Add checks that keyed algorithms are actually keyed before use

Previously calling update or encrypt without calling set_key first
would result in invalid outputs or else crashing.

20 files changed, 99 insertions, 9 deletions

diff --git a/src/lib/block/aes/aes.cpp b/src/lib/block/aes/aes.cpp
index 8a82ad942..9c375c362 100644
--- a/src/lib/block/aes/aes.cpp
+++ b/src/lib/block/aes/aes.cpp
@@ -452,6 +452,8 @@ size_t AES_256::parallelism() const { return aes_parallelism(); }
 
 void AES_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
 #if defined(BOTAN_HAS_AES_NI)
    if(CPUID::has_aes_ni())
       {
@@ -478,6 +480,8 @@ void AES_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 
 void AES_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_DK.empty() == false);
+
 #if defined(BOTAN_HAS_AES_NI)
    if(CPUID::has_aes_ni())
       {
@@ -531,6 +535,8 @@ void AES_128::clear()
 
 void AES_192::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
 #if defined(BOTAN_HAS_AES_NI)
    if(CPUID::has_aes_ni())
       {
@@ -557,6 +563,8 @@ void AES_192::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 
 void AES_192::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_DK.empty() == false);
+
 #if defined(BOTAN_HAS_AES_NI)
    if(CPUID::has_aes_ni())
       {
@@ -610,6 +618,8 @@ void AES_192::clear()
 
 void AES_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
 #if defined(BOTAN_HAS_AES_NI)
    if(CPUID::has_aes_ni())
       {
@@ -636,6 +646,8 @@ void AES_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 
 void AES_256::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_DK.empty() == false);
+
 #if defined(BOTAN_HAS_AES_NI)
    if(CPUID::has_aes_ni())
       {
diff --git a/src/lib/block/blowfish/blowfish.cpp b/src/lib/block/blowfish/blowfish.cpp
index 68d73cafd..c2634bba4 100644
--- a/src/lib/block/blowfish/blowfish.cpp
+++ b/src/lib/block/blowfish/blowfish.cpp
@@ -197,6 +197,8 @@ const uint32_t S_INIT[1024] = {
 */
 void Blowfish::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_S.empty() == false);
+
    const uint32_t* S1 = &m_S[0];
    const uint32_t* S2 = &m_S[256];
    const uint32_t* S3 = &m_S[512];
@@ -229,6 +231,8 @@ void Blowfish::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void Blowfish::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_S.empty() == false);
+
    const uint32_t* S1 = &m_S[0];
    const uint32_t* S2 = &m_S[256];
    const uint32_t* S3 = &m_S[512];
diff --git a/src/lib/block/camellia/camellia.cpp b/src/lib/block/camellia/camellia.cpp
index 89db6f8b9..9281cd859 100644
--- a/src/lib/block/camellia/camellia.cpp
+++ b/src/lib/block/camellia/camellia.cpp
@@ -854,31 +854,37 @@ void key_schedule(secure_vector<uint64_t>& SK, const uint8_t key[], size_t lengt
 
 void Camellia_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_SK.empty() == false);
    Camellia_F::encrypt(in, out, blocks, m_SK, 9);
    }
 
 void Camellia_192::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_SK.empty() == false);
    Camellia_F::encrypt(in, out, blocks, m_SK, 12);
    }
 
 void Camellia_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_SK.empty() == false);
    Camellia_F::encrypt(in, out, blocks, m_SK, 12);
    }
 
 void Camellia_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_SK.empty() == false);
    Camellia_F::decrypt(in, out, blocks, m_SK, 9);
    }
 
 void Camellia_192::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_SK.empty() == false);
    Camellia_F::decrypt(in, out, blocks, m_SK, 12);
    }
 
 void Camellia_256::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_SK.empty() == false);
    Camellia_F::decrypt(in, out, blocks, m_SK, 12);
    }
 
diff --git a/src/lib/block/cast/cast128.cpp b/src/lib/block/cast/cast128.cpp
index 5ad732eb3..f7910f034 100644
--- a/src/lib/block/cast/cast128.cpp
+++ b/src/lib/block/cast/cast128.cpp
@@ -50,6 +50,8 @@ inline uint32_t R3(uint32_t R, uint32_t MK, uint8_t RK)
 */
 void CAST_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_RK.empty() == false);
+
    BOTAN_PARALLEL_FOR(size_t i = 0; i < blocks; ++i)
       {
       uint32_t L, R;
@@ -81,6 +83,8 @@ void CAST_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void CAST_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_RK.empty() == false);
+
    BOTAN_PARALLEL_FOR(size_t i = 0; i < blocks; ++i)
       {
       uint32_t L, R;
diff --git a/src/lib/block/cast/cast256.cpp b/src/lib/block/cast/cast256.cpp
index b4aa49166..cd5175dd7 100644
--- a/src/lib/block/cast/cast256.cpp
+++ b/src/lib/block/cast/cast256.cpp
@@ -50,6 +50,8 @@ void round3(uint32_t& out, uint32_t in, uint32_t MK, uint32_t RK)
 */
 void CAST_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_RK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint32_t A = load_be<uint32_t>(in, 0);
@@ -94,6 +96,8 @@ void CAST_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void CAST_256::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_RK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint32_t A = load_be<uint32_t>(in, 0);
diff --git a/src/lib/block/des/des.cpp b/src/lib/block/des/des.cpp
index 15c2adb66..2881cfa9a 100644
--- a/src/lib/block/des/des.cpp
+++ b/src/lib/block/des/des.cpp
@@ -144,6 +144,8 @@ void des_decrypt(uint32_t& L, uint32_t& R,
 */
 void DES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_round_key.empty() == false);
+
    for(size_t i = 0; i < blocks; ++i)
       {
       uint64_t T = (DES_IPTAB1[in[8*i+0]]     ) | (DES_IPTAB1[in[8*i+1]] << 1) |
@@ -171,6 +173,8 @@ void DES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void DES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_round_key.empty() == false);
+
    for(size_t i = 0; i < blocks; ++i)
       {
       uint64_t T = (DES_IPTAB1[in[BLOCK_SIZE*i+0]]     ) | (DES_IPTAB1[in[BLOCK_SIZE*i+1]] << 1) |
@@ -213,6 +217,8 @@ void DES::clear()
 */
 void TripleDES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_round_key.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint64_t T = (DES_IPTAB1[in[0]]     ) | (DES_IPTAB1[in[1]] << 1) |
@@ -246,6 +252,8 @@ void TripleDES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) cons
 */
 void TripleDES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_round_key.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint64_t T = (DES_IPTAB1[in[0]]     ) | (DES_IPTAB1[in[1]] << 1) |
diff --git a/src/lib/block/des/desx.cpp b/src/lib/block/des/desx.cpp
index 7c9995523..e869b3ebf 100644
--- a/src/lib/block/des/desx.cpp
+++ b/src/lib/block/des/desx.cpp
@@ -14,6 +14,8 @@ namespace Botan {
 */
 void DESX::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_K1.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       xor_buf(out, in, m_K1.data(), BLOCK_SIZE);
@@ -30,6 +32,8 @@ void DESX::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void DESX::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_K1.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       xor_buf(out, in, m_K2.data(), BLOCK_SIZE);
diff --git a/src/lib/block/gost_28147/gost_28147.cpp b/src/lib/block/gost_28147/gost_28147.cpp
index ffe9b5d66..b46d162de 100644
--- a/src/lib/block/gost_28147/gost_28147.cpp
+++ b/src/lib/block/gost_28147/gost_28147.cpp
@@ -111,6 +111,8 @@ std::string GOST_28147_89::name() const
 */
 void GOST_28147_89::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint32_t N1 = load_le<uint32_t>(in, 0);
@@ -141,6 +143,8 @@ void GOST_28147_89::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks)
 */
 void GOST_28147_89::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint32_t N1 = load_le<uint32_t>(in, 0);
diff --git a/src/lib/block/idea/idea.cpp b/src/lib/block/idea/idea.cpp
index c0364b325..26bd24690 100644
--- a/src/lib/block/idea/idea.cpp
+++ b/src/lib/block/idea/idea.cpp
@@ -137,6 +137,8 @@ std::string IDEA::provider() const
 */
 void IDEA::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
 #if defined(BOTAN_HAS_IDEA_SSE2)
    if(CPUID::has_sse2())
       {
@@ -158,6 +160,8 @@ void IDEA::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void IDEA::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_DK.empty() == false);
+
 #if defined(BOTAN_HAS_IDEA_SSE2)
    if(CPUID::has_sse2())
       {
diff --git a/src/lib/block/kasumi/kasumi.cpp b/src/lib/block/kasumi/kasumi.cpp
index a9b5d8274..a40a9d9d5 100644
--- a/src/lib/block/kasumi/kasumi.cpp
+++ b/src/lib/block/kasumi/kasumi.cpp
@@ -110,6 +110,8 @@ uint16_t FI(uint16_t I, uint16_t K)
 */
 void KASUMI::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint16_t B0 = load_be<uint16_t>(in, 0);
@@ -154,6 +156,8 @@ void KASUMI::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void KASUMI::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint16_t B0 = load_be<uint16_t>(in, 0);
diff --git a/src/lib/block/lion/lion.cpp b/src/lib/block/lion/lion.cpp
index 7959de585..cd7d25d9c 100644
--- a/src/lib/block/lion/lion.cpp
+++ b/src/lib/block/lion/lion.cpp
@@ -14,6 +14,8 @@ namespace Botan {
 */
 void Lion::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_key1.empty() == false);
+
    const size_t LEFT_SIZE = left_size();
    const size_t RIGHT_SIZE = right_size();
 
@@ -44,6 +46,8 @@ void Lion::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void Lion::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_key1.empty() == false);
+
    const size_t LEFT_SIZE = left_size();
    const size_t RIGHT_SIZE = right_size();
 
@@ -77,6 +81,11 @@ void Lion::key_schedule(const uint8_t key[], size_t length)
    clear();
 
    const size_t half = length / 2;
+
+   m_key1.resize(left_size());
+   m_key2.resize(left_size());
+   clear_mem(m_key1.data(), m_key1.size());
+   clear_mem(m_key2.data(), m_key2.size());
    copy_mem(m_key1.data(), key, half);
    copy_mem(m_key2.data(), key + half, half);
    }
@@ -104,8 +113,8 @@ BlockCipher* Lion::clone() const
 */
 void Lion::clear()
    {
-   zeroise(m_key1);
-   zeroise(m_key2);
+   zap(m_key1);
+   zap(m_key2);
    m_hash->clear();
    m_cipher->clear();
    }
@@ -123,9 +132,6 @@ Lion::Lion(HashFunction* hash, StreamCipher* cipher, size_t bs) :
 
    if(!m_cipher->valid_keylength(left_size()))
       throw Invalid_Argument(name() + ": This stream/hash combo is invalid");
-
-   m_key1.resize(left_size());
-   m_key2.resize(left_size());
    }
 
 }
diff --git a/src/lib/block/misty1/misty1.cpp b/src/lib/block/misty1/misty1.cpp
index eaef86c8c..e7ebffa6e 100644
--- a/src/lib/block/misty1/misty1.cpp
+++ b/src/lib/block/misty1/misty1.cpp
@@ -103,6 +103,8 @@ uint16_t FI(uint16_t input, uint16_t key7, uint16_t key9)
 */
 void MISTY1::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint16_t B0 = load_be<uint16_t>(in, 0);
@@ -153,6 +155,8 @@ void MISTY1::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void MISTY1::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_DK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint16_t B0 = load_be<uint16_t>(in, 2);
diff --git a/src/lib/block/noekeon/noekeon.cpp b/src/lib/block/noekeon/noekeon.cpp
index a7f60a0fd..5fd5be82a 100644
--- a/src/lib/block/noekeon/noekeon.cpp
+++ b/src/lib/block/noekeon/noekeon.cpp
@@ -110,6 +110,8 @@ const uint8_t Noekeon::RC[] = {
 */
 void Noekeon::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
 #if defined(BOTAN_HAS_NOEKEON_SIMD)
    if(CPUID::has_simd_32())
       {
@@ -161,6 +163,8 @@ void Noekeon::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void Noekeon::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_DK.empty() == false);
+
 #if defined(BOTAN_HAS_NOEKEON_SIMD)
    if(CPUID::has_simd_32())
       {
diff --git a/src/lib/block/seed/seed.cpp b/src/lib/block/seed/seed.cpp
index 700283042..81194e44a 100644
--- a/src/lib/block/seed/seed.cpp
+++ b/src/lib/block/seed/seed.cpp
@@ -208,6 +208,8 @@ inline uint32_t SEED_G(uint32_t X)
 */
 void SEED::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_K.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint32_t B0 = load_be<uint32_t>(in, 0);
@@ -246,6 +248,8 @@ void SEED::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void SEED::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_K.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint32_t B0 = load_be<uint32_t>(in, 0);
diff --git a/src/lib/block/serpent/serpent.cpp b/src/lib/block/serpent/serpent.cpp
index 6e1d79766..39968e87e 100644
--- a/src/lib/block/serpent/serpent.cpp
+++ b/src/lib/block/serpent/serpent.cpp
@@ -57,6 +57,8 @@ inline void i_transform(uint32_t& B0, uint32_t& B1, uint32_t& B2, uint32_t& B3)
 */
 void Serpent::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_round_key.empty() == false);
+
 #if defined(BOTAN_HAS_SERPENT_SIMD)
    if(CPUID::has_simd_32())
       {
@@ -117,6 +119,8 @@ void Serpent::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void Serpent::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_round_key.empty() == false);
+
 #if defined(BOTAN_HAS_SERPENT_SIMD)
    if(CPUID::has_simd_32())
       {
diff --git a/src/lib/block/shacal2/shacal2.cpp b/src/lib/block/shacal2/shacal2.cpp
index 12c87c426..dd4224ed4 100644
--- a/src/lib/block/shacal2/shacal2.cpp
+++ b/src/lib/block/shacal2/shacal2.cpp
@@ -44,6 +44,8 @@ inline void SHACAL2_Rev(uint32_t A, uint32_t B, uint32_t C, uint32_t& D,
 */
 void SHACAL2::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_RK.empty() == false);
+
 #if defined(BOTAN_HAS_SHACAL2_X86)
    if(CPUID::has_intel_sha())
       {
@@ -99,6 +101,8 @@ void SHACAL2::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void SHACAL2::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_RK.empty() == false);
+
 #if defined(BOTAN_HAS_SHACAL2_SIMD)
    if(CPUID::has_simd_32())
       {
diff --git a/src/lib/block/sm4/sm4.cpp b/src/lib/block/sm4/sm4.cpp
index 2902d514c..7c409d40f 100644
--- a/src/lib/block/sm4/sm4.cpp
+++ b/src/lib/block/sm4/sm4.cpp
@@ -124,6 +124,8 @@ inline uint32_t SM4_Tp(uint32_t b)
 */
 void SM4::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_RK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint32_t B0 = load_be<uint32_t>(in, 0);
@@ -152,6 +154,8 @@ void SM4::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void SM4::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_RK.empty() == false);
+
    for(size_t i = 0; i != blocks; ++i)
       {
       uint32_t B0 = load_be<uint32_t>(in, 0);
diff --git a/src/lib/block/threefish/threefish.cpp b/src/lib/block/threefish/threefish.cpp
index 804d6003a..60f793d64 100644
--- a/src/lib/block/threefish/threefish.cpp
+++ b/src/lib/block/threefish/threefish.cpp
@@ -124,8 +124,7 @@ std::string Threefish_512::provider() const
 
 void Threefish_512::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
-   BOTAN_ASSERT(m_K.size() == 9, "Key was set");
-   BOTAN_ASSERT(m_T.size() == 3, "Tweak was set");
+   verify_key_set(m_K.empty() == false);
 
 #if defined(BOTAN_HAS_THREEFISH_512_AVX2)
    if(CPUID::has_avx2())
@@ -161,8 +160,7 @@ void Threefish_512::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks)
 
 void Threefish_512::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
-   BOTAN_ASSERT(m_K.size() == 9, "Key was set");
-   BOTAN_ASSERT(m_T.size() == 3, "Tweak was set");
+   verify_key_set(m_K.empty() == false);
 
 #if defined(BOTAN_HAS_THREEFISH_512_AVX2)
    if(CPUID::has_avx2())
diff --git a/src/lib/block/twofish/twofish.cpp b/src/lib/block/twofish/twofish.cpp
index 3a09af8da..496c31a36 100644
--- a/src/lib/block/twofish/twofish.cpp
+++ b/src/lib/block/twofish/twofish.cpp
@@ -19,6 +19,8 @@ namespace Botan {
 */
 void Twofish::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_SB.empty() == false);
+
    BOTAN_PARALLEL_FOR(size_t i = 0; i < blocks; ++i)
       {
       uint32_t A, B, C, D;
@@ -70,6 +72,8 @@ void Twofish::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void Twofish::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_SB.empty() == false);
+
    BOTAN_PARALLEL_FOR(size_t i = 0; i < blocks; ++i)
       {
       uint32_t A, B, C, D;
diff --git a/src/lib/block/xtea/xtea.cpp b/src/lib/block/xtea/xtea.cpp
index b53de448b..679ad4cfb 100644
--- a/src/lib/block/xtea/xtea.cpp
+++ b/src/lib/block/xtea/xtea.cpp
@@ -15,6 +15,8 @@ namespace Botan {
 */
 void XTEA::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
    const uint32_t* EK = &m_EK[0];
 
    const size_t blocks4 = blocks / 4;
@@ -61,6 +63,8 @@ void XTEA::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
 */
 void XTEA::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
    {
+   verify_key_set(m_EK.empty() == false);
+
    const uint32_t* EK = &m_EK[0];
 
    const size_t blocks4 = blocks / 4;