Merge branch 'master' of https://github.com/randombit/botan

13 files changed, 434 insertions, 267 deletions

diff --git a/src/cmd/fuzzer.cpp b/src/cmd/fuzzer.cpp
index 2bbffd288..3174c76b8 100644
--- a/src/cmd/fuzzer.cpp
+++ b/src/cmd/fuzzer.cpp
@@ -39,7 +39,7 @@ class Fuzzer_Creds : public Credentials_Manager
          }
 
       std::string psk_identity_hint(const std::string&, const std::string&) override { return "psk_hint"; }
-      std::string psk_identity(const std::string&, const std::string&) { return "psk_id"; }
+      std::string psk_identity(const std::string&, const std::string&, const std::string&) override { return "psk_id"; }
       SymmetricKey psk(const std::string&, const std::string&, const std::string&) override
          {
          return SymmetricKey("AABBCCDDEEFF00112233445566778899");
diff --git a/src/lib/filters/secqueue.cpp b/src/lib/filters/secqueue.cpp
index 718223876..120e8dd0d 100644
--- a/src/lib/filters/secqueue.cpp
+++ b/src/lib/filters/secqueue.cpp
@@ -60,9 +60,9 @@ class SecureQueueNode
 */
 SecureQueue::SecureQueue()
    {
-   bytes_read = 0;
+   m_bytes_read = 0;
    set_next(nullptr, 0);
-   head = tail = new SecureQueueNode;
+   m_head = m_tail = new SecureQueueNode;
    }
 
 /*
@@ -71,11 +71,11 @@ SecureQueue::SecureQueue()
 SecureQueue::SecureQueue(const SecureQueue& input) :
    Fanout_Filter(), DataSource()
    {
-   bytes_read = 0;
+   m_bytes_read = 0;
    set_next(nullptr, 0);
 
-   head = tail = new SecureQueueNode;
-   SecureQueueNode* temp = input.head;
+   m_head = m_tail = new SecureQueueNode;
+   SecureQueueNode* temp = input.m_head;
    while(temp)
       {
       write(&temp->buffer[temp->start], temp->end - temp->start);
@@ -88,14 +88,14 @@ SecureQueue::SecureQueue(const SecureQueue& input) :
 */
 void SecureQueue::destroy()
    {
-   SecureQueueNode* temp = head;
+   SecureQueueNode* temp = m_head;
    while(temp)
       {
       SecureQueueNode* holder = temp->next;
       delete temp;
       temp = holder;
       }
-   head = tail = nullptr;
+   m_head = m_tail = nullptr;
    }
 
 /*
@@ -104,8 +104,8 @@ void SecureQueue::destroy()
 SecureQueue& SecureQueue::operator=(const SecureQueue& input)
    {
    destroy();
-   head = tail = new SecureQueueNode;
-   SecureQueueNode* temp = input.head;
+   m_head = m_tail = new SecureQueueNode;
+   SecureQueueNode* temp = input.m_head;
    while(temp)
       {
       write(&temp->buffer[temp->start], temp->end - temp->start);
@@ -119,17 +119,17 @@ SecureQueue& SecureQueue::operator=(const SecureQueue& input)
 */
 void SecureQueue::write(const byte input[], size_t length)
    {
-   if(!head)
-      head = tail = new SecureQueueNode;
+   if(!m_head)
+      m_head = m_tail = new SecureQueueNode;
    while(length)
       {
-      const size_t n = tail->write(input, length);
+      const size_t n = m_tail->write(input, length);
       input += n;
       length -= n;
       if(length)
          {
-         tail->next = new SecureQueueNode;
-         tail = tail->next;
+         m_tail->next = new SecureQueueNode;
+         m_tail = m_tail->next;
          }
       }
    }
@@ -140,20 +140,20 @@ void SecureQueue::write(const byte input[], size_t length)
 size_t SecureQueue::read(byte output[], size_t length)
    {
    size_t got = 0;
-   while(length && head)
+   while(length && m_head)
       {
-      const size_t n = head->read(output, length);
+      const size_t n = m_head->read(output, length);
       output += n;
       got += n;
       length -= n;
-      if(head->size() == 0)
+      if(m_head->size() == 0)
          {
-         SecureQueueNode* holder = head->next;
-         delete head;
-         head = holder;
+         SecureQueueNode* holder = m_head->next;
+         delete m_head;
+         m_head = holder;
          }
       }
-   bytes_read += got;
+   m_bytes_read += got;
    return got;
    }
 
@@ -162,7 +162,7 @@ size_t SecureQueue::read(byte output[], size_t length)
 */
 size_t SecureQueue::peek(byte output[], size_t length, size_t offset) const
    {
-   SecureQueueNode* current = head;
+   SecureQueueNode* current = m_head;
 
    while(offset && current)
       {
@@ -193,7 +193,7 @@ size_t SecureQueue::peek(byte output[], size_t length, size_t offset) const
 */
 size_t SecureQueue::get_bytes_read() const
    {
-   return bytes_read;
+   return m_bytes_read;
    }
 
 /*
@@ -201,7 +201,7 @@ size_t SecureQueue::get_bytes_read() const
 */
 size_t SecureQueue::size() const
    {
-   SecureQueueNode* current = head;
+   SecureQueueNode* current = m_head;
    size_t count = 0;
 
    while(current)
diff --git a/src/lib/filters/secqueue.h b/src/lib/filters/secqueue.h
index b548f367f..33afd478a 100644
--- a/src/lib/filters/secqueue.h
+++ b/src/lib/filters/secqueue.h
@@ -32,7 +32,7 @@ class BOTAN_DLL SecureQueue : public Fanout_Filter, public DataSource
 
       bool empty() const;
 
-      bool check_available(size_t n) { return n <= size(); }
+      bool check_available(size_t n) override { return n <= size(); }
 
       /**
       * @return number of bytes available in the queue
@@ -59,11 +59,12 @@ class BOTAN_DLL SecureQueue : public Fanout_Filter, public DataSource
       SecureQueue(const SecureQueue& other);
 
       ~SecureQueue() { destroy(); }
+
    private:
-      size_t bytes_read;
       void destroy();
-      class SecureQueueNode* head;
-      class SecureQueueNode* tail;
+      size_t m_bytes_read;
+      class SecureQueueNode* m_head;
+      class SecureQueueNode* m_tail;
    };
 
 }
diff --git a/src/tests/catchy/catchy_tests.h b/src/tests/catchy/catchy_tests.h
new file mode 100644
index 000000000..f1170fa71
--- /dev/null
+++ b/src/tests/catchy/catchy_tests.h
@@ -0,0 +1,101 @@
+// (C) 2015 Simon Warta (Kullo GmbH)
+// Botan is released under the Simplified BSD License (see license.txt)
+
+#ifndef BOTAN_CATCHY_TESTS_H__
+#define BOTAN_CATCHY_TESTS_H__
+
+#include "catch.hpp"
+#include <botan/build.h>
+
+
+// BEGIN CATCH STD::VECTOR IMPLEMENTATION
+// This is basically https://github.com/philsquared/Catch/pull/466
+#include <vector>
+
+#include <type_traits>
+
+namespace Catch {
+
+namespace Matchers {
+    namespace Impl {
+
+    namespace StdVector {
+        template<typename T, typename Alloc>
+        struct Equals : MatcherImpl<Equals<T, Alloc>, std::vector<T, Alloc> > {
+            Equals( std::vector<T, Alloc> const& vec ) : m_vector( vec ){}
+            Equals( Equals const& other ) : m_vector( other.m_vector ){}
+
+            virtual ~Equals() {};
+
+            virtual bool match( std::vector<T, Alloc> const& expr ) const {
+                return m_vector == expr;
+            }
+            virtual std::string toString() const {
+                return "equals: std::vector of length " + Catch::toString(m_vector.size());
+            }
+
+            std::vector<T, Alloc> m_vector;
+        };
+    } // namespace StdVector
+
+    namespace Boolean {
+        struct Equals : MatcherImpl<Equals, bool> {
+            Equals( const bool expected ) : m_expected( expected ){}
+            Equals( Equals const& other ) : m_expected( other.m_expected ){}
+
+            virtual ~Equals() override {};
+
+            virtual bool match( bool const& expr ) const {
+                return m_expected == expr;
+            }
+            virtual std::string toString() const {
+                return " == " + Catch::toString(m_expected);
+            }
+
+            bool m_expected;
+        };
+    } // Boolean
+
+    namespace Integer {
+        template<typename T>
+        struct Equals : MatcherImpl<Equals<T>, T> {
+            Equals( const T expected ) : m_expected( expected ){}
+            Equals( Equals const& other ) : m_expected( other.m_expected ){}
+
+            virtual ~Equals() override {};
+
+            virtual bool match( T const& expr ) const {
+                return m_expected == expr;
+            }
+            virtual std::string toString() const {
+                return "== " + Catch::toString(m_expected);
+            }
+
+            T m_expected;
+        };
+    } // namespace Integer
+
+    } // namespace Impl
+
+    // The following functions create the actual matcher objects.
+    // This allows the types to be inferred
+    template <typename T, typename Alloc>
+    inline Impl::StdVector::Equals<T, Alloc>      Equals( std::vector<T, Alloc> const& vec ) {
+        return Impl::StdVector::Equals<T, Alloc>( vec );
+    }
+
+    template <typename T,
+              typename = typename std::enable_if<std::numeric_limits<T>::is_integer, T>::type>
+    inline Impl::Integer::Equals<T>    Equals( T expected ) {
+        return Impl::Integer::Equals<T>( expected );
+    }
+
+    inline Impl::Boolean::Equals          Equals( bool expected ) {
+        return Impl::Boolean::Equals( expected );
+    }
+
+} // namespace Matchers
+} // namespace Catch
+// END CATCH STD::VECTOR IMPLEMENTATION
+
+#endif // BOTAN_CATCHY_TESTS_H__
diff --git a/src/tests/catchy/test_base.cpp b/src/tests/catchy/test_base.cpp
new file mode 100644
index 000000000..057b29eb3
--- /dev/null
+++ b/src/tests/catchy/test_base.cpp
@@ -0,0 +1,25 @@
+// (C) 2015 Simon Warta (Kullo GmbH)
+// Botan is released under the Simplified BSD License (see license.txt)
+
+#include "catchy_tests.h"
+#include <botan/symkey.h>
+
+using namespace Botan;
+
+TEST_CASE("OctetString", "[base]")
+   {   
+   auto empty = secure_vector<byte>{ };
+   auto one   = secure_vector<byte>{ 94 }; // ^
+   auto some  = secure_vector<byte>{ 0x48, 0x65, 0x6c, 0x6c, 0x6f }; // Hello
+   auto utf8  = secure_vector<byte>{ 0xc3, 0xb6 }; // ö
+
+   auto os_empty = OctetString("");
+   auto os_one   = OctetString("5e");
+   auto os_some  = OctetString("48656c6c6f");
+   auto os_utf8  = OctetString("c3b6");
+
+   CHECK_THAT(os_empty.bits_of(), Equals(empty));
+   CHECK_THAT(os_one.bits_of(),   Equals(one));
+   CHECK_THAT(os_some.bits_of(),  Equals(some));
+   CHECK_THAT(os_utf8.bits_of(),  Equals(utf8));
+   }
diff --git a/src/tests/catchy/test_base64.cpp b/src/tests/catchy/test_base64.cpp
index e25defb09..fe7739a8d 100644
--- a/src/tests/catchy/test_base64.cpp
+++ b/src/tests/catchy/test_base64.cpp
@@ -1,9 +1,7 @@
 // (C) 2015 Simon Warta (Kullo GmbH)
 // Botan is released under the Simplified BSD License (see license.txt)
 
-#include "catch.hpp"
-
-#include <botan/build.h>
+#include "catchy_tests.h"
 
 #if defined(BOTAN_HAS_BASE64_CODEC)
 
@@ -26,7 +24,7 @@ TEST_CASE("Base64 encode empty string", "[base64]")
    // common knowledge
    auto emptyString = std::string("");
    auto emptyVector = std::vector<Botan::byte>(emptyString.cbegin(), emptyString.cend());
-   CHECK(( Botan::base64_encode(emptyVector) == "" ));
+   CHECK_THAT(Botan::base64_encode(emptyVector), Equals(""));
    }
 
 TEST_CASE("Base64 encode short string", "[base64]")
@@ -35,9 +33,9 @@ TEST_CASE("Base64 encode short string", "[base64]")
    auto in1 = std::vector<Botan::byte>{ 'f' };
    auto in2 = std::vector<Botan::byte>{ 'f', 'o' };
    auto in3 = std::vector<Botan::byte>{ 'f', 'o', 'o' };
-   CHECK(( Botan::base64_encode(in1) == "Zg==" ));
-   CHECK(( Botan::base64_encode(in2) == "Zm8=" ));
-   CHECK(( Botan::base64_encode(in3) == "Zm9v" ));
+   CHECK_THAT(Botan::base64_encode(in1), Equals("Zg=="));
+   CHECK_THAT(Botan::base64_encode(in2), Equals("Zm8="));
+   CHECK_THAT(Botan::base64_encode(in3), Equals("Zm9v"));
    }
 
 TEST_CASE("Base64 encode string", "[base64]")
@@ -50,13 +48,13 @@ TEST_CASE("Base64 encode string", "[base64]")
    auto in5 = std::vector<Botan::byte>{ 'T','h','e',' ','1','3',' ','c','h','a','r','s','.' };
    auto in6 = std::vector<Botan::byte>{ 'T','h','e',' ','1','4',' ','c','h','a','r','s','.','.' };
    auto in7 = std::vector<Botan::byte>{ 'T','h','e',' ','1','5',' ','c','h','a','r','s','.','.','.' };
-   CHECK(( Botan::base64_encode(in1) == "aGVsbG8gd29ybGQ=" ));
-   CHECK(( Botan::base64_encode(in2) == "aGVsbG8gd29ybGQh" ));
-   CHECK(( Botan::base64_encode(in3) == "SGVsbG8sIHdvcmxkLg==" ));
-   CHECK(( Botan::base64_encode(in4) == "VGhlIDEyIGNoYXJz" ));
-   CHECK(( Botan::base64_encode(in5) == "VGhlIDEzIGNoYXJzLg==" ));
-   CHECK(( Botan::base64_encode(in6) == "VGhlIDE0IGNoYXJzLi4=" ));
-   CHECK(( Botan::base64_encode(in7) == "VGhlIDE1IGNoYXJzLi4u" ));
+   CHECK_THAT(Botan::base64_encode(in1), Equals("aGVsbG8gd29ybGQ="));
+   CHECK_THAT(Botan::base64_encode(in2), Equals("aGVsbG8gd29ybGQh"));
+   CHECK_THAT(Botan::base64_encode(in3), Equals("SGVsbG8sIHdvcmxkLg=="));
+   CHECK_THAT(Botan::base64_encode(in4), Equals("VGhlIDEyIGNoYXJz"));
+   CHECK_THAT(Botan::base64_encode(in5), Equals("VGhlIDEzIGNoYXJzLg=="));
+   CHECK_THAT(Botan::base64_encode(in6), Equals("VGhlIDE0IGNoYXJzLi4="));
+   CHECK_THAT(Botan::base64_encode(in7), Equals("VGhlIDE1IGNoYXJzLi4u"));
    }
 
 TEST_CASE("Base64 encode string special chars", "[base64]")
@@ -64,72 +62,72 @@ TEST_CASE("Base64 encode string special chars", "[base64]")
    // Generated by: echo -n "xyz" | base64
    auto in1 = toStdVector("An UTF-8 uuml: ü");
    auto in2 = toStdVector("Weird German 2 byte thing: ß.");
-   CHECK(( Botan::base64_encode(in1) == "QW4gVVRGLTggdXVtbDogw7w=" ));
-   CHECK(( Botan::base64_encode(in2) == "V2VpcmQgR2VybWFuIDIgYnl0ZSB0aGluZzogw58u" ));
+   CHECK_THAT(Botan::base64_encode(in1), Equals("QW4gVVRGLTggdXVtbDogw7w="));
+   CHECK_THAT(Botan::base64_encode(in2), Equals("V2VpcmQgR2VybWFuIDIgYnl0ZSB0aGluZzogw58u"));
    }
 
 TEST_CASE("Base64 encode empty binary", "[base64]")
    {
    auto binary0 = std::vector<unsigned char>{};
-   CHECK(( Botan::base64_encode(binary0) == "" ));
+   CHECK_THAT(Botan::base64_encode(binary0), Equals(""));
    }
 
 TEST_CASE("Base64 encode binary", "[base64]")
    {
    // Generated by: cat /dev/urandom | head -c 3 | tee /tmp/mybinary | hexdump -C && cat /tmp/mybinary | base64
    std::vector<unsigned char> binary1 = {0x9b};
-   CHECK(( Botan::base64_encode(binary1) == "mw==" ));
+   CHECK_THAT(Botan::base64_encode(binary1), Equals("mw=="));
 
    std::vector<unsigned char> binary2 = {0x1c, 0x60};
-   CHECK(( Botan::base64_encode(binary2) == "HGA=" ));
+   CHECK_THAT(Botan::base64_encode(binary2), Equals("HGA="));
 
    std::vector<unsigned char> binary3 = {0x81, 0x34, 0xbd};
-   CHECK(( Botan::base64_encode(binary3) == "gTS9" ));
+   CHECK_THAT(Botan::base64_encode(binary3), Equals("gTS9"));
 
    std::vector<unsigned char> binary4 = {0x5e, 0x6c, 0xff, 0xde};
-   CHECK(( Botan::base64_encode(binary4) == "Xmz/3g==" ));
+   CHECK_THAT(Botan::base64_encode(binary4), Equals("Xmz/3g=="));
 
    std::vector<unsigned char> binary5 = {0xb2, 0xcd, 0xf0, 0xdc, 0x7f};
-   CHECK(( Botan::base64_encode(binary5) == "ss3w3H8=" ));
+   CHECK_THAT(Botan::base64_encode(binary5), Equals("ss3w3H8="));
 
    std::vector<unsigned char> binary6 = {0xfc, 0x56, 0x2d, 0xda, 0xd4, 0x0e};
-   CHECK(( Botan::base64_encode(binary6) == "/FYt2tQO" ));
+   CHECK_THAT(Botan::base64_encode(binary6), Equals("/FYt2tQO"));
 
    std::vector<unsigned char> binary7 = {0x29, 0xb2, 0x32, 0x2e, 0x88, 0x41, 0xe8};
-   CHECK(( Botan::base64_encode(binary7) == "KbIyLohB6A==" ));
+   CHECK_THAT(Botan::base64_encode(binary7), Equals("KbIyLohB6A=="));
 
    std::vector<unsigned char> binary8 = {0x0f, 0x0f, 0xce, 0xd9, 0x49, 0x7a, 0xaf, 0x92};
-   CHECK(( Botan::base64_encode(binary8) == "Dw/O2Ul6r5I=" ));
+   CHECK_THAT(Botan::base64_encode(binary8), Equals("Dw/O2Ul6r5I="));
 
    std::vector<unsigned char> binary9 = {0x27, 0x0f, 0xb1, 0x89, 0x82, 0x80, 0x0d, 0xa6, 0x40};
-   CHECK(( Botan::base64_encode(binary9) == "Jw+xiYKADaZA" ));
+   CHECK_THAT(Botan::base64_encode(binary9), Equals("Jw+xiYKADaZA"));
    }
 
 TEST_CASE("Base64 decode empty string", "[base64]")
    {
    // common knowledge
    auto outVector = toStdVector(Botan::base64_decode(""));
-   CHECK(( outVector == std::vector<Botan::byte>{} ));
+   CHECK_THAT(outVector, Equals(std::vector<Botan::byte>{}));
    }
 
 TEST_CASE("Base64 decode short string", "[base64]")
    {
    // test vectors from http://tools.ietf.org/html/rfc4648
-   CHECK(( toStdVector(Botan::base64_decode("Zg==")) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode("Zm8=")) == toStdVector("fo") ));
-   CHECK(( toStdVector(Botan::base64_decode("Zm9v")) == toStdVector("foo") ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("Zg==")), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode("Zm8=")), Equals(toStdVector("fo")));
+   CHECK_THAT(toStdVector(Botan::base64_decode("Zm9v")), Equals(toStdVector("foo")));
    }
 
 TEST_CASE("Base64 decode string", "[base64]")
    {
    // Generated by: echo -n "xyz" | base64
-   CHECK(( toStdVector(Botan::base64_decode("aGVsbG8gd29ybGQ="))     == toStdVector("hello world") ));
-   CHECK(( toStdVector(Botan::base64_decode("aGVsbG8gd29ybGQh"))     == toStdVector("hello world!") ));
-   CHECK(( toStdVector(Botan::base64_decode("SGVsbG8sIHdvcmxkLg==")) == toStdVector("Hello, world.") ));
-   CHECK(( toStdVector(Botan::base64_decode("VGhlIDEyIGNoYXJz"))     == toStdVector("The 12 chars") ));
-   CHECK(( toStdVector(Botan::base64_decode("VGhlIDEzIGNoYXJzLg==")) == toStdVector("The 13 chars.") ));
-   CHECK(( toStdVector(Botan::base64_decode("VGhlIDE0IGNoYXJzLi4=")) == toStdVector("The 14 chars..") ));
-   CHECK(( toStdVector(Botan::base64_decode("VGhlIDE1IGNoYXJzLi4u")) == toStdVector("The 15 chars...") ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("aGVsbG8gd29ybGQ=")),     Equals(toStdVector("hello world")));
+   CHECK_THAT(toStdVector(Botan::base64_decode("aGVsbG8gd29ybGQh")),     Equals(toStdVector("hello world!")));
+   CHECK_THAT(toStdVector(Botan::base64_decode("SGVsbG8sIHdvcmxkLg==")), Equals(toStdVector("Hello, world.")));
+   CHECK_THAT(toStdVector(Botan::base64_decode("VGhlIDEyIGNoYXJz")),     Equals(toStdVector("The 12 chars")));
+   CHECK_THAT(toStdVector(Botan::base64_decode("VGhlIDEzIGNoYXJzLg==")), Equals(toStdVector("The 13 chars.")));
+   CHECK_THAT(toStdVector(Botan::base64_decode("VGhlIDE0IGNoYXJzLi4=")), Equals(toStdVector("The 14 chars..")));
+   CHECK_THAT(toStdVector(Botan::base64_decode("VGhlIDE1IGNoYXJzLi4u")), Equals(toStdVector("The 15 chars...")));
    }
 
 TEST_CASE("Base64 decode string special chars", "[base64]")
@@ -139,96 +137,96 @@ TEST_CASE("Base64 decode string special chars", "[base64]")
    auto in2 = std::string("V2VpcmQgR2VybWFuIDIgYnl0ZSB0aGluZzogw58u");
    auto out1 = std::string("An UTF-8 uuml: ü");
    auto out2 = std::string("Weird German 2 byte thing: ß.");
-   CHECK(( toStdVector(Botan::base64_decode(in1)) == toStdVector(out1) ));
-   CHECK(( toStdVector(Botan::base64_decode(in2)) == toStdVector(out2) ));
+   CHECK_THAT(toStdVector(Botan::base64_decode(in1)), Equals(toStdVector(out1)));
+   CHECK_THAT(toStdVector(Botan::base64_decode(in2)), Equals(toStdVector(out2)));
    }
 
 TEST_CASE("Base64 decode binary", "[base64]")
    {
    // Generated by: cat /dev/urandom | head -c 3 | tee /tmp/mybinary | hexdump -C && cat /tmp/mybinary | base64
    std::vector<unsigned char> binary0 = {};
-   CHECK(( toStdVector(Botan::base64_decode("")) == binary0));
+   CHECK_THAT(toStdVector(Botan::base64_decode("")), Equals(binary0));
 
    std::vector<unsigned char> binary1 = {0x9b};
-   CHECK(( toStdVector(Botan::base64_decode("mw==")) == binary1 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("mw==")), Equals(binary1));
 
    std::vector<unsigned char> binary2 = {0x1c, 0x60};
-   CHECK(( toStdVector(Botan::base64_decode("HGA=")) == binary2 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("HGA=")), Equals(binary2));
 
    std::vector<unsigned char> binary3 = {0x81, 0x34, 0xbd};
-   CHECK(( toStdVector(Botan::base64_decode("gTS9")) == binary3 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("gTS9")), Equals(binary3));
 
    std::vector<unsigned char> binary4 = {0x5e, 0x6c, 0xff, 0xde};
-   CHECK(( toStdVector(Botan::base64_decode("Xmz/3g==")) == binary4 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("Xmz/3g==")), Equals(binary4));
 
    std::vector<unsigned char> binary5 = {0xb2, 0xcd, 0xf0, 0xdc, 0x7f};
-   CHECK(( toStdVector(Botan::base64_decode("ss3w3H8=")) == binary5 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("ss3w3H8=")), Equals(binary5));
 
    std::vector<unsigned char> binary6 = {0xfc, 0x56, 0x2d, 0xda, 0xd4, 0x0e};
-   CHECK(( toStdVector(Botan::base64_decode("/FYt2tQO")) == binary6 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("/FYt2tQO")), Equals(binary6));
 
    std::vector<unsigned char> binary7 = {0x29, 0xb2, 0x32, 0x2e, 0x88, 0x41, 0xe8};
-   CHECK(( toStdVector(Botan::base64_decode("KbIyLohB6A==")) == binary7 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("KbIyLohB6A==")), Equals(binary7));
 
    std::vector<unsigned char> binary8 = {0x0f, 0x0f, 0xce, 0xd9, 0x49, 0x7a, 0xaf, 0x92};
-   CHECK(( toStdVector(Botan::base64_decode("Dw/O2Ul6r5I=")) == binary8 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("Dw/O2Ul6r5I=")), Equals(binary8));
 
    std::vector<unsigned char> binary9 = {0x27, 0x0f, 0xb1, 0x89, 0x82, 0x80, 0x0d, 0xa6, 0x40};
-   CHECK(( toStdVector(Botan::base64_decode("Jw+xiYKADaZA")) == binary9 ));
+   CHECK_THAT(toStdVector(Botan::base64_decode("Jw+xiYKADaZA")), Equals(binary9));
    }
 
 TEST_CASE("Base64 decode and ignore whitespace", "[base64]")
    {
-   CHECK(( toStdVector(Botan::base64_decode(std::string(" Zg=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Z g=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg =="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg= ="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg== "), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("\rZg=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("\nZg=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("\tZg=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg\r=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg\n=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg\t=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg==\r"), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg==\n"), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg==\t"), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("\r Zg=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("\n Zg=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("\t Zg=="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg\r =="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg\n =="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg\t =="), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg==\r "), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg==\n "), true)) == toStdVector("f") ));
-   CHECK(( toStdVector(Botan::base64_decode(std::string("Zg==\t "), true)) == toStdVector("f") ));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string(" Zg=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Z g=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg =="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg= ="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg== "), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("\rZg=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("\nZg=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("\tZg=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg\r=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg\n=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg\t=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg==\r"), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg==\n"), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg==\t"), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("\r Zg=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("\n Zg=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("\t Zg=="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg\r =="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg\n =="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg\t =="), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg==\r "), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg==\n "), true)), Equals(toStdVector("f")));
+   CHECK_THAT(toStdVector(Botan::base64_decode(std::string("Zg==\t "), true)), Equals(toStdVector("f")));
    }
 
 TEST_CASE("Base64 decode and don't ignore whitespace", "[base64]")
    {
-   CHECK_THROWS( Botan::base64_decode(std::string(" Zg=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Z g=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg =="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg= ="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg== "), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("\rZg=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("\nZg=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("\tZg=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg\r=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg\n=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg\t=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg==\r"), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg==\n"), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg==\t"), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("\r Zg=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("\n Zg=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("\t Zg=="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg\r =="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg\n =="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg\t =="), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg==\r "), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg==\n "), false) );
-   CHECK_THROWS( Botan::base64_decode(std::string("Zg==\t "), false) );
+   CHECK_THROWS(Botan::base64_decode(std::string(" Zg=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Z g=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg =="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg= ="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg== "), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("\rZg=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("\nZg=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("\tZg=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg\r=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg\n=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg\t=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg==\r"), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg==\n"), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg==\t"), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("\r Zg=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("\n Zg=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("\t Zg=="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg\r =="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg\n =="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg\t =="), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg==\r "), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg==\n "), false));
+   CHECK_THROWS(Botan::base64_decode(std::string("Zg==\t "), false));
    }
 
 #endif // BOTAN_HAS_BASE64_CODEC
diff --git a/src/tests/catchy/test_bigint.cpp b/src/tests/catchy/test_bigint.cpp
index 7ea2d6370..67821eaf0 100644
--- a/src/tests/catchy/test_bigint.cpp
+++ b/src/tests/catchy/test_bigint.cpp
@@ -1,9 +1,7 @@
 // (C) 2015 Simon Warta (Kullo GmbH)
 // Botan is released under the Simplified BSD License (see license.txt)
 
-#include "catch.hpp"
-
-#include <botan/build.h>
+#include "catchy_tests.h"
 
 #if defined(BOTAN_HAS_BIGINT)
 
@@ -16,57 +14,57 @@ TEST_CASE("Bigint basics", "[bigint]")
    SECTION("in 0-bit border")
       {
       BigInt a(0u);
-      CHECK(( a.bits() == 0 ));
-      CHECK(( a.bytes() == 0 ));
-      CHECK(( a.to_u32bit() == 0 ));
+      CHECK_THAT(a.bits(),      Equals(0));
+      CHECK_THAT(a.bytes(),     Equals(0));
+      CHECK_THAT(a.to_u32bit(), Equals(0));
       }
    SECTION("above 0-bit border")
       {
       BigInt a(1u);
-      CHECK(( a.bits() == 1 ));
-      CHECK(( a.bytes() == 1 ));
-      CHECK(( a.to_u32bit() == 1 ));
+      CHECK_THAT(a.bits(),      Equals(1));
+      CHECK_THAT(a.bytes(),     Equals(1));
+      CHECK_THAT(a.to_u32bit(), Equals(1));
       }
    SECTION("in 8-bit border")
       {
       BigInt a(255u);
-      CHECK(( a.bits() == 8 ));
-      CHECK(( a.bytes() == 1 ));
-      CHECK(( a.to_u32bit() == 255 ));
+      CHECK_THAT(a.bits(),      Equals(8));
+      CHECK_THAT(a.bytes(),     Equals(1));
+      CHECK_THAT(a.to_u32bit(), Equals(255));
       }
    SECTION("above 8-bit border")
       {
       BigInt a(256u);
-      CHECK(( a.bits() == 9 ));
-      CHECK(( a.bytes() == 2 ));
-      CHECK(( a.to_u32bit() == 256 ));
+      CHECK_THAT(a.bits(),      Equals(9));
+      CHECK_THAT(a.bytes(),     Equals(2));
+      CHECK_THAT(a.to_u32bit(), Equals(256));
       }
    SECTION("in 16-bit border")
       {
       BigInt a(65535u);
-      CHECK(( a.bits() == 16 ));
-      CHECK(( a.bytes() == 2 ));
-      CHECK(( a.to_u32bit() == 65535 ));
+      CHECK_THAT(a.bits(),      Equals(16));
+      CHECK_THAT(a.bytes(),     Equals(2));
+      CHECK_THAT(a.to_u32bit(), Equals(65535));
       }
    SECTION("above 16-bit border")
       {
       BigInt a(65536u);
-      CHECK(( a.bits() == 17 ));
-      CHECK(( a.bytes() == 3 ));
-      CHECK(( a.to_u32bit() == 65536 ));
+      CHECK_THAT(a.bits(),      Equals(17));
+      CHECK_THAT(a.bytes(),     Equals(3));
+      CHECK_THAT(a.to_u32bit(), Equals(65536));
       }
    SECTION("in 32-bit border")
       {
       BigInt a(4294967295u);
-      CHECK(( a.bits() == 32 ));
-      CHECK(( a.bytes() == 4 ));
-      CHECK(( a.to_u32bit() == 4294967295u ));
+      CHECK_THAT(a.bits(),      Equals(32));
+      CHECK_THAT(a.bytes(),     Equals(4));
+      CHECK_THAT(a.to_u32bit(), Equals(4294967295u));
       }
    SECTION("above 32-bit border")
       {
       BigInt a(4294967296u);
-      CHECK(( a.bits() == 33 ));
-      CHECK(( a.bytes() == 5 ));
+      CHECK_THAT(a.bits(),  Equals(33));
+      CHECK_THAT(a.bytes(), Equals(5));
       CHECK_THROWS( a.to_u32bit() );
       }
    }
diff --git a/src/tests/catchy/test_cvc.cpp b/src/tests/catchy/test_cvc.cpp
index 1678f76f1..2ac6be848 100644
--- a/src/tests/catchy/test_cvc.cpp
+++ b/src/tests/catchy/test_cvc.cpp
@@ -1,8 +1,7 @@
 // (C) 2015 Simon Warta (Kullo GmbH)
 // Botan is released under the Simplified BSD License (see license.txt)
 
-#include "catch.hpp"
-#include <botan/build.h>
+#include "catchy_tests.h"
 
 #if defined(BOTAN_HAS_CVC)
 
diff --git a/src/tests/catchy/test_stl_util.cpp b/src/tests/catchy/test_stl_util.cpp
index a0b38b045..f7c2c9990 100644
--- a/src/tests/catchy/test_stl_util.cpp
+++ b/src/tests/catchy/test_stl_util.cpp
@@ -1,8 +1,8 @@
 // (C) 2015 Simon Warta (Kullo GmbH)
 // Botan is released under the Simplified BSD License (see license.txt)
 
-#include "catch.hpp"
-#include <botan/types.h>
+#include "catchy_tests.h"
+
 #include <botan/internal/stl_util.h>
 
 TEST_CASE("secure vector to string", "[STL_Util]")
@@ -14,8 +14,8 @@ TEST_CASE("secure vector to string", "[STL_Util]")
    // echo -n "ö" | hexdump -C
    auto utf8  = secure_vector<byte>{ 0xc3, 0xb6 };
 
-   CHECK(( to_string(empty) == "" ));
-   CHECK(( to_string(one)   == "^" ));
-   CHECK(( to_string(some)  == "Hello" ));
-   CHECK(( to_string(utf8)  == "ö" ));
+   CHECK_THAT(to_string(empty), Equals(""));
+   CHECK_THAT(to_string(one),   Equals("^"));
+   CHECK_THAT(to_string(some),  Equals("Hello"));
+   CHECK_THAT(to_string(utf8),  Equals("ö"));
    }
diff --git a/src/tests/catchy/test_utils.cpp b/src/tests/catchy/test_utils.cpp
index 702d82f9c..a04010b8f 100644
--- a/src/tests/catchy/test_utils.cpp
+++ b/src/tests/catchy/test_utils.cpp
@@ -1,7 +1,7 @@
 // (C) 2015 Simon Warta (Kullo GmbH)
 // Botan is released under the Simplified BSD License (see license.txt)
 
-#include "catch.hpp"
+#include "catchy_tests.h"
 
 #include <botan/calendar.h>
 #include <botan/internal/rounding.h>
diff --git a/src/tests/catchy/test_x509.cpp b/src/tests/catchy/test_x509.cpp
index 20b72ab26..01c01dbdc 100644
--- a/src/tests/catchy/test_x509.cpp
+++ b/src/tests/catchy/test_x509.cpp
@@ -1,8 +1,7 @@
 // (C) 2015 Simon Warta (Kullo GmbH)
 // Botan is released under the Simplified BSD License (see license.txt)
 
-#include "catch.hpp"
-#include <botan/build.h>
+#include "catchy_tests.h"
 
 // deacticate due to
 // https://github.com/randombit/botan/issues/185
diff --git a/src/tests/test_ffi.cpp b/src/tests/test_ffi.cpp
index 084490a08..7f5908834 100644
--- a/src/tests/test_ffi.cpp
+++ b/src/tests/test_ffi.cpp
@@ -4,11 +4,12 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include "catchy/catch.hpp"
-#include <botan/version.h>
+#include "catchy/catchy_tests.h"
 
 #if defined(BOTAN_HAS_FFI)
 
+#include <botan/version.h>
+
 #include <botan/hex.h>
 #include <botan/ffi.h>
 
@@ -17,10 +18,10 @@ using Botan::hex_decode;
 
 TEST_CASE("FFI versioning", "[ffi]")
    {
-   CHECK(botan_ffi_api_version() == BOTAN_HAS_FFI);
-   CHECK(botan_version_major() == Botan::version_major());
-   CHECK(botan_version_minor() == Botan::version_minor());
-   CHECK(botan_version_patch() == Botan::version_patch());
+   CHECK_THAT(botan_ffi_api_version(), Equals(BOTAN_HAS_FFI));
+   CHECK_THAT(botan_version_major(),   Equals(Botan::version_major()));
+   CHECK_THAT(botan_version_minor(),   Equals(Botan::version_minor()));
+   CHECK_THAT(botan_version_patch(),   Equals(Botan::version_patch()));
    }
 
 TEST_CASE("FFI hex", "[ffi]")
@@ -29,11 +30,11 @@ TEST_CASE("FFI hex", "[ffi]")
    std::string out;
    out.resize(2*bin.size());
 
-   CHECK(0 == botan_hex_encode(bin.data(), bin.size(), &out[0], 0));
-   CHECK(out == "AADE01");
+   CHECK_THAT(botan_hex_encode(bin.data(), bin.size(), &out[0], 0), Equals(0));
+   CHECK_THAT(out, Equals("AADE01"));
 
-   CHECK(0 == botan_hex_encode(bin.data(), bin.size(), &out[0], BOTAN_FFI_HEX_LOWER_CASE));
-   CHECK(out == "aade01");
+   CHECK_THAT(botan_hex_encode(bin.data(), bin.size(), &out[0], BOTAN_FFI_HEX_LOWER_CASE), Equals(0));
+   CHECK_THAT(out, Equals("aade01"));
    }
 
 TEST_CASE("FFI RNG", "[ffi]")
@@ -43,14 +44,16 @@ TEST_CASE("FFI RNG", "[ffi]")
 
    CHECK(botan_rng_init(&rng, "bad_type") < 0);
 
-   const char* types[] = { "system", "user", nullptr };
+   const std::vector<std::string> types = { "system", "user" };
 
-   for(size_t i = 0; types[i]; ++i)
+   for(const auto type : types)
       {
-      REQUIRE(botan_rng_init(&rng, types[i]) == 0);
-      CHECK(0 == botan_rng_get(rng, buf, sizeof(buf)));
-      CHECK(0 == botan_rng_reseed(rng, 256));
-      CHECK(0 == botan_rng_destroy(rng));
+      REQUIRE_THAT(botan_rng_init(&rng, type.c_str()), Equals(0));
+      CHECK_THAT(botan_rng_get(rng, buf, sizeof(buf)), Equals(0));
+      CHECK_THAT(botan_rng_reseed(rng, 256), Equals(0));
+
+      int ret = botan_rng_destroy(rng); // Catch evalues expresstion multiple times
+      CHECK_THAT(ret, Equals(0));
       }
    }
 
@@ -58,62 +61,72 @@ TEST_CASE("FFI hash", "[ffi]")
    {
    botan_hash_t hash;
    CHECK(botan_hash_init(&hash, "SHA-256", 1) < 0);
-   REQUIRE(botan_hash_init(&hash, "SHA-256", 0) == 0);
+   REQUIRE_THAT(botan_hash_init(&hash, "SHA-256", 0), Equals(0));
 
    /*
    char namebuf[32];
    CHECK(botan_hash_name(hash, namebuf, 5) < 0);
-   CHECK(0 == botan_hash_name(hash, namebuf, 31));
+   CHECK_THAT(botan_hash_name(hash, namebuf, 31));
    CHECK(std::string(namebuf) == "SHA-256");
    */
 
    size_t ol;
-   CHECK(0 == botan_hash_output_length(hash, &ol));
-   CHECK(ol == 32);
+   CHECK_THAT(botan_hash_output_length(hash, &ol), Equals(0));
+   CHECK_THAT(ol, Equals(32));
 
    const char* s = "ABC";
 
    std::vector<uint8_t> outbuf(ol);
-   CHECK(0 == botan_hash_update(hash, reinterpret_cast<const uint8_t*>(s), 3));
-   CHECK(0 == botan_hash_final(hash, outbuf.data()));
 
-   //CHECK_ARRAY(outbuf, "B5D4045C3F466FA91FE2CC6ABE79232A1A57CDF104F7A26E716E0A1E2789DF78");
-   CHECK(hex_encode(outbuf) == "B5D4045C3F466FA91FE2CC6ABE79232A1A57CDF104F7A26E716E0A1E2789DF78");
+   int retUpdate = botan_hash_update(hash, reinterpret_cast<const uint8_t*>(s), 3);
+   CHECK_THAT(retUpdate, Equals(0));
+
+   int retFinal = botan_hash_final(hash, outbuf.data());
+   CHECK_THAT(retFinal, Equals(0));
 
-   CHECK(0 == botan_hash_clear(hash));
+   //CHECK_ARRAY(outbuf, "B5D4045C3F466FA91FE2CC6ABE79232A1A57CDF104F7A26E716E0A1E2789DF78");
+   CHECK_THAT(hex_encode(outbuf), Equals("B5D4045C3F466FA91FE2CC6ABE79232A1A57CDF104F7A26E716E0A1E2789DF78"));
 
-   CHECK(0 == botan_hash_destroy(hash));
+   CHECK_THAT(botan_hash_clear(hash), Equals(0));
+   int ret = botan_hash_destroy(hash);
+   CHECK_THAT(ret, Equals(0));
    }
 
 TEST_CASE("FFI mac", "[ffi]")
    {
    botan_mac_t mac;
-   CHECK(-1 == botan_mac_init(&mac, "HMAC(SHA-256)", 1)); // bad flag
-   CHECK(-2 == botan_mac_init(&mac, "HMAC(SHA-259)", 0)); // bad name
-   CHECK(0 == botan_mac_init(&mac, "HMAC(SHA-256)", 0));
+   CHECK_THAT(botan_mac_init(&mac, "HMAC(SHA-256)", 1), Equals(-1)); // bad flag
+   CHECK_THAT(botan_mac_init(&mac, "HMAC(SHA-259)", 0), Equals(-2)); // bad name
+   CHECK_THAT(botan_mac_init(&mac, "HMAC(SHA-256)", 0), Equals(0));
 
    //char namebuf[32];
    //CHECK(botan_mac_name(mac, namebuf, 10) < 0);
-   //CHECK(0 == botan_mac_name(mac, namebuf, 31));
+   //CHECK_THAT(botan_mac_name(mac, namebuf, 31), Equals(0));
    //CHECK(std::string(namebuf) == "HMAC(SHA-256)");
 
    size_t ol;
-   CHECK(0 == botan_mac_output_length(mac, &ol));
-   CHECK(ol == 32);
+   CHECK_THAT(botan_mac_output_length(mac, &ol), Equals(0));
+   CHECK_THAT(ol, Equals(32));
 
    const uint8_t key[] = { 0xAA, 0xBB, 0xCC, 0xDD };
 
-   CHECK(0 == botan_mac_set_key(mac, key, 4));
+   CHECK_THAT(botan_mac_set_key(mac, key, 4), Equals(0));
    const char* s = "ABC";
 
    std::vector<uint8_t> outbuf(ol);
-   CHECK(0 == botan_mac_update(mac, reinterpret_cast<const uint8_t*>(s), 3));
-   CHECK(0 == botan_mac_final(mac, outbuf.data()));
 
-   CHECK(hex_encode(outbuf) == "1A82EEA984BC4A7285617CC0D05F1FE1D6C96675924A81BC965EE8FF7B0697A7");
+   int retUpdate = botan_mac_update(mac, reinterpret_cast<const uint8_t*>(s), 3);
+   CHECK_THAT(retUpdate, Equals(0));
 
-   CHECK(0 == botan_mac_clear(mac));
-   CHECK(0 == botan_mac_destroy(mac));
+   int retFinal = botan_mac_final(mac, outbuf.data());
+   CHECK_THAT(retFinal, Equals(0));
+
+   CHECK_THAT(hex_encode(outbuf), Equals("1A82EEA984BC4A7285617CC0D05F1FE1D6C96675924A81BC965EE8FF7B0697A7"));
+
+   CHECK_THAT(botan_mac_clear(mac), Equals(0));
+
+   int retDestroy = botan_mac_destroy(mac);
+   CHECK_THAT(retDestroy, Equals(0));
    }
 
 TEST_CASE("FFI PBKDF", "[ffi]")
@@ -125,16 +138,19 @@ TEST_CASE("FFI PBKDF", "[ffi]")
 
    std::vector<uint8_t> outbuf(out_len);
 
-   CHECK(0 == botan_pbkdf("PBKDF2(SHA-1)", outbuf.data(), outbuf.size(),
-                          passphrase.c_str(), salt.data(), salt.size(), iterations));
+   CHECK_THAT(botan_pbkdf("PBKDF2(SHA-1)", outbuf.data(), outbuf.size(),
+                          passphrase.c_str(), salt.data(), salt.size(), iterations),
+              Equals(0));
 
-   CHECK(hex_encode(outbuf) == "027AFADD48F4BE8DCC4F");
+   CHECK_THAT(hex_encode(outbuf), Equals("027AFADD48F4BE8DCC4F"));
 
    size_t iters_10ms, iters_100ms;
-   CHECK(0 == botan_pbkdf_timed("PBKDF2(SHA-1)", outbuf.data(), outbuf.size(),
-                                passphrase.c_str(), salt.data(), salt.size(), 10, &iters_10ms));
-   CHECK(0 == botan_pbkdf_timed("PBKDF2(SHA-1)", outbuf.data(), outbuf.size(),
-                                passphrase.c_str(), salt.data(), salt.size(), 100, &iters_100ms));
+   CHECK_THAT(botan_pbkdf_timed("PBKDF2(SHA-1)", outbuf.data(), outbuf.size(),
+                                passphrase.c_str(), salt.data(), salt.size(), 10, &iters_10ms),
+              Equals(0));
+   CHECK_THAT(botan_pbkdf_timed("PBKDF2(SHA-1)", outbuf.data(), outbuf.size(),
+                                passphrase.c_str(), salt.data(), salt.size(), 100, &iters_100ms),
+              Equals(0));
 
    CHECK(iters_10ms >= 10000);
 
@@ -152,10 +168,11 @@ TEST_CASE("FFI KDF", "[ffi]")
    const size_t out_len = 18;
    std::vector<uint8_t> out_buf(out_len);
 
-   REQUIRE(botan_kdf("KDF2(SHA-1)", out_buf.data(), out_len,
-                     secret.data(), secret.size(), salt.data(), salt.size()) == 0);
+   REQUIRE_THAT(botan_kdf("KDF2(SHA-1)", out_buf.data(), out_len,
+                     secret.data(), secret.size(), salt.data(), salt.size()),
+                Equals(0));
 
-   CHECK(hex_encode(out_buf) == "3A5DC9AA1C872B4744515AC2702D6396FC2A");
+   CHECK_THAT(hex_encode(out_buf), Equals("3A5DC9AA1C872B4744515AC2702D6396FC2A"));
    }
 
 TEST_CASE("FFI bcrypt", "[ffi]")
@@ -166,12 +183,11 @@ TEST_CASE("FFI bcrypt", "[ffi]")
    std::vector<uint8_t> outbuf(62);
    size_t ol = outbuf.size();
 
-   CHECK(0 == botan_bcrypt_generate(outbuf.data(), &ol, "password", rng, 10, 0));
+   CHECK_THAT(botan_bcrypt_generate(outbuf.data(), &ol, "password", rng, 10, 0), Equals(0));
    botan_rng_destroy(rng);
 
-   CHECK(1 == botan_bcrypt_is_valid("wrong", reinterpret_cast<const char*>(outbuf.data())));
-   CHECK(0 == botan_bcrypt_is_valid("password", reinterpret_cast<const char*>(outbuf.data())));
-
+   CHECK_THAT(botan_bcrypt_is_valid("wrong", reinterpret_cast<const char*>(outbuf.data())), Equals(1));
+   CHECK_THAT(botan_bcrypt_is_valid("password", reinterpret_cast<const char*>(outbuf.data())), Equals(0));
    }
 
 TEST_CASE("FFI RSA", "[ffi]")
@@ -180,45 +196,49 @@ TEST_CASE("FFI RSA", "[ffi]")
    botan_rng_init(&rng, "system");
 
    botan_privkey_t priv;
-   REQUIRE(0 == botan_privkey_create_rsa(&priv, rng, 2048));
+   REQUIRE_THAT(botan_privkey_create_rsa(&priv, rng, 2048), Equals(0));
 
    botan_pubkey_t pub;
-   CHECK(0 == botan_privkey_export_pubkey(&pub, priv));
+   CHECK_THAT(botan_privkey_export_pubkey(&pub, priv), Equals(0));
 
    std::string name(64, '\x00');
    size_t name_len = name.size();
-   CHECK(0 == botan_pubkey_algo_name(pub, &name[0], &name_len));
+   CHECK_THAT(botan_pubkey_algo_name(pub, &name[0], &name_len), Equals(0));
    name.resize(name_len - 1);
 
-   CHECK(name == "RSA");
+   CHECK_THAT(name, Equals("RSA"));
 
    botan_pk_op_encrypt_t encrypt;
-   CHECK(0 == botan_pk_op_encrypt_create(&encrypt, pub, "OAEP(SHA-256)", 0));
+   CHECK_THAT(botan_pk_op_encrypt_create(&encrypt, pub, "OAEP(SHA-256)", 0), Equals(0));
 
    std::vector<uint8_t> plaintext(32);
-   CHECK(0 == botan_rng_get(rng, plaintext.data(), plaintext.size()));
+   CHECK_THAT(botan_rng_get(rng, plaintext.data(), plaintext.size()), Equals(0));
 
    std::vector<uint8_t> ciphertext(256); // TODO: no way to know this size from API
    size_t ctext_len = ciphertext.size();
-   CHECK(botan_pk_op_encrypt(encrypt, rng, ciphertext.data(), &ctext_len,
-                             plaintext.data(), plaintext.size()) == 0);
+   CHECK_THAT(botan_pk_op_encrypt(encrypt, rng, ciphertext.data(), &ctext_len,
+                             plaintext.data(), plaintext.size()),
+              Equals(0));
    ciphertext.resize(ctext_len);
 
-   CHECK(0 == botan_pk_op_encrypt_destroy(encrypt));
+   int retEncryptDestroy = botan_pk_op_encrypt_destroy(encrypt);
+   CHECK_THAT(retEncryptDestroy, Equals(0));
    //CHECK(botan_pk_op_encrypt_destroy(encrypt) < 0);
 
    botan_pk_op_decrypt_t decrypt;
-   CHECK(0 == botan_pk_op_decrypt_create(&decrypt, priv, "OAEP(SHA-256)", 0));
+   CHECK_THAT(botan_pk_op_decrypt_create(&decrypt, priv, "OAEP(SHA-256)", 0), Equals(0));
 
    std::vector<uint8_t> decrypted(256); // TODO as with above
    size_t decrypted_len = decrypted.size();
-   CHECK(botan_pk_op_decrypt(decrypt, decrypted.data(), &decrypted_len,
-                             ciphertext.data(), ciphertext.size()) == 0);
+   CHECK_THAT(botan_pk_op_decrypt(decrypt, decrypted.data(), &decrypted_len,
+                             ciphertext.data(), ciphertext.size()),
+              Equals(0));
    decrypted.resize(decrypted_len);
 
-   CHECK(hex_encode(plaintext) == hex_encode(decrypted));
+   CHECK_THAT(hex_encode(plaintext), Equals(hex_encode(decrypted)));
 
-   CHECK(0 == botan_pk_op_decrypt_destroy(decrypt));
+   int retDecryptDestroy = botan_pk_op_decrypt_destroy(decrypt);
+   CHECK_THAT(retDecryptDestroy, Equals(0));
    //CHECK(botan_pk_op_decrypt_destroy(decrypt) < 0);
 
    botan_rng_destroy(rng);
@@ -233,58 +253,82 @@ TEST_CASE("FFI ECDSA", "[ffi]")
    int rc = botan_privkey_create_ecdsa(&priv, rng, "secp384r1");
 
    botan_pubkey_t pub;
-   CHECK(0 == botan_privkey_export_pubkey(&pub, priv));
+   CHECK_THAT(botan_privkey_export_pubkey(&pub, priv), Equals(0));
 
    std::string name(64, '\x00');
    size_t name_len = name.size();
-   CHECK(0 == botan_pubkey_algo_name(pub, &name[0], &name_len));
+   CHECK_THAT(botan_pubkey_algo_name(pub, &name[0], &name_len), Equals(0));
    name.resize(name_len - 1);
 
-   CHECK(name == "ECDSA");
+   CHECK_THAT(name, Equals("ECDSA"));
 
    botan_pk_op_sign_t signer;
-   CHECK(0 == botan_pk_op_sign_create(&signer, priv, "EMSA1(SHA-384)", 0));
+   CHECK_THAT(botan_pk_op_sign_create(&signer, priv, "EMSA1(SHA-384)", 0), Equals(0));
 
    std::vector<uint8_t> message(1280);
-   CHECK(0 == botan_rng_get(rng, message.data(), message.size()));
+   CHECK_THAT(botan_rng_get(rng, message.data(), message.size()), Equals(0));
 
    // TODO: break input into multiple calls to update
-   CHECK(0 == botan_pk_op_sign_update(signer, message.data(), message.size()));
+   int retSignUpdate = botan_pk_op_sign_update(signer, message.data(), message.size());
+   CHECK_THAT(retSignUpdate, Equals(0));
 
    std::vector<uint8_t> signature(96); // TODO: no way to derive this from API
    size_t sig_len = signature.size();
-   CHECK(0 == botan_pk_op_sign_finish(signer, rng, signature.data(), &sig_len));
+
+   int retSignFinish = botan_pk_op_sign_finish(signer, rng, signature.data(), &sig_len);
+   CHECK_THAT(retSignFinish, Equals(0));
+
    signature.resize(sig_len);
-   CHECK(0 == botan_pk_op_sign_destroy(signer));
+
+   int retSignDestroy = botan_pk_op_sign_destroy(signer);
+   CHECK_THAT(retSignDestroy, Equals(0));
 
    botan_pk_op_verify_t verifier;
-   CHECK(0 == botan_pk_op_verify_create(&verifier, pub, "EMSA1(SHA-384)", 0));
+   int retVerifyCreate = botan_pk_op_verify_create(&verifier, pub, "EMSA1(SHA-384)", 0);
+   CHECK_THAT(retVerifyCreate, Equals(0));
 
-   CHECK(0 == botan_pk_op_verify_update(verifier, message.data(), message.size()));
-   CHECK(0 == botan_pk_op_verify_finish(verifier, signature.data(), signature.size()));
+      {
+      int retVerifyUpdate = botan_pk_op_verify_update(verifier, message.data(), message.size());
+      CHECK_THAT(retVerifyUpdate, Equals(0));
+      int retVerifyFinish = botan_pk_op_verify_finish(verifier, signature.data(), signature.size());
+      CHECK_THAT(retVerifyFinish, Equals(0));
+      }
 
    // TODO: randomize this
    signature[0] ^= 1;
-
-   CHECK(0 == botan_pk_op_verify_update(verifier, message.data(), message.size()));
-   CHECK(1 == botan_pk_op_verify_finish(verifier, signature.data(), signature.size()));
+      {
+      int retVerifyUpdate = botan_pk_op_verify_update(verifier, message.data(), message.size());
+      CHECK_THAT(retVerifyUpdate, Equals(0));
+      int retVerifyFinish = botan_pk_op_verify_finish(verifier, signature.data(), signature.size());
+      CHECK_THAT(retVerifyFinish, Equals(1));
+      }
 
    message[0] ^= 1;
-
-   CHECK(0 == botan_pk_op_verify_update(verifier, message.data(), message.size()));
-   CHECK(1 == botan_pk_op_verify_finish(verifier, signature.data(), signature.size()));
+      {
+      int retVerifyUpdate = botan_pk_op_verify_update(verifier, message.data(), message.size());
+      CHECK_THAT(retVerifyUpdate, Equals(0));
+      int retVerifyFinish = botan_pk_op_verify_finish(verifier, signature.data(), signature.size());
+      CHECK_THAT(retVerifyFinish, Equals(1));
+      }
 
    signature[0] ^= 1;
-
-   CHECK(0 == botan_pk_op_verify_update(verifier, message.data(), message.size()));
-   CHECK(1 == botan_pk_op_verify_finish(verifier, signature.data(), signature.size()));
+      {
+      int retVerifyUpdate = botan_pk_op_verify_update(verifier, message.data(), message.size());
+      CHECK_THAT(retVerifyUpdate, Equals(0));
+      int retVerifyFinish = botan_pk_op_verify_finish(verifier, signature.data(), signature.size());
+      CHECK_THAT(retVerifyFinish, Equals(1));
+      }
 
    message[0] ^= 1;
+      {
+      int retVerifyUpdate = botan_pk_op_verify_update(verifier, message.data(), message.size());
+      CHECK_THAT(retVerifyUpdate, Equals(0));
+      int retVerifyFinish = botan_pk_op_verify_finish(verifier, signature.data(), signature.size());
+      CHECK_THAT(retVerifyFinish, Equals(0));
+      }
 
-   CHECK(0 == botan_pk_op_verify_update(verifier, message.data(), message.size()));
-   CHECK(0 == botan_pk_op_verify_finish(verifier, signature.data(), signature.size()));
-
-   CHECK(0 == botan_pk_op_verify_destroy(verifier));
+   int retVerifyDestroy = botan_pk_op_verify_destroy(verifier);
+   CHECK_THAT(retVerifyDestroy, Equals(0));
 
    botan_rng_destroy(rng);
    }
@@ -295,48 +339,50 @@ TEST_CASE("FFI ECDH", "[ffi]")
    botan_rng_init(&rng, "system");
 
    botan_privkey_t priv1;
-   CHECK(0 == botan_privkey_create_ecdh(&priv1, rng, "secp256r1"));
+   CHECK_THAT(botan_privkey_create_ecdh(&priv1, rng, "secp256r1"), Equals(0));
    botan_privkey_t priv2;
-   CHECK(0 == botan_privkey_create_ecdh(&priv2, rng, "secp256r1"));
+   CHECK_THAT(botan_privkey_create_ecdh(&priv2, rng, "secp256r1"), Equals(0));
 
    botan_pubkey_t pub1;
-   CHECK(0 == botan_privkey_export_pubkey(&pub1, priv1));
+   CHECK_THAT(botan_privkey_export_pubkey(&pub1, priv1), Equals(0));
    botan_pubkey_t pub2;
-   CHECK(0 == botan_privkey_export_pubkey(&pub2, priv2));
+   CHECK_THAT(botan_privkey_export_pubkey(&pub2, priv2), Equals(0));
 
    botan_pk_op_ka_t ka1;
-   CHECK(0 == botan_pk_op_key_agreement_create(&ka1, priv1, "KDF2(SHA-256)", 0));
+   CHECK_THAT(botan_pk_op_key_agreement_create(&ka1, priv1, "KDF2(SHA-256)", 0), Equals(0));
    botan_pk_op_ka_t ka2;
-   CHECK(0 == botan_pk_op_key_agreement_create(&ka2, priv2, "KDF2(SHA-256)", 0));
+   CHECK_THAT(botan_pk_op_key_agreement_create(&ka2, priv2, "KDF2(SHA-256)", 0), Equals(0));
 
    std::vector<uint8_t> pubkey1(256); // length problem again
    size_t pubkey1_len = pubkey1.size();
-   CHECK(0 == botan_pk_op_key_agreement_export_public(priv1, pubkey1.data(), &pubkey1_len));
+   CHECK_THAT(botan_pk_op_key_agreement_export_public(priv1, pubkey1.data(), &pubkey1_len), Equals(0));
    pubkey1.resize(pubkey1_len);
 
    std::vector<uint8_t> pubkey2(256); // length problem again
    size_t pubkey2_len = pubkey2.size();
-   CHECK(0 == botan_pk_op_key_agreement_export_public(priv2, pubkey2.data(), &pubkey2_len));
+   CHECK_THAT(botan_pk_op_key_agreement_export_public(priv2, pubkey2.data(), &pubkey2_len), Equals(0));
    pubkey2.resize(pubkey2_len);
 
    std::vector<uint8_t> salt(32);
-   CHECK(0 == botan_rng_get(rng, salt.data(), salt.size()));
+   CHECK_THAT(botan_rng_get(rng, salt.data(), salt.size()), Equals(0));
 
    const size_t shared_key_len = 64;
 
    std::vector<uint8_t> key1(shared_key_len);
    size_t key1_len = key1.size();
-   CHECK(0 == botan_pk_op_key_agreement(ka1, key1.data(), &key1_len,
+   CHECK_THAT(botan_pk_op_key_agreement(ka1, key1.data(), &key1_len,
                                         pubkey2.data(), pubkey2.size(),
-                                        salt.data(), salt.size()));
+                                        salt.data(), salt.size()),
+              Equals(0));
 
    std::vector<uint8_t> key2(shared_key_len);
    size_t key2_len = key2.size();
-   CHECK(0 == botan_pk_op_key_agreement(ka2, key2.data(), &key2_len,
+   CHECK_THAT(botan_pk_op_key_agreement(ka2, key2.data(), &key2_len,
                                         pubkey1.data(), pubkey1.size(),
-                                        salt.data(), salt.size()));
+                                        salt.data(), salt.size()),
+              Equals(0));
 
-   CHECK(hex_encode(key1) == hex_encode(key2));
+   CHECK_THAT(hex_encode(key1), Equals(hex_encode(key2)));
 
    botan_rng_destroy(rng);
    }
diff --git a/src/tests/test_fuzz.cpp b/src/tests/test_fuzzer.cpp
index a44110f24..212a313a8 100644
--- a/src/tests/test_fuzz.cpp
+++ b/src/tests/test_fuzzer.cpp
@@ -48,11 +48,11 @@ size_t test_x509_fuzz()
 
       if(duration > 100)
          {
-         std::cout << "Fuzz test " << vec << " took " << duration << " ms\n";
+         std::cout << "Fuzzer test " << vec << " took " << duration << " ms" << std::endl;
          }
       }
 
-   test_report("Fuzz Checks", tests, fails);
+   test_report("Fuzzer checks", tests, fails);
 #endif
 
    return fails;