG(m_v.size() == p_size); ------------------ | | 84| 243k| do { \ | | 85| 243k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 243k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 243k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 243k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 243k] | | ------------------ ------------------ 413| | 414| | // Double and add, from the second highest bit of d downwards 415| 243k| const auto do_mul = [&](std::span x) { 416| 243k| copy_mem(x.data(), m_v.data(), p_size); 417| | 418| 243k| for(size_t i = high_bit(d) - 1; i > 0; --i) { 419| 243k| this->add_mod_p(m_v); 420| 243k| if(((d >> (i - 1)) & 1) == 1) { 421| 243k| this->add_mod_p(x); 422| 243k| } 423| 243k| } 424| 243k| }; 425| | 426| 243k| if(p_size <= MontgomeryUseStackLimit) { ------------------ | Branch (426:7): [True: 243k, False: 0] ------------------ 427| 243k| std::array x{}; 428| 243k| do_mul(std::span{x}.first(p_size)); 429| 243k| } else { 430| 0| secure_vector x(p_size); 431| 0| do_mul(x); 432| 0| } 433| | 434| 243k| return (*this); 435| 243k|} _ZN5Botan14Montgomery_Int4div2Ev: 437| 310k|Montgomery_Int& Montgomery_Int::div2() { 438| 310k| const size_t p_size = m_params.p_words(); 439| 310k| BOTAN_ASSERT_NOMSG(m_v.size() == p_size); ------------------ | | 84| 310k| do { \ | | 85| 310k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 310k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 310k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 310k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 310k] | | ------------------ ------------------ 440| 310k| constexpr size_t WB = WordInfo::bits; 441| | 442| | // If odd, add p (also odd) to make the value even; the sum is below 2p 443| 310k| const word carry = bigint_cnd_add(m_v[0] & 1, m_v.data(), m_params.p()._data(), p_size); 444| | 445| 1.94M| for(size_t i = 0; i != p_size - 1; ++i) { ------------------ | Branch (445:22): [True: 1.63M, False: 310k] ------------------ 446| 1.63M| m_v[i] = (m_v[i] >> 1) | (m_v[i + 1] << (WB - 1)); 447| 1.63M| } 448| 310k| m_v[p_size - 1] = (m_v[p_size - 1] >> 1) | (carry << (WB - 1)); 449| | 450| 310k| return (*this); 451| 310k|} _ZNK5Botan14Montgomery_Int7is_zeroEv: 459| 560|bool Montgomery_Int::is_zero() const { 460| 560| return CT::all_zeros(m_v.data(), m_v.size()).as_bool(); 461| 560|} _ZNK5Botan14Montgomery_Int6squareERNSt3__16vectorImNS_16secure_allocatorImEEEE: 463| 11.9k|Montgomery_Int Montgomery_Int::square(secure_vector& ws) const { 464| 11.9k| auto z = (*this); 465| 11.9k| z.square_this_n_times(ws, 1); 466| 11.9k| return z; 467| 11.9k|} monty.cpp:_ZN5Botan12_GLOBAL__N_114ranges_overlapEPKmmS2_m: 30| 2.34M|bool ranges_overlap(const word* a, size_t na, const word* b, size_t nb) { 31| 2.34M| if(na == 0 || nb == 0) { ------------------ | Branch (31:7): [True: 375, False: 2.34M] | Branch (31:18): [True: 0, False: 2.34M] ------------------ 32| 375| return false; 33| 375| } 34| 2.34M| const std::less lt; // NOLINT(modernize-use-transparent-functors) 35| 2.34M| return lt(a, b + nb) && lt(b, a + na); ------------------ | Branch (35:11): [True: 1.39M, False: 956k] | Branch (35:28): [True: 0, False: 1.39M] ------------------ 36| 2.34M|} monty.cpp:_ZZN5Botan14Montgomery_Int9add_mod_pENSt3__14spanIKmLm18446744073709551615EEEENK3$_0clENS2_ImLm18446744073709551615EEE: 376| 1.24M| const auto do_add = [&](std::span t) { 377| 1.24M| const word carry = bigint_add3(t.data(), m_v.data(), p_size, other.data(), p_size); 378| 1.24M| bigint_monty_maybe_sub(p_size, m_v.data(), carry, t.data(), m_params.p()._data()); 379| 1.24M| }; monty.cpp:_ZZN5Botan14Montgomery_Int11mul_by_wordEmENK3$_0clENSt3__14spanImLm18446744073709551615EEE: 415| 243k| const auto do_mul = [&](std::span x) { 416| 243k| copy_mem(x.data(), m_v.data(), p_size); 417| | 418| 870k| for(size_t i = high_bit(d) - 1; i > 0; --i) { ------------------ | Branch (418:39): [True: 626k, False: 243k] ------------------ 419| 626k| this->add_mod_p(m_v); 420| 626k| if(((d >> (i - 1)) & 1) == 1) { ------------------ | Branch (420:13): [True: 482k, False: 143k] ------------------ 421| 482k| this->add_mod_p(x); 422| 482k| } 423| 626k| } 424| 243k| }; _ZN5Botan16monty_precomputeERKNS_14Montgomery_IntEmb: 145| 1.37k| bool const_time) { 146| 1.37k| if(window_bits == 0) { ------------------ | Branch (146:7): [True: 0, False: 1.37k] ------------------ 147| 0| window_bits = 4; 148| 0| } 149| | 150| 1.37k| if(window_bits < 1 || window_bits > 12) { // really even 8 is too large ... ------------------ | Branch (150:7): [True: 0, False: 1.37k] | Branch (150:26): [True: 0, False: 1.37k] ------------------ 151| 0| throw Invalid_Argument("Invalid window bits for Montgomery exponentiation"); 152| 0| } 153| | 154| 1.37k|#if defined(BOTAN_HAS_MONTY_EXP_AVX512) 155| 1.37k| if(CPUID::has(CPUID::Feature::AVX512)) { ------------------ | Branch (155:7): [True: 0, False: 1.37k] ------------------ 156| 0| if(auto state = make_monty_exp_avx512(g, window_bits, const_time)) { ------------------ | Branch (156:15): [True: 0, False: 0] ------------------ 157| 0| return state; 158| 0| } 159| 0| } 160| 1.37k|#endif 161| | 162| 1.37k| return std::make_shared(g, window_bits, const_time); 163| 1.37k|} _ZN5Botan16monty_precomputeERKNS_17Montgomery_ParamsERKNS_6BigIntEmb: 168| 1.37k| bool const_time) { 169| 1.37k| BOTAN_ARG_CHECK(g.signum() >= 0 && g < params.p(), "Montgomery exponentiation base integer out of range"); ------------------ | | 35| 1.37k| do { \ | | 36| 1.37k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 2.75k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 1.37k, False: 0] | | | Branch (37:12): [True: 1.37k, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.37k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.37k] | | ------------------ ------------------ 170| 1.37k| const Montgomery_Int monty_g(params, g); 171| 1.37k| return monty_precompute(monty_g, window_bits, const_time); 172| 1.37k|} _ZN5Botan13monty_executeERKNS_31Montgomery_Exponentiation_StateERKNS_6BigIntEm: 176| 198| size_t max_k_bits) { 177| 198| return precomputed_state.exponentiation(k, max_k_bits); 178| 198|} _ZN5Botan21monty_execute_vartimeERKNS_31Montgomery_Exponentiation_StateERKNS_6BigIntE: 180| 1.14k|Montgomery_Int monty_execute_vartime(const Montgomery_Exponentiation_State& precomputed_state, const BigInt& k) { 181| 1.14k| return precomputed_state.exponentiation_vartime(k); 182| 1.14k|} monty_exp.cpp:_ZN5Botan12_GLOBAL__N_133Montgomery_Exponentiation_GenericC2ERKNS_14Montgomery_IntEmb: 43| 1.37k| m_params(g._params()), m_window_bits(window_bits) { 44| 1.37k| const size_t window_size = (static_cast(1) << m_window_bits); 45| | 46| 1.37k| m_g.reserve(window_size); 47| | 48| 1.37k| m_g.push_back(Montgomery_Int::one(m_params)); 49| | 50| 1.37k| m_g.push_back(g); 51| | 52| 1.37k| secure_vector ws(2 * m_params.p_words()); 53| | 54| 25.2k| for(size_t i = 2; i != window_size; ++i) { ------------------ | Branch (54:22): [True: 23.8k, False: 1.37k] ------------------ 55| 23.8k| if(i % 2 == 0) { ------------------ | Branch (55:10): [True: 11.9k, False: 11.9k] ------------------ 56| 11.9k| m_g.push_back(m_g[i / 2].square(ws)); 57| 11.9k| } else { 58| 11.9k| m_g.push_back(m_g[1].mul(m_g[i - 1], ws)); 59| 11.9k| } 60| 23.8k| } 61| | 62| 1.37k| if(const_time) { ------------------ | Branch (62:7): [True: 234, False: 1.14k] ------------------ 63| 234| CT::poison_range(m_g); 64| 234| } 65| 1.37k|} monty_exp.cpp:_ZNK5Botan12_GLOBAL__N_133Montgomery_Exponentiation_Generic14exponentiationERKNS_6BigIntEm: 90| 198|Montgomery_Int Montgomery_Exponentiation_Generic::exponentiation(const BigInt& scalar, size_t max_k_bits) const { 91| 198| BOTAN_ARG_CHECK(scalar.signum() >= 0, "Invalid scalar for Montgomery exponentiation"); ------------------ | | 35| 198| do { \ | | 36| 198| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 198| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 198] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 198| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 198] | | ------------------ ------------------ 92| 198| BOTAN_DEBUG_ASSERT(scalar.bits() <= max_k_bits); ------------------ | | 137| 198| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 198| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 198] | | ------------------ ------------------ 93| | // TODO add a const-time implementation of above assert and use it in release builds 94| | 95| 198| const size_t exp_nibbles = (max_k_bits + m_window_bits - 1) / m_window_bits; 96| | 97| 198| if(exp_nibbles == 0) { ------------------ | Branch (97:7): [True: 0, False: 198] ------------------ 98| 0| return Montgomery_Int::one(m_params); 99| 0| } 100| | 101| 198| secure_vector e_bits(m_params.p_words()); 102| 198| secure_vector ws(2 * m_params.p_words()); 103| | 104| 198| const_time_lookup(e_bits, m_g, scalar.get_substring(m_window_bits * (exp_nibbles - 1), m_window_bits)); 105| 198| Montgomery_Int x(m_params, std::span{e_bits}); 106| | 107| 788| for(size_t i = exp_nibbles - 1; i > 0; --i) { ------------------ | Branch (107:36): [True: 590, False: 198] ------------------ 108| 590| x.square_this_n_times(ws, m_window_bits); 109| 590| const_time_lookup(e_bits, m_g, scalar.get_substring(m_window_bits * (i - 1), m_window_bits)); 110| 590| x.mul_by(e_bits, ws); 111| 590| } 112| | 113| 198| CT::unpoison(x); 114| 198| return x; 115| 198|} monty_exp.cpp:_ZN5Botan12_GLOBAL__N_117const_time_lookupERNSt3__16vectorImNS_16secure_allocatorImEEEERKNS2_INS_14Montgomery_IntENS1_9allocatorIS7_EEEEm: 67| 788|void const_time_lookup(secure_vector& output, const std::vector& g, size_t nibble) { 68| 788| BOTAN_ASSERT_NOMSG(g.size() % 2 == 0); // actually a power of 2 ------------------ | | 84| 788| do { \ | | 85| 788| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 788| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 788] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 788| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 788] | | ------------------ ------------------ 69| | 70| 788| const size_t words = output.size(); 71| | 72| 788| clear_mem(output.data(), output.size()); 73| | 74| 7.09k| for(size_t i = 0; i != g.size(); i += 2) { ------------------ | Branch (74:22): [True: 6.30k, False: 788] ------------------ 75| 6.30k| const secure_vector& vec_0 = g[i].repr(); 76| 6.30k| const secure_vector& vec_1 = g[i + 1].repr(); 77| | 78| 6.30k| BOTAN_ASSERT_NOMSG(vec_0.size() >= words && vec_1.size() >= words); ------------------ | | 84| 6.30k| do { \ | | 85| 6.30k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 12.6k| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 6.30k, False: 0] | | | Branch (86:12): [True: 6.30k, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 6.30k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 6.30k] | | ------------------ ------------------ 79| | 80| 6.30k| const auto mask_0 = CT::Mask::is_equal(nibble, i); 81| 6.30k| const auto mask_1 = CT::Mask::is_equal(nibble, i + 1); 82| | 83| 58.7k| for(size_t w = 0; w != words; ++w) { ------------------ | Branch (83:25): [True: 52.4k, False: 6.30k] ------------------ 84| 52.4k| output[w] |= mask_0.if_set_return(vec_0[w]); 85| 52.4k| output[w] |= mask_1.if_set_return(vec_1[w]); 86| 52.4k| } 87| 6.30k| } 88| 788|} monty_exp.cpp:_ZNK5Botan12_GLOBAL__N_133Montgomery_Exponentiation_Generic22exponentiation_vartimeERKNS_6BigIntE: 117| 1.14k|Montgomery_Int Montgomery_Exponentiation_Generic::exponentiation_vartime(const BigInt& scalar) const { 118| 1.14k| const size_t exp_nibbles = (scalar.bits() + m_window_bits - 1) / m_window_bits; 119| | 120| 1.14k| secure_vector ws(2 * m_params.p_words()); 121| | 122| 1.14k| if(exp_nibbles == 0) { ------------------ | Branch (122:7): [True: 0, False: 1.14k] ------------------ 123| 0| return Montgomery_Int::one(m_params); 124| 0| } 125| | 126| 1.14k| Montgomery_Int x = m_g[scalar.get_substring(m_window_bits * (exp_nibbles - 1), m_window_bits)]; 127| | 128| 69.2k| for(size_t i = exp_nibbles - 1; i > 0; --i) { ------------------ | Branch (128:36): [True: 68.0k, False: 1.14k] ------------------ 129| 68.0k| x.square_this_n_times(ws, m_window_bits); 130| | 131| 68.0k| const uint32_t nibble = scalar.get_substring(m_window_bits * (i - 1), m_window_bits); 132| 68.0k| if(nibble > 0) { ------------------ | Branch (132:10): [True: 51.0k, False: 17.0k] ------------------ 133| 51.0k| x.mul_by(m_g[nibble], ws); 134| 51.0k| } 135| 68.0k| } 136| | 137| 1.14k| CT::unpoison(x); 138| 1.14k| return x; 139| 1.14k|} _ZN5Botan17sqrt_modulo_primeERKNS_6BigIntES2_: 27| 202|BigInt sqrt_modulo_prime(const BigInt& a, const BigInt& p) { 28| 202| BOTAN_ARG_CHECK(p > 1, "invalid prime"); ------------------ | | 35| 202| do { \ | | 36| 202| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 202| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 202] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 202| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 202] | | ------------------ ------------------ 29| 202| BOTAN_ARG_CHECK(a < p, "value to solve for must be less than p"); ------------------ | | 35| 202| do { \ | | 36| 202| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 202| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 202] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 202| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 202] | | ------------------ ------------------ 30| 202| BOTAN_ARG_CHECK(a >= 0, "value to solve for must not be negative"); ------------------ | | 35| 202| do { \ | | 36| 202| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 202| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 202] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 202| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 202] | | ------------------ ------------------ 31| | 32| | // some very easy cases 33| 202| if(p == 2 || a <= 1) { ------------------ | Branch (33:7): [True: 0, False: 202] | Branch (33:17): [True: 0, False: 202] ------------------ 34| 0| return a; 35| 0| } 36| | 37| 202| BOTAN_ARG_CHECK(p.is_odd(), "invalid prime"); ------------------ | | 35| 202| do { \ | | 36| 202| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 202| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 202] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 202| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 202] | | ------------------ ------------------ 38| | 39| 202| if(jacobi(a, p) != 1) { // not a quadratic residue ------------------ | Branch (39:7): [True: 92, False: 110] ------------------ 40| 92| return BigInt::from_s32(-1); 41| 92| } 42| | 43| 110| const auto mod_p = Barrett_Reduction::for_public_modulus(p); 44| 110| const Montgomery_Params monty_p(p, mod_p); 45| | 46| | // If p == 3 (mod 4) there is a simple solution 47| 110| if(p % 4 == 3) { ------------------ | Branch (47:7): [True: 0, False: 110] ------------------ 48| 0| return monty_exp_vartime(monty_p, a, ((p + 1) >> 2)).value(); 49| 0| } 50| | 51| | // Otherwise we have to use Shanks-Tonelli 52| 110| size_t s = low_zero_bits(p - 1); 53| 110| BigInt q = p >> s; 54| | 55| 110| q -= 1; 56| 110| q >>= 1; 57| | 58| 110| BigInt r = monty_exp_vartime(monty_p, a, q).value(); 59| 110| BigInt n = mod_p.multiply(a, mod_p.square(r)); 60| 110| r = mod_p.multiply(r, a); 61| | 62| 110| if(n == 1) { ------------------ | Branch (62:7): [True: 52, False: 58] ------------------ 63| 52| return r; 64| 52| } 65| | 66| | // find random quadratic nonresidue z 67| 58| word z = 2; 68| 58| for(;;) { 69| 58| if(jacobi(BigInt::from_word(z), p) == -1) { // found one ------------------ | Branch (69:10): [True: 58, False: 0] ------------------ 70| 58| break; 71| 58| } 72| | 73| 0| z += 1; // try next z 74| | 75| | /* 76| | * The expected number of tests to find a non-residue modulo a 77| | * prime is 2. If we have not found one after 256 then almost 78| | * certainly we have been given a non-prime p. 79| | */ 80| 0| if(z >= 256) { ------------------ | Branch (80:10): [True: 0, False: 0] ------------------ 81| 0| return BigInt::from_s32(-1); 82| 0| } 83| 0| } 84| | 85| 58| BigInt c = monty_exp_vartime(monty_p, BigInt::from_word(z), (q << 1) + 1).value(); 86| | 87| 116| while(n > 1) { ------------------ | Branch (87:10): [True: 58, False: 58] ------------------ 88| 58| q = n; 89| | 90| 58| size_t i = 0; 91| 116| while(q != 1) { ------------------ | Branch (91:13): [True: 58, False: 58] ------------------ 92| 58| q = mod_p.square(q); 93| 58| ++i; 94| | 95| 58| if(i >= s) { ------------------ | Branch (95:13): [True: 0, False: 58] ------------------ 96| 0| return BigInt::from_s32(-1); 97| 0| } 98| 58| } 99| | 100| 58| BOTAN_ASSERT_NOMSG(s >= (i + 1)); // No underflow! ------------------ | | 84| 58| do { \ | | 85| 58| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 58| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 58] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 58| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 58] | | ------------------ ------------------ 101| 58| c = monty_exp_vartime(monty_p, c, BigInt::power_of_2(s - i - 1)).value(); 102| 58| r = mod_p.multiply(r, c); 103| 58| c = mod_p.square(c); 104| 58| n = mod_p.multiply(n, c); 105| | 106| | // s decreases as the algorithm proceeds 107| 58| BOTAN_ASSERT_NOMSG(s >= i); ------------------ | | 84| 58| do { \ | | 85| 58| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 58| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 58] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 58| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 58] | | ------------------ ------------------ 108| 58| s = i; 109| 58| } 110| | 111| 58| return r; 112| 58|} _ZN5Botan6jacobiENS_6BigIntES0_: 119| 2.39k|int32_t jacobi(BigInt a, BigInt n) { 120| 2.39k| BOTAN_ARG_CHECK(n.is_odd() && n >= 3, "Argument n must be an odd integer >= 3"); ------------------ | | 35| 2.39k| do { \ | | 36| 2.39k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 4.78k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 2.39k, False: 0] | | | Branch (37:12): [True: 2.39k, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 2.39k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 2.39k] | | ------------------ ------------------ 121| | 122| 2.39k| if(a < 0 || a >= n) { ------------------ | Branch (122:7): [True: 988, False: 1.40k] | Branch (122:16): [True: 0, False: 1.40k] ------------------ 123| 988| a %= n; 124| 988| } 125| | 126| 2.39k| if(a == 0) { ------------------ | Branch (126:7): [True: 0, False: 2.39k] ------------------ 127| 0| return 0; 128| 0| } 129| 2.39k| if(a == 1) { ------------------ | Branch (129:7): [True: 0, False: 2.39k] ------------------ 130| 0| return 1; 131| 0| } 132| | 133| 2.39k| int32_t s = 1; 134| | 135| 21.2k| for(;;) { 136| 21.2k| const size_t e = low_zero_bits(a); 137| 21.2k| a >>= e; 138| 21.2k| const word n_mod_8 = n.word_at(0) % 8; 139| 21.2k| const word n_mod_4 = n_mod_8 % 4; 140| | 141| 21.2k| if(e % 2 == 1 && (n_mod_8 == 3 || n_mod_8 == 5)) { ------------------ | Branch (141:10): [True: 7.39k, False: 13.8k] | Branch (141:25): [True: 1.74k, False: 5.65k] | Branch (141:41): [True: 1.80k, False: 3.85k] ------------------ 142| 3.54k| s = -s; 143| 3.54k| } 144| | 145| 21.2k| if(n_mod_4 == 3 && a % 4 == 3) { ------------------ | Branch (145:10): [True: 10.6k, False: 10.5k] | Branch (145:26): [True: 4.99k, False: 5.67k] ------------------ 146| 4.99k| s = -s; 147| 4.99k| } 148| | 149| | /* 150| | * The HAC presentation of the algorithm uses recursion, which is not 151| | * desirable or necessary. 152| | * 153| | * Instead we loop accumulating the product of the various jacobi() 154| | * subcomputations into s, until we reach algorithm termination, which 155| | * occurs in one of two ways. 156| | * 157| | * If a == 1 then the recursion has completed; we can return the value of s. 158| | * 159| | * Otherwise, after swapping and reducing, check for a == 0 [this value is 160| | * called `n1` in HAC's presentation]. This would imply that jacobi(n1,a1) 161| | * would have the value 0, due to Line 1 in HAC 2.149, in which case the 162| | * entire product is zero, and we can immediately return that result. 163| | */ 164| | 165| 21.2k| if(a == 1) { ------------------ | Branch (165:10): [True: 2.39k, False: 18.8k] ------------------ 166| 2.39k| return s; 167| 2.39k| } 168| | 169| 18.8k| std::swap(a, n); 170| | 171| 18.8k| BOTAN_ASSERT_NOMSG(n.is_odd()); ------------------ | | 84| 18.8k| do { \ | | 85| 18.8k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 18.8k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 18.8k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 18.8k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 18.8k] | | ------------------ ------------------ 172| | 173| 18.8k| a %= n; 174| | 175| 18.8k| if(a == 0) { ------------------ | Branch (175:10): [True: 0, False: 18.8k] ------------------ 176| 0| return 0; 177| 0| } 178| 18.8k| } 179| 2.39k|} _ZN5Botan13low_zero_bitsERKNS_6BigIntE: 194| 22.2k|size_t low_zero_bits(const BigInt& n) { 195| 22.2k| size_t low_zero = 0; 196| | 197| 22.2k| auto seen_nonempty_word = CT::Mask::cleared(); 198| | 199| 146k| for(size_t i = 0; i != n.size(); ++i) { ------------------ | Branch (199:22): [True: 124k, False: 22.2k] ------------------ 200| 124k| const word x = n.word_at(i); 201| | 202| | // ctz(0) will return sizeof(word) 203| 124k| const size_t tz_x = ctz(x); 204| | 205| | // if x > 0 we want to count tz_x in total but not any 206| | // further words, so set the mask after the addition 207| 124k| low_zero += seen_nonempty_word.if_not_set_return(tz_x); 208| | 209| 124k| seen_nonempty_word |= CT::Mask::expand(x); 210| 124k| } 211| | 212| | // if we saw no words with x > 0 then n == 0 and the value we have 213| | // computed is meaningless. Instead return BigInt::zero() in that case. 214| 22.2k| return static_cast(seen_nonempty_word.if_set_return(low_zero)); 215| 22.2k|} _ZN5Botan17is_perfect_squareERKNS_6BigIntE: 347| 93|BigInt is_perfect_square(const BigInt& C) { 348| 93| if(C < 1) { ------------------ | Branch (348:7): [True: 0, False: 93] ------------------ 349| 0| throw Invalid_Argument("is_perfect_square requires C >= 1"); 350| 0| } 351| 93| if(C == 1) { ------------------ | Branch (351:7): [True: 0, False: 93] ------------------ 352| 0| return BigInt::one(); 353| 0| } 354| | 355| 93| const size_t n = C.bits(); 356| 93| const size_t m = (n + 1) / 2; 357| 93| const BigInt B = C + BigInt::power_of_2(m); 358| | 359| 93| BigInt X = BigInt::power_of_2(m) - 1; 360| 93| BigInt X2 = (X * X); 361| | 362| 417| for(;;) { 363| 417| X = (X2 + C) / (2 * X); 364| 417| X2 = (X * X); 365| | 366| 417| if(X2 < B) { ------------------ | Branch (366:10): [True: 93, False: 324] ------------------ 367| 93| break; 368| 93| } 369| 417| } 370| | 371| 93| if(X2 == C) { ------------------ | Branch (371:7): [True: 0, False: 93] ------------------ 372| 0| return X; 373| 93| } else { 374| 93| return BigInt::zero(); 375| 93| } 376| 93|} _ZN5Botan36is_bailie_psw_probable_prime_vartimeERKNS_6BigIntE: 396| 1.01k|bool is_bailie_psw_probable_prime_vartime(const BigInt& n) { 397| 1.01k| if(n == 2) { ------------------ | Branch (397:7): [True: 1, False: 1.01k] ------------------ 398| 1| return true; 399| 1.01k| } else if(n <= 1 || n.is_even()) { ------------------ | Branch (399:14): [True: 1, False: 1.01k] | Branch (399:24): [True: 101, False: 915] ------------------ 400| 102| return false; 401| 102| } 402| | 403| 915| return bailie_psw_test(n, Montgomery_Params(n), true); 404| 1.01k|} primality.cpp:_ZN5Botan12_GLOBAL__N_110lucas_testERKNS_6BigIntERKNS_17Montgomery_ParamsEb: 31| 565|bool lucas_test(const BigInt& C, const Montgomery_Params& monty_C, bool vartime) { 32| 565| BOTAN_ARG_CHECK(C.signum() >= 0, "Argument must be non-negative"); ------------------ | | 35| 565| do { \ | | 36| 565| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 565| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 565] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 565| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 565] | | ------------------ ------------------ 33| | 34| 565| if(C == 2 || C == 3 || C == 5 || C == 7 || C == 11 || C == 13) { ------------------ | Branch (34:7): [True: 0, False: 565] | Branch (34:17): [True: 1, False: 564] | Branch (34:27): [True: 1, False: 563] | Branch (34:37): [True: 1, False: 562] | Branch (34:47): [True: 1, False: 561] | Branch (34:58): [True: 1, False: 560] ------------------ 35| 5| return true; 36| 5| } 37| | 38| 560| if(C <= 1 || C.is_even()) { ------------------ | Branch (38:7): [True: 0, False: 560] | Branch (38:17): [True: 0, False: 560] ------------------ 39| 0| return false; 40| 0| } 41| | 42| | // Check 5, -7, 9, -11, 13, -15, 17, ... 43| 560| word D = 5; 44| 560| bool D_negative = false; 45| | 46| 2.13k| for(;;) { 47| 2.13k| auto D_bn = BigInt::from_word(D); 48| 2.13k| D_bn.cond_flip_sign(D_negative); 49| | 50| 2.13k| const int32_t j = jacobi(D_bn, C); 51| 2.13k| if(j == 0) { ------------------ | Branch (51:10): [True: 0, False: 2.13k] ------------------ 52| 0| return false; 53| 0| } 54| | 55| 2.13k| if(j == -1) { ------------------ | Branch (55:10): [True: 560, False: 1.57k] ------------------ 56| 560| break; 57| 560| } 58| | 59| 1.57k| D += 2; 60| 1.57k| D_negative = !D_negative; 61| | 62| 1.57k| if(D == 17 && is_perfect_square(C).signum() != 0) { ------------------ | Branch (62:10): [True: 93, False: 1.47k] | Branch (62:10): [True: 0, False: 1.57k] | Branch (62:21): [True: 0, False: 93] ------------------ 63| 0| return false; 64| 0| } 65| 1.57k| } 66| | 67| 560| const BigInt K = C + 1; 68| 560| const size_t K_bits = K.bits() - 1; 69| | 70| 560| secure_vector ws; 71| | 72| 560| Montgomery_Int U = Montgomery_Int::one(monty_C); 73| 560| Montgomery_Int V = U; 74| 560| Montgomery_Int Ut = U; 75| 560| Montgomery_Int Vt = U; 76| 560| Montgomery_Int U2 = U; 77| 560| Montgomery_Int V2 = U; 78| 560| Montgomery_Int T = U; 79| | 80| 177k| for(size_t i = 0; i != K_bits; ++i) { ------------------ | Branch (80:22): [True: 177k, False: 560] ------------------ 81| 177k| const bool k_bit = K.get_bit(K_bits - 1 - i); 82| | 83| | // U_temp = U V 84| 177k| Ut = U; 85| 177k| Ut.mul_by(V, ws); 86| | 87| | // V_temp = (V^2 + D U^2) / 2 88| 177k| T = U; 89| 177k| T.square_this_n_times(ws, 1); 90| 177k| T.mul_by_word(D); 91| 177k| Vt = V; 92| 177k| Vt.square_this_n_times(ws, 1); 93| 177k| if(D_negative) { ------------------ | Branch (93:10): [True: 132k, False: 44.6k] ------------------ 94| 132k| Vt -= T; 95| 132k| } else { 96| 44.6k| Vt += T; 97| 44.6k| } 98| 177k| Vt.div2(); 99| | 100| 177k| if(!vartime || k_bit) { ------------------ | Branch (100:10): [True: 0, False: 177k] | Branch (100:22): [True: 66.6k, False: 110k] ------------------ 101| | // U_i = (U_temp + V_temp) / 2 102| 66.6k| U2 = Ut; 103| 66.6k| U2 += Vt; 104| 66.6k| U2.div2(); 105| | 106| | // V_i = (V_temp + D U_temp) / 2 107| 66.6k| T = Ut; 108| 66.6k| T.mul_by_word(D); 109| 66.6k| V2 = Vt; 110| 66.6k| if(D_negative) { ------------------ | Branch (110:13): [True: 46.6k, False: 19.9k] ------------------ 111| 46.6k| V2 -= T; 112| 46.6k| } else { 113| 19.9k| V2 += T; 114| 19.9k| } 115| 66.6k| V2.div2(); 116| 66.6k| } 117| | 118| 177k| if(vartime) { ------------------ | Branch (118:10): [True: 177k, False: 0] ------------------ 119| 177k| if(k_bit) { ------------------ | Branch (119:13): [True: 66.6k, False: 110k] ------------------ 120| 66.6k| U = U2; 121| 66.6k| V = V2; 122| 110k| } else { 123| 110k| U = Ut; 124| 110k| V = Vt; 125| 110k| } 126| 177k| } else { 127| 0| U = Ut; 128| 0| V = Vt; 129| 0| U.ct_cond_assign(k_bit, U2); 130| 0| V.ct_cond_assign(k_bit, V2); 131| 0| } 132| 177k| } 133| | 134| 560| return U.is_zero(); 135| 560|} primality.cpp:_ZN5Botan12_GLOBAL__N_115bailie_psw_testERKNS_6BigIntERKNS_17Montgomery_ParamsEb: 357| 915|bool bailie_psw_test(const BigInt& n, const Montgomery_Params& monty_n, bool vartime) { 358| 915| if(n == 2) { ------------------ | Branch (358:7): [True: 0, False: 915] ------------------ 359| 0| return true; 360| 915| } else if(n <= 1 || n.is_even()) { ------------------ | Branch (360:14): [True: 0, False: 915] | Branch (360:24): [True: 0, False: 915] ------------------ 361| 0| return false; 362| 0| } 363| | 364| 915| const Miller_Rabin_Test mr(n, monty_n, vartime); 365| 915| return mr.passes(BigInt::from_word(2)) && lucas_test(n, monty_n, vartime); ------------------ | Branch (365:11): [True: 565, False: 350] | Branch (365:46): [True: 563, False: 2] ------------------ 366| 915|} primality.cpp:_ZN5Botan12_GLOBAL__N_117Miller_Rabin_TestC2ERKNS_6BigIntERKNS_17Montgomery_ParamsEb: 158| 915| m_monty_n(monty_n), m_vartime(vartime) { 159| 915| BOTAN_ARG_CHECK(n >= 3 && n.is_odd(), "Invalid integer for Miller-Rabin test"); ------------------ | | 35| 915| do { \ | | 36| 915| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.83k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 915, False: 0] | | | Branch (37:12): [True: 915, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 915| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 915] | | ------------------ ------------------ 160| | 161| 915| const size_t N = m_monty_n.p_words(); 162| | 163| 915| const BigInt n_minus_1 = n - 1; 164| | /* 165| | * This unpoison is not ideal but realistically there is no way to 166| | * hide the number of loop iterations (below). The main user of 167| | * secret primes is RSA and we always generate RSA primes such that 168| | * p == 3 (mod 4), which means s is always 1. 169| | */ 170| 915| m_s = CT::driveby_unpoison(low_zero_bits(n_minus_1)); 171| 915| m_d = n_minus_1 >> m_s; 172| 915| m_d_bits = m_d.bits(); 173| | 174| | // 1 and -1 in Montgomery form 175| 915| m_one.assign(m_monty_n.R1()._as_span().first(N).begin(), m_monty_n.R1()._as_span().first(N).end()); 176| 915| m_minus_one.resize(N); 177| 915| bigint_sub3(m_minus_one.data(), n._data(), N, m_one.data(), N); 178| 915| } primality.cpp:_ZNK5Botan12_GLOBAL__N_117Miller_Rabin_Test6passesERKNS_6BigIntE: 183| 915| bool passes(const BigInt& a) const { 184| 915| Montgomery_Int y = [&]() { 185| 915| if(m_vartime) { 186| 915| const auto powm_a = monty_precompute(m_monty_n, a, vartime_window_bits(m_d_bits), false); 187| 915| return monty_execute_vartime(*powm_a, m_d); 188| 915| } else { 189| 915| const auto powm_a = monty_precompute(m_monty_n, a, 4, true); 190| 915| return monty_execute(*powm_a, m_d, m_d_bits); 191| 915| } 192| 915| }(); 193| | 194| 915| if(is_one(y) || is_minus_one(y)) { ------------------ | Branch (194:13): [True: 285, False: 630] | Branch (194:26): [True: 31, False: 599] ------------------ 195| 316| return true; 196| 316| } 197| | 198| 599| secure_vector ws(2 * m_monty_n.p_words()); 199| | 200| 13.1k| for(size_t i = 1; i != m_s; ++i) { ------------------ | Branch (200:28): [True: 12.8k, False: 349] ------------------ 201| 12.8k| y.square_this_n_times(ws, 1); 202| | 203| 12.8k| if(is_one(y)) { // found a non-trivial square root ------------------ | Branch (203:16): [True: 1, False: 12.8k] ------------------ 204| 1| return false; 205| 1| } 206| | 207| | /* 208| | -1 is the trivial square root of unity, so ``a`` is not a 209| | witness for this number - give up 210| | */ 211| 12.8k| if(is_minus_one(y)) { ------------------ | Branch (211:16): [True: 249, False: 12.5k] ------------------ 212| 249| return true; 213| 249| } 214| 12.8k| } 215| | 216| 349| return false; 217| 599| } primality.cpp:_ZZNK5Botan12_GLOBAL__N_117Miller_Rabin_Test6passesERKNS_6BigIntEENKUlvE_clEv: 184| 915| Montgomery_Int y = [&]() { 185| 915| if(m_vartime) { ------------------ | Branch (185:16): [True: 915, False: 0] ------------------ 186| 915| const auto powm_a = monty_precompute(m_monty_n, a, vartime_window_bits(m_d_bits), false); 187| 915| return monty_execute_vartime(*powm_a, m_d); 188| 915| } else { 189| 0| const auto powm_a = monty_precompute(m_monty_n, a, 4, true); 190| 0| return monty_execute(*powm_a, m_d, m_d_bits); 191| 0| } 192| 915| }(); primality.cpp:_ZN5Botan12_GLOBAL__N_119vartime_window_bitsEm: 140| 915|size_t vartime_window_bits(size_t exp_bits) { 141| 915| if(exp_bits <= 256) { ------------------ | Branch (141:7): [True: 625, False: 290] ------------------ 142| 625| return 4; 143| 625| } else if(exp_bits <= 1024) { ------------------ | Branch (143:14): [True: 290, False: 0] ------------------ 144| 290| return 5; 145| 290| } else if(exp_bits <= 2048) { ------------------ | Branch (145:14): [True: 0, False: 0] ------------------ 146| 0| return 6; 147| 0| } else { 148| 0| return 7; 149| 0| } 150| 915|} primality.cpp:_ZNK5Botan12_GLOBAL__N_117Miller_Rabin_Test6is_oneERKNS_14Montgomery_IntE: 220| 13.7k| bool is_one(const Montgomery_Int& y) const { 221| 13.7k| return CT::is_equal(y.repr().data(), m_one.data(), m_one.size()).as_bool(); 222| 13.7k| } primality.cpp:_ZNK5Botan12_GLOBAL__N_117Miller_Rabin_Test12is_minus_oneERKNS_14Montgomery_IntE: 224| 13.4k| bool is_minus_one(const Montgomery_Int& y) const { 225| 13.4k| return CT::is_equal(y.repr().data(), m_minus_one.data(), m_minus_one.size()).as_bool(); 226| 13.4k| } _ZN5Botan6PCurve15PrimeOrderCurve6Scalar8_zeroizeEv: 16| 13.6k|void PrimeOrderCurve::Scalar::_zeroize() { 17| 13.6k| secure_zeroize_buffer(m_value.data(), m_value.size() * sizeof(word)); 18| 13.6k|} _ZN5Botan6PCurve15PrimeOrderCurve11from_paramsERKNS_6BigIntES4_S4_S4_S4_S4_: 22| 739| const BigInt& p, const BigInt& a, const BigInt& b, const BigInt& base_x, const BigInt& base_y, const BigInt& order) { 23| 739|#if defined(BOTAN_HAS_PCURVES_GENERIC) 24| 739| return PCurveInstance::from_params(p, a, b, base_x, base_y, order); 25| 0|#endif 26| | 27| 0| BOTAN_UNUSED(p, a, b, base_x, base_y, order); ------------------ | | 151| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 28| 0| return {}; 29| 739|} _ZN5Botan6PCurve15PrimeOrderCurve15for_named_curveENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 32| 2.43k|std::shared_ptr PrimeOrderCurve::for_named_curve(std::string_view name) { 33| 2.43k|#if defined(BOTAN_HAS_PCURVES_SECP256R1) 34| 2.43k| if(name == "secp256r1") { ------------------ | Branch (34:7): [True: 226, False: 2.21k] ------------------ 35| 226| return PCurveInstance::secp256r1(); 36| 226| } 37| 2.21k|#endif 38| | 39| 2.21k|#if defined(BOTAN_HAS_PCURVES_SECP384R1) 40| 2.21k| if(name == "secp384r1") { ------------------ | Branch (40:7): [True: 201, False: 2.01k] ------------------ 41| 201| return PCurveInstance::secp384r1(); 42| 201| } 43| 2.01k|#endif 44| | 45| 2.01k|#if defined(BOTAN_HAS_PCURVES_SECP521R1) 46| 2.01k| if(name == "secp521r1") { ------------------ | Branch (46:7): [True: 283, False: 1.72k] ------------------ 47| 283| return PCurveInstance::secp521r1(); 48| 283| } 49| 1.72k|#endif 50| | 51| 1.72k|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL256R1) 52| 1.72k| if(name == "brainpool256r1") { ------------------ | Branch (52:7): [True: 176, False: 1.55k] ------------------ 53| 176| return PCurveInstance::brainpool256r1(); 54| 176| } 55| 1.55k|#endif 56| | 57| 1.55k|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL384R1) 58| 1.55k| if(name == "brainpool384r1") { ------------------ | Branch (58:7): [True: 152, False: 1.39k] ------------------ 59| 152| return PCurveInstance::brainpool384r1(); 60| 152| } 61| 1.39k|#endif 62| | 63| 1.39k|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL512R1) 64| 1.39k| if(name == "brainpool512r1") { ------------------ | Branch (64:7): [True: 137, False: 1.26k] ------------------ 65| 137| return PCurveInstance::brainpool512r1(); 66| 137| } 67| 1.26k|#endif 68| | 69| 1.26k|#if defined(BOTAN_HAS_PCURVES_FRP256V1) 70| 1.26k| if(name == "frp256v1") { ------------------ | Branch (70:7): [True: 0, False: 1.26k] ------------------ 71| 0| return PCurveInstance::frp256v1(); 72| 0| } 73| 1.26k|#endif 74| | 75| 1.26k|#if defined(BOTAN_HAS_PCURVES_SECP192R1) 76| 1.26k| if(name == "secp192r1") { ------------------ | Branch (76:7): [True: 0, False: 1.26k] ------------------ 77| 0| return PCurveInstance::secp192r1(); 78| 0| } 79| 1.26k|#endif 80| | 81| 1.26k|#if defined(BOTAN_HAS_PCURVES_SECP224R1) 82| 1.26k| if(name == "secp224r1") { ------------------ | Branch (82:7): [True: 333, False: 929] ------------------ 83| 333| return PCurveInstance::secp224r1(); 84| 333| } 85| 929|#endif 86| | 87| 929|#if defined(BOTAN_HAS_PCURVES_SECP256K1) 88| 929| if(name == "secp256k1") { ------------------ | Branch (88:7): [True: 194, False: 735] ------------------ 89| 194| return PCurveInstance::secp256k1(); 90| 194| } 91| 735|#endif 92| | 93| 735|#if defined(BOTAN_HAS_PCURVES_SM2P256V1) 94| 735| if(name == "sm2p256v1") { ------------------ | Branch (94:7): [True: 0, False: 735] ------------------ 95| 0| return PCurveInstance::sm2p256v1(); 96| 0| } 97| 735|#endif 98| | 99| 735|#if defined(BOTAN_HAS_PCURVES_NUMSP512D1) 100| 735| if(name == "numsp512d1") { ------------------ | Branch (100:7): [True: 0, False: 735] ------------------ 101| 0| return PCurveInstance::numsp512d1(); 102| 0| } 103| 735|#endif 104| | 105| 735| BOTAN_UNUSED(name); ------------------ | | 151| 735|#define BOTAN_UNUSED Botan::ignore_params ------------------ 106| 735| return {}; 107| 735|} _ZN5Botan6PCurve14PCurveInstance14brainpool256r1Ev: 37| 176|std::shared_ptr PCurveInstance::brainpool256r1() { 38| 176| return PrimeOrderCurveImpl::instance(); 39| 176|} _ZN5Botan6PCurve14PCurveInstance14brainpool384r1Ev: 37| 152|std::shared_ptr PCurveInstance::brainpool384r1() { 38| 152| return PrimeOrderCurveImpl::instance(); 39| 152|} _ZN5Botan6PCurve14PCurveInstance14brainpool512r1Ev: 37| 137|std::shared_ptr PCurveInstance::brainpool512r1() { 38| 137| return PrimeOrderCurveImpl::instance(); 39| 137|} _ZN5Botan6PCurve22GenericPrimeOrderCurveC2ERKNS_6BigIntES4_S4_S4_S4_S4_: 1601| 379| m_params(std::make_unique(p, a, b, base_x, base_y, order)) {} _ZN5Botan6PCurve22GenericPrimeOrderCurve20_precompute_base_mulEv: 1603| 379|void GenericPrimeOrderCurve::_precompute_base_mul() { 1604| 379| BOTAN_STATE_CHECK(m_basemul == nullptr); ------------------ | | 51| 379| do { \ | | 52| 379| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 379| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 379] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 379| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 379] | | ------------------ ------------------ 1605| 379| m_basemul = std::make_unique(from_stash(generator())); 1606| 379|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve10order_bitsEv: 1608| 379|size_t GenericPrimeOrderCurve::order_bits() const { 1609| 379| return _params().order_bits(); 1610| 379|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve19field_element_bytesEv: 1616| 748|size_t GenericPrimeOrderCurve::field_element_bytes() const { 1617| 748| return _params().field_bytes(); 1618| 748|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve8mul_by_gERKNS0_15PrimeOrderCurve6ScalarERNS_21RandomNumberGeneratorE: 1621| 364| RandomNumberGenerator& rng) const { 1622| 364| BOTAN_STATE_CHECK(m_basemul != nullptr); ------------------ | | 51| 364| do { \ | | 52| 364| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 364| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 364] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 364| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 364] | | ------------------ ------------------ 1623| 364| return stash(m_basemul->mul(from_stash(scalar), rng)); 1624| 364|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve9generatorEv: 1712| 379|PrimeOrderCurve::AffinePoint GenericPrimeOrderCurve::generator() const { 1713| 379| return PrimeOrderCurve::AffinePoint::_create(shared_from_this(), _params().base_x(), _params().base_y()); 1714| 379|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve15point_to_affineERKNS0_15PrimeOrderCurve15ProjectivePointE: 1720| 364|PrimeOrderCurve::AffinePoint GenericPrimeOrderCurve::point_to_affine(const ProjectivePoint& pt) const { 1721| 364| const auto affine = to_affine(from_stash(pt)); 1722| | 1723| 364| const auto y2 = affine.y().square(); 1724| 364| const auto x3_ax_b = GenericCurve::AffinePoint::x3_ax_b(affine.x()); 1725| 364| const auto valid_point = affine.is_identity() || (y2 == x3_ax_b); 1726| | 1727| 364| BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve"); ------------------ | | 71| 364| do { \ | | 72| 364| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 364| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 364] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 364| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 364] | | ------------------ ------------------ 1728| | 1729| 364| return stash(affine); 1730| 364|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve12point_negateERKNS0_15PrimeOrderCurve11AffinePointE: 1736| 4|PrimeOrderCurve::AffinePoint GenericPrimeOrderCurve::point_negate(const AffinePoint& pt) const { 1737| 4| return stash(from_stash(pt).negate()); 1738| 4|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE: 1740| 372|bool GenericPrimeOrderCurve::affine_point_is_identity(const AffinePoint& pt) const { 1741| 372| return from_stash(pt).is_identity().as_bool(); 1742| 372|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE: 1744| 372|void GenericPrimeOrderCurve::serialize_point(std::span bytes, const AffinePoint& pt) const { 1745| 372| from_stash(pt).serialize_to(bytes); 1746| 372|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 1748| 360|void GenericPrimeOrderCurve::serialize_scalar(std::span bytes, const Scalar& scalar) const { 1749| 360| BOTAN_ARG_CHECK(bytes.size() == _params().order_bytes(), "Invalid length to serialize_scalar"); ------------------ | | 35| 360| do { \ | | 36| 360| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 360| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 360] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 360| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 360] | | ------------------ ------------------ 1750| 360| from_stash(scalar).serialize_to(bytes); 1751| 360|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 1754| 366| std::span bytes) const { 1755| 366| if(auto s = GenericScalar::deserialize(this, bytes)) { ------------------ | Branch (1755:12): [True: 365, False: 1] ------------------ 1756| 365| if(s->is_nonzero().as_bool()) { ------------------ | Branch (1756:10): [True: 360, False: 5] ------------------ 1757| 360| return stash(s.value()); 1758| 360| } 1759| 365| } 1760| | 1761| 6| return {}; 1762| 366|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve30deserialize_point_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 1774| 70| std::span bytes) const { 1775| 70| if(auto pt = GenericAffinePoint::deserialize_uncompressed(this, bytes)) { ------------------ | Branch (1775:12): [True: 4, False: 66] ------------------ 1776| 4| return stash(pt.value()); 1777| 66| } else { 1778| 66| return {}; 1779| 66| } 1780| 70|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 1815| 4|PrimeOrderCurve::Scalar GenericPrimeOrderCurve::scalar_negate(const Scalar& s) const { 1816| 4| return stash(from_stash(s).negate()); 1817| 4|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 1819| 360|bool GenericPrimeOrderCurve::scalar_is_zero(const Scalar& s) const { 1820| 360| return from_stash(s).is_zero().as_bool(); 1821| 360|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve10scalar_oneEv: 1827| 4|PrimeOrderCurve::Scalar GenericPrimeOrderCurve::scalar_one() const { 1828| 4| return stash(GenericScalar::one(this)); 1829| 4|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve5stashERKNS0_13GenericScalarE: 1835| 368|PrimeOrderCurve::Scalar GenericPrimeOrderCurve::stash(const GenericScalar& s) const { 1836| 368| return Scalar::_create(shared_from_this(), s.stash_value()); 1837| 368|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 1839| 1.08k|GenericScalar GenericPrimeOrderCurve::from_stash(const PrimeOrderCurve::Scalar& s) const { 1840| 1.08k| BOTAN_ARG_CHECK(s._curve().get() == this, "Curve mismatch"); ------------------ | | 35| 1.08k| do { \ | | 36| 1.08k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.08k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.08k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.08k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.08k] | | ------------------ ------------------ 1841| 1.08k| return GenericScalar(this, s._value()); 1842| 1.08k|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve5stashERKNS0_18GenericAffinePointE: 1844| 372|PrimeOrderCurve::AffinePoint GenericPrimeOrderCurve::stash(const GenericAffinePoint& pt) const { 1845| 372| const auto x_w = pt.x().stash_value(); 1846| 372| const auto y_w = pt.y().stash_value(); 1847| 372| return AffinePoint::_create(shared_from_this(), x_w, y_w); 1848| 372|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve10from_stashERKNS0_15PrimeOrderCurve11AffinePointE: 1850| 1.12k|GenericAffinePoint GenericPrimeOrderCurve::from_stash(const PrimeOrderCurve::AffinePoint& pt) const { 1851| 1.12k| BOTAN_ARG_CHECK(pt._curve().get() == this, "Curve mismatch"); ------------------ | | 35| 1.12k| do { \ | | 36| 1.12k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.12k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.12k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.12k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.12k] | | ------------------ ------------------ 1852| 1.12k| const auto x = GenericField(this, pt._x()); 1853| 1.12k| const auto y = GenericField(this, pt._y()); 1854| 1.12k| return GenericAffinePoint(x, y); 1855| 1.12k|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve5stashERKNS0_22GenericProjectivePointE: 1857| 364|PrimeOrderCurve::ProjectivePoint GenericPrimeOrderCurve::stash(const GenericProjectivePoint& pt) const { 1858| 364| const auto x_w = pt.x().stash_value(); 1859| 364| const auto y_w = pt.y().stash_value(); 1860| 364| const auto z_w = pt.z().stash_value(); 1861| 364| return ProjectivePoint::_create(shared_from_this(), x_w, y_w, z_w); 1862| 364|} _ZNK5Botan6PCurve22GenericPrimeOrderCurve10from_stashERKNS0_15PrimeOrderCurve15ProjectivePointE: 1864| 364|GenericProjectivePoint GenericPrimeOrderCurve::from_stash(const PrimeOrderCurve::ProjectivePoint& pt) const { 1865| 364| BOTAN_ARG_CHECK(pt._curve().get() == this, "Curve mismatch"); ------------------ | | 35| 364| do { \ | | 36| 364| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 364| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 364] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 364| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 364] | | ------------------ ------------------ 1866| 364| const auto x = GenericField(this, pt._x()); 1867| 364| const auto y = GenericField(this, pt._y()); 1868| 364| const auto z = GenericField(this, pt._z()); 1869| 364| return GenericProjectivePoint(x, y, z); 1870| 364|} _ZN5Botan6PCurve14PCurveInstance11from_paramsERKNS_6BigIntES4_S4_S4_S4_S4_: 1889| 739| const BigInt& p, const BigInt& a, const BigInt& b, const BigInt& base_x, const BigInt& base_y, const BigInt& order) { 1890| | // We don't check that p and order are prime here on the assumption this has 1891| | // been checked already by EC_Group 1892| | 1893| 739| BOTAN_ARG_CHECK(a >= 0 && a < p, "a is invalid"); ------------------ | | 35| 739| do { \ | | 36| 739| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.47k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 739, False: 0] | | | Branch (37:12): [True: 739, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 739| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 739] | | ------------------ ------------------ 1894| 739| BOTAN_ARG_CHECK(b > 0 && b < p, "b is invalid"); ------------------ | | 35| 739| do { \ | | 36| 739| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.47k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 739, False: 0] | | | Branch (37:12): [True: 739, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 739| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 739] | | ------------------ ------------------ 1895| 739| BOTAN_ARG_CHECK(base_x >= 0 && base_x < p, "base_x is invalid"); ------------------ | | 35| 739| do { \ | | 36| 739| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.47k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 739, False: 0] | | | Branch (37:12): [True: 739, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 739| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 739] | | ------------------ ------------------ 1896| 739| BOTAN_ARG_CHECK(base_y >= 0 && base_y < p, "base_y is invalid"); ------------------ | | 35| 739| do { \ | | 36| 739| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.47k| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 739, False: 0] | | | Branch (37:12): [True: 739, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 739| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 739] | | ------------------ ------------------ 1897| | 1898| 739| const size_t p_bits = p.bits(); 1899| | 1900| | // Same size restrictions as EC_Group however here we do not require 1901| | // exactly the primes for the 521 or 239 bit exceptions; this code 1902| | // should work fine with any such prime and we are relying on the higher 1903| | // levels to prevent creating such a group in the first place 1904| | // 1905| | // TODO(Botan4) increase the 128 here to 192 when the corresponding EC_Group constructor is changed 1906| | // 1907| 739| if(p_bits != 521 && p_bits != 239 && (p_bits < 128 || p_bits > 512 || p_bits % 32 != 0)) { ------------------ | Branch (1907:7): [True: 737, False: 2] | Branch (1907:24): [True: 737, False: 0] | Branch (1907:42): [True: 0, False: 737] | Branch (1907:58): [True: 0, False: 737] | Branch (1907:74): [True: 0, False: 737] ------------------ 1908| 0| return {}; 1909| 0| } 1910| | 1911| | // We don't want to deal with Shanks-Tonelli in the generic case 1912| 739| if(p % 4 != 3) { ------------------ | Branch (1912:7): [True: 308, False: 431] ------------------ 1913| 308| return {}; 1914| 308| } 1915| | 1916| | // The bit length of the field and order being the same simplifies things 1917| 431| if(p_bits != order.bits()) { ------------------ | Branch (1917:7): [True: 52, False: 379] ------------------ 1918| 52| return {}; 1919| 52| } 1920| | 1921| | // Check that the (x,y) generator point is on the curve 1922| 379| const auto mod_p = Barrett_Reduction::for_public_modulus(p); 1923| 379| const BigInt y2 = mod_p.square(base_y); 1924| 379| const BigInt x3_ax_b = mod_p.reduce(mod_p.cube(base_x) + mod_p.multiply(a, base_x) + b); 1925| 379| if(y2 != x3_ax_b) { ------------------ | Branch (1925:7): [True: 0, False: 379] ------------------ 1926| 0| return {}; 1927| 0| } 1928| | 1929| 379| auto gpoc = std::make_shared(p, a, b, base_x, base_y, order); 1930| | /* 1931| | The implementation of this needs to call shared_from_this which is not usable 1932| | until after the constructor has completed, so we have to do a two-stage 1933| | construction process. This is certainly not so clean but it is contained to 1934| | this single file so seems tolerable. 1935| | 1936| | Alternately we could lazily compute the base mul table but this brings in 1937| | locking issues which seem a worse alternative overall. 1938| | */ 1939| 379| gpoc->_precompute_base_mul(); 1940| 379| return gpoc; 1941| 379|} _ZNK5Botan6PCurve18GenericCurveParams10order_bitsEv: 147| 1.10k| size_t order_bits() const { return m_order_bits; } _ZNK5Botan6PCurve18GenericCurveParams11order_bytesEv: 149| 1.81k| size_t order_bytes() const { return m_order_bytes; } _ZNK5Botan6PCurve18GenericCurveParams11field_bytesEv: 153| 2.07k| size_t field_bytes() const { return m_field_bytes; } _ZN5Botan6PCurve19GenericBaseMulTable3mulERKNS0_13GenericScalarERNS_21RandomNumberGeneratorE: 1511| 364| GenericProjectivePoint mul(const GenericScalar& s, RandomNumberGenerator& rng) { 1512| 364| const GenericBlindingRandomness blinding(s.curve(), rng, 1); 1513| | // W+1 bit windows for Booth recoding overlap 1514| 364| const GenericBlindedScalarBits scalar(s, blinding, 0, WindowBits + 1); 1515| 364| return basemul_booth_exec(m_table, scalar, blinding); 1516| 364| } _ZNK5Botan6PCurve13GenericScalar5curveEv: 553| 728| const GenericPrimeOrderCurve* curve() const { return m_curve; } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_125GenericBlindingRandomnessC2EPKNS0_22GenericPrimeOrderCurveERNS_21RandomNumberGeneratorEm: 1326| 364| m_seeded(rng.is_seeded()), 1327| 364| m_scalars(scalars), 1328| 364| m_mask_bytes(mask_bytes(curve->_params().order_bits())), 1329| 364| m_isomorphism(GenericField::one(curve)) { 1330| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1331| 364| if(m_seeded) { ------------------ | Branch (1331:13): [True: 0, False: 364] ------------------ 1332| | // Reducing 64 extra bits mod p leaves a negligible bias 1333| 0| const size_t wide_bytes = curve->_params().field_bytes() + 8; 1334| | 1335| 0| secure_vector buf(m_scalars * m_mask_bytes + (Rerandomizations + 1) * wide_bytes); 1336| 0| rng.randomize(buf); 1337| | 1338| 0| m_masks.assign(buf.begin(), buf.begin() + m_scalars * m_mask_bytes); 1339| | 1340| 0| m_rerandomizers.reserve(Rerandomizations); 1341| 0| for(size_t i = 0; i != Rerandomizations; ++i) { ------------------ | Branch (1341:31): [True: 0, False: 0] ------------------ 1342| 0| const auto bytes = std::span{buf}.subspan(m_scalars * m_mask_bytes + i * wide_bytes, wide_bytes); 1343| 0| m_rerandomizers.push_back(GenericField::from_wide_bytes(curve, bytes)); 1344| 0| } 1345| | 1346| 0| const auto iso = 1347| 0| std::span{buf}.subspan(m_scalars * m_mask_bytes + Rerandomizations * wide_bytes, wide_bytes); 1348| 0| m_isomorphism = GenericField::from_wide_bytes(curve, iso); 1349| 0| m_isomorphism.conditional_assign(m_isomorphism.is_zero(), GenericField::one(curve)); 1350| 0| } 1351| 364| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_125GenericBlindingRandomness10mask_bytesEm: 1377| 364| static size_t mask_bytes(size_t order_bits) { 1378| 364| const size_t blinder_bits = scalar_blinding_bits(order_bits); 1379| 364| const size_t mask_words = (blinder_bits + WordInfo::bits - 1) / WordInfo::bits; 1380| 364| return mask_words * WordInfo::bytes; 1381| 364| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField3oneEPKNS0_22GenericPrimeOrderCurveE: 639| 14.8k| static GenericField one(const GenericPrimeOrderCurve* curve) { 640| 14.8k| return GenericField(curve, curve->_params().field_monty_r1()); 641| 14.8k| } _ZNK5Botan6PCurve18GenericCurveParams14field_monty_r1Ev: 163| 14.8k| const StorageUnit& field_monty_r1() const { return m_field_monty_r1; } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField4redcEPKNS0_22GenericPrimeOrderCurveENSt3__15arrayImLm18EEE: 916| 9.97M| static StorageUnit redc(const GenericPrimeOrderCurve* curve, std::array z) { 917| 9.97M| const auto& mod = curve->_params().field(); 918| 9.97M| const size_t words = curve->_params().words(); 919| 9.97M| StorageUnit r{}; 920| 9.97M| StorageUnit ws{}; 921| 9.97M| bigint_monty_redc( 922| 9.97M| r.data(), z.data(), mod.data(), words, curve->_params().field_p_dash(), ws.data(), ws.size()); 923| 9.97M| return r; 924| 9.97M| } _ZNK5Botan6PCurve18GenericCurveParams5fieldEv: 159| 17.3M| const StorageUnit& field() const { return m_field; } _ZNK5Botan6PCurve18GenericCurveParams5wordsEv: 145| 14.4M| size_t words() const { return m_words; } _ZNK5Botan6PCurve18GenericCurveParams12field_p_dashEv: 173| 9.97M| word field_p_dash() const { return m_field_p_dash; } _ZNK5Botan6PCurve18GenericCurveParams3mulERNSt3__15arrayImLm18EEERKNS3_ImLm9EEES8_: 203| 6.95M| void mul(std::array& z, const std::array& x, const std::array& y) const { 204| 6.95M| clear_mem(z); 205| | 206| 6.95M| if(m_words == 4) { ------------------ | Branch (206:13): [True: 1.47M, False: 5.47M] ------------------ 207| 1.47M| bigint_comba_mul4(z.data(), x.data(), y.data()); 208| 5.47M| } else if(m_words == 6) { ------------------ | Branch (208:20): [True: 0, False: 5.47M] ------------------ 209| 0| bigint_comba_mul6(z.data(), x.data(), y.data()); 210| 5.47M| } else if(m_words == 8) { ------------------ | Branch (210:20): [True: 0, False: 5.47M] ------------------ 211| 0| bigint_comba_mul8(z.data(), x.data(), y.data()); 212| 5.47M| } else if(m_words == 9) { ------------------ | Branch (212:20): [True: 87.2k, False: 5.39M] ------------------ 213| 87.2k| bigint_comba_mul9(z.data(), x.data(), y.data()); 214| 5.39M| } else { 215| 5.39M| bigint_mul(z.data(), z.size(), x.data(), m_words, m_words, y.data(), m_words, m_words, nullptr, 0); 216| 5.39M| } 217| 6.95M| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField18conditional_assignENS_2CT6ChoiceERKS2_: 850| 13.0k| void conditional_assign(CT::Choice cond, const GenericField& nx) { 851| 13.0k| const W mask = cond.into_bitmask(); 852| | 853| 130k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (853:28): [True: 117k, False: 13.0k] ------------------ 854| 117k| m_val[i] = choose(mask, nx.m_val[i], m_val[i]); 855| 117k| } 856| 13.0k| } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField7is_zeroEv: 809| 1.51M| CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_curve->_params().words()).as_choice(); } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_124GenericBlindedScalarBitsC2ERKNS0_13GenericScalarERKNS1_25GenericBlindingRandomnessEmm: 1399| 364| size_t wb) { 1400| 364| BOTAN_ASSERT_NOMSG(wb == 1 || wb == 2 || wb == 3 || wb == 4 || wb == 5 || wb == 6 || wb == 7); ------------------ | | 84| 364| do { \ | | 85| 364| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 4.36k| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 0, False: 364] | | | Branch (86:12): [True: 0, False: 364] | | | Branch (86:12): [True: 0, False: 364] | | | Branch (86:12): [True: 0, False: 364] | | | Branch (86:12): [True: 0, False: 364] | | | Branch (86:12): [True: 0, False: 364] | | | Branch (86:12): [True: 364, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 364| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 364] | | ------------------ ------------------ 1401| | 1402| 364| const auto& params = scalar.curve()->_params(); 1403| | 1404| 364| const size_t order_bits = params.order_bits(); 1405| 364| m_window_bits = wb; 1406| | 1407| 364| const size_t blinder_bits = scalar_blinding_bits(order_bits); 1408| | 1409| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1410| 364| if(blinder_bits > 0 && randomness.seeded()) { ------------------ | Branch (1410:13): [True: 364, False: 0] | Branch (1410:33): [True: 0, False: 364] ------------------ 1411| 0| const size_t mask_words = (blinder_bits + WordInfo::bits - 1) / WordInfo::bits; 1412| | 1413| 0| const size_t words = params.words(); 1414| | 1415| 0| const auto maskb = randomness.mask(idx); 1416| 0| BOTAN_ASSERT_NOMSG(maskb.size() == mask_words * WordInfo::bytes); ------------------ | | 84| 0| do { \ | | 85| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 0| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 0| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 0] | | ------------------ ------------------ 1417| | 1418| 0| std::array mask{}; 1419| 0| load_le(mask.data(), maskb.data(), mask_words); 1420| | 1421| | // Mask to exactly blinder_bits and set MSB and LSB 1422| 0| const size_t excess = mask_words * WordInfo::bits - blinder_bits; 1423| 0| if(excess > 0) { ------------------ | Branch (1423:16): [True: 0, False: 0] ------------------ 1424| 0| mask[mask_words - 1] &= (static_cast(1) << (WordInfo::bits - excess)) - 1; 1425| 0| } 1426| 0| const size_t msb_pos = (blinder_bits - 1) % WordInfo::bits; 1427| 0| mask[(blinder_bits - 1) / WordInfo::bits] |= static_cast(1) << msb_pos; 1428| 0| mask[0] |= 1; 1429| | 1430| 0| std::array mask_n{}; 1431| | 1432| 0| const auto sw = scalar.to_words(); 1433| | 1434| | // Compute masked scalar s + k*n 1435| 0| params.mul(mask_n, mask, params.order()); 1436| 0| bigint_add2(mask_n.data(), 2 * words, sw.data(), words); 1437| | 1438| 0| std::reverse(mask_n.begin(), mask_n.end()); 1439| 0| m_bytes = store_be>(mask_n); 1440| 0| m_bits = order_bits + blinder_bits; 1441| 364| } else { 1442| | // No RNG available, skip blinding 1443| 364| m_bytes = scalar.serialize>(); 1444| 364| m_bits = order_bits; 1445| 364| } 1446| | 1447| 364| m_windows = (m_bits + wb - 1) / wb; 1448| 364| } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_125GenericBlindingRandomness6seededEv: 1353| 364| bool seeded() const { return m_seeded; } _ZN5Botan6PCurve13GenericScalar8from_repEPKNS0_22GenericPrimeOrderCurveENSt3__15arrayImLm9EEE: 577| 724| static StorageUnit from_rep(const GenericPrimeOrderCurve* curve, StorageUnit z) { 578| 724| std::array ze{}; 579| 724| copy_mem(std::span{ze}.template first(), z); 580| 724| return redc(curve, ze); 581| 724| } _ZN5Botan6PCurve13GenericScalar4redcEPKNS0_22GenericPrimeOrderCurveENSt3__15arrayImLm18EEE: 567| 1.08k| static StorageUnit redc(const GenericPrimeOrderCurve* curve, std::array z) { 568| 1.08k| const auto& mod = curve->_params().order(); 569| 1.08k| const size_t words = curve->_params().words(); 570| 1.08k| StorageUnit r{}; 571| 1.08k| StorageUnit ws{}; 572| 1.08k| bigint_monty_redc( 573| 1.08k| r.data(), z.data(), mod.data(), words, curve->_params().order_p_dash(), ws.data(), ws.size()); 574| 1.08k| return r; 575| 1.08k| } _ZNK5Botan6PCurve18GenericCurveParams12order_p_dashEv: 187| 1.08k| word order_p_dash() const { return m_order_p_dash; } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_124GenericBlindedScalarBits4bitsEv: 1452| 364| size_t bits() const { return m_bits; } _ZN5Botan6PCurve22GenericProjectivePoint18conditional_assignENS_2CT6ChoiceERKS1_: 1150| 364| void conditional_assign(CT::Choice cond, const Self& pt) { 1151| 364| GenericField::conditional_assign(m_x, m_y, m_z, cond, pt.x(), pt.y(), pt.z()); 1152| 364| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField18conditional_assignERS2_S3_S3_NS_2CT6ChoiceERKS2_S7_S7_: 884| 497k| const GenericField& nz) { 885| 497k| const W mask = cond.into_bitmask(); 886| | 887| 4.97M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (887:28): [True: 4.48M, False: 497k] ------------------ 888| 4.48M| x.m_val[i] = choose(mask, nx.m_val[i], x.m_val[i]); 889| 4.48M| y.m_val[i] = choose(mask, ny.m_val[i], y.m_val[i]); 890| 4.48M| z.m_val[i] = choose(mask, nz.m_val[i], z.m_val[i]); 891| 4.48M| } 892| 497k| } _ZNK5Botan6PCurve22GenericProjectivePoint6negateEv: 1254| 364| Self negate() const { return Self(x(), y().negate(), z()); } _ZNK5Botan6PCurve22GenericProjectivePoint18_const_time_poisonEv: 1288| 364| void _const_time_poison() const { CT::poison_all(m_x, m_y, m_z); } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField18_const_time_poisonEv: 835| 1.09k| void _const_time_poison() const { CT::poison(m_val); } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_124GenericBlindedScalarBits10get_windowEm: 1454| 13.4k| size_t get_window(size_t offset) const { 1455| 13.4k| if(m_window_bits == 1) { ------------------ | Branch (1455:13): [True: 0, False: 13.4k] ------------------ 1456| 0| return read_window_bits<1>(std::span{m_bytes}, offset); 1457| 13.4k| } else if(m_window_bits == 2) { ------------------ | Branch (1457:20): [True: 0, False: 13.4k] ------------------ 1458| 0| return read_window_bits<2>(std::span{m_bytes}, offset); 1459| 13.4k| } else if(m_window_bits == 3) { ------------------ | Branch (1459:20): [True: 0, False: 13.4k] ------------------ 1460| 0| return read_window_bits<3>(std::span{m_bytes}, offset); 1461| 13.4k| } else if(m_window_bits == 4) { ------------------ | Branch (1461:20): [True: 0, False: 13.4k] ------------------ 1462| 0| return read_window_bits<4>(std::span{m_bytes}, offset); 1463| 13.4k| } else if(m_window_bits == 5) { ------------------ | Branch (1463:20): [True: 0, False: 13.4k] ------------------ 1464| 0| return read_window_bits<5>(std::span{m_bytes}, offset); 1465| 13.4k| } else if(m_window_bits == 6) { ------------------ | Branch (1465:20): [True: 0, False: 13.4k] ------------------ 1466| 0| return read_window_bits<6>(std::span{m_bytes}, offset); 1467| 13.4k| } else if(m_window_bits == 7) { ------------------ | Branch (1467:20): [True: 13.4k, False: 0] ------------------ 1468| 13.4k| return read_window_bits<7>(std::span{m_bytes}, offset); 1469| 13.4k| } else { 1470| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 1471| 0| } 1472| 13.4k| } _ZN5Botan6PCurve22GenericProjectivePoint10add_or_subERKS1_RKNS0_18GenericAffinePointENS_2CT6ChoiceE: 1177| 13.0k| static Self add_or_sub(const Self& a, const GenericAffinePoint& b, CT::Choice sub) { 1178| 13.0k| return point_add_or_sub_mixed( 1179| 13.0k| a, b, sub, GenericField::one(a.curve()), GenericField::curve_a(a.curve())); 1180| 13.0k| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_1miERKNS1_12GenericFieldES4_: 740| 2.29M| friend GenericField operator-(const GenericField& a, const GenericField& b) { return a + b.negate(); } _ZNK5Botan6PCurve18GenericCurveParams9a_is_zeroEv: 199| 262k| bool a_is_zero() const { return m_a_is_zero; } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField4mul3Ev: 720| 267k| GenericField mul3() const { return mul2() + (*this); } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField4mul4Ev: 723| 267k| GenericField mul4() const { return mul2().mul2(); } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField4mul2Ev: 710| 2.13M| GenericField mul2() const { 711| 2.13M| StorageUnit t = value(); 712| 2.13M| const W carry = shift_left<1>(t); 713| | 714| 2.13M| StorageUnit r; 715| 2.13M| bigint_monty_maybe_sub(r.data(), carry, t.data(), m_curve->_params().field().data()); 716| 2.13M| return GenericField(m_curve, r); 717| 2.13M| } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField5valueEv: 907| 19.0M| const StorageUnit& value() const { return m_val; } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField4mul8Ev: 726| 267k| GenericField mul8() const { return mul2().mul2().mul2(); } _ZNK5Botan6PCurve22GenericProjectivePoint5curveEv: 1286| 706k| const GenericPrimeOrderCurve* curve() const { return m_x.curve(); } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField5curveEv: 823| 724k| const GenericPrimeOrderCurve* curve() const { return m_curve; } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField7curve_aEPKNS0_22GenericPrimeOrderCurveE: 643| 164k| static GenericField curve_a(const GenericPrimeOrderCurve* curve) { 644| 164k| return GenericField(curve, curve->_params().monty_curve_a()); 645| 164k| } _ZNK5Botan6PCurve18GenericCurveParams13monty_curve_aEv: 189| 164k| const StorageUnit& monty_curve_a() const { return m_monty_curve_a; } _ZN5Botan6PCurve18GenericAffinePoint9ct_selectENSt3__14spanIKS1_Lm18446744073709551615EEEm: 992| 13.4k| static auto ct_select(std::span pts, size_t idx) { 993| 13.4k| BOTAN_ARG_CHECK(!pts.empty(), "Cannot select from an empty set"); ------------------ | | 35| 13.4k| do { \ | | 36| 13.4k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 13.4k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 13.4k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 13.4k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 13.4k] | | ------------------ ------------------ 994| 13.4k| auto result = GenericAffinePoint::identity(pts[0].curve()); 995| | 996| | // Intentionally wrapping; set to maximum size_t if idx == 0 997| 13.4k| const size_t idx1 = idx - 1; 998| 442k| for(size_t i = 0; i != pts.size(); ++i) { ------------------ | Branch (998:28): [True: 428k, False: 13.4k] ------------------ 999| 428k| const auto found = CT::Mask::is_equal(idx1, i).as_choice(); 1000| 428k| result.conditional_assign(found, pts[i]); 1001| 428k| } 1002| | 1003| 13.4k| return result; 1004| 13.4k| } _ZNK5Botan6PCurve18GenericAffinePoint5curveEv: 1077| 14.1k| const GenericPrimeOrderCurve* curve() const { return m_x.curve(); } _ZN5Botan6PCurve18GenericAffinePoint18conditional_assignENS_2CT6ChoiceERKS1_: 1073| 428k| void conditional_assign(CT::Choice cond, const GenericAffinePoint& pt) { 1074| 428k| GenericField::conditional_assign(m_x, m_y, cond, pt.x(), pt.y()); 1075| 428k| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField18conditional_assignERS2_S3_NS_2CT6ChoiceERKS2_S7_: 864| 428k| GenericField& x, GenericField& y, CT::Choice cond, const GenericField& nx, const GenericField& ny) { 865| 428k| const W mask = cond.into_bitmask(); 866| | 867| 4.28M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (867:28): [True: 3.86M, False: 428k] ------------------ 868| 3.86M| x.m_val[i] = choose(mask, nx.m_val[i], x.m_val[i]); 869| 3.86M| y.m_val[i] = choose(mask, ny.m_val[i], y.m_val[i]); 870| 3.86M| } 871| 428k| } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_125GenericBlindingRandomness13randomize_repERNS0_22GenericProjectivePointEm: 1363| 1.45k| void randomize_rep(GenericProjectivePoint& pt, size_t idx) const { 1364| 1.45k| BOTAN_ASSERT_NOMSG(idx < Rerandomizations); ------------------ | | 84| 1.45k| do { \ | | 85| 1.45k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 1.45k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 1.45k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 1.45k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 1.45k] | | ------------------ ------------------ 1365| | // Conditional ok: caller's RNG state (seeded vs not) is presumed public 1366| 1.45k| if(m_seeded) { ------------------ | Branch (1366:13): [True: 0, False: 1.45k] ------------------ 1367| 0| pt.randomize_rep(m_rerandomizers[idx]); 1368| 0| } 1369| 1.45k| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericFieldmLERKS2_: 750| 37.8k| GenericField& operator*=(const GenericField& other) { 751| 37.8k| const auto* curve = check_curve(*this, other); 752| | 753| 37.8k| std::array z; // NOLINT(*-member-init) 754| 37.8k| curve->_params().mul(z, value(), other.value()); 755| 37.8k| m_val = redc(curve, z); 756| 37.8k| return (*this); 757| 37.8k| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField11check_curveERKS2_S4_: 911| 9.92M| static const GenericPrimeOrderCurve* check_curve(const GenericField& a, const GenericField& b) { 912| 9.92M| BOTAN_STATE_CHECK(a.m_curve == b.m_curve); ------------------ | | 51| 9.92M| do { \ | | 52| 9.92M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 9.92M| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 9.92M] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 9.92M| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 9.92M] | | ------------------ ------------------ 913| 9.92M| return a.m_curve; 914| 9.92M| } _ZNK5Botan6PCurve22GenericProjectivePoint20_const_time_unpoisonEv: 1290| 364| void _const_time_unpoison() const { CT::unpoison_all(m_x, m_y, m_z); } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField20_const_time_unpoisonEv: 837| 1.09k| void _const_time_unpoison() const { CT::unpoison(m_val); } _ZNK5Botan6PCurve22GenericProjectivePoint11is_identityEv: 1148| 987k| CT::Choice is_identity() const { return z().is_zero(); } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField6invertEv: 781| 743| GenericField invert() const { return pow_vartime(m_curve->_params().field_minus_2()); } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField11pow_vartimeERKNSt3__15arrayImLm9EEE: 765| 743| GenericField pow_vartime(const StorageUnit& exp) const { 766| 743| const auto one = GenericField::one(curve()); 767| 743| auto bits = curve()->_params().field_bits(); 768| 743| auto words = curve()->_params().words(); 769| 743| return impl_pow_vartime(*this, one, bits, std::span{exp}.last(words)); 770| 743| } _ZNK5Botan6PCurve18GenericCurveParams10field_bitsEv: 151| 743| size_t field_bits() const { return m_field_bits; } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_116impl_pow_vartimeINS1_12GenericFieldEEET_RKS4_S6_mNSt3__14spanIKmLm18446744073709551615EEE: 56| 743|T impl_pow_vartime(const T& elem, const T& one, size_t bits, std::span exp) { 57| 743| constexpr size_t WindowBits = 4; 58| 743| constexpr size_t WindowElements = (1 << WindowBits) - 1; 59| | 60| 743| const size_t Windows = (bits + WindowBits - 1) / WindowBits; 61| | 62| 743| std::vector tbl; 63| 743| tbl.reserve(WindowElements); 64| | 65| 743| tbl.push_back(elem); 66| | 67| 11.1k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (67:22): [True: 10.4k, False: 743] ------------------ 68| 10.4k| if(i % 2 == 1) { ------------------ | Branch (68:10): [True: 5.20k, False: 5.20k] ------------------ 69| 5.20k| tbl.push_back(tbl[i / 2].square()); 70| 5.20k| } else { 71| 5.20k| tbl.push_back(tbl[i - 1] * tbl[0]); 72| 5.20k| } 73| 10.4k| } 74| | 75| 743| auto r = one; 76| | 77| 743| const size_t w0 = read_window_bits(exp, (Windows - 1) * WindowBits); 78| | 79| 743| if(w0 > 0) { ------------------ | Branch (79:7): [True: 743, False: 0] ------------------ 80| 743| r = tbl[w0 - 1]; 81| 743| } 82| | 83| 40.1k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (83:22): [True: 39.4k, False: 743] ------------------ 84| 197k| for(size_t j = 0; j != WindowBits; ++j) { ------------------ | Branch (84:25): [True: 157k, False: 39.4k] ------------------ 85| 157k| r = r.square(); 86| 157k| } 87| 39.4k| const size_t w = read_window_bits(exp, (Windows - i - 1) * WindowBits); 88| | 89| 39.4k| if(w > 0) { ------------------ | Branch (89:10): [True: 37.8k, False: 1.55k] ------------------ 90| 37.8k| r *= tbl[w - 1]; 91| 37.8k| } 92| 39.4k| } 93| | 94| 743| return r; 95| 743|} _ZNK5Botan6PCurve18GenericCurveParams13field_minus_2Ev: 161| 743| const StorageUnit& field_minus_2() const { return m_field_minus_2; } _ZNK5Botan6PCurve22GenericProjectivePoint3dblEv: 1240| 267k| Self dbl() const { 1241| 267k| if(curve()->_params().a_is_minus_3()) { ------------------ | Branch (1241:13): [True: 4.96k, False: 262k] ------------------ 1242| 4.96k| return dbl_a_minus_3(*this); 1243| 262k| } else if(curve()->_params().a_is_zero()) { ------------------ | Branch (1243:20): [True: 111k, False: 150k] ------------------ 1244| 111k| return dbl_a_zero(*this); 1245| 150k| } else { 1246| 150k| const auto A = GenericField::curve_a(curve()); 1247| 150k| return dbl_generic(*this, A); 1248| 150k| } 1249| 267k| } _ZNK5Botan6PCurve18GenericCurveParams12a_is_minus_3Ev: 197| 267k| bool a_is_minus_3() const { return m_a_is_minus_3; } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField4zeroEPKNS0_22GenericPrimeOrderCurveE: 634| 26.8k| static GenericField zero(const GenericPrimeOrderCurve* curve) { 635| 26.8k| const StorageUnit zeros{}; 636| 26.8k| return GenericField(curve, zeros); 637| 26.8k| } _ZN5Botan6PCurveplERKNS0_22GenericProjectivePointES3_: 1132| 235k| friend Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } _ZN5Botan6PCurve22GenericProjectivePoint3addERKS1_S3_: 1196| 235k| static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_generic.cpp:_ZNK5Botan6PCurve22GenericProjectivePoint1zEv: 1284| 4.35M| const GenericField& z() const { return m_z; } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField6squareEv: 759| 3.01M| GenericField square() const { 760| 3.01M| std::array z; // NOLINT(*-member-init) 761| 3.01M| m_curve->_params().sqr(z, value()); 762| 3.01M| return GenericField(m_curve, redc(m_curve, z)); 763| 3.01M| } _ZNK5Botan6PCurve18GenericCurveParams3sqrERNSt3__15arrayImLm18EEERKNS3_ImLm9EEE: 219| 3.01M| void sqr(std::array& z, const std::array& x) const { 220| 3.01M| clear_mem(z); 221| | 222| 3.01M| if(m_words == 4) { ------------------ | Branch (222:13): [True: 675k, False: 2.34M] ------------------ 223| 675k| bigint_comba_sqr4(z.data(), x.data()); 224| 2.34M| } else if(m_words == 6) { ------------------ | Branch (224:20): [True: 0, False: 2.34M] ------------------ 225| 0| bigint_comba_sqr6(z.data(), x.data()); 226| 2.34M| } else if(m_words == 8) { ------------------ | Branch (226:20): [True: 0, False: 2.34M] ------------------ 227| 0| bigint_comba_sqr8(z.data(), x.data()); 228| 2.34M| } else if(m_words == 9) { ------------------ | Branch (228:20): [True: 33.6k, False: 2.30M] ------------------ 229| 33.6k| bigint_comba_sqr9(z.data(), x.data()); 230| 2.30M| } else { 231| 2.30M| bigint_sqr(z.data(), z.size(), x.data(), m_words, m_words, nullptr, 0); 232| 2.30M| } 233| 3.01M| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField11deserializeEPKNS0_22GenericPrimeOrderCurveENSt3__14spanIKhLm18446744073709551615EEE: 609| 140| std::span bytes) { 610| 140| const size_t len = curve->_params().field_bytes(); 611| | 612| 140| if(bytes.size() != len) { ------------------ | Branch (612:13): [True: 0, False: 140] ------------------ 613| 0| return {}; 614| 0| } 615| | 616| 140| const auto words = bytes_to_words(bytes); 617| | 618| 140| if(words) { ------------------ | Branch (618:13): [True: 140, False: 0] ------------------ 619| 140| if(!bigint_ct_is_lt(words->data(), N, curve->_params().field().data(), N).as_bool()) { ------------------ | Branch (619:16): [True: 7, False: 133] ------------------ 620| 7| return {}; 621| 7| } 622| | 623| | // Safe because we checked above that words is an integer < P 624| 133| return GenericField::from_words(curve, *words); 625| 140| } else { 626| 0| return {}; 627| 0| } 628| 140| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_114bytes_to_wordsILm9EEENSt3__18optionalINS3_5arrayImXT_EEEEENS3_4spanIKhLm18446744073709551615EEE: 28| 506|constexpr std::optional> bytes_to_words(std::span bytes) { 29| 506| if(bytes.size() > WordInfo::bytes * N) { ------------------ | Branch (29:7): [True: 0, False: 506] ------------------ 30| 0| return std::nullopt; 31| 0| } 32| | 33| 506| std::array r{}; 34| | 35| 506| const size_t full_words = bytes.size() / WordInfo::bytes; 36| 506| const size_t extra_bytes = bytes.size() % WordInfo::bytes; 37| | 38| 2.11k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (38:22): [True: 1.60k, False: 506] ------------------ 39| 1.60k| r[i] = load_be(bytes.data(), full_words - 1 - i); 40| 1.60k| } 41| | 42| 506| if(extra_bytes > 0) { ------------------ | Branch (42:7): [True: 270, False: 236] ------------------ 43| 270| const size_t shift = extra_bytes * 8; 44| 270| bigint_shl1(r.data(), r.size(), r.size(), shift); 45| | 46| 1.34k| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (46:25): [True: 1.07k, False: 270] ------------------ 47| 1.07k| const word b0 = bytes[WordInfo::bytes * full_words + i]; 48| 1.07k| r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 49| 1.07k| } 50| 270| } 51| | 52| 506| return r; 53| 506|} pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_1mlERKNS1_12GenericFieldES4_: 742| 6.91M| friend GenericField operator*(const GenericField& a, const GenericField& b) { 743| 6.91M| const auto* curve = check_curve(a, b); 744| | 745| 6.91M| std::array z; // NOLINT(*-member-init) 746| 6.91M| curve->_params().mul(z, a.value(), b.value()); 747| 6.91M| return GenericField(curve, redc(curve, z)); 748| 6.91M| } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericFieldeqERKS2_: 813| 428| CT::Choice operator==(const GenericField& other) const { 814| 428| if(this->m_curve != other.m_curve) { ------------------ | Branch (814:13): [True: 0, False: 428] ------------------ 815| 0| return CT::Choice::no(); 816| 0| } 817| | 818| 428| return CT::is_equal(m_val.data(), other.m_val.data(), m_curve->_params().words()).as_choice(); 819| 428| } pcurves_generic.cpp:_ZNK5Botan6PCurve22GenericProjectivePoint1xEv: 1274| 2.02M| const GenericField& x() const { return m_x; } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField10from_wordsEPKNS0_22GenericPrimeOrderCurveERKNSt3__15arrayImLm9EEE: 630| 133| static GenericField from_words(const GenericPrimeOrderCurve* curve, const std::array& words) { 631| 133| return GenericField(curve, to_rep(curve, words)); 632| 133| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField6to_repEPKNS0_22GenericPrimeOrderCurveENSt3__15arrayImLm9EEE: 932| 133| static StorageUnit to_rep(const GenericPrimeOrderCurve* curve, StorageUnit x) { 933| 133| std::array z{}; 934| 133| curve->_params().mul(z, x, curve->_params().field_monty_r2()); 935| 133| return redc(curve, z); 936| 133| } _ZNK5Botan6PCurve18GenericCurveParams14field_monty_r2Ev: 165| 133| const StorageUnit& field_monty_r2() const { return m_field_monty_r2; } _ZNK5Botan6PCurve18GenericCurveParams5orderEv: 175| 1.45k| const StorageUnit& order() const { return m_order; } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField6negateEv: 772| 2.31M| GenericField negate() const { 773| 2.31M| auto x_is_zero = CT::all_zeros(this->data(), N); 774| | 775| 2.31M| StorageUnit r; 776| 2.31M| bigint_sub3(r.data(), m_curve->_params().field().data(), N, this->data(), N); 777| 2.31M| x_is_zero.if_set_zero_out(r.data(), N); 778| 2.31M| return GenericField(m_curve, r); 779| 2.31M| } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField4dataEv: 909| 10.5M| const W* data() const { return m_val.data(); } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField8from_repEPKNS0_22GenericPrimeOrderCurveENSt3__15arrayImLm9EEE: 926| 744| static StorageUnit from_rep(const GenericPrimeOrderCurve* curve, StorageUnit z) { 927| 744| std::array ze{}; 928| 744| copy_mem(std::span{ze}.template first(), z); 929| 744| return redc(curve, ze); 930| 744| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_1plERKNS1_12GenericFieldES4_: 728| 2.97M| friend GenericField operator+(const GenericField& a, const GenericField& b) { 729| 2.97M| const auto* curve = check_curve(a, b); 730| 2.97M| const size_t words = curve->_params().words(); 731| | 732| 2.97M| StorageUnit t{}; 733| 2.97M| const W carry = bigint_add3(t.data(), a.data(), words, b.data(), words); 734| | 735| 2.97M| StorageUnit r{}; 736| 2.97M| bigint_monty_maybe_sub(words, r.data(), carry, t.data(), curve->_params().field().data()); 737| 2.97M| return GenericField(curve, r); 738| 2.97M| } _ZNK5Botan6PCurve18GenericCurveParams6base_xEv: 193| 379| const StorageUnit& base_x() const { return m_base_x; } _ZNK5Botan6PCurve18GenericCurveParams6base_yEv: 195| 379| const StorageUnit& base_y() const { return m_base_y; } _ZN5Botan6PCurve18GenericAffinePoint8identityEPKNS0_22GenericPrimeOrderCurveE: 963| 13.4k| static GenericAffinePoint identity(const GenericPrimeOrderCurve* curve) { 964| 13.4k| return GenericAffinePoint(GenericField::zero(curve), GenericField::zero(curve)); 965| 13.4k| } pcurves_generic.cpp:_ZNK5Botan6PCurve18GenericAffinePoint1yEv: 1068| 458k| const GenericField& y() const { return m_y; } pcurves_generic.cpp:_ZN5Botan6PCurve18GenericAffinePoint7x3_ax_bERKNS0_12_GLOBAL__N_112GenericFieldE: 1009| 428| static GenericField x3_ax_b(const GenericField& x) { 1010| 428| return (x.square() + GenericField::curve_a(x.curve())) * x + GenericField::curve_b(x.curve()); 1011| 428| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField7curve_bEPKNS0_22GenericPrimeOrderCurveE: 647| 428| static GenericField curve_b(const GenericPrimeOrderCurve* curve) { 648| 428| return GenericField(curve, curve->_params().monty_curve_b()); 649| 428| } _ZNK5Botan6PCurve18GenericCurveParams13monty_curve_bEv: 191| 428| const StorageUnit& monty_curve_b() const { return m_monty_curve_b; } pcurves_generic.cpp:_ZNK5Botan6PCurve18GenericAffinePoint1xEv: 1063| 471k| const GenericField& x() const { return m_x; } _ZNK5Botan6PCurve18GenericAffinePoint11is_identityEv: 969| 14.8k| CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } _ZN5Botan6PCurve22GenericProjectivePoint11from_affineERKNS0_18GenericAffinePointE: 1097| 743| static Self from_affine(const GenericAffinePoint& pt) { 1098| 743| const auto x = pt.x(); 1099| 743| auto y = pt.y(); 1100| 743| auto z = GenericField::one(x.curve()); 1101| | 1102| | // If pt is identity (0,0) swap y/z to convert (0,0,1) into (0,1,0) 1103| 743| GenericField::conditional_swap(pt.is_identity(), y, z); 1104| 743| return GenericProjectivePoint(x, y, z); 1105| 743| } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericField16conditional_swapENS_2CT6ChoiceERS2_S5_: 839| 743| static void conditional_swap(CT::Choice cond, GenericField& x, GenericField& y) { 840| 743| const W mask = cond.into_bitmask(); 841| | 842| 7.43k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (842:28): [True: 6.68k, False: 743] ------------------ 843| 6.68k| const auto nx = choose(mask, y.m_val[i], x.m_val[i]); 844| 6.68k| const auto ny = choose(mask, x.m_val[i], y.m_val[i]); 845| 6.68k| x.m_val[i] = nx; 846| 6.68k| y.m_val[i] = ny; 847| 6.68k| } 848| 743| } _ZNK5Botan6PCurve18GenericAffinePoint6negateEv: 971| 4| GenericAffinePoint negate() const { return GenericAffinePoint(x(), y().negate()); } _ZNK5Botan6PCurve18GenericAffinePoint12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 976| 372| void serialize_to(std::span bytes) const { 977| 372| const size_t fe_bytes = curve()->_params().field_bytes(); 978| 372| BOTAN_ARG_CHECK(bytes.size() == 1 + 2 * fe_bytes, "Buffer size incorrect"); ------------------ | | 35| 372| do { \ | | 36| 372| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 372| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 372] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 372| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 372] | | ------------------ ------------------ 979| 372| BOTAN_STATE_CHECK(this->is_identity().as_bool() == false); ------------------ | | 51| 372| do { \ | | 52| 372| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 372| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 372] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 372| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 372] | | ------------------ ------------------ 980| 372| BufferStuffer pack(bytes); 981| 372| pack.append(0x04); 982| 372| x().serialize_to(pack.next(fe_bytes)); 983| 372| y().serialize_to(pack.next(fe_bytes)); 984| 372| BOTAN_DEBUG_ASSERT(pack.full()); ------------------ | | 137| 372| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 372| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 372] | | ------------------ ------------------ 985| 372| } pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 796| 744| void serialize_to(std::span bytes) const { 797| 744| auto v = from_rep(m_curve, m_val); 798| 744| std::reverse(v.begin(), v.end()); 799| | 800| 744| const size_t flen = m_curve->_params().field_bytes(); 801| 744| BOTAN_ARG_CHECK(bytes.size() == flen, "Expected output span provided"); ------------------ | | 35| 744| do { \ | | 36| 744| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 744| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 744] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 744| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 744] | | ------------------ ------------------ 802| | 803| | // Remove leading zero bytes 804| 744| const auto padded_bytes = store_be(v); 805| 744| const size_t extra = N * WordInfo::bytes - flen; 806| 744| copy_mem(bytes, std::span{padded_bytes}.subspan(extra, flen)); 807| 744| } _ZNK5Botan6PCurve13GenericScalar12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 521| 724| void serialize_to(std::span bytes) const { 522| 724| auto v = from_rep(m_curve, m_val); 523| 724| std::reverse(v.begin(), v.end()); 524| | 525| 724| const size_t flen = m_curve->_params().order_bytes(); 526| 724| BOTAN_ARG_CHECK(bytes.size() == flen, "Expected output span provided"); ------------------ | | 35| 724| do { \ | | 36| 724| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 724| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 724] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 724| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 724] | | ------------------ ------------------ 527| | 528| | // Remove leading zero bytes 529| 724| const auto padded_bytes = store_be(v); 530| 724| const size_t extra = N * WordInfo::bytes - flen; 531| 724| copy_mem(bytes, std::span{padded_bytes}.subspan(extra, flen)); 532| 724| } _ZN5Botan6PCurve13GenericScalar11deserializeEPKNS0_22GenericPrimeOrderCurveENSt3__14spanIKhLm18446744073709551615EEE: 316| 366| std::span bytes) { 317| 366| const size_t len = curve->_params().order_bytes(); 318| | 319| 366| if(bytes.size() != len) { ------------------ | Branch (319:13): [True: 0, False: 366] ------------------ 320| 0| return {}; 321| 0| } 322| | 323| 366| const auto words = bytes_to_words(bytes); 324| | 325| 366| if(words) { ------------------ | Branch (325:13): [True: 366, False: 0] ------------------ 326| 366| if(!bigint_ct_is_lt(words->data(), N, curve->_params().order().data(), N).as_bool()) { ------------------ | Branch (326:16): [True: 1, False: 365] ------------------ 327| 1| return {}; 328| 1| } 329| | 330| | // Safe because we checked above that words is an integer < P 331| 365| return GenericScalar(curve, to_rep(curve, *words)); 332| 366| } else { 333| 0| return {}; 334| 0| } 335| 366| } _ZN5Botan6PCurve13GenericScalar6to_repEPKNS0_22GenericPrimeOrderCurveENSt3__15arrayImLm9EEE: 583| 365| static StorageUnit to_rep(const GenericPrimeOrderCurve* curve, StorageUnit x) { 584| 365| std::array z; // NOLINT(*-member-init) 585| 365| curve->_params().mul(z, x, curve->_params().order_monty_r2()); 586| 365| return redc(curve, z); 587| 365| } _ZNK5Botan6PCurve18GenericCurveParams14order_monty_r2Ev: 181| 365| const StorageUnit& order_monty_r2() const { return m_order_monty_r2; } _ZNK5Botan6PCurve13GenericScalar10is_nonzeroEv: 536| 365| CT::Choice is_nonzero() const { return !is_zero(); } _ZN5Botan6PCurve18GenericAffinePoint24deserialize_uncompressedEPKNS0_22GenericPrimeOrderCurveENSt3__14spanIKhLm18446744073709551615EEE: 1017| 70| std::span bytes) { 1018| 70| const size_t fe_bytes = curve->_params().field_bytes(); 1019| | 1020| 70| if(bytes.size() == 1 + 2 * fe_bytes && bytes[0] == 0x04) { ------------------ | Branch (1020:13): [True: 70, False: 0] | Branch (1020:49): [True: 70, False: 0] ------------------ 1021| 70| auto x = GenericField::deserialize(curve, bytes.subspan(1, fe_bytes)); 1022| 70| auto y = GenericField::deserialize(curve, bytes.subspan(1 + fe_bytes, fe_bytes)); 1023| | 1024| 70| if(x && y) { ------------------ | Branch (1024:16): [True: 67, False: 3] | Branch (1024:21): [True: 64, False: 3] ------------------ 1025| 64| const auto lhs = (*y).square(); 1026| 64| const auto rhs = GenericAffinePoint::x3_ax_b(*x); 1027| 64| if((lhs == rhs).as_bool()) { ------------------ | Branch (1027:19): [True: 4, False: 60] ------------------ 1028| 4| return GenericAffinePoint(*x, *y); 1029| 4| } 1030| 64| } 1031| 70| } 1032| | 1033| 66| return {}; 1034| 70| } _ZNK5Botan6PCurve13GenericScalar4dataEv: 560| 8| const W* data() const { return m_val.data(); } _ZNK5Botan6PCurve13GenericScalar6negateEv: 419| 4| GenericScalar negate() const { 420| 4| auto x_is_zero = CT::all_zeros(this->data(), N); 421| | 422| 4| StorageUnit r; 423| 4| bigint_sub3(r.data(), m_curve->_params().order().data(), N, this->data(), N); 424| 4| x_is_zero.if_set_zero_out(r.data(), N); 425| 4| return GenericScalar(m_curve, r); 426| 4| } _ZNK5Botan6PCurve13GenericScalar7is_zeroEv: 534| 725| CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_curve->_params().words()).as_choice(); } _ZN5Botan6PCurve13GenericScalar3oneEPKNS0_22GenericPrimeOrderCurveE: 342| 4| static GenericScalar one(const GenericPrimeOrderCurve* curve) { 343| 4| return GenericScalar(curve, curve->_params().order_monty_r1()); 344| 4| } _ZNK5Botan6PCurve18GenericCurveParams14order_monty_r1Ev: 179| 4| const StorageUnit& order_monty_r1() const { return m_order_monty_r1; } _ZNK5Botan6PCurve13GenericScalar11stash_valueEv: 551| 368| const StorageUnit& stash_value() const { return m_val; } _ZN5Botan6PCurve13GenericScalarC2EPKNS0_22GenericPrimeOrderCurveENSt3__15arrayImLm9EEE: 555| 1.46k| GenericScalar(const GenericPrimeOrderCurve* curve, StorageUnit val) : m_curve(curve), m_val(val) {} pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField11stash_valueEv: 821| 1.83k| const StorageUnit& stash_value() const { return m_val; } pcurves_generic.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112GenericFieldC2EPKNS0_22GenericPrimeOrderCurveENSt3__15arrayImLm9EEE: 904| 17.5M| GenericField(const GenericPrimeOrderCurve* curve, StorageUnit val) : m_curve(curve), m_val(val) {} pcurves_generic.cpp:_ZN5Botan6PCurve18GenericAffinePointC2ERKNS0_12_GLOBAL__N_112GenericFieldES5_: 958| 517k| GenericAffinePoint(const GenericField& x, const GenericField& y) : m_x(x), m_y(y) {} pcurves_generic.cpp:_ZNK5Botan6PCurve22GenericProjectivePoint1yEv: 1279| 2.02M| const GenericField& y() const { return m_y; } pcurves_generic.cpp:_ZN5Botan6PCurve22GenericProjectivePointC2ERKNS0_12_GLOBAL__N_112GenericFieldES5_S5_: 1130| 517k| m_x(x), m_y(y), m_z(z) {} _ZNK5Botan6PCurve13GenericScalar9serializeITkNS_8concepts21resizable_byte_bufferENSt3__16vectorIhNS4_9allocatorIhEEEEEET_v: 515| 364| T serialize() const { 516| 364| T bytes(m_curve->_params().order_bytes()); 517| 364| this->serialize_to(bytes); 518| 364| return bytes; 519| 364| } _ZN5Botan6PCurve18GenericCurveParamsC2ERKNS_6BigIntES4_S4_S4_S4_S4_: 110| 379| m_words(p.sig_words()), 111| 379| m_order_bits(order.bits()), 112| 379| m_order_bytes(order.bytes()), 113| 379| m_field_bits(p.bits()), 114| 379| m_field_bytes(p.bytes()), 115| 379| m_monty_order(order), 116| 379| m_monty_field(p), 117| 379| m_field(bn_to_fixed(p)), 118| 379| m_field_minus_2(bn_to_fixed_rev(p - 2)), 119| 379| m_field_monty_r1(bn_to_fixed(m_monty_field.R1())), 120| 379| m_field_monty_r2(bn_to_fixed(m_monty_field.R2())), 121| 379| m_field_monty_r3(bn_to_fixed(m_monty_field.R3())), 122| 379| m_field_p_plus_1_over_4(bn_to_fixed_rev((p + 1) / 4)), 123| 379| m_field_inv_2(bn_to_fixed((p / 2) + 1)), 124| 379| m_field_p_dash(m_monty_field.p_dash()), 125| | 126| 379| m_order(bn_to_fixed(order)), 127| 379| m_order_minus_2(bn_to_fixed_rev(order - 2)), 128| 379| m_order_monty_r1(bn_to_fixed(m_monty_order.R1())), 129| 379| m_order_monty_r2(bn_to_fixed(m_monty_order.R2())), 130| 379| m_order_monty_r3(bn_to_fixed(m_monty_order.R3())), 131| 379| m_order_inv_2(bn_to_fixed((order / 2) + 1)), 132| 379| m_order_p_dash(m_monty_order.p_dash()), 133| | 134| 379| m_a_is_minus_3(a + 3 == p), 135| 379| m_a_is_zero(a.is_zero()), 136| 379| m_order_is_lt_field(order < p) { 137| 379| secure_vector ws; 138| 379| m_monty_curve_a = bn_to_fixed(m_monty_field.mul(a, m_monty_field.R2(), ws)); 139| 379| m_monty_curve_b = bn_to_fixed(m_monty_field.mul(b, m_monty_field.R2(), ws)); 140| | 141| 379| m_base_x = bn_to_fixed(m_monty_field.mul(base_x, m_monty_field.R2(), ws)); 142| 379| m_base_y = bn_to_fixed(m_monty_field.mul(base_y, m_monty_field.R2(), ws)); 143| 379| } _ZN5Botan6PCurve18GenericCurveParams11bn_to_fixedERKNS_6BigIntE: 236| 6.44k| static std::array bn_to_fixed(const BigInt& n) { 237| 6.44k| const size_t n_words = n.sig_words(); 238| 6.44k| BOTAN_ASSERT_NOMSG(n_words <= PrimeOrderCurve::StorageWords); ------------------ | | 84| 6.44k| do { \ | | 85| 6.44k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 6.44k| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 6.44k] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 6.44k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 6.44k] | | ------------------ ------------------ 239| | 240| 6.44k| std::array r{}; 241| 6.44k| copy_mem(std::span{r}.first(n_words), n._as_span().first(n_words)); 242| 6.44k| return r; 243| 6.44k| } _ZN5Botan6PCurve18GenericCurveParams15bn_to_fixed_revERKNS_6BigIntE: 245| 1.13k| static std::array bn_to_fixed_rev(const BigInt& n) { 246| 1.13k| auto v = bn_to_fixed(n); 247| 1.13k| std::reverse(v.begin(), v.end()); 248| 1.13k| return v; 249| 1.13k| } _ZN5Botan6PCurve19GenericBaseMulTableC2ERKNS0_18GenericAffinePointE: 1509| 379| m_table(basemul_booth_setup(pt, blinded_scalar_bits(*pt.curve()) + 1)) {} pcurves_generic.cpp:_ZNK5Botan6PCurve12_GLOBAL__N_112GenericField14invert_vartimeEv: 783| 379| GenericField invert_vartime() const { 784| | // TODO take advantage of variable time here using eg BEEA 785| | // see IntMod::invert_vartime in pcurves_impl.h 786| 379| return invert(); 787| 379| } _ZN5Botan6PCurve19GenericBaseMulTable19blinded_scalar_bitsERKNS0_22GenericPrimeOrderCurveE: 1519| 379| static size_t blinded_scalar_bits(const GenericPrimeOrderCurve& curve) { 1520| 379| const size_t order_bits = curve.order_bits(); 1521| 379| return order_bits + scalar_blinding_bits(order_bits); 1522| 379| } _ZN5Botan6PCurve14PCurveInstance9secp224r1Ev: 223| 333|std::shared_ptr PCurveInstance::secp224r1() { 224| 333| return PrimeOrderCurveImpl::instance(); 225| 333|} pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 69| 26.5k| constexpr static std::array one() { return std::array{1}; } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 25| 963k| constexpr static std::array redc(const std::array& z) { 26| 963k| const int64_t X00 = get_uint32(z.data(), 0); 27| 963k| const int64_t X01 = get_uint32(z.data(), 1); 28| 963k| const int64_t X02 = get_uint32(z.data(), 2); 29| 963k| const int64_t X03 = get_uint32(z.data(), 3); 30| 963k| const int64_t X04 = get_uint32(z.data(), 4); 31| 963k| const int64_t X05 = get_uint32(z.data(), 5); 32| 963k| const int64_t X06 = get_uint32(z.data(), 6); 33| 963k| const int64_t X07 = get_uint32(z.data(), 7); 34| 963k| const int64_t X08 = get_uint32(z.data(), 8); 35| 963k| const int64_t X09 = get_uint32(z.data(), 9); 36| 963k| const int64_t X10 = get_uint32(z.data(), 10); 37| 963k| const int64_t X11 = get_uint32(z.data(), 11); 38| 963k| const int64_t X12 = get_uint32(z.data(), 12); 39| 963k| const int64_t X13 = get_uint32(z.data(), 13); 40| | 41| 963k| const int64_t S0 = 0x00000001 + X00 - X07 - X11; 42| 963k| const int64_t S1 = 0x00000000 + X01 - X08 - X12; 43| 963k| const int64_t S2 = 0x00000000 + X02 - X09 - X13; 44| 963k| const int64_t S3 = 0xFFFFFFFF + X03 + X07 + X11 - X10; 45| 963k| const int64_t S4 = 0xFFFFFFFF + X04 + X08 + X12 - X11; 46| 963k| const int64_t S5 = 0xFFFFFFFF + X05 + X09 + X13 - X12; 47| 963k| const int64_t S6 = 0xFFFFFFFF + X06 + X10 - X13; 48| | 49| 963k| std::array r = {}; 50| | 51| 963k| SolinasAccum sum(r); 52| | 53| 963k| sum.accum(S0); 54| 963k| sum.accum(S1); 55| 963k| sum.accum(S2); 56| 963k| sum.accum(S3); 57| 963k| sum.accum(S4); 58| 963k| sum.accum(S5); 59| 963k| sum.accum(S6); 60| 963k| const auto S = sum.final_carry(0); 61| | 62| 963k| BOTAN_DEBUG_ASSERT(S <= 2); ------------------ | | 137| 963k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 963k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 963k] | | ------------------ ------------------ 63| | 64| 963k| solinas_correct_redc(r, P, p224_mul_mod_224(S)); 65| | 66| 963k| return r; 67| 963k| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE16p224_mul_mod_224Em: 81| 963k| constexpr static std::array p224_mul_mod_224(W i) { 82| 963k| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 83| | 84| | // For small i, multiples of P-224 have a simple structure so it's faster to 85| | // compute the value directly vs a (constant time) table lookup 86| | 87| 963k| auto r = P; 88| | 89| | if constexpr(WordInfo::bits == 32) { 90| | r[3] -= i; 91| | r[0] += i; 92| 963k| } else { 93| 963k| const W i32 = i << 32; 94| 963k| r[1] -= i32; 95| 963k| r[0] += i; 96| 963k| } 97| 963k| return r; 98| 963k| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r15Curve10fe_invert2ERKNS_6IntModINS2_12Secp224r1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 117| 323| static constexpr FieldElement fe_invert2(const FieldElement& x) { 118| 323| auto z = x.square(); 119| 323| z *= x; 120| 323| z = z.square(); 121| 323| z *= x; 122| 323| auto t0 = z; 123| 323| t0.square_n(3); 124| 323| t0 *= z; 125| 323| auto t1 = t0; 126| 323| t1.square_n(6); 127| 323| t0 *= t1; 128| 323| t0.square_n(3); 129| 323| z *= t0; 130| 323| t0 = z.square(); 131| 323| t0 *= x; 132| 323| t1 = t0; 133| 323| t1.square_n(16); 134| 323| t0 *= t1; 135| 323| t1 = t0; 136| 323| t1.square_n(15); 137| 323| z *= t1; 138| 323| t1 = z; 139| 323| t1.square_n(47); 140| 323| z *= t1; 141| 323| z = z.square(); 142| 323| z *= x; 143| 323| t1 = z; 144| 323| t1.square_n(32); 145| 323| t0 *= t1; 146| 323| t0.square_n(96); 147| 323| z *= t0; 148| 323| return z.square(); 149| 323| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 75| 875| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 71| 232| constexpr static std::array to_rep(const std::array& x) { return x; } _ZN5Botan6PCurve14PCurveInstance9secp256k1Ev: 233| 194|std::shared_ptr PCurveInstance::secp256k1() { 234| 194| return PrimeOrderCurveImpl::instance(); 235| 194|} pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 28| 8.31k| constexpr static std::array one() { return std::array{1}; } pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 30| 168k| constexpr static std::array redc(const std::array& z) { 31| 168k| return redc_crandall(std::span{z}); 32| 168k| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k15Curve10fe_invert2ERKNS_6IntModINS2_12Secp256k1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 60| 189| static constexpr FieldElement fe_invert2(const FieldElement& x) { 61| 189| auto z = x.square(); 62| 189| z *= x; 63| 189| auto t0 = z; 64| 189| t0.square_n(2); 65| 189| t0 *= z; 66| 189| auto t1 = t0.square(); 67| 189| auto t2 = t1 * x; 68| 189| t1 = t2; 69| 189| t1.square_n(2); 70| 189| t1 *= z; 71| 189| auto t3 = t1; 72| 189| t3.square_n(4); 73| 189| t0 *= t3; 74| 189| t3 = t0; 75| 189| t3.square_n(11); 76| 189| t0 *= t3; 77| 189| t3 = t0; 78| 189| t3.square_n(5); 79| 189| t2 *= t3; 80| 189| t3 = t2; 81| 189| t3.square_n(27); 82| 189| t2 *= t3; 83| 189| t3 = t2; 84| 189| t3.square_n(54); 85| 189| t2 *= t3; 86| 189| t3 = t2; 87| 189| t3.square_n(108); 88| 189| t2 *= t3; 89| 189| t2.square_n(7); 90| 189| t1 *= t2; 91| 189| t1.square_n(23); 92| 189| t0 *= t1; 93| 189| t0.square_n(5); 94| 189| t0 *= x; 95| 189| t0.square_n(3); 96| 189| z *= t0; 97| 189| z.square_n(2); 98| 189| return z; 99| 189| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 38| 379| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 34| 1| constexpr static std::array to_rep(const std::array& x) { return x; } _ZN5Botan6PCurve14PCurveInstance9secp256r1Ev: 407| 226|std::shared_ptr PCurveInstance::secp256r1() { 408| 226| return PrimeOrderCurveImpl::instance(); 409| 226|} pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE3oneEv: 138| 7.61k| constexpr static std::array one() { return R1; } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 140| 156k| constexpr static BOTAN_FORCE_INLINE std::array redc(const std::array& z) { 141| | // Scalar locals rather than a copy of z: GCC copies arrays using 16 byte 142| | // loads, which stall on the 8 byte stores that just produced z 143| 156k| W t1 = z[1]; 144| 156k| W t2 = z[2]; 145| 156k| W t3 = z[3]; 146| 156k| W t4 = z[4]; 147| 156k| W t5 = z[5]; 148| 156k| W t6 = z[6]; 149| 156k| W t7 = z[7]; 150| | 151| | // The carry out from the previous step 152| 156k| W pending = 0; 153| | 154| 156k| redc_step(z[0], t1, t2, t3, t4, pending); 155| 156k| redc_step(t1, t2, t3, t4, t5, pending); 156| 156k| redc_step(t2, t3, t4, t5, t6, pending); 157| 156k| redc_step(t3, t4, t5, t6, t7, pending); 158| | 159| 156k| return final_sub(pending, {t4, t5, t6, t7}); 160| 156k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE9redc_stepEmRmS9_S9_S9_S9_: 185| 627k| constexpr static BOTAN_FORCE_INLINE void redc_step(W m, W& t0, W& t1, W& t2, W& t3, W& pending) { 186| 627k| auto [q0, q1, q2, q3] = p256_m_p1_64(m); 187| | 188| | // q3 is at most 2^64 - 2^32, leaving room to add the carry from the 189| | // previous step without worrying about creating a new carry 190| 627k| q3 += pending; 191| | 192| 627k| W carry = 0; 193| 627k| t0 = word_add(t0, q0, &carry); 194| 627k| t1 = word_add(t1, q1, &carry); 195| 627k| t2 = word_add(t2, q2, &carry); 196| 627k| t3 = word_add(t3, q3, &carry); 197| 627k| pending = carry; 198| 627k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE12p256_m_p1_64Em: 204| 627k| constexpr static BOTAN_FORCE_INLINE std::array p256_m_p1_64(W m) { 205| 627k| const W m_lo = m << 32; 206| 627k| const W m_hi = m >> 32; 207| | 208| | /* 209| | * m*(p+1)/2^64 = m*2^32 + m*2^128 + m*2^192 - m*2^160, laid out as 210| | * 211| | * m*2^32 -> word 0 gets m << 32, word 1 gets m >> 32 212| | * m*2^128 -> word 2 gets m 213| | * m*2^192 -> word 3 gets m 214| | * -m*2^160 -> word 2 loses m << 32, word 3 loses m >> 32 plus the borrow 215| | * 216| | * The total is non-negative and below 2^256, so the final borrow is zero 217| | */ 218| 627k| W borrow = 0; 219| 627k| const W q2 = word_sub(m, m_lo, &borrow); 220| 627k| const W q3 = word_sub(m, m_hi, &borrow); 221| | 222| 627k| return {m_lo, m_hi, q2, q3}; 223| 627k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE9final_subEmRKNSt3__15arrayImLm4EEE: 228| 156k| constexpr static BOTAN_FORCE_INLINE std::array final_sub(W top, const std::array& t) { 229| 156k| W borrow = 0; 230| 156k| const W r0 = word_sub(t[0], P[0], &borrow); 231| 156k| const W r1 = word_sub(t[1], P[1], &borrow); 232| 156k| const W r2 = word_sub(t[2], P[2], &borrow); 233| 156k| const W r3 = word_sub(t[3], P[3], &borrow); 234| | 235| | // t is only < p if the subtraction underflowed and top (the 257th bit) is zero 236| 156k| const W t_lt_p = CT::value_barrier(static_cast(0) - (borrow & (top ^ 1))); 237| | 238| 156k| return { 239| 156k| choose(t_lt_p, t[0], r0), 240| 156k| choose(t_lt_p, t[1], r1), 241| 156k| choose(t_lt_p, t[2], r2), 242| 156k| choose(t_lt_p, t[3], r3), 243| 156k| }; 244| 156k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256r15Curve10fe_invert2ERKNS_6IntModINS1_22Secp256r1MontgomeryRepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 270| 173| static constexpr FieldElement fe_invert2(const FieldElement& x) { 271| | // Generated using https://github.com/mmcloughlin/addchain 272| | 273| 173| auto z = x.square(); 274| 173| z *= x; 275| 173| z = z.square(); 276| 173| z *= x; 277| 173| auto t0 = z; 278| 173| t0.square_n(3); 279| 173| t0 *= z; 280| 173| auto t1 = t0; 281| 173| t1.square_n(6); 282| 173| t0 *= t1; 283| 173| t0.square_n(3); 284| 173| z *= t0; 285| 173| t0 = z.square(); 286| 173| t0 *= x; 287| 173| t1 = t0; 288| 173| t1.square_n(16); 289| 173| t0 *= t1; 290| 173| t0.square_n(15); 291| 173| z *= t0; 292| 173| t0.square_n(17); 293| 173| t0 *= x; 294| 173| t0.square_n(143); 295| 173| t0 *= z; 296| 173| t0.square_n(47); 297| 173| z *= t0; 298| 173| z.square_n(2); 299| | 300| 173| return z; 301| 173| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 175| 347| constexpr static std::array from_rep(const std::array& z) { 176| 347| std::array ze = {}; 177| 347| copy_mem(std::span{ze}.template first(), z); 178| 347| return redc(ze); 179| 347| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 162| 1| constexpr static std::array to_rep(const std::array& x) { 163| 1| std::array z; // NOLINT(*-member-init) 164| 1| comba_mul(z.data(), x.data(), R2.data()); 165| 1| return redc(z); 166| 1| } _ZN5Botan6PCurve14PCurveInstance9secp384r1Ev: 343| 201|std::shared_ptr PCurveInstance::secp384r1() { 344| 201| return PrimeOrderCurveImpl::instance(); 345| 201|} pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE3oneEv: 88| 12.7k| constexpr static std::array one() { return std::array{1}; } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE4redcERKNSt3__15arrayImLm12EEE: 23| 257k| constexpr static std::array redc(const std::array& z) { 24| 257k| const int64_t X00 = get_uint32(z.data(), 0); 25| 257k| const int64_t X01 = get_uint32(z.data(), 1); 26| 257k| const int64_t X02 = get_uint32(z.data(), 2); 27| 257k| const int64_t X03 = get_uint32(z.data(), 3); 28| 257k| const int64_t X04 = get_uint32(z.data(), 4); 29| 257k| const int64_t X05 = get_uint32(z.data(), 5); 30| 257k| const int64_t X06 = get_uint32(z.data(), 6); 31| 257k| const int64_t X07 = get_uint32(z.data(), 7); 32| 257k| const int64_t X08 = get_uint32(z.data(), 8); 33| 257k| const int64_t X09 = get_uint32(z.data(), 9); 34| 257k| const int64_t X10 = get_uint32(z.data(), 10); 35| 257k| const int64_t X11 = get_uint32(z.data(), 11); 36| 257k| const int64_t X12 = get_uint32(z.data(), 12); 37| 257k| const int64_t X13 = get_uint32(z.data(), 13); 38| 257k| const int64_t X14 = get_uint32(z.data(), 14); 39| 257k| const int64_t X15 = get_uint32(z.data(), 15); 40| 257k| const int64_t X16 = get_uint32(z.data(), 16); 41| 257k| const int64_t X17 = get_uint32(z.data(), 17); 42| 257k| const int64_t X18 = get_uint32(z.data(), 18); 43| 257k| const int64_t X19 = get_uint32(z.data(), 19); 44| 257k| const int64_t X20 = get_uint32(z.data(), 20); 45| 257k| const int64_t X21 = get_uint32(z.data(), 21); 46| 257k| const int64_t X22 = get_uint32(z.data(), 22); 47| 257k| const int64_t X23 = get_uint32(z.data(), 23); 48| | 49| | // One copy of P-384 is added to prevent underflow 50| 257k| const int64_t S0 = 0xFFFFFFFF + X00 + X12 + X20 + X21 - X23; 51| 257k| const int64_t S1 = 0x00000000 + X01 + X13 + X22 + X23 - X12 - X20; 52| 257k| const int64_t S2 = 0x00000000 + X02 + X14 + X23 - X13 - X21; 53| 257k| const int64_t S3 = 0xFFFFFFFF + X03 + X12 + X15 + X20 + X21 - X14 - X22 - X23; 54| 257k| const int64_t S4 = 0xFFFFFFFE + X04 + X12 + X13 + X16 + X20 + X21 * 2 + X22 - X15 - X23 * 2; 55| 257k| const int64_t S5 = 0xFFFFFFFF + X05 + X13 + X14 + X17 + X21 + X22 * 2 + X23 - X16; 56| 257k| const int64_t S6 = 0xFFFFFFFF + X06 + X14 + X15 + X18 + X22 + X23 * 2 - X17; 57| 257k| const int64_t S7 = 0xFFFFFFFF + X07 + X15 + X16 + X19 + X23 - X18; 58| 257k| const int64_t S8 = 0xFFFFFFFF + X08 + X16 + X17 + X20 - X19; 59| 257k| const int64_t S9 = 0xFFFFFFFF + X09 + X17 + X18 + X21 - X20; 60| 257k| const int64_t SA = 0xFFFFFFFF + X10 + X18 + X19 + X22 - X21; 61| 257k| const int64_t SB = 0xFFFFFFFF + X11 + X19 + X20 + X23 - X22; 62| | 63| 257k| std::array r = {}; 64| | 65| 257k| SolinasAccum sum(r); 66| | 67| 257k| sum.accum(S0); 68| 257k| sum.accum(S1); 69| 257k| sum.accum(S2); 70| 257k| sum.accum(S3); 71| 257k| sum.accum(S4); 72| 257k| sum.accum(S5); 73| 257k| sum.accum(S6); 74| 257k| sum.accum(S7); 75| 257k| sum.accum(S8); 76| 257k| sum.accum(S9); 77| 257k| sum.accum(SA); 78| 257k| sum.accum(SB); 79| 257k| const auto S = sum.final_carry(0); 80| | 81| 257k| BOTAN_DEBUG_ASSERT(S <= 4); ------------------ | | 137| 257k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 257k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 257k] | | ------------------ ------------------ 82| | 83| 257k| solinas_correct_redc(r, P, p384_mul_mod_384(S)); 84| | 85| 257k| return r; 86| 257k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE16p384_mul_mod_384Em: 100| 257k| constexpr static std::array p384_mul_mod_384(W i) { 101| 257k| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 102| | 103| | // For small i, multiples of P-384 have a simple structure so it's faster to 104| | // compute the value directly vs a (constant time) table lookup 105| | 106| 257k| auto r = P; 107| | if constexpr(WordInfo::bits == 32) { 108| | r[4] -= i; 109| | r[3] -= i; 110| | r[1] += i; 111| | r[0] -= i; 112| 257k| } else { 113| 257k| const uint64_t i32 = static_cast(i) << 32; 114| 257k| r[2] -= i; 115| 257k| r[1] -= i32; 116| 257k| r[0] += i32; 117| 257k| r[0] -= i; 118| 257k| } 119| 257k| return r; 120| 257k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp384r15Curve10fe_invert2ERKNS_6IntModINS1_12Secp384r1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 142| 193| static constexpr FieldElement fe_invert2(const FieldElement& x) { 143| | // From https://briansmith.org/ecc-inversion-addition-chains-01 144| | 145| 193| FieldElement r = x.square(); 146| 193| r *= x; 147| 193| const auto x2 = r; 148| 193| r = r.square(); 149| 193| r *= x; 150| 193| const auto x3 = r; 151| 193| r.square_n(3); 152| 193| r *= x3; 153| 193| auto rl = r; 154| 193| r.square_n(6); 155| 193| r *= rl; 156| 193| r.square_n(3); 157| 193| r *= x3; 158| 193| const auto x15 = r; 159| 193| r.square_n(15); 160| 193| r *= x15; 161| 193| const auto x30 = r; 162| 193| r.square_n(30); 163| 193| r *= x30; 164| 193| rl = r; 165| 193| r.square_n(60); 166| 193| r *= rl; 167| 193| rl = r; 168| 193| r.square_n(120); 169| 193| r *= rl; 170| 193| r.square_n(15); 171| 193| r *= x15; 172| 193| r.square_n(31); 173| 193| r *= x30; 174| 193| r.square_n(2); 175| 193| r *= x2; 176| 193| r.square_n(94); 177| 193| r *= x30; 178| 193| r.square_n(2); 179| | 180| 193| return r; 181| 193| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE8from_repERKNSt3__15arrayImLm6EEE: 94| 387| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE6to_repERKNSt3__15arrayImLm6EEE: 90| 1| constexpr static std::array to_rep(const std::array& x) { return x; } _ZN5Botan6PCurve14PCurveInstance9secp521r1Ev: 291| 283|std::shared_ptr PCurveInstance::secp521r1() { 292| 283| return PrimeOrderCurveImpl::instance(); 293| 283|} pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 24| 22.0k| constexpr static std::array one() { return std::array{1}; } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm18EEE: 26| 429k| constexpr static std::array redc(const std::array& z) { 27| | // Regardless of word size (32 or 64) the top word is 9 bits long 28| 429k| constexpr W TOP_BITS = static_cast(0x1FF); 29| | // The 23 or 55 bits that should be cleared in the top word 30| 429k| constexpr W CLEARED_TOP_BITS = WordInfo::max ^ TOP_BITS; 31| | 32| | /* 33| | * Extract the high part of z (z >> 521) 34| | */ 35| 429k| std::array t; // NOLINT(*-member-init) 36| | 37| 4.29M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (37:28): [True: 3.86M, False: 429k] ------------------ 38| 3.86M| t[i] = z[(N - 1) + i] >> 9; 39| 3.86M| } 40| | 41| 3.86M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (41:28): [True: 3.43M, False: 429k] ------------------ 42| 3.43M| t[i] |= z[(N - 1) + i + 1] << (WordInfo::bits - 9); 43| 3.43M| } 44| | 45| | // Now t += z & (2**521-1) 46| 429k| W carry = 0; 47| 3.86M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (47:28): [True: 3.43M, False: 429k] ------------------ 48| 3.43M| t[i] = word_add(t[i], z[i], &carry); 49| 3.43M| } 50| | 51| | // Now add the (partial) top words; this can't carry out 52| | // since both inputs are at most 2**9-1 53| 429k| t[N - 1] += (z[N - 1] & TOP_BITS) + carry; 54| | 55| | /* 56| | Since the modulus P is exactly 2**521 - 1 the only way the computed 57| | result can be larger than P is if the top word is larger than TOP_BITS 58| | 59| | Since TOP_BITS has the low 9 bits set, we can check if t[N - 1] > TOP_BITS 60| | by checking if t[N - 1] >> 9 has any bits set. Doing it this way is 61| | faster than a standard comparison since CT::Mask::is_gt requires 62| | several bit operations. 63| | */ 64| | 65| 429k| const W is_over_p521 = ~CT::Mask::is_zero(t[N - 1] >> 9).value(); 66| | 67| | /* 68| | * Also must detect/handle x == P 69| | */ 70| 429k| const W is_eq_p521 = [&]() { 71| 429k| W sum = WordInfo::max; 72| 429k| for(size_t i = 0; i != N - 1; ++i) { 73| 429k| sum &= t[i]; 74| 429k| } 75| 429k| sum &= (CLEARED_TOP_BITS | t[N - 1]); 76| | 77| 429k| return CT::Mask::is_zero(sum ^ WordInfo::max).value(); 78| 429k| }(); 79| | 80| 429k| const W need_sub = is_over_p521 | is_eq_p521; 81| | 82| 429k| W borrow = 0; 83| 3.86M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (83:28): [True: 3.43M, False: 429k] ------------------ 84| 3.43M| t[i] = word_sub(t[i], need_sub & WordInfo::max, &borrow); 85| 3.43M| } 86| 429k| t[N - 1] = word_sub(t[N - 1], need_sub & TOP_BITS, &borrow); 87| | 88| 429k| return t; 89| 429k| } pcurves_secp521r1.cpp:_ZZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm18EEEENKUlvE_clEv: 70| 429k| const W is_eq_p521 = [&]() { 71| 429k| W sum = WordInfo::max; 72| 3.86M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (72:31): [True: 3.43M, False: 429k] ------------------ 73| 3.43M| sum &= t[i]; 74| 3.43M| } 75| 429k| sum &= (CLEARED_TOP_BITS | t[N - 1]); 76| | 77| 429k| return CT::Mask::is_zero(sum ^ WordInfo::max).value(); 78| 429k| }(); pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r15Curve10fe_invert2ERKNS_6IntModINS2_7P521RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE: 115| 250| static constexpr FieldElement fe_invert2(const FieldElement& x) { 116| | // Addition chain from https://eprint.iacr.org/2014/852.pdf page 6 117| | 118| 250| FieldElement r = x.square(); 119| 250| r *= x; 120| 250| r = r.square(); 121| 250| r *= x; 122| 250| FieldElement rl = r; 123| 250| r.square_n(3); 124| 250| r *= rl; 125| 250| r.square_n(1); 126| 250| r *= x; 127| 250| const auto a7 = r; 128| 250| r.square_n(1); 129| 250| r *= x; 130| 250| rl = r; 131| 250| r.square_n(8); 132| 250| r *= rl; 133| 250| rl = r; 134| 250| r.square_n(16); 135| 250| r *= rl; 136| 250| rl = r; 137| 250| r.square_n(32); 138| 250| r *= rl; 139| 250| rl = r; 140| 250| r.square_n(64); 141| 250| r *= rl; 142| 250| rl = r; 143| 250| r.square_n(128); 144| 250| r *= rl; 145| 250| rl = r; 146| 250| r.square_n(256); 147| 250| r *= rl; 148| 250| r.square_n(7); 149| 250| r *= a7; 150| 250| r.square_n(2); 151| | 152| 250| return r; 153| 250| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm9EEE: 95| 503| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm9EEE: 91| 154| constexpr static std::array to_rep(const std::array& x) { return x; } _ZN5Botan18Keccak_Permutation5clearEv: 37| 446|void Keccak_Permutation::clear() { 38| 446| state() = {}; 39| 446| reset_cursor(); 40| 446|} _ZN5Botan18Keccak_Permutation6absorbENSt3__14spanIKhLm18446744073709551615EEE: 42| 7.88k|void Keccak_Permutation::absorb(std::span input) { 43| 7.88k| absorb_into_sponge(*this, input); 44| 7.88k|} _ZN5Botan18Keccak_Permutation7squeezeENSt3__14spanIhLm18446744073709551615EEE: 46| 823k|void Keccak_Permutation::squeeze(std::span output) { 47| 823k| squeeze_from_sponge(*this, output); 48| 823k|} _ZN5Botan18Keccak_Permutation6finishEv: 50| 4.00k|void Keccak_Permutation::finish() { 51| | // The padding for Keccak[c]-based functions spans the entire remaining 52| | // byterate until the next permute() call. At most that could be an entire 53| | // byterate. First are a few bits of "custom" padding defined by the using 54| | // function (e.g. SHA-3 uses "01"), then the remaining space is filled with 55| | // "pad10*1" (see NIST FIPS 202 Section 5.1) followed by a final permute(). 56| | 57| 4.00k| auto& S = state(); 58| | 59| | // Apply the custom padding + the left-most 1-bit of "pad10*1" to the current 60| | // (partial) word of the sponge state 61| | 62| 4.00k| const uint64_t start_of_padding = (m_padding.padding | uint64_t(1) << m_padding.bit_len); 63| 4.00k| S[cursor() / word_bytes] ^= start_of_padding << (8 * (cursor() % word_bytes)); 64| | 65| | // XOR'ing the 0-bits of "pad10*1" into the state is a NOOP 66| | 67| | // If the custom padding + the left-most 1-bit of "pad10*1" had resulted in a 68| | // byte-aligned "partial padding", the final 1-bit of of "pad10*1" could 69| | // potentially override parts of the already-appended "start_of_padding". 70| | // In case we ever introduce a Keccak-based function with such a need, we 71| | // have to modify this padding algorithm. 72| 4.00k| BOTAN_DEBUG_ASSERT(m_padding.bit_len % 8 != 7); ------------------ | | 137| 4.00k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 4.00k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 4.00k] | | ------------------ ------------------ 73| | 74| | // Append the final bit of "pad10*1" into the last word of the input range 75| 4.00k| S[(byte_rate() / word_bytes) - 1] ^= uint64_t(0x8000000000000000); 76| | 77| | // Perform the final permutation and reset the state cursor 78| 4.00k| permute(); 79| 4.00k| reset_cursor(); 80| | 81| 4.00k| BOTAN_DEBUG_ASSERT(cursor() == 0); ------------------ | | 137| 4.00k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 4.00k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 4.00k] | | ------------------ ------------------ 82| 4.00k|} _ZN5Botan18Keccak_Permutation7permuteEv: 84| 16.6k|void Keccak_Permutation::permute() { 85| 16.6k|#if defined(BOTAN_HAS_KECCAK_PERM_AVX512) 86| 16.6k| if(CPUID::has(CPUID::Feature::AVX512)) { ------------------ | Branch (86:7): [True: 0, False: 16.6k] ------------------ 87| 0| return permute_avx512(); 88| 0| } 89| 16.6k|#endif 90| | 91| 16.6k|#if defined(BOTAN_HAS_KECCAK_PERM_BMI2) 92| 16.6k| if(CPUID::has(CPUID::Feature::BMI)) { ------------------ | Branch (92:7): [True: 16.6k, False: 0] ------------------ 93| 16.6k| return permute_bmi2(); 94| 16.6k| } 95| 0|#endif 96| | 97| 0| uint64_t T[25]; 98| | 99| 0| for(size_t i = 0; i != 24; i += 2) { ------------------ | Branch (99:22): [True: 0, False: 0] ------------------ 100| 0| Keccak_Permutation_round(T, state().data(), KECCAK_RC[i + 0]); 101| 0| Keccak_Permutation_round(state().data(), T, KECCAK_RC[i + 1]); 102| 0| } 103| 0|} _ZN5Botan18Keccak_Permutation12permute_bmi2Ev: 15| 16.6k|void BOTAN_FN_ISA_BMI2 Keccak_Permutation::permute_bmi2() { 16| 16.6k| uint64_t T[25]; 17| | 18| 216k| for(size_t i = 0; i != 24; i += 2) { ------------------ | Branch (18:22): [True: 199k, False: 16.6k] ------------------ 19| 199k| Keccak_Permutation_round(T, state().data(), KECCAK_RC[i + 0]); 20| 199k| Keccak_Permutation_round(state().data(), T, KECCAK_RC[i + 1]); 21| 199k| } 22| 16.6k|} _ZN5Botan18Ed25519_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 193| 42|Ed25519_PrivateKey::Ed25519_PrivateKey(const AlgorithmIdentifier& alg_id, std::span key_bits) { 194| | // RFC 8410 Section 3: "the parameters MUST be absent". 195| 42| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (195:7): [True: 1, False: 41] ------------------ 196| 1| throw Decoding_Error("Unexpected parameters for Ed25519 private key"); 197| 1| } 198| | 199| 41| secure_vector bits; 200| 41| BER_Decoder(key_bits, BER_Decoder::Limits::DER()).decode(bits, ASN1_Type::OctetString).verify_end(); 201| | 202| 41| if(bits.size() != 32) { ------------------ | Branch (202:7): [True: 2, False: 39] ------------------ 203| 2| throw Decoding_Error("Invalid size for Ed25519 private key"); 204| 2| } 205| 39| load_ed25519_keypair(ed25519_expand_seed(bits), m_public, m_private); 206| 39|} _ZN5Botan22Ed25519_PublicKey_DataC2ENSt3__16vectorIhNS1_9allocatorIhEEEE: 28| 38| explicit Ed25519_PublicKey_Data(std::vector key) : m_key(std::move(key)) {} ed25519_key.cpp:_ZN5Botan12_GLOBAL__N_119ed25519_expand_seedENSt3__14spanIKhLm18446744073709551615EEE: 141| 38|secure_vector ed25519_expand_seed(std::span seed) { 142| 38| BOTAN_ASSERT_NOMSG(seed.size() == 32); ------------------ | | 84| 38| do { \ | | 85| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 38| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 38] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 38| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 38] | | ------------------ ------------------ 143| | 144| 38| auto sha512 = HashFunction::create_or_throw("SHA-512"); 145| 38| const auto a = ed25519_secret_scalar(*sha512, seed); 146| | 147| 38| secure_vector sk(64); 148| 38| copy_mem(sk.data(), seed.data(), 32); 149| 38| ed25519_basepoint_mul(std::span{sk.data() + 32, 32}, a); 150| 38| return sk; 151| 38|} ed25519_key.cpp:_ZN5Botan12_GLOBAL__N_121ed25519_secret_scalarERNS_12HashFunctionENSt3__14spanIKhLm18446744073709551615EEE: 127| 38|Ed25519_Scalar ed25519_secret_scalar(HashFunction& sha512, std::span seed) { 128| 38| std::array az{}; 129| 38| sha512.update(seed); 130| 38| sha512.final(az); 131| 38| az[0] &= 248; 132| 38| az[31] &= 63; 133| 38| az[31] |= 64; 134| | 135| 38| const auto a = Ed25519_Scalar::from_bytes(std::span{az}.first<32>()); 136| 38| secure_scrub_memory(az); 137| 38| return a; 138| 38|} ed25519_key.cpp:_ZN5Botan12_GLOBAL__N_120load_ed25519_keypairENSt3__16vectorIhNS_16secure_allocatorIhEEEERNS1_10shared_ptrIKNS_22Ed25519_PublicKey_DataEEERNS6_IKNS_23Ed25519_PrivateKey_DataEEE: 116| 38| std::shared_ptr& sk_out) { 117| 38| BOTAN_ASSERT_NOMSG(expanded_key.size() == 64); ------------------ | | 84| 38| do { \ | | 85| 38| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 38| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 38] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 38| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 38] | | ------------------ ------------------ 118| 38| pk_out = std::make_shared( 119| 38| std::vector(expanded_key.begin() + 32, expanded_key.end())); 120| 38| sk_out = std::make_shared(std::move(expanded_key)); 121| 38|} _ZN5Botan23Ed25519_PrivateKey_DataC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 38| 38| explicit Ed25519_PrivateKey_Data(secure_vector key) : m_key(std::move(key)) {} _ZN5Botan21ed25519_basepoint_mulENSt3__14spanIhLm32EEERKNS_14Ed25519_ScalarE: 628| 38|void ed25519_basepoint_mul(std::span out, const Ed25519_Scalar& scalar) { 629| 38| const auto h = basepoint_mul(scalar); 630| 38| h.serialize_to(out); 631| 38| CT::unpoison(out); 632| 38|} _ZN5Botan31ed25519_basepoint_mul_to_x25519ENSt3__14spanIhLm32EEERKNS_14Ed25519_ScalarE: 634| 12|void ed25519_basepoint_mul_to_x25519(std::span out, const Ed25519_Scalar& scalar) { 635| 12| const auto h = basepoint_mul(scalar); 636| | 637| | /* 638| | * The birational map from the twisted Edwards curve to Curve25519 sends 639| | * (x, y) to u = (1 + y) / (1 - y) (RFC 7748 Section 4.1), which for a 640| | * projective point (X : Y : Z) is (Z + Y) / (Z - Y). The map sends the 641| | * Ed25519 base point to u = 9, so this is the X25519 public key for the 642| | * scalar. 643| | * 644| | * The only point with Z == Y is the identity, where the inversion of zero 645| | * returns zero and so u == 0, matching what the Montgomery ladder produces 646| | * for the identity. A clamped X25519 scalar is never zero mod l so this 647| | * cannot happen for X25519 anyway. 648| | */ 649| 12| const auto u = (h.Z + h.Y) * (h.Z - h.Y).invert(); 650| 12| u.serialize_to(out); 651| 12| CT::unpoison(out); 652| 12|} ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_113basepoint_mulERKNS_14Ed25519_ScalarE: 582| 50|Ed25519_Point_Extended basepoint_mul(const Ed25519_Scalar& scalar) { 583| 50| static const std::array, 32> B_precomp = ed25519_base_precomp(); 584| | 585| 50| const auto a = scalar.to_bytes(); 586| | 587| 50| std::array e{}; 588| | 589| 50| CT::poison(a.data(), a.size()); 590| | 591| | // each e[i] is between 0 and 15 except e[63] which is between 0 and 7 592| 1.65k| for(size_t i = 0; i != 32; ++i) { ------------------ | Branch (592:22): [True: 1.60k, False: 50] ------------------ 593| 1.60k| e[2 * i + 0] = (a[i] >> 0) & 0x0F; 594| 1.60k| e[2 * i + 1] = (a[i] >> 4) & 0x0F; 595| 1.60k| } 596| | 597| 50| int8_t carry = 0; 598| 3.20k| for(size_t i = 0; i < 63; ++i) { ------------------ | Branch (598:22): [True: 3.15k, False: 50] ------------------ 599| 3.15k| e[i] += carry; 600| 3.15k| carry = e[i] + 8; 601| 3.15k| carry >>= 4; 602| 3.15k| e[i] -= carry << 4; 603| 3.15k| } 604| 50| e[63] += carry; 605| | /* each e[i] is between -8 and 8 */ 606| | 607| 50| auto h = Ed25519_Point_Extended::identity(); 608| 1.65k| for(size_t i = 1; i < 64; i += 2) { ------------------ | Branch (608:22): [True: 1.60k, False: 50] ------------------ 609| 1.60k| h = Ed25519_Point_Extended::from(h + select(B_precomp[i / 2].data(), e[i])); 610| 1.60k| } 611| | 612| 50| auto s = Ed25519_Point_Projective::from(h.dbl()); 613| 50| s = Ed25519_Point_Projective::from(s.dbl()); 614| 50| s = Ed25519_Point_Projective::from(s.dbl()); 615| 50| h = Ed25519_Point_Extended::from(s.dbl()); 616| | 617| 1.65k| for(size_t i = 0; i != 64; i += 2) { ------------------ | Branch (617:22): [True: 1.60k, False: 50] ------------------ 618| 1.60k| h = Ed25519_Point_Extended::from(h + select(B_precomp[i / 2].data(), e[i])); 619| 1.60k| } 620| | 621| 50| CT::unpoison(a.data(), a.size()); 622| | 623| 50| return h; 624| 50|} ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_120ed25519_base_precompEv: 360| 1|std::array, 32> ed25519_base_precomp() { 361| 1| constexpr size_t PTS = 32 * 8; 362| | 363| 1| auto pts_storage = std::make_unique>(); 364| 1| auto& pts = *pts_storage; 365| | 366| 1| auto base = ed25519_basepoint(); 367| 33| for(size_t i = 0; i != 32; ++i) { ------------------ | Branch (367:22): [True: 32, False: 1] ------------------ 368| 32| pts[8 * i] = base; 369| 32| const auto base_c = Ed25519_Point_Cached::from(base); 370| 256| for(size_t j = 1; j != 8; ++j) { ------------------ | Branch (370:25): [True: 224, False: 32] ------------------ 371| 224| pts[8 * i + j] = Ed25519_Point_Extended::from(pts[8 * i + j - 1] + base_c); 372| 224| } 373| | 374| | // The next row base is 256*base; the row ends with 8*base already 375| 32| base = pts[8 * i + 7]; 376| 192| for(size_t k = 0; k != 5; ++k) { ------------------ | Branch (376:25): [True: 160, False: 32] ------------------ 377| 160| base = Ed25519_Point_Extended::from(base.dbl()); 378| 160| } 379| 32| } 380| | 381| 1| auto prod_storage = std::make_unique>(); 382| 1| auto& prod = *prod_storage; 383| | 384| 1| prod[0] = pts[0].Z; 385| 256| for(size_t i = 1; i != PTS; ++i) { ------------------ | Branch (385:22): [True: 255, False: 1] ------------------ 386| 255| prod[i] = prod[i - 1] * pts[i].Z; 387| 255| } 388| | 389| 1| auto inv = prod[PTS - 1].invert(); 390| | 391| 1| std::array, 32> table; 392| 257| for(size_t i = PTS; i-- > 0;) { ------------------ | Branch (392:24): [True: 256, False: 1] ------------------ 393| 256| const auto z_inv = (i == 0) ? inv : inv * prod[i - 1]; ------------------ | Branch (393:26): [True: 1, False: 255] ------------------ 394| 256| inv = inv * pts[i].Z; 395| | 396| 256| const auto x = pts[i].X * z_inv; 397| 256| const auto y = pts[i].Y * z_inv; 398| 256| auto& n = table[i / 8][i % 8]; 399| 256| n.yplusx = y + x; 400| 256| n.yminusx = y - x; 401| 256| n.xy2d = ED25519_D2 * (x * y); 402| 256| } 403| | 404| 1| return table; 405| 1|} ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_117ed25519_basepointEv: 351| 1|const Ed25519_Point_Extended& ed25519_basepoint() { 352| 1| static const Ed25519_Point_Extended b = ed25519_derive_basepoint(); 353| 1| return b; 354| 1|} ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_124ed25519_derive_basepointEv: 325| 1|Ed25519_Point_Extended ed25519_derive_basepoint() { 326| 1| const auto y = Ed25519_FieldElement::from_word(4) * Ed25519_FieldElement::from_word(5).invert(); 327| | 328| | // Recover x = sqrt((y^2-1)/(d*y^2+1)) as in point decoding 329| 1| const auto yy = y.sqr(); 330| 1| const auto u = yy - Ed25519_FieldElement::one(); 331| 1| const auto v = ED25519_D * yy + Ed25519_FieldElement::one(); 332| 1| const auto v3 = v.sqr() * v; 333| 1| const auto v7 = v3.sqr() * v; 334| 1| auto x = (u * v3) * (u * v7).pow_22523(); 335| | 336| 1| if(!(x.sqr() * v - u).is_zero()) { ------------------ | Branch (336:7): [True: 0, False: 1] ------------------ 337| 0| x = x * ED25519_SQRTM1; 338| 0| } 339| 1| if(x.is_negative()) { ------------------ | Branch (339:7): [True: 1, False: 0] ------------------ 340| 1| x = -x; 341| 1| } 342| | 343| 1| Ed25519_Point_Extended b; 344| 1| b.X = x; 345| 1| b.Y = y; 346| 1| b.Z = Ed25519_FieldElement::one(); 347| 1| b.T = x * y; 348| 1| return b; 349| 1|} ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_120Ed25519_Point_Cached4fromERKNS0_22Ed25519_Point_ExtendedE: 198| 32| static constexpr Ed25519_Point_Cached from(const Ed25519_Point_Extended& p) { 199| 32| Ed25519_Point_Cached r; 200| 32| r.YplusX = p.Y + p.X; 201| 32| r.YminusX = p.Y - p.X; 202| 32| r.Z = p.Z; 203| 32| r.T2d = p.T * ED25519_D2; 204| 32| return r; 205| 32| } ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_1plERKNS0_22Ed25519_Point_ExtendedERKNS0_20Ed25519_Point_CachedE: 218| 224|inline constexpr Ed25519_Point_Completed operator+(const Ed25519_Point_Extended& p, const Ed25519_Point_Cached& q) { 219| 224| Ed25519_Point_Completed r; 220| 224| r.X = p.Y + p.X; // YpX1 = Y1+X1 221| 224| r.Y = p.Y - p.X; // YmX1 = Y1-X1 222| 224| r.Z = r.X * q.YplusX; // A = YpX1*YpX2 223| 224| r.Y = r.Y * q.YminusX; // B = YmX1*YmX2 224| 224| r.T = q.T2d * p.T; // C = T2d2*T1 225| 224| r.X = p.Z * q.Z; // ZZ = Z1*Z2 226| 224| const auto t0 = r.X + r.X; // D = 2*ZZ 227| 224| r.X = r.Z - r.Y; // X3 = A-B 228| 224| r.Y = r.Z + r.Y; // Y3 = A+B 229| 224| r.Z = t0 + r.T; // Z3 = D+C 230| 224| r.T = t0 - r.T; // T3 = D-C 231| 224| return r; 232| 224|} ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_122Ed25519_Point_Extended8identityEv: 128| 50| static constexpr Ed25519_Point_Extended identity() { 129| 50| Ed25519_Point_Extended h; 130| 50| h.X = Ed25519_FieldElement::zero(); 131| 50| h.Y = Ed25519_FieldElement::one(); 132| 50| h.Z = Ed25519_FieldElement::one(); 133| 50| h.T = Ed25519_FieldElement::zero(); 134| 50| return h; 135| 50| } ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_122Ed25519_Point_Extended4fromERKNS0_23Ed25519_Point_CompletedE: 148| 3.63k| static constexpr Ed25519_Point_Extended from(const Ed25519_Point_Completed& p) { 149| 3.63k| Ed25519_Point_Extended r; 150| 3.63k| r.X = p.X * p.T; 151| 3.63k| r.Y = p.Y * p.Z; 152| 3.63k| r.Z = p.Z * p.T; 153| 3.63k| r.T = p.X * p.Y; 154| 3.63k| return r; 155| 3.63k| } ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_1plERKNS0_22Ed25519_Point_ExtendedERKNS0_19Ed25519_Point_NielsE: 237| 3.20k|inline constexpr Ed25519_Point_Completed operator+(const Ed25519_Point_Extended& p, const Ed25519_Point_Niels& q) { 238| 3.20k| Ed25519_Point_Completed r; 239| 3.20k| r.X = p.Y + p.X; // YpX1 = Y1+X1 240| 3.20k| r.Y = p.Y - p.X; // YmX1 = Y1-X1 241| 3.20k| r.Z = r.X * q.yplusx; // A = YpX1*ypx2 242| 3.20k| r.Y = r.Y * q.yminusx; // B = YmX1*ymx2 243| 3.20k| r.T = q.xy2d * p.T; // C = xy2d2*T1 244| 3.20k| const auto t0 = p.Z + p.Z; // D = 2*Z1 245| 3.20k| r.X = r.Z - r.Y; // X3 = A-B 246| 3.20k| r.Y = r.Z + r.Y; // Y3 = A+B 247| 3.20k| r.Z = t0 + r.T; // Z3 = D+C 248| 3.20k| r.T = t0 - r.T; // T3 = D-C 249| 3.20k| return r; 250| 3.20k|} ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_16selectEPKNS0_19Ed25519_Point_NielsEa: 553| 3.20k|Ed25519_Point_Niels select(const Ed25519_Point_Niels base[8], int8_t b) { 554| 3.20k| const uint8_t bnegative = static_cast(b) >> 7; 555| 3.20k| const uint8_t babs = b - ((-static_cast(bnegative) & b) * 2); 556| | 557| 3.20k| auto t = Ed25519_Point_Niels::identity(); 558| | 559| 28.8k| for(size_t i = 0; i != 8; ++i) { ------------------ | Branch (559:22): [True: 25.6k, False: 3.20k] ------------------ 560| 25.6k| const auto b_is_i1 = CT::Mask::is_equal(babs, static_cast(i + 1)).as_choice(); 561| 25.6k| t.yplusx.conditional_assign(b_is_i1, base[i].yplusx); 562| 25.6k| t.yminusx.conditional_assign(b_is_i1, base[i].yminusx); 563| 25.6k| t.xy2d.conditional_assign(b_is_i1, base[i].xy2d); 564| 25.6k| } 565| | 566| | // If negative have to swap yminusx and yplusx, and negate xy2d 567| 3.20k| const auto is_negative = CT::Mask::expand(bnegative).as_choice(); 568| 3.20k| Ed25519_FieldElement::conditional_swap(is_negative, t.yplusx, t.yminusx); 569| 3.20k| t.xy2d.conditional_assign(is_negative, -t.xy2d); 570| | 571| 3.20k| return t; 572| 3.20k|} ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_119Ed25519_Point_Niels8identityEv: 179| 3.20k| static constexpr Ed25519_Point_Niels identity() { 180| 3.20k| Ed25519_Point_Niels h; 181| 3.20k| h.yplusx = Ed25519_FieldElement::one(); 182| 3.20k| h.yminusx = Ed25519_FieldElement::one(); 183| 3.20k| h.xy2d = Ed25519_FieldElement::zero(); 184| 3.20k| return h; 185| 3.20k| } ed25519_ge.cpp:_ZN5Botan12_GLOBAL__N_124Ed25519_Point_Projective4fromERKNS0_23Ed25519_Point_CompletedE: 75| 150| static constexpr Ed25519_Point_Projective from(const Ed25519_Point_Completed& p) { 76| 150| Ed25519_Point_Projective r; 77| 150| r.X = p.X * p.T; 78| 150| r.Y = p.Y * p.Z; 79| 150| r.Z = p.Z * p.T; 80| 150| return r; 81| 150| } ed25519_ge.cpp:_ZNK5Botan12_GLOBAL__N_122Ed25519_Point_Extended3dblEv: 137| 210| constexpr Ed25519_Point_Completed dbl() const { 138| 210| Ed25519_Point_Projective q; 139| 210| q.X = X; 140| 210| q.Y = Y; 141| 210| q.Z = Z; 142| 210| return q.dbl(); 143| 210| } ed25519_ge.cpp:_ZNK5Botan12_GLOBAL__N_124Ed25519_Point_Projective3dblEv: 102| 360|constexpr Ed25519_Point_Completed Ed25519_Point_Projective::dbl() const { 103| 360| Ed25519_Point_Completed r; 104| 360| r.X = X.sqr(); // XX=X1^2 105| 360| r.Z = Y.sqr(); // YY=Y1^2 106| 360| r.T = Z.sqr2(); // B=2*Z1^2 107| 360| r.Y = X + Y; // A=X1+Y1 108| 360| const auto t0 = r.Y.sqr(); // AA=A^2 109| 360| r.Y = r.Z + r.X; // Y3=YY+XX 110| 360| r.Z = r.Z - r.X; // Z3=YY-XX 111| 360| r.X = t0 - r.Y; // X3=AA-Y3 112| 360| r.T = r.T - r.Z; // T3=B-Z3 113| 360| return r; 114| 360|} ed25519_ge.cpp:_ZNK5Botan12_GLOBAL__N_122Ed25519_Point_Extended12serialize_toENSt3__14spanIhLm32EEE: 157| 38| void serialize_to(std::span out) const { 158| 38| const auto recip = this->Z.invert(); 159| 38| const auto x = this->X * recip; 160| 38| const auto y = this->Y * recip; 161| 38| y.serialize_to(out); 162| 38| out[31] ^= x.is_negative() ? 0x80 : 0x00; ------------------ | Branch (162:21): [True: 20, False: 18] ------------------ 163| 38| } _ZN5Botan14Ed25519_Scalar10from_bytesENSt3__14spanIKhLm32EEE: 122| 50|Ed25519_Scalar Ed25519_Scalar::from_bytes(std::span b) { 123| | // x mod l == mont_mul(x, R) 124| 50| return Ed25519_Scalar(sc_mont_mul(sc_load(b), SC_R1)); 125| 50|} _ZNK5Botan14Ed25519_Scalar12serialize_toENSt3__14spanIhLm32EEE: 151| 50|void Ed25519_Scalar::serialize_to(std::span b) const { 152| 250| for(size_t i = 0; i != WORDS; ++i) { ------------------ | Branch (152:22): [True: 200, False: 50] ------------------ 153| 200| store_le(m_val[i], b.data() + sizeof(word) * i); 154| 200| } 155| 50|} ed25519_scalar.cpp:_ZN5Botan12_GLOBAL__N_111sc_mont_mulERKNSt3__15arrayImLm4EEES5_: 82| 50|std::array sc_mont_mul(const std::array& x, const std::array& y) { 83| 50| std::array z; // NOLINT(*-member-init) 84| 50| comba_mul(z.data(), x.data(), y.data()); 85| | 86| 50| std::array r; // NOLINT(*-member-init) 87| 50| std::array ws; // NOLINT(*-member-init) 88| 50| bigint_monty_redc(r.data(), z.data(), SC_L.data(), SC_WORDS, SC_L_DASH, ws.data(), ws.size()); 89| 50| return r; 90| 50|} ed25519_scalar.cpp:_ZN5Botan12_GLOBAL__N_17sc_loadENSt3__14spanIKhLm32EEE: 112| 50|std::array sc_load(std::span b) { 113| 50| std::array r; // NOLINT(*-member-init) 114| 250| for(size_t i = 0; i != SC_WORDS; ++i) { ------------------ | Branch (114:22): [True: 200, False: 50] ------------------ 115| 200| r[i] = load_le(b.data(), i); 116| 200| } 117| 50| return r; 118| 50|} _ZN5Botan17X25519_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 149| 16|X25519_PrivateKey::X25519_PrivateKey(const AlgorithmIdentifier& alg_id, std::span key_bits) { 150| | // RFC 8410 Section 3: "the parameters MUST be absent". 151| 16| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (151:7): [True: 1, False: 15] ------------------ 152| 1| throw Decoding_Error("Unexpected parameters for X25519 private key"); 153| 1| } 154| | 155| 15| secure_vector secret_key; 156| 15| BER_Decoder(key_bits, BER_Decoder::Limits::DER()).decode(secret_key, ASN1_Type::OctetString).verify_end(); 157| | 158| 15| size_check(secret_key.size(), "private key"); 159| 15| load_x25519_keypair(std::move(secret_key), m_public, m_private); 160| 15|} x25519.cpp:_ZN5Botan12_GLOBAL__N_110size_checkEmPKc: 52| 13|void size_check(size_t size, const char* thing) { 53| 13| if(size != 32) { ------------------ | Branch (53:7): [True: 1, False: 12] ------------------ 54| 1| throw Decoding_Error(fmt("Invalid size {} for X25519 {}", size, thing)); 55| 1| } 56| 13|} x25519.cpp:_ZN5Botan12_GLOBAL__N_119load_x25519_keypairENSt3__16vectorIhNS_16secure_allocatorIhEEEERNS1_10shared_ptrIKNS_21X25519_PublicKey_DataEEERNS6_IKNS_22X25519_PrivateKey_DataEEE: 86| 12| std::shared_ptr& sk_out) { 87| 12| BOTAN_ASSERT_NOMSG(secret.size() == 32); ------------------ | | 84| 12| do { \ | | 85| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 12| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 12] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 12| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 12] | | ------------------ ------------------ 88| 12| std::vector pub(32); 89| 12| x25519_basepoint(std::span(pub.data(), 32), std::span(secret.data(), 32)); 90| 12| pk_out = std::make_shared(std::move(pub)); 91| 12| sk_out = std::make_shared(std::move(secret)); 92| 12|} _ZN5Botan22X25519_PrivateKey_DataC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 34| 12| explicit X25519_PrivateKey_Data(secure_vector key) : m_key(std::move(key)) {} _ZN5Botan21X25519_PublicKey_DataC2ENSt3__16vectorIhNS1_9allocatorIhEEEE: 24| 12| explicit X25519_PublicKey_Data(std::vector key) : m_key(std::move(key)) {} _ZN5Botan16x25519_basepointENSt3__14spanIhLm32EEENS1_IKhLm32EEE: 46| 12|void x25519_basepoint(std::span out, std::span scalar) { 47| | /* 48| | * Compute the public key as [k]B on the Ed25519 curve using the fixed-base 49| | * tables, then map the result to Curve25519. This gives the same result as 50| | * running the Montgomery ladder on u = 9 since the base points correspond 51| | * under the birational map and B has order l, but is several times faster. 52| | */ 53| 12| CT::poison(scalar); 54| | 55| 12| auto k = x25519_clamp(scalar); 56| 12| const auto s = Ed25519_Scalar::from_bytes(k); 57| 12| ed25519_basepoint_mul_to_x25519(out, s); 58| 12| secure_scrub_memory(k.data(), k.size()); 59| | 60| 12| CT::unpoison(scalar); 61| 12|} x25519_scalarmult.cpp:_ZN5Botan12_GLOBAL__N_112x25519_clampENSt3__14spanIKhLm32EEE: 20| 12|std::array x25519_clamp(std::span scalar) { 21| 12| std::array k{}; 22| 12| copy_mem(k, scalar); 23| 12| k[0] &= 248; 24| 12| k[31] &= 127; 25| 12| k[31] |= 64; 26| 12| return k; 27| 12|} _ZN5Botan9Gf448ElemC2ENSt3__14spanIKhLm56EEE: 356| 2|Gf448Elem::Gf448Elem(std::span x) /* NOLINT(*-member-init) */ { 357| 2| load_le(m_x, x); 358| 2|} _ZN5Botan9Gf448ElemC2Em: 360| 40.5k|Gf448Elem::Gf448Elem(uint64_t least_sig_word) /* NOLINT(*-member-init) */ { 361| 40.5k| clear_mem(m_x); 362| 40.5k| m_x[0] = least_sig_word; 363| 40.5k|} _ZNK5Botan9Gf448Elem8to_bytesENSt3__14spanIhLm56EEE: 365| 3|void Gf448Elem::to_bytes(std::span out) const { 366| 3| store_le(out, to_canonical(m_x)); 367| 3|} _ZNK5Botan9Gf448Elem8to_bytesEv: 369| 1|std::array Gf448Elem::to_bytes() const { 370| 1| std::array bytes{}; 371| 1| to_bytes(bytes); 372| 1| return bytes; 373| 1|} _ZN5Botan9Gf448Elem12ct_cond_swapENS_2CT4MaskImEERS0_: 375| 898|void Gf448Elem::ct_cond_swap(CT::Mask mask, Gf448Elem& other) { 376| 7.18k| for(size_t i = 0; i < WORDS_448; ++i) { ------------------ | Branch (376:22): [True: 6.28k, False: 898] ------------------ 377| 6.28k| mask.conditional_swap(m_x[i], other.m_x[i]); 378| 6.28k| } 379| 898|} _ZN5Botan9Gf448Elem14ct_cond_assignENS_2CT4MaskImEERKS0_: 381| 10.0k|void Gf448Elem::ct_cond_assign(CT::Mask mask, const Gf448Elem& other) { 382| 10.0k| mask.select_n(m_x.data(), other.m_x.data(), m_x.data(), WORDS_448); 383| 10.0k|} _ZNK5Botan9Gf448ElemplERKS0_: 385| 7.50k|Gf448Elem Gf448Elem::operator+(const Gf448Elem& other) const { 386| 7.50k| Gf448Elem res(0); 387| 7.50k| gf_add(res.m_x, m_x, other.m_x); 388| 7.50k| return res; 389| 7.50k|} _ZNK5Botan9Gf448ElemmiERKS0_: 391| 8.51k|Gf448Elem Gf448Elem::operator-(const Gf448Elem& other) const { 392| 8.51k| Gf448Elem res(0); 393| 8.51k| gf_sub(res.m_x, m_x, other.m_x); 394| 8.51k| return res; 395| 8.51k|} _ZNK5Botan9Gf448ElemngEv: 397| 1.00k|Gf448Elem Gf448Elem::operator-() const { 398| 1.00k| Gf448Elem res(0); 399| 1.00k| gf_sub(res.m_x, res.m_x, m_x); 400| 1.00k| return res; 401| 1.00k|} _ZNK5Botan9Gf448ElemmlERKS0_: 403| 15.0k|Gf448Elem Gf448Elem::operator*(const Gf448Elem& other) const { 404| 15.0k| Gf448Elem res(0); 405| 15.0k| gf_mul(res.m_x, m_x, other.m_x); 406| 15.0k| return res; 407| 15.0k|} _ZNK5Botan9Gf448ElemdvERKS0_: 409| 3|Gf448Elem Gf448Elem::operator/(const Gf448Elem& other) const { 410| 3| Gf448Elem res(0); 411| 3| gf_inv(res.m_x, other.m_x); 412| 3| gf_mul(res.m_x, m_x, res.m_x); 413| 3| return res; 414| 3|} _ZNK5Botan9Gf448Elem6is_oddEv: 428| 2|bool Gf448Elem::is_odd() const { 429| 2| const auto canonical_form = to_canonical(m_x); 430| 2| return (canonical_form[0] & 1) == 1; 431| 2|} _ZN5Botan7mul_a24ERKNS_9Gf448ElemE: 439| 1.45k|Gf448Elem mul_a24(const Gf448Elem& a) { 440| 1.45k| Gf448Elem res(0); 441| 1.45k| gf_mul_a24(res.words(), a.words()); 442| 1.45k| return res; 443| 1.45k|} _ZN5Botan6squareERKNS_9Gf448ElemE: 445| 6.38k|Gf448Elem square(const Gf448Elem& elem) { 446| 6.38k| Gf448Elem res(0); 447| 6.38k| gf_square(res.words(), elem.words()); 448| 6.38k| return res; 449| 6.38k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_112to_canonicalENSt3__14spanIKmLm7EEE: 335| 5|std::array to_canonical(std::span in) { 336| 5| const std::array p = {0xffffffffffffffff, 337| 5| 0xffffffffffffffff, 338| 5| 0xffffffffffffffff, 339| 5| 0xfffffffeffffffff, 340| 5| 0xffffffffffffffff, 341| 5| 0xffffffffffffffff, 342| 5| 0xffffffffffffffff}; 343| | 344| 5| std::array in_minus_p; // NOLINT(*-member-init) 345| 5| uint64_t borrow = 0; 346| 40| for(size_t i = 0; i < WORDS_448; ++i) { ------------------ | Branch (346:22): [True: 35, False: 5] ------------------ 347| 35| in_minus_p[i] = word_sub(in[i], p[i], &borrow); 348| 35| } 349| 5| std::array out; // NOLINT(*-member-init) 350| 5| CT::Mask::expand(borrow).select_n(out.data(), in.data(), in_minus_p.data(), WORDS_448); 351| 5| return out; 352| 5|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_16gf_addENSt3__14spanImLm7EEENS2_IKmLm7EEES5_: 155| 7.50k| std::span b) { 156| 7.50k| std::array ws; // NOLINT(*-member-init) 157| | 158| 7.50k| uint64_t carry = 0; 159| 7.50k| ws[0] = word_add(a[0], b[0], &carry); 160| 7.50k| ws[1] = word_add(a[1], b[1], &carry); 161| 7.50k| ws[2] = word_add(a[2], b[2], &carry); 162| 7.50k| ws[3] = word_add(a[3], b[3], &carry); 163| 7.50k| ws[4] = word_add(a[4], b[4], &carry); 164| 7.50k| ws[5] = word_add(a[5], b[5], &carry); 165| 7.50k| ws[6] = word_add(a[6], b[6], &carry); 166| 7.50k| ws[7] = carry; 167| | 168| 7.50k| reduce_after_add(out, ws); 169| 7.50k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_116reduce_after_addENSt3__14spanImLm7EEENS2_IKmLm8EEE: 27| 31.7k|void reduce_after_add(std::span h_3, std::span h_1) { 28| 31.7k| std::array h_2; /* NOLINT(*-member-init) */ 29| 31.7k| uint64_t carry = 0; 30| | 31| 31.7k| constexpr uint64_t zero = 0; 32| | 33| | // Line 27+ (of the paper's algorithm 1) 34| 31.7k| h_2[0] = word_add(h_1[0], h_1[7], &carry); 35| 31.7k| h_2[1] = word_add(h_1[1], zero, &carry); 36| 31.7k| h_2[2] = word_add(h_1[2], zero, &carry); 37| | 38| | // Line 30 39| 31.7k| h_2[3] = word_add(h_1[3], h_1[7] << 32, &carry); 40| | 41| | // Line 31+ 42| 31.7k| h_2[4] = word_add(h_1[4], zero, &carry); 43| 31.7k| h_2[5] = word_add(h_1[5], zero, &carry); 44| 31.7k| h_2[6] = word_add(h_1[6], zero, &carry); 45| | 46| 31.7k| h_2[7] = carry; 47| | 48| 31.7k| carry = 0; 49| 31.7k| h_3[0] = word_add(h_2[0], h_2[7], &carry); 50| 31.7k| h_3[1] = word_add(h_2[1], zero, &carry); 51| 31.7k| h_3[2] = word_add(h_2[2], zero, &carry); 52| | // Line 37 53| 31.7k| h_3[3] = h_2[3] + (h_2[7] << 32) + carry; 54| | 55| | // Line 38 56| 31.7k| h_3[4] = h_2[4]; 57| 31.7k| h_3[5] = h_2[5]; 58| 31.7k| h_3[6] = h_2[6]; 59| 31.7k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_16gf_subENSt3__14spanImLm7EEENS2_IKmLm7EEES5_: 178| 9.52k| std::span b) { 179| 9.52k| std::array h_0; // NOLINT(*-member-init) 180| 9.52k| std::array h_1; // NOLINT(*-member-init) 181| | 182| 9.52k| uint64_t borrow = 0; 183| 9.52k| h_0[0] = word_sub(a[0], b[0], &borrow); 184| 9.52k| h_0[1] = word_sub(a[1], b[1], &borrow); 185| 9.52k| h_0[2] = word_sub(a[2], b[2], &borrow); 186| 9.52k| h_0[3] = word_sub(a[3], b[3], &borrow); 187| 9.52k| h_0[4] = word_sub(a[4], b[4], &borrow); 188| 9.52k| h_0[5] = word_sub(a[5], b[5], &borrow); 189| 9.52k| h_0[6] = word_sub(a[6], b[6], &borrow); 190| 9.52k| uint64_t delta = borrow; 191| 9.52k| uint64_t delta_p = delta << 32; 192| 9.52k| borrow = 0; 193| | 194| 9.52k| constexpr uint64_t zero = 0; 195| | 196| 9.52k| h_1[0] = word_sub(h_0[0], delta, &borrow); 197| 9.52k| h_1[1] = word_sub(h_0[1], zero, &borrow); 198| 9.52k| h_1[2] = word_sub(h_0[2], zero, &borrow); 199| 9.52k| h_1[3] = word_sub(h_0[3], delta_p, &borrow); 200| 9.52k| h_1[4] = word_sub(h_0[4], zero, &borrow); 201| 9.52k| h_1[5] = word_sub(h_0[5], zero, &borrow); 202| 9.52k| h_1[6] = word_sub(h_0[6], zero, &borrow); 203| | 204| 9.52k| delta = borrow; 205| 9.52k| delta_p = delta << 32; 206| 9.52k| borrow = 0; 207| | 208| 9.52k| out[0] = word_sub(h_1[0], delta, &borrow); 209| 9.52k| out[1] = word_sub(h_1[1], zero, &borrow); 210| 9.52k| out[2] = word_sub(h_1[2], zero, &borrow); 211| 9.52k| out[3] = word_sub(h_1[3], delta_p, &borrow); 212| 9.52k| out[4] = h_1[4]; 213| 9.52k| out[5] = h_1[5]; 214| 9.52k| out[6] = h_1[6]; 215| 9.52k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_16gf_mulENSt3__14spanImLm7EEENS2_IKmLm7EEES5_: 141| 15.0k| std::span b) { 142| 15.0k| std::array ws; // NOLINT(*-member-init) 143| 15.0k| comba_mul<7>(ws.data(), a.data(), b.data()); 144| 15.0k| reduce_after_mul(out, ws); 145| 15.0k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_116reduce_after_mulENSt3__14spanImLm7EEENS2_IKmLm14EEE: 66| 22.7k|void reduce_after_mul(std::span out, std::span in) { 67| 22.7k| std::array r; // NOLINT(*-member-init) 68| 22.7k| std::array s; // NOLINT(*-member-init) 69| 22.7k| std::array t_0; // NOLINT(*-member-init) 70| 22.7k| std::array h_1; // NOLINT(*-member-init) 71| | 72| 22.7k| uint64_t carry = 0; 73| | 74| | // Line 4 (of the paper's algorithm 1) 75| 22.7k| r[0] = word_add(in[0], in[7], &carry); 76| | 77| | // Line 5-7 78| 22.7k| r[1] = word_add(in[1], in[1 + 7], &carry); 79| 22.7k| r[2] = word_add(in[2], in[2 + 7], &carry); 80| 22.7k| r[3] = word_add(in[3], in[3 + 7], &carry); 81| 22.7k| r[4] = word_add(in[4], in[4 + 7], &carry); 82| 22.7k| r[5] = word_add(in[5], in[5 + 7], &carry); 83| 22.7k| r[6] = word_add(in[6], in[6 + 7], &carry); 84| 22.7k| r[7] = carry; 85| 22.7k| s[0] = r[0]; 86| 22.7k| s[1] = r[1]; 87| 22.7k| s[2] = r[2]; 88| | // Line 10 89| 22.7k| carry = 0; 90| 22.7k| s[3] = word_add(r[3], in[10] & 0xFFFFFFFF00000000, &carry); 91| | // Line 11-13 92| 22.7k| s[4] = word_add(r[4], in[4 + 7], &carry); 93| 22.7k| s[5] = word_add(r[5], in[5 + 7], &carry); 94| 22.7k| s[6] = word_add(r[6], in[6 + 7], &carry); 95| 22.7k| s[7] = r[7] + carry; 96| | 97| | // Line 15-17 98| 22.7k| t_0[0] = (in[0 + 11] << 32) | (in[0 + 10] >> 32); 99| 22.7k| t_0[1] = (in[1 + 11] << 32) | (in[1 + 10] >> 32); 100| 22.7k| t_0[2] = (in[2 + 11] << 32) | (in[2 + 10] >> 32); 101| | // Line 18 102| 22.7k| t_0[3] = (in[7] << 32) | (in[13] >> 32); 103| | // Line 19-21 104| 22.7k| t_0[4] = (in[4 + 4] << 32) | (in[4 + 3] >> 32); 105| 22.7k| t_0[5] = (in[5 + 4] << 32) | (in[5 + 3] >> 32); 106| 22.7k| t_0[6] = (in[6 + 4] << 32) | (in[6 + 3] >> 32); 107| 22.7k| carry = 0; 108| | // Line 23-25 109| 22.7k| h_1[0] = word_add(s[0], t_0[0], &carry); 110| 22.7k| h_1[1] = word_add(s[1], t_0[1], &carry); 111| 22.7k| h_1[2] = word_add(s[2], t_0[2], &carry); 112| 22.7k| h_1[3] = word_add(s[3], t_0[3], &carry); 113| 22.7k| h_1[4] = word_add(s[4], t_0[4], &carry); 114| 22.7k| h_1[5] = word_add(s[5], t_0[5], &carry); 115| 22.7k| h_1[6] = word_add(s[6], t_0[6], &carry); 116| 22.7k| h_1[7] = s[7] + carry; 117| | 118| 22.7k| reduce_after_add(out, h_1); 119| 22.7k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_16gf_invENSt3__14spanImLm7EEENS2_IKmLm7EEE: 316| 3|void gf_inv(std::span out, std::span a) { 317| 3| std::array x222; // NOLINT(*-member-init) 318| 3| std::array x223; // NOLINT(*-member-init) 319| 3| gf_pow_2_222m1(x222, x223, a); 320| | 321| | // (x223 << 223 + x222) << 2 + 1 322| 3| std::array t; // NOLINT(*-member-init) 323| 3| gf_sqr_n(t, x223, 223); 324| 3| gf_mul(t, t, x222); 325| 3| gf_sqr_n(t, t, 2); 326| 3| gf_mul(out, t, a); 327| 3|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_110gf_mul_a24ENSt3__14spanImLm7EEENS2_IKmLm7EEE: 124| 1.45k|void gf_mul_a24(std::span out, std::span a) { 125| 1.45k| constexpr uint64_t A24 = 39081; 126| 1.45k| std::array ws; // NOLINT(*-member-init) 127| 1.45k| uint64_t carry = 0; 128| 1.45k| ws[0] = word_madd2(a[0], A24, &carry); 129| 1.45k| ws[1] = word_madd2(a[1], A24, &carry); 130| 1.45k| ws[2] = word_madd2(a[2], A24, &carry); 131| 1.45k| ws[3] = word_madd2(a[3], A24, &carry); 132| 1.45k| ws[4] = word_madd2(a[4], A24, &carry); 133| 1.45k| ws[5] = word_madd2(a[5], A24, &carry); 134| 1.45k| ws[6] = word_madd2(a[6], A24, &carry); 135| 1.45k| ws[7] = carry; 136| 1.45k| reduce_after_add(out, ws); 137| 1.45k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_19gf_squareENSt3__14spanImLm7EEENS2_IKmLm7EEE: 147| 7.72k|void gf_square(std::span out, std::span a) { 148| 7.72k| std::array ws; // NOLINT(*-member-init) 149| 7.72k| comba_sqr<7>(ws.data(), a.data()); 150| 7.72k| reduce_after_mul(out, ws); 151| 7.72k|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_114gf_pow_2_222m1ENSt3__14spanImLm7EEES3_NS2_IKmLm7EEE: 245| 3| std::span a) { 246| 3| std::array t; // NOLINT(*-member-init) 247| | 248| | // _10 = a^2 249| 3| std::array a2; // NOLINT(*-member-init) 250| 3| gf_square(a2, a); 251| | 252| | // _11 = a^3 253| 3| std::array a3; // NOLINT(*-member-init) 254| 3| gf_mul(a3, a, a2); 255| | 256| | // _111 = a^7 257| 3| std::array a7; // NOLINT(*-member-init) 258| 3| gf_square(t, a3); 259| 3| gf_mul(a7, a, t); 260| | 261| | // _111111 = a^63 262| 3| std::array a63; // NOLINT(*-member-init) 263| 3| gf_sqr_n(t, a7, 3); 264| 3| gf_mul(a63, a7, t); 265| | 266| | // x12 = a^(2^12 - 1) 267| 3| std::array x12; // NOLINT(*-member-init) 268| 3| gf_sqr_n(t, a63, 6); 269| 3| gf_mul(x12, a63, t); 270| | 271| | // x24 = a^(2^24 - 1) 272| 3| std::array x24; // NOLINT(*-member-init) 273| 3| gf_sqr_n(t, x12, 12); 274| 3| gf_mul(x24, x12, t); 275| | 276| | // i34 = x24 << 6 = a^((2^24 - 1) * 2^6) 277| 3| std::array i34; // NOLINT(*-member-init) 278| 3| gf_sqr_n(i34, x24, 6); 279| | 280| | // x30 = a^(2^30 - 1) 281| 3| std::array x30; // NOLINT(*-member-init) 282| 3| gf_mul(x30, a63, i34); 283| | 284| | // x48 = a^(2^48 - 1) 285| 3| std::array x48; // NOLINT(*-member-init) 286| 3| gf_sqr_n(t, i34, 18); 287| 3| gf_mul(x48, x24, t); 288| | 289| | // x96 = a^(2^96 - 1) 290| 3| std::array x96; // NOLINT(*-member-init) 291| 3| gf_sqr_n(t, x48, 48); 292| 3| gf_mul(x96, x48, t); 293| | 294| | // x192 = a^(2^192 - 1) 295| 3| std::array x192; // NOLINT(*-member-init) 296| 3| gf_sqr_n(t, x96, 96); 297| 3| gf_mul(x192, x96, t); 298| | 299| | // x222 = a^(2^222 - 1) 300| 3| gf_sqr_n(t, x192, 30); 301| 3| gf_mul(x222, x30, t); 302| | 303| | // x223 = a^(2^223 - 1) 304| 3| gf_square(t, x222); 305| 3| gf_mul(x223, a, t); 306| 3|} curve448_gf.cpp:_ZN5Botan12_GLOBAL__N_18gf_sqr_nENSt3__14spanImLm7EEENS2_IKmLm7EEEm: 218| 30|void gf_sqr_n(std::span out, std::span a, size_t n) { 219| 30| gf_square(out, a); 220| 1.33k| for(size_t i = 1; i < n; ++i) { ------------------ | Branch (220:22): [True: 1.30k, False: 30] ------------------ 221| 1.30k| gf_square(out, out); 222| 1.30k| } 223| 30|} _ZN5Botan9Scalar448C2ENSt3__14spanIKhLm18446744073709551615EEE: 148| 2|Scalar448::Scalar448(std::span in_bytes) { 149| 2| BOTAN_ARG_CHECK(in_bytes.size() <= 114, "Input must be at most 114 bytes long"); ------------------ | | 35| 2| do { \ | | 36| 2| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 2| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 2] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 2| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 2] | | ------------------ ------------------ 150| 2| std::array max_bytes = {0}; 151| 2| copy_mem(std::span(max_bytes).first(in_bytes.size()), in_bytes); 152| | 153| 2| const auto x_words = bytes_to_words(std::span(max_bytes)); 154| 2| m_scalar_words = ct_reduce_mod_L(x_words); 155| 2|} _ZNK5Botan9Scalar44810get_windowEmm: 163| 224|uint32_t Scalar448::get_window(size_t starting_pos, size_t width) const { 164| 224| BOTAN_ARG_CHECK(width <= 32, "Window too wide"); ------------------ | | 35| 224| do { \ | | 36| 224| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 224| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 224] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 224| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 224] | | ------------------ ------------------ 165| 224| constexpr size_t word_sz = sizeof(word) * 8; 166| | 167| | // Bits at or beyond position 446 are zero 168| 224| if(starting_pos >= 446) { ------------------ | Branch (168:7): [True: 0, False: 224] ------------------ 169| 0| return 0; 170| 0| } 171| | 172| | // Clamp the effective width so we don't read past bit 445 173| 224| const size_t effective_bits = std::min(width, size_t(446) - starting_pos); 174| | 175| 224| const size_t word_idx = starting_pos / word_sz; 176| 224| const size_t bit_idx = starting_pos % word_sz; 177| | 178| 224| const uint64_t mask = (effective_bits >= 64) ? ~uint64_t(0) : (uint64_t(1) << effective_bits) - 1; ------------------ | Branch (178:26): [True: 0, False: 224] ------------------ 179| | 180| 224| uint64_t val = m_scalar_words[word_idx] >> bit_idx; 181| 224| if(bit_idx + effective_bits > word_sz && word_idx + 1 < WORDS) { ------------------ | Branch (181:7): [True: 0, False: 224] | Branch (181:45): [True: 0, False: 0] ------------------ 182| 0| val |= m_scalar_words[word_idx + 1] << (word_sz - bit_idx); 183| 0| } 184| | 185| 224| return static_cast(val & mask); 186| 224|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_115ct_reduce_mod_LENSt3__15arrayImLm15EEE: 113| 2|std::array ct_reduce_mod_L(const std::array x) { 114| 2| const auto [q_0, r_0] = div_mod_2_446(std::span(x)); 115| | 116| 2| auto r = r_0; 117| | // Three iterations are required. This is tested using the biggest possible input. 118| | // i = 0: 119| 2| const auto q_0_c = mul_c(std::span(q_0)); 120| 2| const auto [q_1, r_1] = div_mod_2_446(std::span(q_0_c)); 121| 2| r = add(r, r_1); 122| | 123| | // i = 1 124| 2| const auto q_1_c = mul_c(std::span(q_1)); 125| 2| const auto [q_2, r_2] = div_mod_2_446(std::span(q_1_c)); 126| 2| r = add(r, r_2); 127| | 128| | // i = 2 129| 2| const auto q_2_c = mul_c(std::span(q_2)); 130| 2| const auto [q_3, r_3] = div_mod_2_446(std::span(q_2_c)); 131| 2| r = add(r, r_3); 132| | 133| 2| BOTAN_ASSERT_NOMSG(CT::all_zeros(q_3.data(), q_3.size()).as_bool()); ------------------ | | 84| 2| do { \ | | 85| 2| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 2| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 2] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 2| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 2] | | ------------------ ------------------ 134| | 135| | // Note that r is maximal 4*(2^446 - 1) < 2^448. Therefore, the addition did not overflow. 136| | // Also, this means that subtracting L 4 times (at most) will bring r into the range [0, L), since 137| | // 4*(2^446 - 1) - 4*(2^446 - c) = 4*(c - 1) < L. 138| 10| for(size_t i = 0; i < 4; ++i) { ------------------ | Branch (138:22): [True: 8, False: 2] ------------------ 139| 8| ct_subtract_L_if_bigger(r); 140| 8| } 141| | 142| 2| return r; 143| 2|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_113div_mod_2_446ILm15EEEDaNSt3__14spanIKmXT_EEE: 21| 2|auto div_mod_2_446(std::span x) { 22| | if constexpr(S < Scalar448::WORDS) { 23| | std::array r = {0}; 24| | copy_mem(std::span(r).template first(), x); 25| | return std::make_pair(std::array({0}), r); 26| 2| } else { 27| 2| std::array r; // NOLINT(*-member-init) 28| 2| copy_mem(r, std::span(x).template first()); 29| | // Clear the two most significant bits 30| 2| r[Scalar448::WORDS - 1] &= ~(word(0b11) << (sizeof(word) * 8 - 2)); 31| | 32| 2| std::array q; // NOLINT(*-member-init) 33| 2| bigint_shr2(q.data(), q.size(), x.data(), x.size(), 446); 34| | 35| 2| return std::make_pair(q, r); 36| 2| } 37| 2|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_15mul_cILm9EEENSt3__15arrayImXplT_L_ZNS0_7WORDS_CEEEEENS2_4spanIKmXT_EEE: 58| 2|std::array mul_c(std::span x) { 59| 2| std::array res; // NOLINT(*-member-init) 60| 2| std::array ws; // NOLINT(*-member-init) 61| 2| constexpr std::array c = c_words(); 62| 2| bigint_mul(res.data(), res.size(), x.data(), x.size(), x.size(), c.data(), c.size(), c.size(), ws.data(), ws.size()); 63| | 64| 2| return res; 65| 2|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_113div_mod_2_446ILm13EEEDaNSt3__14spanIKmXT_EEE: 21| 2|auto div_mod_2_446(std::span x) { 22| | if constexpr(S < Scalar448::WORDS) { 23| | std::array r = {0}; 24| | copy_mem(std::span(r).template first(), x); 25| | return std::make_pair(std::array({0}), r); 26| 2| } else { 27| 2| std::array r; // NOLINT(*-member-init) 28| 2| copy_mem(r, std::span(x).template first()); 29| | // Clear the two most significant bits 30| 2| r[Scalar448::WORDS - 1] &= ~(word(0b11) << (sizeof(word) * 8 - 2)); 31| | 32| 2| std::array q; // NOLINT(*-member-init) 33| 2| bigint_shr2(q.data(), q.size(), x.data(), x.size(), 446); 34| | 35| 2| return std::make_pair(q, r); 36| 2| } 37| 2|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_15mul_cILm7EEENSt3__15arrayImXplT_L_ZNS0_7WORDS_CEEEEENS2_4spanIKmXT_EEE: 58| 2|std::array mul_c(std::span x) { 59| 2| std::array res; // NOLINT(*-member-init) 60| 2| std::array ws; // NOLINT(*-member-init) 61| 2| constexpr std::array c = c_words(); 62| 2| bigint_mul(res.data(), res.size(), x.data(), x.size(), x.size(), c.data(), c.size(), c.size(), ws.data(), ws.size()); 63| | 64| 2| return res; 65| 2|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_113div_mod_2_446ILm11EEEDaNSt3__14spanIKmXT_EEE: 21| 2|auto div_mod_2_446(std::span x) { 22| | if constexpr(S < Scalar448::WORDS) { 23| | std::array r = {0}; 24| | copy_mem(std::span(r).template first(), x); 25| | return std::make_pair(std::array({0}), r); 26| 2| } else { 27| 2| std::array r; // NOLINT(*-member-init) 28| 2| copy_mem(r, std::span(x).template first()); 29| | // Clear the two most significant bits 30| 2| r[Scalar448::WORDS - 1] &= ~(word(0b11) << (sizeof(word) * 8 - 2)); 31| | 32| 2| std::array q; // NOLINT(*-member-init) 33| 2| bigint_shr2(q.data(), q.size(), x.data(), x.size(), 446); 34| | 35| 2| return std::make_pair(q, r); 36| 2| } 37| 2|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_15mul_cILm5EEENSt3__15arrayImXplT_L_ZNS0_7WORDS_CEEEEENS2_4spanIKmXT_EEE: 58| 2|std::array mul_c(std::span x) { 59| 2| std::array res; // NOLINT(*-member-init) 60| 2| std::array ws; // NOLINT(*-member-init) 61| 2| constexpr std::array c = c_words(); 62| 2| bigint_mul(res.data(), res.size(), x.data(), x.size(), x.size(), c.data(), c.size(), c.size(), ws.data(), ws.size()); 63| | 64| 2| return res; 65| 2|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_113div_mod_2_446ILm9EEEDaNSt3__14spanIKmXT_EEE: 21| 2|auto div_mod_2_446(std::span x) { 22| | if constexpr(S < Scalar448::WORDS) { 23| | std::array r = {0}; 24| | copy_mem(std::span(r).template first(), x); 25| | return std::make_pair(std::array({0}), r); 26| 2| } else { 27| 2| std::array r; // NOLINT(*-member-init) 28| 2| copy_mem(r, std::span(x).template first()); 29| | // Clear the two most significant bits 30| 2| r[Scalar448::WORDS - 1] &= ~(word(0b11) << (sizeof(word) * 8 - 2)); 31| | 32| 2| std::array q; // NOLINT(*-member-init) 33| 2| bigint_shr2(q.data(), q.size(), x.data(), x.size(), 446); 34| | 35| 2| return std::make_pair(q, r); 36| 2| } 37| 2|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_13addENSt3__14spanIKmLm7EEES4_: 71| 6| std::span y) { 72| 6| std::array res; // NOLINT(*-member-init) 73| 6| copy_mem(res, x); 74| 6| const word carry = bigint_add2(res.data(), res.size(), y.data(), y.size()); 75| 6| CT::unpoison(carry); 76| 6| BOTAN_ASSERT(carry == 0, "Result fits in output"); ------------------ | | 71| 6| do { \ | | 72| 6| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 6| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 6] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 6| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 6] | | ------------------ ------------------ 77| 6| return res; 78| 6|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_123ct_subtract_L_if_biggerENSt3__14spanImLm7EEE: 85| 8|CT::Choice ct_subtract_L_if_bigger(std::span x) { 86| 8| std::array tmp; // NOLINT(*-member-init) 87| 8| copy_mem(tmp, x); 88| 8| constexpr auto big_l = big_l_words(); 89| | 90| 8| const word borrow = bigint_sub2(tmp.data(), tmp.size(), big_l.data(), big_l.size()); 91| 8| const auto smaller_than_L = CT::Mask::expand(borrow); 92| 8| smaller_than_L.select_n(x.data(), x.data(), tmp.data(), Scalar448::WORDS); 93| | 94| 8| return !smaller_than_L.as_choice(); 95| 8|} curve448_scalar.cpp:_ZN5Botan12_GLOBAL__N_114bytes_to_wordsILm114EEENSt3__15arrayImXclL_ZNS_14words_for_bitsEmEmlT_Li8EEEEENS2_4spanIKhXT_EEE: 98| 2|std::array bytes_to_words(std::span x) { 99| 2| constexpr size_t words = words_for_bits(S * 8); 100| 2| std::array x_word_bytes{}; 101| 2| copy_mem(std::span(x_word_bytes).template first(), x); 102| 2| return load_le>(x_word_bytes); 103| 2|} _ZN5Botan16Ed448_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 94| 5|Ed448_PrivateKey::Ed448_PrivateKey(const AlgorithmIdentifier& alg_id, std::span key_bits) { 95| | // RFC 8410 Section 3: "the parameters MUST be absent". 96| 5| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (96:7): [True: 1, False: 4] ------------------ 97| 1| throw Decoding_Error("Unexpected parameters for Ed448 private key"); 98| 1| } 99| | 100| 4| secure_vector bits; 101| 4| BER_Decoder(key_bits, BER_Decoder::Limits::DER()).decode(bits, ASN1_Type::OctetString).verify_end(); 102| | 103| 4| if(bits.size() != ED448_LEN) { ------------------ | Branch (103:7): [True: 1, False: 3] ------------------ 104| 1| throw Decoding_Error("Invalid size for Ed448 private key"); 105| 1| } 106| 3| const auto pub = create_pk_from_sk(std::span(bits).first()); 107| 3| m_public = std::make_shared(pub); 108| 3| m_private = std::make_shared(std::move(bits)); 109| 3|} _ZN5Botan20Ed448_PublicKey_DataC2ENSt3__15arrayIhLm57EEE: 27| 2| explicit Ed448_PublicKey_Data(std::array key) : m_key(key) {} _ZN5Botan21Ed448_PrivateKey_DataC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 37| 2| explicit Ed448_PrivateKey_Data(secure_vector key) : m_key(std::move(key)) {} _ZN5Botan10Ed448Point10base_pointEv: 122| 1|Ed448Point Ed448Point::base_point() { 123| 1| constexpr std::array x = {0x2626a82bc70cc05e, 124| 1| 0x433b80e18b00938e, 125| 1| 0x12ae1af72ab66511, 126| 1| 0xea6de324a3d3a464, 127| 1| 0x9e146570470f1767, 128| 1| 0x221d15a622bf36da, 129| 1| 0x4f1970c66bed0ded}; 130| 1| constexpr std::array y = {0x9808795bf230fa14, 131| 1| 0xfdbd132c4ed7c8ad, 132| 1| 0x3ad3ff1ce67c39c4, 133| 1| 0x87789c1e05a0c2d7, 134| 1| 0x4bea73736ca39840, 135| 1| 0x8876203756c9c762, 136| 1| 0x693f46716eb6bc24}; 137| 1| return Ed448Point(Gf448Elem(x), Gf448Elem(y)); 138| 1|} _ZNK5Botan10Ed448Point6encodeEv: 140| 2|std::array Ed448Point::encode() const { 141| 2| std::array res_buf = {0}; 142| | 143| | // A single inversion of Z yields both affine coordinates 144| 2| const auto z_inv = Gf448Elem::one() / m_z; 145| 2| const auto x = m_x * z_inv; 146| 2| const auto y = m_y * z_inv; 147| | 148| | // RFC 8032 5.2.2 149| | // All values are coded as octet strings, and integers are coded using 150| | // little-endian convention. [...] 151| | // First, encode the y-coordinate as a little-endian string of 57 octets. 152| | // The final octet is always zero. 153| 2| y.to_bytes(std::span(res_buf).first<56>()); 154| | 155| | // To form the encoding of the point, copy the least significant bit of 156| | // the x-coordinate to the most significant bit of the final octet. 157| 2| res_buf.back() = (static_cast(x.is_odd()) << 7); 158| | 159| 2| return res_buf; 160| 2|} _ZNK5Botan10Ed448PointplERKS0_: 162| 1.00k|Ed448Point Ed448Point::operator+(const Ed448Point& other) const { 163| | // RFC 8032 5.2.4. - Point Addition (Add) 164| 1.00k| const Gf448Elem A = m_z * other.m_z; 165| 1.00k| const Gf448Elem B = square(A); 166| 1.00k| const Gf448Elem C = m_x * other.m_x; 167| 1.00k| const Gf448Elem D = m_y * other.m_y; 168| 1.00k| const Gf448Elem E = -mul_a24(C * D); 169| 1.00k| const Gf448Elem F = B - E; 170| 1.00k| const Gf448Elem G = B + E; 171| 1.00k| const Gf448Elem H = (m_x + m_y) * (other.m_x + other.m_y); 172| 1.00k| const Gf448Elem X3 = A * F * (H - C - D); 173| 1.00k| const Gf448Elem Y3 = A * G * (D - C); 174| 1.00k| const Gf448Elem Z3 = F * G; 175| | 176| 1.00k| return Ed448Point(X3, Y3, Z3); 177| 1.00k|} _ZNK5Botan10Ed448Point12double_pointEv: 179| 896|Ed448Point Ed448Point::double_point() const { 180| | // RFC 8032 5.2.4. - Point Addition (Double) 181| 896| const Gf448Elem B = square(m_x + m_y); 182| 896| const Gf448Elem C = square(m_x); 183| 896| const Gf448Elem D = square(m_y); 184| 896| const Gf448Elem E = C + D; 185| 896| const Gf448Elem H = square(m_z); 186| 896| const Gf448Elem J = E - (H + H); 187| 896| const Gf448Elem X3 = (B - E) * J; 188| 896| const Gf448Elem Y3 = E * (C - D); 189| 896| const Gf448Elem Z3 = E * J; 190| | 191| 896| return Ed448Point(X3, Y3, Z3); 192| 896|} _ZN5Botan10Ed448Point14base_point_mulERKNS_9Scalar448E: 247| 2|Ed448Point Ed448Point::base_point_mul(const Scalar448& scalar) { 248| | /* 249| | Fixed base point multiplication 250| | 251| | Same idea as base point multiply used in pcurves 252| | */ 253| 2| constexpr size_t W = 4; 254| 2| constexpr size_t WindowElements = (1 << W) - 1; // 15 255| 2| constexpr size_t Windows = (448 + W - 1) / W; // 112 256| 2| constexpr size_t TableSize = Windows * WindowElements; // 1680 257| | 258| 2| static const auto table = []() { 259| 2| std::vector tbl(TableSize, Ed448Point::identity()); 260| | 261| 2| auto accum = Ed448Point::base_point(); 262| | 263| 2| for(size_t i = 0; i < TableSize; i += WindowElements) { 264| 2| tbl[i] = accum; 265| | 266| 2| for(size_t j = 1; j < WindowElements; ++j) { 267| 2| if(j % 2 == 1) { 268| 2| tbl[i + j] = tbl[i + j / 2].double_point(); 269| 2| } else { 270| 2| tbl[i + j] = tbl[i + j - 1] + tbl[i]; 271| 2| } 272| 2| } 273| | 274| 2| accum = tbl[i + (WindowElements / 2)].double_point(); 275| 2| } 276| | 277| 2| return tbl; 278| 2| }(); 279| | 280| 2| auto res = Ed448Point::identity(); 281| | 282| 226| for(size_t i = 0; i != Windows; ++i) { ------------------ | Branch (282:22): [True: 224, False: 2] ------------------ 283| 224| const uint8_t w = static_cast(scalar.get_window(i * W, W)); 284| | 285| | // Constant-time table lookup from this window's 15-entry subtable 286| 224| auto selected = Ed448Point::identity(); 287| 3.58k| for(size_t j = 0; j != WindowElements; ++j) { ------------------ | Branch (287:25): [True: 3.36k, False: 224] ------------------ 288| 3.36k| const auto assign = CT::Mask::is_equal(j + 1, w); 289| 3.36k| selected.ct_conditional_assign(assign, table[i * WindowElements + j]); 290| 3.36k| } 291| | 292| 224| res = res + selected; 293| 224| } 294| | 295| 2| return res; 296| 2|} _ZN5Botan10Ed448Point21ct_conditional_assignENS_2CT4MaskImEERKS0_: 364| 3.36k|void Ed448Point::ct_conditional_assign(CT::Mask mask, const Ed448Point& other) { 365| 3.36k| m_x.ct_cond_assign(mask, other.m_x); 366| 3.36k| m_y.ct_cond_assign(mask, other.m_y); 367| 3.36k| m_z.ct_cond_assign(mask, other.m_z); 368| 3.36k|} _ZN5Botan17create_pk_from_skENSt3__14spanIKhLm57EEE: 374| 2|std::array create_pk_from_sk(std::span sk) { 375| | // 5.2.5. Key Generation 376| | // The 57-byte public key is generated by the following steps: 377| 2| auto shake_xof = XOF::create_or_throw("SHAKE-256"); 378| 2| shake_xof->update(sk); 379| | 380| 2| const Scalar448 s = scalar_from_xof(*shake_xof); 381| | // 3. Interpret the buffer as the little-endian integer, forming a 382| | // secret scalar s. Perform a known-base-point scalar 383| | // multiplication [s]B. 384| 2| return Ed448Point::base_point_mul(s).encode(); 385| 2|} ed448_internal.cpp:_ZZN5Botan10Ed448Point14base_point_mulERKNS_9Scalar448EENK3$_0clEv: 258| 1| static const auto table = []() { 259| 1| std::vector tbl(TableSize, Ed448Point::identity()); 260| | 261| 1| auto accum = Ed448Point::base_point(); 262| | 263| 113| for(size_t i = 0; i < TableSize; i += WindowElements) { ------------------ | Branch (263:25): [True: 112, False: 1] ------------------ 264| 112| tbl[i] = accum; 265| | 266| 1.68k| for(size_t j = 1; j < WindowElements; ++j) { ------------------ | Branch (266:28): [True: 1.56k, False: 112] ------------------ 267| 1.56k| if(j % 2 == 1) { ------------------ | Branch (267:16): [True: 784, False: 784] ------------------ 268| 784| tbl[i + j] = tbl[i + j / 2].double_point(); 269| 784| } else { 270| 784| tbl[i + j] = tbl[i + j - 1] + tbl[i]; 271| 784| } 272| 1.56k| } 273| | 274| 112| accum = tbl[i + (WindowElements / 2)].double_point(); 275| 112| } 276| | 277| 1| return tbl; 278| 1| }(); ed448_internal.cpp:_ZN5Botan12_GLOBAL__N_115scalar_from_xofERNS_3XOFE: 53| 2|Scalar448 scalar_from_xof(XOF& shake_xof) { 54| | // 5.2.5. Key Generation 55| | // The 57-byte public key is generated by the following steps: 56| | // 1. Hash the 57-byte private key using SHAKE256(x, 114), storing the 57| | // digest in a 114-octet large buffer, denoted h. Only the lower 57 58| | // bytes are used for generating the public key. 59| 2| std::array raw_s{}; 60| 2| shake_xof.output(raw_s); 61| | // 2. Prune the buffer: The two least significant bits of the first 62| | // octet are cleared, all eight bits the last octet are cleared, and 63| | // the highest bit of the second to last octet is set. 64| 2| raw_s[0] &= 0xFC; 65| 2| raw_s[55] |= 0x80; 66| 2| raw_s[56] = 0; 67| | 68| 2| return Scalar448(raw_s); 69| 2|} _ZN5Botan15X448_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 127| 4| X448_PrivateKey(ber_decode_sk(key_bits)) { 128| | // RFC 8410 Section 3: "the parameters MUST be absent". 129| 4| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (129:7): [True: 0, False: 4] ------------------ 130| 0| throw Decoding_Error("Unexpected parameters for X448 private key"); 131| 0| } 132| 4|} _ZN5Botan15X448_PrivateKeyC1ENSt3__14spanIKhLm18446744073709551615EEE: 134| 1|X448_PrivateKey::X448_PrivateKey(std::span secret_key) { 135| 1| if(secret_key.size() != X448_LEN) { ------------------ | Branch (135:7): [True: 0, False: 1] ------------------ 136| 0| throw Decoding_Error("Invalid size for X448 private key"); 137| 0| } 138| 1| load_x448_keypair(secure_vector(secret_key.begin(), secret_key.end()), m_public, m_private); 139| 1|} x448.cpp:_ZN5Botan12_GLOBAL__N_113ber_decode_skENSt3__14spanIKhLm18446744073709551615EEE: 54| 4|secure_vector ber_decode_sk(std::span key_bits) { 55| 4| secure_vector decoded_bits; 56| 4| BER_Decoder(key_bits, BER_Decoder::Limits::DER()).decode(decoded_bits, ASN1_Type::OctetString).verify_end(); 57| 4| if(decoded_bits.size() != X448_LEN) { ------------------ | Branch (57:7): [True: 2, False: 2] ------------------ 58| 2| throw Decoding_Error("Invalid size for X448 private key"); 59| 2| } 60| 2| return decoded_bits; 61| 4|} x448.cpp:_ZN5Botan12_GLOBAL__N_117load_x448_keypairENSt3__16vectorIhNS_16secure_allocatorIhEEEERNS1_10shared_ptrIKNS_19X448_PublicKey_DataEEERNS6_IKNS_20X448_PrivateKey_DataEEE: 67| 1| std::shared_ptr& sk_out) { 68| 1| BOTAN_ASSERT_NOMSG(secret.size() == X448_LEN); ------------------ | | 84| 1| do { \ | | 85| 1| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 1| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 1] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 1| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 1] | | ------------------ ------------------ 69| 1| std::array pub{}; 70| 1| { 71| 1| const auto scope = CT::scoped_poison(secret); 72| 1| x448_basepoint_from_data(pub, std::span(secret).first()); 73| 1| CT::unpoison(pub); 74| 1| } 75| 1| pk_out = std::make_shared(pub); 76| 1| sk_out = std::make_shared(std::move(secret)); 77| 1|} _ZN5Botan20X448_PrivateKey_DataC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE: 34| 1| explicit X448_PrivateKey_Data(secure_vector key) : m_key(std::move(key)) {} x448.cpp:_ZN5Botan12_GLOBAL__N_124x448_basepoint_from_dataENSt3__14spanIhLm56EEENS2_IKhLm56EEE: 48| 1|void x448_basepoint_from_data(std::span mypublic, std::span secret) { 49| 1| const auto bp = x448_basepoint(decode_scalar(secret)); 50| 1| const auto bp_bytes = encode_point(bp); 51| 1| copy_mem(mypublic, bp_bytes); 52| 1|} _ZN5Botan19X448_PublicKey_DataC2ENSt3__15arrayIhLm56EEE: 24| 1| explicit X448_PublicKey_Data(std::array key) : m_key(key) {} _ZN5Botan12encode_pointERKNS_6StrongINSt3__15arrayIhLm56EEENS_9Point448_EJEEE: 21| 1|secure_vector encode_point(const Point448& p) { 22| 1| return {p.begin(), p.end()}; 23| 1|} _ZN5Botan13decode_scalarENSt3__14spanIKhLm18446744073709551615EEE: 30| 1|ScalarX448 decode_scalar(std::span scalar_bytes) { 31| 1| BOTAN_ARG_CHECK(scalar_bytes.size() == X448_LEN, "Invalid size for X448 scalar"); ------------------ | | 35| 1| do { \ | | 36| 1| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1] | | ------------------ ------------------ 32| 1| auto buf = typecast_copy(scalar_bytes); 33| | 34| 1| buf[0] &= 0xfc; 35| 1| buf[55] |= 0x80; 36| | 37| 1| return buf; 38| 1|} _ZN5Botan14x448_basepointERKNS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEE: 41| 1|Point448 x448_basepoint(const ScalarX448& k) { 42| 1| const Point448 u({5}); 43| 1| return x448(k, u); 44| 1|} _ZN5Botan4x448ERKNS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEERKNS0_IS3_NS_9Point448_EJEEE: 48| 1|Point448 x448(const ScalarX448& k, const Point448& u) { 49| 1| const Gf448Elem x_1 = Gf448Elem(u.get()); 50| 1| Gf448Elem x_2 = Gf448Elem::one(); 51| 1| Gf448Elem z_2 = Gf448Elem::zero(); 52| 1| Gf448Elem x_3 = Gf448Elem(u.get()); 53| 1| Gf448Elem z_3 = Gf448Elem::one(); 54| 1| auto swap = CT::Mask::cleared(); 55| | 56| 449| for(int16_t t = 448 - 1; t >= 0; --t) { ------------------ | Branch (56:29): [True: 448, False: 1] ------------------ 57| 448| const auto k_t = CT::Mask::expand(get_bit(k, t)); 58| 448| swap ^= k_t; 59| | 60| 448| x_2.ct_cond_swap(swap, x_3); 61| 448| z_2.ct_cond_swap(swap, z_3); 62| 448| swap = k_t; 63| | 64| 448| const auto A = x_2 + z_2; 65| 448| const auto AA = square(A); 66| 448| const auto B = x_2 - z_2; 67| 448| const auto BB = square(B); 68| 448| const auto E = AA - BB; 69| 448| const auto C = x_3 + z_3; 70| 448| const auto D = x_3 - z_3; 71| 448| const auto DA = D * A; 72| 448| const auto CB = C * B; 73| 448| x_3 = square(DA + CB); 74| 448| z_3 = x_1 * square(DA - CB); 75| 448| x_2 = AA * BB; 76| 448| z_2 = E * (AA + mul_a24(E)); 77| 448| } 78| | 79| 1| x_2.ct_cond_swap(swap, x_3); 80| 1| z_2.ct_cond_swap(swap, z_3); 81| | 82| 1| const auto res = x_2 / z_2; 83| | 84| 1| return Point448(res.to_bytes()); 85| 1|} x448_internal.cpp:_ZN5Botan12_GLOBAL__N_17get_bitERKNS_6StrongINSt3__15arrayIhLm56EEENS_11ScalarX448_EJEEEm: 16| 448|uint64_t get_bit(const ScalarX448& scalar, size_t bit) { 17| 448| return (scalar[bit / 8] >> (bit % 8)) & 1; 18| 448|} _ZN5Botan13DH_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 71| 199|DH_PrivateKey::DH_PrivateKey(const AlgorithmIdentifier& alg_id, std::span key_bits) { 72| 199| m_private_key = std::make_shared(alg_id, key_bits, DL_Group_Format::ANSI_X9_42); 73| 199| m_public_key = m_private_key->public_key(); 74| 199|} _ZN5Botan13DilithiumModeC2ERKNS_3OIDE: 78| 77|DilithiumMode::DilithiumMode(const OID& oid) : m_mode(dilithium_mode_from_oid(oid)) {} _ZNK5Botan13DilithiumMode6is_aesEv: 111| 298|bool DilithiumMode::is_aes() const { 112| 298| return m_mode == Dilithium4x4_AES || m_mode == Dilithium6x5_AES || m_mode == Dilithium8x7_AES; ------------------ | Branch (112:11): [True: 0, False: 298] | Branch (112:41): [True: 0, False: 298] | Branch (112:71): [True: 0, False: 298] ------------------ 113| 298|} _ZNK5Botan13DilithiumMode9is_modernEv: 115| 149|bool DilithiumMode::is_modern() const { 116| 149| return !is_aes(); 117| 149|} _ZNK5Botan13DilithiumMode9is_ml_dsaEv: 119| 596|bool DilithiumMode::is_ml_dsa() const { 120| 596| return m_mode == ML_DSA_4x4 || m_mode == ML_DSA_6x5 || m_mode == ML_DSA_8x7; ------------------ | Branch (120:11): [True: 104, False: 492] | Branch (120:35): [True: 312, False: 180] | Branch (120:59): [True: 180, False: 0] ------------------ 121| 596|} _ZN5Botan20Dilithium_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 486| 77| Dilithium_PrivateKey(sk, DilithiumMode(alg_id.oid())) { 487| | // The parameter set is identified by the OID; no parameters are defined. 488| 77| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (488:7): [True: 1, False: 76] ------------------ 489| 1| throw Decoding_Error("Unexpected parameters for ML-DSA/Dilithium private key"); 490| 1| } 491| 77|} _ZN5Botan20Dilithium_PrivateKeyC1ENSt3__14spanIKhLm18446744073709551615EEENS_13DilithiumModeE: 493| 77|Dilithium_PrivateKey::Dilithium_PrivateKey(std::span sk, DilithiumMode m) { 494| 77| DilithiumConstants mode(m); 495| 77| const auto& codec = mode.keypair_codec(); 496| 77| std::tie(m_public, m_private) = codec.decode_keypair(sk, std::move(mode)); 497| 77|} dilithium.cpp:_ZN5Botan12_GLOBAL__N_123dilithium_mode_from_oidERKNS_3OIDE: 68| 77|DilithiumMode::Mode dilithium_mode_from_oid(const OID& oid) { 69| 77| if(const auto name = oid.registered_name()) { ------------------ | Branch (69:18): [True: 77, False: 0] ------------------ 70| 77| return dilithium_mode_from_string(*name); 71| 77| } 72| | 73| 0| throw Invalid_Argument(fmt("OID '{}' is not registered as a Dilithium/ML-DSA mode", oid)); 74| 77|} dilithium.cpp:_ZN5Botan12_GLOBAL__N_126dilithium_mode_from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 36| 77|DilithiumMode::Mode dilithium_mode_from_string(std::string_view str) { 37| 77| if(str == "Dilithium-4x4-r3") { ------------------ | Branch (37:7): [True: 0, False: 77] ------------------ 38| 0| return DilithiumMode::Dilithium4x4; 39| 0| } 40| 77| if(str == "Dilithium-4x4-AES-r3") { ------------------ | Branch (40:7): [True: 0, False: 77] ------------------ 41| 0| return DilithiumMode::Dilithium4x4_AES; 42| 0| } 43| 77| if(str == "Dilithium-6x5-r3") { ------------------ | Branch (43:7): [True: 0, False: 77] ------------------ 44| 0| return DilithiumMode::Dilithium6x5; 45| 0| } 46| 77| if(str == "Dilithium-6x5-AES-r3") { ------------------ | Branch (46:7): [True: 0, False: 77] ------------------ 47| 0| return DilithiumMode::Dilithium6x5_AES; 48| 0| } 49| 77| if(str == "Dilithium-8x7-r3") { ------------------ | Branch (49:7): [True: 0, False: 77] ------------------ 50| 0| return DilithiumMode::Dilithium8x7; 51| 0| } 52| 77| if(str == "Dilithium-8x7-AES-r3") { ------------------ | Branch (52:7): [True: 0, False: 77] ------------------ 53| 0| return DilithiumMode::Dilithium8x7_AES; 54| 0| } 55| 77| if(str == "ML-DSA-4x4") { ------------------ | Branch (55:7): [True: 14, False: 63] ------------------ 56| 14| return DilithiumMode::ML_DSA_4x4; 57| 14| } 58| 63| if(str == "ML-DSA-6x5") { ------------------ | Branch (58:7): [True: 40, False: 23] ------------------ 59| 40| return DilithiumMode::ML_DSA_6x5; 60| 40| } 61| 23| if(str == "ML-DSA-8x7") { ------------------ | Branch (61:7): [True: 23, False: 0] ------------------ 62| 23| return DilithiumMode::ML_DSA_8x7; 63| 23| } 64| | 65| 0| throw Invalid_Argument(fmt("'{}' is not a valid Dilithium mode name", str)); 66| 23|} _ZN5Botan15Dilithium_Algos17encode_public_keyENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEERKNS_8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNSC_6DomainE0EEERKNS_18DilithiumConstantsE: 332| 72| const DilithiumConstants& mode) { 333| 72| DilithiumSerializedPublicKey pk(mode.public_key_bytes()); 334| 72| BufferStuffer stuffer(pk); 335| | 336| 72| stuffer.append(rho); 337| 452| for(const auto& p : t1) { ------------------ | Branch (337:22): [True: 452, False: 72] ------------------ 338| 452| poly_pack_t1(p, stuffer); 339| 452| } 340| | 341| 72| BOTAN_ASSERT_NOMSG(stuffer.full()); ------------------ | | 84| 72| do { \ | | 85| 72| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 72| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 72] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 72| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 72] | | ------------------ ------------------ 342| 72| return pk; 343| 72|} _ZN5Botan15Dilithium_Algos14expand_keypairENS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24DilithiumSeedRandomness_EJEEENS_18DilithiumConstantsE: 668| 77|DilithiumInternalKeypair expand_keypair(DilithiumSeedRandomness xi, DilithiumConstants mode) { 669| 77| if(xi.size() != DilithiumConstants::SEED_RANDOMNESS_BYTES) { ------------------ | Branch (669:7): [True: 5, False: 72] ------------------ 670| 5| throw Decoding_Error("Invalid ML-DSA seed size"); 671| 5| } 672| 72| const auto& sympriv = mode.symmetric_primitives(); 673| 72| CT::poison(xi); 674| | 675| 72| auto [rho, rhoprime, K] = sympriv.H(xi); 676| 72| CT::unpoison(rho); // rho is public (seed for the public matrix A) 677| | 678| 72| const auto A = Dilithium_Algos::expand_A(rho, mode); 679| 72| auto [s1, s2] = Dilithium_Algos::expand_s(rhoprime, mode); 680| 72| auto [t1, t0] = Dilithium_Algos::compute_t1_and_t0(A, s1, s2); 681| | 682| 72| CT::unpoison(t1); // part of the public key 683| | 684| 72| DilithiumInternalKeypair keypair{ 685| 72| std::make_shared(mode, std::move(rho), std::move(t1)), 686| 72| std::make_shared( 687| 72| std::move(mode), std::move(xi), std::move(K), std::move(s1), std::move(s2), std::move(t0)), 688| 72| }; 689| | 690| 72| CT::unpoison(*keypair.second); 691| | 692| 72| return keypair; 693| 77|} _ZN5Botan15Dilithium_Algos8expand_AENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEERKNS_18DilithiumConstantsE: 701| 72|DilithiumPolyMatNTT expand_A(StrongSpan rho, const DilithiumConstants& mode) { 702| 72| DilithiumPolyMatNTT A(mode.k(), mode.l()); 703| 524| for(uint8_t r = 0; r < mode.k(); ++r) { ------------------ | Branch (703:23): [True: 452, False: 72] ------------------ 704| 3.01k| for(uint8_t s = 0; s < mode.l(); ++s) { ------------------ | Branch (704:26): [True: 2.56k, False: 452] ------------------ 705| 2.56k| sample_ntt_uniform(rho, A[r][s], load_le(std::array{s, r}), mode); 706| 2.56k| } 707| 452| } 708| 72| return A; 709| 72|} _ZN5Botan15Dilithium_Algos8expand_sENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_22DilithiumSeedRhoPrime_EJEEEEERKNS_18DilithiumConstantsE: 715| 72| const DilithiumConstants& mode) { 716| 72| auto result = std::make_pair(DilithiumPolyVec(mode.l()), DilithiumPolyVec(mode.k())); 717| 72| auto& [s1, s2] = result; 718| | 719| 72| uint16_t nonce = 0; 720| 392| for(auto& p : s1) { ------------------ | Branch (720:16): [True: 392, False: 72] ------------------ 721| 392| sample_uniform_eta(rhoprime, p, nonce++, mode); 722| 392| } 723| | 724| 452| for(auto& p : s2) { ------------------ | Branch (724:16): [True: 452, False: 72] ------------------ 725| 452| sample_uniform_eta(rhoprime, p, nonce++, mode); 726| 452| } 727| | 728| 72| return result; 729| 72|} _ZN5Botan15Dilithium_Algos11power2roundERKNS_8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS1_6DomainE0EEE: 752| 72|std::pair power2round(const DilithiumPolyVec& vec) { 753| | // This procedure is taken verbatim from Dilithium's reference implementation. 754| 72| const auto power2round = [d = DilithiumConstants::D](int32_t r) -> std::pair { 755| 72| const int32_t r1 = (r + (1 << (d - 1)) - 1) >> d; 756| 72| const int32_t r0 = r - (r1 << d); 757| 72| return {r1, r0}; 758| 72| }; 759| | 760| 72| auto result = std::make_pair(DilithiumPolyVec(vec.size()), DilithiumPolyVec(vec.size())); 761| | 762| 524| for(size_t i = 0; i < vec.size(); ++i) { ------------------ | Branch (762:22): [True: 452, False: 72] ------------------ 763| 116k| for(size_t j = 0; j < vec[i].size(); ++j) { ------------------ | Branch (763:25): [True: 115k, False: 452] ------------------ 764| 115k| std::tie(result.first[i][j], result.second[i][j]) = power2round(vec[i][j]); 765| 115k| } 766| 452| } 767| | 768| 72| return result; 769| 72|} dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_112poly_pack_t1ERKNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS2_6DomainE0EEERNS_13BufferStufferE: 102| 452|void poly_pack_t1(const DilithiumPoly& p, BufferStuffer& stuffer) { 103| 452| constexpr auto b = (1 << (bitlen(DilithiumConstants::Q - 1) - DilithiumConstants::D)) - 1; 104| 452| poly_pack<0, b>(p, stuffer); 105| 452|} dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_19poly_packILi0ELi1023ETkNS_8CRYSTALS14crystals_traitENS_19DilithiumPolyTraitsELNS3_6DomainE0EEEvRKNS3_10PolynomialIT1_XT2_EEERNS_13BufferStufferE: 60| 452|constexpr void poly_pack(const CRYSTALS::Polynomial& p, BufferStuffer& stuffer) { 61| 452| if constexpr(a == 0) { 62| | // If `a` is 0, we assume SimpleBitPack (Algorithm 16) where the 63| | // coefficients are in the range [0, b]. 64| 452| CRYSTALS::pack(p, stuffer); 65| | } else { 66| | // Otherwise, for BitPack (Algorithm 17), we must map the coefficients to 67| | // positive values as they are in the range [-a, b]. 68| | CRYSTALS::pack(p, stuffer, map_range); 69| | } 70| 452|} dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_117compute_t1_and_t0ERKNS_8CRYSTALS16PolynomialMatrixINS_19DilithiumPolyTraitsEEERKNS2_16PolynomialVectorIS4_LNS2_6DomainE0EEESC_: 315| 72| const DilithiumPolyVec& s2) { 316| 72| auto t_hat = A * ntt(s1.clone()); 317| 72| t_hat.reduce(); 318| 72| auto t = inverse_ntt(std::move(t_hat)); 319| 72| t += s2; 320| 72| t.conditional_add_q(); 321| | 322| 72| return Dilithium_Algos::power2round(t); 323| 72|} dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_118sample_ntt_uniformENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEERNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNSD_6DomainE1EEEtRKNS_18DilithiumConstantsE: 563| 2.56k| const DilithiumConstants& mode) { 564| | /** 565| | * A generator that returns the next coefficient sampled from the XOF, 566| | * according to: NIST FIPS 204, Algorithm 14 (CoeffFromThreeBytes). 567| | */ 568| 2.56k| auto xof = mode.symmetric_primitives().H(rho, nonce); 569| 2.56k| auto bounded_xof = Bounded_XOF(*xof); 570| | 571| 656k| for(auto& coeff : p) { ------------------ | Branch (571:20): [True: 656k, False: 2.56k] ------------------ 572| 656k| coeff = 573| 656k| bounded_xof.next<3>([](const auto bytes) { return make_uint32(0, bytes[2], bytes[1], bytes[0]) & 0x7FFFFF; }, 574| 656k| [](const uint32_t z) { return z < DilithiumConstants::Q; }); 575| 656k| } 576| | 577| 2.56k| BOTAN_DEBUG_ASSERT(p.ct_validate_value_range(0, DilithiumConstants::Q - 1)); ------------------ | | 137| 2.56k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 2.56k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 2.56k] | | ------------------ ------------------ 578| 2.56k|} dilithium_algos.cpp:_ZZN5Botan15Dilithium_Algos12_GLOBAL__N_118sample_ntt_uniformENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEERNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNSD_6DomainE1EEEtRKNS_18DilithiumConstantsEENK3$_0clINS4_5arrayIhLm3EEEEEDaT_: 573| 657k| bounded_xof.next<3>([](const auto bytes) { return make_uint32(0, bytes[2], bytes[1], bytes[0]) & 0x7FFFFF; }, dilithium_algos.cpp:_ZZN5Botan15Dilithium_Algos12_GLOBAL__N_118sample_ntt_uniformENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS_20DilithiumPublicSeed_EJEEEEERNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNSD_6DomainE1EEEtRKNS_18DilithiumConstantsEENK3$_1clEj: 574| 657k| [](const uint32_t z) { return z < DilithiumConstants::Q; }); dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_118sample_uniform_etaENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_22DilithiumSeedRhoPrime_EJEEEEERNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNSD_6DomainE0EEEtRKNS_18DilithiumConstantsE: 641| 844| const DilithiumConstants& mode) { 642| 844| using Eta = DilithiumConstants::DilithiumEta; 643| | 644| 844| auto xof = mode.symmetric_primitives().H(rhoprime, nonce); 645| 844| switch(mode.eta()) { ------------------ | Branch (645:11): [True: 844, False: 0] ------------------ 646| 426| case Eta::_2: ------------------ | Branch (646:7): [True: 426, False: 418] ------------------ 647| 426| sample_uniform_eta(p, *xof); 648| 426| break; 649| 418| case Eta::_4: ------------------ | Branch (649:7): [True: 418, False: 426] ------------------ 650| 418| sample_uniform_eta(p, *xof); 651| 418| break; 652| 844| } 653| | 654| | // Rejection sampling is done. Secret polynomial can be repoisoned. 655| 844| CT::poison(p); 656| | 657| 844| BOTAN_DEBUG_ASSERT(p.ct_validate_value_range(-static_cast(mode.eta()), mode.eta())); ------------------ | | 137| 844| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 844| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 844] | | ------------------ ------------------ 658| 844|} dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_118sample_uniform_etaILNS_18DilithiumConstants12DilithiumEtaE2EEEvRNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS5_6DomainE0EEERNS_3XOFE: 604| 426|void sample_uniform_eta(DilithiumPoly& p, Botan::XOF& xof) { 605| | // A generator that returns the next coefficient sampled from the XOF. As the 606| | // sampling uses half-bytes, this keeps track of the additionally sampled 607| | // coefficient as needed. 608| 426| auto next_coeff = [bounded_xof = Bounded_XOF(xof), 609| 426| stashed_coeff = std::optional{}]() mutable -> int32_t { 610| 426| if(auto stashed = std::exchange(stashed_coeff, std::nullopt)) { 611| 426| return *stashed; 612| 426| } 613| | 614| 426| BOTAN_DEBUG_ASSERT(!stashed_coeff.has_value()); 615| 426| while(true) { 616| 426| const auto b = bounded_xof.next_byte(); 617| 426| const auto z0 = coeff_from_halfbyte(b & 0x0F); 618| 426| const auto z1 = coeff_from_halfbyte(b >> 4); 619| | 620| 426| if(z0.has_value()) { 621| 426| stashed_coeff = z1; // keep candidate z1 for the next invocation 622| 426| return *z0; 623| 426| } else if(z1.has_value()) { 624| | // z0 was invalid, z1 is valid, nothing to stash 625| 426| return *z1; 626| 426| } 627| 426| } 628| 426| }; 629| | 630| 109k| for(auto& coeff : p) { ------------------ | Branch (630:20): [True: 109k, False: 426] ------------------ 631| 109k| coeff = next_coeff(); 632| 109k| } 633| 426|} dilithium_algos.cpp:_ZZN5Botan15Dilithium_Algos12_GLOBAL__N_118sample_uniform_etaILNS_18DilithiumConstants12DilithiumEtaE2EEEvRNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS5_6DomainE0EEERNS_3XOFEENUlvE_clEv: 609| 109k| stashed_coeff = std::optional{}]() mutable -> int32_t { 610| 109k| if(auto stashed = std::exchange(stashed_coeff, std::nullopt)) { ------------------ | Branch (610:15): [True: 51.1k, False: 57.9k] ------------------ 611| 51.1k| return *stashed; 612| 51.1k| } 613| | 614| 57.9k| BOTAN_DEBUG_ASSERT(!stashed_coeff.has_value()); ------------------ | | 137| 57.9k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 57.9k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 57.9k] | | ------------------ ------------------ 615| 58.1k| while(true) { ------------------ | Branch (615:13): [True: 58.1k, Folded] ------------------ 616| 58.1k| const auto b = bounded_xof.next_byte(); 617| 58.1k| const auto z0 = coeff_from_halfbyte(b & 0x0F); 618| 58.1k| const auto z1 = coeff_from_halfbyte(b >> 4); 619| | 620| 58.1k| if(z0.has_value()) { ------------------ | Branch (620:13): [True: 54.6k, False: 3.50k] ------------------ 621| 54.6k| stashed_coeff = z1; // keep candidate z1 for the next invocation 622| 54.6k| return *z0; 623| 54.6k| } else if(z1.has_value()) { ------------------ | Branch (623:20): [True: 3.31k, False: 192] ------------------ 624| | // z0 was invalid, z1 is valid, nothing to stash 625| 3.31k| return *z1; 626| 3.31k| } 627| 58.1k| } 628| 57.9k| }; dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_119coeff_from_halfbyteILNS_18DilithiumConstants12DilithiumEtaE2EEENSt3__18optionalIiEEh: 586| 116k|std::optional coeff_from_halfbyte(uint8_t b) { 587| 116k| BOTAN_DEBUG_ASSERT(b < 16); ------------------ | | 137| 116k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 116k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 116k] | | ------------------ ------------------ 588| | 589| 116k| if constexpr(eta == DilithiumConstants::DilithiumEta::_2) { 590| 116k| if(CT::driveby_unpoison(b < 15)) { ------------------ | Branch (590:10): [True: 109k, False: 7.04k] ------------------ 591| 109k| b = b - (205U * b >> 10) * 5; // b = b mod 5 592| 109k| return 2 - b; 593| 109k| } 594| | } else if constexpr(eta == DilithiumConstants::DilithiumEta::_4) { 595| | if(CT::driveby_unpoison(b < 9)) { 596| | return 4 - b; 597| | } 598| | } 599| | 600| 7.04k| return std::nullopt; 601| 116k|} dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_118sample_uniform_etaILNS_18DilithiumConstants12DilithiumEtaE4EEEvRNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS5_6DomainE0EEERNS_3XOFE: 604| 418|void sample_uniform_eta(DilithiumPoly& p, Botan::XOF& xof) { 605| | // A generator that returns the next coefficient sampled from the XOF. As the 606| | // sampling uses half-bytes, this keeps track of the additionally sampled 607| | // coefficient as needed. 608| 418| auto next_coeff = [bounded_xof = Bounded_XOF(xof), 609| 418| stashed_coeff = std::optional{}]() mutable -> int32_t { 610| 418| if(auto stashed = std::exchange(stashed_coeff, std::nullopt)) { 611| 418| return *stashed; 612| 418| } 613| | 614| 418| BOTAN_DEBUG_ASSERT(!stashed_coeff.has_value()); 615| 418| while(true) { 616| 418| const auto b = bounded_xof.next_byte(); 617| 418| const auto z0 = coeff_from_halfbyte(b & 0x0F); 618| 418| const auto z1 = coeff_from_halfbyte(b >> 4); 619| | 620| 418| if(z0.has_value()) { 621| 418| stashed_coeff = z1; // keep candidate z1 for the next invocation 622| 418| return *z0; 623| 418| } else if(z1.has_value()) { 624| | // z0 was invalid, z1 is valid, nothing to stash 625| 418| return *z1; 626| 418| } 627| 418| } 628| 418| }; 629| | 630| 107k| for(auto& coeff : p) { ------------------ | Branch (630:20): [True: 107k, False: 418] ------------------ 631| 107k| coeff = next_coeff(); 632| 107k| } 633| 418|} dilithium_algos.cpp:_ZZN5Botan15Dilithium_Algos12_GLOBAL__N_118sample_uniform_etaILNS_18DilithiumConstants12DilithiumEtaE4EEEvRNS_8CRYSTALS10PolynomialINS_19DilithiumPolyTraitsELNS5_6DomainE0EEERNS_3XOFEENUlvE_clEv: 609| 107k| stashed_coeff = std::optional{}]() mutable -> int32_t { 610| 107k| if(auto stashed = std::exchange(stashed_coeff, std::nullopt)) { ------------------ | Branch (610:15): [True: 29.9k, False: 77.0k] ------------------ 611| 29.9k| return *stashed; 612| 29.9k| } 613| | 614| 77.0k| BOTAN_DEBUG_ASSERT(!stashed_coeff.has_value()); ------------------ | | 137| 77.0k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 77.0k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 77.0k] | | ------------------ ------------------ 615| 95.3k| while(true) { ------------------ | Branch (615:13): [True: 95.3k, Folded] ------------------ 616| 95.3k| const auto b = bounded_xof.next_byte(); 617| 95.3k| const auto z0 = coeff_from_halfbyte(b & 0x0F); 618| 95.3k| const auto z1 = coeff_from_halfbyte(b >> 4); 619| | 620| 95.3k| if(z0.has_value()) { ------------------ | Branch (620:13): [True: 53.9k, False: 41.3k] ------------------ 621| 53.9k| stashed_coeff = z1; // keep candidate z1 for the next invocation 622| 53.9k| return *z0; 623| 53.9k| } else if(z1.has_value()) { ------------------ | Branch (623:20): [True: 23.0k, False: 18.2k] ------------------ 624| | // z0 was invalid, z1 is valid, nothing to stash 625| 23.0k| return *z1; 626| 23.0k| } 627| 95.3k| } 628| 77.0k| }; dilithium_algos.cpp:_ZN5Botan15Dilithium_Algos12_GLOBAL__N_119coeff_from_halfbyteILNS_18DilithiumConstants12DilithiumEtaE4EEENSt3__18optionalIiEEh: 586| 190k|std::optional coeff_from_halfbyte(uint8_t b) { 587| 190k| BOTAN_DEBUG_ASSERT(b < 16); ------------------ | | 137| 190k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 190k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 190k] | | ------------------ ------------------ 588| | 589| | if constexpr(eta == DilithiumConstants::DilithiumEta::_2) { 590| | if(CT::driveby_unpoison(b < 15)) { 591| | b = b - (205U * b >> 10) * 5; // b = b mod 5 592| | return 2 - b; 593| | } 594| 190k| } else if constexpr(eta == DilithiumConstants::DilithiumEta::_4) { 595| 190k| if(CT::driveby_unpoison(b < 9)) { ------------------ | Branch (595:10): [True: 107k, False: 83.5k] ------------------ 596| 107k| return 4 - b; 597| 107k| } 598| 190k| } 599| | 600| 83.5k| return std::nullopt; 601| 190k|} dilithium_algos.cpp:_ZZN5Botan15Dilithium_Algos11power2roundERKNS_8CRYSTALS16PolynomialVectorINS_19DilithiumPolyTraitsELNS1_6DomainE0EEEENK3$_0clEi: 754| 115k| const auto power2round = [d = DilithiumConstants::D](int32_t r) -> std::pair { 755| 115k| const int32_t r1 = (r + (1 << (d - 1)) - 1) >> d; 756| 115k| const int32_t r0 = r - (r1 << d); 757| 115k| return {r1, r0}; 758| 115k| }; _ZN5Botan18DilithiumConstantsD2Ev: 57| 519|DilithiumConstants::~DilithiumConstants() = default; _ZN5Botan18DilithiumConstantsC2ENS_13DilithiumModeE: 60| 149| m_mode(mode), 61| 149| m_public_key_hash_bytes(public_key_hash_size(m_mode)), 62| 149| m_commitment_hash_full_bytes(commitment_hash_full_size(m_mode)) { 63| 149| switch(m_mode.mode()) { 64| 0| case Botan::DilithiumMode::Dilithium4x4: ------------------ | Branch (64:7): [True: 0, False: 149] ------------------ 65| 0| case Botan::DilithiumMode::Dilithium4x4_AES: ------------------ | Branch (65:7): [True: 0, False: 149] ------------------ 66| 26| case Botan::DilithiumMode::ML_DSA_4x4: ------------------ | Branch (66:7): [True: 26, False: 123] ------------------ 67| 26| m_tau = DilithiumTau::_39; 68| 26| m_lambda = DilithiumLambda::_128; 69| 26| m_gamma1 = DilithiumGamma1::ToThe17th; 70| 26| m_gamma2 = DilithiumGamma2::Qminus1DividedBy88; 71| 26| m_k = 4; 72| 26| m_l = 4; 73| 26| m_eta = DilithiumEta::_2; 74| 26| m_beta = DilithiumBeta::_78; 75| 26| m_omega = DilithiumOmega::_80; 76| 26| break; 77| 0| case Botan::DilithiumMode::Dilithium6x5: ------------------ | Branch (77:7): [True: 0, False: 149] ------------------ 78| 0| case Botan::DilithiumMode::Dilithium6x5_AES: ------------------ | Branch (78:7): [True: 0, False: 149] ------------------ 79| 78| case Botan::DilithiumMode::ML_DSA_6x5: ------------------ | Branch (79:7): [True: 78, False: 71] ------------------ 80| 78| m_tau = DilithiumTau::_49; 81| 78| m_lambda = DilithiumLambda::_192; 82| 78| m_gamma1 = DilithiumGamma1::ToThe19th; 83| 78| m_gamma2 = DilithiumGamma2::Qminus1DividedBy32; 84| 78| m_k = 6; 85| 78| m_l = 5; 86| 78| m_eta = DilithiumEta::_4; 87| 78| m_beta = DilithiumBeta::_196; 88| 78| m_omega = DilithiumOmega::_55; 89| 78| break; 90| 0| case Botan::DilithiumMode::Dilithium8x7: ------------------ | Branch (90:7): [True: 0, False: 149] ------------------ 91| 0| case Botan::DilithiumMode::Dilithium8x7_AES: ------------------ | Branch (91:7): [True: 0, False: 149] ------------------ 92| 45| case Botan::DilithiumMode::ML_DSA_8x7: ------------------ | Branch (92:7): [True: 45, False: 104] ------------------ 93| 45| m_tau = DilithiumTau::_60; 94| 45| m_lambda = DilithiumLambda::_256; 95| 45| m_gamma1 = DilithiumGamma1::ToThe19th; 96| 45| m_gamma2 = DilithiumGamma2::Qminus1DividedBy32; 97| 45| m_k = 8; 98| 45| m_l = 7; 99| 45| m_eta = DilithiumEta::_2; 100| 45| m_beta = DilithiumBeta::_120; 101| 45| m_omega = DilithiumOmega::_75; 102| 45| break; 103| 0| default: ------------------ | Branch (103:7): [True: 0, False: 149] ------------------ 104| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 105| 149| } 106| | 107| 149| const auto s1_bytes = 32 * m_l * bitlen(2 * m_eta); 108| 149| const auto s2_bytes = 32 * m_k * bitlen(2 * m_eta); 109| 149| const auto t0_bytes = 32 * m_k * D; 110| 149| const auto t1_bytes = 32 * m_k * (bitlen(static_cast(Q) - 1) - D); 111| 149| const auto z_bytes = 32 * m_l * (1 + bitlen(m_gamma1 - 1)); 112| 149| const auto hint_bytes = m_omega + m_k; 113| | 114| 149| m_private_key_bytes = 115| 149| SEED_RHO_BYTES + SEED_SIGNING_KEY_BYTES + m_public_key_hash_bytes + s1_bytes + s2_bytes + t0_bytes; 116| 149| m_public_key_bytes = SEED_RHO_BYTES + t1_bytes; 117| 149| m_signature_bytes = m_commitment_hash_full_bytes + z_bytes + hint_bytes; 118| 149| m_serialized_commitment_bytes = 32 * m_k * bitlen(((Q - 1) / (2 * m_gamma2)) - 1); 119| | 120| 149| m_symmetric_primitives = Dilithium_Symmetric_Primitives_Base::create(*this); 121| 149| m_keypair_codec = Dilithium_Keypair_Codec::create(mode); 122| 149|} dilithium_constants.cpp:_ZN5Botan12_GLOBAL__N_120public_key_hash_sizeENS_13DilithiumModeE: 20| 149|uint32_t public_key_hash_size(DilithiumMode mode) { 21| 149| switch(mode.mode()) { ------------------ | Branch (21:11): [True: 149, False: 0] ------------------ 22| 26| case DilithiumMode::ML_DSA_4x4: ------------------ | Branch (22:7): [True: 26, False: 123] ------------------ 23| 104| case DilithiumMode::ML_DSA_6x5: ------------------ | Branch (23:7): [True: 78, False: 71] ------------------ 24| 149| case DilithiumMode::ML_DSA_8x7: ------------------ | Branch (24:7): [True: 45, False: 104] ------------------ 25| 149| return 64; 26| 0| case DilithiumMode::Dilithium4x4: ------------------ | Branch (26:7): [True: 0, False: 149] ------------------ 27| 0| case DilithiumMode::Dilithium4x4_AES: ------------------ | Branch (27:7): [True: 0, False: 149] ------------------ 28| 0| case DilithiumMode::Dilithium6x5: ------------------ | Branch (28:7): [True: 0, False: 149] ------------------ 29| 0| case DilithiumMode::Dilithium6x5_AES: ------------------ | Branch (29:7): [True: 0, False: 149] ------------------ 30| 0| case DilithiumMode::Dilithium8x7: ------------------ | Branch (30:7): [True: 0, False: 149] ------------------ 31| 0| case DilithiumMode::Dilithium8x7_AES: ------------------ | Branch (31:7): [True: 0, False: 149] ------------------ 32| 0| return 32; 33| 149| } 34| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 35| 0|} dilithium_constants.cpp:_ZN5Botan12_GLOBAL__N_125commitment_hash_full_sizeENS_13DilithiumModeE: 37| 149|uint32_t commitment_hash_full_size(DilithiumMode mode) { 38| 149| switch(mode.mode()) { ------------------ | Branch (38:11): [True: 149, False: 0] ------------------ 39| 0| case DilithiumMode::Dilithium4x4: ------------------ | Branch (39:7): [True: 0, False: 149] ------------------ 40| 0| case DilithiumMode::Dilithium4x4_AES: ------------------ | Branch (40:7): [True: 0, False: 149] ------------------ 41| 0| case DilithiumMode::Dilithium6x5: ------------------ | Branch (41:7): [True: 0, False: 149] ------------------ 42| 0| case DilithiumMode::Dilithium6x5_AES: ------------------ | Branch (42:7): [True: 0, False: 149] ------------------ 43| 0| case DilithiumMode::Dilithium8x7: ------------------ | Branch (43:7): [True: 0, False: 149] ------------------ 44| 0| case DilithiumMode::Dilithium8x7_AES: ------------------ | Branch (44:7): [True: 0, False: 149] ------------------ 45| 26| case DilithiumMode::ML_DSA_4x4: ------------------ | Branch (45:7): [True: 26, False: 123] ------------------ 46| 26| return 32; 47| 78| case DilithiumMode::ML_DSA_6x5: ------------------ | Branch (47:7): [True: 78, False: 71] ------------------ 48| 78| return 48; 49| 45| case DilithiumMode::ML_DSA_8x7: ------------------ | Branch (49:7): [True: 45, False: 104] ------------------ 50| 45| return 64; 51| 149| } 52| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 53| 0|} _ZN5Botan23Dilithium_Keypair_Codec6createENS_13DilithiumModeE: 22| 149|std::unique_ptr Dilithium_Keypair_Codec::create(DilithiumMode mode) { 23| 149|#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES) 24| 149| if(mode.is_dilithium_round3()) { ------------------ | Branch (24:7): [True: 0, False: 149] ------------------ 25| 0| return std::make_unique(); 26| 0| } 27| 149|#endif 28| | 29| 149|#if defined(BOTAN_HAS_ML_DSA) 30| 149| if(mode.is_ml_dsa()) { ------------------ | Branch (30:7): [True: 149, False: 0] ------------------ 31| 149| return std::make_unique(); 32| 149| } 33| 0|#endif 34| | 35| 0| throw Not_Implemented("requested ML-DSA/Dilithium mode is not implemented in this build"); 36| 149|} _ZN5Botan17DilithiumShakeXOFD2Ev: 13| 149|DilithiumShakeXOF::~DilithiumShakeXOF() = default; _ZN5Botan17DilithiumShakeXOF9createXOFENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS1_4spanIKhLm18446744073709551615EEEt: 18| 3.40k| uint16_t nonce) { 19| 3.40k| auto xof = Botan::XOF::create_or_throw(name); 20| 3.40k| xof->update(seed); 21| 3.40k| xof->update(store_le(nonce)); 22| 3.40k| return xof; 23| 3.40k|} _ZN5Botan35Dilithium_Symmetric_Primitives_BaseC2ERKNS_18DilithiumConstantsENSt3__110unique_ptrINS_12DilithiumXOFENS4_14default_deleteIS6_EEEE: 43| 149| m_commitment_hash_length_bytes(mode.commitment_hash_full_bytes()), 44| 149| m_public_key_hash_bytes(mode.public_key_hash_bytes()), 45| 149| m_mode(mode.mode()), 46| 149| m_xof_adapter(std::move(xof_adapter)) {} _ZN5Botan35Dilithium_Symmetric_Primitives_Base6createERKNS_18DilithiumConstantsE: 49| 149| const DilithiumConstants& mode) { 50| 149|#if defined(BOTAN_HAS_DILITHIUM) 51| 149| if(mode.is_modern() && !mode.is_ml_dsa()) { ------------------ | Branch (51:7): [True: 149, False: 0] | Branch (51:27): [True: 0, False: 149] ------------------ 52| 0| return std::make_unique(mode); 53| 0| } 54| 149|#endif 55| | 56| 149|#if defined(BOTAN_HAS_DILITHIUM_AES) 57| 149| if(mode.is_aes()) { ------------------ | Branch (57:7): [True: 0, False: 149] ------------------ 58| 0| return std::make_unique(mode); 59| 0| } 60| 149|#endif 61| | 62| 149|#if defined(BOTAN_HAS_ML_DSA) 63| 149| if(mode.is_ml_dsa()) { ------------------ | Branch (63:7): [True: 149, False: 0] ------------------ 64| 149| return std::make_unique(mode); 65| 149| } 66| 0|#endif 67| | 68| 0| throw Not_Implemented("requested ML-DSA/Dilithium mode is not implemented in this build"); 69| 149|} _ZNK5Botan30ML_DSA_Expanding_Keypair_Codec14decode_keypairENSt3__14spanIKhLm18446744073709551615EEENS_18DilithiumConstantsE: 23| 77| DilithiumConstants mode) const { 24| 77| return Dilithium_Algos::expand_keypair(DilithiumSeedRandomness(private_key_seed), std::move(mode)); 25| 77|} _ZN5Botan12DL_PublicKeyC2ERKNS_8DL_GroupERKNS_6BigIntE: 49| 198| m_group(group), m_public_key(check_dl_public_key_input(public_key, m_group)) {} _ZN5Botan13DL_PrivateKeyC2ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEENS_15DL_Group_FormatE: 92| 316| m_group(alg_id.parameters(), format), 93| 316| m_private_key(check_dl_private_key_input(decode_single_bigint(key_bits), m_group)), 94| 316| m_public_key(m_group.power_g_p(m_private_key, m_private_key.bits())) {} _ZNK5Botan13DL_PrivateKey10public_keyEv: 108| 198|std::shared_ptr DL_PrivateKey::public_key() const { 109| 198| return std::make_shared(m_group, m_public_key); 110| 198|} dl_scheme.cpp:_ZN5Botan12_GLOBAL__N_125check_dl_public_key_inputERKNS_6BigIntERKNS_8DL_GroupE: 38| 198|BigInt check_dl_public_key_input(const BigInt& y, const DL_Group& group) { 39| | // The subgroup check (y^q == 1 mod p) is deferred to check_key() since it can be expensive 40| 198| if(y <= 1 || y >= group.get_p() - 1) { ------------------ | Branch (40:7): [True: 1, False: 197] | Branch (40:7): [True: 2, False: 196] | Branch (40:17): [True: 1, False: 196] ------------------ 41| 2| throw Decoding_Error("Invalid DL public key"); 42| 2| } 43| 196| return y; 44| 198|} dl_scheme.cpp:_ZN5Botan12_GLOBAL__N_120decode_single_bigintENSt3__14spanIKhLm18446744073709551615EEE: 17| 234|BigInt decode_single_bigint(std::span key_bits) { 18| 234| BigInt x; 19| 234| BER_Decoder(key_bits, BER_Decoder::Limits::DER()).decode(x).verify_end(); 20| 234| return x; 21| 234|} dl_scheme.cpp:_ZN5Botan12_GLOBAL__N_126check_dl_private_key_inputERKNS_6BigIntERKNS_8DL_GroupE: 31| 207|BigInt check_dl_private_key_input(const BigInt& x, const DL_Group& group) { 32| 207| if(!group.verify_private_element(x)) { ------------------ | Branch (32:7): [True: 9, False: 198] ------------------ 33| 9| throw Decoding_Error("Invalid DL private key"); 34| 9| } 35| 198| return x; 36| 207|} _ZN5Botan8DL_Group19DER_decode_DL_groupENSt3__14spanIKhLm18446744073709551615EEENS_15DL_Group_FormatENS_15DL_Group_SourceE: 170| 316| DL_Group_Source source) { 171| 316| BER_Decoder outer(data, BER_Decoder::Limits::DER()); 172| 316| BER_Decoder inner = outer.start_sequence(); 173| 316| outer.verify_end(); 174| | 175| 316| if(format == DL_Group_Format::ANSI_X9_57) { ------------------ | Branch (175:7): [True: 109, False: 207] ------------------ 176| | /* 177| | This format is p, q, g with no additional data following 178| | */ 179| 109| BigInt p; 180| 109| BigInt q; 181| 109| BigInt g; 182| 109| inner.decode(p).decode(q).decode(g).verify_end(); 183| 109| return DL_Group_Data::create(p, q, g, source); 184| 207| } else if(format == DL_Group_Format::ANSI_X9_42) { ------------------ | Branch (184:14): [True: 199, False: 8] ------------------ 185| | /* 186| | This format is p, g, q with optional cofactor and seed following 187| | */ 188| 199| BigInt p; 189| 199| BigInt g; 190| 199| BigInt q; 191| 199| inner.decode(p).decode(g).decode(q).discard_remaining(); 192| 199| return DL_Group_Data::create(p, q, g, source); 193| 199| } else if(format == DL_Group_Format::PKCS_3) { ------------------ | Branch (193:14): [True: 0, False: 8] ------------------ 194| | /* 195| | This format is p, g followed by optional privateValueLength (recommended exponent size) 196| | */ 197| 0| BigInt p; 198| 0| BigInt g; 199| 0| inner.decode(p).decode(g).discard_remaining(); 200| 0| return DL_Group_Data::create(p, g, source); 201| 8| } else { 202| 8| throw Invalid_Argument("Unknown DL_Group encoding"); 203| 8| } 204| 316|} _ZNK5Botan8DL_Group4dataEv: 413| 1.12k|const DL_Group_Data& DL_Group::data() const { 414| 1.12k| if(m_data) { ------------------ | Branch (414:7): [True: 1.12k, False: 0] ------------------ 415| 1.12k| return *m_data; 416| 1.12k| } 417| | 418| 0| throw Invalid_State("DL_Group uninitialized"); 419| 1.12k|} _ZNK5Botan8DL_Group22verify_private_elementERKNS_6BigIntE: 438| 207|bool DL_Group::verify_private_element(const BigInt& x) const { 439| 207| const BigInt& p = get_p(); 440| 207| const BigInt& q = get_q(); 441| | 442| 207| if(x <= 1 || x >= p) { ------------------ | Branch (442:7): [True: 3, False: 204] | Branch (442:17): [True: 1, False: 203] ------------------ 443| 4| return false; 444| 4| } 445| | 446| 203| if(q > 0 && x >= q) { ------------------ | Branch (446:7): [True: 203, False: 0] | Branch (446:16): [True: 5, False: 198] ------------------ 447| 5| return false; 448| 5| } 449| | 450| 198| return true; 451| 203|} _ZNK5Botan8DL_Group5get_pEv: 523| 404|const BigInt& DL_Group::get_p() const { 524| 404| return data().p(); 525| 404|} _ZNK5Botan8DL_Group5get_qEv: 537| 207|const BigInt& DL_Group::get_q() const { 538| 207| return data().q(); 539| 207|} _ZNK5Botan8DL_Group5has_qEv: 545| 78|bool DL_Group::has_q() const { 546| 78| return data().q_is_set(); 547| 78|} _ZNK5Botan8DL_Group6p_bitsEv: 549| 78|size_t DL_Group::p_bits() const { 550| 78| return data().p_bits(); 551| 78|} _ZNK5Botan8DL_Group6q_bitsEv: 557| 78|size_t DL_Group::q_bits() const { 558| 78| data().assert_q_is_set("q_bits"); 559| 78| return data().q_bits(); 560| 78|} _ZNK5Botan8DL_Group9power_g_pERKNS_6BigIntEm: 622| 198|BigInt DL_Group::power_g_p(const BigInt& x, size_t max_x_bits) const { 623| 198| return data().power_g_p(x, max_x_bits); 624| 198|} _ZN5Botan8DL_GroupC2ENSt3__14spanIKhLm18446744073709551615EEENS_15DL_Group_FormatE: 681| 316|DL_Group::DL_Group(std::span der, DL_Group_Format format) { 682| 316| m_data = DER_decode_DL_group(der, format, DL_Group_Source::ExternalSource); 683| 316|} _ZN5Botan13DL_Group_Data6createERKNS_6BigIntES3_S3_NS_15DL_Group_SourceE: 52| 303| DL_Group_Source source) { 53| 303| check_dl_group_params(p, q, g); 54| 303| return std::make_shared(p, q, g, source); 55| 303| } dl_group.cpp:_ZN5Botan12_GLOBAL__N_121check_dl_group_paramsERKNS_6BigIntES3_S3_: 38| 303|void check_dl_group_params(const BigInt& p, const BigInt& q, const BigInt& g) { 39| 303| check_dl_group_params(p, g); 40| 303| if(q.signum() <= 0 || q.is_even() || q.bits() >= p.bits()) { ------------------ | Branch (40:7): [True: 66, False: 237] | Branch (40:26): [True: 2, False: 235] | Branch (40:41): [True: 1, False: 234] ------------------ 41| 7| throw Decoding_Error("Invalid DL group subgroup order"); 42| 7| } 43| 303|} dl_group.cpp:_ZN5Botan12_GLOBAL__N_121check_dl_group_paramsERKNS_6BigIntES3_: 29| 303|void check_dl_group_params(const BigInt& p, const BigInt& g) { 30| 303| if(p.signum() <= 0 || p.is_even() || p.bits() < 3 || p.bits() > 16384) { ------------------ | Branch (30:7): [True: 3, False: 300] | Branch (30:26): [True: 1, False: 299] | Branch (30:41): [True: 1, False: 298] | Branch (30:57): [True: 0, False: 298] ------------------ 31| 5| throw Decoding_Error("Invalid DL group prime"); 32| 5| } 33| 298| if(g.signum() <= 0 || g < 2 || g >= p) { ------------------ | Branch (33:7): [True: 3, False: 295] | Branch (33:26): [True: 1, False: 294] | Branch (33:35): [True: 53, False: 241] ------------------ 34| 57| throw Decoding_Error("Invalid DL group generator"); 35| 57| } 36| 298|} _ZN5Botan13DL_Group_DataC2ERKNS_6BigIntES3_S3_NS_15DL_Group_SourceE: 65| 234| m_p(p), 66| 234| m_q(q), 67| 234| m_g(g), 68| 234| m_mod_p(Barrett_Reduction::for_public_modulus(p)), 69| 234| m_mod_q(Barrett_Reduction::for_public_modulus(q)), 70| 234| m_monty_params(m_p, m_mod_p), 71| 234| m_monty(monty_precompute(m_monty_params, m_g, /*window bits=*/4)), 72| 234| m_p_bits(p.bits()), 73| 234| m_q_bits(q.bits()), 74| | // For DL crypto in a prime-order subgroup, security is bounded by 75| | // both the NFS cost in Z_p* and Pollard rho in the q-order subgroup. 76| 234| m_estimated_strength(std::min(dl_work_factor(m_p_bits), m_q_bits / 2)), 77| 234| m_exponent_bits(dl_exponent_size(m_p_bits)), 78| 234| m_source(source) {} _ZN5Botan13DL_Group_DataD2Ev: 94| 234| ~DL_Group_Data() = default; _ZNK5Botan13DL_Group_Data1pEv: 101| 404| const BigInt& p() const { return m_p; } _ZNK5Botan13DL_Group_Data1qEv: 103| 207| const BigInt& q() const { return m_q; } _ZNK5Botan13DL_Group_Data8q_is_setEv: 142| 156| bool q_is_set() const { return m_q_bits > 0; } _ZNK5Botan13DL_Group_Data6p_bitsEv: 116| 78| size_t p_bits() const { return m_p_bits; } _ZNK5Botan13DL_Group_Data15assert_q_is_setENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 144| 78| void assert_q_is_set(std::string_view function) const { 145| 78| if(!q_is_set()) { ------------------ | Branch (145:13): [True: 0, False: 78] ------------------ 146| 0| throw Invalid_State(fmt("DL_Group::{}: q is not set for this group", function)); 147| 0| } 148| 78| } _ZNK5Botan13DL_Group_Data6q_bitsEv: 118| 78| size_t q_bits() const { return m_q_bits; } _ZNK5Botan13DL_Group_Data9power_g_pERKNS_6BigIntEm: 128| 198| BigInt power_g_p(const BigInt& k, size_t max_k_bits) const { 129| 198| return monty_execute(*m_monty, k, max_k_bits).value(); 130| 198| } _ZN5Botan14DSA_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 111| 117|DSA_PrivateKey::DSA_PrivateKey(const AlgorithmIdentifier& alg_id, std::span key_bits) { 112| 117| m_private_key = std::make_shared(alg_id, key_bits, DL_Group_Format::ANSI_X9_57); 113| 117| m_public_key = m_private_key->public_key(); 114| | 115| 117| check_dsa_group(m_private_key->group()); 116| 117|} dsa.cpp:_ZN5Botan12_GLOBAL__N_115check_dsa_groupERKNS_8DL_GroupE: 28| 78|void check_dsa_group(const DL_Group& group) { 29| 78| if(!group.has_q()) { ------------------ | Branch (29:7): [True: 0, False: 78] ------------------ 30| 0| throw Decoding_Error("Q parameter must be set for DSA"); 31| 0| } 32| | 33| 78| const size_t q_bits = group.q_bits(); 34| 78| const size_t p_bits = group.p_bits(); 35| | 36| | // TODO(Botan4) restrict to exactly the parameter sizes from FIPS 186-4 37| | // (1024,160), (2048,224), (2048,256), or (3072,256) 38| | 39| 78| if(q_bits < 160 || q_bits > 256) { ------------------ | Branch (39:7): [True: 78, False: 0] | Branch (39:23): [True: 0, False: 0] ------------------ 40| 78| throw Decoding_Error("Invalid DSA q parameter size"); 41| 78| } 42| 0| if(p_bits < 512 || p_bits > 3072) { ------------------ | Branch (42:7): [True: 0, False: 0] | Branch (42:23): [True: 0, False: 0] ------------------ 43| 0| throw Decoding_Error("Invalid DSA p parameter size"); 44| 0| } 45| 0|} _ZN5Botan14EC_AffinePointC2ENSt3__110unique_ptrINS_19EC_AffinePoint_DataENS1_14default_deleteIS3_EEEE: 16| 2.47k|EC_AffinePoint::EC_AffinePoint(std::unique_ptr point) : m_point(std::move(point)) { 17| 2.47k| BOTAN_ASSERT_NONNULL(m_point); ------------------ | | 123| 2.47k| do { \ | | 124| 2.47k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 2.47k] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 2.47k| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 2.47k] | | ------------------ ------------------ 18| 2.47k|} _ZN5Botan14EC_AffinePointC2EOS0_: 22| 5.12k|EC_AffinePoint::EC_AffinePoint(EC_AffinePoint&& other) noexcept : m_point(std::move(other.m_point)) {} _ZNK5Botan14EC_AffinePoint15to_legacy_pointEv: 46| 2.46k|EC_Point EC_AffinePoint::to_legacy_point() const { 47| 2.46k| return m_point->to_legacy_point(); 48| 2.46k|} _ZNK5Botan14EC_AffinePointeqERKS0_: 55| 189|bool EC_AffinePoint::operator==(const EC_AffinePoint& other) const { 56| 189| if(this == &other) { ------------------ | Branch (56:7): [True: 0, False: 189] ------------------ 57| 0| return true; 58| 0| } 59| | 60| | // We are relying on EC_Group to ensure there is just a single shared_ptr 61| | // for any set of group params 62| 189| if(this->_group() != other._group()) { ------------------ | Branch (62:7): [True: 0, False: 189] ------------------ 63| 0| return false; 64| 0| } 65| | 66| 189| const auto a_is_id = this->is_identity(); 67| 189| const auto b_is_id = other.is_identity(); 68| | 69| 189| if(a_is_id || b_is_id) { ------------------ | Branch (69:7): [True: 0, False: 189] | Branch (69:18): [True: 0, False: 189] ------------------ 70| 0| return (a_is_id == b_is_id); 71| 0| } 72| | 73| 189| auto a_xy = this->serialize_uncompressed(); 74| 189| auto b_xy = other.serialize_uncompressed(); 75| 189| BOTAN_ASSERT_NOMSG(a_xy.size() == b_xy.size()); ------------------ | | 84| 189| do { \ | | 85| 189| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 189| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 189] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 189| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 189] | | ------------------ ------------------ 76| | 77| 189| return CT::is_equal(a_xy.data(), b_xy.data(), a_xy.size()).as_bool(); 78| 189|} _ZN5Botan14EC_AffinePoint14from_bigint_xyERKNS_8EC_GroupERKNS_6BigIntES6_: 93| 4|std::optional EC_AffinePoint::from_bigint_xy(const EC_Group& group, const BigInt& x, const BigInt& y) { 94| 4| if(x.signum() < 0 || x >= group.get_p()) { ------------------ | Branch (94:7): [True: 0, False: 4] | Branch (94:25): [True: 0, False: 4] ------------------ 95| 0| return {}; 96| 0| } 97| 4| if(y.signum() < 0 || y >= group.get_p()) { ------------------ | Branch (97:7): [True: 0, False: 4] | Branch (97:25): [True: 0, False: 4] ------------------ 98| 0| return {}; 99| 0| } 100| | 101| 4| const size_t fe_bytes = group.get_p_bytes(); 102| 4| std::vector sec1(1 + 2 * fe_bytes); 103| 4| sec1[0] = 0x04; 104| 4| x.serialize_to(std::span{sec1}.subspan(1, fe_bytes)); 105| 4| y.serialize_to(std::span{sec1}.last(fe_bytes)); 106| | 107| 4| return EC_AffinePoint::deserialize_uncompressed(group, sec1); 108| 4|} _ZNK5Botan14EC_AffinePoint19field_element_bytesEv: 114| 378|size_t EC_AffinePoint::field_element_bytes() const { 115| 378| return inner().field_element_bytes(); 116| 378|} _ZNK5Botan14EC_AffinePoint11is_identityEv: 118| 3.22k|bool EC_AffinePoint::is_identity() const { 119| 3.22k| return inner().is_identity(); 120| 3.22k|} _ZN5Botan14EC_AffinePointD2Ev: 152| 7.60k|EC_AffinePoint::~EC_AffinePoint() = default; _ZN5Botan14EC_AffinePoint22deserialize_compressedERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 195| 790| std::span bytes) { 196| 790| if(auto pt = group._data()->point_deserialize_compressed(bytes)) { ------------------ | Branch (196:12): [True: 184, False: 606] ------------------ 197| 184| return EC_AffinePoint(std::move(pt)); 198| 606| } else { 199| 606| return {}; 200| 606| } 201| 790|} _ZN5Botan14EC_AffinePoint24deserialize_uncompressedERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 204| 795| std::span bytes) { 205| 795| if(auto pt = group._data()->point_deserialize_uncompressed(bytes)) { ------------------ | Branch (205:12): [True: 5, False: 790] ------------------ 206| 5| return EC_AffinePoint(std::move(pt)); 207| 790| } else { 208| 790| return {}; 209| 790| } 210| 795|} _ZN5Botan14EC_AffinePoint5g_mulERKNS_9EC_ScalarERNS_21RandomNumberGeneratorE: 212| 2.28k|EC_AffinePoint EC_AffinePoint::g_mul(const EC_Scalar& scalar, RandomNumberGenerator& rng) { 213| 2.28k| auto pt = scalar._inner().group()->point_g_mul(scalar.inner(), rng); 214| 2.28k| return EC_AffinePoint(std::move(pt)); 215| 2.28k|} _ZNK5Botan14EC_AffinePoint6negateEv: 243| 4|EC_AffinePoint EC_AffinePoint::negate() const { 244| 4| auto pt = this->_inner().group()->affine_neg(this->_inner()); 245| 4| return EC_AffinePoint(std::move(pt)); 246| 4|} _ZNK5Botan14EC_AffinePoint25serialize_uncompressed_toENSt3__14spanIhLm18446744073709551615EEE: 283| 378|void EC_AffinePoint::serialize_uncompressed_to(std::span bytes) const { 284| 378| BOTAN_STATE_CHECK(!this->is_identity()); ------------------ | | 51| 378| do { \ | | 52| 378| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 378| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 378] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 378| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 378] | | ------------------ ------------------ 285| 378| m_point->serialize_uncompressed_to(bytes); 286| 378|} _ZNK5Botan14EC_AffinePoint6_groupEv: 292| 2.84k|const std::shared_ptr& EC_AffinePoint::_group() const { 293| 2.84k| return inner().group(); 294| 2.84k|} _ZN5Botan8EC_Group13ec_group_dataEv: 240| 10.1k|EC_Group_Data_Map& EC_Group::ec_group_data() { 241| | /* 242| | * This exists purely to ensure the allocator is constructed before g_ec_data, 243| | * which ensures that its destructor runs after ~g_ec_data is complete. 244| | */ 245| | 246| 10.1k| static const Allocator_Initializer g_init_allocator; 247| 10.1k| static EC_Group_Data_Map g_ec_data; 248| 10.1k| return g_ec_data; 249| 10.1k|} _ZN5Botan8EC_Group27clear_registered_curve_dataEv: 252| 7.00k|size_t EC_Group::clear_registered_curve_data() { 253| 7.00k| return ec_group_data().clear(); 254| 7.00k|} _ZN5Botan8EC_Group18load_EC_group_infoEPKcS2_S2_S2_S2_S2_RKNS_3OIDE: 263| 2.43k| const OID& oid) { 264| 2.43k| BOTAN_ARG_CHECK(oid.has_value(), "EC_Group::load_EC_group_info OID must be set"); ------------------ | | 35| 2.43k| do { \ | | 36| 2.43k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 2.43k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 2.43k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 2.43k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 2.43k] | | ------------------ ------------------ 265| | 266| 2.43k| const BigInt p(p_str); 267| 2.43k| const BigInt a(a_str); 268| 2.43k| const BigInt b(b_str); 269| 2.43k| const BigInt g_x(g_x_str); 270| 2.43k| const BigInt g_y(g_y_str); 271| 2.43k| const BigInt order(order_str); 272| 2.43k| const BigInt cofactor(1); // implicit 273| | 274| 2.43k| return EC_Group_Data::create(p, a, b, g_x, g_y, order, cofactor, oid, EC_Group_Source::Builtin); 275| 2.43k|} _ZN5Botan8EC_Group19DER_decode_EC_groupENSt3__14spanIKhLm18446744073709551615EEENS_15EC_Group_SourceE: 279| 3.12k| EC_Group_Source source) { 280| 3.12k| BER_Decoder dec(der, BER_Decoder::Limits::DER()); 281| | 282| 3.12k| const auto next_obj_type = dec.peek_next_object().type_tag(); 283| | 284| 3.12k| if(next_obj_type == ASN1_Type::ObjectId) { ------------------ | Branch (284:7): [True: 2.18k, False: 939] ------------------ 285| 2.18k| OID oid; 286| 2.18k| dec.decode(oid).verify_end(); 287| | 288| 2.18k| const auto data = ec_group_data().lookup(oid); 289| 2.18k| if(!data) { ------------------ | Branch (289:10): [True: 95, False: 2.08k] ------------------ 290| 95| throw Decoding_Error(fmt("Unknown namedCurve OID '{}'", oid.to_string())); 291| 95| } 292| | 293| 2.08k| return std::make_pair(data, false); 294| 2.18k| } else if(next_obj_type == ASN1_Type::Sequence) { ------------------ | Branch (294:14): [True: 938, False: 1] ------------------ 295| 938| BigInt p; 296| 938| BigInt a; 297| 938| BigInt b; 298| 938| BigInt order; 299| 938| BigInt cofactor; 300| 938| std::vector base_pt; 301| 938| std::vector seed; 302| | 303| 938| dec.start_sequence() 304| 938| .decode_and_check(1, "Unknown ECC param version code") 305| 938| .start_sequence() 306| 938| .decode_and_check(OID({1, 2, 840, 10045, 1, 1}), "Only prime ECC fields supported") 307| 938| .decode(p) 308| 938| .end_cons() 309| 938| .start_sequence() 310| 938| .decode_octet_string_bigint(a) 311| 938| .decode_octet_string_bigint(b) 312| 938| .decode_optional_string(seed, ASN1_Type::BitString, ASN1_Type::BitString, ASN1_Class::Universal) 313| 938| .end_cons() 314| 938| .decode(base_pt, ASN1_Type::OctetString) 315| 938| .decode(order) 316| 938| .decode(cofactor) 317| 938| .end_cons() 318| 938| .verify_end(); 319| | 320| | // TODO(Botan4) Require cofactor == 1 321| 938| if(cofactor <= 0 || cofactor >= 16) { ------------------ | Branch (321:10): [True: 32, False: 906] | Branch (321:27): [True: 2, False: 904] ------------------ 322| 3| throw Decoding_Error("Invalid ECC cofactor parameter"); 323| 3| } 324| | 325| 935| if(p.bits() < 112 || p.bits() > 521 || p.signum() < 0) { ------------------ | Branch (325:10): [True: 31, False: 904] | Branch (325:28): [True: 1, False: 903] | Branch (325:46): [True: 1, False: 902] ------------------ 326| 2| throw Decoding_Error("ECC p parameter is invalid size"); 327| 2| } 328| | 329| | // A can be zero 330| 933| if(a.signum() < 0 || a >= p) { ------------------ | Branch (330:10): [True: 31, False: 902] | Branch (330:28): [True: 2, False: 900] ------------------ 331| 2| throw Decoding_Error("Invalid ECC a parameter"); 332| 2| } 333| | 334| | // B must be > 0 335| | // 336| | // Technically this is not true but we have historically rejected this and 337| | // nobody has noted it as an issue, so it is retained. 338| 931| if(b.signum() <= 0 || b >= p) { ------------------ | Branch (338:10): [True: 32, False: 899] | Branch (338:29): [True: 9, False: 890] ------------------ 339| 10| throw Decoding_Error("Invalid ECC b parameter"); 340| 10| } 341| | 342| 921| if(order.signum() <= 0 || order >= 2 * p) { ------------------ | Branch (342:10): [True: 33, False: 888] | Branch (342:10): [True: 3, False: 918] | Branch (342:33): [True: 1, False: 887] ------------------ 343| 3| throw Decoding_Error("Invalid ECC group order"); 344| 3| } 345| | 346| 918| if(p == order) { ------------------ | Branch (346:10): [True: 1, False: 917] ------------------ 347| 1| throw Decoding_Error("Anomalous elliptic curves are not supported"); 348| 1| } 349| | 350| 917| if(const auto data = ec_group_data().lookup_from_params(p, a, b, base_pt, order, cofactor)) { ------------------ | Branch (350:21): [True: 255, False: 662] ------------------ 351| 255| return std::make_pair(data, true); 352| 255| } 353| | 354| | /* 355| | TODO(Botan4) the remaining code is used only to handle the case of decoding an EC_Group 356| | which is neither a builtin group nor a group that was registered by the application. 357| | It can all be removed and replaced with a throw 358| | */ 359| | 360| 662| const auto mod_p = Barrett_Reduction::for_public_modulus(p); 361| 662| if(!is_bailie_psw_probable_prime_vartime(p)) { ------------------ | Branch (361:10): [True: 242, False: 420] ------------------ 362| 242| throw Decoding_Error("ECC p parameter is not a prime"); 363| 242| } 364| | 365| 420| if(!is_bailie_psw_probable_prime_vartime(order)) { ------------------ | Branch (365:10): [True: 212, False: 208] ------------------ 366| 212| throw Decoding_Error("Invalid ECC order parameter"); 367| 212| } 368| | 369| 208| if((p - cofactor * order).abs().bits() > (p.bits() / 2) + 1) { ------------------ | Branch (369:10): [True: 92, False: 116] ------------------ 370| 92| throw Decoding_Error("Invalid ECC Hasse bound"); 371| 92| } 372| | 373| 116| const auto discriminant = mod_p.reduce(mod_p.multiply(BigInt::from_s32(4), mod_p.cube(a)) + 374| 116| mod_p.multiply(BigInt::from_s32(27), mod_p.square(b))); 375| 116| if(discriminant == 0) { ------------------ | Branch (375:10): [True: 0, False: 116] ------------------ 376| 0| throw Decoding_Error("Invalid ECC curve discriminant"); 377| 0| } 378| | 379| 116| const size_t p_bytes = p.bytes(); 380| 116| if(base_pt.size() != 1 + p_bytes && base_pt.size() != 1 + 2 * p_bytes) { ------------------ | Branch (380:10): [True: 84, False: 32] | Branch (380:43): [True: 2, False: 82] ------------------ 381| 2| throw Decoding_Error("Invalid ECC base point encoding"); 382| 2| } 383| | 384| 114| auto [g_x, g_y] = [&]() { 385| 114| const uint8_t hdr = base_pt[0]; 386| | 387| 114| if(hdr == 0x04 && base_pt.size() == 1 + 2 * p_bytes) { 388| 114| const BigInt x = BigInt::from_bytes(std::span{base_pt}.subspan(1, p_bytes)); 389| 114| const BigInt y = BigInt::from_bytes(std::span{base_pt}.subspan(1 + p_bytes, p_bytes)); 390| | 391| 114| if(x < p && y < p) { 392| 114| return std::make_pair(x, y); 393| 114| } 394| 114| } else if((hdr == 0x02 || hdr == 0x03) && base_pt.size() == 1 + p_bytes) { 395| | // TODO(Botan4) remove this branch; we won't support compressed points 396| 114| const BigInt x = BigInt::from_bytes(std::span{base_pt}.subspan(1, p_bytes)); 397| 114| BigInt y = sqrt_modulo_prime(((x * x + a) * x + b) % p, p); 398| | 399| 114| if(x < p && y >= 0) { 400| 114| const bool y_mod_2 = (hdr & 0x01) == 1; 401| 114| if(y.get_bit(0) != y_mod_2) { 402| 114| y = p - y; 403| 114| } 404| | 405| 114| return std::make_pair(x, y); 406| 114| } 407| 114| } 408| | 409| 114| throw Decoding_Error("Invalid ECC base point encoding"); 410| 114| }(); 411| | 412| | // TODO(Botan4) we can remove this check since we'll only accept pre-registered groups 413| 114| const auto y2 = mod_p.square(g_y); 414| 114| const auto x3_ax_b = mod_p.reduce(mod_p.cube(g_x) + mod_p.multiply(a, g_x) + b); 415| 114| if(y2 != x3_ax_b) { ------------------ | Branch (415:10): [True: 51, False: 63] ------------------ 416| 51| throw Decoding_Error("Invalid ECC base point"); 417| 51| } 418| | 419| | /* 420| | * Create the group data without registering it in the global map. 421| | * 422| | * Applications that need persistent custom groups should register them 423| | * via the relevant EC_Group constructor 424| | */ 425| 63| const auto data = EC_Group_Data::create(p, a, b, g_x, g_y, order, cofactor, OID(), source); 426| | 427| 63| if(!EC_Group::verify_generator_order(data)) { ------------------ | Branch (427:10): [True: 19, False: 44] ------------------ 428| 19| throw Decoding_Error("ECC generator does not have the claimed order"); 429| 19| } 430| | 431| 44| return std::make_pair(data, true); 432| 63| } else if(next_obj_type == ASN1_Type::Null) { ------------------ | Branch (432:14): [True: 0, False: 1] ------------------ 433| 0| throw Decoding_Error("Decoding ImplicitCA ECC parameters is not supported"); 434| 1| } else { 435| 1| throw Decoding_Error( 436| 1| fmt("Unexpected tag {} while decoding ECC domain params", asn1_tag_to_string(next_obj_type))); 437| 1| } 438| 3.12k|} _ZN5Botan8EC_GroupD2Ev: 442| 14.8k|EC_Group::~EC_Group() = default; _ZN5Botan8EC_GroupC2ERKS0_: 444| 5.38k|EC_Group::EC_Group(const EC_Group&) = default; _ZN5Botan8EC_GroupC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEE: 449| 2.32k|EC_Group::EC_Group(std::shared_ptr data) : m_data(std::move(data)) {} _ZN5Botan8EC_Group22verify_generator_orderENSt3__110shared_ptrIKNS_13EC_Group_DataEEE: 452| 19|bool EC_Group::verify_generator_order(std::shared_ptr data) { 453| 19| const EC_Group group(std::move(data)); 454| | 455| 19|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 456| 19| if(group.engine() == EC_Group_Engine::Legacy) { ------------------ | Branch (456:7): [True: 15, False: 4] ------------------ 457| 15| return (group.get_base_point() * group.get_order()).is_zero(); 458| 15| } 459| 4|#endif 460| | 461| 4| auto g_pt = EC_AffinePoint::from_bigint_xy(group, group.get_g_x(), group.get_g_y()); 462| 4| if(!g_pt) { ------------------ | Branch (462:7): [True: 0, False: 4] ------------------ 463| 0| return false; 464| 0| } 465| | 466| 4| Null_RNG null_rng; 467| 4| const auto neg_one = EC_Scalar::one(group).negate(); 468| 4| const auto n_minus_one_g = EC_AffinePoint::g_mul(neg_one, null_rng); 469| 4| return n_minus_one_g == g_pt->negate(); 470| 4|} _ZN5Botan8EC_Group8from_OIDERKNS_3OIDE: 518| 37|EC_Group EC_Group::from_OID(const OID& oid) { 519| 37| auto data = ec_group_data().lookup(oid); 520| | 521| 37| if(!data) { ------------------ | Branch (521:7): [True: 14, False: 23] ------------------ 522| 14| throw Invalid_Argument(fmt("No EC_Group associated with OID '{}'", oid.to_string())); 523| 14| } 524| | 525| 23| return EC_Group(std::move(data)); 526| 37|} _ZN5Botan8EC_GroupC2ENSt3__14spanIKhLm18446744073709551615EEE: 703| 3.12k|EC_Group::EC_Group(std::span der) { 704| 3.12k| const auto data = DER_decode_EC_group(der, EC_Group_Source::ExternalSource); 705| 3.12k| m_data = data.first; 706| 3.12k| m_explicit_encoding = data.second; 707| 3.12k|} _ZNK5Botan8EC_Group4dataEv: 714| 5.92k|const EC_Group_Data& EC_Group::data() const { 715| 5.92k| if(m_data == nullptr) { ------------------ | Branch (715:7): [True: 0, False: 5.92k] ------------------ 716| 0| throw Invalid_State("EC_Group uninitialized"); 717| 0| } 718| 5.92k| return *m_data; 719| 5.92k|} _ZNK5Botan8EC_Group11get_p_bytesEv: 725| 4|size_t EC_Group::get_p_bytes() const { 726| 4| return data().p_bytes(); 727| 4|} _ZNK5Botan8EC_Group15get_order_bytesEv: 733| 4.32k|size_t EC_Group::get_order_bytes() const { 734| 4.32k| return data().order_bytes(); 735| 4.32k|} _ZNK5Botan8EC_Group5get_pEv: 737| 50|const BigInt& EC_Group::get_p() const { 738| 50| return data().p(); 739| 50|} _ZNK5Botan8EC_Group5get_aEv: 741| 2|const BigInt& EC_Group::get_a() const { 742| 2| return data().a(); 743| 2|} _ZNK5Botan8EC_Group14get_base_pointEv: 750| 15|const EC_Point& EC_Group::get_base_point() const { 751| 15| return data().base_point(); 752| 15|} _ZNK5Botan8EC_Group9get_orderEv: 785| 15|const BigInt& EC_Group::get_order() const { 786| 15| return data().order(); 787| 15|} _ZNK5Botan8EC_Group7get_g_xEv: 789| 4|const BigInt& EC_Group::get_g_x() const { 790| 4| return data().g_x(); 791| 4|} _ZNK5Botan8EC_Group7get_g_yEv: 793| 4|const BigInt& EC_Group::get_g_y() const { 794| 4| return data().g_y(); 795| 4|} _ZNK5Botan8EC_Group13get_curve_oidEv: 805| 1.49k|const OID& EC_Group::get_curve_oid() const { 806| 1.49k| return data().oid(); 807| 1.49k|} _ZNK5Botan8EC_Group6engineEv: 813| 19|EC_Group_Engine EC_Group::engine() const { 814| 19| return data().engine(); 815| 19|} _ZNK5Botan8EC_GroupeqERKS0_: 871| 23|bool EC_Group::operator==(const EC_Group& other) const { 872| 23| if(m_data == other.m_data) { ------------------ | Branch (872:7): [True: 2, False: 21] ------------------ 873| 2| return true; // same shared rep 874| 2| } 875| | 876| 21| return (get_p() == other.get_p() && get_a() == other.get_a() && get_b() == other.get_b() && ------------------ | Branch (876:12): [True: 1, False: 20] | Branch (876:40): [True: 0, False: 1] | Branch (876:68): [True: 0, False: 0] ------------------ 877| 0| get_g_x() == other.get_g_x() && get_g_y() == other.get_g_y() && get_order() == other.get_order() && ------------------ | Branch (877:12): [True: 0, False: 0] | Branch (877:44): [True: 0, False: 0] | Branch (877:76): [True: 0, False: 0] ------------------ 878| 0| get_cofactor() == other.get_cofactor()); ------------------ | Branch (878:12): [True: 0, False: 0] ------------------ 879| 23|} _ZN5Botan17EC_Group_Data_Map5clearEv: 31| 7.00k| size_t clear() { 32| 7.00k| const lock_guard_type lock(m_mutex); 33| 7.00k| const size_t count = m_registered_curves.size(); 34| 7.00k| m_registered_curves.clear(); 35| 7.00k| return count; 36| 7.00k| } _ZN5Botan17EC_Group_Data_Map6lookupERKNS_3OIDE: 54| 2.21k| std::shared_ptr lookup(const OID& oid) { 55| 2.21k| const lock_guard_type lock(m_mutex); 56| | 57| 2.21k| for(auto i : m_registered_curves) { ------------------ | Branch (57:21): [True: 37, False: 2.21k] ------------------ 58| 37| if(i->oid() == oid) { ------------------ | Branch (58:16): [True: 2, False: 35] ------------------ 59| 2| return i; 60| 2| } 61| 37| } 62| | 63| | // Not found, check hardcoded data 64| 2.21k| std::shared_ptr data = EC_Group::EC_group_info(oid); 65| | 66| 2.21k| if(data) { ------------------ | Branch (66:13): [True: 2.10k, False: 109] ------------------ 67| | // The requested OID may be an alias for a curve whose canonical OID differs 68| | // TODO(Botan4) remove this once we require exactly one canonical OID per curve 69| 2.10k| if(data->oid() != oid) { ------------------ | Branch (69:16): [True: 0, False: 2.10k] ------------------ 70| 0| for(const auto& i : m_registered_curves) { ------------------ | Branch (70:34): [True: 0, False: 0] ------------------ 71| 0| if(i->oid() == data->oid()) { ------------------ | Branch (71:22): [True: 0, False: 0] ------------------ 72| 0| return i; 73| 0| } 74| 0| } 75| 0| } 76| | 77| 2.10k| m_registered_curves.push_back(data); 78| 2.10k| return data; 79| 2.10k| } 80| | 81| | // Nope, unknown curve 82| 109| return std::shared_ptr(); 83| 2.21k| } _ZN5Botan17EC_Group_Data_Map18lookup_from_paramsERKNS_6BigIntES3_S3_NSt3__14spanIKhLm18446744073709551615EEES3_S3_: 164| 886| const BigInt& cofactor) { 165| 886| const lock_guard_type lock(m_mutex); 166| | 167| 886| for(auto i : m_registered_curves) { ------------------ | Branch (167:21): [True: 0, False: 886] ------------------ 168| 0| if(i->params_match(p, a, b, base_pt, order, cofactor)) { ------------------ | Branch (168:16): [True: 0, False: 0] ------------------ 169| 0| return i; 170| 0| } 171| 0| } 172| | 173| | // Try to use the order as a hint to look up the group id 174| 886| const OID oid_from_order = EC_Group::EC_group_identity_from_order(order); 175| 886| if(oid_from_order.has_value()) { ------------------ | Branch (175:13): [True: 329, False: 557] ------------------ 176| 329| auto new_group = EC_Group::EC_group_info(oid_from_order); 177| | 178| | // Have to check all params in the (unlikely/malicious) event of an order collision 179| 329| if(new_group && new_group->params_match(p, a, b, base_pt, order, cofactor)) { ------------------ | Branch (179:16): [True: 329, False: 0] | Branch (179:29): [True: 255, False: 74] ------------------ 180| 255| m_registered_curves.push_back(new_group); 181| 255| return new_group; 182| 255| } 183| 329| } 184| | 185| 631| return {}; 186| 886| } ec_group.cpp:_ZZN5Botan8EC_Group19DER_decode_EC_groupENSt3__14spanIKhLm18446744073709551615EEENS_15EC_Group_SourceEENK3$_0clEv: 384| 82| auto [g_x, g_y] = [&]() { 385| 82| const uint8_t hdr = base_pt[0]; 386| | 387| 82| if(hdr == 0x04 && base_pt.size() == 1 + 2 * p_bytes) { ------------------ | Branch (387:13): [True: 74, False: 8] | Branch (387:28): [True: 74, False: 0] ------------------ 388| 74| const BigInt x = BigInt::from_bytes(std::span{base_pt}.subspan(1, p_bytes)); 389| 74| const BigInt y = BigInt::from_bytes(std::span{base_pt}.subspan(1 + p_bytes, p_bytes)); 390| | 391| 74| if(x < p && y < p) { ------------------ | Branch (391:16): [True: 72, False: 2] | Branch (391:25): [True: 70, False: 2] ------------------ 392| 70| return std::make_pair(x, y); 393| 70| } 394| 74| } else if((hdr == 0x02 || hdr == 0x03) && base_pt.size() == 1 + p_bytes) { ------------------ | Branch (394:21): [True: 1, False: 7] | Branch (394:36): [True: 2, False: 5] | Branch (394:52): [True: 0, False: 3] ------------------ 395| | // TODO(Botan4) remove this branch; we won't support compressed points 396| 0| const BigInt x = BigInt::from_bytes(std::span{base_pt}.subspan(1, p_bytes)); 397| 0| BigInt y = sqrt_modulo_prime(((x * x + a) * x + b) % p, p); 398| | 399| 0| if(x < p && y >= 0) { ------------------ | Branch (399:16): [True: 0, False: 0] | Branch (399:25): [True: 0, False: 0] ------------------ 400| 0| const bool y_mod_2 = (hdr & 0x01) == 1; 401| 0| if(y.get_bit(0) != y_mod_2) { ------------------ | Branch (401:19): [True: 0, False: 0] ------------------ 402| 0| y = p - y; 403| 0| } 404| | 405| 0| return std::make_pair(x, y); 406| 0| } 407| 0| } 408| | 409| 12| throw Decoding_Error("Invalid ECC base point encoding"); 410| 82| }(); _ZN5Botan13EC_Group_DataD2Ev: 28| 2.45k|EC_Group_Data::~EC_Group_Data() = default; _ZN5Botan13EC_Group_DataC2ERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE: 40| 2.45k| m_p(p), 41| 2.45k| m_a(a), 42| 2.45k| m_b(b), 43| 2.45k| m_g_x(g_x), 44| 2.45k| m_g_y(g_y), 45| 2.45k| m_order(order), 46| 2.45k| m_cofactor(cofactor), 47| |#if defined(BOTAN_HAS_LEGACY_EC_POINT) 48| 2.45k| m_mod_field(Barrett_Reduction::for_public_modulus(p)), 49| 2.45k| m_mod_order(Barrett_Reduction::for_public_modulus(order)), 50| 2.45k| m_monty(m_p, m_mod_field), 51| |#endif 52| 2.45k| m_oid(oid), 53| 2.45k| m_p_words(p.sig_words()), 54| 2.45k| m_p_bits(p.bits()), 55| 2.45k| m_order_bits(order.bits()), 56| 2.45k| m_order_bytes((m_order_bits + 7) / 8), 57| 2.45k| m_a_is_minus_3(a == p - 3), 58| 2.45k| m_a_is_zero(a.is_zero()), 59| 2.45k| m_has_cofactor(m_cofactor != 1), 60| 2.45k| m_order_is_less_than_p(m_order < p), 61| 2.45k| m_source(source) { 62| | // Verify the generator (x, y) satisfies y^2 = x^3 + a*x + b (mod p) 63| 2.45k| const auto mod_p = Barrett_Reduction::for_public_modulus(p); 64| 2.45k| const BigInt y2 = mod_p.square(g_y); 65| 2.45k| const BigInt x3_ax_b = mod_p.reduce(mod_p.cube(g_x) + mod_p.multiply(a, g_x) + b); 66| 2.45k| if(y2 != x3_ax_b) { ------------------ | Branch (66:7): [True: 0, False: 2.45k] ------------------ 67| 0| throw Invalid_Argument("EC_Group generator is not on the curve"); 68| 0| } 69| | 70| | // TODO(Botan4) we can assume/assert the OID is set 71| 2.45k| if(!m_oid.empty()) { ------------------ | Branch (71:7): [True: 2.43k, False: 19] ------------------ 72| 2.43k| DER_Encoder der(m_der_named_curve); 73| 2.43k| der.encode(m_oid); 74| | 75| 2.43k| if(const auto name = m_oid.registered_name()) { ------------------ | Branch (75:21): [True: 2.43k, False: 0] ------------------ 76| 2.43k| if(auto pcurve = PCurve::PrimeOrderCurve::for_named_curve(*name)) { ------------------ | Branch (76:18): [True: 1.70k, False: 735] ------------------ 77| 1.70k| const bool same_params = [&]() { 78| 1.70k| if(m_source == EC_Group_Source::Builtin) { 79| 1.70k| return true; 80| 1.70k| } 81| | 82| 1.70k| if(const auto group_oid = OID::from_name(*name)) { 83| 1.70k| if(const auto group_info = EC_Group::EC_group_info(*group_oid)) { 84| 1.70k| return group_info->params_match(p, a, b, g_x, g_y, order, cofactor); 85| 1.70k| } 86| 1.70k| } 87| | 88| 1.70k| return false; 89| 1.70k| }(); 90| | 91| 1.70k| if(same_params) { ------------------ | Branch (91:16): [True: 1.70k, False: 0] ------------------ 92| 1.70k| m_pcurve = std::move(pcurve); 93| 1.70k| } 94| 1.70k| } 95| 2.43k| } 96| 2.43k| if(m_pcurve) { ------------------ | Branch (96:10): [True: 1.70k, False: 735] ------------------ 97| 1.70k| m_engine = EC_Group_Engine::Optimized; 98| 1.70k| } 99| 2.43k| } 100| | 101| | // Try a generic pcurves instance 102| 2.45k| if(!m_pcurve && !m_has_cofactor) { ------------------ | Branch (102:7): [True: 754, False: 1.70k] | Branch (102:20): [True: 739, False: 15] ------------------ 103| 739| m_pcurve = PCurve::PrimeOrderCurve::from_params(p, a, b, g_x, g_y, order); 104| 739| if(m_pcurve) { ------------------ | Branch (104:10): [True: 379, False: 360] ------------------ 105| 379| m_engine = EC_Group_Engine::Generic; 106| 379| } 107| | // possibly still null here, if parameters unsuitable or if the 108| | // pcurves_generic module wasn't included in the build 109| 739| } 110| | 111| 2.45k|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 112| 2.45k| secure_vector ws; 113| 2.45k| m_a_r = m_monty.mul(a, m_monty.R2(), ws); 114| 2.45k| m_b_r = m_monty.mul(b, m_monty.R2(), ws); 115| 2.45k| if(!m_pcurve) { ------------------ | Branch (115:7): [True: 375, False: 2.08k] ------------------ 116| 375| m_engine = EC_Group_Engine::Legacy; 117| 375| } 118| |#else 119| | if(!m_pcurve) { 120| | if(m_oid.empty()) { 121| | throw Not_Implemented("EC_Group this group is not supported in this build configuration"); 122| | } else { 123| | throw Not_Implemented( 124| | fmt("EC_Group the group {} is not supported in this build configuration", oid.to_string())); 125| | } 126| | } 127| |#endif 128| 2.45k|} _ZN5Botan13EC_Group_Data6createERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE: 138| 2.45k| EC_Group_Source source) { 139| 2.45k| auto group = std::make_shared(p, a, b, g_x, g_y, order, cofactor, oid, source); 140| | 141| 2.45k|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 142| 2.45k| group->m_curve = CurveGFp(group.get()); 143| 2.45k| group->m_base_point = EC_Point(group->m_curve, g_x, g_y); 144| 2.45k| if(!group->m_pcurve) { ------------------ | Branch (144:7): [True: 375, False: 2.08k] ------------------ 145| 375| group->m_base_mult = std::make_unique(group->m_base_point, group->m_mod_order); 146| 375| } 147| 2.45k|#endif 148| | 149| 2.45k| return group; 150| 2.45k|} _ZNK5Botan13EC_Group_Data12params_matchERKNS_6BigIntES3_S3_NSt3__14spanIKhLm18446744073709551615EEES3_S3_: 189| 329| const BigInt& cofactor) const { 190| 329| if(p != this->p()) { ------------------ | Branch (190:7): [True: 17, False: 312] ------------------ 191| 17| return false; 192| 17| } 193| 312| if(a != this->a()) { ------------------ | Branch (193:7): [True: 6, False: 306] ------------------ 194| 6| return false; 195| 6| } 196| 306| if(b != this->b()) { ------------------ | Branch (196:7): [True: 3, False: 303] ------------------ 197| 3| return false; 198| 3| } 199| 303| if(order != this->order()) { ------------------ | Branch (199:7): [True: 0, False: 303] ------------------ 200| 0| return false; 201| 0| } 202| 303| if(cofactor != this->cofactor()) { ------------------ | Branch (202:7): [True: 1, False: 302] ------------------ 203| 1| return false; 204| 1| } 205| | 206| 302| const size_t field_len = this->p_bytes(); 207| | 208| 302| if(base_pt.size() == 1 + field_len && (base_pt[0] == 0x02 || base_pt[0] == 0x03)) { ------------------ | Branch (208:7): [True: 0, False: 302] | Branch (208:43): [True: 0, False: 0] | Branch (208:65): [True: 0, False: 0] ------------------ 209| | // compressed 210| | 211| 0| const auto g_x = m_g_x.serialize(field_len); 212| 0| const auto g_y = m_g_y.is_odd(); 213| | 214| 0| const auto sec1_x = base_pt.subspan(1, field_len); 215| 0| const bool sec1_y = (base_pt[0] == 0x03); 216| | 217| 0| if(!std::ranges::equal(sec1_x, g_x)) { ------------------ | Branch (217:10): [True: 0, False: 0] ------------------ 218| 0| return false; 219| 0| } 220| | 221| 0| if(sec1_y != g_y) { ------------------ | Branch (221:10): [True: 0, False: 0] ------------------ 222| 0| return false; 223| 0| } 224| | 225| 0| return true; 226| 302| } else if(base_pt.size() == 1 + 2 * field_len && base_pt[0] == 0x04) { ------------------ | Branch (226:14): [True: 302, False: 0] | Branch (226:53): [True: 301, False: 1] ------------------ 227| 301| const auto g_x = m_g_x.serialize(field_len); 228| 301| const auto g_y = m_g_y.serialize(field_len); 229| | 230| 301| const auto sec1_x = base_pt.subspan(1, field_len); 231| 301| const auto sec1_y = base_pt.subspan(1 + field_len, field_len); 232| | 233| 301| if(!std::ranges::equal(sec1_x, g_x)) { ------------------ | Branch (233:10): [True: 27, False: 274] ------------------ 234| 27| return false; 235| 27| } 236| | 237| 274| if(!std::ranges::equal(sec1_y, g_y)) { ------------------ | Branch (237:10): [True: 19, False: 255] ------------------ 238| 19| return false; 239| 19| } 240| | 241| 255| return true; 242| 274| } else { 243| 1| throw Decoding_Error("Invalid base point encoding in explicit group"); 244| 1| } 245| 302|} _ZNK5Botan13EC_Group_Data10scalar_oneEv: 323| 4|std::unique_ptr EC_Group_Data::scalar_one() const { 324| 4| if(m_pcurve) { ------------------ | Branch (324:7): [True: 4, False: 0] ------------------ 325| 4| return std::make_unique(shared_from_this(), m_pcurve->scalar_one()); 326| 4| } else { 327| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 328| 0| return std::make_unique(shared_from_this(), BigInt::one()); 329| |#else 330| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 331| |#endif 332| 0| } 333| 4|} _ZNK5Botan13EC_Group_Data18scalar_deserializeENSt3__14spanIKhLm18446744073709551615EEE: 375| 2.30k|std::unique_ptr EC_Group_Data::scalar_deserialize(std::span bytes) const { 376| 2.30k| if(bytes.size() != m_order_bytes) { ------------------ | Branch (376:7): [True: 4, False: 2.30k] ------------------ 377| 4| return nullptr; 378| 4| } 379| | 380| 2.30k| if(m_pcurve) { ------------------ | Branch (380:7): [True: 1.96k, False: 337] ------------------ 381| 1.96k| if(auto s = m_pcurve->deserialize_scalar(bytes)) { ------------------ | Branch (381:15): [True: 1.94k, False: 18] ------------------ 382| 1.94k| return std::make_unique(shared_from_this(), *s); 383| 1.94k| } else { 384| 18| return nullptr; 385| 18| } 386| 1.96k| } else { 387| 337|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 388| 337| BigInt r(bytes); 389| | 390| 337| if(r.is_zero() || r >= m_order) { ------------------ | Branch (390:10): [True: 3, False: 334] | Branch (390:25): [True: 0, False: 334] ------------------ 391| 3| return nullptr; 392| 3| } 393| | 394| 334| return std::make_unique(shared_from_this(), std::move(r)); 395| |#else 396| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 397| |#endif 398| 337| } 399| 2.30k|} _ZNK5Botan13EC_Group_Data30point_deserialize_uncompressedENSt3__14spanIKhLm18446744073709551615EEE: 402| 795| std::span bytes) const { 403| 795| if(bytes.size() != 1 + 2 * p_bytes() || bytes[0] != 0x04) { ------------------ | Branch (403:7): [True: 506, False: 289] | Branch (403:44): [True: 13, False: 276] ------------------ 404| 519| return {}; 405| 519| } 406| | 407| 276| if(m_pcurve) { ------------------ | Branch (407:7): [True: 194, False: 82] ------------------ 408| 194| if(auto pt = m_pcurve->deserialize_point_uncompressed(bytes)) { ------------------ | Branch (408:15): [True: 5, False: 189] ------------------ 409| 5| return std::make_unique(shared_from_this(), std::move(*pt)); 410| 189| } else { 411| 189| return {}; 412| 189| } 413| 194| } else { 414| 82|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 415| 82| try { 416| 82| auto pt = Botan::OS2ECP(bytes, m_curve); 417| 82| return std::make_unique(shared_from_this(), std::move(pt)); 418| 82| } catch(...) { 419| 82| return {}; 420| 82| } 421| |#else 422| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 423| |#endif 424| 82| } 425| 276|} _ZNK5Botan13EC_Group_Data28point_deserialize_compressedENSt3__14spanIKhLm18446744073709551615EEE: 427| 790|std::unique_ptr EC_Group_Data::point_deserialize_compressed(std::span bytes) const { 428| 790| if(bytes.size() != 1 + p_bytes() || (bytes[0] != 0x02 && bytes[0] != 0x03)) { ------------------ | Branch (428:7): [True: 441, False: 349] | Branch (428:41): [True: 328, False: 21] | Branch (428:61): [True: 1, False: 327] ------------------ 429| 442| return {}; 430| 442| } 431| | 432| 348| if(m_pcurve) { ------------------ | Branch (432:7): [True: 146, False: 202] ------------------ 433| 146| if(auto pt = m_pcurve->deserialize_point_compressed(bytes)) { ------------------ | Branch (433:15): [True: 76, False: 70] ------------------ 434| 76| return std::make_unique(shared_from_this(), std::move(*pt)); 435| 76| } else { 436| 70| return {}; 437| 70| } 438| 202| } else { 439| 202|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 440| 202| try { 441| 202| auto pt = Botan::OS2ECP(bytes, m_curve); 442| 202| return std::make_unique(shared_from_this(), std::move(pt)); 443| 202| } catch(...) { 444| 94| return {}; 445| 94| } 446| |#else 447| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 448| |#endif 449| 202| } 450| 348|} _ZNK5Botan13EC_Group_Data11point_g_mulERKNS_14EC_Scalar_DataERNS_21RandomNumberGeneratorE: 556| 2.28k| RandomNumberGenerator& rng) const { 557| 2.28k| if(m_pcurve) { ------------------ | Branch (557:7): [True: 1.95k, False: 334] ------------------ 558| 1.95k| const auto& k = EC_Scalar_Data_PC::checked_ref(scalar); 559| 1.95k| auto pt = m_pcurve->point_to_affine(m_pcurve->mul_by_g(k.value(), rng)); 560| 1.95k| return std::make_unique(shared_from_this(), std::move(pt)); 561| 1.95k| } else { 562| 334|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 563| 334| const auto& group = scalar.group(); 564| 334| const auto& bn = EC_Scalar_Data_BN::checked_ref(scalar); 565| | 566| 334| BOTAN_STATE_CHECK(group->m_base_mult != nullptr); ------------------ | | 51| 334| do { \ | | 52| 334| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 334| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 334] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 334| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 334] | | ------------------ ------------------ 567| 334| std::vector ws; 568| 334| auto pt = group->m_base_mult->mul(bn.value(), rng, m_order, ws); 569| 334| return std::make_unique(shared_from_this(), std::move(pt)); 570| |#else 571| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 572| |#endif 573| 334| } 574| 2.28k|} _ZNK5Botan13EC_Group_Data10affine_negERKNS_19EC_AffinePoint_DataE: 638| 4|std::unique_ptr EC_Group_Data::affine_neg(const EC_AffinePoint_Data& p) const { 639| 4| if(m_pcurve) { ------------------ | Branch (639:7): [True: 4, False: 0] ------------------ 640| 4| const auto pt = m_pcurve->point_negate(EC_AffinePoint_Data_PC::checked_ref(p).value()); 641| 4| return std::make_unique(shared_from_this(), pt); 642| 4| } else { 643| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 644| 0| auto pt = p.to_legacy_point(); 645| 0| pt.negate(); // negates in place 646| 0| return std::make_unique(shared_from_this(), std::move(pt)); 647| |#else 648| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 649| |#endif 650| 0| } 651| 4|} ec_inner_data.cpp:_ZZN5Botan13EC_Group_DataC1ERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceEENK3$_0clEv: 77| 1.70k| const bool same_params = [&]() { 78| 1.70k| if(m_source == EC_Group_Source::Builtin) { ------------------ | Branch (78:19): [True: 1.70k, False: 0] ------------------ 79| 1.70k| return true; 80| 1.70k| } 81| | 82| 0| if(const auto group_oid = OID::from_name(*name)) { ------------------ | Branch (82:30): [True: 0, False: 0] ------------------ 83| 0| if(const auto group_info = EC_Group::EC_group_info(*group_oid)) { ------------------ | Branch (83:33): [True: 0, False: 0] ------------------ 84| 0| return group_info->params_match(p, a, b, g_x, g_y, order, cofactor); 85| 0| } 86| 0| } 87| | 88| 0| return false; 89| 0| }(); _ZN5Botan17EC_Scalar_Data_PC11checked_refERKNS_14EC_Scalar_DataE: 14| 1.95k|const EC_Scalar_Data_PC& EC_Scalar_Data_PC::checked_ref(const EC_Scalar_Data& data) { 15| 1.95k| const auto* p = dynamic_cast(&data); 16| 1.95k| if(p == nullptr) { ------------------ | Branch (16:7): [True: 0, False: 1.95k] ------------------ 17| 0| throw Invalid_State("Failed conversion to EC_Scalar_Data_PC"); 18| 0| } 19| 1.95k| return *p; 20| 1.95k|} _ZNK5Botan17EC_Scalar_Data_PC5groupEv: 22| 9.74k|const std::shared_ptr& EC_Scalar_Data_PC::group() const { 23| 9.74k| return m_group; 24| 9.74k|} _ZNK5Botan17EC_Scalar_Data_PC5bytesEv: 26| 1.94k|size_t EC_Scalar_Data_PC::bytes() const { 27| 1.94k| return this->group()->order_bytes(); 28| 1.94k|} _ZNK5Botan17EC_Scalar_Data_PC5cloneEv: 30| 1.94k|std::unique_ptr EC_Scalar_Data_PC::clone() const { 31| 1.94k| return std::make_unique(this->group(), this->value()); 32| 1.94k|} _ZNK5Botan17EC_Scalar_Data_PC7is_zeroEv: 34| 1.94k|bool EC_Scalar_Data_PC::is_zero() const { 35| 1.94k| const auto& pcurve = this->group()->pcurve(); 36| 1.94k| return pcurve.scalar_is_zero(m_v); 37| 1.94k|} _ZN5Botan17EC_Scalar_Data_PC7zeroizeEv: 49| 1.94k|void EC_Scalar_Data_PC::zeroize() { 50| 1.94k| m_v._zeroize(); 51| 1.94k|} _ZNK5Botan17EC_Scalar_Data_PC6negateEv: 58| 4|std::unique_ptr EC_Scalar_Data_PC::negate() const { 59| 4| return std::make_unique(m_group, m_group->pcurve().scalar_negate(m_v)); 60| 4|} _ZNK5Botan17EC_Scalar_Data_PC12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 82| 1.94k|void EC_Scalar_Data_PC::serialize_to(std::span bytes) const { 83| 1.94k| BOTAN_ARG_CHECK(bytes.size() == m_group->order_bytes(), "Invalid output length"); ------------------ | | 35| 1.94k| do { \ | | 36| 1.94k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 1.94k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 1.94k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 1.94k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 1.94k] | | ------------------ ------------------ 84| 1.94k| m_group->pcurve().serialize_scalar(bytes, m_v); 85| 1.94k|} _ZN5Botan22EC_AffinePoint_Data_PCC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEENS_6PCurve15PrimeOrderCurve11AffinePointE: 89| 2.03k| m_group(std::move(group)), m_pt(std::move(pt)) { 90| 2.03k| const auto& pcurve = m_group->pcurve(); 91| | 92| 2.03k| if(!pcurve.affine_point_is_identity(m_pt)) { ------------------ | Branch (92:7): [True: 2.03k, False: 0] ------------------ 93| 2.03k| m_xy.resize(1 + 2 * field_element_bytes()); 94| 2.03k| pcurve.serialize_point(m_xy, m_pt); 95| 2.03k| } 96| 2.03k|} _ZN5Botan22EC_AffinePoint_Data_PC11checked_refERKNS_19EC_AffinePoint_DataE: 98| 4|const EC_AffinePoint_Data_PC& EC_AffinePoint_Data_PC::checked_ref(const EC_AffinePoint_Data& data) { 99| 4| const auto* p = dynamic_cast(&data); 100| 4| if(p == nullptr) { ------------------ | Branch (100:7): [True: 0, False: 4] ------------------ 101| 0| throw Invalid_State("Failed conversion to EC_AffinePoint_Data_PC"); 102| 0| } 103| 4| return *p; 104| 4|} _ZNK5Botan22EC_AffinePoint_Data_PC5groupEv: 110| 2.19k|const std::shared_ptr& EC_AffinePoint_Data_PC::group() const { 111| 2.19k| return m_group; 112| 2.19k|} _ZNK5Botan22EC_AffinePoint_Data_PC19field_element_bytesEv: 130| 4.38k|size_t EC_AffinePoint_Data_PC::field_element_bytes() const { 131| 4.38k| return m_group->pcurve().field_element_bytes(); 132| 4.38k|} _ZNK5Botan22EC_AffinePoint_Data_PC11is_identityEv: 134| 4.53k|bool EC_AffinePoint_Data_PC::is_identity() const { 135| 4.53k| return m_xy.empty(); 136| 4.53k|} _ZNK5Botan22EC_AffinePoint_Data_PC25serialize_uncompressed_toENSt3__14spanIhLm18446744073709551615EEE: 170| 162|void EC_AffinePoint_Data_PC::serialize_uncompressed_to(std::span bytes) const { 171| 162| BOTAN_STATE_CHECK(!this->is_identity()); ------------------ | | 51| 162| do { \ | | 52| 162| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 162| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 162] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 162| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 162] | | ------------------ ------------------ 172| 162| const size_t fe_bytes = this->field_element_bytes(); 173| 162| BOTAN_ARG_CHECK(bytes.size() == 1 + 2 * fe_bytes, "Invalid output size"); ------------------ | | 35| 162| do { \ | | 36| 162| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 162| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 162] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 162| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 162] | | ------------------ ------------------ 174| 162| copy_mem(bytes, m_xy); 175| 162|} _ZNK5Botan22EC_AffinePoint_Data_PC15to_legacy_pointEv: 178| 2.02k|EC_Point EC_AffinePoint_Data_PC::to_legacy_point() const { 179| 2.02k| if(this->is_identity()) { ------------------ | Branch (179:7): [True: 0, False: 2.02k] ------------------ 180| 0| return EC_Point(m_group->curve()); 181| 2.02k| } else { 182| 2.02k| const size_t fe_bytes = this->field_element_bytes(); 183| 2.02k| return EC_Point(m_group->curve(), 184| 2.02k| BigInt::from_bytes(std::span{m_xy}.subspan(1, fe_bytes)), 185| 2.02k| BigInt::from_bytes(std::span{m_xy}.last(fe_bytes))); 186| 2.02k| } 187| 2.02k|} _ZN5Botan8EC_Group13EC_group_infoERKNS_3OIDE: 16| 2.54k|std::shared_ptr EC_Group::EC_group_info(const OID& oid) { 17| | // secp256r1 18| 2.54k| if(oid == OID{1, 2, 840, 10045, 3, 1, 7}) { ------------------ | Branch (18:7): [True: 226, False: 2.32k] ------------------ 19| 226| return load_EC_group_info( 20| 226| "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", 21| 226| "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", 22| 226| "0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", 23| 226| "0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296", 24| 226| "0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", 25| 226| "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551", 26| 226| oid); 27| 226| } 28| | 29| | // secp384r1 30| 2.32k| if(oid == OID{1, 3, 132, 0, 34}) { ------------------ | Branch (30:7): [True: 201, False: 2.11k] ------------------ 31| 201| return load_EC_group_info( 32| 201| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF", 33| 201| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC", 34| 201| "0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF", 35| 201| "0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7", 36| 201| "0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F", 37| 201| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973", 38| 201| oid); 39| 201| } 40| | 41| | // secp521r1 42| 2.11k| if(oid == OID{1, 3, 132, 0, 35}) { ------------------ | Branch (42:7): [True: 283, False: 1.83k] ------------------ 43| 283| return load_EC_group_info( 44| 283| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", 45| 283| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC", 46| 283| "0x51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00", 47| 283| "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66", 48| 283| "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650", 49| 283| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409", 50| 283| oid); 51| 283| } 52| | 53| | // brainpool160r1 54| 1.83k| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 1}) { ------------------ | Branch (54:7): [True: 60, False: 1.77k] ------------------ 55| 60| return load_EC_group_info( 56| 60| "0xE95E4A5F737059DC60DFC7AD95B3D8139515620F", 57| 60| "0x340E7BE2A280EB74E2BE61BADA745D97E8F7C300", 58| 60| "0x1E589A8595423412134FAA2DBDEC95C8D8675E58", 59| 60| "0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3", 60| 60| "0x1667CB477A1A8EC338F94741669C976316DA6321", 61| 60| "0xE95E4A5F737059DC60DF5991D45029409E60FC09", 62| 60| oid); 63| 60| } 64| | 65| | // brainpool192r1 66| 1.77k| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 3}) { ------------------ | Branch (66:7): [True: 3, False: 1.77k] ------------------ 67| 3| return load_EC_group_info( 68| 3| "0xC302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297", 69| 3| "0x6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF", 70| 3| "0x469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9", 71| 3| "0xC0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6", 72| 3| "0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F", 73| 3| "0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1", 74| 3| oid); 75| 3| } 76| | 77| | // brainpool224r1 78| 1.77k| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 5}) { ------------------ | Branch (78:7): [True: 74, False: 1.69k] ------------------ 79| 74| return load_EC_group_info( 80| 74| "0xD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF", 81| 74| "0x68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43", 82| 74| "0x2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B", 83| 74| "0xD9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D", 84| 74| "0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD", 85| 74| "0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F", 86| 74| oid); 87| 74| } 88| | 89| | // brainpool256r1 90| 1.69k| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 7}) { ------------------ | Branch (90:7): [True: 176, False: 1.52k] ------------------ 91| 176| return load_EC_group_info( 92| 176| "0xA9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", 93| 176| "0x7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", 94| 176| "0x26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", 95| 176| "0x8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262", 96| 176| "0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", 97| 176| "0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7", 98| 176| oid); 99| 176| } 100| | 101| | // brainpool320r1 102| 1.52k| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 9}) { ------------------ | Branch (102:7): [True: 61, False: 1.46k] ------------------ 103| 61| return load_EC_group_info( 104| 61| "0xD35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27", 105| 61| "0x3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4", 106| 61| "0x520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6", 107| 61| "0x43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611", 108| 61| "0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1", 109| 61| "0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311", 110| 61| oid); 111| 61| } 112| | 113| | // brainpool384r1 114| 1.46k| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 11}) { ------------------ | Branch (114:7): [True: 152, False: 1.31k] ------------------ 115| 152| return load_EC_group_info( 116| 152| "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53", 117| 152| "0x7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826", 118| 152| "0x4A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11", 119| 152| "0x1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E", 120| 152| "0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315", 121| 152| "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565", 122| 152| oid); 123| 152| } 124| | 125| | // brainpool512r1 126| 1.31k| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 13}) { ------------------ | Branch (126:7): [True: 137, False: 1.17k] ------------------ 127| 137| return load_EC_group_info( 128| 137| "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3", 129| 137| "0x7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA", 130| 137| "0x3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723", 131| 137| "0x81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822", 132| 137| "0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892", 133| 137| "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069", 134| 137| oid); 135| 137| } 136| | 137| | // frp256v1 138| 1.17k| if(oid == OID{1, 2, 250, 1, 223, 101, 256, 1}) { ------------------ | Branch (138:7): [True: 0, False: 1.17k] ------------------ 139| 0| return load_EC_group_info( 140| 0| "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C03", 141| 0| "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C00", 142| 0| "0xEE353FCA5428A9300D4ABA754A44C00FDFEC0C9AE4B1A1803075ED967B7BB73F", 143| 0| "0xB6B3D4C356C139EB31183D4749D423958C27D2DCAF98B70164C97A2DD98F5CFF", 144| 0| "0x6142E0F7C8B204911F9271F0F3ECEF8C2701C307E8E4C9E183115A1554062CFB", 145| 0| "0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1", 146| 0| oid); 147| 0| } 148| | 149| | // gost_256A 150| 1.17k| if(oid == OID{1, 2, 643, 7, 1, 2, 1, 1, 1} || oid == OID{1, 2, 643, 2, 2, 35, 1} || oid == OID{1, 2, 643, 2, 2, 36, 0}) { ------------------ | Branch (150:7): [True: 0, False: 1.17k] | Branch (150:7): [True: 0, False: 1.17k] | Branch (150:50): [True: 0, False: 1.17k] | Branch (150:88): [True: 0, False: 1.17k] ------------------ 151| 0| return load_EC_group_info( 152| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97", 153| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94", 154| 0| "0xA6", 155| 0| "0x1", 156| 0| "0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14", 157| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893", 158| 0| OID{1, 2, 643, 7, 1, 2, 1, 1, 1}); 159| 0| } 160| | 161| | // gost_512A 162| 1.17k| if(oid == OID{1, 2, 643, 7, 1, 2, 1, 2, 1}) { ------------------ | Branch (162:7): [True: 0, False: 1.17k] ------------------ 163| 0| return load_EC_group_info( 164| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7", 165| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4", 166| 0| "0xE8C2505DEDFC86DDC1BD0B2B6667F1DA34B82574761CB0E879BD081CFD0B6265EE3CB090F30D27614CB4574010DA90DD862EF9D4EBEE4761503190785A71C760", 167| 0| "0x3", 168| 0| "0x7503CFE87A836AE3A61B8816E25450E6CE5E1C93ACF1ABC1778064FDCBEFA921DF1626BE4FD036E93D75E6A50E3A41E98028FE5FC235F5B889A589CB5215F2A4", 169| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2B85DCACDB1411F10B275", 170| 0| oid); 171| 0| } 172| | 173| | // secp160k1 174| 1.17k| if(oid == OID{1, 3, 132, 0, 9}) { ------------------ | Branch (174:7): [True: 15, False: 1.15k] ------------------ 175| 15| return load_EC_group_info( 176| 15| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", 177| 15| "0x0", 178| 15| "0x7", 179| 15| "0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB", 180| 15| "0x938CF935318FDCED6BC28286531733C3F03C4FEE", 181| 15| "0x100000000000000000001B8FA16DFAB9ACA16B6B3", 182| 15| oid); 183| 15| } 184| | 185| | // secp160r1 186| 1.15k| if(oid == OID{1, 3, 132, 0, 8}) { ------------------ | Branch (186:7): [True: 13, False: 1.14k] ------------------ 187| 13| return load_EC_group_info( 188| 13| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF", 189| 13| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC", 190| 13| "0x1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45", 191| 13| "0x4A96B5688EF573284664698968C38BB913CBFC82", 192| 13| "0x23A628553168947D59DCC912042351377AC5FB32", 193| 13| "0x100000000000000000001F4C8F927AED3CA752257", 194| 13| oid); 195| 13| } 196| | 197| | // secp160r2 198| 1.14k| if(oid == OID{1, 3, 132, 0, 30}) { ------------------ | Branch (198:7): [True: 24, False: 1.12k] ------------------ 199| 24| return load_EC_group_info( 200| 24| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", 201| 24| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70", 202| 24| "0xB4E134D3FB59EB8BAB57274904664D5AF50388BA", 203| 24| "0x52DCB034293A117E1F4FF11B30F7199D3144CE6D", 204| 24| "0xFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E", 205| 24| "0x100000000000000000000351EE786A818F3A1A16B", 206| 24| oid); 207| 24| } 208| | 209| | // secp192k1 210| 1.12k| if(oid == OID{1, 3, 132, 0, 31}) { ------------------ | Branch (210:7): [True: 177, False: 944] ------------------ 211| 177| return load_EC_group_info( 212| 177| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37", 213| 177| "0x0", 214| 177| "0x3", 215| 177| "0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D", 216| 177| "0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D", 217| 177| "0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D", 218| 177| oid); 219| 177| } 220| | 221| | // secp192r1 222| 944| if(oid == OID{1, 2, 840, 10045, 3, 1, 1}) { ------------------ | Branch (222:7): [True: 0, False: 944] ------------------ 223| 0| return load_EC_group_info( 224| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 225| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 226| 0| "0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1", 227| 0| "0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012", 228| 0| "0x7192B95FFC8DA78631011ED6B24CDD573F977A11E794811", 229| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831", 230| 0| oid); 231| 0| } 232| | 233| | // secp224k1 234| 944| if(oid == OID{1, 3, 132, 0, 32}) { ------------------ | Branch (234:7): [True: 308, False: 636] ------------------ 235| 308| return load_EC_group_info( 236| 308| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D", 237| 308| "0x0", 238| 308| "0x5", 239| 308| "0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C", 240| 308| "0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5", 241| 308| "0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7", 242| 308| oid); 243| 308| } 244| | 245| | // secp224r1 246| 636| if(oid == OID{1, 3, 132, 0, 33}) { ------------------ | Branch (246:7): [True: 333, False: 303] ------------------ 247| 333| return load_EC_group_info( 248| 333| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001", 249| 333| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE", 250| 333| "0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4", 251| 333| "0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21", 252| 333| "0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34", 253| 333| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D", 254| 333| oid); 255| 333| } 256| | 257| | // secp256k1 258| 303| if(oid == OID{1, 3, 132, 0, 10}) { ------------------ | Branch (258:7): [True: 194, False: 109] ------------------ 259| 194| return load_EC_group_info( 260| 194| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F", 261| 194| "0x0", 262| 194| "0x7", 263| 194| "0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", 264| 194| "0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", 265| 194| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", 266| 194| oid); 267| 194| } 268| | 269| | // sm2p256v1 270| 109| if(oid == OID{1, 2, 156, 10197, 1, 301}) { ------------------ | Branch (270:7): [True: 0, False: 109] ------------------ 271| 0| return load_EC_group_info( 272| 0| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF", 273| 0| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC", 274| 0| "0x28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93", 275| 0| "0x32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7", 276| 0| "0xBC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0", 277| 0| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123", 278| 0| oid); 279| 0| } 280| | 281| | // x962_p192v2 282| 109| if(oid == OID{1, 2, 840, 10045, 3, 1, 2}) { ------------------ | Branch (282:7): [True: 0, False: 109] ------------------ 283| 0| return load_EC_group_info( 284| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 285| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 286| 0| "0xCC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953", 287| 0| "0xEEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A", 288| 0| "0x6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15", 289| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31", 290| 0| oid); 291| 0| } 292| | 293| | // x962_p192v3 294| 109| if(oid == OID{1, 2, 840, 10045, 3, 1, 3}) { ------------------ | Branch (294:7): [True: 0, False: 109] ------------------ 295| 0| return load_EC_group_info( 296| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 297| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 298| 0| "0x22123DC2395A05CAA7423DAECCC94760A7D462256BD56916", 299| 0| "0x7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896", 300| 0| "0x38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0", 301| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13", 302| 0| oid); 303| 0| } 304| | 305| | // x962_p239v1 306| 109| if(oid == OID{1, 2, 840, 10045, 3, 1, 4}) { ------------------ | Branch (306:7): [True: 0, False: 109] ------------------ 307| 0| return load_EC_group_info( 308| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 309| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 310| 0| "0x6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A", 311| 0| "0xFFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF", 312| 0| "0x7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE", 313| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B", 314| 0| oid); 315| 0| } 316| | 317| | // x962_p239v2 318| 109| if(oid == OID{1, 2, 840, 10045, 3, 1, 5}) { ------------------ | Branch (318:7): [True: 0, False: 109] ------------------ 319| 0| return load_EC_group_info( 320| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 321| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 322| 0| "0x617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C", 323| 0| "0x38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7", 324| 0| "0x5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA", 325| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063", 326| 0| oid); 327| 0| } 328| | 329| | // x962_p239v3 330| 109| if(oid == OID{1, 2, 840, 10045, 3, 1, 6}) { ------------------ | Branch (330:7): [True: 0, False: 109] ------------------ 331| 0| return load_EC_group_info( 332| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 333| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 334| 0| "0x255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E", 335| 0| "0x6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A", 336| 0| "0x1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3", 337| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551", 338| 0| oid); 339| 0| } 340| | 341| | // numsp512d1 342| 109| if(oid == OID{1, 3, 6, 1, 4, 1, 25258, 4, 3}) { ------------------ | Branch (342:7): [True: 0, False: 109] ------------------ 343| 0| return load_EC_group_info( 344| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7", 345| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4", 346| 0| "0x1D99B", 347| 0| "0x2", 348| 0| "0x1C282EB23327F9711952C250EA61AD53FCC13031CF6DD336E0B9328433AFBDD8CC5A1C1F0C716FDC724DDE537C2B0ADB00BB3D08DC83755B205CC30D7F83CF28", 349| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5B3CA4FB94E7831B4FC258ED97D0BDC63B568B36607CD243CE153F390433555D", 350| 0| oid); 351| 0| } 352| | 353| 109| return std::shared_ptr(); 354| 109|} _ZN5Botan8EC_Group28EC_group_identity_from_orderERKNS_6BigIntE: 358| 886| { 359| 886| const uint32_t low_bits = static_cast(order.word_at(0)); 360| | 361| 886| if(low_bits == 0xFC632551 && order == BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551")) { ------------------ | Branch (361:7): [True: 246, False: 640] | Branch (361:7): [True: 226, False: 660] | Branch (361:33): [True: 226, False: 20] ------------------ 362| 226| return OID{1, 2, 840, 10045, 3, 1, 7}; 363| 226| } 364| | 365| 660| if(low_bits == 0xCCC52973 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973")) { ------------------ | Branch (365:7): [True: 1, False: 659] | Branch (365:7): [True: 0, False: 660] | Branch (365:33): [True: 0, False: 1] ------------------ 366| 0| return OID{1, 3, 132, 0, 34}; 367| 0| } 368| | 369| 660| if(low_bits == 0x91386409 && order == BigInt("0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409")) { ------------------ | Branch (369:7): [True: 119, False: 541] | Branch (369:7): [True: 103, False: 557] | Branch (369:33): [True: 103, False: 16] ------------------ 370| 103| return OID{1, 3, 132, 0, 35}; 371| 103| } 372| | 373| 557| if(low_bits == 0x9E60FC09 && order == BigInt("0xE95E4A5F737059DC60DF5991D45029409E60FC09")) { ------------------ | Branch (373:7): [True: 0, False: 557] | Branch (373:7): [True: 0, False: 557] | Branch (373:33): [True: 0, False: 0] ------------------ 374| 0| return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 1}; 375| 0| } 376| | 377| 557| if(low_bits == 0x9AC4ACC1 && order == BigInt("0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1")) { ------------------ | Branch (377:7): [True: 0, False: 557] | Branch (377:7): [True: 0, False: 557] | Branch (377:33): [True: 0, False: 0] ------------------ 378| 0| return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 3}; 379| 0| } 380| | 381| 557| if(low_bits == 0xA5A7939F && order == BigInt("0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F")) { ------------------ | Branch (381:7): [True: 2, False: 555] | Branch (381:7): [True: 0, False: 557] | Branch (381:33): [True: 0, False: 2] ------------------ 382| 0| return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 5}; 383| 0| } 384| | 385| 557| if(low_bits == 0x974856A7 && order == BigInt("0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7")) { ------------------ | Branch (385:7): [True: 2, False: 555] | Branch (385:7): [True: 0, False: 557] | Branch (385:33): [True: 0, False: 2] ------------------ 386| 0| return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 7}; 387| 0| } 388| | 389| 557| if(low_bits == 0x44C59311 && order == BigInt("0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311")) { ------------------ | Branch (389:7): [True: 1, False: 556] | Branch (389:7): [True: 0, False: 557] | Branch (389:33): [True: 0, False: 1] ------------------ 390| 0| return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 9}; 391| 0| } 392| | 393| 557| if(low_bits == 0xE9046565 && order == BigInt("0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565")) { ------------------ | Branch (393:7): [True: 1, False: 556] | Branch (393:7): [True: 0, False: 557] | Branch (393:33): [True: 0, False: 1] ------------------ 394| 0| return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 11}; 395| 0| } 396| | 397| 557| if(low_bits == 0x9CA90069 && order == BigInt("0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069")) { ------------------ | Branch (397:7): [True: 1, False: 556] | Branch (397:7): [True: 0, False: 557] | Branch (397:33): [True: 0, False: 1] ------------------ 398| 0| return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 13}; 399| 0| } 400| | 401| 557| if(low_bits == 0xC6D655E1 && order == BigInt("0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1")) { ------------------ | Branch (401:7): [True: 1, False: 556] | Branch (401:7): [True: 0, False: 557] | Branch (401:33): [True: 0, False: 1] ------------------ 402| 0| return OID{1, 2, 250, 1, 223, 101, 256, 1}; 403| 0| } 404| | 405| 557| if(low_bits == 0xB761B893 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893")) { ------------------ | Branch (405:7): [True: 0, False: 557] | Branch (405:7): [True: 0, False: 557] | Branch (405:33): [True: 0, False: 0] ------------------ 406| 0| return OID{1, 2, 643, 7, 1, 2, 1, 1, 1}; 407| 0| } 408| | 409| 557| if(low_bits == 0x1F10B275 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2B85DCACDB1411F10B275")) { ------------------ | Branch (409:7): [True: 1, False: 556] | Branch (409:7): [True: 0, False: 557] | Branch (409:33): [True: 0, False: 1] ------------------ 410| 0| return OID{1, 2, 643, 7, 1, 2, 1, 2, 1}; 411| 0| } 412| | 413| 557| if(low_bits == 0xCA16B6B3 && order == BigInt("0x100000000000000000001B8FA16DFAB9ACA16B6B3")) { ------------------ | Branch (413:7): [True: 0, False: 557] | Branch (413:7): [True: 0, False: 557] | Branch (413:33): [True: 0, False: 0] ------------------ 414| 0| return OID{1, 3, 132, 0, 9}; 415| 0| } 416| | 417| 557| if(low_bits == 0xCA752257 && order == BigInt("0x100000000000000000001F4C8F927AED3CA752257")) { ------------------ | Branch (417:7): [True: 0, False: 557] | Branch (417:7): [True: 0, False: 557] | Branch (417:33): [True: 0, False: 0] ------------------ 418| 0| return OID{1, 3, 132, 0, 8}; 419| 0| } 420| | 421| 557| if(low_bits == 0xF3A1A16B && order == BigInt("0x100000000000000000000351EE786A818F3A1A16B")) { ------------------ | Branch (421:7): [True: 2, False: 555] | Branch (421:7): [True: 0, False: 557] | Branch (421:33): [True: 0, False: 2] ------------------ 422| 0| return OID{1, 3, 132, 0, 30}; 423| 0| } 424| | 425| 557| if(low_bits == 0x74DEFD8D && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D")) { ------------------ | Branch (425:7): [True: 1, False: 556] | Branch (425:7): [True: 0, False: 557] | Branch (425:33): [True: 0, False: 1] ------------------ 426| 0| return OID{1, 3, 132, 0, 31}; 427| 0| } 428| | 429| 557| if(low_bits == 0xB4D22831 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831")) { ------------------ | Branch (429:7): [True: 1, False: 556] | Branch (429:7): [True: 0, False: 557] | Branch (429:33): [True: 0, False: 1] ------------------ 430| 0| return OID{1, 2, 840, 10045, 3, 1, 1}; 431| 0| } 432| | 433| 557| if(low_bits == 0x769FB1F7 && order == BigInt("0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7")) { ------------------ | Branch (433:7): [True: 2, False: 555] | Branch (433:7): [True: 0, False: 557] | Branch (433:33): [True: 0, False: 2] ------------------ 434| 0| return OID{1, 3, 132, 0, 32}; 435| 0| } 436| | 437| 557| if(low_bits == 0x5C5C2A3D && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D")) { ------------------ | Branch (437:7): [True: 1, False: 556] | Branch (437:7): [True: 0, False: 557] | Branch (437:33): [True: 0, False: 1] ------------------ 438| 0| return OID{1, 3, 132, 0, 33}; 439| 0| } 440| | 441| 557| if(low_bits == 0xD0364141 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141")) { ------------------ | Branch (441:7): [True: 3, False: 554] | Branch (441:7): [True: 0, False: 557] | Branch (441:33): [True: 0, False: 3] ------------------ 442| 0| return OID{1, 3, 132, 0, 10}; 443| 0| } 444| | 445| 557| if(low_bits == 0x39D54123 && order == BigInt("0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123")) { ------------------ | Branch (445:7): [True: 1, False: 556] | Branch (445:7): [True: 0, False: 557] | Branch (445:33): [True: 0, False: 1] ------------------ 446| 0| return OID{1, 2, 156, 10197, 1, 301}; 447| 0| } 448| | 449| 557| if(low_bits == 0x48D8DD31 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31")) { ------------------ | Branch (449:7): [True: 1, False: 556] | Branch (449:7): [True: 0, False: 557] | Branch (449:33): [True: 0, False: 1] ------------------ 450| 0| return OID{1, 2, 840, 10045, 3, 1, 2}; 451| 0| } 452| | 453| 557| if(low_bits == 0xF640EC13 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13")) { ------------------ | Branch (453:7): [True: 1, False: 556] | Branch (453:7): [True: 0, False: 557] | Branch (453:33): [True: 0, False: 1] ------------------ 454| 0| return OID{1, 2, 840, 10045, 3, 1, 3}; 455| 0| } 456| | 457| 557| if(low_bits == 0x88909D0B && order == BigInt("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B")) { ------------------ | Branch (457:7): [True: 1, False: 556] | Branch (457:7): [True: 0, False: 557] | Branch (457:33): [True: 0, False: 1] ------------------ 458| 0| return OID{1, 2, 840, 10045, 3, 1, 4}; 459| 0| } 460| | 461| 557| if(low_bits == 0xBC582063 && order == BigInt("0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063")) { ------------------ | Branch (461:7): [True: 1, False: 556] | Branch (461:7): [True: 0, False: 557] | Branch (461:33): [True: 0, False: 1] ------------------ 462| 0| return OID{1, 2, 840, 10045, 3, 1, 5}; 463| 0| } 464| | 465| 557| if(low_bits == 0x46526551 && order == BigInt("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551")) { ------------------ | Branch (465:7): [True: 1, False: 556] | Branch (465:7): [True: 0, False: 557] | Branch (465:33): [True: 0, False: 1] ------------------ 466| 0| return OID{1, 2, 840, 10045, 3, 1, 6}; 467| 0| } 468| | 469| 557| if(low_bits == 0x0433555D && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5B3CA4FB94E7831B4FC258ED97D0BDC63B568B36607CD243CE153F390433555D")) { ------------------ | Branch (469:7): [True: 1, False: 556] | Branch (469:7): [True: 0, False: 557] | Branch (469:33): [True: 0, False: 1] ------------------ 470| 0| return OID{1, 3, 6, 1, 4, 1, 25258, 4, 3}; 471| 0| } 472| | 473| 557| return OID(); 474| 557|} _ZN5Botan9EC_ScalarC2ENSt3__110unique_ptrINS_14EC_Scalar_DataENS1_14default_deleteIS3_EEEE: 19| 2.29k|EC_Scalar::EC_Scalar(std::unique_ptr scalar) : m_scalar(std::move(scalar)) { 20| 2.29k| BOTAN_ASSERT_NONNULL(m_scalar); ------------------ | | 123| 2.29k| do { \ | | 124| 2.29k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 2.29k] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 2.29k| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 2.29k] | | ------------------ ------------------ 21| 2.29k|} _ZN5Botan9EC_ScalarC2ERKS0_: 23| 2.28k|EC_Scalar::EC_Scalar(const EC_Scalar& other) : m_scalar(other.inner().clone()) {} _ZN5Botan9EC_ScalarC2EOS0_: 25| 4.56k|EC_Scalar::EC_Scalar(EC_Scalar&& other) noexcept : m_scalar(std::move(other.m_scalar)) {} _ZN5Botan9EC_ScalarD2Ev: 46| 9.13k|EC_Scalar::~EC_Scalar() = default; _ZNK5Botan9EC_Scalar5groupEv: 48| 2.28k|EC_Group EC_Scalar::group() const { 49| 2.28k| return EC_Group(inner().group()); 50| 2.28k|} _ZN5Botan9EC_Scalar3oneERKNS_8EC_GroupE: 72| 4|EC_Scalar EC_Scalar::one(const EC_Group& group) { 73| 4| return EC_Scalar(group._data()->scalar_one()); 74| 4|} _ZNK5Botan9EC_Scalar9to_bigintEv: 84| 2.28k|BigInt EC_Scalar::to_bigint() const { 85| 2.28k| secure_vector bytes(m_scalar->bytes()); 86| 2.28k| m_scalar->serialize_to(bytes); 87| 2.28k| return BigInt::from_bytes(bytes); 88| 2.28k|} _ZN5Botan9EC_Scalar11deserializeERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 126| 2.30k|std::optional EC_Scalar::deserialize(const EC_Group& group, std::span bytes) { 127| 2.30k| if(auto v = group._data()->scalar_deserialize(bytes)) { ------------------ | Branch (127:12): [True: 2.28k, False: 25] ------------------ 128| 2.28k| return EC_Scalar(std::move(v)); 129| 2.28k| } else { 130| 25| return {}; 131| 25| } 132| 2.30k|} _ZNK5Botan9EC_Scalar7is_zeroEv: 141| 2.28k|bool EC_Scalar::is_zero() const { 142| 2.28k| return inner().is_zero(); 143| 2.28k|} _ZNK5Botan9EC_Scalar6negateEv: 153| 4|EC_Scalar EC_Scalar::negate() const { 154| 4| return EC_Scalar(inner().negate()); 155| 4|} _ZN5Botan9EC_Scalar7zeroizeEv: 186| 2.28k|void EC_Scalar::zeroize() { 187| 2.28k| m_scalar->zeroize(); 188| 2.28k|} _ZN5Botan17EC_Scalar_Data_BN11checked_refERKNS_14EC_Scalar_DataE: 15| 334|const EC_Scalar_Data_BN& EC_Scalar_Data_BN::checked_ref(const EC_Scalar_Data& data) { 16| 334| const auto* p = dynamic_cast(&data); 17| 334| if(p == nullptr) { ------------------ | Branch (17:7): [True: 0, False: 334] ------------------ 18| 0| throw Invalid_State("Failed conversion to EC_Scalar_Data_BN"); 19| 0| } 20| 334| return *p; 21| 334|} _ZNK5Botan17EC_Scalar_Data_BN5groupEv: 23| 1.67k|const std::shared_ptr& EC_Scalar_Data_BN::group() const { 24| 1.67k| return m_group; 25| 1.67k|} _ZNK5Botan17EC_Scalar_Data_BN5bytesEv: 27| 334|size_t EC_Scalar_Data_BN::bytes() const { 28| 334| return this->group()->order_bytes(); 29| 334|} _ZNK5Botan17EC_Scalar_Data_BN5cloneEv: 31| 334|std::unique_ptr EC_Scalar_Data_BN::clone() const { 32| 334| return std::make_unique(this->group(), this->value()); 33| 334|} _ZNK5Botan17EC_Scalar_Data_BN7is_zeroEv: 35| 334|bool EC_Scalar_Data_BN::is_zero() const { 36| 334| return this->value().is_zero(); 37| 334|} _ZN5Botan17EC_Scalar_Data_BN7zeroizeEv: 48| 334|void EC_Scalar_Data_BN::zeroize() { 49| | // BigInt stores its value in a secure_vector, after swapping the existing 50| | // value will go out of scope (inside `zero`) and be wiped properly. 51| 334| BigInt zero; 52| 334| std::swap(m_v, zero); 53| 334|} _ZNK5Botan17EC_Scalar_Data_BN12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 92| 334|void EC_Scalar_Data_BN::serialize_to(std::span bytes) const { 93| 334| BOTAN_ARG_CHECK(bytes.size() == m_group->order_bytes(), "Invalid output length"); ------------------ | | 35| 334| do { \ | | 36| 334| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 334| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 334] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 334| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 334] | | ------------------ ------------------ 94| 334| m_v.serialize_to(bytes); 95| 334|} _ZN5Botan22EC_AffinePoint_Data_BNC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEENS_8EC_PointE: 98| 442| m_group(std::move(group)), m_pt(std::move(pt)) { 99| 442| if(!m_pt.is_zero()) { ------------------ | Branch (99:7): [True: 442, False: 0] ------------------ 100| 442| m_pt.force_affine(); 101| 442| m_xy = m_pt.xy_bytes(); 102| 442| } 103| 442|} _ZNK5Botan22EC_AffinePoint_Data_BN5groupEv: 109| 658|const std::shared_ptr& EC_AffinePoint_Data_BN::group() const { 110| 658| return m_group; 111| 658|} _ZNK5Botan22EC_AffinePoint_Data_BN19field_element_bytesEv: 149| 432|size_t EC_AffinePoint_Data_BN::field_element_bytes() const { 150| 432| return m_group->p_bytes(); 151| 432|} _ZNK5Botan22EC_AffinePoint_Data_BN11is_identityEv: 153| 1.09k|bool EC_AffinePoint_Data_BN::is_identity() const { 154| 1.09k| return m_xy.empty(); 155| 1.09k|} _ZNK5Botan22EC_AffinePoint_Data_BN25serialize_uncompressed_toENSt3__14spanIhLm18446744073709551615EEE: 189| 216|void EC_AffinePoint_Data_BN::serialize_uncompressed_to(std::span bytes) const { 190| 216| BOTAN_STATE_CHECK(!this->is_identity()); ------------------ | | 51| 216| do { \ | | 52| 216| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 216| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 216] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 216| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 216] | | ------------------ ------------------ 191| 216| const size_t fe_bytes = this->field_element_bytes(); 192| 216| BOTAN_ARG_CHECK(bytes.size() == 1 + 2 * fe_bytes, "Invalid output size"); ------------------ | | 35| 216| do { \ | | 36| 216| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 216| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 216] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 216| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 216] | | ------------------ ------------------ 193| 216| BufferStuffer stuffer(bytes); 194| 216| stuffer.append(0x04); 195| 216| stuffer.append(m_xy); 196| 216|} _ZN5Botan8CurveGFpC2EPKNS_13EC_Group_DataE: 28| 2.45k|CurveGFp::CurveGFp(const EC_Group_Data* group) : m_group(group) { 29| 2.45k| BOTAN_ASSERT_NONNULL(m_group); ------------------ | | 123| 2.45k| do { \ | | 124| 2.45k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 2.45k] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 2.45k| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 2.45k] | | ------------------ ------------------ 30| 2.45k|} _ZNK5Botan8CurveGFp5groupEv: 32| 522k|const EC_Group_Data& CurveGFp::group() const { 33| 522k| BOTAN_ASSERT_NONNULL(m_group); ------------------ | | 123| 522k| do { \ | | 124| 522k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 522k] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 522k| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 522k] | | ------------------ ------------------ 34| 522k| return *m_group; 35| 522k|} _ZNK5Botan8CurveGFp5get_aEv: 37| 284|const BigInt& CurveGFp::get_a() const { 38| 284| return this->group().a(); 39| 284|} _ZNK5Botan8CurveGFp5get_bEv: 41| 284|const BigInt& CurveGFp::get_b() const { 42| 284| return this->group().b(); 43| 284|} _ZNK5Botan8CurveGFp5get_pEv: 45| 284|const BigInt& CurveGFp::get_p() const { 46| 284| return this->group().p(); 47| 284|} _ZNK5Botan8CurveGFp11get_p_wordsEv: 49| 179k|size_t CurveGFp::get_p_words() const { 50| 179k| return this->group().p_words(); 51| 179k|} _ZN5Botan8EC_PointC2ERKNS_8CurveGFpE: 108| 349|EC_Point::EC_Point(const CurveGFp& curve) : m_curve(curve), m_x(0), m_y(curve.group().monty().R1()), m_z(0) {} _ZNK5Botan8EC_Point4zeroEv: 110| 349|EC_Point EC_Point::zero() const { 111| 349| return EC_Point(m_curve); 112| 349|} _ZN5Botan8EC_PointC2ERKNS_8CurveGFpENS_6BigIntES4_: 115| 4.66k| m_curve(curve), m_x(std::move(x)), m_y(std::move(y)), m_z(m_curve.group().monty().R1()) { 116| 4.66k| const auto& group = m_curve.group(); 117| | 118| 4.66k| if(m_x < 0 || m_x >= group.p()) { ------------------ | Branch (118:7): [True: 0, False: 4.66k] | Branch (118:18): [True: 0, False: 4.66k] ------------------ 119| 0| throw Invalid_Argument("Invalid EC_Point affine x"); 120| 0| } 121| 4.66k| if(m_y < 0 || m_y >= group.p()) { ------------------ | Branch (121:7): [True: 0, False: 4.66k] | Branch (121:18): [True: 0, False: 4.66k] ------------------ 122| 0| throw Invalid_Argument("Invalid EC_Point affine y"); 123| 0| } 124| | 125| 4.66k| secure_vector monty_ws(monty_ws_size(group)); 126| | 127| 4.66k| to_rep(group, m_x, monty_ws); 128| 4.66k| to_rep(group, m_y, monty_ws); 129| 4.66k|} _ZN5Botan8EC_Point10add_affineEPKmmS2_mRNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE: 188| 24.6k| const word x_words[], size_t x_size, const word y_words[], size_t y_size, std::vector& ws_bn) { 189| 24.6k| if((CT::all_zeros(x_words, x_size) & CT::all_zeros(y_words, y_size)).as_bool()) { ------------------ | Branch (189:7): [True: 11.3k, False: 13.3k] ------------------ 190| 11.3k| return; 191| 11.3k| } 192| | 193| 13.3k| const auto& group = m_curve.group(); 194| | 195| 13.3k| if(is_zero()) { ------------------ | Branch (195:7): [True: 334, False: 12.9k] ------------------ 196| 334| m_x.set_words(x_words, x_size); 197| 334| m_y.set_words(y_words, y_size); 198| 334| m_z = group.monty().R1(); 199| 334| return; 200| 334| } 201| | 202| 12.9k| resize_ws(ws_bn, monty_ws_size(group)); 203| | 204| 12.9k| secure_vector& ws = ws_bn[0].get_word_vector(); 205| 12.9k| secure_vector& sub_ws = ws_bn[1].get_word_vector(); 206| | 207| 12.9k| BigInt& T0 = ws_bn[2]; 208| 12.9k| BigInt& T1 = ws_bn[3]; 209| 12.9k| BigInt& T2 = ws_bn[4]; 210| 12.9k| BigInt& T3 = ws_bn[5]; 211| 12.9k| BigInt& T4 = ws_bn[6]; 212| | 213| | /* 214| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 215| | simplified with Z2 = 1 216| | */ 217| | 218| 12.9k| const BigInt& p = group.p(); 219| | 220| 12.9k| fe_sqr(group, T3, m_z, ws); // z1^2 221| 12.9k| fe_mul(group, T4, x_words, x_size, T3, ws); // x2*z1^2 222| | 223| 12.9k| fe_mul(group, T2, m_z, T3, ws); // z1^3 224| 12.9k| fe_mul(group, T0, y_words, y_size, T2, ws); // y2*z1^3 225| | 226| 12.9k| T4.mod_sub(m_x, p, sub_ws); // x2*z1^2 - x1*z2^2 227| | 228| 12.9k| T0.mod_sub(m_y, p, sub_ws); 229| | 230| 12.9k| if(T4.is_zero()) { ------------------ | Branch (230:7): [True: 10, False: 12.9k] ------------------ 231| 10| if(T0.is_zero()) { ------------------ | Branch (231:10): [True: 10, False: 0] ------------------ 232| 10| mult2(ws_bn); 233| 10| return; 234| 10| } 235| | 236| | // setting to zero: 237| 0| m_x.clear(); 238| 0| m_y = group.monty().R1(); 239| 0| m_z.clear(); 240| 0| return; 241| 10| } 242| | 243| 12.9k| fe_sqr(group, T2, T4, ws); 244| | 245| 12.9k| fe_mul(group, T3, m_x, T2, ws); 246| | 247| 12.9k| fe_mul(group, T1, T2, T4, ws); 248| | 249| 12.9k| fe_sqr(group, m_x, T0, ws); 250| 12.9k| m_x.mod_sub(T1, p, sub_ws); 251| | 252| 12.9k| m_x.mod_sub(T3, p, sub_ws); 253| 12.9k| m_x.mod_sub(T3, p, sub_ws); 254| | 255| 12.9k| T3.mod_sub(m_x, p, sub_ws); 256| | 257| 12.9k| fe_mul(group, T2, T0, T3, ws); 258| 12.9k| fe_mul(group, T0, m_y, T1, ws); 259| 12.9k| T2.mod_sub(T0, p, sub_ws); 260| 12.9k| m_y.swap(T2); 261| | 262| 12.9k| fe_mul(group, T0, m_z, T4, ws); 263| 12.9k| m_z.swap(T0); 264| 12.9k|} _ZN5Botan8EC_Point3addERKS0_RNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE: 266| 179k|void EC_Point::add(const EC_Point& other, std::vector& workspace) { 267| 179k| BOTAN_ARG_CHECK(m_curve == other.m_curve, "cannot add points on different curves"); ------------------ | | 35| 179k| do { \ | | 36| 179k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 179k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 179k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 179k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 179k] | | ------------------ ------------------ 268| | 269| 179k| const size_t p_words = m_curve.get_p_words(); 270| | 271| 179k| add(other.m_x._data(), 272| 179k| std::min(p_words, other.m_x.size()), 273| 179k| other.m_y._data(), 274| 179k| std::min(p_words, other.m_y.size()), 275| 179k| other.m_z._data(), 276| 179k| std::min(p_words, other.m_z.size()), 277| 179k| workspace); 278| 179k|} _ZN5Botan8EC_Point3addEPKmmS2_mS2_mRNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE: 286| 179k| std::vector& ws_bn) { 287| 179k| if((CT::all_zeros(x_words, x_size) & CT::all_zeros(z_words, z_size)).as_bool()) { ------------------ | Branch (287:7): [True: 0, False: 179k] ------------------ 288| 0| return; 289| 0| } 290| | 291| 179k| const auto& group = m_curve.group(); 292| | 293| 179k| if(is_zero()) { ------------------ | Branch (293:7): [True: 15, False: 179k] ------------------ 294| 15| m_x.set_words(x_words, x_size); 295| 15| m_y.set_words(y_words, y_size); 296| 15| m_z.set_words(z_words, z_size); 297| 15| return; 298| 15| } 299| | 300| 179k| resize_ws(ws_bn, monty_ws_size(group)); 301| | 302| 179k| secure_vector& ws = ws_bn[0].get_word_vector(); 303| 179k| secure_vector& sub_ws = ws_bn[1].get_word_vector(); 304| | 305| 179k| BigInt& T0 = ws_bn[2]; 306| 179k| BigInt& T1 = ws_bn[3]; 307| 179k| BigInt& T2 = ws_bn[4]; 308| 179k| BigInt& T3 = ws_bn[5]; 309| 179k| BigInt& T4 = ws_bn[6]; 310| 179k| BigInt& T5 = ws_bn[7]; 311| | 312| | /* 313| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2 314| | */ 315| | 316| 179k| const BigInt& p = group.p(); 317| | 318| 179k| fe_sqr(group, T0, z_words, z_size, ws); // z2^2 319| 179k| fe_mul(group, T1, m_x, T0, ws); // x1*z2^2 320| 179k| fe_mul(group, T3, z_words, z_size, T0, ws); // z2^3 321| 179k| fe_mul(group, T2, m_y, T3, ws); // y1*z2^3 322| | 323| 179k| fe_sqr(group, T3, m_z, ws); // z1^2 324| 179k| fe_mul(group, T4, x_words, x_size, T3, ws); // x2*z1^2 325| | 326| 179k| fe_mul(group, T5, m_z, T3, ws); // z1^3 327| 179k| fe_mul(group, T0, y_words, y_size, T5, ws); // y2*z1^3 328| | 329| 179k| T4.mod_sub(T1, p, sub_ws); // x2*z1^2 - x1*z2^2 330| | 331| 179k| T0.mod_sub(T2, p, sub_ws); 332| | 333| 179k| if(T4.is_zero()) { ------------------ | Branch (333:7): [True: 0, False: 179k] ------------------ 334| 0| if(T0.is_zero()) { ------------------ | Branch (334:10): [True: 0, False: 0] ------------------ 335| 0| mult2(ws_bn); 336| 0| return; 337| 0| } 338| | 339| | // setting to zero: 340| 0| m_x.clear(); 341| 0| m_y = group.monty().R1(); 342| 0| m_z.clear(); 343| 0| return; 344| 0| } 345| | 346| 179k| fe_sqr(group, T5, T4, ws); 347| | 348| 179k| fe_mul(group, T3, T1, T5, ws); 349| | 350| 179k| fe_mul(group, T1, T5, T4, ws); 351| | 352| 179k| fe_sqr(group, m_x, T0, ws); 353| 179k| m_x.mod_sub(T1, p, sub_ws); 354| 179k| m_x.mod_sub(T3, p, sub_ws); 355| 179k| m_x.mod_sub(T3, p, sub_ws); 356| | 357| 179k| T3.mod_sub(m_x, p, sub_ws); 358| | 359| 179k| fe_mul(group, m_y, T0, T3, ws); 360| 179k| fe_mul(group, T3, T2, T1, ws); 361| | 362| 179k| m_y.mod_sub(T3, p, sub_ws); 363| | 364| 179k| fe_mul(group, T3, z_words, z_size, m_z, ws); 365| 179k| fe_mul(group, m_z, T3, T4, ws); 366| 179k|} _ZN5Botan8EC_Point5mult2ERNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEE: 388| 136k|void EC_Point::mult2(std::vector& ws_bn) { 389| 136k| if(is_zero()) { ------------------ | Branch (389:7): [True: 0, False: 136k] ------------------ 390| 0| return; 391| 0| } 392| | 393| 136k| const auto& group = m_curve.group(); 394| | 395| 136k| if(m_y.is_zero()) { ------------------ | Branch (395:7): [True: 0, False: 136k] ------------------ 396| 0| *this = EC_Point(m_curve); // setting myself to zero 397| 0| return; 398| 0| } 399| | 400| 136k| resize_ws(ws_bn, monty_ws_size(group)); 401| | 402| 136k| secure_vector& ws = ws_bn[0].get_word_vector(); 403| 136k| secure_vector& sub_ws = ws_bn[1].get_word_vector(); 404| | 405| 136k| BigInt& T0 = ws_bn[2]; 406| 136k| BigInt& T1 = ws_bn[3]; 407| 136k| BigInt& T2 = ws_bn[4]; 408| 136k| BigInt& T3 = ws_bn[5]; 409| 136k| BigInt& T4 = ws_bn[6]; 410| | 411| | /* 412| | https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-1986-cc 413| | */ 414| 136k| const BigInt& p = group.p(); 415| | 416| 136k| fe_sqr(group, T0, m_y, ws); 417| | 418| 136k| fe_mul(group, T1, m_x, T0, ws); 419| 136k| fe_smul<4>(T1, p, sub_ws); 420| | 421| 136k| if(group.a_is_zero()) { ------------------ | Branch (421:7): [True: 108k, False: 28.4k] ------------------ 422| | // if a == 0 then 3*x^2 + a*z^4 is just 3*x^2 423| 108k| fe_sqr(group, T4, m_x, ws); // x^2 424| 108k| fe_smul<3>(T4, p, sub_ws); // 3*x^2 425| 108k| } else if(group.a_is_minus_3()) { ------------------ | Branch (425:14): [True: 28.4k, False: 0] ------------------ 426| | /* 427| | if a == -3 then 428| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 429| | */ 430| 28.4k| fe_sqr(group, T3, m_z, ws); // z^2 431| | 432| | // (x-z^2) 433| 28.4k| T2 = m_x; 434| 28.4k| T2.mod_sub(T3, p, sub_ws); 435| | 436| | // (x+z^2) 437| 28.4k| T3.mod_add(m_x, p, sub_ws); 438| | 439| 28.4k| fe_mul(group, T4, T2, T3, ws); // (x-z^2)*(x+z^2) 440| | 441| 28.4k| fe_smul<3>(T4, p, sub_ws); // 3*(x-z^2)*(x+z^2) 442| 28.4k| } else { 443| 0| fe_sqr(group, T3, m_z, ws); // z^2 444| 0| fe_sqr(group, T4, T3, ws); // z^4 445| 0| fe_mul(group, T3, group.monty_a(), T4, ws); // a*z^4 446| | 447| 0| fe_sqr(group, T4, m_x, ws); // x^2 448| 0| fe_smul<3>(T4, p, sub_ws); 449| 0| T4.mod_add(T3, p, sub_ws); // 3*x^2 + a*z^4 450| 0| } 451| | 452| 136k| fe_sqr(group, T2, T4, ws); 453| 136k| T2.mod_sub(T1, p, sub_ws); 454| 136k| T2.mod_sub(T1, p, sub_ws); 455| | 456| 136k| fe_sqr(group, T3, T0, ws); 457| 136k| fe_smul<8>(T3, p, sub_ws); 458| | 459| 136k| T1.mod_sub(T2, p, sub_ws); 460| | 461| 136k| fe_mul(group, T0, T4, T1, ws); 462| 136k| T0.mod_sub(T3, p, sub_ws); 463| | 464| 136k| m_x.swap(T2); 465| | 466| 136k| fe_mul(group, T2, m_y, m_z, ws); 467| 136k| fe_smul<2>(T2, p, sub_ws); 468| | 469| 136k| m_y.swap(T0); 470| 136k| m_z.swap(T2); 471| 136k|} _ZNK5Botan8EC_Point3mulERKNS_6BigIntE: 497| 15|EC_Point EC_Point::mul(const BigInt& scalar) const { 498| 15| const size_t scalar_bits = scalar.bits(); 499| | 500| 15| std::vector ws(EC_Point::WORKSPACE_SIZE); 501| | 502| 15| EC_Point R[2] = {this->zero(), *this}; 503| | 504| 7.81k| for(size_t i = scalar_bits; i > 0; i--) { ------------------ | Branch (504:32): [True: 7.80k, False: 15] ------------------ 505| 7.80k| const size_t b = scalar.get_bit(i - 1) ? 1 : 0; ------------------ | Branch (505:24): [True: 6.12k, False: 1.67k] ------------------ 506| 7.80k| R[b ^ 1].add(R[b], ws); 507| 7.80k| R[b].mult2(ws); 508| 7.80k| } 509| | 510| 15| if(scalar.signum() < 0) { ------------------ | Branch (510:7): [True: 0, False: 15] ------------------ 511| 0| R[0].negate(); 512| 0| } 513| | 514| 15| BOTAN_DEBUG_ASSERT(R[0].on_the_curve()); ------------------ | | 137| 15| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 15| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 15] | | ------------------ ------------------ 515| | 516| 15| return R[0]; 517| 15|} _ZN5Botan8EC_Point16force_all_affineENSt3__14spanIS0_Lm18446744073709551615EEERNS1_6vectorImNS_16secure_allocatorImEEEE: 520| 375|void EC_Point::force_all_affine(std::span points, secure_vector& ws) { 521| 375| if(points.size() <= 1) { ------------------ | Branch (521:7): [True: 0, False: 375] ------------------ 522| 0| for(auto& point : points) { ------------------ | Branch (522:23): [True: 0, False: 0] ------------------ 523| 0| point.force_affine(); 524| 0| } 525| 0| return; 526| 0| } 527| | 528| 300k| for(const auto& point : points) { ------------------ | Branch (528:26): [True: 300k, False: 375] ------------------ 529| 300k| if(point.is_zero()) { ------------------ | Branch (529:10): [True: 0, False: 300k] ------------------ 530| 0| throw Invalid_State("Cannot convert zero ECC point to affine"); 531| 0| } 532| 300k| } 533| | 534| | /* 535| | For >= 2 points use Montgomery's trick 536| | 537| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 538| | (Hankerson, Menezes, Vanstone) 539| | 540| | TODO is it really necessary to save all k points in c? 541| | */ 542| | 543| 375| const auto& group = points[0].m_curve.group(); 544| 375| const BigInt& rep_1 = group.monty().R1(); 545| | 546| 375| if(ws.size() < monty_ws_size(group)) { ------------------ | Branch (546:7): [True: 0, False: 375] ------------------ 547| 0| ws.resize(monty_ws_size(group)); 548| 0| } 549| | 550| 375| std::vector c(points.size()); 551| 375| c[0] = points[0].m_z; 552| | 553| 300k| for(size_t i = 1; i != points.size(); ++i) { ------------------ | Branch (553:22): [True: 300k, False: 375] ------------------ 554| 300k| fe_mul(group, c[i], c[i - 1], points[i].m_z, ws); 555| 300k| } 556| | 557| 375| BigInt s_inv = invert_element(group, c[c.size() - 1], ws); 558| | 559| 375| BigInt z_inv; 560| 375| BigInt z2_inv; 561| 375| BigInt z3_inv; 562| | 563| 300k| for(size_t i = points.size() - 1; i != 0; i--) { ------------------ | Branch (563:38): [True: 300k, False: 375] ------------------ 564| 300k| EC_Point& point = points[i]; 565| | 566| 300k| fe_mul(group, z_inv, s_inv, c[i - 1], ws); 567| | 568| 300k| s_inv = fe_mul(group, s_inv, point.m_z, ws); 569| | 570| 300k| fe_sqr(group, z2_inv, z_inv, ws); 571| 300k| fe_mul(group, z3_inv, z2_inv, z_inv, ws); 572| 300k| point.m_x = fe_mul(group, point.m_x, z2_inv, ws); 573| 300k| point.m_y = fe_mul(group, point.m_y, z3_inv, ws); 574| 300k| point.m_z = rep_1; 575| 300k| } 576| | 577| 375| fe_sqr(group, z2_inv, s_inv, ws); 578| 375| fe_mul(group, z3_inv, z2_inv, s_inv, ws); 579| 375| points[0].m_x = fe_mul(group, points[0].m_x, z2_inv, ws); 580| 375| points[0].m_y = fe_mul(group, points[0].m_y, z3_inv, ws); 581| 375| points[0].m_z = rep_1; 582| 375|} _ZN5Botan8EC_Point12force_affineEv: 584| 442|void EC_Point::force_affine() { 585| 442| if(is_zero()) { ------------------ | Branch (585:7): [True: 0, False: 442] ------------------ 586| 0| throw Invalid_State("Cannot convert zero ECC point to affine"); 587| 0| } 588| | 589| 442| secure_vector ws; 590| | 591| 442| const auto& group = m_curve.group(); 592| | 593| 442| const BigInt z_inv = invert_element(group, m_z, ws); 594| 442| const BigInt z2_inv = fe_sqr(group, z_inv, ws); 595| 442| const BigInt z3_inv = fe_mul(group, z_inv, z2_inv, ws); 596| 442| m_x = fe_mul(group, m_x, z2_inv, ws); 597| 442| m_y = fe_mul(group, m_y, z3_inv, ws); 598| 442| m_z = group.monty().R1(); 599| 442|} _ZNK5Botan8EC_Point9is_affineEv: 601| 884|bool EC_Point::is_affine() const { 602| 884| const auto& group = m_curve.group(); 603| 884| return m_z == group.monty().R1(); 604| 884|} _ZNK5Botan8EC_Point8xy_bytesEv: 622| 442|secure_vector EC_Point::xy_bytes() const { 623| 442| const auto& group = m_curve.group(); 624| 442| const size_t p_bytes = group.p_bytes(); 625| 442| secure_vector b(2 * p_bytes); 626| 442| BigInt::encode_1363(&b[0], p_bytes, this->get_affine_x()); // NOLINT(*container-data-pointer) 627| 442| BigInt::encode_1363(&b[p_bytes], p_bytes, this->get_affine_y()); 628| 442| return b; 629| 442|} _ZNK5Botan8EC_Point12get_affine_xEv: 631| 442|BigInt EC_Point::get_affine_x() const { 632| 442| if(is_zero()) { ------------------ | Branch (632:7): [True: 0, False: 442] ------------------ 633| 0| throw Invalid_State("Cannot convert zero point to affine"); 634| 0| } 635| | 636| 442| secure_vector monty_ws; 637| | 638| 442| const auto& group = m_curve.group(); 639| | 640| 442| if(is_affine()) { ------------------ | Branch (640:7): [True: 442, False: 0] ------------------ 641| 442| return from_rep_to_tmp(group, m_x, monty_ws); 642| 442| } 643| | 644| 0| BigInt z2 = fe_sqr(group, m_z, monty_ws); 645| 0| z2 = invert_element(group, z2, monty_ws); 646| | 647| 0| BigInt r; 648| 0| fe_mul(group, r, m_x, z2, monty_ws); 649| 0| from_rep(group, r, monty_ws); 650| 0| return r; 651| 442|} _ZNK5Botan8EC_Point12get_affine_yEv: 653| 442|BigInt EC_Point::get_affine_y() const { 654| 442| if(is_zero()) { ------------------ | Branch (654:7): [True: 0, False: 442] ------------------ 655| 0| throw Invalid_State("Cannot convert zero point to affine"); 656| 0| } 657| | 658| 442| const auto& group = m_curve.group(); 659| 442| secure_vector monty_ws; 660| | 661| 442| if(is_affine()) { ------------------ | Branch (661:7): [True: 442, False: 0] ------------------ 662| 442| return from_rep_to_tmp(group, m_y, monty_ws); 663| 442| } 664| | 665| 0| const BigInt z2 = fe_sqr(group, m_z, monty_ws); 666| 0| const BigInt z3 = fe_mul(group, m_z, z2, monty_ws); 667| 0| const BigInt z3_inv = invert_element(group, z3, monty_ws); 668| | 669| 0| BigInt r; 670| 0| fe_mul(group, r, m_y, z3_inv, monty_ws); 671| 0| from_rep(group, r, monty_ws); 672| 0| return r; 673| 442|} _ZNK5Botan8EC_Point12on_the_curveEv: 675| 187|bool EC_Point::on_the_curve() const { 676| | /* 677| | Is the point still on the curve?? (If everything is correct, the 678| | point is always on its curve; then the function will return true. 679| | If somehow the state is corrupted, which suggests a fault attack 680| | (or internal computational error), then return false. 681| | */ 682| 187| if(is_zero()) { ------------------ | Branch (682:7): [True: 0, False: 187] ------------------ 683| 0| return true; 684| 0| } 685| | 686| 187| const auto& group = m_curve.group(); 687| 187| secure_vector monty_ws; 688| | 689| 187| const BigInt y2 = from_rep_to_tmp(group, fe_sqr(group, m_y, monty_ws), monty_ws); 690| 187| const BigInt x3 = fe_mul(group, m_x, fe_sqr(group, m_x, monty_ws), monty_ws); 691| 187| const BigInt ax = fe_mul(group, m_x, group.monty_a(), monty_ws); 692| 187| const BigInt z2 = fe_sqr(group, m_z, monty_ws); 693| | 694| 187| const BigInt& monty_b = group.monty_b(); 695| | 696| | // Is z equal to 1 (in Montgomery form)? 697| 187| if(m_z == z2) { ------------------ | Branch (697:7): [True: 187, False: 0] ------------------ 698| 187| if(y2 != from_rep_to_tmp(group, x3 + ax + monty_b, monty_ws)) { ------------------ | Branch (698:10): [True: 79, False: 108] ------------------ 699| 79| return false; 700| 79| } 701| 187| } 702| | 703| 108| const BigInt z3 = fe_mul(group, m_z, z2, monty_ws); 704| 108| const BigInt ax_z4 = fe_mul(group, ax, fe_sqr(group, z2, monty_ws), monty_ws); 705| 108| const BigInt b_z6 = fe_mul(group, monty_b, fe_sqr(group, z3, monty_ws), monty_ws); 706| | 707| 108| if(y2 != from_rep_to_tmp(group, x3 + ax_z4 + b_z6, monty_ws)) { ------------------ | Branch (707:7): [True: 0, False: 108] ------------------ 708| 0| return false; 709| 0| } 710| | 711| 108| return true; 712| 108|} _ZN5Botan8EC_Point4swapERS0_: 792| 263k|void EC_Point::swap(EC_Point& other) noexcept { 793| 263k| m_curve.swap(other.m_curve); 794| 263k| m_x.swap(other.m_x); 795| 263k| m_y.swap(other.m_y); 796| 263k| m_z.swap(other.m_z); 797| 263k|} _ZN5Botan6OS2ECPENSt3__14spanIKhLm18446744073709551615EEERKNS_8CurveGFpE: 866| 284|EC_Point OS2ECP(std::span data, const CurveGFp& curve) { 867| 284| return OS2ECP(data.data(), data.size(), curve); 868| 284|} _ZN5Botan6OS2ECPEPKhmRKNS_8CurveGFpE: 870| 284|EC_Point OS2ECP(const uint8_t data[], size_t data_len, const CurveGFp& curve) { 871| 284| if(data_len == 1 && data[0] == 0) { ------------------ | Branch (871:7): [True: 0, False: 284] | Branch (871:24): [True: 0, False: 0] ------------------ 872| | // SEC1 standard representation of the point at infinity 873| 0| return EC_Point(curve); 874| 0| } 875| | 876| 284| const auto [g_x, g_y] = OS2ECP(data, data_len, curve.get_p(), curve.get_a(), curve.get_b()); 877| | 878| 284| EC_Point point(curve, g_x, g_y); 879| | 880| 284| if(!point.on_the_curve()) { ------------------ | Branch (880:7): [True: 79, False: 205] ------------------ 881| 79| throw Decoding_Error("OS2ECP: Decoded point was not on the curve"); 882| 79| } 883| | 884| 205| return point; 885| 284|} _ZN5Botan6OS2ECPEPKhmRKNS_6BigIntES4_S4_: 887| 284|std::pair OS2ECP(const uint8_t pt[], size_t pt_len, const BigInt& p, const BigInt& a, const BigInt& b) { 888| 284| if(pt_len <= 1) { ------------------ | Branch (888:7): [True: 0, False: 284] ------------------ 889| 0| throw Decoding_Error("OS2ECP invalid point encoding"); 890| 0| } 891| | 892| 284| const uint8_t pc = pt[0]; 893| 284| const size_t p_bytes = p.bytes(); 894| | 895| 284| BigInt x; 896| 284| BigInt y; 897| | 898| 284| if(pc == 2 || pc == 3) { ------------------ | Branch (898:7): [True: 9, False: 275] | Branch (898:18): [True: 193, False: 82] ------------------ 899| 202| if(pt_len != 1 + p_bytes) { ------------------ | Branch (899:10): [True: 0, False: 202] ------------------ 900| 0| throw Decoding_Error("OS2ECP invalid point encoding"); 901| 0| } 902| 202| x = BigInt::decode(&pt[1], pt_len - 1); 903| | 904| 202| const bool y_mod_2 = ((pc & 0x01) == 1); 905| 202| y = decompress_point(y_mod_2, x, p, a, b); 906| 202| } else if(pc == 4) { ------------------ | Branch (906:14): [True: 82, False: 0] ------------------ 907| 82| if(pt_len != 1 + 2 * p_bytes) { ------------------ | Branch (907:10): [True: 0, False: 82] ------------------ 908| 0| throw Decoding_Error("OS2ECP invalid point encoding"); 909| 0| } 910| | 911| 82| x = BigInt::decode(&pt[1], p_bytes); 912| 82| y = BigInt::decode(&pt[p_bytes + 1], p_bytes); 913| 82| } else if(pc == 6 || pc == 7) { ------------------ | Branch (913:14): [True: 0, False: 0] | Branch (913:25): [True: 0, False: 0] ------------------ 914| 0| if(pt_len != 1 + 2 * p_bytes) { ------------------ | Branch (914:10): [True: 0, False: 0] ------------------ 915| 0| throw Decoding_Error("OS2ECP invalid point encoding"); 916| 0| } 917| | 918| 0| x = BigInt::decode(&pt[1], p_bytes); 919| 0| y = BigInt::decode(&pt[p_bytes + 1], p_bytes); 920| | 921| 0| const bool y_mod_2 = ((pc & 0x01) == 1); 922| | 923| 0| if(decompress_point(y_mod_2, x, p, a, b) != y) { ------------------ | Branch (923:10): [True: 0, False: 0] ------------------ 924| 0| throw Decoding_Error("OS2ECP: Decoding error in hybrid format"); 925| 0| } 926| 0| } else { 927| 0| throw Decoding_Error("OS2ECP: Unknown format type " + std::to_string(static_cast(pc))); 928| 0| } 929| | 930| 284| if(x >= p || y >= p) { ------------------ | Branch (930:7): [True: 94, False: 190] | Branch (930:17): [True: 3, False: 187] ------------------ 931| 5| throw Decoding_Error("OS2ECP invalid point encoding"); 932| 5| } 933| | 934| 279| return std::make_pair(x, y); 935| 284|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_113monty_ws_sizeERKNS_13EC_Group_DataE: 102| 334k|size_t monty_ws_size(const EC_Group_Data& group) { 103| 334k| return 2 * group.p_words(); 104| 334k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16to_repERKNS_13EC_Group_DataERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE: 55| 9.33k|void to_rep(const EC_Group_Data& group, BigInt& x, secure_vector& ws) { 56| 9.33k| group.monty().mul_by(x, group.monty().R2(), ws); 57| 9.33k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16fe_sqrERKNS_13EC_Group_DataERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE: 94| 1.21k|BigInt fe_sqr(const EC_Group_Data& group, const BigInt& x, secure_vector& ws) { 95| 1.21k| return group.monty().sqr(x, ws); 96| 1.21k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16fe_mulERKNS_13EC_Group_DataERKNS_6BigIntES6_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 82| 902k|inline BigInt fe_mul(const EC_Group_Data& group, const BigInt& x, const BigInt& y, secure_vector& ws) { 83| 902k| return group.monty().mul(x, y, ws); 84| 902k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_19resize_wsERNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEEm: 163| 328k|inline void resize_ws(std::vector& ws_bn, size_t cap_size) { 164| 328k| BOTAN_ASSERT(ws_bn.size() >= EC_Point::WORKSPACE_SIZE, "Expected size for EC_Point workspace"); ------------------ | | 71| 328k| do { \ | | 72| 328k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 328k| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 328k] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 328k| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 328k] | | ------------------ ------------------ 165| | 166| 2.63M| for(auto& ws : ws_bn) { ------------------ | Branch (166:17): [True: 2.63M, False: 328k] ------------------ 167| 2.63M| if(ws.size() < cap_size) { ------------------ | Branch (167:10): [True: 6.12k, False: 2.62M] ------------------ 168| 6.12k| ws.get_word_vector().resize(cap_size); 169| 6.12k| } 170| 2.63M| } 171| 328k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16fe_sqrERKNS_13EC_Group_DataERNS_6BigIntERKS4_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 86| 1.42M|void fe_sqr(const EC_Group_Data& group, BigInt& z, const BigInt& x, secure_vector& ws) { 87| 1.42M| group.monty().sqr(z, x, ws); 88| 1.42M|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16fe_mulERKNS_13EC_Group_DataERNS_6BigIntEPKmmRKS4_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 72| 743k| const EC_Group_Data& group, BigInt& z, const word x_w[], size_t x_size, const BigInt& y, secure_vector& ws) { 73| 743k| group.monty().mul(z, y, std::span{x_w, x_size}, ws); 74| 743k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16fe_mulERKNS_13EC_Group_DataERNS_6BigIntERKS4_S7_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 67| 2.85M|inline void fe_mul(const EC_Group_Data& group, BigInt& z, const BigInt& x, const BigInt& y, secure_vector& ws) { 68| 2.85M| group.monty().mul(z, x, y, ws); 69| 2.85M|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16fe_sqrERKNS_13EC_Group_DataERNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE: 90| 179k|void fe_sqr(const EC_Group_Data& group, BigInt& z, const word x_w[], size_t x_size, secure_vector& ws) { 91| 179k| group.monty().sqr(z, std::span{x_w, x_size}, ws); 92| 179k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_114invert_elementERKNS_13EC_Group_DataERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE: 98| 817|BigInt invert_element(const EC_Group_Data& group, const BigInt& x, secure_vector& ws) { 99| 817| return group.monty().mul(inverse_mod_public_prime(x, group.p()), group.monty().R3(), ws); 100| 817|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_115from_rep_to_tmpERKNS_13EC_Group_DataERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE: 63| 1.36k|BigInt from_rep_to_tmp(const EC_Group_Data& group, const BigInt& x, secure_vector& ws) { 64| 1.36k| return group.monty().redc(x, ws); 65| 1.36k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_116decompress_pointEbRKNS_6BigIntES3_S3_S3_: 848| 202|BigInt decompress_point(bool y_mod_2, const BigInt& x, const BigInt& p, const BigInt& a, const BigInt& b) { 849| 202| const BigInt g = ((x * x + a) * x + b) % p; 850| | 851| 202| BigInt z = sqrt_modulo_prime(g, p); 852| | 853| 202| if(z < 0) { ------------------ | Branch (853:7): [True: 92, False: 110] ------------------ 854| 92| throw Decoding_Error("Error during EC point decompression"); 855| 92| } 856| | 857| 110| if(z.get_bit(0) != y_mod_2) { ------------------ | Branch (857:7): [True: 69, False: 41] ------------------ 858| 69| z = p - z; 859| 69| } 860| | 861| 110| return z; 862| 202|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_17fe_smulILm4EEEvRNS_6BigIntERKS2_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 77| 136k|inline void fe_smul(BigInt& z, const BigInt& p, secure_vector& ws) { 78| 136k| static_assert(M == 2 || M == 3 || M == 4 || M == 8); 79| 136k| z.mod_mul(M, p, ws); 80| 136k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_17fe_smulILm3EEEvRNS_6BigIntERKS2_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 77| 136k|inline void fe_smul(BigInt& z, const BigInt& p, secure_vector& ws) { 78| 136k| static_assert(M == 2 || M == 3 || M == 4 || M == 8); 79| 136k| z.mod_mul(M, p, ws); 80| 136k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_17fe_smulILm8EEEvRNS_6BigIntERKS2_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 77| 136k|inline void fe_smul(BigInt& z, const BigInt& p, secure_vector& ws) { 78| 136k| static_assert(M == 2 || M == 3 || M == 4 || M == 8); 79| 136k| z.mod_mul(M, p, ws); 80| 136k|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_17fe_smulILm2EEEvRNS_6BigIntERKS2_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 77| 136k|inline void fe_smul(BigInt& z, const BigInt& p, secure_vector& ws) { 78| 136k| static_assert(M == 2 || M == 3 || M == 4 || M == 8); 79| 136k| z.mod_mul(M, p, ws); 80| 136k|} _ZN5Botan30EC_Point_Base_Point_PrecomputeC2ERKNS_8EC_PointERKNS_17Barrett_ReductionE: 43| 375| m_base_point(base), m_mod_order(mod_order), m_p_words(base.get_curve().get_p_words()) { 44| 375| std::vector ws(EC_Point::WORKSPACE_SIZE); 45| | 46| 375| const size_t order_bits = mod_order.modulus_bits(); 47| | 48| 375| const size_t T_bits = ceil_division(order_bits + blinding_size(order_bits), WindowBits); 49| | 50| 375| std::vector T(WindowSize * T_bits); 51| | 52| 375| EC_Point g = base; 53| 375| EC_Point g2; 54| 375| EC_Point g4; 55| | 56| 43.2k| for(size_t i = 0; i != T_bits; i++) { ------------------ | Branch (56:22): [True: 42.9k, False: 375] ------------------ 57| 42.9k| g2 = g; 58| 42.9k| g2.mult2(ws); 59| 42.9k| g4 = g2; 60| 42.9k| g4.mult2(ws); 61| | 62| 42.9k| T[7 * i + 0] = g; 63| 42.9k| T[7 * i + 1] = std::move(g2); 64| 42.9k| T[7 * i + 2] = T[7 * i + 1].plus(T[7 * i + 0], ws); // g2+g 65| 42.9k| T[7 * i + 3] = g4; 66| 42.9k| T[7 * i + 4] = T[7 * i + 3].plus(T[7 * i + 0], ws); // g4+g 67| 42.9k| T[7 * i + 5] = T[7 * i + 3].plus(T[7 * i + 1], ws); // g4+g2 68| 42.9k| T[7 * i + 6] = T[7 * i + 3].plus(T[7 * i + 2], ws); // g4+g2+g 69| | 70| 42.9k| g.swap(g4); 71| 42.9k| g.mult2(ws); 72| 42.9k| } 73| | 74| 375| EC_Point::force_all_affine(T, ws[0].get_word_vector()); 75| | 76| 375| m_W.resize(T.size() * 2 * m_p_words); 77| | 78| 375| word* p = m_W.data(); 79| 300k| for(const auto& pt : T) { ------------------ | Branch (79:23): [True: 300k, False: 375] ------------------ 80| 300k| pt.get_x().encode_words(p, m_p_words); 81| 300k| p += m_p_words; 82| 300k| pt.get_y().encode_words(p, m_p_words); 83| 300k| p += m_p_words; 84| 300k| } 85| 375|} _ZNK5Botan30EC_Point_Base_Point_Precompute3mulERKNS_6BigIntERNS_21RandomNumberGeneratorES3_RNSt3__16vectorIS1_NS6_9allocatorIS1_EEEE: 90| 334| std::vector& ws) const { 91| 334| if(k.signum() < 0) { ------------------ | Branch (91:7): [True: 0, False: 334] ------------------ 92| 0| throw Invalid_Argument("EC_Point_Base_Point_Precompute scalar must be positive"); 93| 0| } 94| | 95| | // Instead of reducing k mod group order should we alter the mask size?? 96| 334| BigInt scalar = m_mod_order.reduce(k); 97| | 98| 334| if(rng.is_seeded()) { ------------------ | Branch (98:7): [True: 0, False: 334] ------------------ 99| | // Choose a small mask m and use k' = k + m*order (Coron's 1st countermeasure) 100| 0| scalar += group_order * blinding_mask(group_order, rng); 101| 334| } else { 102| | /* 103| | When we don't have an RNG we cannot do scalar blinding. Instead use the 104| | same trick as OpenSSL and add one or two copies of the order to normalize 105| | the length of the scalar at order.bits()+1. This at least ensures the loop 106| | bound does not leak information about the high bits of the scalar. 107| | */ 108| 334| scalar += group_order; 109| 334| if(scalar.bits() == group_order.bits()) { ------------------ | Branch (109:10): [True: 332, False: 2] ------------------ 110| 332| scalar += group_order; 111| 332| } 112| 334| BOTAN_DEBUG_ASSERT(scalar.bits() == group_order.bits() + 1); ------------------ | | 137| 334| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 334| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 334] | | ------------------ ------------------ 113| 334| } 114| | 115| 334| const size_t windows = ceil_division(scalar.bits(), WindowBits); 116| | 117| 334| const size_t elem_size = 2 * m_p_words; 118| | 119| 334| BOTAN_ASSERT(windows <= m_W.size() / (3 * elem_size), "Precomputed sufficient values for scalar mult"); ------------------ | | 71| 334| do { \ | | 72| 334| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 334| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 334] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 334| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 334] | | ------------------ ------------------ 120| | 121| 334| EC_Point R = m_base_point.zero(); 122| | 123| 334| if(ws.size() < EC_Point::WORKSPACE_SIZE) { ------------------ | Branch (123:7): [True: 334, False: 0] ------------------ 124| 334| ws.resize(EC_Point::WORKSPACE_SIZE); 125| 334| } 126| | 127| | // the precomputed multiples are not secret so use std::vector 128| 334| std::vector Wt(elem_size); 129| | 130| 24.9k| for(size_t i = 0; i != windows; ++i) { ------------------ | Branch (130:22): [True: 24.6k, False: 334] ------------------ 131| 24.6k| const size_t window = windows - i - 1; 132| 24.6k| const size_t base_addr = (WindowSize * window) * elem_size; 133| | 134| 24.6k| const word w = scalar.get_substring(WindowBits * window, WindowBits); 135| | 136| 24.6k| const auto w_is_1 = CT::Mask::is_equal(w, 1); 137| 24.6k| const auto w_is_2 = CT::Mask::is_equal(w, 2); 138| 24.6k| const auto w_is_3 = CT::Mask::is_equal(w, 3); 139| 24.6k| const auto w_is_4 = CT::Mask::is_equal(w, 4); 140| 24.6k| const auto w_is_5 = CT::Mask::is_equal(w, 5); 141| 24.6k| const auto w_is_6 = CT::Mask::is_equal(w, 6); 142| 24.6k| const auto w_is_7 = CT::Mask::is_equal(w, 7); 143| | 144| 218k| for(size_t j = 0; j != elem_size; ++j) { ------------------ | Branch (144:25): [True: 193k, False: 24.6k] ------------------ 145| 193k| const word w1 = w_is_1.if_set_return(m_W[base_addr + 0 * elem_size + j]); 146| 193k| const word w2 = w_is_2.if_set_return(m_W[base_addr + 1 * elem_size + j]); 147| 193k| const word w3 = w_is_3.if_set_return(m_W[base_addr + 2 * elem_size + j]); 148| 193k| const word w4 = w_is_4.if_set_return(m_W[base_addr + 3 * elem_size + j]); 149| 193k| const word w5 = w_is_5.if_set_return(m_W[base_addr + 4 * elem_size + j]); 150| 193k| const word w6 = w_is_6.if_set_return(m_W[base_addr + 5 * elem_size + j]); 151| 193k| const word w7 = w_is_7.if_set_return(m_W[base_addr + 6 * elem_size + j]); 152| | 153| 193k| Wt[j] = w1 | w2 | w3 | w4 | w5 | w6 | w7; 154| 193k| } 155| | 156| 24.6k| R.add_affine(Wt.data(), m_p_words, &Wt[m_p_words], m_p_words, ws); 157| | 158| 24.6k| if(i == 0 && rng.is_seeded()) { ------------------ | Branch (158:10): [True: 334, False: 24.3k] | Branch (158:20): [True: 0, False: 334] ------------------ 159| | /* 160| | * Since we start with the top bit of the exponent we know the 161| | * first window must have a non-zero element, and thus R is 162| | * now a point other than the point at infinity. 163| | */ 164| 0| BOTAN_DEBUG_ASSERT(w != 0); ------------------ | | 137| 0| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 0| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 0] | | ------------------ ------------------ 165| 0| R.randomize_repr(rng, ws[0].get_word_vector()); 166| 0| } 167| 24.6k| } 168| | 169| 334| BOTAN_DEBUG_ASSERT(R.on_the_curve()); ------------------ | | 137| 334| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 334| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 334] | | ------------------ ------------------ 170| | 171| 334| return R; 172| 334|} point_mul.cpp:_ZN5Botan12_GLOBAL__N_113blinding_sizeEm: 20| 375|size_t blinding_size(size_t order_bits) { 21| 375| return (order_bits + 1) / 2; 22| 375|} _ZN5Botan17EC_PublicKey_DataC2ERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 38| 791| EC_PublicKey_Data(group, decode_ec_public_key_point(group, bytes)) {} _ZN5Botan17EC_PublicKey_DataC2ENS_8EC_GroupENS_14EC_AffinePointE: 41| 2.46k| m_group(std::move(group)), m_point(std::move(pt)) { 42| | // Checking that the point lies on the curve is done in the deserialization 43| | // of EC_AffinePoint. 44| 2.46k| if(m_point.is_identity()) { ------------------ | Branch (44:7): [True: 0, False: 2.46k] ------------------ 45| 0| throw Decoding_Error("ECC public key cannot be point at infinity"); 46| 0| } 47| | 48| 2.46k| if(m_point._group() != m_group._data()) { ------------------ | Branch (48:7): [True: 0, False: 2.46k] ------------------ 49| 0| if(m_point.group() != m_group) { ------------------ | Branch (49:10): [True: 0, False: 0] ------------------ 50| 0| throw Decoding_Error("ECC public key point is not an element of the specified group"); 51| 0| } 52| | 53| | // Same curve but a distinct EC_Group_Data (eg an unregistered explicit 54| | // group decoded twice); point arithmetic requires a shared representation 55| 0| if(auto rebound = EC_AffinePoint::deserialize_uncompressed(m_group, m_point.serialize_uncompressed())) { ------------------ | Branch (55:15): [True: 0, False: 0] ------------------ 56| 0| m_point = std::move(rebound).value(); 57| 0| } else { 58| 0| throw Decoding_Error("ECC public key point is not an element of the specified group"); 59| 0| } 60| 0| } 61| | 62| 2.46k|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 63| 2.46k| m_legacy_point = m_point.to_legacy_point(); 64| 2.46k|#endif 65| 2.46k|} _ZN5Botan18EC_PrivateKey_DataC2ENS_8EC_GroupENS_9EC_ScalarE: 68| 2.28k| m_group(std::move(group)), m_scalar(std::move(x)), m_legacy_x(m_scalar.to_bigint()) { 69| 2.28k| if(m_scalar.group()._data() != m_group._data()) { ------------------ | Branch (69:7): [True: 0, False: 2.28k] ------------------ 70| 0| if(m_scalar.group() != m_group) { ------------------ | Branch (70:10): [True: 0, False: 0] ------------------ 71| 0| throw Decoding_Error("ECC private key scalar is not an element of the specified group"); 72| 0| } 73| | 74| 0| if(auto rebound = EC_Scalar::deserialize(m_group, m_scalar.serialize>())) { ------------------ | Branch (74:15): [True: 0, False: 0] ------------------ 75| 0| m_scalar = std::move(rebound).value(); 76| 0| } else { 77| 0| throw Decoding_Error("ECC private key scalar is not an element of the specified group"); 78| 0| } 79| 0| } 80| | 81| | // Checking that the scalar is lower than the group order is ensured in the 82| | // deserialization of the EC_Scalar or during the random generation respectively. 83| 2.28k| if(m_scalar.is_zero()) { ------------------ | Branch (83:7): [True: 0, False: 2.28k] ------------------ 84| 0| throw Decoding_Error("ECC private key cannot be zero"); 85| 0| } 86| 2.28k|} _ZN5Botan18EC_PrivateKey_DataC2ERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 118| 2.30k| Botan::EC_PrivateKey_Data(group, decode_ec_secret_key_scalar(group, bytes)) {} _ZN5Botan18EC_PrivateKey_DataD2Ev: 120| 2.28k|EC_PrivateKey_Data::~EC_PrivateKey_Data() { 121| 2.28k| m_scalar.zeroize(); 122| 2.28k|} _ZNK5Botan18EC_PrivateKey_Data10public_keyERNS_21RandomNumberGeneratorEb: 125| 2.28k| bool with_modular_inverse) const { 126| 2.28k| const auto public_point = [&] { 127| 2.28k| if(with_modular_inverse) { 128| 2.28k| return EC_AffinePoint::g_mul(m_scalar.invert(), rng); 129| 2.28k| } else { 130| 2.28k| return EC_AffinePoint::g_mul(m_scalar, rng); 131| 2.28k| } 132| 2.28k| }; 133| | 134| 2.28k| return std::make_shared(m_group, public_point()); 135| 2.28k|} _ZNK5Botan18EC_PrivateKey_Data10public_keyEb: 137| 2.28k|std::shared_ptr EC_PrivateKey_Data::public_key(bool with_modular_inverse) const { 138| 2.28k| Null_RNG null_rng; 139| 2.28k| return this->public_key(null_rng, with_modular_inverse); 140| 2.28k|} ec_key_data.cpp:_ZN5Botan12_GLOBAL__N_126decode_ec_public_key_pointERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 17| 791|EC_AffinePoint decode_ec_public_key_point(const EC_Group& group, std::span bytes) { 18| | /* 19| | * RFC 5480 section 2.2: 20| | * The first octet of the OCTET STRING indicates whether the key is 21| | * compressed or uncompressed. The uncompressed form is indicated 22| | * by 0x04 and the compressed form is indicated by either 0x02 or 23| | * 0x03 (see 2.3.3 in [SEC1]). The public key MUST be rejected if 24| | * any other value is included in the first octet. 25| | */ 26| 791| if(auto pt_uncompressed = EC_AffinePoint::deserialize_uncompressed(group, bytes)) { ------------------ | Branch (26:12): [True: 1, False: 790] ------------------ 27| 1| return std::move(pt_uncompressed).value(); 28| 790| } else if(auto pt_compressed = EC_AffinePoint::deserialize_compressed(group, bytes)) { ------------------ | Branch (28:19): [True: 184, False: 606] ------------------ 29| 184| return std::move(pt_compressed).value(); 30| 606| } else { 31| 606| throw Decoding_Error("Failed to deserialize elliptic curve point"); 32| 606| } 33| 791|} ec_key_data.cpp:_ZN5Botan12_GLOBAL__N_127decode_ec_secret_key_scalarERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 90| 4.32k|EC_Scalar decode_ec_secret_key_scalar(const EC_Group& group, std::span bytes) { 91| 4.32k| const size_t order_bytes = group.get_order_bytes(); 92| | 93| 4.32k| if(bytes.size() < order_bytes) { ------------------ | Branch (93:7): [True: 2.01k, False: 2.30k] ------------------ 94| | /* 95| | * Older versions had a bug which caused secret keys to not be encoded to 96| | * the full byte length of the order if there were leading zero bytes. This 97| | * was particularly a problem for P-521, where on average half of keys do 98| | * not have their high bit set and so can be encoded in 65 bytes, vs 66 99| | * bytes for the full order. 100| | * 101| | * To accommodate this, zero prefix the key if we see such a short input 102| | */ 103| 2.01k| secure_vector padded_sk(order_bytes); 104| 2.01k| copy_mem(std::span{padded_sk}.last(bytes.size()), bytes); 105| 2.01k| return decode_ec_secret_key_scalar(group, padded_sk); 106| 2.01k| } 107| | 108| 2.30k| if(auto s = EC_Scalar::deserialize(group, bytes)) { ------------------ | Branch (108:12): [True: 2.28k, False: 25] ------------------ 109| 2.28k| return s.value(); 110| 2.28k| } else { 111| 25| throw Decoding_Error("EC private key is invalid for this group"); 112| 25| } 113| 2.30k|} ec_key_data.cpp:_ZZNK5Botan18EC_PrivateKey_Data10public_keyERNS_21RandomNumberGeneratorEbENK3$_0clEv: 126| 2.28k| const auto public_point = [&] { 127| 2.28k| if(with_modular_inverse) { ------------------ | Branch (127:10): [True: 0, False: 2.28k] ------------------ 128| 0| return EC_AffinePoint::g_mul(m_scalar.invert(), rng); 129| 2.28k| } else { 130| 2.28k| return EC_AffinePoint::g_mul(m_scalar, rng); 131| 2.28k| } 132| 2.28k| }; _ZN5Botan12EC_PublicKey27assert_algorithm_identifierERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEE: 49| 2.51k| std::string_view alg_name) { 50| 2.51k| if(alg_id.oid() != OID::from_string(alg_name)) { ------------------ | Branch (50:7): [True: 5, False: 2.50k] ------------------ 51| 5| throw Decoding_Error( 52| 5| fmt("Unexpected AlgorithmIdentifier OID {} in association with {} key", alg_id.oid(), alg_name)); 53| 5| } 54| | 55| 2.50k| return alg_id; // NOLINT(*-return-const-ref-from-parameter) 56| 2.51k|} _ZNK5Botan12EC_PublicKey6domainEv: 76| 1.49k|const EC_Group& EC_PublicKey::domain() const { 77| 1.49k| BOTAN_STATE_CHECK(m_public_key != nullptr); ------------------ | | 51| 1.49k| do { \ | | 52| 1.49k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 1.49k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 1.49k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 1.49k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 1.49k] | | ------------------ ------------------ 78| 1.49k| return m_public_key->group(); 79| 1.49k|} _ZN5Botan13EC_PrivateKeyC2ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEEb: 191| 3.24k| m_with_modular_inverse(with_modular_inverse) { 192| 3.24k| OID key_parameters; 193| 3.24k| secure_vector private_key_bits; 194| 3.24k| secure_vector public_key_bits; 195| | 196| 3.24k| BER_Decoder(key_bits, BER_Decoder::Limits::DER()) 197| 3.24k| .start_sequence() 198| 3.24k| .decode_and_check(1, "Unknown version code for ECC key") 199| 3.24k| .decode(private_key_bits, ASN1_Type::OctetString) 200| 3.24k| .decode_optional(key_parameters, ASN1_Type(0), ASN1_Class::ExplicitContextSpecific) 201| 3.24k| .decode_optional_octet_aligned_bitstring(public_key_bits, 1, ASN1_Class::ExplicitContextSpecific) 202| 3.24k| .end_cons() 203| 3.24k| .verify_end(); 204| | 205| 3.24k| std::unique_ptr group; 206| | 207| 3.24k| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (207:7): [True: 3.12k, False: 124] ------------------ 208| 3.12k| group = std::make_unique(alg_id.parameters()); 209| 3.12k| } 210| 3.24k| if(!key_parameters.empty()) { ------------------ | Branch (210:7): [True: 37, False: 3.21k] ------------------ 211| 37| if(group) { ------------------ | Branch (211:10): [True: 37, False: 0] ------------------ 212| 37| if(EC_Group(key_parameters) != *group) { ------------------ | Branch (212:13): [True: 21, False: 16] ------------------ 213| 21| throw Decoding_Error("ECPrivateKey parameters do not match the AlgorithmIdentifier parameters"); 214| 21| } 215| 37| } else { 216| 0| group = std::make_unique(key_parameters); 217| 0| } 218| 37| } 219| 3.22k| if(!group) { ------------------ | Branch (219:7): [True: 1, False: 3.22k] ------------------ 220| 1| throw Decoding_Error("ECPrivateKey has no domain parameters"); 221| 1| } 222| | 223| 3.22k| m_private_key = std::make_shared(*group, private_key_bits); 224| 3.22k| m_public_key = m_private_key->public_key(with_modular_inverse); 225| | 226| | // If the encoding carried a public key it must agree with the derived one 227| 3.22k| if(!public_key_bits.empty()) { ------------------ | Branch (227:7): [True: 791, False: 2.43k] ------------------ 228| 791| const EC_PublicKey_Data encoded_public_key(*group, public_key_bits); 229| 791| if(encoded_public_key.public_key() != m_public_key->public_key()) { ------------------ | Branch (229:10): [True: 185, False: 606] ------------------ 230| 185| throw Decoding_Error("ECPrivateKey public key does not match the private key"); 231| 185| } 232| 791| } 233| | 234| 3.04k| m_domain_encoding = default_encoding_for(domain()); 235| 3.04k|} ecc_key.cpp:_ZN5Botan12_GLOBAL__N_120default_encoding_forERKNS_8EC_GroupE: 38| 1.49k|EC_Group_Encoding default_encoding_for(const EC_Group& group) { 39| 1.49k| if(group.get_curve_oid().empty()) { ------------------ | Branch (39:7): [True: 0, False: 1.49k] ------------------ 40| 0| return EC_Group_Encoding::Explicit; 41| 1.49k| } else { 42| 1.49k| return EC_Group_Encoding::NamedCurve; 43| 1.49k| } 44| 1.49k|} _ZN5Botan20GOST_3410_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 190| 2| EC_PrivateKey(gost_private_key_alg_id(alg_id), key_bits) {} gost_3410.cpp:_ZN5Botan12_GLOBAL__N_132assert_gost_algorithm_identifierERKNS_19AlgorithmIdentifierE: 37| 2|const AlgorithmIdentifier& assert_gost_algorithm_identifier(const AlgorithmIdentifier& alg_id) { 38| 2| if(!is_gost_3410_key_oid(alg_id.oid())) { ------------------ | Branch (38:7): [True: 1, False: 1] ------------------ 39| 1| throw Decoding_Error( 40| 1| fmt("Unexpected AlgorithmIdentifier OID {} in association with GOST 34.10 key", alg_id.oid())); 41| 1| } 42| | 43| 1| return alg_id; // NOLINT(*-return-const-ref-from-parameter) 44| 2|} gost_3410.cpp:_ZN5Botan12_GLOBAL__N_120is_gost_3410_key_oidERKNS_3OIDE: 32| 2|bool is_gost_3410_key_oid(const OID& oid) { 33| 2| return oid == OID::from_string("GOST-34.10") || oid == OID::from_string("GOST-34.10-2012-256") || ------------------ | Branch (33:11): [True: 1, False: 1] | Branch (33:52): [True: 0, False: 1] ------------------ 34| 1| oid == OID::from_string("GOST-34.10-2012-512"); ------------------ | Branch (34:11): [True: 0, False: 1] ------------------ 35| 2|} gost_3410.cpp:_ZN5Botan12_GLOBAL__N_126decode_gost_key_parametersERKNS_19AlgorithmIdentifierE: 46| 1|OID decode_gost_key_parameters(const AlgorithmIdentifier& alg_id) { 47| 1| OID ecc_param_id; 48| | 49| 1| auto outer = BER_Decoder(alg_id.parameters(), BER_Decoder::Limits::DER()); 50| 1| auto params = outer.start_sequence(); 51| 1| params.decode(ecc_param_id); 52| | 53| 1| if(params.more_items()) { ------------------ | Branch (53:7): [True: 0, False: 1] ------------------ 54| 0| OID digest_param_id; 55| 0| params.decode(digest_param_id); 56| | 57| 0| if(alg_id.oid() == OID::from_string("GOST-34.10-2012-256") && ------------------ | Branch (57:10): [True: 0, False: 0] | Branch (57:10): [True: 0, False: 0] ------------------ 58| 0| digest_param_id != OID::from_string("Streebog-256")) { ------------------ | Branch (58:10): [True: 0, False: 0] ------------------ 59| 0| throw Decoding_Error("Unexpected digest parameters for GOST-34.10-2012-256 public key"); 60| 0| } 61| | 62| 0| if(alg_id.oid() == OID::from_string("GOST-34.10-2012-512") && ------------------ | Branch (62:10): [True: 0, False: 0] | Branch (62:10): [True: 0, False: 0] ------------------ 63| 0| digest_param_id != OID::from_string("Streebog-512")) { ------------------ | Branch (63:10): [True: 0, False: 0] ------------------ 64| 0| throw Decoding_Error("Unexpected digest parameters for GOST-34.10-2012-512 public key"); 65| 0| } 66| 0| } 67| | 68| 1| if(params.more_items()) { ------------------ | Branch (68:7): [True: 0, False: 1] ------------------ 69| 0| if(alg_id.oid() != OID::from_string("GOST-34.10")) { ------------------ | Branch (69:10): [True: 0, False: 0] ------------------ 70| 0| throw Decoding_Error("Unexpected extra parameters for GOST-34.10-2012 public key"); 71| 0| } 72| | 73| 0| OID encryption_param_id; 74| 0| params.decode(encryption_param_id); 75| 0| } 76| | 77| 1| params.verify_end(); 78| 1| outer.verify_end(); 79| | 80| 1| return ecc_param_id; 81| 1|} gost_3410.cpp:_ZN5Botan12_GLOBAL__N_123gost_private_key_alg_idERKNS_19AlgorithmIdentifierE: 93| 2|AlgorithmIdentifier gost_private_key_alg_id(const AlgorithmIdentifier& alg_id) { 94| 2| assert_gost_algorithm_identifier(alg_id); 95| | 96| 2| OID ecc_param_id; 97| 2| BER_Decoder decoder(alg_id.parameters(), BER_Decoder::Limits::DER()); 98| 2| if(decoder.peek_next_object().type_tag() == ASN1_Type::ObjectId) { ------------------ | Branch (98:7): [True: 0, False: 2] ------------------ 99| 0| decoder.decode(ecc_param_id).verify_end(); 100| 2| } else { 101| 2| ecc_param_id = decode_gost_key_parameters(alg_id); 102| 2| } 103| | 104| 2| const auto group = check_domain(EC_Group::from_OID(ecc_param_id)); 105| 2| check_gost_key_oid_matches_group(alg_id.oid(), group); 106| | 107| 2| return AlgorithmIdentifier(alg_id.oid(), group.DER_encode()); 108| 2|} _ZN5Botan9KyberModeC2ERKNS_3OIDE: 87| 54|KyberMode::KyberMode(const OID& oid) : m_mode(kyber_mode_from_oid(oid)) {} _ZNK5Botan9KyberMode9is_ml_kemEv: 128| 162|bool KyberMode::is_ml_kem() const { 129| 162| return m_mode == KyberMode::ML_KEM_512 || m_mode == KyberMode::ML_KEM_768 || m_mode == KyberMode::ML_KEM_1024; ------------------ | Branch (129:11): [True: 42, False: 120] | Branch (129:46): [True: 42, False: 78] | Branch (129:81): [True: 78, False: 0] ------------------ 130| 162|} _ZNK5Botan9KyberMode15is_kyber_round3Ev: 132| 196|bool KyberMode::is_kyber_round3() const { 133| 196| return m_mode == KyberMode::Kyber512_R3 || m_mode == KyberMode::Kyber768_R3 || m_mode == KyberMode::Kyber1024_R3 || ------------------ | Branch (133:11): [True: 0, False: 196] | Branch (133:47): [True: 0, False: 196] | Branch (133:83): [True: 0, False: 196] ------------------ 134| 196| m_mode == KyberMode::Kyber512_90s || m_mode == KyberMode::Kyber768_90s || m_mode == KyberMode::Kyber1024_90s; ------------------ | Branch (134:11): [True: 0, False: 196] | Branch (134:48): [True: 0, False: 196] | Branch (134:85): [True: 0, False: 196] ------------------ 135| 196|} _ZN5Botan16Kyber_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 241| 54| Kyber_PrivateKey(key_bits, KyberMode(alg_id.oid())) { 242| | // The parameter set is identified by the OID; no parameters are defined. 243| 54| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (243:7): [True: 40, False: 14] ------------------ 244| 40| throw Decoding_Error("Unexpected parameters for ML-KEM/Kyber private key"); 245| 40| } 246| 54|} _ZN5Botan16Kyber_PrivateKeyC1ENSt3__14spanIKhLm18446744073709551615EEENS_9KyberModeE: 248| 54|Kyber_PrivateKey::Kyber_PrivateKey(std::span sk, KyberMode m) { 249| 54| KyberConstants mode(m); 250| | 251| 54| if(mode.mode().is_ml_kem() && sk.size() == mode.seed_private_key_bytes()) { ------------------ | Branch (251:7): [True: 54, False: 0] | Branch (251:7): [True: 44, False: 10] | Branch (251:34): [True: 44, False: 10] ------------------ 252| 44| std::tie(m_public, m_private) = Seed_Expanding_Keypair_Codec().decode_keypair(sk, std::move(mode)); 253| 44| } else if(sk.size() == mode.expanded_private_key_bytes()) { ------------------ | Branch (253:14): [True: 0, False: 10] ------------------ 254| 0| std::tie(m_public, m_private) = Expanded_Keypair_Codec().decode_keypair(sk, std::move(mode)); 255| 10| } else if(!mode.mode().is_ml_kem() && sk.size() == mode.seed_private_key_bytes()) { ------------------ | Branch (255:14): [True: 0, False: 10] | Branch (255:14): [True: 0, False: 10] | Branch (255:42): [True: 0, False: 0] ------------------ 256| 0| throw Invalid_Argument("Kyber round 3 private keys do not support the seed format"); 257| 10| } else { 258| 10| throw Invalid_Argument("Private key does not have the correct byte count"); 259| 10| } 260| 54|} kyber.cpp:_ZN5Botan12_GLOBAL__N_119kyber_mode_from_oidERKNS_3OIDE: 75| 54|KyberMode::Mode kyber_mode_from_oid(const OID& oid) { 76| 54| if(const auto name = oid.registered_name()) { ------------------ | Branch (76:18): [True: 54, False: 0] ------------------ 77| 54| return kyber_mode_from_string(*name); 78| 54| } 79| | 80| 0| throw Invalid_Argument(fmt("OID '{}' is not registered as a Kyber/ML-KEM mode", oid)); 81| 54|} kyber.cpp:_ZN5Botan12_GLOBAL__N_122kyber_mode_from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 43| 54|KyberMode::Mode kyber_mode_from_string(std::string_view str) { 44| 54| if(str == "Kyber-512-90s-r3") { ------------------ | Branch (44:7): [True: 0, False: 54] ------------------ 45| 0| return KyberMode::Kyber512_90s; 46| 0| } 47| 54| if(str == "Kyber-768-90s-r3") { ------------------ | Branch (47:7): [True: 0, False: 54] ------------------ 48| 0| return KyberMode::Kyber768_90s; 49| 0| } 50| 54| if(str == "Kyber-1024-90s-r3") { ------------------ | Branch (50:7): [True: 0, False: 54] ------------------ 51| 0| return KyberMode::Kyber1024_90s; 52| 0| } 53| 54| if(str == "Kyber-512-r3") { ------------------ | Branch (53:7): [True: 0, False: 54] ------------------ 54| 0| return KyberMode::Kyber512_R3; 55| 0| } 56| 54| if(str == "Kyber-768-r3") { ------------------ | Branch (56:7): [True: 0, False: 54] ------------------ 57| 0| return KyberMode::Kyber768_R3; 58| 0| } 59| 54| if(str == "Kyber-1024-r3") { ------------------ | Branch (59:7): [True: 0, False: 54] ------------------ 60| 0| return KyberMode::Kyber1024_R3; 61| 0| } 62| 54| if(str == "ML-KEM-512") { ------------------ | Branch (62:7): [True: 14, False: 40] ------------------ 63| 14| return KyberMode::ML_KEM_512; 64| 14| } 65| 40| if(str == "ML-KEM-768") { ------------------ | Branch (65:7): [True: 14, False: 26] ------------------ 66| 14| return KyberMode::ML_KEM_768; 67| 14| } 68| 26| if(str == "ML-KEM-1024") { ------------------ | Branch (68:7): [True: 26, False: 0] ------------------ 69| 26| return KyberMode::ML_KEM_1024; 70| 26| } 71| | 72| 0| throw Invalid_Argument(fmt("'{}' is not a valid Kyber mode name", str)); 73| 26|} _ZN5Botan11Kyber_Algos24encode_polynomial_vectorENSt3__14spanIhLm18446744073709551615EEERKNS_8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS4_6DomainE1EEE: 234| 44|void encode_polynomial_vector(std::span out, const KyberPolyVecNTT& vec) { 235| 44| BufferStuffer bs(out); 236| 144| for(const auto& v : vec) { ------------------ | Branch (236:22): [True: 144, False: 44] ------------------ 237| 144| byte_encode(bs, v); 238| 144| } 239| 44| BOTAN_ASSERT_NOMSG(bs.full()); ------------------ | | 84| 44| do { \ | | 85| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 44| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 44] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 44| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 44] | | ------------------ ------------------ 240| 44|} _ZN5Botan11Kyber_Algos14expand_keypairENS_19KyberPrivateKeySeedENS_14KyberConstantsE: 371| 44|KyberInternalKeypair expand_keypair(KyberPrivateKeySeed seed, KyberConstants mode) { 372| 44| BOTAN_ARG_CHECK(seed.d.has_value(), "Cannot expand keypair without the full private seed"); ------------------ | | 35| 44| do { \ | | 36| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 44| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 44] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 44| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 44] | | ------------------ ------------------ 373| 44| const auto& d = seed.d.value(); 374| | 375| 44| CT::poison(d); 376| 44| auto [rho, sigma] = mode.symmetric_primitives().G(d, mode); 377| 44| CT::unpoison(rho); // rho is public (seed for the public matrix A) 378| | 379| | // Algorithm 13 (K-PKE.KeyGen) ---------------- 380| | 381| 44| const auto A = Kyber_Algos::sample_matrix(rho, false /* not transposed */, mode); 382| | 383| | // The nonce N is handled internally by the PolynomialSampler 384| 44| Kyber_Algos::PolynomialSampler ps(sigma, mode); 385| 44| auto [s_std, e_std] = ps.sample_polynomial_vector_pair_cbd_eta1(); 386| 44| auto s = ntt(std::move(s_std)); 387| 44| const auto e = ntt(std::move(e_std)); 388| | 389| 44| auto t = montgomery(A * s); 390| 44| t += e; 391| 44| t.reduce(); 392| | 393| | // Bring s into canonical [0,Q) form (as ByteEncode_12 requires), matching 394| | // the representation produced when decoding a private key. This lets the 395| | // secret key be serialized directly, without reducing a copy at encode time. 396| 44| s.reduce(); 397| | 398| | // End Algorithm 13 --------------------------- 399| | 400| 44| CT::unpoison_all(d, t, s); 401| | 402| 44| return { 403| 44| std::make_shared(mode, std::move(t), std::move(rho)), 404| 44| std::make_shared(std::move(mode), std::move(s), std::move(seed)), 405| 44| }; 406| 44|} _ZN5Botan11Kyber_Algos13sample_matrixENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS_13KyberSeedRho_EJEEEEEbRKNS_14KyberConstantsE: 436| 44|KyberPolyMat sample_matrix(StrongSpan seed, bool transposed, const KyberConstants& mode) { 437| 44| BOTAN_ASSERT(seed.size() == KyberConstants::SEED_BYTES, "unexpected seed size"); ------------------ | | 71| 44| do { \ | | 72| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 44| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 44] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 44| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 44] | | ------------------ ------------------ 438| | 439| 44| KyberPolyMat mat(mode.k(), mode.k()); 440| | 441| 44| const auto& sym = mode.symmetric_primitives(); 442| | 443| | // Pre-squeeze the XOFs of all matrix entries at once, sized so that 444| | // the rejection sampling loop rarely (under 1% of the time) needs more. 445| 44| constexpr size_t buffered_bytes = 3 * 168; // 3 SHAKE-128 blocks 446| | 447| 44| const size_t lanes = static_cast(mode.k()) * mode.k(); 448| 44| std::vector buffer(lanes * buffered_bytes); 449| 44| std::vector> positions; 450| 44| std::vector> outputs; 451| 44| positions.reserve(lanes); 452| 44| outputs.reserve(lanes); 453| | 454| 188| for(uint8_t i = 0; i < mode.k(); ++i) { ------------------ | Branch (454:23): [True: 144, False: 44] ------------------ 455| 646| for(uint8_t j = 0; j < mode.k(); ++j) { ------------------ | Branch (455:26): [True: 502, False: 144] ------------------ 456| 502| positions.push_back((transposed) ? std::tuple(i, j) : std::tuple(j, i)); ------------------ | Branch (456:30): [True: 0, False: 502] ------------------ 457| 502| outputs.push_back(std::span(buffer).subspan(outputs.size() * buffered_bytes, buffered_bytes)); 458| 502| } 459| 144| } 460| | 461| 44| sym.XOF_batch(outputs, seed, positions); 462| | 463| 44| std::unique_ptr xof; 464| 44| size_t lane = 0; 465| 188| for(uint8_t i = 0; i < mode.k(); ++i) { ------------------ | Branch (465:23): [True: 144, False: 44] ------------------ 466| 646| for(uint8_t j = 0; j < mode.k(); ++j, ++lane) { ------------------ | Branch (466:26): [True: 502, False: 144] ------------------ 467| 502| if(!sample_ntt_uniform_from_buffer(mat[i][j], outputs[lane])) { ------------------ | Branch (467:13): [True: 70, False: 432] ------------------ 468| 70| sym.setup_XOF(xof, seed, positions[lane]); 469| 70| sample_ntt_uniform(mat[i][j], *xof); 470| 70| } 471| 502| } 472| 144| } 473| | 474| 44| return mat; 475| 44|} _ZN5Botan11Kyber_Algos26sample_polynomial_from_cbdERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS1_6DomainE0EEENS_14KyberConstants8KyberEtaENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEEE: 485| 288| StrongSpan randomness) { 486| 288| switch(eta) { ------------------ | Branch (486:11): [True: 288, False: 0] ------------------ 487| 244| case KyberConstants::KyberEta::_2: ------------------ | Branch (487:7): [True: 244, False: 44] ------------------ 488| 244| return sample_poly_cbd(poly, randomness); 489| 44| case KyberConstants::KyberEta::_3: ------------------ | Branch (489:7): [True: 44, False: 244] ------------------ 490| 44| return sample_poly_cbd(poly, randomness); 491| 288| } 492| | 493| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 494| 0|} kyber_algos.cpp:_ZN5Botan11Kyber_Algos12_GLOBAL__N_111byte_encodeERNS_13BufferStufferERKNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS4_6DomainE1EEE: 44| 144|void byte_encode(BufferStuffer& bs, const KyberPolyNTT& p) { 45| 144| CRYSTALS::pack(p, bs); 46| 144|} kyber_algos.cpp:_ZN5Botan11Kyber_Algos12_GLOBAL__N_130sample_ntt_uniform_from_bufferERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS2_6DomainE1EEENSt3__14spanIKhLm18446744073709551615EEE: 120| 502|bool sample_ntt_uniform_from_buffer(KyberPolyNTT& p, std::span buf) { 121| 502| auto sample = [in = buf, stashed_coeff = std::optional{}]() mutable -> std::optional { 122| 502| const auto lowerthan_q = [](uint32_t d) -> std::optional { 123| 502| if(d < KyberConstants::Q) { 124| 502| return static_cast(d); 125| 502| } else { 126| 502| return std::nullopt; 127| 502| } 128| 502| }; 129| | 130| 502| if(auto stashed = std::exchange(stashed_coeff, std::nullopt)) { 131| 502| return stashed; 132| 502| } 133| | 134| 502| while(in.size() >= 3) { 135| 502| const auto x = load_le3(in.first<3>()); 136| 502| in = in.subspan(3); 137| | 138| 502| const auto d1 = lowerthan_q(x & 0x0FFF); 139| 502| const auto d2 = lowerthan_q(x >> 12); 140| | 141| 502| if(d1.has_value()) { 142| 502| stashed_coeff = d2; // keep candidate d2 for the next invocation 143| 502| return d1; 144| 502| } else if(d2.has_value()) { 145| | // d1 was invalid, d2 is valid, nothing to stash 146| 502| return d2; 147| 502| } 148| 502| } 149| | 150| 502| return std::nullopt; // not enough candidates left in the buffer 151| 502| }; 152| | 153| 128k| for(auto& coeff : p) { ------------------ | Branch (153:20): [True: 128k, False: 432] ------------------ 154| 128k| if(auto c = sample()) { ------------------ | Branch (154:15): [True: 128k, False: 70] ------------------ 155| 128k| coeff = *c; 156| 128k| } else { 157| 70| return false; // buffer exhausted before all coefficients could be sampled 158| 70| } 159| 128k| } 160| | 161| 432| return true; 162| 502|} kyber_algos.cpp:_ZZN5Botan11Kyber_Algos12_GLOBAL__N_130sample_ntt_uniform_from_bufferERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS2_6DomainE1EEENSt3__14spanIKhLm18446744073709551615EEEEN3$_0clEv: 121| 128k| auto sample = [in = buf, stashed_coeff = std::optional{}]() mutable -> std::optional { 122| 128k| const auto lowerthan_q = [](uint32_t d) -> std::optional { 123| 128k| if(d < KyberConstants::Q) { 124| 128k| return static_cast(d); 125| 128k| } else { 126| 128k| return std::nullopt; 127| 128k| } 128| 128k| }; 129| | 130| 128k| if(auto stashed = std::exchange(stashed_coeff, std::nullopt)) { ------------------ | Branch (130:15): [True: 51.3k, False: 77.0k] ------------------ 131| 51.3k| return stashed; 132| 51.3k| } 133| | 134| 80.0k| while(in.size() >= 3) { ------------------ | Branch (134:13): [True: 80.0k, False: 70] ------------------ 135| 80.0k| const auto x = load_le3(in.first<3>()); 136| 80.0k| in = in.subspan(3); 137| | 138| 80.0k| const auto d1 = lowerthan_q(x & 0x0FFF); 139| 80.0k| const auto d2 = lowerthan_q(x >> 12); 140| | 141| 80.0k| if(d1.has_value()) { ------------------ | Branch (141:13): [True: 63.9k, False: 16.0k] ------------------ 142| 63.9k| stashed_coeff = d2; // keep candidate d2 for the next invocation 143| 63.9k| return d1; 144| 63.9k| } else if(d2.has_value()) { ------------------ | Branch (144:20): [True: 12.9k, False: 3.05k] ------------------ 145| | // d1 was invalid, d2 is valid, nothing to stash 146| 12.9k| return d2; 147| 12.9k| } 148| 80.0k| } 149| | 150| 70| return std::nullopt; // not enough candidates left in the buffer 151| 77.0k| }; kyber_algos.cpp:_ZZZN5Botan11Kyber_Algos12_GLOBAL__N_130sample_ntt_uniform_from_bufferERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS2_6DomainE1EEENSt3__14spanIKhLm18446744073709551615EEEEN3$_0clEvENKUljE_clEj: 122| 160k| const auto lowerthan_q = [](uint32_t d) -> std::optional { 123| 160k| if(d < KyberConstants::Q) { ------------------ | Branch (123:13): [True: 128k, False: 31.5k] ------------------ 124| 128k| return static_cast(d); 125| 128k| } else { 126| 31.5k| return std::nullopt; 127| 31.5k| } 128| 160k| }; kyber_algos.cpp:_ZN5Botan11Kyber_Algos12_GLOBAL__N_118sample_ntt_uniformERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS2_6DomainE1EEERNS_3XOFE: 76| 70|void sample_ntt_uniform(KyberPolyNTT& p, XOF& xof) { 77| | // A generator that returns the next coefficient sampled from the XOF. As the 78| | // sampling uses half-bytes, this keeps track of the additionally sampled 79| | // coefficient as needed. 80| 70| auto sample = [stashed_coeff = std::optional{}, 81| 70| bounded_xof = 82| 70| Bounded_XOF(xof)]() mutable -> uint16_t { 83| 70| auto lowerthan_q = [](uint32_t d) -> std::optional { 84| 70| if(d < KyberConstants::Q) { 85| 70| return static_cast(d); 86| 70| } else { 87| 70| return std::nullopt; 88| 70| } 89| 70| }; 90| | 91| 70| if(auto stashed = std::exchange(stashed_coeff, std::nullopt)) { 92| 70| return *stashed; // value retained from a previous invocation 93| 70| } 94| | 95| 70| while(true) { 96| 70| const auto [d1, d2] = bounded_xof.next<3>([&](const auto bytes) { 97| 70| const auto x = load_le3(bytes); 98| 70| return std::pair{lowerthan_q(x & 0x0FFF), lowerthan_q(x >> 12)}; 99| 70| }); 100| | 101| 70| if(d1.has_value()) { 102| 70| stashed_coeff = d2; // keep candidate d2 for the next invocation 103| 70| return *d1; 104| 70| } else if(d2.has_value()) { 105| | // d1 was invalid, d2 is valid, nothing to stash 106| 70| return *d2; 107| 70| } 108| 70| } 109| 70| }; 110| | 111| 17.9k| for(auto& coeff : p) { ------------------ | Branch (111:20): [True: 17.9k, False: 70] ------------------ 112| 17.9k| coeff = sample(); 113| 17.9k| } 114| 70|} kyber_algos.cpp:_ZZN5Botan11Kyber_Algos12_GLOBAL__N_118sample_ntt_uniformERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS2_6DomainE1EEERNS_3XOFEEN3$_0clEv: 82| 17.9k| Bounded_XOF(xof)]() mutable -> uint16_t { 83| 17.9k| auto lowerthan_q = [](uint32_t d) -> std::optional { 84| 17.9k| if(d < KyberConstants::Q) { 85| 17.9k| return static_cast(d); 86| 17.9k| } else { 87| 17.9k| return std::nullopt; 88| 17.9k| } 89| 17.9k| }; 90| | 91| 17.9k| if(auto stashed = std::exchange(stashed_coeff, std::nullopt)) { ------------------ | Branch (91:15): [True: 6.71k, False: 11.2k] ------------------ 92| 6.71k| return *stashed; // value retained from a previous invocation 93| 6.71k| } 94| | 95| 11.9k| while(true) { ------------------ | Branch (95:13): [True: 11.9k, Folded] ------------------ 96| 11.9k| const auto [d1, d2] = bounded_xof.next<3>([&](const auto bytes) { 97| 11.9k| const auto x = load_le3(bytes); 98| 11.9k| return std::pair{lowerthan_q(x & 0x0FFF), lowerthan_q(x >> 12)}; 99| 11.9k| }); 100| | 101| 11.9k| if(d1.has_value()) { ------------------ | Branch (101:13): [True: 8.99k, False: 2.95k] ------------------ 102| 8.99k| stashed_coeff = d2; // keep candidate d2 for the next invocation 103| 8.99k| return *d1; 104| 8.99k| } else if(d2.has_value()) { ------------------ | Branch (104:20): [True: 2.21k, False: 739] ------------------ 105| | // d1 was invalid, d2 is valid, nothing to stash 106| 2.21k| return *d2; 107| 2.21k| } 108| 11.9k| } 109| 11.2k| }; kyber_algos.cpp:_ZZZN5Botan11Kyber_Algos12_GLOBAL__N_118sample_ntt_uniformERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS2_6DomainE1EEERNS_3XOFEEN3$_0clEvENKUlT_E_clINSt3__15arrayIhLm3EEEEEDaSB_: 96| 11.9k| const auto [d1, d2] = bounded_xof.next<3>([&](const auto bytes) { 97| 11.9k| const auto x = load_le3(bytes); 98| 11.9k| return std::pair{lowerthan_q(x & 0x0FFF), lowerthan_q(x >> 12)}; 99| 11.9k| }); kyber_algos.cpp:_ZZZN5Botan11Kyber_Algos12_GLOBAL__N_118sample_ntt_uniformERNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS2_6DomainE1EEERNS_3XOFEEN3$_0clEvENKUljE_clEj: 83| 23.8k| auto lowerthan_q = [](uint32_t d) -> std::optional { 84| 23.8k| if(d < KyberConstants::Q) { ------------------ | Branch (84:13): [True: 17.9k, False: 5.93k] ------------------ 85| 17.9k| return static_cast(d); 86| 17.9k| } else { 87| 5.93k| return std::nullopt; 88| 5.93k| } 89| 23.8k| }; kyber_algos.cpp:_ZN5Botan11Kyber_Algos12_GLOBAL__N_115sample_poly_cbdILNS_14KyberConstants8KyberEtaE2EEEvRNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS5_6DomainE0EEENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEEE: 178| 244| StrongSpan randomness) { 179| 244| BufferSlicer bs(randomness); 180| | 181| 8.05k| for(size_t i = 0; i < poly.size() / 8; ++i) { ------------------ | Branch (181:22): [True: 7.80k, False: 244] ------------------ 182| 7.80k| const uint32_t t = Botan::load_le(bs.take<4>()); 183| | 184| | // SWAR (SIMD within a Register) trick: calculate 16 2-bit-sums in parallel 185| 7.80k| constexpr uint32_t operand_bitmask = 0b01010101010101010101010101010101; 186| | 187| | // clang-format off 188| 7.80k| const uint32_t d = ((t >> 0) & operand_bitmask) + 189| 7.80k| ((t >> 1) & operand_bitmask); 190| | // clang-format on 191| | 192| 70.2k| for(size_t j = 0; j < 8; ++j) { ------------------ | Branch (192:25): [True: 62.4k, False: 7.80k] ------------------ 193| 62.4k| const int16_t a = (d >> (4 * j + 0)) & 0x3; 194| 62.4k| const int16_t b = (d >> (4 * j + 2)) & 0x3; 195| 62.4k| poly[8 * i + j] = a - b; 196| 62.4k| } 197| 7.80k| } 198| | 199| 244| BOTAN_ASSERT_NOMSG(bs.empty()); ------------------ | | 84| 244| do { \ | | 85| 244| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 244| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 244] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 244| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 244] | | ------------------ ------------------ 200| 244|} kyber_algos.cpp:_ZN5Botan11Kyber_Algos12_GLOBAL__N_115sample_poly_cbdILNS_14KyberConstants8KyberEtaE3EEEvRNS_8CRYSTALS10PolynomialINS_15KyberPolyTraitsELNS5_6DomainE0EEENS_10StrongSpanIKNS_6StrongINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_24KyberSamplingRandomness_EJEEEEE: 207| 44| StrongSpan randomness) { 208| 44| BufferSlicer bs(randomness); 209| | 210| 2.86k| for(size_t i = 0; i < poly.size() / 4; ++i) { ------------------ | Branch (210:22): [True: 2.81k, False: 44] ------------------ 211| 2.81k| const uint32_t t = load_le3(bs.take<3>()); 212| | 213| | // SWAR (SIMD within a Register) trick: calculate 8 3-bit-sums in parallel 214| 2.81k| constexpr uint32_t operand_bitmask = 0b00000000001001001001001001001001; 215| | 216| | // clang-format off 217| 2.81k| const uint32_t d = ((t >> 0) & operand_bitmask) + 218| 2.81k| ((t >> 1) & operand_bitmask) + 219| 2.81k| ((t >> 2) & operand_bitmask); 220| | // clang-format on 221| | 222| 14.0k| for(size_t j = 0; j < 4; ++j) { ------------------ | Branch (222:25): [True: 11.2k, False: 2.81k] ------------------ 223| 11.2k| const int16_t a = (d >> (6 * j + 0)) & 0x7; 224| 11.2k| const int16_t b = (d >> (6 * j + 3)) & 0x7; 225| 11.2k| poly[4 * i + j] = a - b; 226| 11.2k| } 227| 2.81k| } 228| | 229| 44| BOTAN_ASSERT_NOMSG(bs.empty()); ------------------ | | 84| 44| do { \ | | 85| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 44| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 44] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 44| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 44] | | ------------------ ------------------ 230| 44|} _ZN5Botan10Kyber_AVX23nttENSt3__14spanIsLm256EEE: 343| 288|BOTAN_FN_ISA_AVX2 void ntt(std::span p) { 344| 288| int16_t* c = p.data(); 345| 288| const auto q = SIMD_16x16::splat(KyberConstants::Q); 346| | 347| 288| size_t k = 1; 348| 1.44k| for(size_t len = 128; len >= 16; len >>= 1) { ------------------ | Branch (348:26): [True: 1.15k, False: 288] ------------------ 349| 5.47k| for(size_t start = 0; start < 256; start += 2 * len, ++k) { ------------------ | Branch (349:29): [True: 4.32k, False: 1.15k] ------------------ 350| 4.32k| const Zeta zeta = TABLES.zeta(k); 351| 13.5k| for(size_t j = start; j < start + len; j += 16) { ------------------ | Branch (351:32): [True: 9.21k, False: 4.32k] ------------------ 352| 9.21k| auto a = SIMD_16x16::load(c + j); 353| 9.21k| auto b = SIMD_16x16::load(c + j + len); 354| 9.21k| ct_butterfly(a, b, zeta, q); 355| 9.21k| a.store(c + j); 356| 9.21k| b.store(c + j + len); 357| 9.21k| } 358| 4.32k| } 359| 1.15k| } 360| | 361| 288| const auto v = SIMD_16x16::splat(KyberPolyTraits::BARRETT_V); 362| 2.59k| for(size_t blk = 0; blk < 8; ++blk) { ------------------ | Branch (362:24): [True: 2.30k, False: 288] ------------------ 363| 2.30k| int16_t* cb = c + 32 * blk; 364| 2.30k| auto a = SIMD_16x16::load(cb); 365| 2.30k| auto b = SIMD_16x16::load(cb + 16); 366| | 367| 2.30k| swap_halves(a, b); 368| 2.30k| ct_butterfly(a, b, TABLES.forward_8(blk), q); 369| 2.30k| interleave64(a, b); 370| 2.30k| ct_butterfly(a, b, TABLES.forward_4(blk), q); 371| 2.30k| distance_4_to_2(a, b); 372| 2.30k| ct_butterfly(a, b, TABLES.forward_2(blk), q); 373| 2.30k| distance_2_to_4(a, b); 374| 2.30k| interleave64(a, b); 375| 2.30k| swap_halves(a, b); 376| | 377| 2.30k| barrett(a, v, q).store(cb); 378| 2.30k| barrett(b, v, q).store(cb + 16); 379| 2.30k| } 380| 288|} _ZN5Botan10Kyber_AVX225poly_pointwise_montgomeryENSt3__14spanIsLm256EEENS2_IKsLm256EEES5_: 448| 502| std::span rhs) { 449| 502| const auto q = SIMD_16x16::splat(KyberConstants::Q); 450| 502| const auto qinv = SIMD_16x16::splat(KyberPolyTraits::q_inverse()); 451| | 452| 8.53k| for(size_t i = 0; i < 16; ++i) { ------------------ | Branch (452:22): [True: 8.03k, False: 502] ------------------ 453| 8.03k| const auto a = SIMD_16x16::load(lhs.data() + 16 * i); 454| 8.03k| const auto b = SIMD_16x16::load(rhs.data() + 16 * i); 455| | 456| 8.03k| const auto ab = fqmul(a, b, qinv, q); 457| 8.03k| const auto ab_swapped = fqmul(a, b.swap_16_halves(), qinv, q); 458| | 459| 8.03k| const auto zeta_a1b1 = fqmul_const(ab.swap_16_halves(), TABLES.basemul(i), q); 460| | 461| 8.03k| const auto r0 = ab + zeta_a1b1; 462| 8.03k| const auto r1 = ab_swapped + ab_swapped.swap_16_halves(); 463| | 464| 8.03k| r0.blend<0xAA>(r1).store(result.data() + 16 * i); 465| 8.03k| } 466| 502|} kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x165splatEs: 35| 10.2k| static BOTAN_FN_ISA_AVX2 SIMD_16x16 splat(int16_t v) { return SIMD_16x16(_mm256_set1_epi16(v)); } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x16C2EDv4_x: 33| 416k| BOTAN_FN_ISA_AVX2 explicit SIMD_16x16(native_type x) : m_simd(x) {} kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_16Tables4zetaEm: 212| 4.32k| BOTAN_FN_ISA_AVX2 Zeta zeta(size_t k) const { return {SIMD_16x16::splat(m_z[k]), SIMD_16x16::splat(m_zq[k])}; } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x164loadEPKs: 37| 68.9k| static BOTAN_FN_ISA_AVX2 SIMD_16x16 load(const int16_t in[]) { 38| 68.9k| return SIMD_16x16(_mm256_loadu_si256(reinterpret_cast(in))); 39| 68.9k| } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_112ct_butterflyERNS1_10SIMD_16x16ES3_RKNS1_4ZetaES2_: 286| 16.1k|BOTAN_FN_ISA_AVX2 BOTAN_FORCE_INLINE void ct_butterfly(SIMD_16x16& a, SIMD_16x16& b, const Zeta& zeta, SIMD_16x16 q) { 287| 16.1k| const auto t = fqmul_const(b, zeta, q); 288| 16.1k| b = a - t; 289| 16.1k| a = a + t; 290| 16.1k|} kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x16miERKS2_: 49| 60.9k| BOTAN_FN_ISA_AVX2 SIMD_16x16 operator-(const SIMD_16x16& o) const { 50| 60.9k| return SIMD_16x16(_mm256_sub_epi16(m_simd, o.m_simd)); 51| 60.9k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x165storeEPs: 41| 31.0k| BOTAN_FN_ISA_AVX2 void store(int16_t out[]) const { 42| 31.0k| _mm256_storeu_si256(reinterpret_cast<__m256i*>(out), m_simd); 43| 31.0k| } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_111swap_halvesERNS1_10SIMD_16x16ES3_: 308| 4.60k|BOTAN_FN_ISA_AVX2 BOTAN_FORCE_INLINE void swap_halves(SIMD_16x16& a, SIMD_16x16& b) { 309| 4.60k| const auto x = SIMD_16x16::concat_lo128(a, b); 310| 4.60k| const auto y = SIMD_16x16::concat_hi128(a, b); 311| 4.60k| a = x; 312| 4.60k| b = y; 313| 4.60k|} kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x1612concat_lo128ERKS2_S4_: 99| 4.60k| static BOTAN_FN_ISA_AVX2 SIMD_16x16 concat_lo128(const SIMD_16x16& a, const SIMD_16x16& b) { 100| | return SIMD_16x16(_mm256_permute2x128_si256(a.m_simd, b.m_simd, 0x20)); 101| 4.60k| } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x1612concat_hi128ERKS2_S4_: 104| 4.60k| static BOTAN_FN_ISA_AVX2 SIMD_16x16 concat_hi128(const SIMD_16x16& a, const SIMD_16x16& b) { 105| | return SIMD_16x16(_mm256_permute2x128_si256(a.m_simd, b.m_simd, 0x31)); 106| 4.60k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_16Tables9forward_8Em: 214| 2.30k| BOTAN_FN_ISA_AVX2 Zeta forward_8(size_t blk) const { return lanes(m_f8[blk], m_f8q[blk]); } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_16Tables5lanesERKNSt3__15arrayIsLm16EEES7_: 239| 14.9k| static BOTAN_FN_ISA_AVX2 Zeta lanes(const Lanes& z, const Lanes& zq) { 240| 14.9k| return {SIMD_16x16::load(z.data()), SIMD_16x16::load(zq.data())}; 241| 14.9k| } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_112interleave64ERNS1_10SIMD_16x16ES3_: 316| 9.21k|BOTAN_FN_ISA_AVX2 BOTAN_FORCE_INLINE void interleave64(SIMD_16x16& a, SIMD_16x16& b) { 317| 9.21k| const auto x = SIMD_16x16::interleave_lo64(a, b); 318| 9.21k| const auto y = SIMD_16x16::interleave_hi64(a, b); 319| 9.21k| a = x; 320| 9.21k| b = y; 321| 9.21k|} kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x1615interleave_lo64ERKS2_S4_: 109| 9.21k| static BOTAN_FN_ISA_AVX2 SIMD_16x16 interleave_lo64(const SIMD_16x16& a, const SIMD_16x16& b) { 110| 9.21k| return SIMD_16x16(_mm256_unpacklo_epi64(a.m_simd, b.m_simd)); 111| 9.21k| } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x1615interleave_hi64ERKS2_S4_: 114| 9.21k| static BOTAN_FN_ISA_AVX2 SIMD_16x16 interleave_hi64(const SIMD_16x16& a, const SIMD_16x16& b) { 115| 9.21k| return SIMD_16x16(_mm256_unpackhi_epi64(a.m_simd, b.m_simd)); 116| 9.21k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_16Tables9forward_4Em: 216| 2.30k| BOTAN_FN_ISA_AVX2 Zeta forward_4(size_t blk) const { return lanes(m_f4[blk], m_f4q[blk]); } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_115distance_4_to_2ERNS1_10SIMD_16x16ES3_: 324| 2.30k|BOTAN_FN_ISA_AVX2 BOTAN_FORCE_INLINE void distance_4_to_2(SIMD_16x16& a, SIMD_16x16& b) { 325| 2.30k| a = a.shuffle_32<0xD8>(); 326| 2.30k| b = b.shuffle_32<0xD8>(); 327| 2.30k| interleave64(a, b); 328| 2.30k|} kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x1610shuffle_32ILi216EEES2_v: 77| 9.21k| BOTAN_FN_ISA_AVX2 SIMD_16x16 shuffle_32() const { 78| | return SIMD_16x16(_mm256_shuffle_epi32(m_simd, CTRL)); 79| 9.21k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_16Tables9forward_2Em: 218| 2.30k| BOTAN_FN_ISA_AVX2 Zeta forward_2(size_t blk) const { return lanes(m_f2[blk], m_f2q[blk]); } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_115distance_2_to_4ERNS1_10SIMD_16x16ES3_: 331| 2.30k|BOTAN_FN_ISA_AVX2 BOTAN_FORCE_INLINE void distance_2_to_4(SIMD_16x16& a, SIMD_16x16& b) { 332| 2.30k| interleave64(a, b); 333| 2.30k| a = a.shuffle_32<0xD8>(); 334| 2.30k| b = b.shuffle_32<0xD8>(); 335| 2.30k|} kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_17barrettENS1_10SIMD_16x16ES2_S2_: 281| 4.60k|BOTAN_FN_ISA_AVX2 BOTAN_FORCE_INLINE SIMD_16x16 barrett(SIMD_16x16 a, SIMD_16x16 v, SIMD_16x16 q) { 282| 4.60k| const auto t = a.mul_hi(v).sra<10>(); 283| 4.60k| return a - t.mul_lo(q); 284| 4.60k|} kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x166mul_hiERKS2_: 59| 85.0k| BOTAN_FN_ISA_AVX2 SIMD_16x16 mul_hi(const SIMD_16x16& o) const { 60| 85.0k| return SIMD_16x16(_mm256_mulhi_epi16(m_simd, o.m_simd)); 61| 85.0k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x163sraILi10EEES2_v: 65| 4.60k| BOTAN_FN_ISA_AVX2 SIMD_16x16 sra() const { 66| 4.60k| return SIMD_16x16(_mm256_srai_epi16(m_simd, SHIFT)); 67| 4.60k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x166mul_loERKS2_: 54| 60.8k| BOTAN_FN_ISA_AVX2 SIMD_16x16 mul_lo(const SIMD_16x16& o) const { 55| 60.8k| return SIMD_16x16(_mm256_mullo_epi16(m_simd, o.m_simd)); 56| 60.8k| } kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_111fqmul_constENS1_10SIMD_16x16ERKNS1_4ZetaES2_: 268| 24.1k|BOTAN_FN_ISA_AVX2 BOTAN_FORCE_INLINE SIMD_16x16 fqmul_const(SIMD_16x16 a, const Zeta& zeta, SIMD_16x16 q) { 269| 24.1k| const auto hi = a.mul_hi(zeta.z); 270| 24.1k| const auto u = a.mul_lo(zeta.zq); 271| 24.1k| return hi - u.mul_hi(q); 272| 24.1k|} kyber_avx2.cpp:_ZN5Botan10Kyber_AVX212_GLOBAL__N_15fqmulENS1_10SIMD_16x16ES2_S2_S2_: 275| 16.0k|BOTAN_FN_ISA_AVX2 BOTAN_FORCE_INLINE SIMD_16x16 fqmul(SIMD_16x16 a, SIMD_16x16 b, SIMD_16x16 qinv, SIMD_16x16 q) { 276| 16.0k| const auto hi = a.mul_hi(b); 277| 16.0k| const auto u = a.mul_lo(b).mul_lo(qinv); 278| 16.0k| return hi - u.mul_hi(q); 279| 16.0k|} kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x1614swap_16_halvesEv: 87| 24.0k| BOTAN_FN_ISA_AVX2 SIMD_16x16 swap_16_halves() const { 88| | // clang-format off 89| 24.0k| const SIMD_16x16 tbl( 90| 24.0k| _mm256_setr_epi8( 91| 24.0k| 2, 3, 0, 1, 6, 7, 4, 5, 10, 11, 8, 9, 14, 15, 12, 13, 92| 24.0k| 2, 3, 0, 1, 6, 7, 4, 5, 10, 11, 8, 9, 14, 15, 12, 13)); 93| | // clang-format on 94| | 95| 24.0k| return byte_shuffle(tbl); 96| 24.0k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x1612byte_shuffleERKS2_: 82| 24.0k| BOTAN_FN_ISA_AVX2 SIMD_16x16 byte_shuffle(const SIMD_16x16& tbl) const { 83| 24.0k| return SIMD_16x16(_mm256_shuffle_epi8(m_simd, tbl.m_simd)); 84| 24.0k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_16Tables7basemulEm: 227| 8.03k| BOTAN_FN_ISA_AVX2 Zeta basemul(size_t v) const { return lanes(m_b[v], m_bq[v]); } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x16plERKS2_: 45| 32.1k| BOTAN_FN_ISA_AVX2 SIMD_16x16 operator+(const SIMD_16x16& o) const { 46| 32.1k| return SIMD_16x16(_mm256_add_epi16(m_simd, o.m_simd)); 47| 32.1k| } kyber_avx2.cpp:_ZNK5Botan10Kyber_AVX212_GLOBAL__N_110SIMD_16x165blendILi170EEES2_RKS2_: 71| 8.03k| BOTAN_FN_ISA_AVX2 SIMD_16x16 blend(const SIMD_16x16& other) const { 72| | return SIMD_16x16(_mm256_blend_epi16(m_simd, other.m_simd, MASK)); 73| 8.03k| } _ZN5Botan14KyberConstantsC2ENS_9KyberModeE: 30| 98|KyberConstants::KyberConstants(KyberMode mode) : m_mode(mode) { 31| 98| switch(mode.mode()) { 32| 0| case KyberMode::Kyber512_R3: ------------------ | Branch (32:7): [True: 0, False: 98] ------------------ 33| 0| case KyberMode::Kyber512_90s: ------------------ | Branch (33:7): [True: 0, False: 98] ------------------ 34| 25| case KyberMode::ML_KEM_512: ------------------ | Branch (34:7): [True: 25, False: 73] ------------------ 35| 25| m_nist_strength = KyberStrength::_128; 36| 25| m_k = 2; 37| 25| m_eta1 = KyberEta::_3; 38| 25| m_du = KyberDu::_10; 39| 25| m_dv = KyberDv::_4; 40| 25| break; 41| | 42| 0| case KyberMode::Kyber768_R3: ------------------ | Branch (42:7): [True: 0, False: 98] ------------------ 43| 0| case KyberMode::Kyber768_90s: ------------------ | Branch (43:7): [True: 0, False: 98] ------------------ 44| 24| case KyberMode::ML_KEM_768: ------------------ | Branch (44:7): [True: 24, False: 74] ------------------ 45| 24| m_nist_strength = KyberStrength::_192; 46| 24| m_k = 3; 47| 24| m_eta1 = KyberEta::_2; 48| 24| m_du = KyberDu::_10; 49| 24| m_dv = KyberDv::_4; 50| 24| break; 51| | 52| 0| case KyberMode::Kyber1024_R3: ------------------ | Branch (52:7): [True: 0, False: 98] ------------------ 53| 0| case KyberMode::Kyber1024_90s: ------------------ | Branch (53:7): [True: 0, False: 98] ------------------ 54| 49| case KyberMode::ML_KEM_1024: ------------------ | Branch (54:7): [True: 49, False: 49] ------------------ 55| 49| m_nist_strength = KyberStrength::_256; 56| 49| m_k = 4; 57| 49| m_eta1 = KyberEta::_2; 58| 49| m_du = KyberDu::_11; 59| 49| m_dv = KyberDv::_5; 60| 49| break; 61| | 62| 0| default: ------------------ | Branch (62:7): [True: 0, False: 98] ------------------ 63| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 64| 98| } 65| | 66| 98|#ifdef BOTAN_HAS_KYBER_90S 67| 98| if(mode.is_kyber_round3() && mode.is_90s()) { ------------------ | Branch (67:7): [True: 0, False: 98] | Branch (67:33): [True: 0, False: 0] ------------------ 68| 0| m_symmetric_primitives = std::make_unique(); 69| 0| } 70| 98|#endif 71| | 72| 98|#ifdef BOTAN_HAS_KYBER 73| 98| if(mode.is_kyber_round3() && mode.is_modern()) { ------------------ | Branch (73:7): [True: 0, False: 98] | Branch (73:33): [True: 0, False: 0] ------------------ 74| 0| m_symmetric_primitives = std::make_unique(); 75| 0| } 76| 98|#endif 77| | 78| 98|#ifdef BOTAN_HAS_ML_KEM 79| 98| if(mode.is_ml_kem()) { ------------------ | Branch (79:7): [True: 98, False: 0] ------------------ 80| 98| m_symmetric_primitives = std::make_unique(); 81| 98| } 82| 98|#endif 83| | 84| 98| static_assert(N % 8 == 0); 85| 98| m_polynomial_vector_bytes = (bitlen(Q) * (N / 8)) * k(); 86| 98| m_polynomial_vector_compressed_bytes = d_u() * k() * (N / 8); 87| 98| m_polynomial_compressed_bytes = d_v() * (N / 8); 88| 98| m_expanded_private_key_bytes = 89| 98| static_cast(m_polynomial_vector_bytes + public_key_bytes() + PUBLIC_KEY_HASH_BYTES + SEED_BYTES); 90| 98| m_seed_private_key_bytes = 2 * SEED_BYTES; 91| | 92| 98| if(!m_symmetric_primitives) { ------------------ | Branch (92:7): [True: 0, False: 98] ------------------ 93| 0| throw Not_Implemented("requested Kyber mode is not enabled in this build"); 94| 0| } 95| 98|} _ZN5Botan14KyberConstantsD2Ev: 97| 318|KyberConstants::~KyberConstants() = default; _ZNK5Botan28Seed_Expanding_Keypair_Codec14decode_keypairENSt3__14spanIKhLm18446744073709551615EEENS_14KyberConstantsE: 88| 44| KyberConstants mode) const { 89| 44| BufferSlicer s(private_key); 90| 44| auto seed = KyberPrivateKeySeed{ 91| 44| s.copy(KyberConstants::SEED_BYTES), 92| 44| s.copy(KyberConstants::SEED_BYTES), 93| 44| }; 94| 44| BOTAN_ASSERT_NOMSG(s.empty()); ------------------ | | 84| 44| do { \ | | 85| 44| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 44| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 44] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 44| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 44] | | ------------------ ------------------ 95| 44| return Kyber_Algos::expand_keypair(std::move(seed), std::move(mode)); 96| 44|} _ZN5Botan23Kyber_PublicKeyInternalC2ENS_14KyberConstantsENS_8CRYSTALS16PolynomialVectorINS_15KyberPolyTraitsELNS2_6DomainE1EEENS_6StrongINSt3__16vectorIhNS8_9allocatorIhEEEENS_13KyberSeedRho_EJEEE: 114| 44| m_mode(std::move(mode)), 115| 44| m_public_key_bits_raw(concat(Kyber_Algos::encode_polynomial_vector>(t, m_mode), rho)), 116| 44| m_H_public_key_bits_raw(m_mode.symmetric_primitives().H(m_public_key_bits_raw)), 117| 44| m_t(std::move(t)), 118| 44| m_rho(std::move(rho)) {} _ZN5Botan8PEM_Code6decodeERNS_10DataSourceERNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEE: 64| 268|secure_vector decode(DataSource& source, std::string& label) { 65| 268| const size_t RANDOM_CHAR_LIMIT = 8; 66| | 67| 268| label.clear(); 68| | 69| 268| const std::string PEM_HEADER1 = "-----BEGIN "; 70| 268| const std::string PEM_HEADER2 = "-----"; 71| 268| size_t position = 0; 72| | 73| 3.77k| while(position != PEM_HEADER1.length()) { ------------------ | Branch (73:10): [True: 3.54k, False: 226] ------------------ 74| 3.54k| auto b = source.read_byte(); 75| | 76| 3.54k| if(!b) { ------------------ | Branch (76:10): [True: 41, False: 3.50k] ------------------ 77| 41| throw Decoding_Error("PEM: No PEM header found"); 78| 41| } 79| 3.50k| if(static_cast(*b) == PEM_HEADER1[position]) { ------------------ | Branch (79:10): [True: 2.72k, False: 776] ------------------ 80| 2.72k| ++position; 81| 2.72k| } else if(position >= RANDOM_CHAR_LIMIT) { ------------------ | Branch (81:17): [True: 1, False: 775] ------------------ 82| 1| throw Decoding_Error("PEM: Malformed PEM header"); 83| 775| } else { 84| 775| position = 0; 85| 775| } 86| 3.50k| } 87| 226| position = 0; 88| 3.10k| while(position != PEM_HEADER2.length()) { ------------------ | Branch (88:10): [True: 2.90k, False: 196] ------------------ 89| 2.90k| auto b = source.read_byte(); 90| | 91| 2.90k| if(!b) { ------------------ | Branch (91:10): [True: 28, False: 2.87k] ------------------ 92| 28| throw Decoding_Error("PEM: No PEM header found"); 93| 28| } 94| 2.87k| if(static_cast(*b) == PEM_HEADER2[position]) { ------------------ | Branch (94:10): [True: 991, False: 1.88k] ------------------ 95| 991| ++position; 96| 1.88k| } else if(position > 0) { ------------------ | Branch (96:17): [True: 1, False: 1.88k] ------------------ 97| 1| throw Decoding_Error("PEM: Malformed PEM header"); 98| 1| } 99| | 100| 2.87k| if(position == 0) { ------------------ | Branch (100:10): [True: 1.88k, False: 991] ------------------ 101| 1.88k| if(label.size() >= 128) { ------------------ | Branch (101:13): [True: 1, False: 1.88k] ------------------ 102| 1| throw Decoding_Error("PEM: Label too long"); 103| 1| } 104| 1.88k| label += static_cast(*b); 105| 1.88k| } 106| 2.87k| } 107| | 108| 196| std::vector b64; 109| | 110| 196| const std::string PEM_TRAILER = fmt("-----END {}-----", label); 111| 196| position = 0; 112| 85.5k| while(position != PEM_TRAILER.length()) { ------------------ | Branch (112:10): [True: 85.3k, False: 144] ------------------ 113| 85.3k| auto b = source.read_byte(); 114| | 115| 85.3k| if(!b) { ------------------ | Branch (115:10): [True: 47, False: 85.3k] ------------------ 116| 47| throw Decoding_Error("PEM: No PEM trailer found"); 117| 47| } 118| 85.3k| if(static_cast(*b) == PEM_TRAILER[position]) { ------------------ | Branch (118:10): [True: 3.02k, False: 82.2k] ------------------ 119| 3.02k| ++position; 120| 82.2k| } else if(position > 0) { ------------------ | Branch (120:17): [True: 5, False: 82.2k] ------------------ 121| 5| throw Decoding_Error("PEM: Malformed PEM trailer"); 122| 5| } 123| | 124| 85.3k| if(position == 0) { ------------------ | Branch (124:10): [True: 82.2k, False: 3.02k] ------------------ 125| 82.2k| b64.push_back(*b); 126| 82.2k| } 127| 85.3k| } 128| | 129| 144| return base64_decode(b64.data(), b64.size()); 130| 196|} _ZN5Botan8PEM_Code7matchesERNS_10DataSourceENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEm: 146| 6.73k|bool matches(DataSource& source, std::string_view extra, size_t search_range) { 147| 6.73k| const std::string PEM_HEADER = fmt("-----BEGIN {}", extra); 148| | 149| 6.73k| std::array stack_buf{}; 150| 6.73k| std::vector heap_buf; 151| 6.73k| uint8_t* search_buf = stack_buf.data(); 152| 6.73k| if(search_range > stack_buf.size()) { ------------------ | Branch (152:7): [True: 0, False: 6.73k] ------------------ 153| 0| heap_buf.resize(search_range); 154| 0| search_buf = heap_buf.data(); 155| 0| } 156| | 157| 6.73k| const size_t got = source.peek(search_buf, search_range, 0); 158| | 159| 6.73k| if(got < PEM_HEADER.length()) { ------------------ | Branch (159:7): [True: 498, False: 6.24k] ------------------ 160| 498| return false; 161| 498| } 162| | 163| 6.24k| return std::search(search_buf, search_buf + got, PEM_HEADER.begin(), PEM_HEADER.end()) != search_buf + got; 164| 6.73k|} _ZN5Botan16load_private_keyERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 298| 3.93k| [[maybe_unused]] std::span key_bits) { 299| 3.93k| const std::string alg_name = [&]() -> std::string { 300| 3.93k| if(const auto name = alg_id.oid().registered_name()) { 301| 3.93k| const std::vector alg_info = split_on(*name, '/'); 302| 3.93k| if(!alg_info.empty()) { 303| 3.93k| return alg_info[0]; 304| 3.93k| } 305| 3.93k| } 306| | 307| 3.93k| throw Decoding_Error( 308| 3.93k| fmt("Private key decoding failed, no algorithm associated with {}", alg_id.oid().to_string())); 309| 3.93k| }(); 310| | 311| 3.93k|#if defined(BOTAN_HAS_RSA) 312| 3.93k| if(alg_name == "RSA") { ------------------ | Branch (312:7): [True: 59, False: 3.87k] ------------------ 313| 59| return std::make_unique(alg_id, key_bits); 314| 59| } 315| 3.87k|#endif 316| | 317| 3.87k|#if defined(BOTAN_HAS_X25519) 318| 3.87k| if(alg_name == "X25519" || alg_name == "Curve25519") { ------------------ | Branch (318:7): [True: 16, False: 3.86k] | Branch (318:31): [True: 0, False: 3.86k] ------------------ 319| 16| return std::make_unique(alg_id, key_bits); 320| 16| } 321| 3.86k|#endif 322| | 323| 3.86k|#if defined(BOTAN_HAS_X448) 324| 3.86k| if(alg_name == "X448") { ------------------ | Branch (324:7): [True: 4, False: 3.85k] ------------------ 325| 4| return std::make_unique(alg_id, key_bits); 326| 4| } 327| 3.85k|#endif 328| | 329| 3.85k|#if defined(BOTAN_HAS_ECDSA) 330| 3.85k| if(alg_name == "ECDSA") { ------------------ | Branch (330:7): [True: 2.51k, False: 1.34k] ------------------ 331| 2.51k| return std::make_unique(alg_id, key_bits); 332| 2.51k| } 333| 1.34k|#endif 334| | 335| 1.34k|#if defined(BOTAN_HAS_ECDH) 336| 1.34k| if(alg_name == "ECDH") { ------------------ | Branch (336:7): [True: 741, False: 604] ------------------ 337| 741| return std::make_unique(alg_id, key_bits); 338| 741| } 339| 604|#endif 340| | 341| 604|#if defined(BOTAN_HAS_DIFFIE_HELLMAN) 342| 604| if(alg_name == "DH") { ------------------ | Branch (342:7): [True: 199, False: 405] ------------------ 343| 199| return std::make_unique(alg_id, key_bits); 344| 199| } 345| 405|#endif 346| | 347| 405|#if defined(BOTAN_HAS_DSA) 348| 405| if(alg_name == "DSA") { ------------------ | Branch (348:7): [True: 117, False: 288] ------------------ 349| 117| return std::make_unique(alg_id, key_bits); 350| 117| } 351| 288|#endif 352| | 353| 288|#if defined(BOTAN_HAS_FRODOKEM) 354| 288| if(alg_name == "FrodoKEM" || alg_name.starts_with("FrodoKEM-") || alg_name.starts_with("eFrodoKEM-")) { ------------------ | Branch (354:7): [True: 0, False: 288] | Branch (354:33): [True: 0, False: 288] | Branch (354:70): [True: 0, False: 288] ------------------ 355| 0| return std::make_unique(alg_id, key_bits); 356| 0| } 357| 288|#endif 358| | 359| 288|#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S) 360| 288| if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) { ------------------ | Branch (360:7): [True: 0, False: 288] | Branch (360:30): [True: 0, False: 288] ------------------ 361| 0| return std::make_unique(alg_id, key_bits); 362| 0| } 363| 288|#endif 364| | 365| 288|#if defined(BOTAN_HAS_ML_KEM) 366| 288| if(alg_name.starts_with("ML-KEM-")) { ------------------ | Branch (366:7): [True: 54, False: 234] ------------------ 367| 54| return std::make_unique(alg_id, key_bits); 368| 54| } 369| 234|#endif 370| | 371| 234|#if defined(BOTAN_HAS_MCELIECE) 372| 234| if(alg_name == "McEliece") { ------------------ | Branch (372:7): [True: 0, False: 234] ------------------ 373| 0| return std::make_unique(alg_id, key_bits); 374| 0| } 375| 234|#endif 376| | 377| 234|#if defined(BOTAN_HAS_ECGDSA) 378| 234| if(alg_name == "ECGDSA") { ------------------ | Branch (378:7): [True: 0, False: 234] ------------------ 379| 0| return std::make_unique(alg_id, key_bits); 380| 0| } 381| 234|#endif 382| | 383| 234|#if defined(BOTAN_HAS_ECKCDSA) 384| 234| if(alg_name == "ECKCDSA") { ------------------ | Branch (384:7): [True: 0, False: 234] ------------------ 385| 0| return std::make_unique(alg_id, key_bits); 386| 0| } 387| 234|#endif 388| | 389| 234|#if defined(BOTAN_HAS_ED25519) 390| 234| if(alg_name == "Ed25519") { ------------------ | Branch (390:7): [True: 42, False: 192] ------------------ 391| 42| return std::make_unique(alg_id, key_bits); 392| 42| } 393| 192|#endif 394| | 395| 192|#if defined(BOTAN_HAS_ED448) 396| 192| if(alg_name == "Ed448") { ------------------ | Branch (396:7): [True: 5, False: 187] ------------------ 397| 5| return std::make_unique(alg_id, key_bits); 398| 5| } 399| 187|#endif 400| | 401| 187|#if defined(BOTAN_HAS_GOST_34_10_2001) 402| 187| if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") { ------------------ | Branch (402:7): [True: 2, False: 185] | Branch (402:35): [True: 0, False: 185] | Branch (402:72): [True: 0, False: 185] ------------------ 403| 2| return std::make_unique(alg_id, key_bits); 404| 2| } 405| 185|#endif 406| | 407| 185|#if defined(BOTAN_HAS_SM2) 408| 185| if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") { ------------------ | Branch (408:7): [True: 0, False: 185] | Branch (408:28): [True: 0, False: 185] | Branch (408:53): [True: 0, False: 185] ------------------ 409| 0| return std::make_unique(alg_id, key_bits); 410| 0| } 411| 185|#endif 412| | 413| 185|#if defined(BOTAN_HAS_ELGAMAL) 414| 185| if(alg_name == "ElGamal") { ------------------ | Branch (414:7): [True: 0, False: 185] ------------------ 415| 0| return std::make_unique(alg_id, key_bits); 416| 0| } 417| 185|#endif 418| | 419| 185|#if defined(BOTAN_HAS_XMSS_RFC8391) 420| 185| if(alg_name == "XMSS") { ------------------ | Branch (420:7): [True: 0, False: 185] ------------------ 421| 0| return std::make_unique(alg_id, key_bits); 422| 0| } 423| 185|#endif 424| | 425| 185|#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES) 426| 185| if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) { ------------------ | Branch (426:7): [True: 0, False: 185] | Branch (426:34): [True: 0, False: 185] ------------------ 427| 0| return std::make_unique(alg_id, key_bits); 428| 0| } 429| 185|#endif 430| | 431| 185|#if defined(BOTAN_HAS_ML_DSA) 432| 185| if(alg_name.starts_with("ML-DSA-")) { ------------------ | Branch (432:7): [True: 77, False: 108] ------------------ 433| 77| return std::make_unique(alg_id, key_bits); 434| 77| } 435| 108|#endif 436| | 437| 108|#if defined(BOTAN_HAS_HSS_LMS) 438| 108| if(alg_name == "HSS-LMS-Private-Key") { ------------------ | Branch (438:7): [True: 0, False: 108] ------------------ 439| 0| return std::make_unique(alg_id, key_bits); 440| 0| } 441| 108|#endif 442| | 443| 108|#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE) 444| 108| if(alg_name == "SPHINCS+" || alg_name.starts_with("SphincsPlus-")) { ------------------ | Branch (444:7): [True: 0, False: 108] | Branch (444:33): [True: 0, False: 108] ------------------ 445| 0| return std::make_unique(alg_id, key_bits); 446| 0| } 447| 108|#endif 448| | 449| 108|#if defined(BOTAN_HAS_SLH_DSA_WITH_SHA2) || defined(BOTAN_HAS_SLH_DSA_WITH_SHAKE) 450| 108| if(alg_name.starts_with("SLH-DSA-") || alg_name.starts_with("Hash-SLH-DSA-")) { ------------------ | Branch (450:7): [True: 21, False: 87] | Branch (450:43): [True: 0, False: 87] ------------------ 451| 21| return std::make_unique(alg_id, key_bits); 452| 21| } 453| 87|#endif 454| | 455| 87|#if defined(BOTAN_HAS_CLASSICMCELIECE) 456| 87| if(alg_name.starts_with("ClassicMcEliece")) { ------------------ | Branch (456:7): [True: 0, False: 87] ------------------ 457| 0| return std::make_unique(alg_id, key_bits); 458| 0| } 459| 87|#endif 460| | 461| 87| throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name)); 462| 87|} pk_algs.cpp:_ZZN5Botan16load_private_keyERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEEENK3$_0clEv: 299| 3.93k| const std::string alg_name = [&]() -> std::string { 300| 3.93k| if(const auto name = alg_id.oid().registered_name()) { ------------------ | Branch (300:21): [True: 3.93k, False: 0] ------------------ 301| 3.93k| const std::vector alg_info = split_on(*name, '/'); 302| 3.93k| if(!alg_info.empty()) { ------------------ | Branch (302:13): [True: 3.93k, False: 0] ------------------ 303| 3.93k| return alg_info[0]; 304| 3.93k| } 305| 3.93k| } 306| | 307| 0| throw Decoding_Error( 308| 0| fmt("Private key decoding failed, no algorithm associated with {}", alg_id.oid().to_string())); 309| 3.93k| }(); _ZN5Botan5PKCS88load_keyERNS_10DataSourceE: 351| 7.00k|std::unique_ptr load_key(DataSource& source) { 352| 7.00k| const auto fail_fn = []() -> std::string { 353| 7.00k| throw PKCS8_Exception("Internal error: Attempt to read password for unencrypted key"); 354| 7.00k| }; 355| | 356| 7.00k| return load_key(source, fail_fn, false); 357| 7.00k|} pkcs8.cpp:_ZN5Botan5PKCS812_GLOBAL__N_18load_keyERNS_10DataSourceERKNSt3__18functionIFNS4_12basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEvEEEb: 304| 7.00k| bool is_encrypted) { 305| 7.00k| AlgorithmIdentifier alg_id; 306| 7.00k| secure_vector pkcs8_key = PKCS8_decode(source, get_pass, alg_id, is_encrypted); 307| | 308| 7.00k| if(const auto alg_name = alg_id.oid().registered_name()) { ------------------ | Branch (308:18): [True: 3.93k, False: 3.06k] ------------------ 309| 3.93k| return load_private_key(alg_id, pkcs8_key); 310| 3.93k| } else { 311| 3.06k| throw PKCS8_Exception(fmt("Unknown algorithm OID {}", alg_id.oid())); 312| 3.06k| } 313| 7.00k|} pkcs8.cpp:_ZN5Botan5PKCS812_GLOBAL__N_112PKCS8_decodeERNS_10DataSourceERKNSt3__18functionIFNS4_12basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEvEEERNS_19AlgorithmIdentifierEb: 50| 7.00k| bool is_encrypted) { 51| 7.00k| AlgorithmIdentifier pbe_alg_id; 52| 7.00k| secure_vector key_data; 53| 7.00k| secure_vector key; 54| | 55| 7.00k| try { 56| 7.00k| if(ASN1::maybe_BER(source) && !PEM_Code::matches(source)) { ------------------ | Branch (56:10): [True: 6.73k, False: 262] | Branch (56:37): [True: 6.73k, False: 6] ------------------ 57| 6.73k| if(is_encrypted) { ------------------ | Branch (57:13): [True: 0, False: 6.73k] ------------------ 58| 0| key_data = PKCS8_extract(source, pbe_alg_id); 59| 6.73k| } else { 60| | // todo read more efficiently 61| 810k| while(auto b = source.read_byte()) { ------------------ | Branch (61:24): [True: 803k, False: 6.73k] ------------------ 62| 803k| key_data.push_back(*b); 63| 803k| } 64| 6.73k| } 65| 6.73k| } else { 66| 268| std::string label; 67| 268| key_data = PEM_Code::decode(source, label); 68| | 69| | // todo remove autodetect for pem as well? 70| 268| if(label == "PRIVATE KEY") { ------------------ | Branch (70:13): [True: 11, False: 257] ------------------ 71| 11| is_encrypted = false; 72| 257| } else if(label == "ENCRYPTED PRIVATE KEY") { ------------------ | Branch (72:20): [True: 9, False: 248] ------------------ 73| 9| DataSource_Memory key_source(key_data); 74| 9| key_data = PKCS8_extract(key_source, pbe_alg_id); 75| 248| } else { 76| 248| throw PKCS8_Exception(fmt("Unknown PEM label '{}'", label)); 77| 248| } 78| 268| } 79| | 80| 6.75k| if(key_data.empty()) { ------------------ | Branch (80:10): [True: 1, False: 6.75k] ------------------ 81| 1| throw PKCS8_Exception("No key data found"); 82| 1| } 83| 6.75k| } catch(Decoding_Error& e) { 84| 196| throw Decoding_Error("PKCS #8 private key decoding", e); 85| 196| } 86| | 87| 6.74k| try { 88| 6.74k| if(is_encrypted) { ------------------ | Branch (88:10): [True: 0, False: 6.74k] ------------------ 89| 0| if(pbe_alg_id.oid().registered_name() != "PBE-PKCS5v20") { ------------------ | Branch (89:13): [True: 0, False: 0] ------------------ 90| 0| throw PKCS8_Exception(fmt("Unknown PBE type {}", pbe_alg_id.oid())); 91| 0| } 92| | 93| 0|#if defined(BOTAN_HAS_PKCS5_PBES2) 94| 0| key = pbes2_decrypt(key_data, get_passphrase(), pbe_alg_id.parameters()); 95| |#else 96| | BOTAN_UNUSED(get_passphrase); 97| | throw Decoding_Error("Private key is encrypted but PBES2 was disabled in build"); 98| |#endif 99| 6.74k| } else { 100| 6.74k| key = key_data; 101| 6.74k| } 102| | 103| 6.74k| BER_Decoder(key, BER_Decoder::Limits::DER()) 104| 6.74k| .start_sequence() 105| 6.74k| .decode_and_check(0, "Unknown PKCS #8 version number") 106| 6.74k| .decode(pk_alg_id) 107| 6.74k| .decode(key, ASN1_Type::OctetString) 108| 6.74k| .discard_remaining() 109| 6.74k| .end_cons() 110| 6.74k| .verify_end(); 111| 6.74k| } catch(std::exception& e) { 112| 967| throw Decoding_Error("PKCS #8 private key decoding", e); 113| 967| } 114| 5.77k| return key; 115| 6.74k|} pkcs8.cpp:_ZN5Botan5PKCS812_GLOBAL__N_113PKCS8_extractERNS_10DataSourceERNS_19AlgorithmIdentifierE: 31| 9|secure_vector PKCS8_extract(DataSource& source, AlgorithmIdentifier& pbe_alg_id) { 32| 9| secure_vector key_data; 33| | 34| 9| BER_Decoder(source, BER_Decoder::Limits::DER()) 35| 9| .start_sequence() 36| 9| .decode(pbe_alg_id) 37| 9| .decode(key_data, ASN1_Type::OctetString) 38| 9| .end_cons() 39| 9| .verify_end(); 40| | 41| 9| return key_data; 42| 9|} _ZNK5Botan13RSA_PublicKey5get_nEv: 316| 4|const BigInt& RSA_PublicKey::get_n() const { 317| 4| return m_public->get_n(); 318| 4|} _ZN5Botan13RSA_PublicKey4initEONS_6BigIntES2_: 324| 11|void RSA_PublicKey::init(BigInt&& n, BigInt&& e) { 325| 11| if(n.signum() <= 0 || n.is_even() || n.bits() < 384 || n.bits() > MAX_RSA_BITS) { ------------------ | Branch (325:7): [True: 3, False: 8] | Branch (325:26): [True: 1, False: 7] | Branch (325:41): [True: 1, False: 6] | Branch (325:59): [True: 0, False: 6] ------------------ 326| 5| throw Decoding_Error("Invalid RSA public key modulus"); 327| 5| } 328| 6| if(e.is_even() || e <= 1 || e >= n || e.bits() > 256) { ------------------ | Branch (328:7): [True: 1, False: 5] | Branch (328:22): [True: 1, False: 4] | Branch (328:32): [True: 0, False: 4] | Branch (328:42): [True: 0, False: 4] ------------------ 329| 2| throw Decoding_Error("Invalid RSA public key exponent"); 330| 2| } 331| 4| m_public = std::make_shared(std::move(n), std::move(e)); 332| 4|} _ZN5Botan14RSA_PrivateKey4initEONS_6BigIntES2_S2_S2_S2_S2_: 463| 4|void RSA_PrivateKey::init(BigInt&& d, BigInt&& p, BigInt&& q, BigInt&& d1, BigInt&& d2, BigInt&& c) { 464| 4| check_rsa_private_key_params(get_n(), p, q); 465| | 466| | /* 467| | * RFC 8017 Section 3.2 468| | * 469| | * The RSA private exponent d is a positive integer less than n 470| | * [...] 471| | * the CRT exponents dP and dQ are positive integers less than p and q, 472| | * respectively, 473| | * [...] 474| | * the CRT coefficient qInv is a positive integer less than p 475| | */ 476| 4| if(d < 2 || d >= get_n()) { ------------------ | Branch (476:7): [True: 4, False: 0] | Branch (476:16): [True: 0, False: 0] ------------------ 477| 0| throw Decoding_Error("Invalid RSA private key exponent"); 478| 0| } 479| 4| if(d1 < 1 || d1 >= p || d2 < 1 || d2 >= q || c < 1 || c >= p) { ------------------ | Branch (479:7): [True: 4, False: 0] | Branch (479:17): [True: 0, False: 0] | Branch (479:28): [True: 0, False: 0] | Branch (479:38): [True: 0, False: 0] | Branch (479:49): [True: 0, False: 0] | Branch (479:58): [True: 0, False: 0] ------------------ 480| 0| throw Decoding_Error("Invalid RSA private key CRT parameters"); 481| 0| } 482| | 483| 4| m_private = std::make_shared( 484| 4| m_public, std::move(d), std::move(p), std::move(q), std::move(d1), std::move(d2), std::move(c)); 485| 4|} _ZN5Botan14RSA_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 487| 59|RSA_PrivateKey::RSA_PrivateKey(const AlgorithmIdentifier& alg_id, std::span key_bits) { 488| 59| if(alg_id.oid().registered_name() == "RSA" && !alg_id.parameters_are_null_or_empty()) { ------------------ | Branch (488:7): [True: 12, False: 47] | Branch (488:7): [True: 3, False: 56] | Branch (488:50): [True: 3, False: 9] ------------------ 489| 3| throw Decoding_Error("Unexpected parameters for RSA private key"); 490| 3| } 491| | 492| 56| BigInt n; 493| 56| BigInt e; 494| 56| BigInt d; 495| 56| BigInt p; 496| 56| BigInt q; 497| 56| BigInt d1; 498| 56| BigInt d2; 499| 56| BigInt c; 500| | 501| 56| BER_Decoder(key_bits, BER_Decoder::Limits::DER()) 502| 56| .start_sequence() 503| 56| .decode_and_check(0, "Unknown PKCS #1 key format version") 504| 56| .decode(n) 505| 56| .decode(e) 506| 56| .decode(d) 507| 56| .decode(p) 508| 56| .decode(q) 509| 56| .decode(d1) 510| 56| .decode(d2) 511| 56| .decode(c) 512| 56| .end_cons() 513| 56| .verify_end(); 514| | 515| 56| RSA_PublicKey::init(std::move(n), std::move(e)); 516| | 517| 56| RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q), std::move(d1), std::move(d2), std::move(c)); 518| | 519| 56| check_rsa_secret_exponent(get_e(), get_d(), get_p(), get_q()); 520| 56|} _ZNK5Botan15RSA_Public_Data5get_nEv: 64| 4| const BigInt& get_n() const { return m_n; } rsa.cpp:_ZN5Botan12_GLOBAL__N_128check_rsa_private_key_paramsERKNS_6BigIntES3_S3_: 441| 4|void check_rsa_private_key_params(const BigInt& n, const BigInt& p, const BigInt& q) { 442| 4| if(n.bits() > MAX_RSA_BITS || p < 3 || q < 3 || p == q || p >= n || q >= n) { ------------------ | Branch (442:7): [True: 0, False: 4] | Branch (442:34): [True: 1, False: 3] | Branch (442:43): [True: 1, False: 2] | Branch (442:52): [True: 0, False: 2] | Branch (442:62): [True: 0, False: 2] | Branch (442:72): [True: 0, False: 2] ------------------ 443| 2| throw Decoding_Error("Invalid RSA private key parameters"); 444| 2| } 445| 2| if(p * q != n) { ------------------ | Branch (445:7): [True: 2, False: 0] ------------------ 446| 2| throw Decoding_Error("Invalid RSA private key: p * q != n"); 447| 2| } 448| 2|} _ZN5Botan15RSA_Public_DataC2EONS_6BigIntES2_: 51| 4| m_n(std::move(n)), 52| 4| m_e(std::move(e)), 53| 4| m_mod_n(Barrett_Reduction::for_public_modulus(m_n)), 54| 4| m_monty_n(m_n, m_mod_n), 55| 4| m_public_modulus_bits(m_n.bits()), 56| 4| m_public_modulus_bytes(m_n.bytes()) {} _ZN5Botan18Sphincs_ParametersC2ENS_21Sphincs_Parameter_SetENS_17Sphincs_Hash_TypeEjjjjjjj: 245| 42| m_set(set), m_hash_type(hash_type), m_n(n), m_h(h), m_d(d), m_a(a), m_k(k), m_w(w), m_bitsec(bitsec) { 246| 42| BOTAN_ARG_CHECK(!(hash_type == Sphincs_Hash_Type::Haraka && is_slh_dsa_set(set)), ------------------ | | 35| 42| do { \ | | 36| 42| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 42| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 42] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 42| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 42] | | ------------------ ------------------ 247| 42| "Haraka is not available for SLH-DSA"); 248| 42| BOTAN_ARG_CHECK(w == 4 || w == 16 || w == 256, "Winternitz parameter must be one of 4, 16, 256"); ------------------ | | 35| 42| do { \ | | 36| 42| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 126| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 42] | | | Branch (37:12): [True: 42, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 42| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 42] | | ------------------ ------------------ 249| 42| BOTAN_ARG_CHECK(n == 16 || n == 24 || n == 32, "n must be one of 16, 24, 32"); ------------------ | | 35| 42| do { \ | | 36| 42| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 112| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 22, False: 20] | | | Branch (37:12): [True: 12, False: 8] | | | Branch (37:12): [True: 8, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 42| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 42] | | ------------------ ------------------ 250| 42| BOTAN_ARG_CHECK(m_d > 0, "d must be greater than zero"); ------------------ | | 35| 42| do { \ | | 36| 42| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 42| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 42] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 42| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 42] | | ------------------ ------------------ 251| | 252| 42| m_xmss_tree_height = m_h / m_d; 253| 42| m_lg_w = ceil_log2(m_w); 254| | 255| | // base_2^b algorithm (Fips 205, Algorithm 4) only works 256| | // when m_log_w is a divisor of 8. 257| 42| BOTAN_ASSERT_NOMSG(m_lg_w <= 8 && 8 % m_lg_w == 0); ------------------ | | 84| 42| do { \ | | 85| 42| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 84| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 42, False: 0] | | | Branch (86:12): [True: 42, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 42| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 42] | | ------------------ ------------------ 258| | 259| | // # Winternitz blocks of the message (len_1 of FIPS 205, Algorithm 1) 260| 42| m_wots_len1 = (m_n * 8) / m_lg_w; 261| | 262| | // # Winternitz blocks of the checksum (output of FIPS 205 Algorithm 1) 263| 42| m_wots_len2 = ceil_log2(m_wots_len1 * (m_w - 1)) / m_lg_w + 1; 264| | 265| | // # Winternitz blocks in the signature (len of FIPS 205, Equation 5.4) 266| 42| m_wots_len = m_wots_len1 + m_wots_len2; 267| | 268| | // byte length of WOTS+ signature as well as public key 269| 42| m_wots_bytes = m_wots_len * m_n; 270| | 271| | // # of bytes the WOTS+ checksum consists of 272| 42| m_wots_checksum_bytes = ceil_tobytes(m_wots_len2 * m_lg_w); 273| | 274| 42| m_fors_sig_bytes = (m_a + 1) * m_k * m_n; 275| | 276| | // byte length of the FORS input message 277| 42| m_fors_message_bytes = ceil_tobytes(m_k * m_a); 278| | 279| 42| m_xmss_sig_bytes = m_wots_bytes + m_xmss_tree_height * m_n; 280| 42| m_ht_sig_bytes = m_d * m_xmss_sig_bytes; 281| 42| m_sp_sig_bytes = m_n /* random */ + m_fors_sig_bytes + m_ht_sig_bytes; 282| | 283| 42| m_tree_digest_bytes = ceil_tobytes(m_h - m_xmss_tree_height); 284| 42| m_leaf_digest_bytes = ceil_tobytes(m_xmss_tree_height); 285| 42| m_h_msg_digest_bytes = m_fors_message_bytes + m_tree_digest_bytes + m_leaf_digest_bytes; 286| 42|} _ZNK5Botan18Sphincs_Parameters12is_availableEv: 288| 8|bool Sphincs_Parameters::is_available() const { 289| 8| [[maybe_unused]] const bool is_slh_dsa = is_slh_dsa_set(m_set); 290| 8|#ifdef BOTAN_HAS_SLH_DSA_WITH_SHA2 291| 8| if(is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Sha256) { ------------------ | Branch (291:7): [True: 8, False: 0] | Branch (291:21): [True: 6, False: 2] ------------------ 292| 6| return true; 293| 6| } 294| 2|#endif 295| 2|#ifdef BOTAN_HAS_SLH_DSA_WITH_SHAKE 296| 2| if(is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Shake256) { ------------------ | Branch (296:7): [True: 2, False: 0] | Branch (296:21): [True: 2, False: 0] ------------------ 297| 2| return true; 298| 2| } 299| 0|#endif 300| 0|#ifdef BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2 301| 0| if(!is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Sha256) { ------------------ | Branch (301:7): [True: 0, False: 0] | Branch (301:22): [True: 0, False: 0] ------------------ 302| 0| return true; 303| 0| } 304| 0|#endif 305| 0|#ifdef BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE 306| 0| if(!is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Shake256) { ------------------ | Branch (306:7): [True: 0, False: 0] | Branch (306:22): [True: 0, False: 0] ------------------ 307| 0| return true; 308| 0| } 309| 0|#endif 310| 0| return false; 311| 0|} _ZN5Botan18Sphincs_Parameters6createENS_21Sphincs_Parameter_SetENS_17Sphincs_Hash_TypeE: 314| 42| Sphincs_Parameter_Set set, Sphincs_Hash_Type hash /*, SlhDsaInputMode input_mode [TODO: prehash mode]*/) { 315| | // See FIPS 205, Table 2 316| 42| switch(set) { ------------------ | Branch (316:11): [True: 42, False: 0] ------------------ 317| 0| case Sphincs_Parameter_Set::Sphincs128Small: ------------------ | Branch (317:7): [True: 0, False: 42] ------------------ 318| 14| case Sphincs_Parameter_Set::SLHDSA128Small: ------------------ | Branch (318:7): [True: 14, False: 28] ------------------ 319| 14| return Sphincs_Parameters(set, hash, 16, 63, 7, 12, 14, 16, 133); 320| 0| case Sphincs_Parameter_Set::Sphincs128Fast: ------------------ | Branch (320:7): [True: 0, False: 42] ------------------ 321| 8| case Sphincs_Parameter_Set::SLHDSA128Fast: ------------------ | Branch (321:7): [True: 8, False: 34] ------------------ 322| 8| return Sphincs_Parameters(set, hash, 16, 66, 22, 6, 33, 16, 128); 323| | 324| 0| case Sphincs_Parameter_Set::Sphincs192Small: ------------------ | Branch (324:7): [True: 0, False: 42] ------------------ 325| 6| case Sphincs_Parameter_Set::SLHDSA192Small: ------------------ | Branch (325:7): [True: 6, False: 36] ------------------ 326| 6| return Sphincs_Parameters(set, hash, 24, 63, 7, 14, 17, 16, 193); 327| 0| case Sphincs_Parameter_Set::Sphincs192Fast: ------------------ | Branch (327:7): [True: 0, False: 42] ------------------ 328| 6| case Sphincs_Parameter_Set::SLHDSA192Fast: ------------------ | Branch (328:7): [True: 6, False: 36] ------------------ 329| 6| return Sphincs_Parameters(set, hash, 24, 66, 22, 8, 33, 16, 194); 330| | 331| 0| case Sphincs_Parameter_Set::Sphincs256Small: ------------------ | Branch (331:7): [True: 0, False: 42] ------------------ 332| 4| case Sphincs_Parameter_Set::SLHDSA256Small: ------------------ | Branch (332:7): [True: 4, False: 38] ------------------ 333| 4| return Sphincs_Parameters(set, hash, 32, 64, 8, 14, 22, 16, 255); 334| 0| case Sphincs_Parameter_Set::Sphincs256Fast: ------------------ | Branch (334:7): [True: 0, False: 42] ------------------ 335| 4| case Sphincs_Parameter_Set::SLHDSA256Fast: ------------------ | Branch (335:7): [True: 4, False: 38] ------------------ 336| 4| return Sphincs_Parameters(set, hash, 32, 68, 17, 9, 35, 16, 255); 337| 42| } 338| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 339| 0|} _ZN5Botan18Sphincs_Parameters6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 341| 42|Sphincs_Parameters Sphincs_Parameters::create(std::string_view name) { 342| 42| auto [param_set, hash_type] = set_and_hash_from_name(name); 343| 42| return Sphincs_Parameters::create(param_set, hash_type); 344| 42|} _ZNK5Botan18Sphincs_Parameters9to_stringEv: 362| 21|std::string Sphincs_Parameters::to_string() const { 363| 21| return name_from_set_and_hash(parameter_set(), hash_type()); 364| 21|} _ZN5Botan18Sphincs_Parameters6createERKNS_3OIDE: 366| 42|Sphincs_Parameters Sphincs_Parameters::create(const OID& oid) { 367| 42| if(const auto name = oid.registered_name()) { ------------------ | Branch (367:18): [True: 42, False: 0] ------------------ 368| 42| return Sphincs_Parameters::create(*name); 369| 42| } 370| | 371| 0| throw Lookup_Error(fmt("No SLH-DSA (or SPHINCS+) parameter registered for OID {}", oid)); 372| 42|} _ZNK5Botan18Sphincs_Parameters17object_identifierEv: 374| 21|OID Sphincs_Parameters::object_identifier() const { 375| 21| return OID::from_string(to_string()); 376| 21|} sp_parameters.cpp:_ZN5Botan12_GLOBAL__N_114is_slh_dsa_setENS_21Sphincs_Parameter_SetE: 214| 8|constexpr bool is_slh_dsa_set(Sphincs_Parameter_Set set) { 215| 8| switch(set) { ------------------ | Branch (215:11): [True: 8, False: 0] ------------------ 216| 2| case Sphincs_Parameter_Set::SLHDSA128Small: ------------------ | Branch (216:7): [True: 2, False: 6] ------------------ 217| 4| case Sphincs_Parameter_Set::SLHDSA128Fast: ------------------ | Branch (217:7): [True: 2, False: 6] ------------------ 218| 6| case Sphincs_Parameter_Set::SLHDSA192Small: ------------------ | Branch (218:7): [True: 2, False: 6] ------------------ 219| 8| case Sphincs_Parameter_Set::SLHDSA192Fast: ------------------ | Branch (219:7): [True: 2, False: 6] ------------------ 220| 8| case Sphincs_Parameter_Set::SLHDSA256Small: ------------------ | Branch (220:7): [True: 0, False: 8] ------------------ 221| 8| case Sphincs_Parameter_Set::SLHDSA256Fast: ------------------ | Branch (221:7): [True: 0, False: 8] ------------------ 222| 8| return true; 223| 0| case Sphincs_Parameter_Set::Sphincs128Small: ------------------ | Branch (223:7): [True: 0, False: 8] ------------------ 224| 0| case Sphincs_Parameter_Set::Sphincs128Fast: ------------------ | Branch (224:7): [True: 0, False: 8] ------------------ 225| 0| case Sphincs_Parameter_Set::Sphincs192Small: ------------------ | Branch (225:7): [True: 0, False: 8] ------------------ 226| 0| case Sphincs_Parameter_Set::Sphincs192Fast: ------------------ | Branch (226:7): [True: 0, False: 8] ------------------ 227| 0| case Sphincs_Parameter_Set::Sphincs256Small: ------------------ | Branch (227:7): [True: 0, False: 8] ------------------ 228| 0| case Sphincs_Parameter_Set::Sphincs256Fast: ------------------ | Branch (228:7): [True: 0, False: 8] ------------------ 229| 0| return false; 230| 8| } 231| 0| BOTAN_ASSERT_UNREACHABLE(); ------------------ | | 173| 0|#define BOTAN_ASSERT_UNREACHABLE() Botan::assert_unreachable(__FILE__, __LINE__) ------------------ 232| 0|} sp_parameters.cpp:_ZN5Botan12_GLOBAL__N_122set_and_hash_from_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 20| 42|std::pair set_and_hash_from_name(std::string_view name) { 21| | // SPHINCS+ Round 3.1 instances 22| 42| if(name == "SphincsPlus-sha2-128s-r3.1") { ------------------ | Branch (22:7): [True: 0, False: 42] ------------------ 23| 0| return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Sha256}; 24| 0| } 25| 42| if(name == "SphincsPlus-sha2-128f-r3.1") { ------------------ | Branch (25:7): [True: 0, False: 42] ------------------ 26| 0| return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Sha256}; 27| 0| } 28| 42| if(name == "SphincsPlus-sha2-192s-r3.1") { ------------------ | Branch (28:7): [True: 0, False: 42] ------------------ 29| 0| return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Sha256}; 30| 0| } 31| 42| if(name == "SphincsPlus-sha2-192f-r3.1") { ------------------ | Branch (31:7): [True: 0, False: 42] ------------------ 32| 0| return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Sha256}; 33| 0| } 34| 42| if(name == "SphincsPlus-sha2-256s-r3.1") { ------------------ | Branch (34:7): [True: 0, False: 42] ------------------ 35| 0| return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Sha256}; 36| 0| } 37| 42| if(name == "SphincsPlus-sha2-256f-r3.1") { ------------------ | Branch (37:7): [True: 0, False: 42] ------------------ 38| 0| return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Sha256}; 39| 0| } 40| | 41| 42| if(name == "SphincsPlus-shake-128s-r3.1") { ------------------ | Branch (41:7): [True: 0, False: 42] ------------------ 42| 0| return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Shake256}; 43| 0| } 44| 42| if(name == "SphincsPlus-shake-128f-r3.1") { ------------------ | Branch (44:7): [True: 0, False: 42] ------------------ 45| 0| return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Shake256}; 46| 0| } 47| 42| if(name == "SphincsPlus-shake-192s-r3.1") { ------------------ | Branch (47:7): [True: 0, False: 42] ------------------ 48| 0| return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Shake256}; 49| 0| } 50| 42| if(name == "SphincsPlus-shake-192f-r3.1") { ------------------ | Branch (50:7): [True: 0, False: 42] ------------------ 51| 0| return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Shake256}; 52| 0| } 53| 42| if(name == "SphincsPlus-shake-256s-r3.1") { ------------------ | Branch (53:7): [True: 0, False: 42] ------------------ 54| 0| return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Shake256}; 55| 0| } 56| 42| if(name == "SphincsPlus-shake-256f-r3.1") { ------------------ | Branch (56:7): [True: 0, False: 42] ------------------ 57| 0| return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Shake256}; 58| 0| } 59| | 60| 42| if(name == "SphincsPlus-haraka-128s-r3.1") { ------------------ | Branch (60:7): [True: 0, False: 42] ------------------ 61| 0| return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Haraka}; 62| 0| } 63| 42| if(name == "SphincsPlus-haraka-128f-r3.1") { ------------------ | Branch (63:7): [True: 0, False: 42] ------------------ 64| 0| return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Haraka}; 65| 0| } 66| 42| if(name == "SphincsPlus-haraka-192s-r3.1") { ------------------ | Branch (66:7): [True: 0, False: 42] ------------------ 67| 0| return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Haraka}; 68| 0| } 69| 42| if(name == "SphincsPlus-haraka-192f-r3.1") { ------------------ | Branch (69:7): [True: 0, False: 42] ------------------ 70| 0| return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Haraka}; 71| 0| } 72| 42| if(name == "SphincsPlus-haraka-256s-r3.1") { ------------------ | Branch (72:7): [True: 0, False: 42] ------------------ 73| 0| return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Haraka}; 74| 0| } 75| 42| if(name == "SphincsPlus-haraka-256f-r3.1") { ------------------ | Branch (75:7): [True: 0, False: 42] ------------------ 76| 0| return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Haraka}; 77| 0| } 78| | 79| | // SLH-DSA instances WITHOUT prehash mode 80| 42| if(name == "SLH-DSA-SHA2-128s") { ------------------ | Branch (80:7): [True: 12, False: 30] ------------------ 81| 12| return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Sha256}; 82| 12| } 83| 30| if(name == "SLH-DSA-SHA2-128f") { ------------------ | Branch (83:7): [True: 2, False: 28] ------------------ 84| 2| return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Sha256}; 85| 2| } 86| 28| if(name == "SLH-DSA-SHA2-192s") { ------------------ | Branch (86:7): [True: 4, False: 24] ------------------ 87| 4| return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Sha256}; 88| 4| } 89| 24| if(name == "SLH-DSA-SHA2-192f") { ------------------ | Branch (89:7): [True: 4, False: 20] ------------------ 90| 4| return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Sha256}; 91| 4| } 92| 20| if(name == "SLH-DSA-SHA2-256s") { ------------------ | Branch (92:7): [True: 2, False: 18] ------------------ 93| 2| return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Sha256}; 94| 2| } 95| 18| if(name == "SLH-DSA-SHA2-256f") { ------------------ | Branch (95:7): [True: 2, False: 16] ------------------ 96| 2| return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Sha256}; 97| 2| } 98| | 99| 16| if(name == "SLH-DSA-SHAKE-128s") { ------------------ | Branch (99:7): [True: 2, False: 14] ------------------ 100| 2| return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Shake256}; 101| 2| } 102| 14| if(name == "SLH-DSA-SHAKE-128f") { ------------------ | Branch (102:7): [True: 6, False: 8] ------------------ 103| 6| return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Shake256}; 104| 6| } 105| 8| if(name == "SLH-DSA-SHAKE-192s") { ------------------ | Branch (105:7): [True: 2, False: 6] ------------------ 106| 2| return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Shake256}; 107| 2| } 108| 6| if(name == "SLH-DSA-SHAKE-192f") { ------------------ | Branch (108:7): [True: 2, False: 4] ------------------ 109| 2| return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Shake256}; 110| 2| } 111| 4| if(name == "SLH-DSA-SHAKE-256s") { ------------------ | Branch (111:7): [True: 2, False: 2] ------------------ 112| 2| return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Shake256}; 113| 2| } 114| 2| if(name == "SLH-DSA-SHAKE-256f") { ------------------ | Branch (114:7): [True: 2, False: 0] ------------------ 115| 2| return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Shake256}; 116| 2| } 117| | 118| | // The pre-hash variants (HashSLH-DSA) are not currently implemented 119| 0| if(name.starts_with("Hash-SLH-DSA-")) { ------------------ | Branch (119:7): [True: 0, False: 0] ------------------ 120| 0| throw Not_Implemented(fmt("Pre-hash SLH-DSA ({}) is not supported", name)); 121| 0| } 122| | 123| 0| throw Lookup_Error(fmt("No SLH-DSA (or SPHINCS+) parameter supported for: {}", name)); 124| 0|} sp_parameters.cpp:_ZN5Botan12_GLOBAL__N_122name_from_set_and_hashENS_21Sphincs_Parameter_SetENS_17Sphincs_Hash_TypeE: 126| 21|std::string name_from_set_and_hash(Sphincs_Parameter_Set set, Sphincs_Hash_Type hash) { 127| 21| if(hash == Sphincs_Hash_Type::Sha256) { ------------------ | Branch (127:7): [True: 13, False: 8] ------------------ 128| 13| switch(set) { ------------------ | Branch (128:14): [True: 13, False: 0] ------------------ 129| 0| case Sphincs_Parameter_Set::Sphincs128Small: ------------------ | Branch (129:10): [True: 0, False: 13] ------------------ 130| 0| return "SphincsPlus-sha2-128s-r3.1"; 131| 0| case Sphincs_Parameter_Set::Sphincs128Fast: ------------------ | Branch (131:10): [True: 0, False: 13] ------------------ 132| 0| return "SphincsPlus-sha2-128f-r3.1"; 133| 0| case Sphincs_Parameter_Set::Sphincs192Small: ------------------ | Branch (133:10): [True: 0, False: 13] ------------------ 134| 0| return "SphincsPlus-sha2-192s-r3.1"; 135| 0| case Sphincs_Parameter_Set::Sphincs192Fast: ------------------ | Branch (135:10): [True: 0, False: 13] ------------------ 136| 0| return "SphincsPlus-sha2-192f-r3.1"; 137| 0| case Sphincs_Parameter_Set::Sphincs256Small: ------------------ | Branch (137:10): [True: 0, False: 13] ------------------ 138| 0| return "SphincsPlus-sha2-256s-r3.1"; 139| 0| case Sphincs_Parameter_Set::Sphincs256Fast: ------------------ | Branch (139:10): [True: 0, False: 13] ------------------ 140| 0| return "SphincsPlus-sha2-256f-r3.1"; 141| | 142| 6| case Sphincs_Parameter_Set::SLHDSA128Small: ------------------ | Branch (142:10): [True: 6, False: 7] ------------------ 143| 6| return "SLH-DSA-SHA2-128s"; 144| 1| case Sphincs_Parameter_Set::SLHDSA128Fast: ------------------ | Branch (144:10): [True: 1, False: 12] ------------------ 145| 1| return "SLH-DSA-SHA2-128f"; 146| 2| case Sphincs_Parameter_Set::SLHDSA192Small: ------------------ | Branch (146:10): [True: 2, False: 11] ------------------ 147| 2| return "SLH-DSA-SHA2-192s"; 148| 2| case Sphincs_Parameter_Set::SLHDSA192Fast: ------------------ | Branch (148:10): [True: 2, False: 11] ------------------ 149| 2| return "SLH-DSA-SHA2-192f"; 150| 1| case Sphincs_Parameter_Set::SLHDSA256Small: ------------------ | Branch (150:10): [True: 1, False: 12] ------------------ 151| 1| return "SLH-DSA-SHA2-256s"; 152| 1| case Sphincs_Parameter_Set::SLHDSA256Fast: ------------------ | Branch (152:10): [True: 1, False: 12] ------------------ 153| 1| return "SLH-DSA-SHA2-256f"; 154| 13| } 155| 13| } 156| | 157| 8| if(hash == Sphincs_Hash_Type::Shake256) { ------------------ | Branch (157:7): [True: 8, False: 0] ------------------ 158| 8| switch(set) { ------------------ | Branch (158:14): [True: 8, False: 0] ------------------ 159| 0| case Sphincs_Parameter_Set::Sphincs128Small: ------------------ | Branch (159:10): [True: 0, False: 8] ------------------ 160| 0| return "SphincsPlus-shake-128s-r3.1"; 161| 0| case Sphincs_Parameter_Set::Sphincs128Fast: ------------------ | Branch (161:10): [True: 0, False: 8] ------------------ 162| 0| return "SphincsPlus-shake-128f-r3.1"; 163| 0| case Sphincs_Parameter_Set::Sphincs192Small: ------------------ | Branch (163:10): [True: 0, False: 8] ------------------ 164| 0| return "SphincsPlus-shake-192s-r3.1"; 165| 0| case Sphincs_Parameter_Set::Sphincs192Fast: ------------------ | Branch (165:10): [True: 0, False: 8] ------------------ 166| 0| return "SphincsPlus-shake-192f-r3.1"; 167| 0| case Sphincs_Parameter_Set::Sphincs256Small: ------------------ | Branch (167:10): [True: 0, False: 8] ------------------ 168| 0| return "SphincsPlus-shake-256s-r3.1"; 169| 0| case Sphincs_Parameter_Set::Sphincs256Fast: ------------------ | Branch (169:10): [True: 0, False: 8] ------------------ 170| 0| return "SphincsPlus-shake-256f-r3.1"; 171| | 172| 1| case Sphincs_Parameter_Set::SLHDSA128Small: ------------------ | Branch (172:10): [True: 1, False: 7] ------------------ 173| 1| return "SLH-DSA-SHAKE-128s"; 174| 3| case Sphincs_Parameter_Set::SLHDSA128Fast: ------------------ | Branch (174:10): [True: 3, False: 5] ------------------ 175| 3| return "SLH-DSA-SHAKE-128f"; 176| 1| case Sphincs_Parameter_Set::SLHDSA192Small: ------------------ | Branch (176:10): [True: 1, False: 7] ------------------ 177| 1| return "SLH-DSA-SHAKE-192s"; 178| 1| case Sphincs_Parameter_Set::SLHDSA192Fast: ------------------ | Branch (178:10): [True: 1, False: 7] ------------------ 179| 1| return "SLH-DSA-SHAKE-192f"; 180| 1| case Sphincs_Parameter_Set::SLHDSA256Small: ------------------ | Branch (180:10): [True: 1, False: 7] ------------------ 181| 1| return "SLH-DSA-SHAKE-256s"; 182| 1| case Sphincs_Parameter_Set::SLHDSA256Fast: ------------------ | Branch (182:10): [True: 1, False: 7] ------------------ 183| 1| return "SLH-DSA-SHAKE-256f"; 184| 8| } 185| 8| } 186| | 187| 0| if(hash == Sphincs_Hash_Type::Haraka) { ------------------ | Branch (187:7): [True: 0, False: 0] ------------------ 188| 0| switch(set) { ------------------ | Branch (188:14): [True: 0, False: 0] ------------------ 189| 0| case Sphincs_Parameter_Set::Sphincs128Small: ------------------ | Branch (189:10): [True: 0, False: 0] ------------------ 190| 0| return "SphincsPlus-haraka-128s-r3.1"; 191| 0| case Sphincs_Parameter_Set::Sphincs128Fast: ------------------ | Branch (191:10): [True: 0, False: 0] ------------------ 192| 0| return "SphincsPlus-haraka-128f-r3.1"; 193| 0| case Sphincs_Parameter_Set::Sphincs192Small: ------------------ | Branch (193:10): [True: 0, False: 0] ------------------ 194| 0| return "SphincsPlus-haraka-192s-r3.1"; 195| 0| case Sphincs_Parameter_Set::Sphincs192Fast: ------------------ | Branch (195:10): [True: 0, False: 0] ------------------ 196| 0| return "SphincsPlus-haraka-192f-r3.1"; 197| 0| case Sphincs_Parameter_Set::Sphincs256Small: ------------------ | Branch (197:10): [True: 0, False: 0] ------------------ 198| 0| return "SphincsPlus-haraka-256s-r3.1"; 199| 0| case Sphincs_Parameter_Set::Sphincs256Fast: ------------------ | Branch (199:10): [True: 0, False: 0] ------------------ 200| 0| return "SphincsPlus-haraka-256f-r3.1"; 201| | 202| 0| case Sphincs_Parameter_Set::SLHDSA128Small: ------------------ | Branch (202:10): [True: 0, False: 0] ------------------ 203| 0| case Sphincs_Parameter_Set::SLHDSA128Fast: ------------------ | Branch (203:10): [True: 0, False: 0] ------------------ 204| 0| case Sphincs_Parameter_Set::SLHDSA192Small: ------------------ | Branch (204:10): [True: 0, False: 0] ------------------ 205| 0| case Sphincs_Parameter_Set::SLHDSA192Fast: ------------------ | Branch (205:10): [True: 0, False: 0] ------------------ 206| 0| case Sphincs_Parameter_Set::SLHDSA256Small: ------------------ | Branch (206:10): [True: 0, False: 0] ------------------ 207| 0| case Sphincs_Parameter_Set::SLHDSA256Fast: ------------------ | Branch (207:10): [True: 0, False: 0] ------------------ 208| 0| throw Invalid_Argument("SLH-DSA does not support Haraka"); 209| 0| } 210| 0| } 211| 0| throw Invalid_Argument("Cannot serialize invalid parameter combination"); 212| 0|} _ZN5Botan21SphincsPlus_PublicKeyC2ENSt3__14spanIKhLm18446744073709551615EEENS_18Sphincs_ParametersE: 135| 4| m_public(std::make_shared(params, pub_key)) { 136| 4| if(!params.is_available()) { ------------------ | Branch (136:7): [True: 0, False: 4] ------------------ 137| 0| throw Not_Implemented("This SPHINCS+ parameter set is not available in this configuration"); 138| 0| } 139| 4|} _ZN5Botan21SphincsPlus_PublicKeyD2Ev: 149| 4|SphincsPlus_PublicKey::~SphincsPlus_PublicKey() = default; _ZN5Botan22SphincsPlus_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE: 308| 21| SphincsPlus_PrivateKey(key_bits, Sphincs_Parameters::create(alg_id.oid())) { 309| | // The parameter set is identified by the OID; no parameters are defined. 310| 21| if(!alg_id.parameters_are_empty()) { ------------------ | Branch (310:7): [True: 1, False: 20] ------------------ 311| 1| throw Decoding_Error("Unexpected parameters for SLH-DSA/SPHINCS+ private key"); 312| 1| } 313| 21|} _ZN5Botan22SphincsPlus_PrivateKeyC1ENSt3__14spanIKhLm18446744073709551615EEENS_18Sphincs_ParametersE: 316| 21| SphincsPlus_PublicKey(slice_off_public_key(params.object_identifier(), private_key), params) { 317| 21| if(!params.is_available()) { ------------------ | Branch (317:7): [True: 0, False: 21] ------------------ 318| 0| throw Not_Implemented("This SPHINCS+ parameter set is not available in this configuration"); 319| 0| } 320| | 321| 21| const auto private_portion_bytes = params.private_key_bytes() - params.public_key_bytes(); 322| 21| BOTAN_ASSERT_NOMSG(private_key.size() >= private_portion_bytes); ------------------ | | 84| 21| do { \ | | 85| 21| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 21| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 21] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 21| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 21] | | ------------------ ------------------ 323| | 324| 21| m_private = std::make_shared(params, private_key.first(private_portion_bytes)); 325| 21|} _ZN5Botan22SphincsPlus_PrivateKeyD2Ev: 349| 4|SphincsPlus_PrivateKey::~SphincsPlus_PrivateKey() = default; sphincsplus.cpp:_ZN5Botan12_GLOBAL__N_120slice_off_public_keyERKNS_3OIDENSt3__14spanIKhLm18446744073709551615EEE: 286| 21|std::span slice_off_public_key(const OID& oid, std::span key_bits) { 287| 21| const auto params = Sphincs_Parameters::create(oid); 288| | // Note: We need to transiently instantiate the `Sphincs_Parameters` object 289| | // to know the size of the public/private key. That's slightly 290| | // inefficient but was the best we could do. Once we get rid of the 291| | // PublicKey-PrivateKey inheritance, we might want to reconsider this 292| | // control flow. 293| 21| if(key_bits.size() != params.private_key_bytes()) { ------------------ | Branch (293:7): [True: 17, False: 4] ------------------ 294| 17| throw Decoding_Error("Sphincs Private Key doesn't have the expected length"); 295| 17| } 296| | 297| 4| return key_bits.subspan(params.private_key_bytes() - params.public_key_bytes()); 298| 21|} _ZN5Botan29SphincsPlus_PublicKeyInternalC2ENS_18Sphincs_ParametersENSt3__14spanIKhLm18446744073709551615EEE: 75| 4| SphincsPlus_PublicKeyInternal(Sphincs_Parameters params, std::span key_bits) : m_params(params) { 76| 4| if(key_bits.size() != m_params.public_key_bytes()) { ------------------ | Branch (76:13): [True: 0, False: 4] ------------------ 77| 0| throw Decoding_Error("SLH-DSA (or SPHINCS+) Public Key doesn't have the expected length"); 78| 0| } 79| | 80| 4| BufferSlicer s(key_bits); 81| 4| m_public_seed = s.copy(params.n()); 82| 4| m_sphincs_root = s.copy(params.n()); 83| | 84| 4| BOTAN_ASSERT_NOMSG(s.empty()); ------------------ | | 84| 4| do { \ | | 85| 4| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 4| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 4] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 4| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 4] | | ------------------ ------------------ 85| 4| } _ZN5Botan30SphincsPlus_PrivateKeyInternalC2ERKNS_18Sphincs_ParametersENSt3__14spanIKhLm18446744073709551615EEE: 106| 4| SphincsPlus_PrivateKeyInternal(const Sphincs_Parameters& params, std::span key_bits) { 107| 4| if(key_bits.size() != params.private_key_bytes() - params.public_key_bytes()) { ------------------ | Branch (107:13): [True: 0, False: 4] ------------------ 108| 0| throw Decoding_Error("SLH-DSA (or SPHINCS+) Private Key doesn't have the expected length"); 109| 0| } 110| | 111| 4| BufferSlicer s(key_bits); 112| 4| m_secret_seed = s.copy(params.n()); 113| 4| m_prf = s.copy(params.n()); 114| | 115| 4| BOTAN_ASSERT_NOMSG(s.empty()); ------------------ | | 84| 4| do { \ | | 85| 4| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 4| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 4] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 4| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 4] | | ------------------ ------------------ 116| 4| } _ZN5Botan14if_work_factorEm: 37| 234|size_t if_work_factor(size_t bits) { 38| 234| if(bits < 512) { ------------------ | Branch (38:7): [True: 113, False: 121] ------------------ 39| 113| return 0; 40| 113| } 41| | 42| | // RFC 3766 estimates k at .02 and o(1) to be effectively zero for sizes of interest 43| | 44| 121| const double log2_k = -5.6438; // log2(.02) 45| 121| return nfs_workfactor(bits, log2_k); 46| 234|} _ZN5Botan14dl_work_factorEm: 48| 234|size_t dl_work_factor(size_t bits) { 49| | // Lacking better estimates... 50| 234| return if_work_factor(bits); 51| 234|} _ZN5Botan16dl_exponent_sizeEm: 53| 234|size_t dl_exponent_size(size_t p_bits) { 54| 234| BOTAN_ARG_CHECK(p_bits > 1, "Invalid prime length"); ------------------ | | 35| 234| do { \ | | 36| 234| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 234| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 234] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 234| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 234] | | ------------------ ------------------ 55| | 56| | /* 57| | For relevant sizes we follow the suggestions in 58| | NIST SP 800-56B Rev 2 Appendix D 59| | "Maximum Security Strength Estimates for IFC Modulus Lengths" 60| | 61| | For sizes outside the range considered in the SP we use some sensible values 62| | 63| | Note that we return twice the value given in Table 4 since we are choosing 64| | the exponent size as twice the estimated security strength. 65| | 66| | See also NIST SP 800-56A Rev 3 Appendix D, Tables 25 and 26 67| | */ 68| | 69| 234| if(p_bits <= 256) { ------------------ | Branch (69:7): [True: 103, False: 131] ------------------ 70| | /* 71| | * For stupidly small groups we might return a value larger than the group 72| | * size if we fell into the conditionals below. Just use the maximum 73| | * possible exponent size - for all the good it will do you with a group 74| | * this weak. 75| | */ 76| 103| return p_bits - 1; 77| 131| } else if(p_bits <= 1024) { ------------------ | Branch (77:14): [True: 111, False: 20] ------------------ 78| | /* 79| | Not in the SP, but general estimates are that a 1024 bit group provides at 80| | most 80 bits security, so using an exponent appropriate for 96 bit security 81| | is more than sufficient. 82| | */ 83| 111| return 192; 84| 111| } else if(p_bits <= 2048) { ------------------ | Branch (84:14): [True: 20, False: 0] ------------------ 85| 20| return 224; // SP 800-56B 86| 20| } else if(p_bits <= 3072) { ------------------ | Branch (86:14): [True: 0, False: 0] ------------------ 87| 0| return 256; // SP 800-56B 88| 0| } else if(p_bits <= 4096) { ------------------ | Branch (88:14): [True: 0, False: 0] ------------------ 89| 0| return 304; // SP 800-56B 90| 0| } else if(p_bits <= 6144) { ------------------ | Branch (90:14): [True: 0, False: 0] ------------------ 91| 0| return 352; // SP 800-56B 92| 0| } else if(p_bits <= 8192) { ------------------ | Branch (92:14): [True: 0, False: 0] ------------------ 93| 0| return 400; // SP 800-56B 94| 0| } else { 95| | // For values larger than we know about, just saturate to 256 bit security 96| | // which is Good Enough for FFDH 97| | // 98| | // NIST puts 15360 bit groups at exactly 256 bits security 99| 0| return 512; 100| 0| } 101| 234|} workfactor.cpp:_ZN5Botan12_GLOBAL__N_114nfs_workfactorEmd: 22| 121|size_t nfs_workfactor(size_t bits, double log2_k) { 23| | // approximates natural logarithm of an integer of given bitsize 24| 121| const double log_p = static_cast(bits) / std::numbers::log2e; 25| | 26| 121| const double log_log_p = std::log(log_p); 27| | 28| | // RFC 3766: k * e^((1.92 + o(1)) * cubrt(ln(n) * (ln(ln(n)))^2)) 29| 121| const double est = 1.92 * std::pow(log_p * log_log_p * log_log_p, 1.0 / 3.0); 30| | 31| | // return log2 of the workfactor 32| 121| return static_cast(log2_k + std::numbers::log2e * est); 33| 121|} _ZN5Botan13AlgorithmSpec10parse_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERmmb: 28| 440|AlgorithmSpec AlgorithmSpec::parse_name(std::string_view text, size_t& pos, size_t depth, bool mode_syntax) { 29| 440| if(depth > MaxNestingDepth) { ------------------ | Branch (29:7): [True: 0, False: 440] ------------------ 30| 0| throw Invalid_Algorithm_Name(text); 31| 0| } 32| | 33| | // The '/' separator is only significant at the top level of a cipher mode 34| 440| const bool slash_separates = mode_syntax && (depth == 0); ------------------ | Branch (34:33): [True: 0, False: 440] | Branch (34:48): [True: 0, False: 0] ------------------ 35| 440| const size_t start = pos; 36| | 37| 2.86k| while(pos < text.size() && !is_spec_separator(text[pos], slash_separates)) { ------------------ | Branch (37:10): [True: 2.86k, False: 0] | Branch (37:31): [True: 2.42k, False: 440] ------------------ 38| 2.42k| ++pos; 39| 2.42k| } 40| | 41| 440| AlgorithmSpec node; 42| 440| node.m_head = std::string(text.substr(start, pos - start)); 43| | 44| 440| if(node.m_head.empty()) { ------------------ | Branch (44:7): [True: 0, False: 440] ------------------ 45| 0| throw Invalid_Algorithm_Name(text); 46| 0| } 47| | 48| 440| if(pos < text.size() && text[pos] == '(') { ------------------ | Branch (48:7): [True: 440, False: 0] | Branch (48:28): [True: 220, False: 220] ------------------ 49| 220| do { // NOLINT(*-avoid-do-while) 50| 220| ++pos; // skip the '(' or ',' 51| 220| node.m_args.push_back(parse_name(text, pos, depth + 1, mode_syntax)); 52| 220| } while(pos < text.size() && text[pos] == ','); ------------------ | Branch (52:15): [True: 220, False: 0] | Branch (52:36): [True: 0, False: 220] ------------------ 53| | 54| 220| if(pos >= text.size() || text[pos] != ')') { ------------------ | Branch (54:10): [True: 0, False: 220] | Branch (54:32): [True: 0, False: 220] ------------------ 55| 0| throw Invalid_Algorithm_Name(text); 56| 0| } 57| 220| ++pos; 58| 220| } 59| | 60| 440| node.m_text = std::string(text.substr(start, pos - start)); 61| 440| return node; 62| 440|} _ZN5Botan13AlgorithmSpecC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS0_6SyntaxE: 64| 220|AlgorithmSpec::AlgorithmSpec(std::string_view spec, Syntax syntax) { 65| 220| if(spec.empty()) { ------------------ | Branch (65:7): [True: 0, False: 220] ------------------ 66| 0| throw Invalid_Algorithm_Name(spec); 67| 0| } 68| | 69| 220| const bool mode_syntax = (syntax == Syntax::CipherMode); 70| | 71| | // Fast path for a bare name such as "SHA-256", which is the common case 72| 220| if(spec.find_first_of(mode_syntax ? "(),/" : "(),") == std::string_view::npos) { ------------------ | Branch (72:7): [True: 0, False: 220] | Branch (72:26): [True: 0, False: 220] ------------------ 73| 0| m_text = std::string(spec); 74| 0| m_head = std::string(spec); 75| 0| return; 76| 0| } 77| | 78| 220| size_t pos = 0; 79| 220| std::vector parts; 80| 220| parts.push_back(parse_name(spec, pos, 0, mode_syntax)); 81| | 82| 220| while(mode_syntax && pos < spec.size() && spec[pos] == '/') { ------------------ | Branch (82:10): [True: 0, False: 220] | Branch (82:25): [True: 0, False: 0] | Branch (82:46): [True: 0, False: 0] ------------------ 83| 0| ++pos; 84| 0| parts.push_back(parse_name(spec, pos, 0, mode_syntax)); 85| 0| } 86| | 87| 220| if(pos != spec.size()) { ------------------ | Branch (87:7): [True: 0, False: 220] ------------------ 88| 0| throw Invalid_Algorithm_Name(spec); 89| 0| } 90| | 91| 220| if(parts.size() == 1) { ------------------ | Branch (91:7): [True: 220, False: 0] ------------------ 92| 220| m_head = std::move(parts[0].m_head); 93| 220| m_args = std::move(parts[0].m_args); 94| 220| } else { 95| | // Cipher/Mode(args)/Pad becomes Mode(Cipher,args,Pad) 96| 0| AlgorithmSpec& mode = parts[1]; 97| 0| m_head = std::move(mode.m_head); 98| 0| m_args.push_back(std::move(parts[0])); 99| 0| for(auto& mode_arg : mode.m_args) { ------------------ | Branch (99:26): [True: 0, False: 0] ------------------ 100| 0| m_args.push_back(std::move(mode_arg)); 101| 0| } 102| 0| for(size_t i = 2; i < parts.size(); ++i) { ------------------ | Branch (102:25): [True: 0, False: 0] ------------------ 103| 0| m_args.push_back(std::move(parts[i])); 104| 0| } 105| 0| } 106| | 107| 220| m_text = std::string(spec); 108| 220|} _ZNKR5Botan13AlgorithmSpec5matchERKNS_16AlgorithmPatternE: 132| 748|std::optional AlgorithmSpec::match(const AlgorithmPattern& pattern) const& { 133| | // Factories try many patterns in turn, so reject on the head before 134| | // setting up the (fairly large) match object 135| 748| if(!pattern.any_head()) { ------------------ | Branch (135:7): [True: 748, False: 0] ------------------ 136| 748| bool head_matches = false; 137| 924| for(const auto alt : pattern.head_alternatives()) { ------------------ | Branch (137:26): [True: 924, False: 616] ------------------ 138| 924| if(alt == m_head) { ------------------ | Branch (138:13): [True: 132, False: 792] ------------------ 139| 132| head_matches = true; 140| 132| break; 141| 132| } 142| 924| } 143| 748| if(!head_matches) { ------------------ | Branch (143:10): [True: 616, False: 132] ------------------ 144| 616| return std::nullopt; 145| 616| } 146| 748| } 147| | 148| 132| AlgorithmMatch m(pattern, *this); 149| | 150| 132| size_t idx = 0; 151| 132| if(!match_args(pattern.elements(), idx, 0, m)) { ------------------ | Branch (151:7): [True: 0, False: 132] ------------------ 152| 0| return std::nullopt; 153| 0| } 154| | 155| 132| return m; 156| 132|} _ZNK5Botan13AlgorithmSpec10match_argsENSt3__14spanIKNS_16AlgorithmPattern7ElementELm18446744073709551615EEERmhRNS_14AlgorithmMatchE: 161| 132| AlgorithmMatch& m) const { 162| 132| using Type = AlgorithmPattern::Type; 163| | 164| 132| size_t arg_idx = 0; 165| | 166| 264| while(idx < elems.size() && elems[idx].depth == depth) { ------------------ | Branch (166:10): [True: 132, False: 132] | Branch (166:32): [True: 132, False: 0] ------------------ 167| 132| const auto& e = elems[idx]; 168| 132| ++idx; 169| | 170| 132| if(arg_idx >= m_args.size()) { ------------------ | Branch (170:10): [True: 0, False: 132] ------------------ 171| | // No argument was provided for this element 172| 0| if(!e.optional) { ------------------ | Branch (172:13): [True: 0, False: 0] ------------------ 173| 0| return false; 174| 0| } 175| | 176| 0| if(e.placeholder && e.has_default) { ------------------ | Branch (176:13): [True: 0, False: 0] | Branch (176:30): [True: 0, False: 0] ------------------ 177| 0| auto& b = m.declared(e.text); 178| 0| b.bound = true; 179| 0| b.text = e.default_value; 180| 0| if(e.type == Type::Int) { ------------------ | Branch (180:16): [True: 0, False: 0] ------------------ 181| | // The pattern parser already checked this is a canonical decimal 182| 0| const auto v = parse_sz(e.default_value, true); 183| 0| BOTAN_ASSERT_NOMSG(v.has_value()); ------------------ | | 84| 0| do { \ | | 85| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 0| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 0| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 0] | | ------------------ ------------------ 184| 0| b.integer = *v; 185| 0| } 186| 0| } 187| | 188| 0| continue; 189| 0| } 190| | 191| 132| const AlgorithmSpec& arg = m_args[arg_idx]; 192| | 193| 132| if(e.variadic) { ------------------ | Branch (193:10): [True: 0, False: 132] ------------------ 194| 0| auto& b = m.declared(e.text); 195| 0| b.bound = true; 196| 0| b.rest = std::span(m_args).subspan(arg_idx); 197| 0| arg_idx = m_args.size(); 198| 0| continue; 199| 0| } 200| | 201| 132| if(e.placeholder) { ------------------ | Branch (201:10): [True: 132, False: 0] ------------------ 202| 132| auto& b = m.declared(e.text); 203| | 204| 132| if(e.type == Type::Int) { ------------------ | Branch (204:13): [True: 132, False: 0] ------------------ 205| 132| if(!arg.m_args.empty()) { ------------------ | Branch (205:16): [True: 0, False: 132] ------------------ 206| 0| return false; 207| 0| } 208| 132| const auto v = parse_sz(arg.m_text, true); 209| 132| if(!v) { ------------------ | Branch (209:16): [True: 0, False: 132] ------------------ 210| 0| return false; 211| 0| } 212| 132| b.integer = *v; 213| 132| } 214| | 215| 132| b.bound = true; 216| 132| b.text = arg.m_text; 217| 132| b.node = &arg; 218| 132| } else if(e.optional) { ------------------ | Branch (218:17): [True: 0, False: 0] ------------------ 219| | // An optional literal which is not present is skipped without consuming the argument 220| 0| if(arg.m_head != e.text || !arg.m_args.empty()) { ------------------ | Branch (220:13): [True: 0, False: 0] | Branch (220:37): [True: 0, False: 0] ------------------ 221| 0| continue; 222| 0| } 223| 0| } else { 224| 0| if(arg.m_head != e.text) { ------------------ | Branch (224:13): [True: 0, False: 0] ------------------ 225| 0| return false; 226| 0| } 227| | 228| 0| if(idx < elems.size() && elems[idx].depth == depth + 1) { ------------------ | Branch (228:13): [True: 0, False: 0] | Branch (228:35): [True: 0, False: 0] ------------------ 229| 0| if(!arg.match_args(elems, idx, depth + 1, m)) { ------------------ | Branch (229:16): [True: 0, False: 0] ------------------ 230| 0| return false; 231| 0| } 232| 0| } else if(!arg.m_args.empty()) { ------------------ | Branch (232:20): [True: 0, False: 0] ------------------ 233| 0| return false; 234| 0| } 235| 0| } 236| | 237| 132| ++arg_idx; 238| 132| } 239| | 240| 132| return arg_idx == m_args.size(); 241| 132|} _ZN5Botan14AlgorithmMatchC2ERKNS_16AlgorithmPatternERKNS_13AlgorithmSpecE: 244| 132| m_pattern(pattern.to_string()), m_head(spec.head()) { 245| 132| for(const auto& e : pattern.elements()) { ------------------ | Branch (245:22): [True: 132, False: 132] ------------------ 246| 132| if(e.placeholder) { ------------------ | Branch (246:10): [True: 132, False: 0] ------------------ 247| 132| Binding b; 248| 132| b.var = e.text; 249| 132| b.type = e.type; 250| 132| b.variadic = e.variadic; 251| 132| m_bindings[m_binding_count++] = b; 252| 132| } 253| 132| } 254| 132|} _ZN5Botan14AlgorithmMatch8declaredENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 256| 132|AlgorithmMatch::Binding& AlgorithmMatch::declared(std::string_view var) { 257| 132| for(size_t i = 0; i != m_binding_count; ++i) { ------------------ | Branch (257:22): [True: 132, False: 0] ------------------ 258| 132| if(m_bindings[i].var == var) { ------------------ | Branch (258:10): [True: 132, False: 0] ------------------ 259| 132| return m_bindings[i]; 260| 132| } 261| 132| } 262| 0| throw Internal_Error(fmt("AlgorithmMatch: no variable '{}' in pattern '{}'", var, m_pattern)); 263| 132|} _ZNK5Botan14AlgorithmMatch5boundENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEPKc: 265| 132|const AlgorithmMatch::Binding& AlgorithmMatch::bound(std::string_view var, const char* accessor) const { 266| 132| for(size_t i = 0; i != m_binding_count; ++i) { ------------------ | Branch (266:22): [True: 132, False: 0] ------------------ 267| 132| if(m_bindings[i].var == var) { ------------------ | Branch (267:10): [True: 132, False: 0] ------------------ 268| 132| if(!m_bindings[i].bound) { ------------------ | Branch (268:13): [True: 0, False: 132] ------------------ 269| 0| throw Internal_Error( 270| 0| fmt("AlgorithmMatch::{}: variable '{}' in pattern '{}' was not bound; check has() first", 271| 0| accessor, 272| 0| var, 273| 0| m_pattern)); 274| 0| } 275| 132| return m_bindings[i]; 276| 132| } 277| 132| } 278| 0| throw Internal_Error(fmt("AlgorithmMatch::{}: no variable '{}' in pattern '{}'", accessor, var, m_pattern)); 279| 132|} _ZNK5Botan14AlgorithmMatch7integerENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 298| 132|size_t AlgorithmMatch::integer(std::string_view var) const { 299| 132| const auto& b = bound(var, "integer"); 300| 132| if(b.type != AlgorithmPattern::Type::Int) { ------------------ | Branch (300:7): [True: 0, False: 132] ------------------ 301| 0| throw Internal_Error(fmt("AlgorithmMatch::integer: variable '{}' in pattern '{}' is not an int", var, m_pattern)); 302| 0| } 303| 132| return b.integer; 304| 132|} algorithm_spec.cpp:_ZN5Botan12_GLOBAL__N_117is_spec_separatorEcb: 21| 2.86k|bool is_spec_separator(char c, bool slash_separates) { 22| 2.86k| return c == '(' || c == ')' || c == ',' || (slash_separates && c == '/'); ------------------ | Branch (22:11): [True: 220, False: 2.64k] | Branch (22:23): [True: 220, False: 2.42k] | Branch (22:35): [True: 0, False: 2.42k] | Branch (22:48): [True: 0, False: 2.42k] | Branch (22:67): [True: 0, False: 0] ------------------ 23| 2.86k|} _ZN5Botan15allocate_memoryEmm: 21| 2.90M|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) { 22| 2.90M| if(elems == 0 || elem_size == 0) { ------------------ | Branch (22:7): [True: 0, False: 2.90M] | Branch (22:21): [True: 0, False: 2.90M] ------------------ 23| 0| return nullptr; 24| 0| } 25| | 26| | // Some calloc implementations do not check for overflow (?!?) 27| 2.90M| if(!checked_mul(elems, elem_size).has_value()) { ------------------ | Branch (27:7): [True: 0, False: 2.90M] ------------------ 28| 0| throw std::bad_alloc(); 29| 0| } 30| | 31| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 32| | // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy 33| | if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) { 34| | return p; 35| | } 36| |#endif 37| | 38| |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL) 39| | void* ptr = ::calloc_conceal(elems, elem_size); 40| |#else 41| | // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy 42| 2.90M| void* ptr = std::calloc(elems, elem_size); // NOLINT(*-no-malloc,*-owning-memory) 43| 2.90M|#endif 44| 2.90M| if(ptr == nullptr) { ------------------ | Branch (44:7): [True: 0, False: 2.90M] ------------------ 45| 0| [[unlikely]] throw std::bad_alloc(); 46| 0| } 47| 2.90M| return ptr; 48| 2.90M|} _ZN5Botan17deallocate_memoryEPvmm: 50| 2.90M|void deallocate_memory(void* p, size_t elems, size_t elem_size) { 51| 2.90M| if(p == nullptr) { ------------------ | Branch (51:7): [True: 0, False: 2.90M] ------------------ 52| 0| [[unlikely]] return; 53| 0| } 54| | 55| 2.90M| secure_scrub_memory(p, elems * elem_size); 56| | 57| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 58| | if(mlock_allocator::instance().deallocate(p, elems, elem_size)) { 59| | return; 60| | } 61| |#endif 62| | 63| 2.90M| std::free(p); // NOLINT(*-no-malloc,*-owning-memory) 64| 2.90M|} _ZN5Botan20initialize_allocatorEv: 66| 1|void initialize_allocator() { 67| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 68| | mlock_allocator::instance(); 69| |#endif 70| 1|} _ZN5Botan21is_ascii_control_charEc: 198| 43|bool is_ascii_control_char(char c) { 199| 43| const uint8_t b = static_cast(c); 200| 43| return b < 0x20 || b == 0x7F; ------------------ | Branch (200:11): [True: 14, False: 29] | Branch (200:23): [True: 1, False: 28] ------------------ 201| 43|} _ZN5Botan23format_char_for_displayEc: 243| 43|std::string format_char_for_display(char c) { 244| 43| std::string out; 245| 43| out += '\''; 246| | 247| 43| if(c == '\t') { ------------------ | Branch (247:7): [True: 0, False: 43] ------------------ 248| 0| out += "\\t"; 249| 43| } else if(c == '\n') { ------------------ | Branch (249:14): [True: 0, False: 43] ------------------ 250| 0| out += "\\n"; 251| 43| } else if(c == '\r') { ------------------ | Branch (251:14): [True: 0, False: 43] ------------------ 252| 0| out += "\\r"; 253| 43| } else if(is_ascii_control_char(c) || static_cast(c) >= 0x80) { ------------------ | Branch (253:14): [True: 15, False: 28] | Branch (253:42): [True: 19, False: 9] ------------------ 254| 34| const auto b = static_cast(c); 255| 34| out += "\\x"; 256| 34| out += nibble_to_hex(b >> 4); 257| 34| out += nibble_to_hex(b); 258| 34| } else { 259| 9| out += c; 260| 9| } 261| | 262| 43| out += '\''; 263| | 264| 43| return out; 265| 43|} _ZN5Botan5CPUID10CPUID_DataC2Ev: 80| 1|CPUID::CPUID_Data::CPUID_Data() { 81| | // NOLINTBEGIN(*-prefer-member-initializer) 82| 1|#if defined(BOTAN_HAS_CPUID_DETECTION) 83| 1| m_processor_features = detect_cpu_features(~cleared_cpuid_bits()); 84| |#else 85| | m_processor_features = 0; 86| |#endif 87| | // NOLINTEND(*-prefer-member-initializer) 88| 1|} cpuid.cpp:_ZN5Botan12_GLOBAL__N_118cleared_cpuid_bitsEv: 59| 1|uint32_t cleared_cpuid_bits() { 60| 1| uint32_t cleared = 0; 61| | 62| 1| #if defined(BOTAN_HAS_OS_UTILS) 63| 1| std::string clear_cpuid_env; 64| 1| if(OS::read_env_variable(clear_cpuid_env, "BOTAN_CLEAR_CPUID")) { ------------------ | Branch (64:7): [True: 0, False: 1] ------------------ 65| 0| for(const auto& cpuid : split_on(clear_cpuid_env, ',')) { ------------------ | Branch (65:29): [True: 0, False: 0] ------------------ 66| 0| if(auto bit = CPUID::bit_from_string(cpuid)) { ------------------ | Branch (66:18): [True: 0, False: 0] ------------------ 67| 0| cleared |= bit->as_u32(); 68| 0| } 69| 0| } 70| 0| } 71| 1| #endif 72| | 73| 1| return cleared; 74| 1|} _ZNK5Botan10CPUFeature9to_stringEv: 13| 44|std::string CPUFeature::to_string() const { 14| 44| switch(m_bit) { ------------------ | Branch (14:11): [True: 44, False: 0] ------------------ 15| 0| case Bit::SSE2: ------------------ | Branch (15:7): [True: 0, False: 44] ------------------ 16| 0| return "sse2"; 17| 0| case Bit::SSSE3: ------------------ | Branch (17:7): [True: 0, False: 44] ------------------ 18| 0| return "ssse3"; 19| 44| case Bit::AVX2: ------------------ | Branch (19:7): [True: 44, False: 0] ------------------ 20| 44| return "avx2"; 21| 0| case Bit::AVX512: ------------------ | Branch (21:7): [True: 0, False: 44] ------------------ 22| 0| return "avx512"; 23| 0| case Bit::RDTSC: ------------------ | Branch (23:7): [True: 0, False: 44] ------------------ 24| 0| return "rdtsc"; 25| 0| case Bit::ADX: ------------------ | Branch (25:7): [True: 0, False: 44] ------------------ 26| 0| return "adx"; 27| 0| case Bit::BMI: ------------------ | Branch (27:7): [True: 0, False: 44] ------------------ 28| 0| return "bmi2"; 29| 0| case Bit::GFNI: ------------------ | Branch (29:7): [True: 0, False: 44] ------------------ 30| 0| return "gfni"; 31| 0| case Bit::RDRAND: ------------------ | Branch (31:7): [True: 0, False: 44] ------------------ 32| 0| return "rdrand"; 33| 0| case Bit::RDSEED: ------------------ | Branch (33:7): [True: 0, False: 44] ------------------ 34| 0| return "rdseed"; 35| 0| case Bit::POPCNT: ------------------ | Branch (35:7): [True: 0, False: 44] ------------------ 36| 0| return "popcnt"; 37| 0| case Bit::AESNI: ------------------ | Branch (37:7): [True: 0, False: 44] ------------------ 38| 0| return "aesni"; 39| 0| case Bit::CLMUL: ------------------ | Branch (39:7): [True: 0, False: 44] ------------------ 40| 0| return "clmul"; 41| 0| case Bit::SHA: ------------------ | Branch (41:7): [True: 0, False: 44] ------------------ 42| 0| return "intel_sha"; 43| 0| case Bit::SHA512: ------------------ | Branch (43:7): [True: 0, False: 44] ------------------ 44| 0| return "intel_sha512"; 45| 0| case Bit::AVX2_AES: ------------------ | Branch (45:7): [True: 0, False: 44] ------------------ 46| 0| return "avx2_aes"; 47| 0| case Bit::AVX512_AES: ------------------ | Branch (47:7): [True: 0, False: 44] ------------------ 48| 0| return "avx512_aes"; 49| 0| case Bit::AVX2_CLMUL: ------------------ | Branch (49:7): [True: 0, False: 44] ------------------ 50| 0| return "avx2_clmul"; 51| 0| case Bit::AVX512_CLMUL: ------------------ | Branch (51:7): [True: 0, False: 44] ------------------ 52| 0| return "avx512_clmul"; 53| 0| case Bit::SM3: ------------------ | Branch (53:7): [True: 0, False: 44] ------------------ 54| 0| return "intel_sm3"; 55| 0| case Bit::SM4: ------------------ | Branch (55:7): [True: 0, False: 44] ------------------ 56| 0| return "intel_sm4"; 57| 44| } 58| 0| throw Invalid_State("CPUFeature invalid bit"); 59| 44|} _ZN5Botan5CPUID10CPUID_Data19detect_cpu_featuresEj: 62| 1|uint32_t CPUID::CPUID_Data::detect_cpu_features(uint32_t allowed) { 63| 1| enum class x86_CPUID_1_bits : uint64_t { 64| 1| RDTSC = (1ULL << 4), 65| 1| SSE2 = (1ULL << 26), 66| 1| CLMUL = (1ULL << 33), 67| 1| SSSE3 = (1ULL << 41), 68| 1| SSE41 = (1ULL << 51), 69| 1| POPCNT = (1ULL << 55), 70| 1| AESNI = (1ULL << 57), 71| | // AVX + OSXSAVE 72| 1| OSXSAVE = (1ULL << 59) | (1ULL << 60), 73| 1| RDRAND = (1ULL << 62) 74| 1| }; 75| | 76| 1| enum class x86_CPUID_7_bits : uint64_t { 77| 1| BMI1 = (1ULL << 3), 78| 1| AVX2 = (1ULL << 5), 79| 1| BMI2 = (1ULL << 8), 80| 1| BMI_1_AND_2 = BMI1 | BMI2, 81| 1| AVX512_F = (1ULL << 16), 82| 1| AVX512_DQ = (1ULL << 17), 83| 1| RDSEED = (1ULL << 18), 84| 1| ADX = (1ULL << 19), 85| 1| AVX512_IFMA = (1ULL << 21), 86| 1| SHA = (1ULL << 29), 87| 1| AVX512_BW = (1ULL << 30), 88| 1| AVX512_VL = (1ULL << 31), 89| 1| AVX512_VBMI = (1ULL << 33), 90| 1| AVX512_VBMI2 = (1ULL << 38), 91| 1| GFNI = (1ULL << 40), 92| 1| AVX512_VAES = (1ULL << 41), 93| 1| AVX512_VCLMUL = (1ULL << 42), 94| 1| AVX512_VBITALG = (1ULL << 44), 95| | 96| | /* 97| | We only enable AVX512 support if all of the below flags are available 98| | 99| | This is more than we strictly need for most uses, however it also has 100| | the effect of preventing execution of AVX512 codepaths on cores that 101| | have serious downclocking problems when AVX512 code executes, 102| | especially Intel Skylake. 103| | 104| | VBMI2/VBITALG are the key flags here as they restrict us to Intel Ice 105| | Lake/Rocket Lake, or AMD Zen4, all of which do not have penalties for 106| | executing AVX512. 107| | 108| | There is nothing stopping some future processor from supporting the 109| | above flags and having AVX512 penalties, but maybe you should not have 110| | bought such a processor. 111| | */ 112| 1| AVX512_PROFILE = 113| 1| AVX512_F | AVX512_DQ | AVX512_IFMA | AVX512_BW | AVX512_VL | AVX512_VBMI | AVX512_VBMI2 | AVX512_VBITALG, 114| 1| }; 115| | 116| | // NOLINTNEXTLINE(performance-enum-size) 117| 1| enum class x86_CPUID_7_1_bits : uint64_t { 118| 1| SHA512 = (1 << 0), 119| 1| SM3 = (1 << 1), 120| 1| SM4 = (1 << 2), 121| 1| }; 122| | 123| 1| uint32_t feat = 0; 124| 1| uint32_t cpuid[4] = {0}; 125| 1| bool has_sse41 = false; 126| 1| bool has_os_ymm_support = false; 127| 1| bool has_os_zmm_support = false; 128| | 129| | // CPUID 0: vendor identification, max sublevel 130| 1| invoke_cpuid(0, cpuid); 131| | 132| 1| const uint32_t max_supported_sublevel = cpuid[0]; 133| | 134| 1| if(max_supported_sublevel >= 1) { ------------------ | Branch (134:7): [True: 1, False: 0] ------------------ 135| | // CPUID 1: feature bits 136| 1| invoke_cpuid(1, cpuid); 137| 1| const uint64_t flags0 = (static_cast(cpuid[2]) << 32) | cpuid[3]; 138| | 139| 1| feat |= if_set(flags0, x86_CPUID_1_bits::RDTSC, CPUFeature::Bit::RDTSC, allowed); 140| | 141| 1| feat |= if_set(flags0, x86_CPUID_1_bits::RDRAND, CPUFeature::Bit::RDRAND, allowed); 142| | 143| 1| feat |= if_set(flags0, x86_CPUID_1_bits::POPCNT, CPUFeature::Bit::POPCNT, allowed); 144| | 145| 1| feat |= if_set(flags0, x86_CPUID_1_bits::SSE2, CPUFeature::Bit::SSE2, allowed); 146| | 147| 1| if(is_set(feat, CPUFeature::Bit::SSE2)) { ------------------ | Branch (147:10): [True: 1, False: 0] ------------------ 148| 1| feat |= if_set(flags0, x86_CPUID_1_bits::SSSE3, CPUFeature::Bit::SSSE3, allowed); 149| | 150| 1| if(is_set(feat, CPUFeature::Bit::SSSE3)) { ------------------ | Branch (150:13): [True: 1, False: 0] ------------------ 151| 1| feat |= if_set(flags0, x86_CPUID_1_bits::CLMUL, CPUFeature::Bit::CLMUL, allowed); 152| 1| feat |= if_set(flags0, x86_CPUID_1_bits::AESNI, CPUFeature::Bit::AESNI, allowed); 153| | 154| | // SSE4.1 is not tracked as a feature, but is required by the SHA-NI code 155| 1| const uint64_t sse41 = static_cast(x86_CPUID_1_bits::SSE41); 156| 1| has_sse41 = (flags0 & sse41) == sse41; 157| 1| } 158| | 159| 1| const uint64_t osxsave64 = static_cast(x86_CPUID_1_bits::OSXSAVE); 160| 1| if((flags0 & osxsave64) == osxsave64) { ------------------ | Branch (160:13): [True: 1, False: 0] ------------------ 161| 1| const uint64_t xcr_flags = xgetbv(); 162| 1| if((xcr_flags & 0x6) == 0x6) { ------------------ | Branch (162:16): [True: 1, False: 0] ------------------ 163| 1| has_os_ymm_support = true; 164| 1| has_os_zmm_support = (xcr_flags & 0xE0) == 0xE0; 165| 1| } 166| 1| } 167| 1| } 168| 1| } 169| | 170| 1| if(max_supported_sublevel >= 7) { ------------------ | Branch (170:7): [True: 1, False: 0] ------------------ 171| 1| clear_mem(cpuid, 4); 172| 1| invoke_cpuid_sublevel(7, 0, cpuid); 173| | 174| 1| const uint64_t flags7 = (static_cast(cpuid[2]) << 32) | cpuid[1]; 175| | 176| 1| clear_mem(cpuid, 4); 177| 1| invoke_cpuid_sublevel(7, 1, cpuid); 178| 1| const uint32_t flags7_1 = cpuid[0]; 179| | 180| 1| feat |= if_set(flags7, x86_CPUID_7_bits::RDSEED, CPUFeature::Bit::RDSEED, allowed); 181| 1| feat |= if_set(flags7, x86_CPUID_7_bits::ADX, CPUFeature::Bit::ADX, allowed); 182| | 183| | /* 184| | We only set the BMI bit if both BMI1 and BMI2 are supported, since 185| | typically we want to use both extensions in the same code. 186| | */ 187| 1| feat |= if_set(flags7, x86_CPUID_7_bits::BMI_1_AND_2, CPUFeature::Bit::BMI, allowed); 188| | 189| 1| if(is_set(feat, CPUFeature::Bit::SSSE3)) { ------------------ | Branch (189:10): [True: 1, False: 0] ------------------ 190| | // The SHA-NI code uses SSE4.1 instructions in addition to SSSE3 191| 1| if(has_sse41) { ------------------ | Branch (191:13): [True: 1, False: 0] ------------------ 192| 1| feat |= if_set(flags7, x86_CPUID_7_bits::SHA, CPUFeature::Bit::SHA, allowed); 193| 1| } 194| | 195| | // We only consider AVX2 if SSSE3 is supported 196| 1| if(has_os_ymm_support) { ------------------ | Branch (196:13): [True: 1, False: 0] ------------------ 197| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX2, CPUFeature::Bit::AVX2, allowed); 198| | 199| 1| if(is_set(feat, CPUFeature::Bit::AVX2)) { ------------------ | Branch (199:16): [True: 1, False: 0] ------------------ 200| 1| feat |= if_set(flags7, x86_CPUID_7_bits::GFNI, CPUFeature::Bit::GFNI, allowed); 201| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX2_AES, allowed); 202| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SHA512, CPUFeature::Bit::SHA512, allowed); 203| | // The SM3/SM4 instructions are VEX encoded and the code using them also uses AVX2 204| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM3, CPUFeature::Bit::SM3, allowed); 205| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM4, CPUFeature::Bit::SM4, allowed); 206| | 207| | // The VPCLMULQDQ code also uses the legacy 128-bit PCLMULQDQ instruction 208| 1| if(is_set(feat, CPUFeature::Bit::CLMUL)) { ------------------ | Branch (208:19): [True: 1, False: 0] ------------------ 209| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX2_CLMUL, allowed); 210| 1| } 211| | 212| | // Likewise we only consider AVX-512 if AVX2 is supported 213| 1| if(has_os_zmm_support) { ------------------ | Branch (213:19): [True: 0, False: 1] ------------------ 214| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_PROFILE, CPUFeature::Bit::AVX512, allowed); 215| | 216| 0| if(is_set(feat, CPUFeature::Bit::AVX512)) { ------------------ | Branch (216:22): [True: 0, False: 0] ------------------ 217| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX512_AES, allowed); 218| 0| if(is_set(feat, CPUFeature::Bit::CLMUL)) { ------------------ | Branch (218:25): [True: 0, False: 0] ------------------ 219| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX512_CLMUL, allowed); 220| 0| } 221| 0| } 222| 0| } 223| 1| } 224| 1| } 225| 1| } 226| 1| } 227| | 228| |/* 229| | * If we don't have access to CPUID, we can still safely assume that 230| | * any x86-64 processor has SSE2 and RDTSC 231| | */ 232| 1|#if defined(BOTAN_TARGET_ARCH_IS_X86_64) 233| 1| if(feat == 0) { ------------------ | Branch (233:7): [True: 0, False: 1] ------------------ 234| 0| feat |= CPUFeature::Bit::SSE2 & allowed; 235| 0| feat |= CPUFeature::Bit::RDTSC & allowed; 236| 0| } 237| 1|#endif 238| | 239| 1| return feat; 240| 1|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_112invoke_cpuidEjPj: 24| 2|void invoke_cpuid(uint32_t type, uint32_t out[4]) { 25| 2| clear_mem(out, 4); 26| | 27| 2|#if defined(BOTAN_USE_GCC_INLINE_ASM) 28| | // NOLINTNEXTLINE(*-no-assembler) 29| 2| asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type)); 30| | 31| |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC) 32| | __cpuid((int*)out, type); 33| | 34| |#else 35| | BOTAN_UNUSED(type); 36| | #warning "No way of calling x86 cpuid instruction for this compiler" 37| |#endif 38| 2|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_16xgetbvEv: 56| 1|BOTAN_FUNC_ISA("xsave") uint64_t xgetbv() { 57| | return _xgetbv(0); 58| 1|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_121invoke_cpuid_sublevelEjjPj: 40| 2|void invoke_cpuid_sublevel(uint32_t type, uint32_t level, uint32_t out[4]) { 41| 2| clear_mem(out, 4); 42| | 43| 2|#if defined(BOTAN_USE_GCC_INLINE_ASM) 44| | // NOLINTNEXTLINE(*-no-assembler) 45| 2| asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type), "2"(level)); 46| | 47| |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC) 48| | __cpuidex((int*)out, type, level); 49| | 50| |#else 51| | BOTAN_UNUSED(type, level); 52| | #warning "No way of calling x86 cpuid instruction for this compiler" 53| |#endif 54| 2|} _ZN5Botan10DataSource9read_byteERh: 27| 71.4k|size_t DataSource::read_byte(uint8_t& out) { 28| 71.4k| return read(&out, 1); 29| 71.4k|} _ZN5Botan10DataSource9read_byteEv: 34| 973k|std::optional DataSource::read_byte() { 35| 973k| uint8_t b = 0; 36| 973k| if(this->read(&b, 1) == 1) { ------------------ | Branch (36:7): [True: 961k, False: 11.2k] ------------------ 37| 961k| return b; 38| 961k| } else { 39| 11.2k| return {}; 40| 11.2k| } 41| 973k|} _ZNK5Botan10DataSource9peek_byteERh: 46| 7.00k|size_t DataSource::peek_byte(uint8_t& out) const { 47| 7.00k| return peek(&out, 1, 0); 48| 7.00k|} _ZN5Botan17DataSource_Memory4readEPhm: 73| 951k|size_t DataSource_Memory::read(uint8_t out[], size_t length) { 74| 951k| const size_t got = std::min(m_source.size() - m_offset, length); 75| 951k| copy_mem(out, m_source.data() + m_offset, got); 76| 951k| m_offset += got; 77| 951k| return got; 78| 951k|} _ZN5Botan17DataSource_Memory15check_availableEm: 80| 14.6k|bool DataSource_Memory::check_available(size_t n) { 81| 14.6k| return (n <= (m_source.size() - m_offset)); 82| 14.6k|} _ZNK5Botan17DataSource_Memory4peekEPhmm: 87| 13.7k|size_t DataSource_Memory::peek(uint8_t out[], size_t length, size_t peek_offset) const { 88| 13.7k| const size_t bytes_left = m_source.size() - m_offset; 89| 13.7k| if(peek_offset >= bytes_left) { ------------------ | Branch (89:7): [True: 0, False: 13.7k] ------------------ 90| 0| return 0; 91| 0| } 92| | 93| 13.7k| const size_t got = std::min(bytes_left - peek_offset, length); 94| 13.7k| copy_mem(out, &m_source[m_offset + peek_offset], got); 95| 13.7k| return got; 96| 13.7k|} _ZNK5Botan17DataSource_Memory11end_of_dataEv: 101| 13.5k|bool DataSource_Memory::end_of_data() const { 102| 13.5k| return (m_offset == m_source.size()); 103| 13.5k|} _ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 71| 5.48k|Exception::Exception(std::string_view msg) : m_msg(msg) {} _ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKSt9exception: 73| 1.16k|Exception::Exception(std::string_view msg, const std::exception& e) : m_msg(fmt("{} failed with {}", msg, e.what())) {} _ZN5Botan16Invalid_ArgumentC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 77| 86|Invalid_Argument::Invalid_Argument(std::string_view msg) : Exception(msg) {} _ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 125| 3.49k|Decoding_Error::Decoding_Error(std::string_view name) : Exception(name) {} _ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 128| 1.90k| Exception(fmt("{}: {}", category, err)) {} _ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKSt9exception: 130| 1.16k|Decoding_Error::Decoding_Error(std::string_view msg, const std::exception& e) : Exception(msg, e) {} _ZN5Botan19secure_scrub_memoryEPvm: 24| 3.03M|void secure_scrub_memory(void* ptr, size_t n) { 25| 3.03M| return secure_zeroize_buffer(ptr, n); 26| 3.03M|} _ZN5Botan21secure_zeroize_bufferEPvm: 28| 3.05M|void secure_zeroize_buffer(void* ptr, size_t n) { 29| 3.05M| if(n == 0) { ------------------ | Branch (29:7): [True: 75.9k, False: 2.97M] ------------------ 30| 75.9k| return; 31| 75.9k| } 32| | 33| |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY) 34| | ::RtlSecureZeroMemory(ptr, n); 35| | 36| |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO) 37| 2.97M| ::explicit_bzero(ptr, n); 38| | 39| |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET) 40| | (void)::explicit_memset(ptr, 0, n); 41| | 42| |#else 43| | /* 44| | * Call memset through a static volatile pointer, which the compiler should 45| | * not elide. This construct should be safe in conforming compilers, but who 46| | * knows. This has been checked to generate the expected code, which saves the 47| | * memset address in the data segment and unconditionally loads and jumps to 48| | * that address, with the following targets: 49| | * 50| | * x86-64: Clang 19, GCC 6, 11, 13, 14 51| | * riscv64: GCC 14 52| | * aarch64: GCC 14 53| | * armv7: GCC 14 54| | * 55| | * Actually all of them generated the expected jump even without marking the 56| | * function pointer as volatile. However this seems worth including as an 57| | * additional precaution. 58| | */ 59| | static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset; 60| | (memset_ptr)(ptr, 0, n); 61| |#endif 62| 2.97M|} _ZN5Botan2OS17get_cpu_availableEv: 241| 1|size_t OS::get_cpu_available() { 242| 1|#if defined(BOTAN_TARGET_OS_HAS_POSIX1) 243| | 244| 1| #if defined(_SC_NPROCESSORS_ONLN) 245| 1| const long cpu_online = ::sysconf(_SC_NPROCESSORS_ONLN); 246| 1| if(cpu_online > 0) { ------------------ | Branch (246:7): [True: 1, False: 0] ------------------ 247| 1| return static_cast(cpu_online); 248| 1| } 249| 0| #endif 250| | 251| 0| #if defined(_SC_NPROCESSORS_CONF) 252| 0| const long cpu_conf = ::sysconf(_SC_NPROCESSORS_CONF); 253| 0| if(cpu_conf > 0) { ------------------ | Branch (253:7): [True: 0, False: 0] ------------------ 254| 0| return static_cast(cpu_conf); 255| 0| } 256| 0| #endif 257| | 258| 0|#endif 259| | 260| 0|#if defined(BOTAN_TARGET_OS_HAS_THREADS) 261| | // hardware_concurrency is allowed to return 0 if the value is not 262| | // well defined or not computable. 263| 0| const size_t hw_concur = std::thread::hardware_concurrency(); 264| | 265| 0| if(hw_concur > 0) { ------------------ | Branch (265:7): [True: 0, False: 0] ------------------ 266| 0| return hw_concur; 267| 0| } 268| 0|#endif 269| | 270| 0| return 1; 271| 0|} _ZN5Botan2OS17read_env_variableERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE: 471| 2|bool OS::read_env_variable(std::string& value_out, std::string_view name_view) { 472| 2| value_out = ""; 473| | 474| 2| if(running_in_privileged_state()) { ------------------ | Branch (474:7): [True: 0, False: 2] ------------------ 475| 0| return false; 476| 0| } 477| | 478| |#if defined(BOTAN_TARGET_OS_HAS_WIN32) && \ 479| | (defined(BOTAN_BUILD_COMPILER_IS_MSVC) || defined(BOTAN_BUILD_COMPILER_IS_CLANGCL)) 480| | const std::string name(name_view); 481| | 482| | // First query the required buffer size; req_size is 0 if the variable is not set 483| | size_t req_size = 0; 484| | if(getenv_s(&req_size, nullptr, 0, name.c_str()) != 0 || req_size == 0) { 485| | return false; 486| | } 487| | 488| | // The reported size includes the terminating \0 489| | std::string val(req_size, '\0'); 490| | if(getenv_s(&req_size, val.data(), val.size(), name.c_str()) != 0) { 491| | return false; 492| | } 493| | 494| | value_out = std::string(val.c_str()); 495| | return true; 496| |#else 497| 2| const std::string name(name_view); 498| 2| if(const char* val = std::getenv(name.c_str())) { ------------------ | Branch (498:19): [True: 0, False: 2] ------------------ 499| 0| value_out = val; 500| 0| return true; 501| 0| } 502| 2|#endif 503| | 504| 2| return false; 505| 2|} os_utils.cpp:_ZN5Botan12_GLOBAL__N_110get_auxvalENSt3__18optionalImEE: 120| 2|std::optional get_auxval(std::optional id) { 121| 2| if(id) { ------------------ | Branch (121:7): [True: 2, False: 0] ------------------ 122| 2|#if defined(BOTAN_TARGET_OS_HAS_GETAUXVAL) 123| 2| return ::getauxval(*id); 124| |#elif defined(BOTAN_TARGET_OS_HAS_ELF_AUX_INFO) 125| | unsigned long auxinfo = 0; 126| | if(::elf_aux_info(static_cast(*id), &auxinfo, sizeof(auxinfo)) == 0) { 127| | return auxinfo; 128| | } 129| |#endif 130| 2| } 131| | 132| 0| return {}; 133| 2|} os_utils.cpp:_ZN5Botan12_GLOBAL__N_127running_in_privileged_stateEv: 154| 2|bool running_in_privileged_state() { 155| 2|#if defined(AT_SECURE) 156| 2| if(const auto at_secure = get_auxval(AT_SECURE)) { ------------------ | Branch (156:18): [True: 2, False: 0] ------------------ 157| 2| return at_secure != 0; 158| 2| } 159| 0|#endif 160| | 161| 0|#if defined(BOTAN_TARGET_OS_HAS_POSIX1) 162| 0| return (::getuid() != ::geteuid()) || (::getgid() != ::getegid()); ------------------ | Branch (162:11): [True: 0, False: 0] | Branch (162:42): [True: 0, False: 0] ------------------ 163| |#else 164| | return false; 165| |#endif 166| 2|} _ZN5Botan8parse_szENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEb: 71| 132|std::optional parse_sz(std::string_view input, bool require_canonical) { 72| 132| return parse_decimal_integer(input, require_canonical); 73| 132|} _ZN5Botan8split_onENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEc: 83| 3.93k|std::vector split_on(std::string_view str, char delim) { 84| 3.93k| std::vector elems; 85| 3.93k| if(str.empty()) { ------------------ | Branch (85:7): [True: 0, False: 3.93k] ------------------ 86| 0| return elems; 87| 0| } 88| | 89| 3.93k| std::string substr; 90| 21.0k| for(const char c : str) { ------------------ | Branch (90:21): [True: 21.0k, False: 3.93k] ------------------ 91| 21.0k| if(c == delim) { ------------------ | Branch (91:10): [True: 79, False: 20.9k] ------------------ 92| 79| if(!substr.empty()) { ------------------ | Branch (92:13): [True: 79, False: 0] ------------------ 93| 79| elems.push_back(substr); 94| 79| } 95| 79| substr.clear(); 96| 20.9k| } else { 97| 20.9k| substr += c; 98| 20.9k| } 99| 21.0k| } 100| | 101| 3.93k| if(substr.empty()) { ------------------ | Branch (101:7): [True: 0, False: 3.93k] ------------------ 102| 0| throw Invalid_Argument(fmt("Unable to split string '{}", str)); 103| 0| } 104| 3.93k| elems.push_back(substr); 105| | 106| 3.93k| return elems; 107| 3.93k|} parsing.cpp:_ZN5Botan12_GLOBAL__N_116digit_from_asciiEc: 22| 440|std::optional digit_from_ascii(char c) { 23| 440| if(c >= '0' && c <= '9') { ------------------ | Branch (23:7): [True: 440, False: 0] | Branch (23:19): [True: 440, False: 0] ------------------ 24| 440| return c - '0'; 25| 440| } else { 26| 0| return {}; 27| 0| } 28| 440|} parsing.cpp:_ZN5Botan12_GLOBAL__N_121parse_decimal_integerITkNSt3__117unsigned_integralEmEENS2_8optionalIT_EENS2_17basic_string_viewIcNS2_11char_traitsIcEEEEb: 31| 132|std::optional parse_decimal_integer(std::string_view input, bool require_canonical) { 32| 132| if(input.empty() || input.size() > (std::numeric_limits::digits10 + 1)) { ------------------ | Branch (32:7): [True: 0, False: 132] | Branch (32:24): [True: 0, False: 132] ------------------ 33| 0| return {}; 34| 0| } 35| | 36| | // The canonical encoding of zero is "0"; no other value starts with a zero 37| 132| if(require_canonical && input.size() > 1 && input.front() == '0') { ------------------ | Branch (37:7): [True: 132, False: 0] | Branch (37:28): [True: 132, False: 0] | Branch (37:48): [True: 0, False: 132] ------------------ 38| 0| return {}; 39| 0| } 40| | 41| 132| T accum = 0; 42| | 43| 440| for(const char c : input) { ------------------ | Branch (43:21): [True: 440, False: 132] ------------------ 44| 440| if(const auto digit = digit_from_ascii(c)) { ------------------ | Branch (44:21): [True: 440, False: 0] ------------------ 45| 440| if(accum > (std::numeric_limits::max() - static_cast(*digit)) / 10) { ------------------ | Branch (45:13): [True: 0, False: 440] ------------------ 46| 0| return {}; 47| 0| } 48| 440| accum = accum * 10 + static_cast(*digit); 49| 440| } else { 50| 0| return {}; 51| 0| } 52| 440| } 53| | 54| 132| return accum; 55| 132|} _ZN5Botan11Thread_Pool15global_instanceEv: 213| 44|Thread_Pool& Thread_Pool::global_instance() { 214| 44| static Thread_Pool g_thread_pool(global_thread_pool_size()); 215| 44| return g_thread_pool; 216| 44|} _ZN5Botan11Thread_PoolC2ENSt3__18optionalImEE: 224| 1| m_executor(std::make_shared(opt_pool_size)), 225| 1| m_worker_count(m_executor->max_concurrency()), 226| 1| m_executor_was_set(false) {} _ZN5Botan11Thread_Pool8shutdownEv: 263| 1|void Thread_Pool::shutdown() { 264| | // Releasing the internal pool drains its queue and joins its threads, so 265| | // it is held until after the lock is dropped 266| 1| const auto executor = [this]() { 267| 1| const std::scoped_lock lock(m_mutex); 268| 1| m_worker_count = 0; 269| 1| return std::exchange(m_executor, nullptr); 270| 1| }(); 271| 1|} thread_pool.cpp:_ZN5Botan12_GLOBAL__N_123global_thread_pool_sizeEv: 176| 1|std::optional global_thread_pool_size() { 177| 1| std::string var; 178| 1| if(OS::read_env_variable(var, "BOTAN_THREAD_POOL_SIZE")) { ------------------ | Branch (178:7): [True: 0, False: 1] ------------------ 179| 0| if(var == "none") { ------------------ | Branch (179:10): [True: 0, False: 0] ------------------ 180| 0| return std::nullopt; 181| 0| } 182| | 183| | // Try to convert to an integer if possible: 184| 0| if(const auto sz = parse_sz(var)) { ------------------ | Branch (184:21): [True: 0, False: 0] ------------------ 185| 0| return sz; 186| 0| } 187| | 188| | // If it was neither a number nor a special value, then ignore the env 189| 0| } 190| | 191| | /* 192| | * On a few platforms, disable the thread pool by default; it is only 193| | * used if a size is set explicitly in the environment. 194| | */ 195| | 196| |#if defined(BOTAN_TARGET_OS_IS_MINGW) 197| | // MinGW seems to have bugs causing deadlock on application exit. 198| | // See https://github.com/randombit/botan/issues/2582 for background. 199| | return std::nullopt; 200| |#elif defined(BOTAN_TARGET_OS_IS_EMSCRIPTEN) 201| | // Emscripten's threads are reportedly problematic 202| | // See https://github.com/randombit/botan/issues/4195 203| | return std::nullopt; 204| |#else 205| | // Some(0) means choose based on CPU count 206| 1| return std::optional(0); 207| 1|#endif 208| 1|} thread_pool.cpp:_ZZN5Botan11Thread_Pool8shutdownEvENK3$_0clEv: 266| 1| const auto executor = [this]() { 267| 1| const std::scoped_lock lock(m_mutex); 268| 1| m_worker_count = 0; 269| 1| return std::exchange(m_executor, nullptr); 270| 1| }(); thread_pool.cpp:_ZN5Botan12_GLOBAL__N_120Internal_Thread_PoolC2ENSt3__18optionalImEE: 32| 1| m_pool_size(resolve_pool_size(pool_size)), m_shutdown(false) {} thread_pool.cpp:_ZN5Botan12_GLOBAL__N_120Internal_Thread_Pool17resolve_pool_sizeENSt3__18optionalImEE: 73| 1|size_t Internal_Thread_Pool::resolve_pool_size(std::optional pool_size) { 74| 1| if(!pool_size.has_value()) { ------------------ | Branch (74:7): [True: 0, False: 1] ------------------ 75| 0| return 0; // disabled 76| 1| } else if(pool_size.value() == 0) { ------------------ | Branch (76:14): [True: 1, False: 0] ------------------ 77| | // For large machines don't create too many threads, unless explicitly asked 78| 1| return std::clamp(OS::get_cpu_available(), 2, 16); 79| 1| } else { 80| 0| return pool_size.value(); 81| 0| } 82| 1|} thread_pool.cpp:_ZN5Botan12_GLOBAL__N_120Internal_Thread_PoolD2Ev: 35| 1| ~Internal_Thread_Pool() override { 36| 1| { 37| 1| const std::scoped_lock lock(m_mutex); 38| 1| m_shutdown = true; 39| 1| } 40| 1| m_more_tasks.notify_all(); 41| | 42| 1| for(auto& worker : m_workers) { ------------------ | Branch (42:27): [True: 0, False: 1] ------------------ 43| 0| worker.join(); 44| 0| } 45| 1| } thread_pool.cpp:_ZNK5Botan12_GLOBAL__N_120Internal_Thread_Pool15max_concurrencyEv: 54| 1| size_t max_concurrency() const override { return m_pool_size; } _ZN5Botan9SHAKE_XOFC2Em: 17| 3.63k| m_keccak({.capacity_bits = capacity, .padding = KeccakPadding::shake()}), m_output_generated(false) { 18| 3.63k| BOTAN_ASSERT_NOMSG(capacity == 256 || capacity == 512); ------------------ | | 84| 3.63k| do { \ | | 85| 3.63k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 4.66k| if(!(expr)) { \ | | ------------------ | | | Branch (86:12): [True: 2.59k, False: 1.03k] | | | Branch (86:12): [True: 1.03k, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 3.63k| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 3.63k] | | ------------------ ------------------ 19| 3.63k|} _ZN5Botan9SHAKE_XOF5resetEv: 21| 358|void SHAKE_XOF::reset() { 22| 358| m_keccak.clear(); 23| 358| m_output_generated = false; 24| 358|} _ZN5Botan9SHAKE_XOF8add_dataENSt3__14spanIKhLm18446744073709551615EEE: 26| 7.75k|void SHAKE_XOF::add_data(std::span input) { 27| 7.75k| BOTAN_STATE_CHECK(!m_output_generated); ------------------ | | 51| 7.75k| do { \ | | 52| 7.75k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 53| 7.75k| if(!(expr)) { \ | | ------------------ | | | Branch (53:10): [True: 0, False: 7.75k] | | ------------------ | | 54| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 55| 0| Botan::throw_invalid_state(#expr, __func__, __FILE__); \ | | 56| 0| } \ | | 57| 7.75k| } while(0) | | ------------------ | | | Branch (57:12): [Folded, False: 7.75k] | | ------------------ ------------------ 28| 7.75k| m_keccak.absorb(input); 29| 7.75k|} _ZN5Botan9SHAKE_XOF14generate_bytesENSt3__14spanIhLm18446744073709551615EEE: 31| 823k|void SHAKE_XOF::generate_bytes(std::span output) { 32| 823k| if(!m_output_generated) { ------------------ | Branch (32:7): [True: 3.91k, False: 819k] ------------------ 33| 3.91k| m_output_generated = true; 34| 3.91k| m_keccak.finish(); 35| 3.91k| } 36| | 37| 823k| m_keccak.squeeze(output); 38| 823k|} _ZN5Botan3XOF6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 28| 3.63k|std::unique_ptr XOF::create(std::string_view algo_spec, std::string_view provider) { 29| 3.63k| if(!provider.empty() && provider != "base") { ------------------ | Branch (29:7): [True: 0, False: 3.63k] | Branch (29:28): [True: 0, False: 0] ------------------ 30| 0| return nullptr; // unknown provider 31| 0| } 32| | 33| 3.63k|#if defined(BOTAN_HAS_SHAKE_XOF) 34| 3.63k| if(algo_spec == "SHAKE-128") { ------------------ | Branch (34:7): [True: 2.59k, False: 1.03k] ------------------ 35| 2.59k| return std::make_unique(); 36| 2.59k| } 37| 1.03k| if(algo_spec == "SHAKE-256") { ------------------ | Branch (37:7): [True: 1.03k, False: 0] ------------------ 38| 1.03k| return std::make_unique(); 39| 1.03k| } 40| 0|#endif 41| | 42| 0|#if defined(BOTAN_HAS_ASCON_XOF128) 43| 0| if(algo_spec == "Ascon-XOF128") { ------------------ | Branch (43:7): [True: 0, False: 0] ------------------ 44| 0| return std::make_unique(); 45| 0| } 46| 0|#endif 47| | 48| 0| return nullptr; 49| 0|} _ZN5Botan3XOF15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_: 52| 3.63k|std::unique_ptr XOF::create_or_throw(std::string_view algo_spec, std::string_view provider) { 53| 3.63k| if(auto xof = XOF::create(algo_spec, provider)) { ------------------ | Branch (53:12): [True: 3.63k, False: 0] ------------------ 54| 3.63k| return xof; 55| 3.63k| } 56| 0| throw Lookup_Error("XOF", algo_spec, provider); 57| 3.63k|} _ZN5Botan3XOF5startENSt3__14spanIKhLm18446744073709551615EEES4_: 68| 3.91k|void XOF::start(std::span salt, std::span key) { 69| 3.91k| if(!key_spec().valid_keylength(key.size())) { ------------------ | Branch (69:7): [True: 0, False: 3.91k] ------------------ 70| 0| throw Invalid_Key_Length(name(), key.size()); 71| 0| } 72| | 73| 3.91k| if(!valid_salt_length(salt.size())) { ------------------ | Branch (73:7): [True: 0, False: 3.91k] ------------------ 74| 0| throw Invalid_Argument(fmt("{} cannot accept a salt length of {}", name(), salt.size())); 75| 0| } 76| | 77| 3.91k| m_xof_started = true; 78| 3.91k| start_msg(salt, key); 79| 3.91k|} _ZN5Botan3XOF9start_msgENSt3__14spanIKhLm18446744073709551615EEES4_: 81| 3.91k|void XOF::start_msg(std::span salt, std::span key) { 82| 3.91k| BOTAN_UNUSED(salt, key); ------------------ | | 151| 3.91k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 83| 3.91k|}