Repository: randombit/botan
Pull request #2546 (2020-12-14 14:00:15)

Avoid using deprecated functions for key loading
Also update the documentation a bit, this area is really out of date


Patch:
diff --git a/doc/api_ref/pubkey.rst b/doc/api_ref/pubkey.rst
index a8b93b457..f76c9004a 100644
--- a/doc/api_ref/pubkey.rst
+++ b/doc/api_ref/pubkey.rst
@@ -167,67 +167,25 @@ Unencrypted serialization is also supported.
 Last but not least, there are some functions that will load (and
 decrypt, if necessary) a PKCS #8 private key:
 
-.. cpp:function:: Private_Key* PKCS8::load_key(DataSource& in, \
-   RandomNumberGenerator& rng, const User_Interface& ui)
-
-.. cpp:function:: Private_Key* PKCS8::load_key(DataSource& in, \
-   RandomNumberGenerator& rng, std::string passphrase = "")
-
-.. cpp:function:: Private_Key* PKCS8::load_key(const std::string& filename, \
-   RandomNumberGenerator& rng, const User_Interface& ui)
-
-.. cpp:function:: Private_Key* PKCS8::load_key(const std::string& filename, \
-   RandomNumberGenerator& rng, const std::string& passphrase = "")
+.. cpp:function:: std::unique_ptr<Private_Key> load_key(DataSource& source, \
+                                      std::function<std::string ()> get_passphrase)
+.. cpp:function:: std::unique_ptr<Private_Key> load_key(DataSource& source, \
+                                      const std::string& pass)
+.. cpp:function:: std::unique_ptr<Private_Key> load_key(DataSource& source)
 
 These functions will return an object allocated key object based on the data
 from whatever source it is using (assuming, of course, the source is in fact
 storing a representation of a private key, and the decryption was
 successful). The encoding used (PEM or BER) need not be specified; the format
-will be detected automatically. The key is allocated with ``new``, and should
-be released with ``delete`` when you are done with it. The first takes a
-generic ``DataSource`` that you have to create - the other is a simple wrapper
-functions that take either a filename or a memory buffer and create the
-appropriate ``DataSource``.
+will be detected automatically. The ``DataSource`` is usually a
+``DataSource_Stream`` to read from a file or ``DataSource_Memory`` for an
+in-memory buffer.
 
 The versions taking a ``std::string`` attempt to decrypt using the password
 given (if the key is encrypted; if it is not, the passphase value will be
 ignored). If the passphrase does not decrypt the key, an exception will be
 thrown.
 
-The ones taking a ``User_Interface`` provide a simple callback interface which
-makes handling incorrect passphrases and such a bit simpler. A
-``User_Interface`` has very little to do with talking to users; it's just a
-way to glue together Botan and whatever user interface you happen to be using.
-
-.. note::
-
-  In a future version, it is likely that ``User_Interface`` will be
-  replaced by a simple callback using ``std::function``.
-
-To use ``User_Interface``, derive a subclass and implement:
-
-.. cpp:function:: std::string User_Interface::get_passphrase(const std::string& what, \
-   const std::string& source, UI_Result& result) const
-
-  The ``what`` argument specifies what the passphrase is needed for (for
-  example, PKCS #8 key loading passes ``what`` as "PKCS #8 private key"). This
-  lets you provide the user with some indication of *why* your application is
-  asking for a passphrase; feel free to pass the string through ``gettext(3)``
-  or moral equivalent for i18n purposes. Similarly, ``source`` specifies where
-  the data in question came from, if available (for example, a file name). If
-  the source is not available for whatever reason, then ``source`` will be an
-  empty string; be sure to account for this possibility.
-
-  The function returns the passphrase as the return value, and a status code
-  in ``result`` (either ``OK`` or ``CANCEL_ACTION``). If ``CANCEL_ACTION`` is
-  returned in ``result``, then the return value will be ignored, and the
-  caller will take whatever action is necessary (typically, throwing an
-  exception stating that the passphrase couldn't be determined). In the
-  specific case of PKCS #8 key decryption, a ``Decoding_Error`` exception will
-  be thrown; your UI should assume this can happen, and provide appropriate
-  error handling (such as putting up a dialog box informing the user of the
-  situation, and canceling the operation in progress).
-
 .. _serializing_public_keys:
 
 Serializing Public Keys
diff --git a/src/cli/pubkey.cpp b/src/cli/pubkey.cpp
index 1c5aaab5f..e70e616f8 100644
--- a/src/cli/pubkey.cpp
+++ b/src/cli/pubkey.cpp
@@ -309,11 +309,11 @@ class PKCS8_Tool final : public Command
 
          if(pass_in.empty())
             {
-            key.reset(Botan::PKCS8::load_key(key_src, rng()));
+            key = Botan::PKCS8::load_key(key_src);
             }
          else
             {
-            key.reset(Botan::PKCS8::load_key(key_src, rng(), pass_in));
+            key = Botan::PKCS8::load_key(key_src, pass_in);
             }
 
          const std::chrono::milliseconds pbe_millis(get_arg_sz("pbe-millis"));
diff --git a/src/cli/tls_helpers.h b/src/cli/tls_helpers.h
index f23a70798..c973d685d 100644
--- a/src/cli/tls_helpers.h
+++ b/src/cli/tls_helpers.h
@@ -55,13 +55,13 @@ class Basic_Credentials_Manager : public Botan::Credentials_Manager
 #endif
          }
 
-      Basic_Credentials_Manager(Botan::RandomNumberGenerator& rng,
-                                const std::string& server_crt,
+      Basic_Credentials_Manager(const std::string& server_crt,
                                 const std::string& server_key)
          {
          Certificate_Info cert;
 
-         cert.key.reset(Botan::PKCS8::load_key(server_key, rng));
+         Botan::DataSource_Stream key_in(server_key);
+         cert.key = Botan::PKCS8::load_key(key_in);
 
          Botan::DataSource_Stream in(server_crt);
          while(!in.end_of_data())
diff --git a/src/cli/tls_http_server.cpp b/src/cli/tls_http_server.cpp
index aaf740fcf..6ce30312f 100644
--- a/src/cli/tls_http_server.cpp
+++ b/src/cli/tls_http_server.cpp
@@ -528,7 +528,7 @@ class TLS_HTTP_Server final : public Command
          const size_t num_threads = thread_count();
          const size_t max_clients = get_arg_sz("max-clients");
 
-         Basic_Credentials_Manager creds(rng(), server_crt, server_key);
+         Basic_Credentials_Manager creds(server_crt, server_key);
 
          auto policy = load_tls_policy(get_arg("policy"));
 
diff --git a/src/cli/tls_proxy.cpp b/src/cli/tls_proxy.cpp
index bd96530c2..686c01ba8 100644
--- a/src/cli/tls_proxy.cpp
+++ b/src/cli/tls_proxy.cpp
@@ -475,7 +475,7 @@ class TLS_Proxy final : public Command
          const size_t num_threads = thread_count();
          const size_t max_clients = get_arg_sz("max-clients");
 
-         Basic_Credentials_Manager creds(rng(), server_crt, server_key);
+         Basic_Credentials_Manager creds(server_crt, server_key);
 
          auto policy = load_tls_policy(get_arg("policy"));
 
diff --git a/src/cli/tls_server.cpp b/src/cli/tls_server.cpp
index c39061e64..2d882f3dc 100644
--- a/src/cli/tls_server.cpp
+++ b/src/cli/tls_server.cpp
@@ -82,7 +82,7 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
 
          Botan::TLS::Session_Manager_In_Memory session_manager(rng()); // TODO sqlite3
 
-         Basic_Credentials_Manager creds(rng(), server_crt, server_key);
+         Basic_Credentials_Manager creds(server_crt, server_key);
 
          output() << "Listening for new connections on " << transport << " port " << port << std::endl;
 
diff --git a/src/cli/x509.cpp b/src/cli/x509.cpp
index 64e66366e..a11411dfd 100644
--- a/src/cli/x509.cpp
+++ b/src/cli/x509.cpp
@@ -109,13 +109,14 @@ class Sign_Cert final : public Command
          const std::string hash = get_arg("hash");
 
          std::unique_ptr<Botan::Private_Key> key;
+         Botan::DataSource_Stream key_stream(key_file);
          if(!pass.empty())
             {
-            key.reset(Botan::PKCS8::load_key(key_file, rng(), pass));
+            key = Botan::PKCS8::load_key(key_stream, pass);
             }
          else
             {
-            key.reset(Botan::PKCS8::load_key(key_file, rng()));
+            key = Botan::PKCS8::load_key(key_stream);
             }
 
          if(!key)
@@ -312,7 +313,8 @@ class Gen_Self_Signed final : public Command
          {
          const std::string key_file = get_arg("key");
          const std::string passphrase = get_passphrase_arg("Passphrase for " + key_file, "key-pass");
-         std::unique_ptr<Botan::Private_Key> key(Botan::PKCS8::load_key(key_file, rng(), passphrase));
+         Botan::DataSource_Stream key_stream(key_file);
+         std::unique_ptr<Botan::Private_Key> key = Botan::PKCS8::load_key(key_stream, passphrase);
 
          if(!key)
             {
@@ -373,7 +375,8 @@ class Generate_PKCS10 final : public Command
 
       void go() override
          {
-         std::unique_ptr<Botan::Private_Key> key(Botan::PKCS8::load_key(get_arg("key"), rng(), get_arg("key-pass")));
+         Botan::DataSource_Stream key_stream(get_arg("key"));
+         std::unique_ptr<Botan::Private_Key> key = Botan::PKCS8::load_key(key_stream, get_arg("key-pass"));
 
          if(!key)
             {
diff --git a/src/lib/ffi/ffi.h b/src/lib/ffi/ffi.h
index 09a77ca1e..dc916ad4a 100644
--- a/src/lib/ffi/ffi.h
+++ b/src/lib/ffi/ffi.h
@@ -544,8 +544,8 @@ BOTAN_PUBLIC_API(2,0) int botan_cipher_destroy(botan_cipher_t cipher);
 *  botan_pwdhash(pbkdf_algo, iterations, 0, 0, out, out_len,
 *                passphrase, 0, salt, salt_len);
 */
-BOTAN_PUBLIC_API(2,0) int
 BOTAN_DEPRECATED("Use botan_pwdhash")
+BOTAN_PUBLIC_API(2,0) int
 botan_pbkdf(const char* pbkdf_algo,
             uint8_t out[], size_t out_len,
             const char* passphrase,
@@ -645,8 +645,8 @@ int BOTAN_PUBLIC_API(2,8) botan_pwdhash_timed(
 * Deprecated; use
 * botan_pwdhash("Scrypt", N, r, p, out, out_len, password, 0, salt, salt_len);
 */
-BOTAN_PUBLIC_API(2,8) int
 BOTAN_DEPRECATED("Use botan_pwdhash")
+BOTAN_PUBLIC_API(2,8) int
 botan_scrypt(uint8_t out[], size_t out_len,
              const char* passphrase,
              const uint8_t salt[], size_t salt_len,
@@ -837,9 +837,9 @@ BOTAN_PUBLIC_API(2,1) int botan_mp_flip_sign(botan_mp_t mp);
 
 BOTAN_PUBLIC_API(2,1) int botan_mp_is_zero(const botan_mp_t mp);
 
-BOTAN_PUBLIC_API(2,1) BOTAN_DEPRECATED("Use botan_mp_get_bit(0)")
+BOTAN_DEPRECATED("Use botan_mp_get_bit(0)") BOTAN_PUBLIC_API(2,1)
 int botan_mp_is_odd(const botan_mp_t mp);
-BOTAN_PUBLIC_API(2,1) BOTAN_DEPRECATED("Use botan_mp_get_bit(0)")
+BOTAN_DEPRECATED("Use botan_mp_get_bit(0)") BOTAN_PUBLIC_API(2,1)
 int botan_mp_is_even(const botan_mp_t mp);
 
 BOTAN_PUBLIC_API(2,8) int botan_mp_add_u32(botan_mp_t result, const botan_mp_t x, uint32_t y);
@@ -967,15 +967,15 @@ BOTAN_PUBLIC_API(2,0) int botan_privkey_create(botan_privkey_t* key,
 
 BOTAN_PUBLIC_API(2,0) int botan_privkey_check_key(botan_privkey_t key, botan_rng_t rng, uint32_t flags);
 
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_create")
+BOTAN_DEPRECATED("Use botan_privkey_create") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_create_rsa(botan_privkey_t* key, botan_rng_t rng, size_t n_bits);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_create")
+BOTAN_DEPRECATED("Use botan_privkey_create") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_create_ecdsa(botan_privkey_t* key, botan_rng_t rng, const char* params);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_create")
+BOTAN_DEPRECATED("Use botan_privkey_create") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_create_ecdh(botan_privkey_t* key, botan_rng_t rng, const char* params);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_create")
+BOTAN_DEPRECATED("Use botan_privkey_create") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_create_mceliece(botan_privkey_t* key, botan_rng_t rng, size_t n, size_t t);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_create")
+BOTAN_DEPRECATED("Use botan_privkey_create") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_create_dh(botan_privkey_t* key, botan_rng_t rng, const char* param);
 
 /**
@@ -1143,15 +1143,15 @@ BOTAN_PUBLIC_API(2,8) int botan_privkey_load_rsa_pkcs1(botan_privkey_t* key,
                                                        const uint8_t bits[],
                                                        size_t len);
 
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_get_field")
+BOTAN_DEPRECATED("Use botan_privkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_rsa_get_p(botan_mp_t p, botan_privkey_t rsa_key);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_get_field")
+BOTAN_DEPRECATED("Use botan_privkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_rsa_get_q(botan_mp_t q, botan_privkey_t rsa_key);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_get_field")
+BOTAN_DEPRECATED("Use botan_privkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_rsa_get_d(botan_mp_t d, botan_privkey_t rsa_key);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_get_field")
+BOTAN_DEPRECATED("Use botan_privkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_rsa_get_n(botan_mp_t n, botan_privkey_t rsa_key);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_get_field")
+BOTAN_DEPRECATED("Use botan_privkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_rsa_get_e(botan_mp_t e, botan_privkey_t rsa_key);
 
 BOTAN_PUBLIC_API(2,8) int botan_privkey_rsa_get_privkey(botan_privkey_t rsa_key,
@@ -1162,9 +1162,9 @@ BOTAN_PUBLIC_API(2,0) int botan_pubkey_load_rsa(botan_pubkey_t* key,
                                                 botan_mp_t n,
                                                 botan_mp_t e);
 
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_pubkey_get_field")
+BOTAN_DEPRECATED("Use botan_pubkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_pubkey_rsa_get_e(botan_mp_t e, botan_pubkey_t rsa_key);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_pubkey_get_field")
+BOTAN_DEPRECATED("Use botan_pubkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_pubkey_rsa_get_n(botan_mp_t n, botan_pubkey_t rsa_key);
 
 /*
@@ -1182,16 +1182,16 @@ BOTAN_PUBLIC_API(2,0) int botan_pubkey_load_dsa(botan_pubkey_t* key,
                                     botan_mp_t g,
                                     botan_mp_t y);
 
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_privkey_get_field")
+BOTAN_DEPRECATED("Use botan_privkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_privkey_dsa_get_x(botan_mp_t n, botan_privkey_t key);
 
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_pubkey_get_field")
+BOTAN_DEPRECATED("Use botan_pubkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_pubkey_dsa_get_p(botan_mp_t p, botan_pubkey_t key);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_pubkey_get_field")
+BOTAN_DEPRECATED("Use botan_pubkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_pubkey_dsa_get_q(botan_mp_t q, botan_pubkey_t key);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_pubkey_get_field")
+BOTAN_DEPRECATED("Use botan_pubkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_pubkey_dsa_get_g(botan_mp_t d, botan_pubkey_t key);
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("Use botan_pubkey_get_field")
+BOTAN_DEPRECATED("Use botan_pubkey_get_field") BOTAN_PUBLIC_API(2,0)
 int botan_pubkey_dsa_get_y(botan_mp_t y, botan_pubkey_t key);
 
 /*
@@ -1336,13 +1336,13 @@ int botan_privkey_load_sm2(botan_privkey_t* key,
                            const botan_mp_t scalar,
                            const char* curve_name);
 
-BOTAN_PUBLIC_API(2,2) BOTAN_DEPRECATED("Use botan_pubkey_load_sm2")
+BOTAN_DEPRECATED("Use botan_pubkey_load_sm2") BOTAN_PUBLIC_API(2,2)
 int botan_pubkey_load_sm2_enc(botan_pubkey_t* key,
                               const botan_mp_t public_x,
                               const botan_mp_t public_y,
                               const char* curve_name);
 
-BOTAN_PUBLIC_API(2,2) BOTAN_DEPRECATED("Use botan_privkey_load_sm2")
+BOTAN_DEPRECATED("Use botan_privkey_load_sm2") BOTAN_PUBLIC_API(2,2)
 int botan_privkey_load_sm2_enc(botan_privkey_t* key,
                                const botan_mp_t scalar,
                                const char* curve_name);
@@ -1482,7 +1482,7 @@ BOTAN_PUBLIC_API(2,0) int botan_pkcs_hash_id(const char* hash_name, uint8_t pkcs
 /*
 * Always returns BOTAN_FFI_ERROR_NOT_IMPLEMENTED
 */
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("No longer implemented")
+BOTAN_DEPRECATED("No longer implemented") BOTAN_PUBLIC_API(2,0)
 int botan_mceies_encrypt(botan_pubkey_t mce_key,
                          botan_rng_t rng,
                          const char* aead,
@@ -1493,7 +1493,7 @@ int botan_mceies_encrypt(botan_pubkey_t mce_key,
 /*
 * Always returns BOTAN_FFI_ERROR_NOT_IMPLEMENTED
 */
-BOTAN_PUBLIC_API(2,0) BOTAN_DEPRECATED("No longer implemented")
+BOTAN_DEPRECATED("No longer implemented") BOTAN_PUBLIC_API(2,0)
 int botan_mceies_decrypt(botan_privkey_t mce_key,
                          const char* aead,
                          const uint8_t ct[], size_t ct_len,
diff --git a/src/lib/utils/compiler.h b/src/lib/utils/compiler.h
index f3b2cb51c..a311b56e1 100644
--- a/src/lib/utils/compiler.h
+++ b/src/lib/utils/compiler.h
@@ -76,7 +76,7 @@
 /*
 * Define BOTAN_DEPRECATED
 */
-#if !defined(BOTAN_NO_DEPRECATED_WARNINGS) && !defined(BOTAN_IS_BEING_BUILT) && !defined(BOTAN_AMALGAMATION_H_)
+#if !defined(BOTAN_NO_DEPRECATED_WARNINGS) && !defined(BOTAN_AMALGAMATION_H_)
 
   #if defined(__cplusplus)
     #define BOTAN_DEPRECATED(msg) [[deprecated(msg)]]
@@ -86,15 +86,17 @@
     #define BOTAN_DEPRECATED(msg) __declspec(deprecated(msg))
   #endif
 
-  #if defined(__clang__)
-    #define BOTAN_DEPRECATED_HEADER(hdr) _Pragma("message \"this header is deprecated\"")
-    #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) _Pragma("message \"this header will be made internal in the future\"")
-  #elif defined(_MSC_VER)
-    #define BOTAN_DEPRECATED_HEADER(hdr) __pragma(message("this header is deprecated"))
-    #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) __pragma(message("this header will be made internal in the future"))
-  #elif defined(__GNUC__)
-    #define BOTAN_DEPRECATED_HEADER(hdr) _Pragma("GCC warning \"this header is deprecated\"")
-    #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) _Pragma("GCC warning \"this header will be made internal in the future\"")
+  #if !defined(BOTAN_IS_BEING_BUILT)
+    #if defined(__clang__)
+      #define BOTAN_DEPRECATED_HEADER(hdr) _Pragma("message \"this header is deprecated\"")
+      #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) _Pragma("message \"this header will be made internal in the future\"")
+    #elif defined(_MSC_VER)
+      #define BOTAN_DEPRECATED_HEADER(hdr) __pragma(message("this header is deprecated"))
+      #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) __pragma(message("this header will be made internal in the future"))
+    #elif defined(__GNUC__)
+      #define BOTAN_DEPRECATED_HEADER(hdr) _Pragma("GCC warning \"this header is deprecated\"")
+      #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) _Pragma("GCC warning \"this header will be made internal in the future\"")
+    #endif
   #endif
 
 #endif
diff --git a/src/lib/x509/certstor_sql/certstor_sql.cpp b/src/lib/x509/certstor_sql/certstor_sql.cpp
index deab7abdd..b29165ac3 100644
--- a/src/lib/x509/certstor_sql/certstor_sql.cpp
+++ b/src/lib/x509/certstor_sql/certstor_sql.cpp
@@ -202,7 +202,7 @@ std::shared_ptr<const Private_Key> Certificate_Store_In_SQL::find_key(const X509
       {
       auto blob = stmt->get_blob(0);
       DataSource_Memory src(blob.first,blob.second);
-      key.reset(PKCS8::load_key(src, m_rng, m_password));
+      key = PKCS8::load_key(src, m_password);
       }
 
    return key;


Test patch:
diff --git a/src/tests/test_c25519.cpp b/src/tests/test_c25519.cpp
index 57687b182..9873d601e 100644
--- a/src/tests/test_c25519.cpp
+++ b/src/tests/test_c25519.cpp
@@ -96,8 +96,8 @@ class Curve25519_Roundtrip_Test final : public Test
             Botan::DataSource_Memory a_priv_ds(a_priv_pem);
             Botan::DataSource_Memory b_priv_ds(b_priv_pem);
 
-            std::unique_ptr<Botan::Private_Key> a_priv(Botan::PKCS8::load_key(a_priv_ds, Test::rng(), [a_pass]() { return a_pass; }));
-            std::unique_ptr<Botan::Private_Key> b_priv(Botan::PKCS8::load_key(b_priv_ds, Test::rng(), b_pass));
+            std::unique_ptr<Botan::Private_Key> a_priv = Botan::PKCS8::load_key(a_priv_ds, [a_pass]() { return a_pass; });
+            std::unique_ptr<Botan::Private_Key> b_priv = Botan::PKCS8::load_key(b_priv_ds, b_pass);
 #else
             const std::string a_priv_pem = Botan::PKCS8::PEM_encode(a_priv_gen);
             const std::string b_priv_pem = Botan::PKCS8::PEM_encode(b_priv_gen);
@@ -106,8 +106,8 @@ class Curve25519_Roundtrip_Test final : public Test
             Botan::DataSource_Memory a_priv_ds(a_priv_pem);
             Botan::DataSource_Memory b_priv_ds(b_priv_pem);
 
-            std::unique_ptr<Botan::Private_Key> a_priv(Botan::PKCS8::load_key(a_priv_ds, Test::rng()));
-            std::unique_ptr<Botan::Private_Key> b_priv(Botan::PKCS8::load_key(b_priv_ds, Test::rng()));
+            std::unique_ptr<Botan::Private_Key> a_priv = Botan::PKCS8::load_key(a_priv_ds);
+            std::unique_ptr<Botan::Private_Key> b_priv = Botan::PKCS8::load_key(b_priv_ds);
 #endif
 
             // Export public keys as PEM
diff --git a/src/tests/test_certstor.cpp b/src/tests/test_certstor.cpp
index 681b323ca..4fe2cc0e9 100644
--- a/src/tests/test_certstor.cpp
+++ b/src/tests/test_certstor.cpp
@@ -395,14 +395,14 @@ class Certstor_Tests final : public Test
             return {result};
             }
 
-         auto& rng = Test::rng();
          std::vector<CertificateAndKey> certsandkeys;
 
          for(const auto& certandkey_filenames : certsandkeys_filenames)
             {
             const Botan::X509_Certificate certificate(test_dir + "/" + certandkey_filenames.certificate);
-            std::shared_ptr<Botan::Private_Key> private_key(Botan::PKCS8::load_key(test_dir + "/" +
-                  certandkey_filenames.private_key, rng));
+
+            Botan::DataSource_Stream key_stream(test_dir + "/" + certandkey_filenames.private_key);
+            std::shared_ptr<Botan::Private_Key> private_key = Botan::PKCS8::load_key(key_stream);
 
             if(!private_key)
                {
diff --git a/src/tests/test_clang_bug.cpp b/src/tests/test_clang_bug.cpp
index 333ceb5a2..96911a544 100644
--- a/src/tests/test_clang_bug.cpp
+++ b/src/tests/test_clang_bug.cpp
@@ -95,7 +95,7 @@ class Clang_Bug_41810 final : public Test
 
          try
             {
-            Botan::PKCS8::load_key(ds, Test::rng(), pw);
+            Botan::PKCS8::load_key(ds, pw);
             result.test_failure("load_key should have thrown due to wrong password");
             }
          catch(const std::exception&)
diff --git a/src/tests/test_dl_group.cpp b/src/tests/test_dl_group.cpp
index 0a792473b..da820d5a4 100644
--- a/src/tests/test_dl_group.cpp
+++ b/src/tests/test_dl_group.cpp
@@ -4,8 +4,6 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#define BOTAN_NO_DEPRECATED_WARNINGS
-
 #include "tests.h"
 
 #if defined(BOTAN_HAS_DL_GROUP)
diff --git a/src/tests/test_ed25519.cpp b/src/tests/test_ed25519.cpp
index f0b4fe269..1d524beb4 100644
--- a/src/tests/test_ed25519.cpp
+++ b/src/tests/test_ed25519.cpp
@@ -92,7 +92,7 @@ class Ed25519_Curdle_Format_Tests final : public Test
          Test::Result result("Ed25519 CURDLE format");
 
          Botan::DataSource_Memory priv_data(priv_key_str);
-         std::unique_ptr<Botan::Private_Key> priv_key(Botan::PKCS8::load_key(priv_data, Test::rng()));
+         std::unique_ptr<Botan::Private_Key> priv_key = Botan::PKCS8::load_key(priv_data);
          result.confirm("Private key loaded", priv_key != nullptr);
 
          Botan::DataSource_Memory pub_data(pub_key_str);
diff --git a/src/tests/test_oid.cpp b/src/tests/test_oid.cpp
index 141c11e9e..430d4fe4b 100644
--- a/src/tests/test_oid.cpp
+++ b/src/tests/test_oid.cpp
@@ -4,8 +4,6 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#define BOTAN_NO_DEPRECATED_WARNINGS
-
 #include "tests.h"
 
 #if defined(BOTAN_HAS_ASN1)
diff --git a/src/tests/test_pubkey.cpp b/src/tests/test_pubkey.cpp
index 03f57c922..b07de2b8c 100644
--- a/src/tests/test_pubkey.cpp
+++ b/src/tests/test_pubkey.cpp
@@ -611,8 +611,8 @@ void test_pbe_roundtrip(Test::Result& result,
                                   std::chrono::milliseconds(10),
                                   pbe_algo));
 
-      std::unique_ptr<Botan::Private_Key> loaded(
-         Botan::PKCS8::load_key(data_src, Test::rng(), passphrase));
+      std::unique_ptr<Botan::Private_Key> loaded =
+         Botan::PKCS8::load_key(data_src, passphrase);
 
       result.confirm("recovered private key from encrypted blob", loaded.get() != nullptr);
       result.test_eq("reloaded key has same type", loaded->algo_name(), key.algo_name());
@@ -630,8 +630,8 @@ void test_pbe_roundtrip(Test::Result& result,
                                   std::chrono::milliseconds(10),
                                   pbe_algo));
 
-      std::unique_ptr<Botan::Private_Key> loaded(
-         Botan::PKCS8::load_key(data_src, Test::rng(), passphrase));
+      std::unique_ptr<Botan::Private_Key> loaded =
+         Botan::PKCS8::load_key(data_src, passphrase);
 
       result.confirm("recovered private key from BER blob", loaded.get() != nullptr);
       result.test_eq("reloaded key has same type", loaded->algo_name(), key.algo_name());
@@ -735,8 +735,8 @@ std::vector<Test::Result> PK_Key_Generation_Test::run()
             {
             const auto ber = key.private_key_info();
             Botan::DataSource_Memory data_src(ber);
-            std::unique_ptr<Botan::Private_Key> loaded(
-               Botan::PKCS8::load_key(data_src, Test::rng()));
+            std::unique_ptr<Botan::Private_Key> loaded =
+               Botan::PKCS8::load_key(data_src);
 
             result.confirm("recovered private key from PEM blob", loaded.get() != nullptr);
             result.test_eq("reloaded key has same type", loaded->algo_name(), key.algo_name());
@@ -750,7 +750,7 @@ std::vector<Test::Result> PK_Key_Generation_Test::run()
          try
             {
             Botan::DataSource_Memory data_src(Botan::PKCS8::BER_encode(key));
-            std::unique_ptr<Botan::Public_Key> loaded(Botan::PKCS8::load_key(data_src, Test::rng()));
+            std::unique_ptr<Botan::Public_Key> loaded = Botan::PKCS8::load_key(data_src);
 
             result.confirm("recovered public key from private", loaded.get() != nullptr);
             result.test_eq("public key has same type", loaded->algo_name(), key.algo_name());
diff --git a/src/tests/test_tls_stream_integration.cpp b/src/tests/test_tls_stream_integration.cpp
index 084d2c08a..60315888e 100644
--- a/src/tests/test_tls_stream_integration.cpp
+++ b/src/tests/test_tls_stream_integration.cpp
@@ -54,7 +54,7 @@ class Side
            m_ctx(m_credentials_manager, m_rng, m_session_mgr, m_policy, Botan::TLS::Server_Information()) {}
 
       Side(const std::string& server_cert, const std::string& server_key)
-         : m_credentials_manager(m_rng, server_cert, server_key),
+         : m_credentials_manager(server_cert, server_key),
            m_ctx(m_credentials_manager, m_rng, m_session_mgr, m_policy, Botan::TLS::Server_Information()) {}
 
       virtual ~Side() {}
diff --git a/src/tests/unit_ecdsa.cpp b/src/tests/unit_ecdsa.cpp
index 68a0d54c9..ad53f00db 100644
--- a/src/tests/unit_ecdsa.cpp
+++ b/src/tests/unit_ecdsa.cpp
@@ -213,7 +213,7 @@ Test::Result test_ecdsa_create_save_load()
       }
 
    Botan::DataSource_Memory pem_src(ecc_private_key_pem);
-   std::unique_ptr<Botan::Private_Key> loaded_key(Botan::PKCS8::load_key(pem_src, Test::rng()));
+   std::unique_ptr<Botan::Private_Key> loaded_key = Botan::PKCS8::load_key(pem_src);;
    Botan::ECDSA_PrivateKey* loaded_ec_key = dynamic_cast<Botan::ECDSA_PrivateKey*>(loaded_key.get());
    result.confirm("the loaded key could be converted into an ECDSA_PrivateKey", loaded_ec_key != nullptr);
 
@@ -255,7 +255,7 @@ Test::Result test_unusual_curve()
    std::string key_odd_curve_str = Botan::PKCS8::PEM_encode(key_odd_curve);
 
    Botan::DataSource_Memory key_data_src(key_odd_curve_str);
-   std::unique_ptr<Botan::Private_Key> loaded_key(Botan::PKCS8::load_key(key_data_src, Test::rng()));
+   std::unique_ptr<Botan::Private_Key> loaded_key = Botan::PKCS8::load_key(key_data_src);
 
    result.confirm("reloaded key", loaded_key.get() != nullptr);
 
@@ -320,8 +320,8 @@ Test::Result test_read_pkcs8()
 
    try
       {
-      std::unique_ptr<Botan::Private_Key> loaded_key_nodp(Botan::PKCS8::load_key(
-               Test::data_file("x509/ecc/nodompar_private.pkcs8.pem"), Test::rng()));
+      Botan::DataSource_Stream key_stream(Test::data_file("x509/ecc/nodompar_private.pkcs8.pem"));
+      auto loaded_key_nodp = Botan::PKCS8::load_key(key_stream);
       // anew in each test with unregistered domain-parameters
       Botan::ECDSA_PrivateKey* ecdsa_nodp = dynamic_cast<Botan::ECDSA_PrivateKey*>(loaded_key_nodp.get());
       if(!ecdsa_nodp)
@@ -338,9 +338,8 @@ Test::Result test_read_pkcs8()
 
       try
          {
-         std::unique_ptr<Botan::Private_Key> loaded_key_withdp(
-            Botan::PKCS8::load_key(Test::data_file("x509/ecc/withdompar_private.pkcs8.pem"), Test::rng()));
-
+         Botan::DataSource_Stream key_stream2(Test::data_file("x509/ecc/withdompar_private.pkcs8.pem"));
+         auto should_fail = Botan::PKCS8::load_key(key_stream2);
          result.test_failure("loaded key with unknown OID");
          }
       catch(std::exception&)
@@ -362,8 +361,8 @@ Test::Result test_ecc_key_with_rfc5915_extensions()
 
    try
       {
-      std::unique_ptr<Botan::Private_Key> pkcs8(
-         Botan::PKCS8::load_key(Test::data_file("x509/ecc/ecc_private_with_rfc5915_ext.pem"), Test::rng()));
+      Botan::DataSource_Stream key_stream(Test::data_file("x509/ecc/ecc_private_with_rfc5915_ext.pem"));
+      std::unique_ptr<Botan::Private_Key> pkcs8 = Botan::PKCS8::load_key(key_stream);
 
       result.confirm("loaded RFC 5915 key", pkcs8.get() != nullptr);
       result.test_eq("key is ECDSA", pkcs8->algo_name(), "ECDSA");
@@ -383,8 +382,8 @@ Test::Result test_ecc_key_with_rfc5915_parameters()
 
    try
       {
-      std::unique_ptr<Botan::Private_Key> pkcs8(
-         Botan::PKCS8::load_key(Test::data_file("x509/ecc/ecc_private_with_rfc5915_parameters.pem"), Test::rng()));
+      Botan::DataSource_Stream key_stream(Test::data_file("x509/ecc/ecc_private_with_rfc5915_parameters.pem"));
+      auto pkcs8 = Botan::PKCS8::load_key(key_stream);
 
       result.confirm("loaded RFC 5915 key", pkcs8.get() != nullptr);
       result.test_eq("key is ECDSA", pkcs8->algo_name(), "ECDSA");
diff --git a/src/tests/unit_x509.cpp b/src/tests/unit_x509.cpp
index 28b4da56a..b969f7501 100644
--- a/src/tests/unit_x509.cpp
+++ b/src/tests/unit_x509.cpp
@@ -637,8 +637,8 @@ Test::Result test_verify_gost2012_cert()
    // Throughout the test, some synonyms for EMSA4 are used, e.g. PSSR, EMSA-PSS
    Test::Result test_result("X509 Padding Config");
 
-   std::unique_ptr<Botan::Private_Key> sk(Botan::PKCS8::load_key(
-      Test::data_file("x509/misc/rsa_key.pem"), Test::rng()));
+   Botan::DataSource_Stream key_stream(Test::data_file("x509/misc/rsa_key.pem"));
+   std::unique_ptr<Botan::Private_Key> sk = Botan::PKCS8::load_key(key_stream);
 
    // Create X509 CA certificate; EMSA3 is used for signing by default
    Botan::X509_Cert_Options opt("TESTCA");