Modify Keyed_Filter so it is a pure interface

Modify ECB to use parallel encryption/decryption where possible

Add toggles in build.h specifying how many blocks to process in parallel.
Defaults to 8 blocks for all modes, which is sufficient that any likely
parallelism can be extracted (via SIMD or concurrent execution) but not
so much as to seem likely to cause cache problems (8*128 bits = 128 bytes,
or two x86 cache lines)

17 files changed, 418 insertions, 150 deletions

diff --git a/checks/validate.dat b/checks/validate.dat
index b8566b62a..c4e0d0121 100644
--- a/checks/validate.dat
+++ b/checks/validate.dat
@@ -19472,7 +19472,20 @@ D261D6041824D259290EABD3E9132DB8:7E3B14847526572FF2AA5D7BD626B560:\
 01000000000000000000000000000000:07E5E5AD7097B849BADC2D5D803B7F6A:\
 0000000000000000000000000000000000000000000000000000000000000000
 
+1032547698BADCFEEFCDAB8967452301:D5BAA00A4BB9D8A7C981C8DC90D89D92:\
+FFEEDDCCBBAA99887766554433221100
 
+145F0B8B663176B95DCAB7E9DCD5CC24:1032547698BADCFEEFCDAB8967452301:\
+FFEEDDCCBBAA99887766554433221100
+
+1032547698BADCFEEFCDAB8967452301:DA860842B720802BF404A4C71034879A:\
+8899AABBCCDDEEFFFFEEDDCCBBAA99887766554433221100
+
+B2696BD0D98C17953E4239225D27202C:1032547698BADCFEEFCDAB8967452301:\
+8899AABBCCDDEEFFFFEEDDCCBBAA99887766554433221100
+
+1032547698BADCFEEFCDAB8967452301:93DF9A3CAFE387BD999EEBE393A17FCA:\
+00112233445566778899AABBCCDDEEFFFFEEDDCCBBAA99887766554433221100
 
 # Corrected test vectors, based on NIST's clarification of May 9, 2002
 [Skipjack]
@@ -22938,6 +22951,51 @@ B4ECC305C3DBD8E5:FBBEC8F5DBF4CEFD:1B5E23EBD915C1FEE59F57DD91AF7347
 
 # The block cipher tests above are distinct from these ECB mode tests
 # for testing reasons. They could otherwise easily be CIPHER/ECB/NoPadding
+
+[AES/ECB/NoPadding]
+D8F532538289EF7D06B506A4FD5BE9C9FD7A929E0FD917686D9520ED236A276D\
+69E63C821F9DE0BF23CF1D19C7374FD1C3139DE2E1BA4693C3E9D29D774C2FF4\
+69E63C821F9DE0BF23CF1D19C7374FD1C3139DE2E1BA4693C3E9D29D774C2FF4\
+D8F532538289EF7D06B506A4FD5BE9C9FD7A929E0FD917686D9520ED236A276D\
+D8F532538289EF7D06B506A4FD5BE9C9C3139DE2E1BA4693C3E9D29D774C2FF4:\
+FD7A929E0FD917686D9520ED236A276D69E63C821F9DE0BF23CF1D19C7374FD1\
+C3139DE2E1BA4693C3E9D29D774C2FF46BA2DCF84C0E7E4D75CB53AD11BA76D6\
+C3139DE2E1BA4693C3E9D29D774C2FF46BA2DCF84C0E7E4D75CB53AD11BA76D6\
+FD7A929E0FD917686D9520ED236A276D69E63C821F9DE0BF23CF1D19C7374FD1\
+FD7A929E0FD917686D9520ED236A276D6BA2DCF84C0E7E4D75CB53AD11BA76D6:\
+00010203050607080A0B0C0D0F101112
+
+[Serpent/ECB/NoPadding]
+D29D576FCEA3A3A7ED9099F29273D78E2D62A890CEA3A3A7ED9099F29273D78E\
+D29D576F315C5C58ED9099F29273D78E2D62A890315C5C58ED9099F29273D78E\
+D29D576FCEA3A3A7126F660D9273D78E2D62A890CEA3A3A7126F660D9273D78E\
+D29D576F315C5C58126F660D9273D78E2D62A890315C5C58126F660D9273D78E\
+D29D576FCEA3A3A7ED9099F26D8C28712D62A890CEA3A3A7ED9099F26D8C2871\
+D29D576F315C5C58ED9099F26D8C28712D62A890315C5C58ED9099F26D8C2871\
+D29D576FCEA3A3A7126F660D6D8C28712D62A890CEA3A3A7126F660D6D8C2871\
+D29D576F315C5C58126F660D6D8C28712D62A890315C5C58126F660D6D8C2871\
+AA26D561F567520E8AE47528C24C18D731A2193D9A97FED6922B17AAA6372B74\
+BE5DEBD559E303C9C92B174A5107BBFEB626D8F65EDCCDF3AEE475C8A1837722\
+41DDE7C1F1631F5FDED4F42746471BD651D238BA86176EFE39E4695AAEB73B52\
+EA5926CADAD8018962E469BA920CB8BF1EA9062E4D9CEDD5FAD4F4C7990367A4\
+B966E5C5D2277288C61B96A559CC84AFB6A6583C5AACFCD6212B0BD8AEF3C6A9\
+A11DDBD175639341052B0B384678D8D9352299B71DD880E29D1B96452DB86540:\
+B2288B968AE8B08648D1CE9606FD992D717EB02EB81A2E939D54ACA91087112D\
+0D809C5EE82F477EBA7B956DBB23463B0F0190D616F5294112FFB7884E8B37F9\
+41BA1B505386B7428B88338188F7E718A3348230BF5CFA552F88D22463D9703A\
+115351622E016BCA26918D17E13225F67EE4E3F2C46FE52ECBDA044C585717DC\
+563A8403FF5309D62370B1DCF5A11EDD2F7D73602B70CD2553E44C1D3F170126\
+155BBD9BE3A965B345E834718F651CEF6CC65E8C5C566E894817350F497816F1\
+EEFA51FC91FEBB6E9F8CB141CC0EB6AF3C6F8380CBD3C996167F2F0E90E71B75\
+6C87EB62A4975356B28DCBF6A64A0BD107206D48FE6DBE19D50314B90AC87B83\
+35706F9B26007071AD8105CFAA1C1E2FF7FEAE5CEC4D11477F24E6B200906870\
+3C0E29E2950F2AC2DACD63DEEB5C7EFA9FDB9F3B740563D5518287DC981FC9CB\
+46D4B5A5A86FEC08FE70D18297DCF51072DDBE038DA040EBB12C509F5940A212\
+DDEB59F02132BE4581FC23EABAA960D6341D9352E36DFD6E4EAF0F6F439BC8CE\
+73A9AB3164FF30350F2DC08E939A104D6DF0C2C28F8E2D44468A61278BB6B429\
+4DAE45AE0CAA032FC97CD4D8C57FB83BBA8AFCAE22070BC882D3A42B38A09E65:\
+00000000000000000000000000000000
+
 [DES/ECB/NoPadding]
 059B5E0851CF143A:86A560F10EC6D85B:0113B970FD34F2CE
 4E6F772069732074:3FA40E8A984D4815:0123456789ABCDEF
@@ -24901,6 +24959,37 @@ E5C7CDDE872BF27C43E934008C389C0F683788499A7C05F662C16A27E4FCF277:\
 4E6F77206973207468652074696D6520666F7220616C6C20:\
 0123456789ABCDEF:1234567890ABCDEF
 
+[Serpent/ECB/NoPadding]
+B2288B968AE8B08648D1CE9606FD992D717EB02EB81A2E939D54ACA91087112D\
+0D809C5EE82F477EBA7B956DBB23463B0F0190D616F5294112FFB7884E8B37F9\
+41BA1B505386B7428B88338188F7E718A3348230BF5CFA552F88D22463D9703A\
+115351622E016BCA26918D17E13225F67EE4E3F2C46FE52ECBDA044C585717DC\
+563A8403FF5309D62370B1DCF5A11EDD2F7D73602B70CD2553E44C1D3F170126\
+155BBD9BE3A965B345E834718F651CEF6CC65E8C5C566E894817350F497816F1\
+EEFA51FC91FEBB6E9F8CB141CC0EB6AF3C6F8380CBD3C996167F2F0E90E71B75\
+6C87EB62A4975356B28DCBF6A64A0BD107206D48FE6DBE19D50314B90AC87B83\
+35706F9B26007071AD8105CFAA1C1E2FF7FEAE5CEC4D11477F24E6B200906870\
+3C0E29E2950F2AC2DACD63DEEB5C7EFA9FDB9F3B740563D5518287DC981FC9CB\
+46D4B5A5A86FEC08FE70D18297DCF51072DDBE038DA040EBB12C509F5940A212\
+DDEB59F02132BE4581FC23EABAA960D6341D9352E36DFD6E4EAF0F6F439BC8CE\
+73A9AB3164FF30350F2DC08E939A104D6DF0C2C28F8E2D44468A61278BB6B429\
+4DAE45AE0CAA032FC97CD4D8C57FB83BBA8AFCAE22070BC882D3A42B38A09E65:\
+D29D576FCEA3A3A7ED9099F29273D78E2D62A890CEA3A3A7ED9099F29273D78E\
+D29D576F315C5C58ED9099F29273D78E2D62A890315C5C58ED9099F29273D78E\
+D29D576FCEA3A3A7126F660D9273D78E2D62A890CEA3A3A7126F660D9273D78E\
+D29D576F315C5C58126F660D9273D78E2D62A890315C5C58126F660D9273D78E\
+D29D576FCEA3A3A7ED9099F26D8C28712D62A890CEA3A3A7ED9099F26D8C2871\
+D29D576F315C5C58ED9099F26D8C28712D62A890315C5C58ED9099F26D8C2871\
+D29D576FCEA3A3A7126F660D6D8C28712D62A890CEA3A3A7126F660D6D8C2871\
+D29D576F315C5C58126F660D6D8C28712D62A890315C5C58126F660D6D8C2871\
+AA26D561F567520E8AE47528C24C18D731A2193D9A97FED6922B17AAA6372B74\
+BE5DEBD559E303C9C92B174A5107BBFEB626D8F65EDCCDF3AEE475C8A1837722\
+41DDE7C1F1631F5FDED4F42746471BD651D238BA86176EFE39E4695AAEB73B52\
+EA5926CADAD8018962E469BA920CB8BF1EA9062E4D9CEDD5FAD4F4C7990367A4\
+B966E5C5D2277288C61B96A559CC84AFB6A6583C5AACFCD6212B0BD8AEF3C6A9\
+A11DDBD175639341052B0B384678D8D9352299B71DD880E29D1B96452DB86540:\
+00000000000000000000000000000000
+
 [RC5(8)/CBC/PKCS7]
 7875DBF6738C64788F34C3C681C99695:FFFFFFFFFFFFFFFF:0102030405:0000000000000000
 7875DBF6738C64787CB3F1DF34F948117FD1A023A5BBA217:\
diff --git a/src/build-data/buildh.in b/src/build-data/buildh.in
index e4ab0f44b..bd900d412 100644
--- a/src/build-data/buildh.in
+++ b/src/build-data/buildh.in
@@ -22,6 +22,12 @@
 #define BOTAN_KARAT_SQR_THRESHOLD 32
 #define BOTAN_PRIVATE_KEY_OP_BLINDING_BITS 64
 
+/* Toggles for parallel block cipher mode processing */
+#define BOTAN_PARALLEL_BLOCKS_ECB 8
+#define BOTAN_PARALLEL_BLOCKS_CTR 8
+#define BOTAN_PARALLEL_BLOCKS_EAX 8
+#define BOTAN_PARALLEL_BLOCKS_XTS 8
+
 /* PK key consistency checking toggles */
 #define BOTAN_PUBLIC_KEY_STRONG_CHECKS_ON_LOAD 1
 #define BOTAN_PRIVATE_KEY_STRONG_CHECKS_ON_LOAD 1
diff --git a/src/codec/openpgp/openpgp.cpp b/src/codec/openpgp/openpgp.cpp
index 7f9cf5f9c..bfba828af 100644
--- a/src/codec/openpgp/openpgp.cpp
+++ b/src/codec/openpgp/openpgp.cpp
@@ -7,6 +7,7 @@
 
 #include <botan/openpgp.h>
 #include <botan/filters.h>
+#include <botan/basefilt.h>
 #include <botan/charset.h>
 #include <botan/crc24.h>
 
diff --git a/src/filters/algo_filt.cpp b/src/filters/algo_filt.cpp
index 23f7a20cf..3268276a6 100644
--- a/src/filters/algo_filt.cpp
+++ b/src/filters/algo_filt.cpp
@@ -18,7 +18,7 @@ StreamCipher_Filter::StreamCipher_Filter(const std::string& sc_name) :
    buffer(DEFAULT_BUFFERSIZE)
    {
    Algorithm_Factory& af = global_state().algorithm_factory();
-   base_ptr = cipher = af.make_stream_cipher(sc_name);
+   cipher = af.make_stream_cipher(sc_name);
    }
 
 /*
@@ -27,7 +27,7 @@ StreamCipher_Filter::StreamCipher_Filter(const std::string& sc_name) :
 StreamCipher_Filter::StreamCipher_Filter(StreamCipher* stream_cipher) :
    buffer(DEFAULT_BUFFERSIZE)
    {
-   base_ptr = cipher = stream_cipher;
+   cipher = stream_cipher;
    }
 
 /*
@@ -38,7 +38,7 @@ StreamCipher_Filter::StreamCipher_Filter(const std::string& sc_name,
    buffer(DEFAULT_BUFFERSIZE)
    {
    Algorithm_Factory& af = global_state().algorithm_factory();
-   base_ptr = cipher = af.make_stream_cipher(sc_name);
+   cipher = af.make_stream_cipher(sc_name);
    cipher->set_key(key);
    }
 
@@ -95,7 +95,7 @@ MAC_Filter::MAC_Filter(const std::string& mac_name, u32bit len) :
    OUTPUT_LENGTH(len)
    {
    Algorithm_Factory& af = global_state().algorithm_factory();
-   base_ptr = mac = af.make_mac(mac_name);
+   mac = af.make_mac(mac_name);
    }
 
 /*
@@ -105,7 +105,7 @@ MAC_Filter::MAC_Filter(const std::string& mac_name, const SymmetricKey& key,
                        u32bit len) : OUTPUT_LENGTH(len)
    {
    Algorithm_Factory& af = global_state().algorithm_factory();
-   base_ptr = mac = af.make_mac(mac_name);
+   mac = af.make_mac(mac_name);
    mac->set_key(key);
    }
 
diff --git a/src/filters/basefilt.cpp b/src/filters/basefilt.cpp
index 02dbd8a73..c91a5aa62 100644
--- a/src/filters/basefilt.cpp
+++ b/src/filters/basefilt.cpp
@@ -50,25 +50,4 @@ Fork::Fork(Filter* filters[], u32bit count)
    set_next(filters, count);
    }
 
-/*
-* Set the algorithm key
-*/
-void Keyed_Filter::set_key(const SymmetricKey& key)
-   {
-   if(base_ptr)
-      base_ptr->set_key(key);
-   else
-      throw Invalid_State("Keyed_Filter::set_key: No base algorithm set");
-   }
-
-/*
-* Check if a keylength is valid
-*/
-bool Keyed_Filter::valid_keylength(u32bit n) const
-   {
-   if(base_ptr)
-      return base_ptr->valid_keylength(n);
-   throw Invalid_State("Keyed_Filter::valid_keylength: No base algorithm set");
-   }
-
 }
diff --git a/src/filters/basefilt.h b/src/filters/basefilt.h
index 75625abb0..348ad6fd3 100644
--- a/src/filters/basefilt.h
+++ b/src/filters/basefilt.h
@@ -9,7 +9,6 @@
 #define BOTAN_BASEFILT_H__
 
 #include <botan/filter.h>
-#include <botan/sym_algo.h>
 
 namespace Botan {
 
@@ -62,38 +61,6 @@ class BOTAN_DLL Fork : public Fanout_Filter
       Fork(Filter* filter_arr[], u32bit length);
    };
 
-/**
-* This class represents keyed filters, i.e. filters that have to be
-* fed with a key in order to function.
-*/
-class BOTAN_DLL Keyed_Filter : public Filter
-   {
-   public:
-
-      /**
-      * Set the key of this filter.
-      * @param key the key to set
-      */
-      virtual void set_key(const SymmetricKey& key);
-
-      /**
-      * Set the initialization vector of this filter.
-      * @param iv the initialization vector to set
-      */
-      virtual void set_iv(const InitializationVector&) {}
-
-      /**
-      * Check whether a key length is valid for this filter.
-      * @param length the key length to be checked for validity
-      * @return true if the key length is valid, false otherwise
-      */
-      virtual bool valid_keylength(u32bit length) const;
-
-      Keyed_Filter() { base_ptr = 0; }
-   protected:
-      SymmetricAlgorithm* base_ptr;
-   };
-
 }
 
 #endif
diff --git a/src/filters/filters.h b/src/filters/filters.h
index 725651f7d..26de6e63c 100644
--- a/src/filters/filters.h
+++ b/src/filters/filters.h
@@ -14,7 +14,7 @@
 #include <botan/mac.h>
 
 #include <botan/pipe.h>
-#include <botan/basefilt.h>
+#include <botan/key_filt.h>
 #include <botan/data_snk.h>
 #include <botan/scan_name.h>
 
@@ -36,6 +36,13 @@ class BOTAN_DLL StreamCipher_Filter : public Keyed_Filter
    public:
 
       /**
+      * Write input data
+      * @param input data
+      * @param input_len length of input in bytes
+      */
+      void write(const byte input[], u32bit input_len);
+
+      /**
       * Seek in the stream.
       * @param position the position to seek ahead
       */
@@ -53,7 +60,20 @@ class BOTAN_DLL StreamCipher_Filter : public Keyed_Filter
       * @param iv the initialization vector to set
       */
       void set_iv(const InitializationVector& iv);
-      void write(const byte[], u32bit);
+
+      /**
+      * Set the key of this filter.
+      * @param key the key to set
+      */
+      void set_key(const SymmetricKey& key) { cipher->set_key(key); }
+
+      /**
+      * Check whether a key length is valid for this filter.
+      * @param length the key length to be checked for validity
+      * @return true if the key length is valid, false otherwise
+      */
+      bool valid_keylength(u32bit length) const
+         { return cipher->valid_keylength(length); }
 
       /**
       * Construct a stream cipher filter.
@@ -126,6 +146,20 @@ class BOTAN_DLL MAC_Filter : public Keyed_Filter
       void end_msg();
 
       /**
+      * Set the key of this filter.
+      * @param key the key to set
+      */
+      void set_key(const SymmetricKey& key) { mac->set_key(key); }
+
+      /**
+      * Check whether a key length is valid for this filter.
+      * @param length the key length to be checked for validity
+      * @return true if the key length is valid, false otherwise
+      */
+      bool valid_keylength(u32bit length) const
+         { return mac->valid_keylength(length); }
+
+      /**
       * Construct a MAC filter. The MAC key will be left empty.
       * @param mac the MAC to use
       * @param len the output length of this filter. Leave the default
@@ -136,7 +170,7 @@ class BOTAN_DLL MAC_Filter : public Keyed_Filter
       MAC_Filter(MessageAuthenticationCode* mac_obj,
                  u32bit out_len = 0) : OUTPUT_LENGTH(out_len)
          {
-         base_ptr = mac = mac_obj;
+         mac = mac_obj;
          }
 
       /**
@@ -152,7 +186,7 @@ class BOTAN_DLL MAC_Filter : public Keyed_Filter
                  const SymmetricKey& key,
                  u32bit out_len = 0) : OUTPUT_LENGTH(out_len)
          {
-         base_ptr = mac = mac_obj;
+         mac = mac_obj;
          mac->set_key(key);
          }
 
diff --git a/src/filters/info.txt b/src/filters/info.txt
index 79a92a9c5..fb8108659 100644
--- a/src/filters/info.txt
+++ b/src/filters/info.txt
@@ -17,6 +17,7 @@ data_src.h
 filter.cpp
 filter.h
 filters.h
+key_filt.h
 out_buf.cpp
 out_buf.h
 pbe.h
diff --git a/src/filters/key_filt.h b/src/filters/key_filt.h
new file mode 100644
index 000000000..36af91f88
--- /dev/null
+++ b/src/filters/key_filt.h
@@ -0,0 +1,45 @@
+/*
+* Keyed_Filter
+* (C) 1999-2007 Jack Lloyd
+*
+* Distributed under the terms of the Botan license
+*/
+
+#ifndef BOTAN_KEYED_FILTER_H__
+#define BOTAN_KEYED_FILTER_H__
+
+#include <botan/filter.h>
+#include <botan/sym_algo.h>
+
+namespace Botan {
+
+/**
+* This class represents keyed filters, i.e. filters that have to be
+* fed with a key in order to function.
+*/
+class BOTAN_DLL Keyed_Filter : public Filter
+   {
+   public:
+      /**
+      * Set the key of this filter.
+      * @param key the key to set
+      */
+      virtual void set_key(const SymmetricKey& key) = 0;
+
+      /**
+      * Set the initialization vector of this filter.
+      * @param iv the initialization vector to set
+      */
+      virtual void set_iv(const InitializationVector&) {}
+
+      /**
+      * Check whether a key length is valid for this filter.
+      * @param length the key length to be checked for validity
+      * @return true if the key length is valid, false otherwise
+      */
+      virtual bool valid_keylength(u32bit length) const = 0;
+   };
+
+}
+
+#endif
diff --git a/src/modes/ctr/ctr.cpp b/src/modes/ctr/ctr.cpp
index 5c27ca63c..a3476c474 100644
--- a/src/modes/ctr/ctr.cpp
+++ b/src/modes/ctr/ctr.cpp
@@ -11,16 +11,21 @@
 
 namespace Botan {
 
+namespace {
+
+const u32bit PARALLEL_BLOCKS = BOTAN_PARALLEL_BLOCKS_CTR;
+
+}
+
 /*
 * CTR-BE Constructor
 */
 CTR_BE::CTR_BE(BlockCipher* ciph) : cipher(ciph)
    {
-   base_ptr = cipher;
    position = 0;
 
-   counter.create(ciph->BLOCK_SIZE * CTR_BLOCKS_PARALLEL);
-   enc_buffer.create(ciph->BLOCK_SIZE * CTR_BLOCKS_PARALLEL);
+   counter.create(ciph->BLOCK_SIZE * PARALLEL_BLOCKS);
+   enc_buffer.create(ciph->BLOCK_SIZE * PARALLEL_BLOCKS);
    }
 
 /*
@@ -30,13 +35,12 @@ CTR_BE::CTR_BE(BlockCipher* ciph, const SymmetricKey& key,
                const InitializationVector& iv) :
    cipher(ciph)
    {
-   base_ptr = cipher;
    position = 0;
 
-   counter.create(ciph->BLOCK_SIZE * CTR_BLOCKS_PARALLEL);
-   enc_buffer.create(ciph->BLOCK_SIZE * CTR_BLOCKS_PARALLEL);
+   counter.create(ciph->BLOCK_SIZE * PARALLEL_BLOCKS);
+   enc_buffer.create(ciph->BLOCK_SIZE * PARALLEL_BLOCKS);
 
-   set_key(key);
+   cipher->set_key(key);
    set_iv(iv);
    }
 
@@ -67,7 +71,7 @@ void CTR_BE::set_iv(const InitializationVector& iv)
    enc_buffer.clear();
    position = 0;
 
-   for(u32bit i = 0; i != CTR_BLOCKS_PARALLEL; ++i)
+   for(u32bit i = 0; i != PARALLEL_BLOCKS; ++i)
       {
       counter.copy(i*cipher->BLOCK_SIZE, iv.begin(), iv.length());
 
@@ -78,7 +82,7 @@ void CTR_BE::set_iv(const InitializationVector& iv)
                break;
       }
 
-   cipher->encrypt_n(counter, enc_buffer, CTR_BLOCKS_PARALLEL);
+   cipher->encrypt_n(counter, enc_buffer, PARALLEL_BLOCKS);
    }
 
 /*
@@ -116,24 +120,24 @@ void CTR_BE::write(const byte input[], u32bit length)
 */
 void CTR_BE::increment_counter()
    {
-   for(u32bit i = 0; i != CTR_BLOCKS_PARALLEL; ++i)
+   for(u32bit i = 0; i != PARALLEL_BLOCKS; ++i)
       {
       // FIXME: Can do it in a single loop
       /*
       for(u32bit j = 1; j != cipher->BLOCK_SIZE; ++j)
          {
          byte carry = 0;
-         byte z = counter[(i+1)*cipher->BLOCK_SIZE-1] + CTR_BLOCKS_PARALLEL;
+         byte z = counter[(i+1)*cipher->BLOCK_SIZE-1] + PARALLEL_BLOCKS;
 
       if(
       */
-      for(u32bit j = 0; j != CTR_BLOCKS_PARALLEL; ++j)
+      for(u32bit j = 0; j != PARALLEL_BLOCKS; ++j)
          for(s32bit k = cipher->BLOCK_SIZE - 1; k >= 0; --k)
             if(++counter[i*cipher->BLOCK_SIZE+k])
                break;
       }
 
-   cipher->encrypt_n(counter, enc_buffer, CTR_BLOCKS_PARALLEL);
+   cipher->encrypt_n(counter, enc_buffer, PARALLEL_BLOCKS);
 
    position = 0;
    }
diff --git a/src/modes/ctr/ctr.h b/src/modes/ctr/ctr.h
index 3d509f02c..1948ffe48 100644
--- a/src/modes/ctr/ctr.h
+++ b/src/modes/ctr/ctr.h
@@ -8,7 +8,7 @@
 #ifndef BOTAN_COUNTER_MODE_H__
 #define BOTAN_COUNTER_MODE_H__
 
-#include <botan/basefilt.h>
+#include <botan/key_filt.h>
 #include <botan/block_cipher.h>
 
 namespace Botan {
@@ -20,15 +20,19 @@ class BOTAN_DLL CTR_BE : public Keyed_Filter
    {
    public:
       std::string name() const;
+
       void set_iv(const InitializationVector&);
 
+      void set_key(const SymmetricKey& key) { cipher->set_key(key); }
+
+      bool valid_keylength(u32bit key_len) const
+         { return cipher->valid_keylength(key_len); }
+
       CTR_BE(BlockCipher*);
       CTR_BE(BlockCipher*, const SymmetricKey&, const InitializationVector&);
 
       ~CTR_BE();
    private:
-      static const u32bit CTR_BLOCKS_PARALLEL = 8;
-
       void write(const byte[], u32bit);
       void increment_counter();
 
diff --git a/src/modes/eax/eax.h b/src/modes/eax/eax.h
index 1bb2e510d..f569f2ede 100644
--- a/src/modes/eax/eax.h
+++ b/src/modes/eax/eax.h
@@ -8,7 +8,7 @@
 #ifndef BOTAN_EAX_H__
 #define BOTAN_EAX_H__
 
-#include <botan/basefilt.h>
+#include <botan/key_filt.h>
 #include <botan/block_cipher.h>
 #include <botan/mac.h>
 
diff --git a/src/modes/ecb/ecb.cpp b/src/modes/ecb/ecb.cpp
index 8da0a4802..988a8b3f2 100644
--- a/src/modes/ecb/ecb.cpp
+++ b/src/modes/ecb/ecb.cpp
@@ -9,22 +9,60 @@
 
 namespace Botan {
 
+namespace {
+
+const u32bit PARALLEL_BLOCKS = BOTAN_PARALLEL_BLOCKS_ECB;
+
+}
+
 /*
-* Verify the IV is not set
+* ECB_Encryption Constructor
 */
-bool ECB::valid_iv_size(u32bit iv_size) const
+ECB_Encryption::ECB_Encryption(BlockCipher* ciph,
+                               BlockCipherModePaddingMethod* pad)
    {
-   if(iv_size == 0)
-      return true;
-   return false;
+   cipher = ciph;
+   padder = pad;
+
+   plaintext.create(cipher->BLOCK_SIZE);
+   ciphertext.create(cipher->BLOCK_SIZE * PARALLEL_BLOCKS);
+
+   position = 0;
+   }
+
+/*
+* ECB_Encryption Constructor
+*/
+ECB_Encryption::ECB_Encryption(BlockCipher* ciph,
+                               BlockCipherModePaddingMethod* pad,
+                               const SymmetricKey& key)
+   {
+   cipher = ciph;
+   padder = pad;
+
+   plaintext.create(cipher->BLOCK_SIZE);
+   ciphertext.create(cipher->BLOCK_SIZE * PARALLEL_BLOCKS);
+
+   position = 0;
+
+   cipher->set_key(key);
+   }
+
+/*
+* ECB_Encryption Destructor
+*/
+ECB_Encryption::~ECB_Encryption()
+   {
+   delete cipher;
+   delete padder;
    }
 
 /*
 * Return an ECB mode name
 */
-std::string ECB::name() const
+std::string ECB_Encryption::name() const
    {
-   return (cipher->name() + "/" + mode_name + "/" + padder->name());
+   return (cipher->name() + "/ECB/" + padder->name());
    }
 
 /*
@@ -32,23 +70,34 @@ std::string ECB::name() const
 */
 void ECB_Encryption::write(const byte input[], u32bit length)
    {
-   buffer.copy(position, input, length);
-   if(position + length >= BLOCK_SIZE)
+   const u32bit BLOCK_SIZE = cipher->BLOCK_SIZE;
+
+   if(position)
       {
-      cipher->encrypt(buffer);
-      send(buffer, BLOCK_SIZE);
-      input += (BLOCK_SIZE - position);
-      length -= (BLOCK_SIZE - position);
-      while(length >= BLOCK_SIZE)
+      plaintext.copy(position, input, length);
+
+      if(position + length >= BLOCK_SIZE)
          {
-         cipher->encrypt(input, buffer);
-         send(buffer, BLOCK_SIZE);
-         input += BLOCK_SIZE;
-         length -= BLOCK_SIZE;
+         cipher->encrypt(plaintext, ciphertext);
+         send(ciphertext, BLOCK_SIZE);
+         input += (BLOCK_SIZE - position);
+         length -= (BLOCK_SIZE - position);
+         position = 0;
          }
-      buffer.copy(input, length);
-      position = 0;
       }
+
+   while(length >= BLOCK_SIZE)
+      {
+      const u32bit to_proc =
+         std::min<u32bit>(length, ciphertext.size()) / BLOCK_SIZE;
+
+      cipher->encrypt_n(input, ciphertext, to_proc);
+      send(ciphertext, to_proc * BLOCK_SIZE);
+      input += to_proc * BLOCK_SIZE;
+      length -= to_proc * BLOCK_SIZE;
+      }
+
+   plaintext.copy(position, input, length);
    position += length;
    }
 
@@ -57,6 +106,8 @@ void ECB_Encryption::write(const byte input[], u32bit length)
 */
 void ECB_Encryption::end_msg()
    {
+   const u32bit BLOCK_SIZE = cipher->BLOCK_SIZE;
+
    SecureVector<byte> padding(BLOCK_SIZE);
    padder->pad(padding, padding.size(), position);
    write(padding, padder->pad_bytes(BLOCK_SIZE, position));
@@ -65,27 +116,93 @@ void ECB_Encryption::end_msg()
    }
 
 /*
+* ECB_Decryption Constructor
+*/
+ECB_Decryption::ECB_Decryption(BlockCipher* ciph,
+                               BlockCipherModePaddingMethod* pad)
+   {
+   cipher = ciph;
+   padder = pad;
+
+   ciphertext.create(cipher->BLOCK_SIZE);
+   plaintext.create(cipher->BLOCK_SIZE * PARALLEL_BLOCKS);
+
+   position = 0;
+   }
+
+/*
+* ECB_Decryption Constructor
+*/
+ECB_Decryption::ECB_Decryption(BlockCipher* ciph,
+                               BlockCipherModePaddingMethod* pad,
+                               const SymmetricKey& key)
+   {
+   cipher = ciph;
+   padder = pad;
+
+   ciphertext.create(cipher->BLOCK_SIZE);
+   plaintext.create(cipher->BLOCK_SIZE * PARALLEL_BLOCKS);
+
+   position = 0;
+
+   cipher->set_key(key);
+   }
+
+/*
+* ECB_Decryption Destructor
+*/
+ECB_Decryption::~ECB_Decryption()
+   {
+   delete cipher;
+   delete padder;
+   }
+
+/*
+* Return an ECB mode name
+*/
+std::string ECB_Decryption::name() const
+   {
+   return (cipher->name() + "/ECB/" + padder->name());
+   }
+
+/*
 * Decrypt in ECB mode
 */
 void ECB_Decryption::write(const byte input[], u32bit length)
    {
-   buffer.copy(position, input, length);
-   if(position + length > BLOCK_SIZE)
+   const u32bit BLOCK_SIZE = cipher->BLOCK_SIZE;
+
+   if(position)
       {
-      cipher->decrypt(buffer);
-      send(buffer, BLOCK_SIZE);
-      input += (BLOCK_SIZE - position);
-      length -= (BLOCK_SIZE - position);
-      while(length > BLOCK_SIZE)
+      ciphertext.copy(position, input, length);
+
+      if(position + length > BLOCK_SIZE)
          {
-         cipher->decrypt(input, buffer);
-         send(buffer, BLOCK_SIZE);
-         input += BLOCK_SIZE;
-         length -= BLOCK_SIZE;
+         cipher->decrypt(ciphertext, plaintext);
+         send(plaintext, BLOCK_SIZE);
+         input += (BLOCK_SIZE - position);
+         length -= (BLOCK_SIZE - position);
+         position = 0;
          }
-      buffer.copy(input, length);
-      position = 0;
       }
+
+   while(length > BLOCK_SIZE)
+      {
+      /* Always leave at least 1 byte left over, to ensure that (as long
+         as the input message actually is a multiple of the block size)
+         we will have the full final block left over in end_msg so as
+         to remove the padding
+      */
+      const u32bit to_proc =
+         std::min<u32bit>(length - 1, plaintext.size()) / BLOCK_SIZE;
+
+      cipher->decrypt_n(input, plaintext, to_proc);
+      send(plaintext, to_proc * BLOCK_SIZE);
+      input += to_proc * BLOCK_SIZE;
+      length -= to_proc * BLOCK_SIZE;
+      }
+
+   ciphertext.copy(position, input, length);
    position += length;
    }
 
@@ -94,11 +211,11 @@ void ECB_Decryption::write(const byte input[], u32bit length)
 */
 void ECB_Decryption::end_msg()
    {
-   if(position != BLOCK_SIZE)
+   if(position != cipher->BLOCK_SIZE)
       throw Decoding_Error(name());
-   cipher->decrypt(buffer);
-   send(buffer, padder->unpad(buffer, BLOCK_SIZE));
-   state = buffer;
+
+   cipher->decrypt(ciphertext);
+   send(ciphertext, padder->unpad(ciphertext, cipher->BLOCK_SIZE));
    position = 0;
    }
 
diff --git a/src/modes/ecb/ecb.h b/src/modes/ecb/ecb.h
index 5230f9b14..ff9ea9635 100644
--- a/src/modes/ecb/ecb.h
+++ b/src/modes/ecb/ecb.h
@@ -1,6 +1,6 @@
 /*
 * ECB Mode
-* (C) 1999-2007 Jack Lloyd
+* (C) 1999-2009 Jack Lloyd
 *
 * Distributed under the terms of the Botan license
 */
@@ -8,64 +8,74 @@
 #ifndef BOTAN_ECB_H__
 #define BOTAN_ECB_H__
 
-#include <botan/modebase.h>
-#include <botan/mode_pad.h>
+#include <botan/basefilt.h>
 #include <botan/block_cipher.h>
+#include <botan/mode_pad.h>
 
-namespace Botan {
-
-/*
-* ECB
-*/
-class BOTAN_DLL ECB : public BlockCipherMode
-   {
-   protected:
-      ECB(BlockCipher* ciph, BlockCipherModePaddingMethod* pad) :
-         BlockCipherMode(ciph, "ECB", 0), padder(pad) {}
-      ~ECB() { delete padder; }
+#include <botan/modebase.h>
 
-      std::string name() const;
-      BlockCipherModePaddingMethod* padder;
-   private:
-      bool valid_iv_size(u32bit) const;
-   };
+namespace Botan {
 
 /*
 * ECB Encryption
 */
-class BOTAN_DLL ECB_Encryption : public ECB
+class BOTAN_DLL ECB_Encryption : public Keyed_Filter
    {
    public:
+      std::string name() const;
+
+      void set_key(const SymmetricKey& key) { cipher->set_key(key); }
+
+      bool valid_keylength(u32bit key_len) const
+         { return cipher->valid_keylength(key_len); }
+
       ECB_Encryption(BlockCipher* ciph,
-                     BlockCipherModePaddingMethod* pad) :
-         ECB(ciph, pad) {}
+                     BlockCipherModePaddingMethod* pad);
 
       ECB_Encryption(BlockCipher* ciph,
                      BlockCipherModePaddingMethod* pad,
-                     const SymmetricKey& key) :
-         ECB(ciph, pad) { set_key(key); }
+                     const SymmetricKey& key);
+
+      ~ECB_Encryption();
    private:
       void write(const byte[], u32bit);
       void end_msg();
+
+      BlockCipher* cipher;
+      BlockCipherModePaddingMethod* padder;
+      SecureVector<byte> plaintext, ciphertext;
+      u32bit position;
    };
 
 /*
 * ECB Decryption
 */
-class BOTAN_DLL ECB_Decryption : public ECB
+class BOTAN_DLL ECB_Decryption : public Keyed_Filter
    {
    public:
+      std::string name() const;
+
+      void set_key(const SymmetricKey& key) { cipher->set_key(key); }
+
+      bool valid_keylength(u32bit key_len) const
+         { return cipher->valid_keylength(key_len); }
+
       ECB_Decryption(BlockCipher* ciph,
-                     BlockCipherModePaddingMethod* pad) :
-         ECB(ciph, pad) {}
+                     BlockCipherModePaddingMethod* pad);
 
       ECB_Decryption(BlockCipher* ciph,
                      BlockCipherModePaddingMethod* pad,
-                     const SymmetricKey& key) :
-         ECB(ciph, pad) { set_key(key); }
+                     const SymmetricKey& key);
+
+      ~ECB_Decryption();
    private:
       void write(const byte[], u32bit);
       void end_msg();
+
+      BlockCipher* cipher;
+      BlockCipherModePaddingMethod* padder;
+      SecureVector<byte> plaintext, ciphertext;
+      u32bit position;
    };
 
 }
diff --git a/src/modes/modebase.cpp b/src/modes/modebase.cpp
index 8293acc54..b048862a4 100644
--- a/src/modes/modebase.cpp
+++ b/src/modes/modebase.cpp
@@ -19,7 +19,7 @@ BlockCipherMode::BlockCipherMode(BlockCipher* cipher_ptr,
    BLOCK_SIZE(cipher_ptr->BLOCK_SIZE), BUFFER_SIZE(buf_mult * BLOCK_SIZE),
    IV_METHOD(iv_meth), mode_name(cipher_mode_name)
    {
-   base_ptr = cipher = cipher_ptr;
+   cipher = cipher_ptr;
    buffer.create(BUFFER_SIZE);
    state.create(iv_size);
    position = 0;
diff --git a/src/modes/modebase.h b/src/modes/modebase.h
index 173fde58c..4a15524b6 100644
--- a/src/modes/modebase.h
+++ b/src/modes/modebase.h
@@ -8,7 +8,7 @@
 #ifndef BOTAN_MODEBASE_H__
 #define BOTAN_MODEBASE_H__
 
-#include <botan/basefilt.h>
+#include <botan/key_filt.h>
 #include <botan/block_cipher.h>
 
 namespace Botan {
@@ -21,12 +21,17 @@ class BOTAN_DLL BlockCipherMode : public Keyed_Filter
    public:
       std::string name() const;
 
+      void set_iv(const InitializationVector&);
+      void set_key(const SymmetricKey& key) { cipher->set_key(key); }
+
+      bool valid_keylength(u32bit key_len) const
+         { return cipher->valid_keylength(key_len); }
+
       BlockCipherMode(BlockCipher*, const std::string&,
                       u32bit, u32bit = 0, u32bit = 1);
 
       virtual ~BlockCipherMode() { delete cipher; }
    protected:
-      void set_iv(const InitializationVector&);
       const u32bit BLOCK_SIZE, BUFFER_SIZE, IV_METHOD;
       const std::string mode_name;
       BlockCipher* cipher;
diff --git a/src/modes/xts/xts.h b/src/modes/xts/xts.h
index 01558175b..9badd3666 100644
--- a/src/modes/xts/xts.h
+++ b/src/modes/xts/xts.h
@@ -8,7 +8,7 @@
 #ifndef BOTAN_XTS_H__
 #define BOTAN_XTS_H__
 
-#include <botan/basefilt.h>
+#include <botan/key_filt.h>
 #include <botan/block_cipher.h>
 
 namespace Botan {
@@ -22,6 +22,9 @@ class BOTAN_DLL XTS_Encryption : public Keyed_Filter
       void set_key(const SymmetricKey& key);
       void set_iv(const InitializationVector& iv);
 
+      bool valid_keylength(u32bit key_len) const
+         { return cipher->valid_keylength(key_len); }
+
       std::string name() const;
 
       XTS_Encryption(BlockCipher* ciph);
@@ -52,6 +55,9 @@ class BOTAN_DLL XTS_Decryption : public Keyed_Filter
       void set_key(const SymmetricKey& key);
       void set_iv(const InitializationVector& iv);
 
+      bool valid_keylength(u32bit key_len) const
+         { return cipher->valid_keylength(key_len); }
+
       std::string name() const;
 
       XTS_Decryption(BlockCipher* ciph);