Plain hex_decode now returns a std::vector, use hex_decode_locked to

get a secure_vector.

10 files changed, 158 insertions, 110 deletions

diff --git a/checks/common.h b/checks/common.h
index 05a6fb974..a96524eda 100644
--- a/checks/common.h
+++ b/checks/common.h
@@ -55,13 +55,13 @@ class Fixed_Output_RNG : public Botan::RandomNumberGenerator
 
       void clear() throw() {}
 
-      Fixed_Output_RNG(const Botan::secure_vector<byte>& in)
+      Fixed_Output_RNG(const std::vector<byte>& in)
          {
          buf.insert(buf.end(), in.begin(), in.end());
          }
       Fixed_Output_RNG(const std::string& in_str)
          {
-         Botan::secure_vector<byte> in = Botan::hex_decode(in_str);
+         std::vector<byte> in = Botan::hex_decode(in_str);
          buf.insert(buf.end(), in.begin(), in.end());
          }
 
diff --git a/checks/ec_tests.cpp b/checks/ec_tests.cpp
index 39c32de37..0f2a268d8 100644
--- a/checks/ec_tests.cpp
+++ b/checks/ec_tests.cpp
@@ -76,10 +76,10 @@ void test_point_turn_on_sp_red_mul()
    std::string a_secp = "ffffffffffffffffffffffffffffffff7ffffffc";
    std::string b_secp = "1c97befc54bd7a8b65acf89f81d4d4adc565fa45";
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_p_secp = hex_decode(p_secp);
-   secure_vector<byte> sv_a_secp = hex_decode(a_secp);
-   secure_vector<byte> sv_b_secp = hex_decode(b_secp);
-   secure_vector<byte> sv_G_secp_comp = hex_decode(G_secp_comp);
+   std::vector<byte> sv_p_secp = hex_decode(p_secp);
+   std::vector<byte> sv_a_secp = hex_decode(a_secp);
+   std::vector<byte> sv_b_secp = hex_decode(b_secp);
+   std::vector<byte> sv_G_secp_comp = hex_decode(G_secp_comp);
    BigInt bi_p_secp = BigInt::decode(&sv_p_secp[0], sv_p_secp.size());
    BigInt bi_a_secp = BigInt::decode(&sv_a_secp[0], sv_a_secp.size());
    BigInt bi_b_secp = BigInt::decode(&sv_b_secp[0], sv_b_secp.size());
@@ -139,10 +139,10 @@ void test_coordinates()
    std::string a_secp = "ffffffffffffffffffffffffffffffff7ffffffc";
    std::string b_secp = "1c97befc54bd7a8b65acf89f81d4d4adc565fa45";
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
 
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
@@ -196,7 +196,7 @@ void test_point_mult ()
    const CurveGFp& curve = secp160r1.get_curve();
 
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_G_secp_comp = hex_decode(G_secp_comp);
+   std::vector<byte> sv_G_secp_comp = hex_decode(G_secp_comp);
    PointGFp p_G = OS2ECP(sv_G_secp_comp, curve);
 
    BigInt d_U("0xaa374ffc3ce144e6b073307972cb6d57b2a4e982");
@@ -215,10 +215,10 @@ void test_point_negative()
    std::string a_secp = "ffffffffffffffffffffffffffffffff7ffffffc";
    std::string b_secp = "1c97befc54bd7a8b65acf89f81d4d4adc565fa45";
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
    BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
@@ -242,7 +242,7 @@ void test_zeropoint()
 
 
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
    BigInt bi_p_secp("0xffffffffffffffffffffffffffffffff7fffffff");
    BigInt bi_a_secp("0xffffffffffffffffffffffffffffffff7ffffffc");
    BigInt bi_b_secp("0x1c97befc54bd7a8b65acf89f81d4d4adc565fa45");
@@ -273,15 +273,15 @@ void test_zeropoint_enc_dec()
    CHECK_MESSAGE(  p.is_zero(), "by constructor created zeropoint is no zeropoint!");
 
 
-   secure_vector<byte> sv_p = EC2OSP(p, PointGFp::UNCOMPRESSED);
+   std::vector<byte> sv_p = unlock(EC2OSP(p, PointGFp::UNCOMPRESSED));
    PointGFp p_encdec = OS2ECP(sv_p, curve);
    CHECK_MESSAGE(  p == p_encdec, "encoded-decoded (uncompressed) point is not equal the original!");
 
-   sv_p = EC2OSP(p, PointGFp::UNCOMPRESSED);
+   sv_p = unlock(EC2OSP(p, PointGFp::UNCOMPRESSED));
    p_encdec = OS2ECP(sv_p, curve);
    CHECK_MESSAGE(  p == p_encdec, "encoded-decoded (compressed) point is not equal the original!");
 
-   sv_p = EC2OSP(p, PointGFp::HYBRID);
+   sv_p = unlock(EC2OSP(p, PointGFp::HYBRID));
    p_encdec = OS2ECP(sv_p, curve);
    CHECK_MESSAGE(  p == p_encdec, "encoded-decoded (hybrid) point is not equal the original!");
    }
@@ -291,7 +291,7 @@ void test_calc_with_zeropoint()
    std::cout << "." << std::flush;
 
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
    BigInt bi_p_secp("0xffffffffffffffffffffffffffffffff7fffffff");
    BigInt bi_a_secp("0xffffffffffffffffffffffffffffffff7ffffffc");
    BigInt bi_b_secp("0x1c97befc54bd7a8b65acf89f81d4d4adc565fa45");
@@ -327,10 +327,10 @@ void test_add_point()
    std::string a_secp = "ffffffffffffffffffffffffffffffff7ffffffc";
    std::string b_secp = "1c97befc54bd7a8b65acf89f81d4d4adc565fa45";
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
    BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
@@ -363,10 +363,10 @@ void test_sub_point()
    std::string a_secp = "ffffffffffffffffffffffffffffffff7ffffffc";
    std::string b_secp = "1c97befc54bd7a8b65acf89f81d4d4adc565fa45";
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
    BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
@@ -398,10 +398,10 @@ void test_mult_point()
    std::string a_secp = "ffffffffffffffffffffffffffffffff7ffffffc";
    std::string b_secp = "1c97befc54bd7a8b65acf89f81d4d4adc565fa45";
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
    BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
@@ -427,10 +427,10 @@ void test_basic_operations()
    std::string a_secp = "ffffffffffffffffffffffffffffffff7ffffffc";
    std::string b_secp = "1c97befc54bd7a8b65acf89f81d4d4adc565fa45";
    std::string G_secp_comp = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
    BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
@@ -490,10 +490,10 @@ void test_enc_dec_compressed_160()
    std::string G_secp_comp = "024A96B5688EF573284664698968C38BB913CBFC82";
    std::string G_order_secp_comp = "0100000000000000000001F4C8F927AED3CA752257";
 
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
 
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
@@ -502,7 +502,7 @@ void test_enc_dec_compressed_160()
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
 
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, secp160r1 );
-   secure_vector<byte> sv_result = EC2OSP(p_G, PointGFp::COMPRESSED);
+   std::vector<byte> sv_result = unlock(EC2OSP(p_G, PointGFp::COMPRESSED));
 
    CHECK( sv_result == sv_G_secp_comp);
    }
@@ -519,10 +519,10 @@ void test_enc_dec_compressed_256()
    std::string G_secp_comp = "036B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296";
    std::string G_order_secp_comp = "ffffffff00000000ffffffffffffffffBCE6FAADA7179E84F3B9CAC2FC632551";
 
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
 
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
@@ -531,7 +531,7 @@ void test_enc_dec_compressed_256()
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
 
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, secp160r1 );
-   secure_vector<byte> sv_result = EC2OSP(p_G, PointGFp::COMPRESSED);
+   std::vector<byte> sv_result = unlock(EC2OSP(p_G, PointGFp::COMPRESSED));
 
    CHECK( sv_result == sv_G_secp_comp);
    }
@@ -550,10 +550,10 @@ void test_enc_dec_uncompressed_112()
    std::string G_secp_uncomp = "044BA30AB5E892B4E1649DD0928643ADCD46F5882E3747DEF36E956E97";
    std::string G_order_secp_uncomp = "36DF0AAFD8B8D7597CA10520D04B";
 
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
 
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
@@ -562,7 +562,7 @@ void test_enc_dec_uncompressed_112()
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
 
    PointGFp p_G = OS2ECP ( sv_G_secp_uncomp, secp160r1 );
-   secure_vector<byte> sv_result = EC2OSP(p_G, PointGFp::UNCOMPRESSED);
+   std::vector<byte> sv_result = unlock(EC2OSP(p_G, PointGFp::UNCOMPRESSED));
 
    CHECK( sv_result == sv_G_secp_uncomp);
    }
@@ -579,10 +579,10 @@ void test_enc_dec_uncompressed_521()
    std::string G_secp_uncomp = "0400C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2ffA8DE3348B3C1856A429BF97E7E31C2E5BD66011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650";
    std::string G_order_secp_uncomp = "01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409";
 
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
 
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
@@ -592,7 +592,7 @@ void test_enc_dec_uncompressed_521()
 
    PointGFp p_G = OS2ECP ( sv_G_secp_uncomp, secp160r1 );
 
-   secure_vector<byte> sv_result = EC2OSP(p_G, PointGFp::UNCOMPRESSED);
+   std::vector<byte> sv_result = unlock(EC2OSP(p_G, PointGFp::UNCOMPRESSED));
    std::string result = hex_encode(&sv_result[0], sv_result.size());
    std::string exp_result = hex_encode(&sv_G_secp_uncomp[0], sv_G_secp_uncomp.size());
 
@@ -611,10 +611,10 @@ void test_enc_dec_uncompressed_521_prime_too_large()
    std::string G_secp_uncomp = "0400C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2ffA8DE3348B3C1856A429BF97E7E31C2E5BD66011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650";
    std::string G_order_secp_uncomp = "01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409";
 
-   secure_vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
+   std::vector<byte> sv_p_secp = hex_decode ( p_secp );
+   std::vector<byte> sv_a_secp = hex_decode ( a_secp );
+   std::vector<byte> sv_b_secp = hex_decode ( b_secp );
+   std::vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
 
    BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
@@ -648,7 +648,7 @@ void test_gfp_store_restore()
    PointGFp p = dom_pars.get_base_point();
 
    //store point (to std::string)
-   secure_vector<byte> sv_mes = EC2OSP(p, PointGFp::COMPRESSED);
+   std::vector<byte> sv_mes = unlock(EC2OSP(p, PointGFp::COMPRESSED));
    PointGFp new_p = OS2ECP(sv_mes, dom_pars.get_curve());
 
    CHECK_MESSAGE( p == new_p, "original and restored point are different!");
@@ -662,7 +662,7 @@ void test_cdc_curve_33()
 
    std::string G_secp_uncomp = "04081523d03d4f12cd02879dea4bf6a4f3a7df26ed888f10c5b2235a1274c386a2f218300dee6ed217841164533bcdc903f07a096f9fbf4ee95bac098a111f296f5830fe5c35b3e344d5df3a2256985f64fbe6d0edcc4c61d18bef681dd399df3d0194c5a4315e012e0245ecea56365baa9e8be1f7";
 
-   secure_vector<byte> sv_G_uncomp = hex_decode ( G_secp_uncomp );
+   std::vector<byte> sv_G_uncomp = hex_decode ( G_secp_uncomp );
 
    BigInt bi_p_secp = BigInt("2117607112719756483104013348936480976596328609518055062007450442679169492999007105354629105748524349829824407773719892437896937279095106809");
    BigInt bi_a_secp("0xa377dede6b523333d36c78e9b0eaa3bf48ce93041f6d4fc34014d08f6833807498deedd4290101c5866e8dfb589485d13357b9e78c2d7fbe9fe");
@@ -689,7 +689,7 @@ void test_more_zeropoint()
    // by Falko
 
    std::string G = "024a96b5688ef573284664698968c38bb913cbfc82";
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G );
+   std::vector<byte> sv_G_secp_comp = hex_decode ( G );
    BigInt bi_p("0xffffffffffffffffffffffffffffffff7fffffff");
    BigInt bi_a("0xffffffffffffffffffffffffffffffff7ffffffc");
    BigInt bi_b("0x1c97befc54bd7a8b65acf89f81d4d4adc565fa45");
diff --git a/checks/ecdsa.cpp b/checks/ecdsa.cpp
index 554f72dd7..1c7df5255 100644
--- a/checks/ecdsa.cpp
+++ b/checks/ecdsa.cpp
@@ -142,7 +142,7 @@ void test_sign_then_ver(RandomNumberGenerator& rng)
 
    PK_Signer signer(ecdsa, "EMSA1(SHA-1)");
 
-   secure_vector<byte> msg = hex_decode("12345678901234567890abcdef12");
+   auto msg = hex_decode("12345678901234567890abcdef12");
    std::vector<byte> sig = signer.sign_message(msg, rng);
 
    PK_Verifier verifier(ecdsa, "EMSA1(SHA-1)");
@@ -268,10 +268,10 @@ void test_create_and_verify(RandomNumberGenerator& rng)
    std::string order_g = "0e1a16196e6000000000bc7f1618d867b15bb86474418f";
 
    //	::std::vector<byte> sv_p_secp = hex_decode ( p_secp );
-   secure_vector<byte> sv_a_secp = hex_decode ( a_secp );
-   secure_vector<byte> sv_b_secp = hex_decode ( b_secp );
-   secure_vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
-   secure_vector<byte> sv_order_g = hex_decode ( order_g );
+   auto sv_a_secp = hex_decode ( a_secp );
+   auto sv_b_secp = hex_decode ( b_secp );
+   auto sv_G_secp_comp = hex_decode ( G_secp_comp );
+   auto sv_order_g = hex_decode ( order_g );
 
    //	BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
    BigInt bi_p_secp("2117607112719756483104013348936480976596328609518055062007450442679169492999007105354629105748524349829824407773719892437896937279095106809");
@@ -343,7 +343,7 @@ void test_curve_registry(RandomNumberGenerator& rng)
          PK_Signer signer(ecdsa, "EMSA1(SHA-1)");
          PK_Verifier verifier(ecdsa, "EMSA1(SHA-1)");
 
-         secure_vector<byte> msg = hex_decode("12345678901234567890abcdef12");
+         auto msg = hex_decode("12345678901234567890abcdef12");
          std::vector<byte> sig = signer.sign_message(msg, rng);
 
          if(!verifier.verify_message(msg, sig))
@@ -361,7 +361,7 @@ void test_read_pkcs8(RandomNumberGenerator& rng)
    {
    std::cout << "." << std::flush;
 
-   secure_vector<byte> msg = hex_decode("12345678901234567890abcdef12");
+   auto msg = hex_decode("12345678901234567890abcdef12");
 
    try
       {
diff --git a/checks/pk.cpp b/checks/pk.cpp
index 5ef5df94b..eaa9c461b 100644
--- a/checks/pk.cpp
+++ b/checks/pk.cpp
@@ -160,8 +160,8 @@ void validate_encryption(PK_Encryptor& e, PK_Decryptor& d,
                          const std::string& random, const std::string& exp,
                          bool& failure)
    {
-   std::vector<byte> message = unlock(hex_decode(input));
-   std::vector<byte> expected = unlock(hex_decode(exp));
+   std::vector<byte> message = hex_decode(input);
+   std::vector<byte> expected = hex_decode(exp);
    Fixed_Output_RNG rng(hex_decode(random));
 
    std::vector<byte> out = e.encrypt(message, rng);
@@ -180,9 +180,9 @@ void validate_signature(PK_Verifier& v, PK_Signer& s, const std::string& algo,
                         RandomNumberGenerator& rng,
                         const std::string& exp, bool& failure)
    {
-   std::vector<byte> message = unlock(hex_decode(input));
+   std::vector<byte> message = hex_decode(input);
 
-   std::vector<byte> expected = unlock(hex_decode(exp));
+   std::vector<byte> expected = hex_decode(exp);
 
    std::vector<byte> sig = s.sign_message(message, rng);
 
@@ -223,15 +223,15 @@ void validate_kas(PK_Key_Agreement& kas, const std::string& algo,
                   const std::vector<byte>& pubkey, const std::string& output,
                   u32bit keylen, bool& failure)
    {
-   secure_vector<byte> expected = hex_decode(output);
+   std::vector<byte> expected = hex_decode(output);
 
-   secure_vector<byte> got = kas.derive_key(keylen,
-                                            pubkey).bits_of();
+   std::vector<byte> got = unlock(kas.derive_key(keylen,
+                                                 pubkey).bits_of());
 
    if(got != expected)
       {
       std::cout << "FAILED: " << algo << std::endl;
-      dump_data(unlock(got), unlock(expected));
+      dump_data(got, expected);
       failure = true;
       }
    }
@@ -325,8 +325,8 @@ u32bit validate_elg_enc(const std::string& algo,
       validate_encryption(e, d, algo, str[4], str[5], str[6], failure);
       }
    else
-      validate_decryption(d, algo, unlock(hex_decode(str[5])),
-                          unlock(hex_decode(str[4])), failure);
+      validate_decryption(d, algo, hex_decode(str[5]),
+                          hex_decode(str[4]), failure);
    return (failure ? 1 : 0);
 #endif
 
@@ -373,8 +373,8 @@ u32bit validate_rsa_ver(const std::string& algo,
 
    PK_Verifier v(key, emsa);
 
-   std::vector<byte> msg = unlock(hex_decode(str[2]));
-   std::vector<byte> sig = unlock(hex_decode(str[3]));
+   std::vector<byte> msg = hex_decode(str[2]);
+   std::vector<byte> sig = hex_decode(str[3]);
 
    bool passed = true;
    passed = v.verify_message(msg, sig);
@@ -405,8 +405,8 @@ u32bit validate_rsa_ver_x509(const std::string& algo,
 
    PK_Verifier v(*rsakey, emsa);
 
-   std::vector<byte> msg = unlock(hex_decode(str[1]));
-   std::vector<byte> sig = unlock(hex_decode(str[2]));
+   std::vector<byte> msg = hex_decode(str[1]);
+   std::vector<byte> sig = hex_decode(str[2]);
 
    bool passed = v.verify_message(msg, sig);
    return (passed ? 0 : 1);
@@ -429,8 +429,8 @@ u32bit validate_rw_ver(const std::string& algo,
 
    PK_Verifier v(key, emsa);
 
-   std::vector<byte> msg = unlock(hex_decode(str[2]));
-   std::vector<byte> sig = unlock(hex_decode(str[3]));
+   std::vector<byte> msg = hex_decode(str[2]);
+   std::vector<byte> sig = hex_decode(str[3]);
 
    bool passed = true;
    passed = v.verify_message(msg, sig);
@@ -538,7 +538,7 @@ u32bit validate_gost_ver(const std::string& algo,
 
    EC_Group group(OIDS::lookup(str[0]));
 
-   PointGFp public_point = OS2ECP(unlock(hex_decode(str[1])), group.get_curve());
+   PointGFp public_point = OS2ECP(hex_decode(str[1]), group.get_curve());
 
    GOST_3410_PublicKey gost(group, public_point);
 
@@ -546,8 +546,8 @@ u32bit validate_gost_ver(const std::string& algo,
 
    PK_Verifier v(gost, emsa);
 
-   std::vector<byte> msg = unlock(hex_decode(str[2]));
-   std::vector<byte> sig = unlock(hex_decode(str[3]));
+   std::vector<byte> msg = hex_decode(str[2]);
+   std::vector<byte> sig = hex_decode(str[3]);
 
    bool passed = v.verify_message(msg, sig);
    return (passed ? 0 : 1);
@@ -578,8 +578,8 @@ u32bit validate_dsa_ver(const std::string& algo,
 
    PK_Verifier v(*dsakey, emsa);
 
-   std::vector<byte> msg = unlock(hex_decode(str[1]));
-   std::vector<byte> sig = unlock(hex_decode(str[2]));
+   std::vector<byte> msg = hex_decode(str[1]);
+   std::vector<byte> sig = hex_decode(str[2]);
 
    v.set_input_format(DER_SEQUENCE);
    bool passed = v.verify_message(msg, sig);
diff --git a/checks/validate.cpp b/checks/validate.cpp
index bae5e857f..307a4e0d5 100644
--- a/checks/validate.cpp
+++ b/checks/validate.cpp
@@ -492,7 +492,7 @@ bool failed_test(const std::string& algo,
       pipe.append(test);
       pipe.append(new Botan::Hex_Encoder);
 
-      secure_vector<byte> data = Botan::hex_decode(in);
+      std::vector<byte> data = Botan::hex_decode(in);
       const byte* data_ptr = &data[0];
 
       // this can help catch errors with buffering, etc
diff --git a/src/codec/hex/hex.cpp b/src/codec/hex/hex.cpp
index 1fd32e2ed..104125894 100644
--- a/src/codec/hex/hex.cpp
+++ b/src/codec/hex/hex.cpp
@@ -159,9 +159,9 @@ size_t hex_decode(byte output[],
    return hex_decode(output, &input[0], input.length(), ignore_ws);
    }
 
-secure_vector<byte> hex_decode(const char input[],
-                              size_t input_length,
-                              bool ignore_ws)
+secure_vector<byte> hex_decode_locked(const char input[],
+                                      size_t input_length,
+                                      bool ignore_ws)
    {
    secure_vector<byte> bin(1 + input_length / 2);
 
@@ -174,8 +174,29 @@ secure_vector<byte> hex_decode(const char input[],
    return bin;
    }
 
-secure_vector<byte> hex_decode(const std::string& input,
-                              bool ignore_ws)
+secure_vector<byte> hex_decode_locked(const std::string& input,
+                                      bool ignore_ws)
+   {
+   return hex_decode_locked(&input[0], input.size(), ignore_ws);
+   }
+
+std::vector<byte> hex_decode(const char input[],
+                             size_t input_length,
+                             bool ignore_ws)
+   {
+   std::vector<byte> bin(1 + input_length / 2);
+
+   size_t written = hex_decode(&bin[0],
+                               input,
+                               input_length,
+                               ignore_ws);
+
+   bin.resize(written);
+   return bin;
+   }
+
+std::vector<byte> hex_decode(const std::string& input,
+                             bool ignore_ws)
    {
    return hex_decode(&input[0], input.size(), ignore_ws);
    }
diff --git a/src/codec/hex/hex.h b/src/codec/hex/hex.h
index bdb5e5365..a64a6c8df 100644
--- a/src/codec/hex/hex.h
+++ b/src/codec/hex/hex.h
@@ -102,9 +102,10 @@ size_t BOTAN_DLL hex_decode(byte output[],
                    exception if whitespace is encountered
 * @return decoded hex output
 */
-secure_vector<byte> BOTAN_DLL hex_decode(const char input[],
-                                        size_t input_length,
-                                        bool ignore_ws = true);
+std::vector<byte> BOTAN_DLL
+hex_decode(const char input[],
+           size_t input_length,
+           bool ignore_ws = true);
 
 /**
 * Perform hex decoding
@@ -113,8 +114,34 @@ secure_vector<byte> BOTAN_DLL hex_decode(const char input[],
                    exception if whitespace is encountered
 * @return decoded hex output
 */
-secure_vector<byte> BOTAN_DLL hex_decode(const std::string& input,
-                                         bool ignore_ws = true);
+std::vector<byte> BOTAN_DLL
+hex_decode(const std::string& input,
+           bool ignore_ws = true);
+
+
+/**
+* Perform hex decoding
+* @param input some hex input
+* @param input_length the length of input in bytes
+* @param ignore_ws ignore whitespace on input; if false, throw an
+                   exception if whitespace is encountered
+* @return decoded hex output
+*/
+secure_vector<byte> BOTAN_DLL
+hex_decode_locked(const char input[],
+                  size_t input_length,
+                  bool ignore_ws = true);
+
+/**
+* Perform hex decoding
+* @param input some hex input
+* @param ignore_ws ignore whitespace on input; if false, throw an
+                   exception if whitespace is encountered
+* @return decoded hex output
+*/
+secure_vector<byte> BOTAN_DLL
+hex_decode_locked(const std::string& input,
+                  bool ignore_ws = true);
 
 }
 
diff --git a/src/constructs/tss/tss.cpp b/src/constructs/tss/tss.cpp
index e002084a1..2024b39ec 100644
--- a/src/constructs/tss/tss.cpp
+++ b/src/constructs/tss/tss.cpp
@@ -106,7 +106,7 @@ HashFunction* get_rtss_hash_by_id(byte id)
 
 RTSS_Share::RTSS_Share(const std::string& hex_input)
    {
-   contents = hex_decode(hex_input);
+   contents = hex_decode_locked(hex_input);
    }
 
 byte RTSS_Share::share_id() const
diff --git a/src/math/bigint/big_code.cpp b/src/math/bigint/big_code.cpp
index a55ec662e..d5b1e98ae 100644
--- a/src/math/bigint/big_code.cpp
+++ b/src/math/bigint/big_code.cpp
@@ -120,15 +120,15 @@ BigInt BigInt::decode(const byte buf[], size_t length, Base base)
          const char buf0_with_leading_0[2] =
             { '0', static_cast<char>(buf[0]) };
 
-         binary = hex_decode(buf0_with_leading_0, 2);
+         binary = hex_decode_locked(buf0_with_leading_0, 2);
 
-         binary += hex_decode(reinterpret_cast<const char*>(&buf[1]),
-                              length - 1,
-                              false);
+         binary += hex_decode_locked(reinterpret_cast<const char*>(&buf[1]),
+                                     length - 1,
+                                     false);
          }
       else
-         binary = hex_decode(reinterpret_cast<const char*>(buf),
-                             length, false);
+         binary = hex_decode_locked(reinterpret_cast<const char*>(buf),
+                                    length, false);
 
       r.binary_decode(&binary[0], binary.size());
       }
diff --git a/src/utils/datastor/datastor.cpp b/src/utils/datastor/datastor.cpp
index d65b3f1ac..d32c4787e 100644
--- a/src/utils/datastor/datastor.cpp
+++ b/src/utils/datastor/datastor.cpp
@@ -86,7 +86,7 @@ Data_Store::get1_memvec(const std::string& key) const
       throw Invalid_State("Data_Store::get1_memvec: Multiple values for " +
                           key);
 
-   return unlock(hex_decode(vals[0]));
+   return hex_decode(vals[0]);
    }
 
 /*