Tests

17 files changed, 370 insertions, 349 deletions

diff --git a/checks/aead.cpp b/checks/aead.cpp
index 3cb0fb986..d96e60c84 100644
--- a/checks/aead.cpp
+++ b/checks/aead.cpp
@@ -1,4 +1,4 @@
-#include "validate.h"
+#include "tests.h"
 
 #include <botan/hex.h>
 #include <botan/siv.h>
@@ -65,11 +65,11 @@ bool aead_test(const std::string& algo,
 
 }
 
-void test_aead()
+size_t test_aead()
    {
    std::ifstream vec("checks/aead.vec");
 
-   run_tests_bb(vec, "AEAD", "Ciphertext", true,
+   return run_tests_bb(vec, "AEAD", "Ciphertext", true,
              [](std::map<std::string, std::string> m)
              {
              return aead_test(m["AEAD"], m["Plaintext"], m["Ciphertext"],
diff --git a/checks/check.cpp b/checks/check.cpp
index 6760d91ca..301964424 100644
--- a/checks/check.cpp
+++ b/checks/check.cpp
@@ -31,11 +31,7 @@ using namespace Botan;
 #include "bench.h"
 #include "validate.h"
 #include "common.h"
-
-const std::string VALIDATION_FILE = "checks/validate.dat";
-const std::string BIGINT_VALIDATION_FILE = "checks/mp_valid.dat";
-const std::string PK_VALIDATION_FILE = "checks/pk_valid.dat";
-const std::string EXPECTED_FAIL_FILE = "checks/fail.dat";
+#include "tests.h"
 
 int run_test_suite(RandomNumberGenerator& rng);
 
@@ -224,6 +220,11 @@ int run_test_suite(RandomNumberGenerator& rng)
    u32bit errors = 0;
    try
       {
+      const std::string VALIDATION_FILE = "checks/validate.dat";
+      const std::string BIGINT_VALIDATION_FILE = "checks/mp_valid.dat";
+      const std::string PK_VALIDATION_FILE = "checks/pk_valid.dat";
+      const std::string EXPECTED_FAIL_FILE = "checks/fail.dat";
+
       errors += do_validation_tests(VALIDATION_FILE, rng);
       errors += do_validation_tests(EXPECTED_FAIL_FILE, rng, false);
       errors += do_bigint_tests(BIGINT_VALIDATION_FILE, rng);
@@ -250,6 +251,5 @@ int run_test_suite(RandomNumberGenerator& rng)
       return 1;
       }
 
-   std::cout << "All tests passed!" << std::endl;
    return 0;
    }
diff --git a/checks/cryptobox.cpp b/checks/cryptobox.cpp
new file mode 100644
index 000000000..9a53da74c
--- /dev/null
+++ b/checks/cryptobox.cpp
@@ -0,0 +1,45 @@
+#include "tests.h"
+
+#include <botan/auto_rng.h>
+#include <iostream>
+
+#if defined(BOTAN_HAS_CRYPTO_BOX)
+  #include <botan/cryptobox.h>
+#endif
+
+using namespace Botan;
+
+size_t test_cryptobox()
+   {
+   size_t fails = 0;
+
+#if defined(BOTAN_HAS_CRYPTO_BOX)
+   AutoSeeded_RNG rng;
+
+   const byte msg[] = { 0xAA, 0xBB, 0xCC };
+   std::string ciphertext = CryptoBox::encrypt(msg, sizeof(msg),
+                                               "secret password",
+                                               rng);
+
+   try
+      {
+      std::string plaintext = CryptoBox::decrypt(ciphertext,
+                                                 "secret password");
+
+      if(plaintext.size() != sizeof(msg) ||
+         !same_mem(reinterpret_cast<const byte*>(&plaintext[0]), msg, sizeof(msg)))
+         ++fails;
+
+      }
+   catch(std::exception& e)
+      {
+      std::cout << "Error during Cryptobox test " << e.what() << "\n";
+      ++fails;
+      }
+
+   test_report("Cryptobox", 1, fails);
+#endif
+
+   return fails;
+   }
+
diff --git a/checks/hkdf.cpp b/checks/hkdf.cpp
index e63ff55fa..6e1c33d60 100644
--- a/checks/hkdf.cpp
+++ b/checks/hkdf.cpp
@@ -1,4 +1,4 @@
-#include "validate.h"
+#include "tests.h"
 
 #include <botan/libstate.h>
 #include <botan/hkdf.h>
@@ -56,12 +56,12 @@ bool hkdf_test(const std::string& algo,
 
 }
 
-void test_hkdf()
+size_t test_hkdf()
    {
    // From RFC 5869
    std::ifstream vec("checks/hkdf.vec");
 
-   run_tests_bb(vec, "HKDF", "OKM", true,
+   return run_tests_bb(vec, "HKDF", "OKM", true,
              [](std::map<std::string, std::string> m) -> bool
              {
              return hkdf_test(m["Hash"], m["IKM"], m["salt"], m["info"],
diff --git a/checks/kdf.cpp b/checks/kdf.cpp
index b27162632..60c4eb25f 100644
--- a/checks/kdf.cpp
+++ b/checks/kdf.cpp
@@ -1,6 +1,5 @@
-#include "validate.h"
+#include "tests.h"
 
-#include <botan/libstate.h>
 #include <botan/lookup.h>
 #include <botan/hex.h>
 #include <iostream>
@@ -31,11 +30,11 @@ std::string kdf_test(const std::string& algo,
 
 }
 
-void test_kdf()
+size_t test_kdf()
    {
    std::ifstream vec("checks/kdf.vec");
 
-   run_tests(vec, "KDF", "Output", true,
+   return run_tests(vec, "KDF", "Output", true,
              [](std::map<std::string, std::string> m)
              {
              return kdf_test(m["KDF"], to_u32bit(m["OutputLen"]),
diff --git a/checks/keywrap.cpp b/checks/keywrap.cpp
new file mode 100644
index 000000000..a7dcbfe75
--- /dev/null
+++ b/checks/keywrap.cpp
@@ -0,0 +1,90 @@
+#include "tests.h"
+
+#include <botan/libstate.h>
+#include <botan/hex.h>
+
+#if defined(BOTAN_HAS_RFC3394_KEYWRAP)
+  #include <botan/rfc3394.h>
+#endif
+
+#include <iostream>
+
+using namespace Botan;
+
+namespace {
+
+size_t keywrap_test(const char* key_str,
+                    const char* expected_str,
+                    const char* kek_str)
+   {
+   size_t fail = 0;
+
+#if defined(BOTAN_HAS_RFC3394_KEYWRAP)
+   try
+      {
+      SymmetricKey key(key_str);
+      SymmetricKey expected(expected_str);
+      SymmetricKey kek(kek_str);
+
+      Algorithm_Factory& af = global_state().algorithm_factory();
+
+      secure_vector<byte> enc = rfc3394_keywrap(key.bits_of(), kek, af);
+
+      if(enc != expected.bits_of())
+         {
+         std::cout << "NIST key wrap encryption failure: "
+                   << hex_encode(enc) << " != " << hex_encode(expected.bits_of()) << "\n";
+         fail++;
+         }
+
+      secure_vector<byte> dec = rfc3394_keyunwrap(expected.bits_of(), kek, af);
+
+      if(dec != key.bits_of())
+         {
+         std::cout << "NIST key wrap decryption failure: "
+                   << hex_encode(dec) << " != " << hex_encode(key.bits_of()) << "\n";
+         fail++;
+         }
+      }
+   catch(std::exception& e)
+      {
+      std::cout << e.what() << "\n";
+      fail++;
+      }
+#endif
+
+   return fail;
+   }
+
+}
+
+size_t test_keywrap()
+   {
+   size_t fails = 0;
+
+   fails += keywrap_test("00112233445566778899AABBCCDDEEFF",
+                         "1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5",
+                         "000102030405060708090A0B0C0D0E0F");
+
+   fails += keywrap_test("00112233445566778899AABBCCDDEEFF",
+                         "96778B25AE6CA435F92B5B97C050AED2468AB8A17AD84E5D",
+                         "000102030405060708090A0B0C0D0E0F1011121314151617");
+
+   fails += keywrap_test("00112233445566778899AABBCCDDEEFF",
+                         "64E8C3F9CE0F5BA263E9777905818A2A93C8191E7D6E8AE7",
+                         "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");
+
+   fails += keywrap_test("00112233445566778899AABBCCDDEEFF0001020304050607",
+                         "031D33264E15D33268F24EC260743EDCE1C6C7DDEE725A936BA814915C6762D2",
+                         "000102030405060708090A0B0C0D0E0F1011121314151617");
+
+   fails += keywrap_test("00112233445566778899AABBCCDDEEFF0001020304050607",
+                         "A8F9BC1612C68B3FF6E6F4FBE30E71E4769C8B80A32CB8958CD5D17D6B254DA1",
+                         "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");
+
+   fails += keywrap_test("00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F",
+                         "28C9F404C4B810F4CBCCB35CFB87F8263F5786E2D80ED326CBC7F0E71A99F43BFB988B9B7A02DD21",
+                         "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");
+
+   return fails;
+   }
diff --git a/checks/ocb.cpp b/checks/ocb.cpp
index 3cb9c4c09..b2bd296e0 100644
--- a/checks/ocb.cpp
+++ b/checks/ocb.cpp
@@ -1,5 +1,5 @@
 
-#include "validate.h"
+#include "tests.h"
 
 #include <botan/ocb.h>
 #include <botan/hex.h>
@@ -93,7 +93,7 @@ std::vector<byte> ocb_encrypt(OCB_Encryption& ocb,
    return unlock(buf);
    }
 
-void test_ocb_long(size_t taglen, const std::string &expected)
+size_t test_ocb_long(size_t taglen, const std::string &expected)
    {
    OCB_Encryption ocb(new AES_128, taglen/8);
 
@@ -119,16 +119,24 @@ void test_ocb_long(size_t taglen, const std::string &expected)
    const std::string cipher_hex = hex_encode(cipher);
 
    if(cipher_hex != expected)
+      {
       std::cout << "OCB AES-128 long test mistmatch " << cipher_hex << " != " << expected << "\n";
+      return 1;
+      }
+
+   return 0;
    }
 
 }
 
-void test_ocb()
+size_t test_ocb()
    {
-   test_ocb_long(128, "B2B41CBF9B05037DA7F16C24A35C1C94");
-   test_ocb_long(96, "1A4F0654277709A5BDA0D380");
-   test_ocb_long(64, "B7ECE9D381FE437F");
+   size_t fails = 0;
+   fails += test_ocb_long(128, "B2B41CBF9B05037DA7F16C24A35C1C94");
+   fails += test_ocb_long(96, "1A4F0654277709A5BDA0D380");
+   fails += test_ocb_long(64, "B7ECE9D381FE437F");
+   test_report("OCB long", 3, fails);
+   return fails;
    }
 
 
diff --git a/checks/passhash.cpp b/checks/passhash.cpp
new file mode 100644
index 000000000..6f66743c5
--- /dev/null
+++ b/checks/passhash.cpp
@@ -0,0 +1,94 @@
+#include "tests.h"
+
+#include <botan/auto_rng.h>
+#include <iostream>
+
+#if defined(BOTAN_HAS_PASSHASH9)
+  #include <botan/passhash9.h>
+#endif
+
+#if defined(BOTAN_HAS_BCRYPT)
+  #include <botan/bcrypt.h>
+#endif
+
+using namespace Botan;
+
+size_t test_bcrypt()
+   {
+   size_t fails = 0;
+
+#if defined(BOTAN_HAS_BCRYPT)
+
+   // Generated by jBCrypt 0.3
+   if(!check_bcrypt("abc", "$2a$05$DfPyLs.G6.To9fXEFgUL1O6HpYw3jIXgPcl/L3Qt3jESuWmhxtmpS"))
+      {
+      std::cout << "Bcrypt test 1 failed\n";
+      fails++;
+      }
+
+   // http://www.openwall.com/lists/john-dev/2011/06/19/2
+   if(!check_bcrypt("\xA3",
+                    "$2a$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq"))
+      {
+      std::cout << "Bcrypt test 2 failed\n";
+      fails++;
+      }
+
+   AutoSeeded_RNG rng;
+
+   for(u16bit level = 1; level != 5; ++level)
+      {
+      const std::string input = "some test passphrase 123";
+      const std::string gen_hash = generate_bcrypt(input, rng, level);
+
+      if(!check_bcrypt(input, gen_hash))
+         {
+         std::cout << "Gen and check for bcrypt failed: " << gen_hash << " not valid\n";
+         ++fails;
+         }
+      }
+
+   test_report("Bcrypt", 6, fails);
+
+#endif
+
+   return fails;
+   }
+
+size_t test_passhash9()
+   {
+   size_t fails = 0;
+
+#if defined(BOTAN_HAS_PASSHASH9)
+   const std::string input = "secret";
+   const std::string fixed_hash =
+      "$9$AAAKhiHXTIUhNhbegwBXJvk03XXJdzFMy+i3GFMIBYKtthTTmXZA";
+
+   size_t ran = 0;
+
+   ++ran;
+   if(!check_passhash9(input, fixed_hash))
+      {
+      std::cout << "Passhash9 fixed input test failed\n";
+      fails++;
+      }
+
+   AutoSeeded_RNG rng;
+
+   for(byte alg_id = 0; alg_id <= 4; ++alg_id)
+      {
+      std::string gen_hash = generate_passhash9(input, rng, 2, alg_id);
+
+      ++ran;
+      if(!check_passhash9(input, gen_hash))
+         {
+         std::cout << "Passhash9 gen and check " << static_cast<int>(alg_id) << " failed\n";
+         ++fails;
+         }
+      }
+
+   test_report("Passhash9", ran, fails);
+#endif
+
+   return fails;
+   }
diff --git a/checks/pbkdf.cpp b/checks/pbkdf.cpp
index 936422bb0..43a77d7f4 100644
--- a/checks/pbkdf.cpp
+++ b/checks/pbkdf.cpp
@@ -1,6 +1,5 @@
-#include "validate.h"
+#include "tests.h"
 
-#include <botan/libstate.h>
 #include <botan/lookup.h>
 #include <botan/hex.h>
 #include <iostream>
@@ -36,11 +35,11 @@ std::string pbkdf_test(const std::string& algo,
 
 }
 
-void test_pbkdf()
+size_t test_pbkdf()
    {
    std::ifstream vec("checks/pbkdf.vec");
 
-   run_tests(vec, "PBKDF", "Output", true,
+   return run_tests(vec, "PBKDF", "Output", true,
              [](std::map<std::string, std::string> m)
              {
              return pbkdf_test(m["PBKDF"], m["Passphrase"], m["Salt"],
diff --git a/checks/tests.cpp b/checks/tests.cpp
index 6da04307c..838c34b00 100644
--- a/checks/tests.cpp
+++ b/checks/tests.cpp
@@ -1,16 +1,28 @@
-#include "validate.h"
+#include "tests.h"
 #include <iostream>
 
-void run_tests_bb(std::istream& src,
-                  const std::string& name_key,
-                  const std::string& output_key,
-                  bool clear_between_cb,
-                  std::function<bool (std::map<std::string, std::string>)> cb)
+size_t run_tests(const std::vector<test_fn>& tests)
+   {
+   size_t fails = 0;
+   for(auto& test : tests)
+      fails += test();
+   return fails;
+   }
+
+void test_report(const std::string& name, size_t ran, size_t failed)
+   {
+   std::cout << name << " tests: " << ran << " completed " << failed << " failed\n";
+   }
+
+size_t run_tests_bb(std::istream& src,
+                    const std::string& name_key,
+                    const std::string& output_key,
+                    bool clear_between_cb,
+                    std::function<bool (std::map<std::string, std::string>)> cb)
    {
    std::map<std::string, std::string> vars;
    size_t test_cnt = 0;
    size_t test_fail = 0;
-   bool verbose = true;
 
    while(src.good())
       {
@@ -47,18 +59,17 @@ void run_tests_bb(std::istream& src,
          }
       }
 
-   if(verbose)
-      std::cout << test_cnt << " " << name_key << " tests completed "
-                << test_fail << " failed\n";
+   test_report(name_key, test_cnt, test_fail);
+   return test_fail;
    }
 
-void run_tests(std::istream& src,
-               const std::string& name_key,
-               const std::string& output_key,
-               bool clear_between_cb,
-               std::function<std::string (std::map<std::string, std::string>)> cb)
+size_t run_tests(std::istream& src,
+                 const std::string& name_key,
+                 const std::string& output_key,
+                 bool clear_between_cb,
+                 std::function<std::string (std::map<std::string, std::string>)> cb)
    {
-   run_tests_bb(src, name_key, output_key, clear_between_cb,
+   return run_tests_bb(src, name_key, output_key, clear_between_cb,
                 [name_key,output_key,cb](std::map<std::string, std::string> vars)
                 {
                 const std::string got = cb(vars);
@@ -71,4 +82,3 @@ void run_tests(std::istream& src,
                 return true;
                 });
    }
-
diff --git a/checks/tests.h b/checks/tests.h
new file mode 100644
index 000000000..db92a5d3d
--- /dev/null
+++ b/checks/tests.h
@@ -0,0 +1,45 @@
+
+#ifndef BOTAN_TESTS_H__
+#define BOTAN_TESTS_H__
+
+#include <functional>
+#include <istream>
+#include <map>
+#include <string>
+#include <vector>
+
+size_t run_tests_bb(std::istream& src,
+                    const std::string& name_key,
+                    const std::string& output_key,
+                    bool clear_between_cb,
+                    std::function<bool (std::map<std::string, std::string>)> cb);
+
+size_t run_tests(std::istream& src,
+                 const std::string& name_key,
+                 const std::string& output_key,
+                 bool clear_between_cb,
+                 std::function<std::string (std::map<std::string, std::string>)> cb);
+
+// Run a list of tests
+typedef std::function<size_t ()> test_fn;
+
+size_t run_tests(const std::vector<test_fn>& tests);
+void test_report(const std::string& name, size_t ran, size_t failed);
+
+#define TEST(expr, msg) do { if(!(expr)) { ++fails; std::cout << msg; } while(0)
+
+// Tests using reader framework above
+size_t test_hkdf();
+size_t test_pbkdf();
+size_t test_kdf();
+size_t test_aead();
+size_t test_transform();
+
+// One off tests
+size_t test_ocb();
+size_t test_keywrap();
+size_t test_bcrypt();
+size_t test_passhash9();
+size_t test_cryptobox();
+
+#endif
diff --git a/checks/transform.cpp b/checks/transform.cpp
index ddad62a72..08911dd7a 100644
--- a/checks/transform.cpp
+++ b/checks/transform.cpp
@@ -1,9 +1,8 @@
-#include "validate.h"
-#include "bench.h"
+#include "tests.h"
 
-#include <botan/libstate.h>
 #include <botan/botan.h>
 #include <botan/transform.h>
+#include <botan/threefish.h>
 #include <botan/benchmark.h>
 #include <botan/hex.h>
 #include <iostream>
@@ -15,7 +14,6 @@ namespace {
 
 Transformation* get_transform(const std::string& algo)
    {
-
    throw std::runtime_error("Unknown transform " + algo);
    }
 
@@ -35,29 +33,7 @@ secure_vector<byte> transform_test(const std::string& algo,
    return out;
    }
 
-}
-
-void test_transform()
-   {
-   return;
-
-   std::ifstream vec("checks/transform.vec");
-
-   run_tests(vec, "Transform", "Output", true,
-             [](std::map<std::string, std::string> m)
-             {
-             return hex_encode(transform_test(m["Transform"],
-                                              hex_decode_locked(m["Nonce"]),
-                                              hex_decode_locked(m["Key"]),
-                                              hex_decode_locked(m["Input"])));
-             });
-
-   if(true)
-      {
-      time_transform("Threefish-512");
-      //time_transform("Threefish-512-AVX2");
-      }
-   }
+namespace {
 
 void time_transform(const std::string& algo)
    {
@@ -85,3 +61,21 @@ void time_transform(const std::string& algo)
       std::cout << Mbytes << " MiB / second in " << buf_size << " byte blocks\n";
       }
    }
+
+}
+
+}
+
+size_t test_transform()
+   {
+   std::ifstream vec("checks/transform.vec");
+
+   return run_tests(vec, "Transform", "Output", true,
+             [](std::map<std::string, std::string> m)
+             {
+             return hex_encode(transform_test(m["Transform"],
+                                              hex_decode_locked(m["Nonce"]),
+                                              hex_decode_locked(m["Key"]),
+                                              hex_decode_locked(m["Input"])));
+             });
+   }
diff --git a/checks/transform.vec b/checks/transform.vec
index 7399fb641..e69de29bb 100644
--- a/checks/transform.vec
+++ b/checks/transform.vec
@@ -1,18 +0,0 @@
-
-Transform = Threefish-512
-Input = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
-Key = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
-Nonce = 00000000000000000000000000000000
-Output = B1A2BBC6EF6025BC40EB3822161F36E375D1BB0AEE3186FBD19E47C5D479947B7BC2F8586E35F0CFF7E7F03084B0B7B1F1AB3961A580A3E97EB41EA14A6D7BBE
-
-Transform = Threefish-512
-Input = FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C0
-Nonce = 000102030405060708090A0B0C0D0E0F
-Key = 101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F
-Output = E304439626D45A2CB401CAD8D636249A6338330EB06D45DD8B36B90E97254779272A0A8D99463504784420EA18C9A725AF11DFFEA10162348927673D5C1CAF3D
-
-Transform = Threefish-512
-Input = FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C0FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C1FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C2FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C3FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C4FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C5FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C6FFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0EFEEEDECEBEAE9E8E7E6E5E4E3E2E1E0DFDEDDDCDBDAD9D8D7D6D5D4D3D2D1D0CFCECDCCCBCAC9C8C7C6C5C4C3C2C1C7
-Nonce = 000102030405060708090A0B0C0D0E0F
-Key = 101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F
-Output = E304439626D45A2CB401CAD8D636249A6338330EB06D45DD8B36B90E97254779272A0A8D99463504784420EA18C9A725AF11DFFEA10162348927673D5C1CAF3DEADB79B45750412A48DA8F29648E51C7DC6B6F1FBC7F9EAE86B200C4D757CF80A2DEDC32EC0C4294CB4715A38B55433238C3E8DB022BF2EAAC20369745D240F2030A3FBD7262ECD63DFD1FF67304CA958C4DCCDA484705B8D0A9DB6FE5ECB774D8506DF74A6103A56F311B0B1A38E7F7CE694825AC2141059FF81F013EF816A070C8511C219FDEE1F9B712475CA1E6D8737A880A15824025FAECDFA946129D66EEFF349B735DA1B28E24AD703671257C1FE94A927CA307750BFB83D8E8E2AC1AED9BDAA2CF8E737994552A65F1488BEDD7995EAD3E2BB1F83372B998516C5E0AD3C4F65FF0A832D6AC866D800D55837E7F054C37BD93C526A41D3C665DD513D8D7D4DE2DD8F5060CC7F6CEDA565B39398392FC53EC95B55FA755FA96D2585C8E21D26694F8DF5D839C462F5ACAB59610B90FB2B10858D29DE8336813DB3FE24C46CEA7E56574F9BE0D348B01FE3AF29D40B360838BF9DA4B28AC63F385EE05880A6A49A8E384E08656F7D3AEB5407658A27278923C56FDA8CE8F269A24776132B98AE9CEF3C02A0AC97D584913AD5C94B51B5256E9B790D083ACBB212DC6DA264B4E16AB60485F93A9226676988BF3307FD1083032FC10BEC1DA051757AB425C
diff --git a/checks/validate.cpp b/checks/validate.cpp
index 866f414eb..cb15325ef 100644
--- a/checks/validate.cpp
+++ b/checks/validate.cpp
@@ -19,21 +19,7 @@
 #include <botan/selftest.h>
 #include <botan/libstate.h>
 
-#if defined(BOTAN_HAS_PASSHASH9)
-  #include <botan/passhash9.h>
-#endif
-
-#if defined(BOTAN_HAS_BCRYPT)
-  #include <botan/bcrypt.h>
-#endif
-
-#if defined(BOTAN_HAS_CRYPTO_BOX)
-  #include <botan/cryptobox.h>
-#endif
-
-#if defined(BOTAN_HAS_RFC3394_KEYWRAP)
-  #include <botan/rfc3394.h>
-#endif
+#include "tests.h"
 
 using namespace Botan;
 
@@ -66,201 +52,6 @@ u32bit random_word(Botan::RandomNumberGenerator& rng,
 #endif
    }
 
-bool test_cryptobox(RandomNumberGenerator& rng)
-   {
-#if defined(BOTAN_HAS_CRYPTO_BOX)
-
-   std::cout << "Testing CryptoBox: " << std::flush;
-
-   const byte msg[] = { 0xAA, 0xBB, 0xCC };
-   std::string ciphertext = CryptoBox::encrypt(msg, sizeof(msg),
-                                               "secret password",
-                                               rng);
-
-   std::cout << "." << std::flush;
-
-   try
-      {
-      std::string plaintext = CryptoBox::decrypt(ciphertext,
-                                                 "secret password");
-
-      std::cout << "." << std::flush;
-
-      if(plaintext.size() != sizeof(msg) ||
-         !same_mem(reinterpret_cast<const byte*>(&plaintext[0]), msg, sizeof(msg)))
-         return false;
-
-      std::cout << std::endl;
-      }
-   catch(std::exception& e)
-      {
-      std::cout << "Error during Cryptobox test " << e.what() << "\n";
-      return false;
-      }
-#endif
-
-   return true;
-   }
-
-bool keywrap_test(const char* key_str,
-                  const char* expected_str,
-                  const char* kek_str)
-   {
-   std::cout << '.' << std::flush;
-
-   bool ok = true;
-
-#if defined(BOTAN_HAS_RFC3394_KEYWRAP)
-   try
-      {
-      SymmetricKey key(key_str);
-      SymmetricKey expected(expected_str);
-      SymmetricKey kek(kek_str);
-
-      Algorithm_Factory& af = global_state().algorithm_factory();
-
-      secure_vector<byte> enc = rfc3394_keywrap(key.bits_of(), kek, af);
-
-      if(enc != expected.bits_of())
-         {
-         std::cout << "NIST key wrap encryption failure: "
-                   << hex_encode(enc) << " != " << hex_encode(expected.bits_of()) << "\n";
-         ok = false;
-         }
-
-      secure_vector<byte> dec = rfc3394_keyunwrap(expected.bits_of(), kek, af);
-
-      if(dec != key.bits_of())
-         {
-         std::cout << "NIST key wrap decryption failure: "
-                   << hex_encode(dec) << " != " << hex_encode(key.bits_of()) << "\n";
-         ok = false;
-         }
-      }
-   catch(std::exception& e)
-      {
-      std::cout << e.what() << "\n";
-      }
-#endif
-
-   return ok;
-   }
-
-bool test_keywrap()
-   {
-   std::cout << "Testing NIST keywrap: " << std::flush;
-
-   bool ok = true;
-
-   ok &= keywrap_test("00112233445566778899AABBCCDDEEFF",
-                      "1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5",
-                      "000102030405060708090A0B0C0D0E0F");
-
-   ok &= keywrap_test("00112233445566778899AABBCCDDEEFF",
-                      "96778B25AE6CA435F92B5B97C050AED2468AB8A17AD84E5D",
-                      "000102030405060708090A0B0C0D0E0F1011121314151617");
-
-   ok &= keywrap_test("00112233445566778899AABBCCDDEEFF",
-                      "64E8C3F9CE0F5BA263E9777905818A2A93C8191E7D6E8AE7",
-                      "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");
-
-   ok &= keywrap_test("00112233445566778899AABBCCDDEEFF0001020304050607",
-                      "031D33264E15D33268F24EC260743EDCE1C6C7DDEE725A936BA814915C6762D2",
-                      "000102030405060708090A0B0C0D0E0F1011121314151617");
-
-   ok &= keywrap_test("00112233445566778899AABBCCDDEEFF0001020304050607",
-                      "A8F9BC1612C68B3FF6E6F4FBE30E71E4769C8B80A32CB8958CD5D17D6B254DA1",
-                      "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");
-
-   ok &= keywrap_test("00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F",
-                      "28C9F404C4B810F4CBCCB35CFB87F8263F5786E2D80ED326CBC7F0E71A99F43BFB988B9B7A02DD21",
-                      "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");
-
-   std::cout << "\n";
-   return ok;
-   }
-
-bool test_bcrypt(RandomNumberGenerator& rng)
-   {
-#if defined(BOTAN_HAS_BCRYPT)
-   std::cout << "Testing Bcrypt: " << std::flush;
-
-   bool ok = true;
-
-   // Generated by jBCrypt 0.3
-   if(!check_bcrypt("abc",
-                    "$2a$05$DfPyLs.G6.To9fXEFgUL1O6HpYw3jIXgPcl/L3Qt3jESuWmhxtmpS"))
-      {
-      std::cout << "Fixed bcrypt test failed\n";
-      ok = false;
-      }
-
-   std::cout << "." << std::flush;
-
-   // http://www.openwall.com/lists/john-dev/2011/06/19/2
-   if(!check_bcrypt("\xA3",
-                    "$2a$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq"))
-      {
-      std::cout << "Fixed bcrypt test 2 failed\n";
-      ok = false;
-      }
-
-   std::cout << "." << std::flush;
-
-   for(u16bit level = 1; level != 5; ++level)
-      {
-      const std::string input = "some test passphrase 123";
-      const std::string gen_hash = generate_bcrypt(input, rng, level);
-
-      if(!check_bcrypt(input, gen_hash))
-         {
-         std::cout << "Gen and check for bcrypt failed: "
-                   << gen_hash << " not valid\n";
-         ok = false;
-         }
-
-      std::cout << "." << std::flush;
-      }
-
-   std::cout << std::endl;
-   return ok;
-#endif
-   }
-
-bool test_passhash(RandomNumberGenerator& rng)
-   {
-#if defined(BOTAN_HAS_PASSHASH9)
-
-   std::cout << "Testing Password Hashing: " << std::flush;
-
-   const std::string input = "secret";
-   const std::string fixed_hash =
-      "$9$AAAKhiHXTIUhNhbegwBXJvk03XXJdzFMy+i3GFMIBYKtthTTmXZA";
-
-   std::cout << "." << std::flush;
-
-   if(!check_passhash9(input, fixed_hash))
-      return false;
-
-   std::cout << "." << std::flush;
-
-   for(byte alg_id = 0; alg_id <= 2; ++alg_id)
-      {
-      std::string gen_hash = generate_passhash9(input, rng, 2, alg_id);
-
-      if(!check_passhash9(input, gen_hash))
-         return false;
-
-      std::cout << "." << std::flush;
-      }
-
-   std::cout << std::endl;
-
-#endif
-
-   return true;
-   }
-
 }
 
 bool failed_test(const std::string&, std::vector<std::string>, bool, bool,
@@ -392,38 +183,23 @@ u32bit do_validation_tests(const std::string& filename,
    if(should_pass)
       std::cout << std::endl;
 
-   if(should_pass && !test_passhash(rng))
+   if(should_pass)
       {
-      std::cout << "Passhash9 tests failed" << std::endl;
-      errors++;
-      }
+      std::vector<test_fn> all_tests;
+      all_tests.push_back(test_aead);
+      all_tests.push_back(test_ocb);
 
-   if(should_pass && !test_bcrypt(rng))
-      {
-      std::cout << "BCrypt tests failed" << std::endl;
-      errors++;
-      }
+      all_tests.push_back(test_pbkdf);
+      all_tests.push_back(test_kdf);
+      all_tests.push_back(test_hkdf);
+      all_tests.push_back(test_keywrap);
+      all_tests.push_back(test_transform);
 
-   if(should_pass && !test_keywrap())
-      {
-      std::cout << "NIST keywrap tests failed" << std::endl;
-      errors++;
-      }
-
-   if(should_pass && !test_cryptobox(rng))
-      {
-      std::cout << "Cryptobox tests failed" << std::endl;
-      errors++;
-      }
+      all_tests.push_back(test_passhash9);
+      all_tests.push_back(test_bcrypt);
+      all_tests.push_back(test_cryptobox);
 
-   if(should_pass)
-      {
-      test_transform();
-      test_ocb();
-      test_hkdf();
-      test_pbkdf();
-      test_kdf();
-      test_aead();
+      run_tests(all_tests);
       }
 
    return errors;
diff --git a/checks/validate.h b/checks/validate.h
index bb4114c3f..34056ab00 100644
--- a/checks/validate.h
+++ b/checks/validate.h
@@ -33,24 +33,4 @@ void do_x509_tests(RandomNumberGenerator&);
 
 size_t do_tls_tests(RandomNumberGenerator& rng);
 
-void test_ocb();
-
-void test_hkdf();
-void test_pbkdf();
-void test_kdf();
-void test_aead();
-void test_transform();
-
-void run_tests_bb(std::istream& src,
-                  const std::string& name_key,
-                  const std::string& output_key,
-                  bool clear_between_cb,
-                  std::function<bool (std::map<std::string, std::string>)> cb);
-
-void run_tests(std::istream& src,
-               const std::string& name_key,
-               const std::string& output_key,
-               bool clear_between_cb,
-               std::function<std::string (std::map<std::string, std::string>)> cb);
-
 #endif
diff --git a/src/passhash/passhash9/passhash9.cpp b/src/passhash/passhash9/passhash9.cpp
index eeebb58d4..027ceeb76 100644
--- a/src/passhash/passhash9/passhash9.cpp
+++ b/src/passhash/passhash9/passhash9.cpp
@@ -38,9 +38,9 @@ MessageAuthenticationCode* get_pbkdf_prf(byte alg_id)
       else if(alg_id == 2)
          return af.make_mac("CMAC(Blowfish)");
       else if(alg_id == 3)
-         return af.make_mac("CMAC(SHA-384)");
+         return af.make_mac("HMAC(SHA-384)");
       else if(alg_id == 4)
-         return af.make_mac("CMAC(SHA-512)");
+         return af.make_mac("HMAC(SHA-512)");
       }
    catch(Algorithm_Not_Found) {}
 
diff --git a/src/pubkey/x509_key.cpp b/src/pubkey/x509_key.cpp
index 62d626d9b..10395837c 100644
--- a/src/pubkey/x509_key.cpp
+++ b/src/pubkey/x509_key.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/x509_key.h>
-#include <botan/filters.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/pem.h>