Make pk_ops.h internal

Some fixes for missing system_rng in ECIES and tests.

17 files changed, 125 insertions, 49 deletions

diff --git a/src/lib/prov/openssl/openssl.h b/src/lib/prov/openssl/openssl.h
index c7bd5774b..58a7d77dc 100644
--- a/src/lib/prov/openssl/openssl.h
+++ b/src/lib/prov/openssl/openssl.h
@@ -8,7 +8,7 @@
 #ifndef BOTAN_OPENSSL_H__
 #define BOTAN_OPENSSL_H__
 
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <botan/secmem.h>
 #include <botan/exceptn.h>
 #include <memory>
diff --git a/src/lib/prov/pkcs11/p11_ecdh.cpp b/src/lib/prov/pkcs11/p11_ecdh.cpp
index 8d8d79db7..6f88f43d6 100644
--- a/src/lib/prov/pkcs11/p11_ecdh.cpp
+++ b/src/lib/prov/pkcs11/p11_ecdh.cpp
@@ -14,7 +14,7 @@
 #include <botan/ber_dec.h>
 #include <botan/der_enc.h>
 #include <botan/internal/algo_registry.h>
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <botan/rng.h>
 
 namespace Botan {
diff --git a/src/lib/prov/pkcs11/p11_ecdsa.cpp b/src/lib/prov/pkcs11/p11_ecdsa.cpp
index c406fe553..076bb2498 100644
--- a/src/lib/prov/pkcs11/p11_ecdsa.cpp
+++ b/src/lib/prov/pkcs11/p11_ecdsa.cpp
@@ -12,7 +12,7 @@
 
 #include <botan/internal/p11_mechanism.h>
 #include <botan/internal/algo_registry.h>
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <botan/keypair.h>
 #include <botan/rng.h>
 
diff --git a/src/lib/prov/pkcs11/p11_rsa.cpp b/src/lib/prov/pkcs11/p11_rsa.cpp
index c048d9d22..c23c8f5f3 100644
--- a/src/lib/prov/pkcs11/p11_rsa.cpp
+++ b/src/lib/prov/pkcs11/p11_rsa.cpp
@@ -11,9 +11,9 @@
 #if defined(BOTAN_HAS_RSA)
 
 #include <botan/internal/p11_mechanism.h>
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <botan/internal/algo_registry.h>
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <botan/rng.h>
 #include <botan/blinding.h>
 
diff --git a/src/lib/prov/tpm/tpm.cpp b/src/lib/prov/tpm/tpm.cpp
index 20334d75d..7604a9be0 100644
--- a/src/lib/prov/tpm/tpm.cpp
+++ b/src/lib/prov/tpm/tpm.cpp
@@ -11,7 +11,7 @@
 #include <botan/hash_id.h>
 #include <botan/der_enc.h>
 #include <botan/workfactor.h>
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <sstream>
 
 #include <tss/platform.h>
diff --git a/src/lib/pubkey/ecies/ecies.cpp b/src/lib/pubkey/ecies/ecies.cpp
index d2e453bdf..ba7140bd0 100644
--- a/src/lib/pubkey/ecies/ecies.cpp
+++ b/src/lib/pubkey/ecies/ecies.cpp
@@ -96,8 +96,10 @@ ECIES_PrivateKey::create_key_agreement_op(RandomNumberGenerator& /*rng*/,
 * @param for_encryption disable cofactor mode if the secret will be used for encryption
 * (according to ISO 18033 cofactor mode is only used during decryption)
 */
-PK_Key_Agreement create_key_agreement(const PK_Key_Agreement_Key& private_key, const ECIES_KA_Params& ecies_params,
-                                      bool for_encryption)
+PK_Key_Agreement create_key_agreement(const PK_Key_Agreement_Key& private_key,
+                                      const ECIES_KA_Params& ecies_params,
+                                      bool for_encryption,
+                                      RandomNumberGenerator& rng)
    {
    const ECDH_PrivateKey* ecdh_key = dynamic_cast<const ECDH_PrivateKey*>(&private_key);
 
@@ -114,16 +116,18 @@ PK_Key_Agreement create_key_agreement(const PK_Key_Agreement_Key& private_key, c
    if(ecdh_key && (for_encryption || !ecies_params.cofactor_mode()))
       {
       // ECDH_KA_Operation uses cofactor mode: use own key agreement method if cofactor should not be used.
-      return PK_Key_Agreement(ECIES_PrivateKey(*ecdh_key), "Raw");
+      return PK_Key_Agreement(ECIES_PrivateKey(*ecdh_key), rng, "Raw");
       }
 
-   return PK_Key_Agreement(private_key, "Raw");		// use default implementation
+   return PK_Key_Agreement(private_key, rng, "Raw");		// use default implementation
    }
 }
 
-ECIES_KA_Operation::ECIES_KA_Operation(const PK_Key_Agreement_Key& private_key, const ECIES_KA_Params& ecies_params,
-                                       bool for_encryption) :
-   m_ka(create_key_agreement(private_key, ecies_params, for_encryption)),
+ECIES_KA_Operation::ECIES_KA_Operation(const PK_Key_Agreement_Key& private_key,
+                                       const ECIES_KA_Params& ecies_params,
+                                       bool for_encryption,
+                                       RandomNumberGenerator& rng) :
+   m_ka(create_key_agreement(private_key, ecies_params, for_encryption, rng)),
    m_params(ecies_params)
    {
    }
@@ -240,8 +244,10 @@ std::unique_ptr<Cipher_Mode> ECIES_System_Params::create_cipher(Botan::Cipher_Di
 /*
 * ECIES_Encryptor Constructor
 */
-ECIES_Encryptor::ECIES_Encryptor(const PK_Key_Agreement_Key& private_key, const ECIES_System_Params& ecies_params) :
-   m_ka(private_key, ecies_params, true),
+ECIES_Encryptor::ECIES_Encryptor(const PK_Key_Agreement_Key& private_key,
+                                 const ECIES_System_Params& ecies_params,
+                                 RandomNumberGenerator& rng) :
+   m_ka(private_key, ecies_params, true, rng),
    m_params(ecies_params),
    m_eph_public_key_bin(private_key.public_value()),	// returns the uncompressed public key, see conversion below
    m_iv(),
@@ -261,7 +267,7 @@ ECIES_Encryptor::ECIES_Encryptor(const PK_Key_Agreement_Key& private_key, const
 * ECIES_Encryptor Constructor
 */
 ECIES_Encryptor::ECIES_Encryptor(RandomNumberGenerator& rng, const ECIES_System_Params& ecies_params) :
-   ECIES_Encryptor(ECDH_PrivateKey(rng, ecies_params.domain()), ecies_params)
+   ECIES_Encryptor(ECDH_PrivateKey(rng, ecies_params.domain()), ecies_params, rng)
    {
    }
 
@@ -311,8 +317,10 @@ std::vector<byte> ECIES_Encryptor::enc(const byte data[], size_t length, RandomN
    }
 
 
-ECIES_Decryptor::ECIES_Decryptor(const PK_Key_Agreement_Key& key, const ECIES_System_Params& ecies_params) :
-   m_ka(key, ecies_params, false),
+ECIES_Decryptor::ECIES_Decryptor(const PK_Key_Agreement_Key& key,
+                                 const ECIES_System_Params& ecies_params,
+                                 RandomNumberGenerator& rng) :
+   m_ka(key, ecies_params, false, rng),
    m_params(ecies_params),
    m_iv(),
    m_label()
diff --git a/src/lib/pubkey/ecies/ecies.h b/src/lib/pubkey/ecies/ecies.h
index 0bc0bf76e..6b9eba31d 100644
--- a/src/lib/pubkey/ecies/ecies.h
+++ b/src/lib/pubkey/ecies/ecies.h
@@ -184,8 +184,10 @@ class BOTAN_DLL ECIES_KA_Operation
       * @param for_encryption disable cofactor mode if the secret will be used for encryption
       * (according to ISO 18033 cofactor mode is only used during decryption)
       */
-      ECIES_KA_Operation(const PK_Key_Agreement_Key& private_key, const ECIES_KA_Params& ecies_params,
-                         bool for_encryption);
+      ECIES_KA_Operation(const PK_Key_Agreement_Key& private_key,
+                         const ECIES_KA_Params& ecies_params,
+                         bool for_encryption,
+                         RandomNumberGenerator& rng);
 
       /**
       * Performs a key agreement with the provided keys and derives the secret from the result
@@ -211,7 +213,9 @@ class BOTAN_DLL ECIES_Encryptor : public PK_Encryptor
       * @param private_key the (ephemeral) private key which is used for the key agreement
       * @param ecies_params settings for ecies
       */
-      ECIES_Encryptor(const PK_Key_Agreement_Key& private_key, const ECIES_System_Params& ecies_params);
+      ECIES_Encryptor(const PK_Key_Agreement_Key& private_key,
+                      const ECIES_System_Params& ecies_params,
+                      RandomNumberGenerator& rng);
 
       /**
       * Creates an ephemeral private key which is used for the key agreement
@@ -265,7 +269,9 @@ class BOTAN_DLL ECIES_Decryptor : public PK_Decryptor
       * @param private_key the private key which is used for the key agreement
       * @param ecies_params settings for ecies
       */
-      ECIES_Decryptor(const PK_Key_Agreement_Key& private_key, const ECIES_System_Params& ecies_params);
+      ECIES_Decryptor(const PK_Key_Agreement_Key& private_key,
+                      const ECIES_System_Params& ecies_params,
+                      RandomNumberGenerator& rng);
 
       /// Set the initialization vector for the data encryption method
       inline void set_initialization_vector(const InitializationVector& iv)
diff --git a/src/lib/pubkey/info.txt b/src/lib/pubkey/info.txt
index 393e089e2..0e799f372 100644
--- a/src/lib/pubkey/info.txt
+++ b/src/lib/pubkey/info.txt
@@ -14,15 +14,16 @@ x509_key.cpp
 <header:public>
 blinding.h
 pk_keys.h
-pk_ops.h
+pk_ops_fwd.h
 pkcs8.h
 pubkey.h
-x509_key.h
 workfactor.h
+x509_key.h
 </header:public>
 
 <header:internal>
 pk_algs.h
+pk_ops.h
 pk_ops_impl.h
 </header:internal>
 
diff --git a/src/lib/pubkey/mce/mce_internal.h b/src/lib/pubkey/mce/mce_internal.h
index d35479080..526552944 100644
--- a/src/lib/pubkey/mce/mce_internal.h
+++ b/src/lib/pubkey/mce/mce_internal.h
@@ -14,7 +14,7 @@
 
 #include <botan/secmem.h>
 #include <botan/types.h>
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <botan/mceliece.h>
 
 namespace Botan {
diff --git a/src/lib/pubkey/pk_keys.cpp b/src/lib/pubkey/pk_keys.cpp
index 21b56ed81..2c846d623 100644
--- a/src/lib/pubkey/pk_keys.cpp
+++ b/src/lib/pubkey/pk_keys.cpp
@@ -6,7 +6,7 @@
 */
 
 #include <botan/pk_keys.h>
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <botan/der_enc.h>
 #include <botan/oids.h>
 #include <botan/hash.h>
diff --git a/src/lib/pubkey/pk_ops_impl.h b/src/lib/pubkey/pk_ops_impl.h
index 9d02de5e5..5fe5623e7 100644
--- a/src/lib/pubkey/pk_ops_impl.h
+++ b/src/lib/pubkey/pk_ops_impl.h
@@ -7,7 +7,7 @@
 #ifndef BOTAN_PK_OPERATION_IMPL_H__
 #define BOTAN_PK_OPERATION_IMPL_H__
 
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/pubkey.cpp b/src/lib/pubkey/pubkey.cpp
index fa5777bde..178eca282 100644
--- a/src/lib/pubkey/pubkey.cpp
+++ b/src/lib/pubkey/pubkey.cpp
@@ -8,7 +8,7 @@
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/bigint.h>
-#include <botan/pk_ops.h>
+#include <botan/internal/pk_ops.h>
 #include <botan/internal/ct_utils.h>
 
 namespace Botan {
@@ -92,6 +92,8 @@ PK_Encryptor_EME::PK_Encryptor_EME(const Public_Key& key,
    BOTAN_ASSERT_NONNULL(m_op);
    }
 
+PK_Encryptor_EME::~PK_Encryptor_EME() { /* for unique_ptr */ }
+
 std::vector<byte>
 PK_Encryptor_EME::enc(const byte in[], size_t length, RandomNumberGenerator& rng) const
    {
@@ -112,6 +114,8 @@ PK_Decryptor_EME::PK_Decryptor_EME(const Private_Key& key,
    BOTAN_ASSERT_NONNULL(m_op);
    }
 
+PK_Decryptor_EME::~PK_Decryptor_EME() { /* for unique_ptr */ }
+
 secure_vector<byte> PK_Decryptor_EME::do_decrypt(byte& valid_mask,
                                                  const byte in[], size_t in_len) const
    {
@@ -127,6 +131,8 @@ PK_KEM_Encryptor::PK_KEM_Encryptor(const Public_Key& key,
    BOTAN_ASSERT_NONNULL(m_op);
    }
 
+PK_KEM_Encryptor::~PK_KEM_Encryptor() { /* for unique_ptr */ }
+
 void PK_KEM_Encryptor::encrypt(secure_vector<byte>& out_encapsulated_key,
                                secure_vector<byte>& out_shared_key,
                                size_t desired_shared_key_len,
@@ -151,6 +157,8 @@ PK_KEM_Decryptor::PK_KEM_Decryptor(const Private_Key& key,
    BOTAN_ASSERT_NONNULL(m_op);
    }
 
+PK_KEM_Decryptor::~PK_KEM_Decryptor() { /* for unique_ptr */ }
+
 secure_vector<byte> PK_KEM_Decryptor::decrypt(const byte encap_key[],
                                               size_t encap_key_len,
                                               size_t desired_shared_key_len,
@@ -171,6 +179,21 @@ PK_Key_Agreement::PK_Key_Agreement(const Private_Key& key,
    BOTAN_ASSERT_NONNULL(m_op);
    }
 
+PK_Key_Agreement::~PK_Key_Agreement() { /* for unique_ptr */ }
+
+PK_Key_Agreement& PK_Key_Agreement::operator=(PK_Key_Agreement&& other)
+   {
+   if(this != &other)
+      {
+      m_op = std::move(other.m_op);
+      }
+   return (*this);
+   }
+
+PK_Key_Agreement::PK_Key_Agreement(PK_Key_Agreement&& other) :
+   m_op(std::move(other.m_op))
+   {}
+
 SymmetricKey PK_Key_Agreement::derive_key(size_t key_len,
                                           const byte in[], size_t in_len,
                                           const byte salt[],
@@ -232,6 +255,8 @@ PK_Signer::PK_Signer(const Private_Key& key,
    m_sig_format = format;
    }
 
+PK_Signer::~PK_Signer() { /* for unique_ptr */ }
+
 void PK_Signer::update(const byte in[], size_t length)
    {
    m_op->update(in, length);
@@ -261,6 +286,8 @@ PK_Verifier::PK_Verifier(const Public_Key& key,
    m_sig_format = format;
    }
 
+PK_Verifier::~PK_Verifier() { /* for unique_ptr */ }
+
 void PK_Verifier::set_input_format(Signature_Format format)
    {
    if(m_op->message_parts() == 1 && format != IEEE_1363)
diff --git a/src/lib/pubkey/pubkey.h b/src/lib/pubkey/pubkey.h
index 077796a5d..94332c8f0 100644
--- a/src/lib/pubkey/pubkey.h
+++ b/src/lib/pubkey/pubkey.h
@@ -9,7 +9,7 @@
 #define BOTAN_PUBKEY_H__
 
 #include <botan/pk_keys.h>
-#include <botan/pk_ops.h>
+#include <botan/pk_ops_fwd.h>
 #include <botan/symkey.h>
 #include <botan/rng.h>
 #include <botan/eme.h>
@@ -71,7 +71,6 @@ class BOTAN_DLL PK_Encryptor
       virtual ~PK_Encryptor() {}
 
       PK_Encryptor(const PK_Encryptor&) = delete;
-
       PK_Encryptor& operator=(const PK_Encryptor&) = delete;
 
    private:
@@ -158,7 +157,7 @@ class BOTAN_DLL PK_Decryptor
 * messages. Use multiple calls update() to process large messages and
 * generate the signature by finally calling signature().
 */
-class BOTAN_DLL PK_Signer
+class BOTAN_DLL PK_Signer final
    {
    public:
 
@@ -192,6 +191,11 @@ class BOTAN_DLL PK_Signer
          {}
 #endif
 
+      ~PK_Signer();
+
+      PK_Signer(const PK_Signer&) = delete;
+      PK_Signer& operator=(const PK_Signer&) = delete;
+
       /**
       * Sign a message all in one go
       * @param in the message to sign as a byte array
@@ -271,7 +275,7 @@ class BOTAN_DLL PK_Signer
 * messages. Use multiple calls update() to process large messages and
 * verify the signature by finally calling check_signature().
 */
-class BOTAN_DLL PK_Verifier
+class BOTAN_DLL PK_Verifier final
    {
    public:
       /**
@@ -285,6 +289,11 @@ class BOTAN_DLL PK_Verifier
                   Signature_Format format = IEEE_1363,
                   const std::string& provider = "");
 
+      ~PK_Verifier();
+
+      PK_Verifier& operator=(const PK_Verifier&) = delete;
+      PK_Verifier(const PK_Verifier&) = delete;
+
       /**
       * Verify a signature.
       * @param msg the message that the signature belongs to, as a byte array
@@ -376,7 +385,7 @@ class BOTAN_DLL PK_Verifier
 /**
 * Key used for key agreement
 */
-class BOTAN_DLL PK_Key_Agreement
+class BOTAN_DLL PK_Key_Agreement final
    {
    public:
 
@@ -406,6 +415,15 @@ class BOTAN_DLL PK_Key_Agreement
          {}
 #endif
 
+      ~PK_Key_Agreement();
+
+      // For ECIES
+      PK_Key_Agreement& operator=(PK_Key_Agreement&&);
+      PK_Key_Agreement(PK_Key_Agreement&&);
+
+      PK_Key_Agreement& operator=(const PK_Key_Agreement&) = delete;
+      PK_Key_Agreement(const PK_Key_Agreement&) = delete;
+
       /*
       * Perform Key Agreement Operation
       * @param key_len the desired key output size
@@ -476,7 +494,7 @@ class BOTAN_DLL PK_Key_Agreement
 * Encryption using a standard message recovery algorithm like RSA or
 * ElGamal, paired with an encoding scheme like OAEP.
 */
-class BOTAN_DLL PK_Encryptor_EME : public PK_Encryptor
+class BOTAN_DLL PK_Encryptor_EME final : public PK_Encryptor
    {
    public:
       size_t maximum_input_size() const override;
@@ -504,6 +522,10 @@ class BOTAN_DLL PK_Encryptor_EME : public PK_Encryptor
          PK_Encryptor_EME(key, system_rng(), padding, provider) {}
 #endif
 
+      ~PK_Encryptor_EME();
+
+      PK_Encryptor_EME& operator=(const PK_Encryptor_EME&) = delete;
+      PK_Encryptor_EME(const PK_Encryptor_EME&) = delete;
    private:
       std::vector<byte> enc(const byte[], size_t,
                              RandomNumberGenerator& rng) const override;
@@ -514,7 +536,7 @@ class BOTAN_DLL PK_Encryptor_EME : public PK_Encryptor
 /**
 * Decryption with an MR algorithm and an EME.
 */
-class BOTAN_DLL PK_Decryptor_EME : public PK_Decryptor
+class BOTAN_DLL PK_Decryptor_EME final : public PK_Decryptor
    {
    public:
      /**
@@ -542,6 +564,9 @@ class BOTAN_DLL PK_Decryptor_EME : public PK_Decryptor
          PK_Decryptor_EME(key, system_rng(), eme, provider) {}
 #endif
 
+      ~PK_Decryptor_EME();
+      PK_Decryptor_EME& operator=(const PK_Decryptor_EME&) = delete;
+      PK_Decryptor_EME(const PK_Decryptor_EME&) = delete;
    private:
       secure_vector<byte> do_decrypt(byte& valid_mask,
                                      const byte in[],
@@ -550,7 +575,7 @@ class BOTAN_DLL PK_Decryptor_EME : public PK_Decryptor
       std::unique_ptr<PK_Ops::Decryption> m_op;
    };
 
-class BOTAN_DLL PK_KEM_Encryptor
+class BOTAN_DLL PK_KEM_Encryptor final
    {
    public:
       PK_KEM_Encryptor(const Public_Key& key,
@@ -566,6 +591,11 @@ class BOTAN_DLL PK_KEM_Encryptor
          PK_KEM_Encryptor(key, system_rng(), kem_param, provider) {}
 #endif
 
+      ~PK_KEM_Encryptor();
+
+      PK_KEM_Encryptor& operator=(const PK_KEM_Encryptor&) = delete;
+      PK_KEM_Encryptor(const PK_KEM_Encryptor&) = delete;
+
       void encrypt(secure_vector<byte>& out_encapsulated_key,
                    secure_vector<byte>& out_shared_key,
                    size_t desired_shared_key_len,
@@ -604,7 +634,7 @@ class BOTAN_DLL PK_KEM_Encryptor
       std::unique_ptr<PK_Ops::KEM_Encryption> m_op;
    };
 
-class BOTAN_DLL PK_KEM_Decryptor
+class BOTAN_DLL PK_KEM_Decryptor final
    {
    public:
       PK_KEM_Decryptor(const Private_Key& key,
@@ -621,6 +651,10 @@ class BOTAN_DLL PK_KEM_Decryptor
          {}
 #endif
 
+      ~PK_KEM_Decryptor();
+      PK_KEM_Decryptor& operator=(const PK_KEM_Decryptor&) = delete;
+      PK_KEM_Decryptor(const PK_KEM_Decryptor&) = delete;
+
       secure_vector<byte> decrypt(const byte encap_key[],
                                   size_t encap_key_len,
                                   size_t desired_shared_key_len,
diff --git a/src/tests/test_ecies.cpp b/src/tests/test_ecies.cpp
index dea9b6266..0cbc5c2b4 100644
--- a/src/tests/test_ecies.cpp
+++ b/src/tests/test_ecies.cpp
@@ -54,9 +54,9 @@ void check_encrypt_decrypt(Test::Result& result, const Botan::ECDH_PrivateKey& p
                            const Botan::InitializationVector& iv, const std::string& label,
                            const std::vector<byte>& plaintext, const std::vector<byte>& ciphertext)
    {
-   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params);
+   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params, Test::rng());
    ecies_enc.set_other_key(other_private_key.public_point());
-   Botan::ECIES_Decryptor ecies_dec(other_private_key, ecies_params);
+   Botan::ECIES_Decryptor ecies_dec(other_private_key, ecies_params, Test::rng());
    if(!iv.bits_of().empty())
       {
       ecies_enc.set_initialization_vector(iv);
@@ -150,7 +150,7 @@ class ECIES_ISO_Tests : public Text_Based_Test
          // test secret derivation: ISO 18033 test vectors use KDF1 from ISO 18033
          // no cofactor-/oldcofactor-/singlehash-/check-mode and 128 byte secret length
          Botan::ECIES_KA_Params ka_params(eph_private_key.domain(), "KDF1-18033(SHA-1)", 128, compression_type, Flags::NONE);
-         const Botan::ECIES_KA_Operation ka(eph_private_key, ka_params, true);
+         const Botan::ECIES_KA_Operation ka(eph_private_key, ka_params, true, Test::rng());
          const Botan::SymmetricKey secret_key = ka.derive_secret(eph_public_key_bin, other_public_key_point);
          result.test_eq("derived secret key", secret_key.bits_of(), k);
 
@@ -266,7 +266,7 @@ Test::Result test_other_key_not_set()
          "HMAC(SHA-512)", 20, Botan::PointGFp::Compression_Type::COMPRESSED,
          flags);
 
-   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params);
+   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params, Test::rng());
 
    result.test_throws("encrypt not possible without setting other public key", [ &ecies_enc ]()
       {
@@ -291,7 +291,7 @@ Test::Result test_kdf_not_found()
          "HMAC(SHA-512)", 20, Botan::PointGFp::Compression_Type::COMPRESSED,
          flags);
 
-   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params);
+   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params, Test::rng());
 
    result.test_throws("kdf not found", [ &ecies_enc ]()
       {
@@ -316,7 +316,7 @@ Test::Result test_mac_not_found()
          "XYZMAC(SHA-512)", 20, Botan::PointGFp::Compression_Type::COMPRESSED,
          flags);
 
-   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params);
+   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params, Test::rng());
 
    result.test_throws("mac not found", [ &ecies_enc ]()
       {
@@ -341,7 +341,7 @@ Test::Result test_cipher_not_found()
          "HMAC(SHA-512)", 20, Botan::PointGFp::Compression_Type::COMPRESSED,
          flags);
 
-   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params);
+   Botan::ECIES_Encryptor ecies_enc(private_key, ecies_params, Test::rng());
 
    result.test_throws("cipher not found", [ &ecies_enc ]()
       {
@@ -409,7 +409,7 @@ Test::Result test_ciphertext_too_short()
    const Botan::ECIES_System_Params ecies_params(private_key.domain(), "KDF1-18033(SHA-512)", "AES-256/CBC", 32,
          "HMAC(SHA-512)", 16);
 
-   Botan::ECIES_Decryptor ecies_dec(other_private_key, ecies_params);
+   Botan::ECIES_Decryptor ecies_dec(other_private_key, ecies_params, Test::rng());
 
    result.test_throws("ciphertext too short", [ &ecies_dec ]()
       {
diff --git a/src/tests/test_pubkey.cpp b/src/tests/test_pubkey.cpp
index 0532eee03..745b18614 100644
--- a/src/tests/test_pubkey.cpp
+++ b/src/tests/test_pubkey.cpp
@@ -102,7 +102,7 @@ PK_Signature_Generation_Test::run_one_test(const std::string&, const VarMap& var
 
       try
          {
-         signer.reset(new Botan::PK_Signer(*privkey, padding, Botan::IEEE_1363, sign_provider));
+         signer.reset(new Botan::PK_Signer(*privkey, Test::rng(), padding, Botan::IEEE_1363, sign_provider));
          }
       catch(Botan::Lookup_Error&)
          {
diff --git a/src/tests/unit_tls.cpp b/src/tests/unit_tls.cpp
index 445077490..28abe2d42 100644
--- a/src/tests/unit_tls.cpp
+++ b/src/tests/unit_tls.cpp
@@ -326,7 +326,7 @@ Test::Result test_tls_handshake(Botan::TLS::Protocol_Version offer_version,
                if(client->is_active() && client_sent.empty())
                   {
                   // Choose random application data to send
-                  const size_t c_len = 1 + (static_cast<size_t>(rng.next_byte()) << 4) ^ rng.next_byte();
+                  const size_t c_len = 1 + ((static_cast<size_t>(rng.next_byte()) << 4) ^ rng.next_byte());
                   client_sent = unlock(rng.random_vec(c_len));
 
                   size_t sent_so_far = 0;
@@ -345,7 +345,7 @@ Test::Result test_tls_handshake(Botan::TLS::Protocol_Version offer_version,
                   {
                   result.test_eq("server->protocol", server->next_protocol(), "test/3");
 
-                  const size_t s_len = 1 + (static_cast<size_t>(rng.next_byte()) << 4) ^ rng.next_byte();
+                  const size_t s_len = 1 + ((static_cast<size_t>(rng.next_byte()) << 4) ^ rng.next_byte());
                   server_sent = unlock(rng.random_vec(s_len));
 
                   size_t sent_so_far = 0;
diff --git a/src/tests/unit_x509.cpp b/src/tests/unit_x509.cpp
index 35718d90d..26545bbdf 100644
--- a/src/tests/unit_x509.cpp
+++ b/src/tests/unit_x509.cpp
@@ -496,7 +496,7 @@ Test::Result test_self_issued(const std::string& sig_algo, const std::string& ha
                                            Test::rng());
 
    /* Create the CA object */
-   Botan::X509_CA ca(ca_cert, *ca_key, hash_fn);
+   Botan::X509_CA ca(ca_cert, *ca_key, hash_fn, Test::rng());
 
    std::unique_ptr<Botan::Private_Key> user_key(make_a_private_key(sig_algo));