Remove more uses of vector to pointer implicit conversions

35 files changed, 154 insertions, 126 deletions

diff --git a/checks/dolook.cpp b/checks/dolook.cpp
index 92f7381c2..09c3d5987 100644
--- a/checks/dolook.cpp
+++ b/checks/dolook.cpp
@@ -115,9 +115,7 @@ class KDF_Filter : public Filter
          { secret.append(in, len); }
       void end_msg()
          {
-         SymmetricKey x = kdf->derive_key(outlen,
-                                          secret, secret.size(),
-                                          salt, salt.size());
+         SymmetricKey x = kdf->derive_key(outlen, secret, salt);
          send(x.bits_of(), x.length());
          }
       KDF_Filter(KDF* algo, const SymmetricKey& s, u32bit o)
@@ -154,9 +152,7 @@ void RNG_Filter::write(const byte[], u32bit length)
    {
    if(length)
       {
-      SecureVector<byte> out(length);
-      rng->randomize(out, out.size());
-      send(out);
+      send(rng->random_vec(length));
       }
    }
 
diff --git a/checks/ec_tests.cpp b/checks/ec_tests.cpp
index 1f31cb2cf..979414ed4 100644
--- a/checks/ec_tests.cpp
+++ b/checks/ec_tests.cpp
@@ -644,11 +644,7 @@ void test_gfp_store_restore()
 
    //store point (to std::string)
    SecureVector<byte> sv_mes = EC2OSP(p, PointGFp::COMPRESSED);
-   std::string storrage = hex_encode(sv_mes, sv_mes.size());
-
-   // restore point (from std::string)
-   SecureVector<byte> sv_new_point = hex_decode(storrage);
-   PointGFp new_p = OS2ECP(sv_new_point, dom_pars.get_curve());
+   PointGFp new_p = OS2ECP(sv_mes, dom_pars.get_curve());
 
    CHECK_MESSAGE( p == new_p, "original and restored point are different!");
    }
diff --git a/checks/pk.cpp b/checks/pk.cpp
index 0d06e0983..eb93cc531 100644
--- a/checks/pk.cpp
+++ b/checks/pk.cpp
@@ -178,7 +178,7 @@ void validate_signature(PK_Verifier& v, PK_Signer& s, const std::string& algo,
 
    SecureVector<byte> expected = hex_decode(exp);
 
-   SecureVector<byte> sig = s.sign_message(message, message.size(), rng);
+   SecureVector<byte> sig = s.sign_message(message, rng);
 
    if(sig != expected)
       {
@@ -187,7 +187,7 @@ void validate_signature(PK_Verifier& v, PK_Signer& s, const std::string& algo,
       failure = true;
       }
 
-   if(!v.verify_message(message, message.size(), sig, sig.size()))
+   if(!v.verify_message(message, sig))
       {
       std::cout << "FAILED (verify): " << algo << std::endl;
       failure = true;
@@ -196,7 +196,7 @@ void validate_signature(PK_Verifier& v, PK_Signer& s, const std::string& algo,
    /* This isn't a very thorough testing method, but it will hopefully
       catch any really horrible errors */
    sig[0]++;
-   if(v.verify_message(message, message.size(), sig, sig.size()))
+   if(v.verify_message(message, sig))
       {
       std::cout << "FAILED (accepted bad sig): " << algo << std::endl;
       failure = true;
@@ -220,7 +220,7 @@ void validate_kas(PK_Key_Agreement& kas, const std::string& algo,
    SecureVector<byte> expected = hex_decode(output);
 
    SecureVector<byte> got = kas.derive_key(keylen,
-                                           pubkey, pubkey.size()).bits_of();
+                                           pubkey).bits_of();
 
    if(got != expected)
       {
@@ -371,7 +371,7 @@ u32bit validate_rsa_ver(const std::string& algo,
    SecureVector<byte> sig = hex_decode(str[3]);
 
    bool passed = true;
-   passed = v.verify_message(msg, msg.size(), sig, sig.size());
+   passed = v.verify_message(msg, sig);
    return (passed ? 0 : 1);
 #endif
 
@@ -402,7 +402,7 @@ u32bit validate_rsa_ver_x509(const std::string& algo,
    SecureVector<byte> msg = hex_decode(str[1]);
    SecureVector<byte> sig = hex_decode(str[2]);
 
-   bool passed = v.verify_message(msg, msg.size(), sig, sig.size());
+   bool passed = v.verify_message(msg, sig);
    return (passed ? 0 : 1);
 
 #endif
@@ -427,7 +427,7 @@ u32bit validate_rw_ver(const std::string& algo,
    SecureVector<byte> sig = hex_decode(str[3]);
 
    bool passed = true;
-   passed = v.verify_message(msg, msg.size(), sig, sig.size());
+   passed = v.verify_message(msg, sig);
    return (passed ? 0 : 1);
 #endif
 
@@ -542,7 +542,7 @@ u32bit validate_gost_ver(const std::string& algo,
    SecureVector<byte> msg = hex_decode(str[2]);
    SecureVector<byte> sig = hex_decode(str[3]);
 
-   bool passed = v.verify_message(msg, msg.size(), sig, sig.size());
+   bool passed = v.verify_message(msg, sig);
    return (passed ? 0 : 1);
 #endif
 
@@ -575,7 +575,7 @@ u32bit validate_dsa_ver(const std::string& algo,
    SecureVector<byte> sig = hex_decode(str[2]);
 
    v.set_input_format(DER_SEQUENCE);
-   bool passed = v.verify_message(msg, msg.size(), sig, sig.size());
+   bool passed = v.verify_message(msg, sig);
    return (passed ? 0 : 1);
 #endif
 
diff --git a/checks/pk_bench.cpp b/checks/pk_bench.cpp
index 41108d9ac..2eb87dfeb 100644
--- a/checks/pk_bench.cpp
+++ b/checks/pk_bench.cpp
@@ -162,8 +162,7 @@ void benchmark_sig_ver(PK_Verifier& ver, PK_Signer& sig,
 
          if((i % 100) == 0)
             {
-            sig_random.resize(signature.size());
-            rng.randomize(sig_random, sig_random.size());
+            sig_random = rng.random_vec(signature.size());
 
             verify_timer.start();
             bool verified2 = ver.verify_message(message, sig_random);
diff --git a/checks/validate.cpp b/checks/validate.cpp
index 9f6bc44ce..3c7aeeb22 100644
--- a/checks/validate.cpp
+++ b/checks/validate.cpp
@@ -346,7 +346,7 @@ bool failed_test(const std::string& algo,
       pipe.append(new Botan::Hex_Encoder);
 
       Botan::SecureVector<byte> data = Botan::hex_decode(in);
-      const byte* data_ptr = data;
+      const byte* data_ptr = &data[0];
 
       // this can help catch errors with buffering, etc
       u32bit len = data.size();
@@ -394,7 +394,7 @@ bool failed_test(const std::string& algo,
       u32bit length = random_word(rng, pipe.remaining() - offset);
 
       Botan::SecureVector<byte> peekbuf(length);
-      pipe.peek(peekbuf, length, offset);
+      pipe.peek(&peekbuf[0], peekbuf.size(), offset);
 
       output = pipe.read_all_as_string();
 
diff --git a/doc/examples/tls_client.cpp b/doc/examples/tls_client.cpp
index 9e9fce9c2..26e93dd2f 100644
--- a/doc/examples/tls_client.cpp
+++ b/doc/examples/tls_client.cpp
@@ -41,8 +41,12 @@ int main(int argc, char* argv[])
 
       printf("Handshake extablished...\n");
 
+#if 0
       std::string http_command = "GET / HTTP/1.1\r\n"
                                  "Server: " + host + ':' + to_string(port) + "\r\n\r\n";
+#else
+      std::string http_command = "GET / HTTP/1.0\r\n\r\n";
+#endif
 
       tls.write((const byte*)http_command.c_str(), http_command.length());
 
@@ -61,7 +65,7 @@ int main(int argc, char* argv[])
          total_got += got;
          }
 
-      printf("Retrieved %d bytes total\n", total_got);
+      printf("\nRetrieved %d bytes total\n", total_got);
    }
    catch(std::exception& e)
       {
diff --git a/src/block/square/square.cpp b/src/block/square/square.cpp
index f96162c37..2d798c3e8 100644
--- a/src/block/square/square.cpp
+++ b/src/block/square/square.cpp
@@ -152,9 +152,10 @@ void Square::key_schedule(const byte key[], u32bit)
       XEK[4*i+6] = XEK[4*i+2] ^ XEK[4*i+5];
       XEK[4*i+7] = XEK[4*i+3] ^ XEK[4*i+6];
 
-      XDK.copy(28 - 4*i, XEK + 4*(i+1), 4);
+      for(u32bit j = 0; j != 4; ++j)
+         XDK[28 - 4*i + j] = XEK[4*(i+1)+j];
 
-      transform(XEK + 4*i);
+      transform(&XEK[4*i]);
       }
 
    for(u32bit i = 0; i != 4; ++i)
@@ -166,8 +167,8 @@ void Square::key_schedule(const byte key[], u32bit)
          MD[4*i+j+16] = get_byte(j, XEK[i   ]);
          }
 
-   EK.copy(XEK + 4, 28);
-   DK.copy(XDK + 4, 28);
+   EK.copy(&XEK[4], 28);
+   DK.copy(&XDK[4], 28);
    }
 
 /*
diff --git a/src/block/xtea_simd/xtea_simd.cpp b/src/block/xtea_simd/xtea_simd.cpp
index 794533d5e..b1c19aca3 100644
--- a/src/block/xtea_simd/xtea_simd.cpp
+++ b/src/block/xtea_simd/xtea_simd.cpp
@@ -94,9 +94,11 @@ void xtea_decrypt_8(const byte in[64], byte out[64], const u32bit EK[64])
 */
 void XTEA_SIMD::encrypt_n(const byte in[], byte out[], u32bit blocks) const
    {
+   const u32bit* KS = &(this->get_EK()[0]);
+
    while(blocks >= 8)
       {
-      xtea_encrypt_8(in, out, this->get_EK());
+      xtea_encrypt_8(in, out, KS);
       in += 8 * BLOCK_SIZE;
       out += 8 * BLOCK_SIZE;
       blocks -= 8;
@@ -111,9 +113,11 @@ void XTEA_SIMD::encrypt_n(const byte in[], byte out[], u32bit blocks) const
 */
 void XTEA_SIMD::decrypt_n(const byte in[], byte out[], u32bit blocks) const
    {
+   const u32bit* KS = &(this->get_EK()[0]);
+
    while(blocks >= 8)
       {
-      xtea_decrypt_8(in, out, this->get_EK());
+      xtea_decrypt_8(in, out, KS);
       in += 8 * BLOCK_SIZE;
       out += 8 * BLOCK_SIZE;
       blocks -= 8;
diff --git a/src/cert/x509/crl_ent.cpp b/src/cert/x509/crl_ent.cpp
index 42a742ebb..807e99ac9 100644
--- a/src/cert/x509/crl_ent.cpp
+++ b/src/cert/x509/crl_ent.cpp
@@ -75,7 +75,7 @@ void CRL_Entry::encode_into(DER_Encoder& der) const
    extensions.add(new Cert_Extension::CRL_ReasonCode(reason));
 
    der.start_cons(SEQUENCE)
-         .encode(BigInt::decode(serial, serial.size()))
+      .encode(BigInt::decode(serial))
          .encode(time)
          .encode(extensions)
       .end_cons();
diff --git a/src/constructs/cryptobox/cryptobox.cpp b/src/constructs/cryptobox/cryptobox.cpp
index 0c37949bc..eadc8d1cc 100644
--- a/src/constructs/cryptobox/cryptobox.cpp
+++ b/src/constructs/cryptobox/cryptobox.cpp
@@ -87,10 +87,10 @@ std::string encrypt(const byte input[], u32bit input_len,
    for(u32bit i = 0; i != VERSION_CODE_LEN; ++i)
      out_buf[i] = get_byte(i, CRYPTOBOX_VERSION_CODE);
 
-   out_buf.copy(VERSION_CODE_LEN, pbkdf_salt, PBKDF_SALT_LEN);
+   out_buf.copy(VERSION_CODE_LEN, &pbkdf_salt[0], PBKDF_SALT_LEN);
 
-   pipe.read(out_buf + VERSION_CODE_LEN + PBKDF_SALT_LEN, MAC_OUTPUT_LEN, 1);
-   pipe.read(out_buf + VERSION_CODE_LEN + PBKDF_SALT_LEN + MAC_OUTPUT_LEN,
+   pipe.read(&out_buf[VERSION_CODE_LEN + PBKDF_SALT_LEN], MAC_OUTPUT_LEN, 1);
+   pipe.read(&out_buf[VERSION_CODE_LEN + PBKDF_SALT_LEN + MAC_OUTPUT_LEN],
              ciphertext_len, 0);
 
    return PEM_Code::encode(out_buf, "BOTAN CRYPTOBOX MESSAGE");
@@ -111,15 +111,15 @@ std::string decrypt(const byte input[], u32bit input_len,
       if(ciphertext[i] != get_byte(i, CRYPTOBOX_VERSION_CODE))
          throw Decoding_Error("Bad CryptoBox version");
 
-   SecureVector<byte> pbkdf_salt(ciphertext + VERSION_CODE_LEN, PBKDF_SALT_LEN);
+   const byte* pbkdf_salt = &ciphertext[VERSION_CODE_LEN];
 
    PKCS5_PBKDF2 pbkdf(new HMAC(new SHA_512));
 
    OctetString master_key = pbkdf.derive_key(
       PBKDF_OUTPUT_LEN,
       passphrase,
-      &pbkdf_salt[0],
-      pbkdf_salt.size(),
+      pbkdf_salt,
+      PBKDF_SALT_LEN,
       PBKDF_ITERATIONS);
 
    const byte* mk = master_key.begin();
@@ -136,13 +136,14 @@ std::string decrypt(const byte input[], u32bit input_len,
    const u32bit ciphertext_offset =
       VERSION_CODE_LEN + PBKDF_SALT_LEN + MAC_OUTPUT_LEN;
 
-   pipe.process_msg(ciphertext + ciphertext_offset,
+   pipe.process_msg(&ciphertext[ciphertext_offset],
                     ciphertext.size() - ciphertext_offset);
 
    byte computed_mac[MAC_OUTPUT_LEN];
    pipe.read(computed_mac, MAC_OUTPUT_LEN, 1);
 
-   if(!same_mem(computed_mac, ciphertext + VERSION_CODE_LEN + PBKDF_SALT_LEN,
+   if(!same_mem(computed_mac,
+                &ciphertext[VERSION_CODE_LEN + PBKDF_SALT_LEN],
                 MAC_OUTPUT_LEN))
       throw Decoding_Error("CryptoBox integrity failure");
 
diff --git a/src/constructs/tss/tss.cpp b/src/constructs/tss/tss.cpp
index 1ae027a78..49ee4ddb3 100644
--- a/src/constructs/tss/tss.cpp
+++ b/src/constructs/tss/tss.cpp
@@ -250,7 +250,8 @@ RTSS_Share::reconstruct(const std::vector<RTSS_Share>& shares)
    hash->update(secret, secret_len);
    SecureVector<byte> hash_check = hash->final();
 
-   if(!same_mem(&hash_check[0], secret + secret_len, hash->OUTPUT_LENGTH))
+   if(!same_mem(&hash_check[0],
+                &secret[secret_len], hash->OUTPUT_LENGTH))
       throw Decoding_Error("RTSS hash check failed");
 
    return SecureVector<byte>(secret, secret_len);
diff --git a/src/entropy/unix_procs/es_unix.cpp b/src/entropy/unix_procs/es_unix.cpp
index 8c6e097c7..b96b740e9 100644
--- a/src/entropy/unix_procs/es_unix.cpp
+++ b/src/entropy/unix_procs/es_unix.cpp
@@ -103,7 +103,7 @@ void Unix_EntropySource::poll(Entropy_Accumulator& accum)
 
       while(!pipe.end_of_data())
          {
-         u32bit got_this_loop = pipe.read(io_buffer, io_buffer.size());
+         u32bit got_this_loop = pipe.read(&io_buffer[0], io_buffer.size());
          got_from_src += got_this_loop;
 
          accum.add(&io_buffer[0], got_this_loop, .005);
diff --git a/src/filters/data_src.cpp b/src/filters/data_src.cpp
index 073be3f47..2ca96ac6e 100644
--- a/src/filters/data_src.cpp
+++ b/src/filters/data_src.cpp
@@ -47,7 +47,7 @@ u32bit DataSource::discard_next(u32bit n)
 u32bit DataSource_Memory::read(byte out[], u32bit length)
    {
    u32bit got = std::min(source.size() - offset, length);
-   copy_mem(out, source + offset, got);
+   copy_mem(out, &source[offset], got);
    offset += got;
    return got;
    }
@@ -62,7 +62,7 @@ u32bit DataSource_Memory::peek(byte out[], u32bit length,
    if(peek_offset >= bytes_left) return 0;
 
    u32bit got = std::min(bytes_left - peek_offset, length);
-   copy_mem(out, source + offset + peek_offset, got);
+   copy_mem(out, &source[offset + peek_offset], got);
    return got;
    }
 
diff --git a/src/filters/fd_unix/fd_unix.cpp b/src/filters/fd_unix/fd_unix.cpp
index 7f19b0aeb..d2b3530a3 100644
--- a/src/filters/fd_unix/fd_unix.cpp
+++ b/src/filters/fd_unix/fd_unix.cpp
@@ -19,11 +19,11 @@ int operator<<(int fd, Pipe& pipe)
    SecureVector<byte> buffer(DEFAULT_BUFFERSIZE);
    while(pipe.remaining())
       {
-      u32bit got = pipe.read(buffer, buffer.size());
+      u32bit got = pipe.read(&buffer[0], buffer.size());
       u32bit position = 0;
       while(got)
          {
-         ssize_t ret = write(fd, buffer + position, got);
+         ssize_t ret = write(fd, &buffer[position], got);
          if(ret == -1)
             throw Stream_IO_Error("Pipe output operator (unixfd) has failed");
          position += ret;
@@ -41,11 +41,11 @@ int operator>>(int fd, Pipe& pipe)
    SecureVector<byte> buffer(DEFAULT_BUFFERSIZE);
    while(true)
       {
-      ssize_t ret = read(fd, buffer, buffer.size());
+      ssize_t ret = read(fd, &buffer[0], buffer.size());
       if(ret == 0) break;
       if(ret == -1)
          throw Stream_IO_Error("Pipe input operator (unixfd) has failed");
-      pipe.write(buffer, ret);
+      pipe.write(&buffer[0], ret);
       }
    return fd;
    }
diff --git a/src/filters/hex_filt/hex_filt.cpp b/src/filters/hex_filt/hex_filt.cpp
index 0f3daa464..441598946 100644
--- a/src/filters/hex_filt/hex_filt.cpp
+++ b/src/filters/hex_filt/hex_filt.cpp
@@ -57,7 +57,7 @@ void Hex_Encoder::encode_and_send(const byte block[], u32bit length)
       while(remaining)
          {
          u32bit sent = std::min(line_length - counter, remaining);
-         send(out + offset, sent);
+         send(&out[offset], sent);
          counter += sent;
          remaining -= sent;
          offset += sent;
@@ -78,7 +78,7 @@ void Hex_Encoder::write(const byte input[], u32bit length)
    in.copy(position, input, length);
    if(position + length >= in.size())
       {
-      encode_and_send(in, in.size());
+      encode_and_send(&in[0], in.size());
       input += (in.size() - position);
       length -= (in.size() - position);
       while(length >= in.size())
@@ -98,7 +98,7 @@ void Hex_Encoder::write(const byte input[], u32bit length)
 */
 void Hex_Encoder::end_msg()
    {
-   encode_and_send(in, position);
+   encode_and_send(&in[0], position);
    if(counter && line_length)
       send('\n');
    counter = position = 0;
diff --git a/src/filters/pipe_rw.cpp b/src/filters/pipe_rw.cpp
index ebbfb101a..937262e26 100644
--- a/src/filters/pipe_rw.cpp
+++ b/src/filters/pipe_rw.cpp
@@ -70,8 +70,8 @@ void Pipe::write(DataSource& source)
    SecureVector<byte> buffer(DEFAULT_BUFFERSIZE);
    while(!source.end_of_data())
       {
-      u32bit got = source.read(buffer, buffer.size());
-      write(buffer, got);
+      u32bit got = source.read(&buffer[0], buffer.size());
+      write(&buffer[0], got);
       }
    }
 
@@ -106,7 +106,8 @@ SecureVector<byte> Pipe::read_all(message_id msg)
    {
    msg = ((msg != DEFAULT_MESSAGE) ? msg : default_msg());
    SecureVector<byte> buffer(remaining(msg));
-   read(buffer, buffer.size(), msg);
+   u32bit got = read(&buffer[0], buffer.size(), msg);
+   buffer.resize(got);
    return buffer;
    }
 
@@ -122,7 +123,7 @@ std::string Pipe::read_all_as_string(message_id msg)
 
    while(true)
       {
-      u32bit got = read(buffer, buffer.size(), msg);
+      u32bit got = read(&buffer[0], buffer.size(), msg);
       if(got == 0)
          break;
       str.append(reinterpret_cast<const char*>(&buffer[0]), got);
diff --git a/src/hash/mdx_hash/mdx_hash.cpp b/src/hash/mdx_hash/mdx_hash.cpp
index 69341c53f..560832542 100644
--- a/src/hash/mdx_hash/mdx_hash.cpp
+++ b/src/hash/mdx_hash/mdx_hash.cpp
@@ -75,13 +75,13 @@ void MDx_HashFunction::final_result(byte output[])
 
    if(position >= HASH_BLOCK_SIZE - COUNT_SIZE)
       {
-      compress_n(buffer, 1);
+      compress_n(&buffer[0], 1);
       zeroise(buffer);
       }
 
-   write_count(buffer + HASH_BLOCK_SIZE - COUNT_SIZE);
+   write_count(&buffer[HASH_BLOCK_SIZE - COUNT_SIZE]);
 
-   compress_n(buffer, 1);
+   compress_n(&buffer[0], 1);
    copy_out(output);
    clear();
    }
diff --git a/src/hash/sha1_amd64/sha1_amd64.cpp b/src/hash/sha1_amd64/sha1_amd64.cpp
index 0efbd8559..885853182 100644
--- a/src/hash/sha1_amd64/sha1_amd64.cpp
+++ b/src/hash/sha1_amd64/sha1_amd64.cpp
@@ -23,7 +23,7 @@ void SHA_160_AMD64::compress_n(const byte input[], u32bit blocks)
    {
    for(u32bit i = 0; i != blocks; ++i)
       {
-      botan_sha160_amd64_compress(digest, input, W);
+      botan_sha160_amd64_compress(&digest[0], input, &W[0]);
       input += HASH_BLOCK_SIZE;
       }
    }
diff --git a/src/hash/sha1_ia32/sha1_ia32.cpp b/src/hash/sha1_ia32/sha1_ia32.cpp
index 6eecdab56..611cc1961 100644
--- a/src/hash/sha1_ia32/sha1_ia32.cpp
+++ b/src/hash/sha1_ia32/sha1_ia32.cpp
@@ -23,7 +23,7 @@ void SHA_160_IA32::compress_n(const byte input[], u32bit blocks)
    {
    for(u32bit i = 0; i != blocks; ++i)
       {
-      botan_sha160_ia32_compress(digest, input, W);
+      botan_sha160_ia32_compress(&digest[0], input, &W[0]);
       input += HASH_BLOCK_SIZE;
       }
    }
diff --git a/src/hash/skein/skein_512.cpp b/src/hash/skein/skein_512.cpp
index dabaa5da2..5aa49ab7a 100644
--- a/src/hash/skein/skein_512.cpp
+++ b/src/hash/skein/skein_512.cpp
@@ -27,7 +27,9 @@ enum type_code {
    SKEIN_OUTPUT = 63
 };
 
-void ubi_512(u64bit H[9], u64bit T[], const byte msg[], u32bit msg_len)
+void ubi_512(MemoryRegion<u64bit>& H,
+             MemoryRegion<u64bit>& T,
+             const byte msg[], u32bit msg_len)
    {
    do
       {
@@ -122,16 +124,19 @@ void ubi_512(u64bit H[9], u64bit T[], const byte msg[], u32bit msg_len)
       } while(msg_len);
    }
 
-void reset_tweak(u64bit T[3], type_code type, bool final)
+void reset_tweak(MemoryRegion<u64bit>& T,
+                 type_code type, bool final)
    {
    T[0] = 0;
    T[1] = ((u64bit)type << 56) | ((u64bit)1 << 62) | ((u64bit)final << 63);
    }
 
-void initial_block(u64bit H[9], u64bit T[3], u32bit output_bits,
+void initial_block(MemoryRegion<u64bit>& H,
+                   MemoryRegion<u64bit>& T,
+                   u32bit output_bits,
                    const std::string& personalization)
    {
-   clear_mem(H, 9);
+   zeroise(H);
 
    // ASCII("SHA3") followed by version (0x0001) code
    byte config_str[32] = { 0x53, 0x48, 0x41, 0x33, 0x01, 0x00, 0 };
diff --git a/src/hash/tiger/tiger.cpp b/src/hash/tiger/tiger.cpp
index dd41841c9..d931324e0 100644
--- a/src/hash/tiger/tiger.cpp
+++ b/src/hash/tiger/tiger.cpp
@@ -17,14 +17,25 @@ namespace {
 /*
 * Tiger Mixing Function
 */
-inline void mix(u64bit X[8])
+inline void mix(MemoryRegion<u64bit>& X)
    {
-   X[0] -= X[7] ^ 0xA5A5A5A5A5A5A5A5; X[1] ^= X[0];
-   X[2] += X[1]; X[3] -= X[2] ^ ((~X[1]) << 19); X[4] ^= X[3];
-   X[5] += X[4]; X[6] -= X[5] ^ ((~X[4]) >> 23); X[7] ^= X[6];
-   X[0] += X[7]; X[1] -= X[0] ^ ((~X[7]) << 19); X[2] ^= X[1];
-   X[3] += X[2]; X[4] -= X[3] ^ ((~X[2]) >> 23); X[5] ^= X[4];
-   X[6] += X[5]; X[7] -= X[6] ^ 0x0123456789ABCDEF;
+   X[0] -= X[7] ^ 0xA5A5A5A5A5A5A5A5;
+   X[1] ^= X[0];
+   X[2] += X[1];
+   X[3] -= X[2] ^ ((~X[1]) << 19);
+   X[4] ^= X[3];
+   X[5] += X[4];
+   X[6] -= X[5] ^ ((~X[4]) >> 23);
+   X[7] ^= X[6];
+
+   X[0] += X[7];
+   X[1] -= X[0] ^ ((~X[7]) << 19);
+   X[2] ^= X[1];
+   X[3] += X[2];
+   X[4] -= X[3] ^ ((~X[2]) >> 23);
+   X[5] ^= X[4];
+   X[6] += X[5];
+   X[7] -= X[6] ^ 0x0123456789ABCDEF;
    }
 
 }
@@ -71,7 +82,9 @@ void Tiger::copy_out(byte output[])
 /*
 * Tiger Pass
 */
-void Tiger::pass(u64bit& A, u64bit& B, u64bit& C, u64bit X[8], byte mul)
+void Tiger::pass(u64bit& A, u64bit& B, u64bit& C,
+                 const MemoryRegion<u64bit>& X,
+                 byte mul)
    {
    C ^= X[0];
    A -= SBOX1[get_byte(7, C)] ^ SBOX2[get_byte(5, C)] ^
diff --git a/src/hash/tiger/tiger.h b/src/hash/tiger/tiger.h
index 380f6eb24..94665b902 100644
--- a/src/hash/tiger/tiger.h
+++ b/src/hash/tiger/tiger.h
@@ -35,7 +35,9 @@ class BOTAN_DLL Tiger : public MDx_HashFunction
       void compress_n(const byte[], u32bit block);
       void copy_out(byte[]);
 
-      static void pass(u64bit&, u64bit&, u64bit&, u64bit[8], byte);
+      static void pass(u64bit& A, u64bit& B, u64bit& C,
+                       const MemoryRegion<u64bit>& M,
+                       byte mul);
 
       static const u64bit SBOX1[256];
       static const u64bit SBOX2[256];
diff --git a/src/kdf/kdf.cpp b/src/kdf/kdf.cpp
index 86f5f2476..04f44f2f4 100644
--- a/src/kdf/kdf.cpp
+++ b/src/kdf/kdf.cpp
@@ -16,7 +16,7 @@ SecureVector<byte> KDF::derive_key(u32bit key_len,
                                    const MemoryRegion<byte>& secret,
                                    const std::string& salt) const
    {
-   return derive_key(key_len, secret, secret.size(),
+   return derive_key(key_len, &secret[0], secret.size(),
                      reinterpret_cast<const byte*>(salt.data()),
                      salt.length());
    }
diff --git a/src/pk_pad/eme.cpp b/src/pk_pad/eme.cpp
index 74bba5ac1..320f19034 100644
--- a/src/pk_pad/eme.cpp
+++ b/src/pk_pad/eme.cpp
@@ -26,7 +26,7 @@ SecureVector<byte> EME::encode(const MemoryRegion<byte>& msg,
                                u32bit key_bits,
                                RandomNumberGenerator& rng) const
    {
-   return pad(msg, msg.size(), key_bits, rng);
+   return pad(&msg[0], msg.size(), key_bits, rng);
    }
 
 /*
@@ -44,7 +44,7 @@ SecureVector<byte> EME::decode(const byte msg[], u32bit msg_len,
 SecureVector<byte> EME::decode(const MemoryRegion<byte>& msg,
                                u32bit key_bits) const
    {
-   return unpad(msg, msg.size(), key_bits);
+   return unpad(&msg[0], msg.size(), key_bits);
    }
 
 }
diff --git a/src/pk_pad/eme1/eme1.cpp b/src/pk_pad/eme1/eme1.cpp
index b695fc2c4..4352231c9 100644
--- a/src/pk_pad/eme1/eme1.cpp
+++ b/src/pk_pad/eme1/eme1.cpp
@@ -28,11 +28,15 @@ SecureVector<byte> EME1::pad(const byte in[], u32bit in_length,
 
    rng.randomize(&out[0], HASH_LENGTH);
 
-   out.copy(HASH_LENGTH, Phash, Phash.size());
+   out.copy(HASH_LENGTH, &Phash[0], Phash.size());
    out[out.size() - in_length - 1] = 0x01;
    out.copy(out.size() - in_length, in, in_length);
-   mgf->mask(out, HASH_LENGTH, out + HASH_LENGTH, out.size() - HASH_LENGTH);
-   mgf->mask(out + HASH_LENGTH, out.size() - HASH_LENGTH, out, HASH_LENGTH);
+
+   mgf->mask(&out[0], HASH_LENGTH,
+             &out[HASH_LENGTH], out.size() - HASH_LENGTH);
+
+   mgf->mask(&out[HASH_LENGTH], out.size() - HASH_LENGTH,
+             &out[0], HASH_LENGTH);
 
    return out;
    }
@@ -64,8 +68,10 @@ SecureVector<byte> EME1::unpad(const byte in[], u32bit in_length,
    SecureVector<byte> tmp(key_length);
    tmp.copy(key_length - in_length, in, in_length);
 
-   mgf->mask(tmp + HASH_LENGTH, tmp.size() - HASH_LENGTH, tmp, HASH_LENGTH);
-   mgf->mask(tmp, HASH_LENGTH, tmp + HASH_LENGTH, tmp.size() - HASH_LENGTH);
+   mgf->mask(&tmp[HASH_LENGTH], tmp.size() - HASH_LENGTH,
+             &tmp[0], HASH_LENGTH);
+   mgf->mask(&tmp[0], HASH_LENGTH,
+             &tmp[HASH_LENGTH], tmp.size() - HASH_LENGTH);
 
    const bool phash_ok = same_mem(&tmp[HASH_LENGTH], &Phash[0], Phash.size());
 
@@ -86,7 +92,7 @@ SecureVector<byte> EME1::unpad(const byte in[], u32bit in_length,
 
    if(delim_idx && delim_ok && phash_ok)
       {
-      return SecureVector<byte>(tmp + delim_idx + 1,
+      return SecureVector<byte>(&tmp[delim_idx + 1],
                                 tmp.size() - delim_idx - 1);
       }
 
diff --git a/src/pk_pad/emsa2/emsa2.cpp b/src/pk_pad/emsa2/emsa2.cpp
index 74a045931..fe337a80b 100644
--- a/src/pk_pad/emsa2/emsa2.cpp
+++ b/src/pk_pad/emsa2/emsa2.cpp
@@ -38,8 +38,8 @@ SecureVector<byte> emsa2_encoding(const MemoryRegion<byte>& msg,
 
    output[0] = (empty ? 0x4B : 0x6B);
    output[output_length - 3 - HASH_SIZE] = 0xBA;
-   set_mem(output + 1, output_length - 4 - HASH_SIZE, 0xBB);
-   output.copy(output_length - (HASH_SIZE + 2), msg, msg.size());
+   set_mem(&output[1], output_length - 4 - HASH_SIZE, 0xBB);
+   output.copy(output_length - (HASH_SIZE + 2), &msg[0], msg.size());
    output[output_length-2] = hash_id;
    output[output_length-1] = 0xCC;
 
diff --git a/src/pk_pad/emsa3/emsa3.cpp b/src/pk_pad/emsa3/emsa3.cpp
index aa1b85f05..21ef072ef 100644
--- a/src/pk_pad/emsa3/emsa3.cpp
+++ b/src/pk_pad/emsa3/emsa3.cpp
@@ -28,10 +28,10 @@ SecureVector<byte> emsa3_encoding(const MemoryRegion<byte>& msg,
    const u32bit P_LENGTH = output_length - msg.size() - hash_id_length - 2;
 
    T[0] = 0x01;
-   set_mem(T+1, P_LENGTH, 0xFF);
+   set_mem(&T[1], P_LENGTH, 0xFF);
    T[P_LENGTH+1] = 0x00;
    T.copy(P_LENGTH+2, hash_id, hash_id_length);
-   T.copy(output_length-msg.size(), msg, msg.size());
+   T.copy(output_length-msg.size(), &msg[0], msg.size());
    return T;
    }
 
@@ -64,7 +64,7 @@ SecureVector<byte> EMSA3::encoding_of(const MemoryRegion<byte>& msg,
       throw Encoding_Error("EMSA3::encoding_of: Bad input length");
 
    return emsa3_encoding(msg, output_bits,
-                         hash_id, hash_id.size());
+                         &hash_id[0], hash_id.size());
    }
 
 /*
@@ -80,7 +80,7 @@ bool EMSA3::verify(const MemoryRegion<byte>& coded,
    try
       {
       return (coded == emsa3_encoding(raw, key_bits,
-                                      hash_id, hash_id.size()));
+                                      &hash_id[0], hash_id.size()));
       }
    catch(...)
       {
diff --git a/src/pubkey/elgamal/elgamal.cpp b/src/pubkey/elgamal/elgamal.cpp
index a264d209b..58336b1b1 100644
--- a/src/pubkey/elgamal/elgamal.cpp
+++ b/src/pubkey/elgamal/elgamal.cpp
@@ -93,8 +93,8 @@ ElGamal_Encryption_Operation::encrypt(const byte msg[], u32bit msg_len,
    BigInt b = mod_p.multiply(m, powermod_y_p(k));
 
    SecureVector<byte> output(2*p.bytes());
-   a.binary_encode(output + (p.bytes() - a.bytes()));
-   b.binary_encode(output + output.size() / 2 + (p.bytes() - b.bytes()));
+   a.binary_encode(&output[p.bytes() - a.bytes()]);
+   b.binary_encode(&output[output.size() / 2 + (p.bytes() - b.bytes())]);
    return output;
    }
 
diff --git a/src/pubkey/gost_3410/gost_3410.cpp b/src/pubkey/gost_3410/gost_3410.cpp
index 74b39d50b..1cff9e081 100644
--- a/src/pubkey/gost_3410/gost_3410.cpp
+++ b/src/pubkey/gost_3410/gost_3410.cpp
@@ -23,8 +23,8 @@ MemoryVector<byte> GOST_3410_PublicKey::x509_subject_public_key() const
 
    MemoryVector<byte> bits(2*part_size);
 
-   x.binary_encode(bits + (part_size - x.bytes()));
-   y.binary_encode(bits + (2*part_size - y.bytes()));
+   x.binary_encode(&bits[part_size - x.bytes()]);
+   y.binary_encode(&bits[2*part_size - y.bytes()]);
 
    // Keys are stored in little endian format (WTF)
    for(u32bit i = 0; i != part_size / 2; ++i)
@@ -69,8 +69,8 @@ GOST_3410_PublicKey::GOST_3410_PublicKey(const AlgorithmIdentifier& alg_id,
       std::swap(bits[part_size+i], bits[2*part_size-1-i]);
       }
 
-   BigInt x(bits, part_size);
-   BigInt y(bits + part_size, part_size);
+   BigInt x(&bits[0], part_size);
+   BigInt y(&bits[part_size], part_size);
 
    public_key = PointGFp(domain().get_curve(), x, y);
 
@@ -87,7 +87,7 @@ BigInt decode_le(const byte msg[], u32bit msg_len)
    for(size_t i = 0; i != msg_le.size() / 2; ++i)
       std::swap(msg_le[i], msg_le[msg_le.size()-1-i]);
 
-   return BigInt(msg_le, msg_le.size());
+   return BigInt(&msg_le[0], msg_le.size());
    }
 
 }
@@ -129,8 +129,8 @@ GOST_3410_Signature_Operation::sign(const byte msg[], u32bit msg_len,
       throw Invalid_State("GOST 34.10: r == 0 || s == 0");
 
    SecureVector<byte> output(2*order.bytes());
-   r.binary_encode(output + (output.size() / 2 - r.bytes()));
-   s.binary_encode(output + (output.size() - s.bytes()));
+   r.binary_encode(&output[output.size() / 2 - r.bytes()]);
+   s.binary_encode(&output[output.size() - s.bytes()]);
    return output;
    }
 
diff --git a/src/pubkey/pubkey.cpp b/src/pubkey/pubkey.cpp
index c8ffccf53..dc91ca908 100644
--- a/src/pubkey/pubkey.cpp
+++ b/src/pubkey/pubkey.cpp
@@ -57,7 +57,7 @@ PK_Encryptor_EME::enc(const byte msg[],
    if(8*(message.size() - 1) + high_bit(message[0]) > op->max_input_bits())
       throw Invalid_Argument("PK_Encryptor_EME: Input is too large");
 
-   return op->encrypt(message, message.size(), rng);
+   return op->encrypt(&message[0], message.size(), rng);
    }
 
 /*
@@ -201,7 +201,7 @@ SecureVector<byte> PK_Signer::signature(RandomNumberGenerator& rng)
                                                   op->max_input_bits(),
                                                   rng);
 
-   SecureVector<byte> plain_sig = op->sign(encoded, encoded.size(), rng);
+   SecureVector<byte> plain_sig = op->sign(&encoded[0], encoded.size(), rng);
 
    if(verify_op && !self_test_signature(encoded, plain_sig))
       throw Internal_Error("PK_Signer consistency check failed");
@@ -217,7 +217,7 @@ SecureVector<byte> PK_Signer::signature(RandomNumberGenerator& rng)
 
       std::vector<BigInt> sig_parts(op->message_parts());
       for(u32bit j = 0; j != sig_parts.size(); ++j)
-         sig_parts[j].binary_decode(plain_sig + SIZE_OF_PART*j, SIZE_OF_PART);
+         sig_parts[j].binary_decode(&plain_sig[SIZE_OF_PART*j], SIZE_OF_PART);
 
       return DER_Encoder()
          .start_cons(SEQUENCE)
@@ -310,7 +310,7 @@ bool PK_Verifier::check_signature(const byte sig[], u32bit length)
             throw Decoding_Error("PK_Verifier: signature size invalid");
 
          return validate_signature(emsa->raw_data(),
-                                   real_sig, real_sig.size());
+                                   &real_sig[0], real_sig.size());
          }
       else
          throw Decoding_Error("PK_Verifier: Unknown signature format " +
@@ -337,7 +337,7 @@ bool PK_Verifier::validate_signature(const MemoryRegion<byte>& msg,
       SecureVector<byte> encoded =
          emsa->encoding_of(msg, op->max_input_bits(), rng);
 
-      return op->verify(encoded, encoded.size(), sig, sig_len);
+      return op->verify(&encoded[0], encoded.size(), sig, sig_len);
       }
    }
 
diff --git a/src/stream/ctr/ctr.cpp b/src/stream/ctr/ctr.cpp
index 6162a76a0..66af28a15 100644
--- a/src/stream/ctr/ctr.cpp
+++ b/src/stream/ctr/ctr.cpp
@@ -121,7 +121,7 @@ void CTR_BE::increment_counter()
 
    for(u32bit i = 0; i != PARALLEL_BLOCKS; ++i)
       {
-      byte* this_ctr = counter + i*permutation->BLOCK_SIZE;
+      byte* this_ctr = &counter[i * permutation->BLOCK_SIZE];
 
       byte last_byte = this_ctr[permutation->BLOCK_SIZE-1];
       last_byte += PARALLEL_BLOCKS;
diff --git a/src/stream/salsa20/salsa20.cpp b/src/stream/salsa20/salsa20.cpp
index c52e305d1..58626fb2f 100644
--- a/src/stream/salsa20/salsa20.cpp
+++ b/src/stream/salsa20/salsa20.cpp
@@ -109,7 +109,7 @@ void Salsa20::cipher(const byte in[], byte out[], u32bit length)
       length -= (buffer.size() - position);
       in += (buffer.size() - position);
       out += (buffer.size() - position);
-      salsa20(&buffer[0], state);
+      salsa20(&buffer[0], &state[0]);
 
       ++state[8];
       if(!state[8]) // if overflow in state[8]
@@ -194,7 +194,7 @@ void Salsa20::set_iv(const byte iv[], u32bit length)
       state[9] = load_le<u32bit>(iv, 3);
 
       SecureVector<u32bit> hsalsa(8);
-      hsalsa20(hsalsa, state);
+      hsalsa20(&hsalsa[0], &state[0]);
 
       state[ 1] = hsalsa[0];
       state[ 2] = hsalsa[1];
@@ -211,7 +211,7 @@ void Salsa20::set_iv(const byte iv[], u32bit length)
    state[8] = 0;
    state[9] = 0;
 
-   salsa20(&buffer[0], state);
+   salsa20(&buffer[0], &state[0]);
    ++state[8];
    if(!state[8]) // if overflow in state[8]
       ++state[9]; // carry to state[9]
diff --git a/src/stream/turing/turing.cpp b/src/stream/turing/turing.cpp
index c53b666ad..9fa38d863 100644
--- a/src/stream/turing/turing.cpp
+++ b/src/stream/turing/turing.cpp
@@ -17,17 +17,17 @@ namespace {
 /*
 * Perform an N-way PHT
 */
-inline void PHT(u32bit buf[], u32bit buf_size)
+inline void PHT(MemoryRegion<u32bit>& B)
    {
    u32bit sum = 0;
-   for(u32bit i = 0; i < buf_size - 1; ++i)
-      sum += buf[i];
+   for(u32bit i = 0; i < B.size() - 1; ++i)
+      sum += B[i];
 
-   buf[buf_size-1] += sum;
+   B[B.size()-1] += sum;
 
-   sum = buf[buf_size-1];
-   for(u32bit i = 0; i < buf_size - 1; ++i)
-      buf[i] += sum;
+   sum = B[B.size()-1];
+   for(u32bit i = 0; i < B.size() - 1; ++i)
+      B[i] += sum;
    }
 
 }
@@ -195,11 +195,11 @@ void Turing::generate()
       C += R9;
       D += R5;
 
-      store_be(A, buffer + 20*j + 0);
-      store_be(B, buffer + 20*j + 4);
-      store_be(C, buffer + 20*j + 8);
-      store_be(D, buffer + 20*j + 12);
-      store_be(E, buffer + 20*j + 16);
+      store_be(A, &buffer[20*j + 0]);
+      store_be(B, &buffer[20*j + 4]);
+      store_be(C, &buffer[20*j + 8]);
+      store_be(D, &buffer[20*j + 12]);
+      store_be(E, &buffer[20*j + 16]);
       }
 
    position = 0;
@@ -232,7 +232,7 @@ void Turing::key_schedule(const byte key[], u32bit length)
    for(u32bit j = 0; j != K.size(); ++j)
       K[j] = fixedS(K[j]);
 
-   PHT(K, K.size());
+   PHT(K);
 
    for(u32bit i = 0; i != 256; ++i)
       {
@@ -290,7 +290,7 @@ void Turing::set_iv(const byte iv[], u32bit length)
              S2[get_byte(2, W)] ^ S3[get_byte(3, W)];
       }
 
-   PHT(R, 17);
+   PHT(R);
 
    generate();
    }
diff --git a/src/stream/wid_wake/wid_wake.cpp b/src/stream/wid_wake/wid_wake.cpp
index f5897f1cc..17b0df557 100644
--- a/src/stream/wid_wake/wid_wake.cpp
+++ b/src/stream/wid_wake/wid_wake.cpp
@@ -18,13 +18,13 @@ void WiderWake_41_BE::cipher(const byte in[], byte out[], u32bit length)
    {
    while(length >= buffer.size() - position)
       {
-      xor_buf(out, in, buffer + position, buffer.size() - position);
+      xor_buf(out, in, &buffer[position], buffer.size() - position);
       length -= (buffer.size() - position);
       in += (buffer.size() - position);
       out += (buffer.size() - position);
       generate(buffer.size());
       }
-   xor_buf(out, in, buffer + position, length);
+   xor_buf(out, in, &buffer[position], length);
    position += length;
    }
 
@@ -41,7 +41,7 @@ void WiderWake_41_BE::generate(u32bit length)
       {
       u32bit R0a;
 
-      store_be(R3, buffer + j);
+      store_be(R3, &buffer[j]);
 
       R0a = R4 + R3; R3 += R2; R2 += R1; R1 += R0;
       R0a = (R0a >> 8) ^ T[(R0a & 0xFF)];
@@ -50,7 +50,7 @@ void WiderWake_41_BE::generate(u32bit length)
       R3  = (R3  >> 8) ^ T[(R3  & 0xFF)];
       R4 = R0; R0 = R0a;
 
-      store_be(R3, buffer + j + 4);
+      store_be(R3, &buffer[j + 4]);
 
       R0a = R4 + R3; R3 += R2; R2 += R1; R1 += R0;
       R0a = (R0a >> 8) ^ T[(R0a & 0xFF)];
diff --git a/src/sym_algo/symkey.cpp b/src/sym_algo/symkey.cpp
index 65eb268cb..c7533d256 100644
--- a/src/sym_algo/symkey.cpp
+++ b/src/sym_algo/symkey.cpp
@@ -20,8 +20,7 @@ namespace Botan {
 OctetString::OctetString(RandomNumberGenerator& rng,
                          u32bit length)
    {
-   bits.resize(length);
-   rng.randomize(bits, length);
+   bits = rng.random_vec(length);
    }
 
 /*