Repository: randombit/botan
Pull request #2224 (2019-12-10 14:21:10)

Add CCM mode to BSI policy
Version 2019-01 of the underlying technical guideline [BSI TR-02102-2](https://www.bsi.bund.de/EN/Publications/TechnicalGuidelines/tr02102/index_htm.html) added CCM to the list of approved modes for block ciphers.

/cc @securitykernel 


Patch:
diff --git a/configure.py b/configure.py
index 028417a4b..9f50677df 100755
--- a/configure.py
+++ b/configure.py
@@ -448,10 +448,6 @@ def process_command_line(args): # pylint: disable=too-many-locals,too-many-state
                            action='store_true', default=False,
                            help="Enable extra warnings")
 
-    build_group.add_option('--werror-mode', dest='werror_mode',
-                           action='store_true', default=False,
-                           help="Prohibit compiler warnings")
-
     build_group.add_option('--no-store-vc-rev', action='store_true', default=False,
                            help=optparse.SUPPRESS_HELP)
 
@@ -1138,7 +1134,7 @@ class CompilerInfo(InfoObject): # pylint: disable=too-many-instance-attributes
                 'add_lib_dir_option': '-L',
                 'add_compile_definition_option': '-D',
                 'add_sysroot_option': '',
-                'add_lib_option': '-l%s',
+                'add_lib_option': '-l',
                 'add_framework_option': '-framework ',
                 'preproc_flags': '-E',
                 'compile_flags': '-c',
@@ -1157,7 +1153,6 @@ class CompilerInfo(InfoObject): # pylint: disable=too-many-instance-attributes
                 'ar_command': '',
                 'ar_options': '',
                 'ar_output_to': '',
-                'werror_flags': '',
             })
 
         self.add_framework_option = lex.add_framework_option
@@ -1197,7 +1192,6 @@ class CompilerInfo(InfoObject): # pylint: disable=too-many-instance-attributes
         self.visibility_attribute = lex.visibility_attribute
         self.visibility_build_flags = lex.visibility_build_flags
         self.warning_flags = lex.warning_flags
-        self.werror_flags = lex.werror_flags
 
     def cross_check(self, os_info, arch_info, all_isas):
 
@@ -1368,8 +1362,6 @@ class CompilerInfo(InfoObject): # pylint: disable=too-many-instance-attributes
     def cc_warning_flags(self, options):
         def gen_flags():
             yield self.warning_flags
-            if options.werror_mode or options.maintainer_mode:
-                yield self.werror_flags
             if options.maintainer_mode:
                 yield self.maintainer_warning_flags
 
@@ -2120,7 +2112,7 @@ def create_template_vars(source_paths, build_paths, options, modules, cc, arch,
         'ar_output_to': cc.ar_output_to,
 
         'link_to': ' '.join(
-            [(cc.add_lib_option % lib) for lib in link_to('libs')] +
+            [cc.add_lib_option + lib for lib in link_to('libs')] +
             [cc.add_framework_option + fw for fw in link_to('frameworks')]
         ),
 
@@ -2129,7 +2121,7 @@ def create_template_vars(source_paths, build_paths, options, modules, cc, arch,
             [('"' + cc.add_framework_option + fw + '"') for fw in link_to('frameworks')]
         ),
 
-        'fuzzer_lib': (cc.add_lib_option % options.fuzzer_lib) if options.fuzzer_lib else '',
+        'fuzzer_lib': (cc.add_lib_option + options.fuzzer_lib) if options.fuzzer_lib else '',
         'libs_used': [lib.replace('.lib', '') for lib in link_to('libs')],
 
         'include_paths': build_paths.format_include_paths(cc, options.with_external_includedir),
@@ -2198,8 +2190,8 @@ def create_template_vars(source_paths, build_paths, options, modules, cc, arch,
         # llvm-link and msvc require just naming the file directly
         variables['link_to_botan'] = os.path.join(build_dir, variables['static_lib_name'])
     else:
-        variables['link_to_botan'] = '%s%s %s' % (cc.add_lib_dir_option, build_dir,
-                                                  (cc.add_lib_option % variables['libname']))
+        variables['link_to_botan'] = '%s%s %s%s' % (cc.add_lib_dir_option, build_dir,
+                                                    cc.add_lib_option, variables['libname'])
 
     return variables
 
diff --git a/doc/api_ref/ffi.rst b/doc/api_ref/ffi.rst
index bec0f5503..4c9472dd2 100644
--- a/doc/api_ref/ffi.rst
+++ b/doc/api_ref/ffi.rst
@@ -66,8 +66,8 @@ The following enum values are defined in the FFI header:
 
    .. note::
 
-      If the environment variable ``BOTAN_FFI_PRINT_EXCEPTIONS`` is set to any
-      non-empty value, then any exception which is caught by the FFI layer will
+      If the environment variable ``BOTAN_FFI_PRINT_EXCEPTIONS`` is
+      set, then any exception which is caught by the FFI layer will
       first print the exception message to stderr before returning an
       error. This is sometimes useful for debugging.
 
@@ -1152,51 +1152,7 @@ X.509 Certificates
     Set ``reference_time`` to be the time which the certificate chain is
     validated against. Use zero to use the current system clock.
 
-.. cpp:function:: int botan_x509_cert_verify_with_crl(int* validation_result, \
-                  botan_x509_cert_t cert, \
-                  const botan_x509_cert_t* intermediates, \
-                  size_t intermediates_len, \
-                  const botan_x509_cert_t* trusted, \
-                  size_t trusted_len, \
-                  const botan_x509_crl_t* crls, \
-                  size_t crls_len, \
-                  const char* trusted_path, \
-                  size_t required_strength, \
-                  const char* hostname, \
-                  uint64_t reference_time)
-
-   Certificate path validation supporting Certificate Revocation Lists.
-
-   Works the same as ``botan_x509_cert_cerify``.
-
-   ``crls`` is an array of ``botan_x509_crl_t`` objects, ``crls_len`` is its length.
-
 .. cpp:function:: const char* botan_x509_cert_validation_status(int code)
 
    Return a (statically allocated) string associated with the verification
    result.
-
-X.509 Certificate Revocation Lists
-----------------------------------------
-
-.. cpp:type:: opaque* botan_x509_crl_t
-
-   An opaque data type for an X.509 CRL.
-
-.. cpp:function:: int botan_x509_crl_load(botan_x509_crl_t* crl_obj, \
-                                        const uint8_t crl[], size_t crl_len)
-
-   Load a CRL from the DER or PEM representation.
-
-.. cpp:function:: int botan_x509_crl_load_file(botan_x509_crl_t* crl_obj, const char* filename)
-
-   Load a CRL from a file.
-
-.. cpp:function:: int botan_x509_crl_destroy(botan_x509_crl_t crl)
-
-   Destroy the CRL object.
-
-.. cpp:function:: int botan_x509_is_revoked(botan_x509_crl_t crl, botan_x509_cert_t cert)
-
-   Check whether a given ``crl`` contains a given ``cert``.
-   Return ``0`` when the certificate is revoked, ``-1`` otherwise.
diff --git a/doc/api_ref/python.rst b/doc/api_ref/python.rst
index a57f29e6d..80c1ca89d 100644
--- a/doc/api_ref/python.rst
+++ b/doc/api_ref/python.rst
@@ -474,19 +474,17 @@ Multiple Precision Integers (MPI)
 -------------------------------------
 .. versionadded:: 2.8.0
 
-.. py:class:: MPI(initial_value=None, radix=None)
+.. py:class:: MPI(initial_value=None)
 
    Initialize an MPI object with specified value, left as zero otherwise.  The
    ``initial_value`` should be an ``int``, ``str``, or ``MPI``.
-   The ``radix`` value should be set to 16 when initializing from a base 16 `str` value.
-
 
    Most of the usual arithmetic operators (``__add__``, ``__mul__``, etc) are
    defined.
 
    .. py:method:: inverse_mod(modulus)
 
-      Return the inverse of ``self`` modulo ``modulus``, or zero if no inverse exists
+      Return the inverse of ``self`` modulo modulus, or zero if no inverse exists
 
    .. py:method:: is_prime(rng, prob=128)
 
@@ -496,15 +494,6 @@ Multiple Precision Integers (MPI)
 
       Return ``self`` to the ``exponent`` power modulo ``modulus``
 
-   .. py:method:: mod_mul(other, modulus):
-
-      Return the multiplication product of ``self`` and ``other`` modulo ``modulus``
-
-   .. py:method:: gcd(other):
-
-      Return the greatest common divisor of ``self`` and ``other``
-
-
 Format Preserving Encryption (FE1 scheme)
 -----------------------------------------
 .. versionadded:: 2.8.0
@@ -547,7 +536,7 @@ HOTP
 X509Cert
 -----------------------------------------
 
-.. py:class:: X509Cert(filename=None, buf=None) 
+.. py:class:: X509Cert(filename=None, buf=None)
 
    .. py:method:: time_starts()
 
@@ -626,8 +615,7 @@ X509Cert
                   trusted_path=None, \
                   required_strength=0, \
                   hostname=None, \
-                  reference_time=0 \
-                  crls=None)
+                  reference_time=0)
 
       Verify a certificate. Returns 0 if validation was successful, returns a positive error code 
       if the validation was unsuccesful.
@@ -649,25 +637,16 @@ X509Cert
       Set ``reference_time`` to be the time which the certificate chain is
       validated against. Use zero (default) to use the current system clock.
 
-      ``crls`` is a list of CRLs issued by either trusted or untrusted authorities.
-
    .. py:classmethod:: validation_status(error_code)
 
       Return an informative string associated with the verification return code.
 
-   .. py:method:: is_revoked(self, crl)
+     
 
-      Check if the certificate (``self``) is revoked on the given ``crl``.
 
-X509CRL
------------------------------------------
 
-.. py:class:: X509CRL(filename=None, buf=None)
 
-   Class representing an X.509 Certificate Revocation List.
 
-   A CRL in PEM or DER format can be loaded from a file, with the ``filename`` argument,
-   or from a bytestring, with the ``buf`` argument.
 
 
 
diff --git a/doc/building.rst b/doc/building.rst
index 9e475d2bd..9227c8a6e 100644
--- a/doc/building.rst
+++ b/doc/building.rst
@@ -858,7 +858,7 @@ Provide an alternative name for a boost library. Depending on the platform and
 boost's build configuration these library names differ significantly (see `Boost docs
 <https://www.boost.org/doc/libs/1_70_0/more/getting_started/unix-variants.html#library-naming>`_).
 The provided library name must be suitable as identifier in a linker parameter,
-e.g on unix: ``boost_system`` or windows: ``libboost_regex-vc71-x86-1_70``.
+e.g on unix: ``boost_system`` or windows: ``libboost_regex-vc71-x86-1_70.lib``.
 
 --without-documentation
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
diff --git a/doc/cli.rst b/doc/cli.rst
index 08e3b14ea..eccc4499c 100644
--- a/doc/cli.rst
+++ b/doc/cli.rst
@@ -16,7 +16,7 @@ command is run with the ``--help`` option (like ``botan <command> --help``)
 some information about the usage of the command is printed.
 
 Starting in version 2.9, commands that take a passphrase (such as
-``gen_bcrypt`` or ``pkcs8``) will also accept the literal ``-`` to mean
+``gen_bcrypt`` or ``pkcs8``) will also accept the literal `-` to mean
 ask for the passphrase on the terminal. If supported by the operating
 system, echo will be disabled while reading the passphrase.
 
@@ -69,8 +69,7 @@ Public Key Cryptography
   defined (such as 3DES, Camellia, SM4, Twofish or Serpent). However most other
   implementations support only AES or 3DES in CBC mode. You can also choose
   Scrypt instead of PBKDF2, by using "Scrypt" instead of the name of a hash
-  function, for example "PBES2(AES-256/CBC,Scrypt)". Scrypt is also supported by
-  some other implementations including OpenSSL.
+  function, for example "PBES2(AES-256/CBC,Scrypt)"
 
 ``pkcs8 --pass-in= --pub-out --der-out --pass-out= --pbe= --pbe-millis=300 key``
   Open a PKCS #8 formatted key at *key*. If *key* is encrypted, the passphrase
@@ -91,8 +90,6 @@ Public Key Cryptography
   ASN.1 encoded blob. Some other tools (including ``openssl``) default to this
   format.
 
-  The signature is formatted for your screen using base64.
-
 ``verify --der-format --hash=SHA-256 --emsa= pubkey file signature``
   Verify the authenticity of the data in *file* with the provided signature
   *signature* and the public key *pubkey*. Similarly to the signing process,
@@ -192,11 +189,10 @@ TLS Server/Client
   advertise with Application-Layer Protocol Negotiation (ALPN).
 
 ``tls_server cert key --port=443 --type=tcp --policy=``
-  Implements a testing TLS server, which allows TLS clients to connect and which
-  echos any data that is sent to it. Binds to either TCP or UDP on port
-  *port*. The server uses the certificate *cert* and the respective PKCS #8
-  private key *key*. The server honors the TLS policy defined in the *policy*
-  file.
+  Implements a testing TLS server, which allows TLS clients to connect. Binds to
+  either TCP or UDP on port *port*. The server uses the certificate *cert* and
+  the respective PKCS #8 private key *key*. The server honors the TLS policy
+  defined in the *policy* file.
 
 ``tls_http_server cert key --port=443 --policy= --session-db --session-db-pass=``
   Only available if Boost.Asio support was enabled. Provides a simple HTTP server
@@ -288,12 +284,10 @@ Miscellaneous Commands
   similar to information provided by the ``pkg-config`` tool.
 
 ``cpuid``
-  List available processor flags (AES-NI, SIMD extensions, ...).
+  List available processor flags (aes_ni, SIMD extensions, ...).
 
-``asn1print --pem file``
-  Decode and print *file* with ASN.1 Basic Encoding Rules (BER). If flag ``--pem`` is
-  used, or the filename ends in ``.pem``, then PEM encoding is assumed. Otherwise
-  the input is assumed to be binary DER/BER.
+``asn1print file``
+  Decode and print *file* with ASN.1 Basic Encoding Rules (BER).
 
 ``http_get url``
   Retrieve resource from the passed http *url*.
diff --git a/doc/deprecated.rst b/doc/deprecated.rst
index 62b9f7984..97cc0e17f 100644
--- a/doc/deprecated.rst
+++ b/doc/deprecated.rst
@@ -61,10 +61,6 @@ in a future major release.
 
 - Block ciphers CAST-256, Kasumi, MISTY1, and DESX.
 
-- DLIES
-
-- MCEIES
-
 - GOST 34.11-94 hash
 
 - CBC-MAC
diff --git a/doc/dev_ref/todo.rst b/doc/dev_ref/todo.rst
index b2ed8e1c6..27a42a703 100644
--- a/doc/dev_ref/todo.rst
+++ b/doc/dev_ref/todo.rst
@@ -143,6 +143,7 @@ Compat Headers
 New C APIs
 ----------------------------------------
 
+* X.509 CRL handling
 * PKCS10 requests
 * Certificate signing
 * Expose TLS
diff --git a/news.rst b/news.rst
index 5f15f5d66..1520b85e4 100644
--- a/news.rst
+++ b/news.rst
@@ -8,8 +8,6 @@ Version 2.13.0, Not Yet Released
 
 * Add support for XMSS X.509 certificates (GH #2172)
 
-* Add support for X.509 CRLs in FFI layer and Python wrapper (GH #2213)
-
 * It is now possible to disable TLS v1.0/v1.1 and DTLS v1.0 at build time.
   (GH #2188)
 
@@ -31,12 +29,6 @@ Version 2.13.0, Not Yet Released
 * Disable stack protector on MinGW as it causes crashes with some recent
   versions. (GH #2187)
 
-* Resolve all compile time warnings generated by GCC, Clang and MSVC.
-  Modify CI to compile with warnings-as-errors. (GH #2170 #2206 #2211 #2212)
-
-* Fix bugs linking to 3rd party libraries on Windows due to invalid
-  link specifiers. (GH #2210 #2215)
-
 * Fix a bug introduced in 2.12.0 where ``TLS::Channel::is_active`` and
   ``TLS::Channel::is_closed`` could simultanously return true.
   (GH #2174 #2171)
diff --git a/readme.rst b/readme.rst
index 0188cfee5..16c226f9a 100644
--- a/readme.rst
+++ b/readme.rst
@@ -11,8 +11,6 @@ password hashing, and post quantum crypto schemes. A Python binding is included,
 and several other `language bindings
 <https://github.com/randombit/botan/wiki/Language-Bindings>`_ are available.
 It is used in many `open source and commercial products <https://github.com/randombit/botan/wiki/Users>`_.
-The library is accompanied by a featureful
-`command line interface <https://botan.randombit.net/handbook/cli.html>`_.
 
 See the `documentation <https://botan.randombit.net/handbook>`_ for more
 information about included features.
diff --git a/src/build-data/botan.doxy.in b/src/build-data/botan.doxy.in
index 2686897d9..52ce67c2a 100644
--- a/src/build-data/botan.doxy.in
+++ b/src/build-data/botan.doxy.in
@@ -168,7 +168,6 @@ PREDEFINED             = BOTAN_HAS_AES_ARMV8 \
                          BOTAN_HAS_SHA2_64_BMI2 \
                          BOTAN_HAS_SHA3_BMI2 \
                          BOTAN_HAS_SHACAL2_SIMD \
-                         BOTAN_HAS_SHACAL2_AVX2 \
                          BOTAN_HAS_SHACAL2_X86 \
                          BOTAN_HAS_SM4_ARMV8 \
                          BOTAN_HAS_THREEFISH_512_AVX2 \
diff --git a/src/build-data/cc/clang.txt b/src/build-data/cc/clang.txt
index b183f60ef..e0b9d3a33 100644
--- a/src/build-data/cc/clang.txt
+++ b/src/build-data/cc/clang.txt
@@ -5,10 +5,7 @@ binary_name clang++
 lang_flags "-std=c++11 -D_REENTRANT"
 
 warning_flags "-Wall -Wextra -Wpedantic -Wshadow -Wstrict-aliasing -Wstrict-overflow=5 -Wcast-align -Wmissing-declarations -Wpointer-arith -Wcast-qual"
-
-werror_flags "-Werror -Wno-error=unused-parameter -Wno-error=unreachable-code -Wno-error=unused-lambda-capture"
-
-maintainer_warning_flags "-Wunreachable-code -Wdocumentation -Qunused-arguments"
+maintainer_warning_flags "-Wunreachable-code -Wdocumentation -Qunused-arguments -Werror -Wno-error=unused-parameter -Wno-error=unreachable-code -Wno-error=unused-lambda-capture"
 
 optimization_flags "-O3"
 sanitizer_optimization_flags "-O1 -fno-optimize-sibling-calls -fno-omit-frame-pointer"
diff --git a/src/build-data/cc/gcc.txt b/src/build-data/cc/gcc.txt
index 4ff005bd5..7393358a6 100644
--- a/src/build-data/cc/gcc.txt
+++ b/src/build-data/cc/gcc.txt
@@ -7,9 +7,7 @@ lang_flags "-std=c++11 -D_REENTRANT"
 # This should only contain flags which are included in GCC 4.8
 warning_flags "-Wall -Wextra -Wpedantic -Wstrict-aliasing -Wcast-align -Wmissing-declarations -Wpointer-arith -Wcast-qual -Wzero-as-null-pointer-constant -Wnon-virtual-dtor"
 
-werror_flags "-Werror -Wno-error=strict-overflow -Wno-error=zero-as-null-pointer-constant"
-
-maintainer_warning_flags "-Wstrict-overflow=5 -Wold-style-cast -Wsuggest-override -Wshadow -Wextra-semi"
+maintainer_warning_flags "-Wstrict-overflow=5 -Wold-style-cast -Wsuggest-override -Wshadow -Wextra-semi -Werror -Wno-error=strict-overflow"
 
 optimization_flags "-O3"
 sanitizer_optimization_flags "-O1 -fno-optimize-sibling-calls -fno-omit-frame-pointer"
diff --git a/src/build-data/cc/msvc.txt b/src/build-data/cc/msvc.txt
index 71fc25ce7..2306a4485 100644
--- a/src/build-data/cc/msvc.txt
+++ b/src/build-data/cc/msvc.txt
@@ -9,7 +9,7 @@ output_to_exe "/OUT:"
 add_include_dir_option "/I"
 add_lib_dir_option "/LIBPATH:"
 add_compile_definition_option "/D"
-add_lib_option "%s.lib"
+add_lib_option ""
 
 compile_flags "/nologo /c"
 
@@ -25,14 +25,7 @@ debug_info_flags "/Zi /FS"
 preproc_flags "/nologo /EP"
 
 lang_flags "/EHs /GR /D_ENABLE_EXTENDED_ALIGNED_STORAGE"
-
-# 4250: diamond inheritence warning
-# 4251: STL types used in DLL interface
-# 4275: ???
-# 4127: conditional expression is constant, consider using if constexpr
-warning_flags "/W4 /wd4250 /wd4251 /wd4275 /wd4127"
-
-werror_flags "/WX"
+warning_flags "/W4 /wd4250 /wd4251 /wd4275"
 
 visibility_build_flags "/DBOTAN_DLL=__declspec(dllexport)"
 visibility_attribute "__declspec(dllimport)"
diff --git a/src/build-data/policy/bsi.txt b/src/build-data/policy/bsi.txt
index a06e3cbfc..6fa3ee9a9 100644
--- a/src/build-data/policy/bsi.txt
+++ b/src/build-data/policy/bsi.txt
@@ -3,6 +3,7 @@
 aes
 
 # modes
+ccm
 gcm
 cbc
 mode_pad
@@ -114,7 +115,6 @@ twofish
 xtea
 
 # modes
-ccm
 chacha20poly1305
 eax
 ocb
diff --git a/src/cli/encryption.cpp b/src/cli/encryption.cpp
index fa8de7cfd..4d85890b0 100644
--- a/src/cli/encryption.cpp
+++ b/src/cli/encryption.cpp
@@ -18,7 +18,7 @@ namespace {
 
 auto VALID_MODES = std::map<std::string, std::string>{
          // Don't add algorithms here without extending tests
-         // in `src/scripts/test_cli_crypt.py`
+         // in `src/scripts/cli_tests.py`
          { "aes-128-cfb", "AES-128/CFB" },
          { "aes-192-cfb", "AES-192/CFB" },
          { "aes-256-cfb", "AES-256/CFB" },
diff --git a/src/cli/socket_utils.h b/src/cli/socket_utils.h
index d52b5a0e7..7856f5508 100644
--- a/src/cli/socket_utils.h
+++ b/src/cli/socket_utils.h
@@ -16,14 +16,7 @@
 #include <winsock2.h>
 #include <WS2tcpip.h>
 
-typedef SOCKET socket_type;
-
-inline socket_type invalid_socket() { return INVALID_SOCKET; }
-
 typedef size_t ssize_t;
-typedef int sendrecv_len_type;
-
-inline void close_socket(socket_type s) { ::closesocket(s); }
 
 #define STDIN_FILENO _fileno(stdin)
 
@@ -49,12 +42,6 @@ inline void stop_sockets()
    ::WSACleanup();
    }
 
-inline std::string err_to_string(int e)
-   {
-   // TODO use strerror_s here
-   return "Error code " + std::to_string(e);
-   }
-
 inline int close(int fd)
    {
    return ::closesocket(fd);
@@ -82,20 +69,9 @@ inline int send(int s, const uint8_t* buf, size_t len, int flags)
 #include <errno.h>
 #include <fcntl.h>
 
-typedef int socket_type;
-typedef size_t sendrecv_len_type;
-
-inline socket_type invalid_socket() { return -1; }
-inline void close_socket(socket_type s) { ::close(s); }
-
 inline void init_sockets() {}
 inline void stop_sockets() {}
 
-inline std::string err_to_string(int e)
-   {
-   return std::strerror(e);
-   }
-
 #endif
 
 #if !defined(MSG_NOSIGNAL)
diff --git a/src/cli/speed.cpp b/src/cli/speed.cpp
index 0593fc1b5..6449c33c4 100644
--- a/src/cli/speed.cpp
+++ b/src/cli/speed.cpp
@@ -1836,7 +1836,7 @@ class Speed final : public Command
          if(invalid_sigs > 0)
             error_output() << invalid_sigs << " generated signatures rejected in PK signature bench\n";
 
-         const size_t events = static_cast<size_t>(std::min(sig_timer->events(), ver_timer->events()));
+         const size_t events = std::min(sig_timer->events(), ver_timer->events());
 
          record_result(sig_timer);
          record_result(ver_timer);
diff --git a/src/cli/tls_client.cpp b/src/cli/tls_client.cpp
index 9541f8fbc..4df8b61cc 100644
--- a/src/cli/tls_client.cpp
+++ b/src/cli/tls_client.cpp
@@ -8,7 +8,8 @@
 
 #include "cli.h"
 
-#if defined(BOTAN_HAS_TLS) && defined(BOTAN_TARGET_OS_HAS_FILESYSTEM) && defined(BOTAN_TARGET_OS_HAS_SOCKETS)
+#if defined(BOTAN_HAS_TLS) && defined(BOTAN_TARGET_OS_HAS_FILESYSTEM) && \
+   (defined(BOTAN_TARGET_OS_HAS_SOCKETS) || defined(BOTAN_TARGET_OS_HAS_WINSOCK2))
 
 #include <botan/tls_client.h>
 #include <botan/tls_policy.h>
@@ -194,7 +195,7 @@ class TLS_Client final : public Command, public Botan::TLS::Callbacks
 
             struct timeval timeout = { 1, 0 };
 
-            ::select(static_cast<int>(m_sockfd + 1), &readfds, nullptr, nullptr, &timeout);
+            ::select(m_sockfd + 1, &readfds, nullptr, nullptr, &timeout);
 
             if(FD_ISSET(m_sockfd, &readfds))
                {
@@ -209,7 +210,7 @@ class TLS_Client final : public Command, public Botan::TLS::Callbacks
                   }
                else if(got == -1)
                   {
-                  output() << "Socket error: " << errno << " " << err_to_string(errno) << "\n";
+                  output() << "Socket error: " << errno << " " << std::strerror(errno) << "\n";
                   continue;
                   }
 
@@ -229,7 +230,7 @@ class TLS_Client final : public Command, public Botan::TLS::Callbacks
                   }
                else if(got == -1)
                   {
-                  output() << "Stdin error: " << errno << " " << err_to_string(errno) << "\n";
+                  output() << "Stdin error: " << errno << " " << std::strerror(errno) << "\n";
                   continue;
                   }
 
@@ -264,7 +265,7 @@ class TLS_Client final : public Command, public Botan::TLS::Callbacks
          }
 
    private:
-      socket_type connect_to_host(const std::string& host, uint16_t port, bool tcp)
+      int connect_to_host(const std::string& host, uint16_t port, bool tcp)
          {
          addrinfo hints;
          Botan::clear_mem(&hints, 1);
@@ -277,18 +278,18 @@ class TLS_Client final : public Command, public Botan::TLS::Callbacks
             throw CLI_Error("getaddrinfo failed for " + host);
             }
 
-         socket_type fd = 0;
+         int fd = 0;
 
          for(rp = res; rp != nullptr; rp = rp->ai_next)
             {
             fd = ::socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
 
-            if(fd == invalid_socket())
+            if(fd == -1)
                {
                continue;
                }
 
-            if(::connect(fd, rp->ai_addr, static_cast<socklen_t>(rp->ai_addrlen)) != 0)
+            if(::connect(fd, rp->ai_addr, rp->ai_addrlen) != 0)
                {
                ::close(fd);
                continue;
@@ -426,7 +427,7 @@ class TLS_Client final : public Command, public Botan::TLS::Callbacks
             }
          }
 
-      socket_type m_sockfd = invalid_socket();
+      int m_sockfd = -1;
    };
 
 BOTAN_REGISTER_COMMAND("tls_client", TLS_Client);
diff --git a/src/cli/tls_server.cpp b/src/cli/tls_server.cpp
index c39061e64..8b6a60ea4 100644
--- a/src/cli/tls_server.cpp
+++ b/src/cli/tls_server.cpp
@@ -10,7 +10,7 @@
 #include "sandbox.h"
 
 #if defined(BOTAN_HAS_TLS) && defined(BOTAN_TARGET_OS_HAS_FILESYSTEM) && \
-   defined(BOTAN_TARGET_OS_HAS_SOCKETS)
+   (defined(BOTAN_TARGET_OS_HAS_SOCKETS) || defined(BOTAN_TARGET_OS_HAS_WINSOCK2))
 
 #if defined(SO_USER_COOKIE)
 #define SOCKET_ID 1
@@ -22,7 +22,6 @@
 #include <botan/tls_policy.h>
 #include <botan/hex.h>
 #include <botan/internal/os_utils.h>
-#include <botan/mem_ops.h>
 
 #include <list>
 #include <fstream>
@@ -92,7 +91,7 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
             return;
             }
 
-         socket_type server_fd = make_server_socket(port);
+         int server_fd = make_server_socket(port);
          size_t clients_served = 0;
 
          while(true)
@@ -120,8 +119,7 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
                peek_len = sizeof(dummy);
 #endif
 
-               if(::recvfrom(server_fd, static_cast<char*>(peek_buf), static_cast<sendrecv_len_type>(peek_len),
-                             MSG_PEEK, reinterpret_cast<struct sockaddr*>(&from), &from_len) != 0)
+               if(::recvfrom(server_fd, static_cast<char*>(peek_buf), peek_len, MSG_PEEK, reinterpret_cast<struct sockaddr*>(&from), &from_len) != 0)
                   {
                   throw CLI_Error("Could not peek next packet");
                   }
@@ -160,11 +158,11 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
                   try
                      {
                      uint8_t buf[4 * 1024] = { 0 };
-                     ssize_t got = ::recv(m_socket, Botan::cast_uint8_ptr_to_char(buf), sizeof(buf), 0);
+                     ssize_t got = ::read(m_socket, buf, sizeof(buf));
 
                      if(got == -1)
                         {
-                        error_output() << "Error in socket read - " << err_to_string(errno) << std::endl;
+                        error_output() << "Error in socket read - " << std::strerror(errno) << std::endl;
                         break;
                         }
 
@@ -198,8 +196,8 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
                      error_output() << "Connection problem: " << e.what() << std::endl;
                      if(m_is_tcp)
                         {
-                        close_socket(m_socket);
-                        m_socket = invalid_socket();
+                        ::close(m_socket);
+                        m_socket = -1;
                         }
                      }
                   }
@@ -211,20 +209,20 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
 
             if(m_is_tcp)
                {
-               close_socket(m_socket);
-               m_socket = invalid_socket();
+               ::close(m_socket);
+               m_socket = -1;
                }
             }
 
-         close_socket(server_fd);
+         ::close(server_fd);
          }
    private:
-      socket_type make_server_socket(uint16_t port)
+      int make_server_socket(uint16_t port)
          {
          const int type = m_is_tcp ? SOCK_STREAM : SOCK_DGRAM;
 
-         socket_type fd = ::socket(PF_INET, type, 0);
-         if(fd == invalid_socket())
+         int fd = ::socket(PF_INET, type, 0);
+         if(fd == -1)
             {
             throw CLI_Error("Unable to acquire socket");
             }
@@ -239,7 +237,7 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
 
          if(::bind(fd, reinterpret_cast<struct sockaddr*>(&socket_info), sizeof(struct sockaddr)) != 0)
             {
-            close_socket(fd);
+            ::close(fd);
             throw CLI_Error("server bind failed");
             }
 
@@ -247,7 +245,7 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
             {
             if(::listen(fd, 100) != 0)
                {
-               close_socket(fd);
+               ::close(fd);
                throw CLI_Error("listen failed");
                }
             }
@@ -303,11 +301,11 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
          {
          if(m_is_tcp)
             {
-            ssize_t sent = ::send(m_socket, buf, static_cast<sendrecv_len_type>(length), MSG_NOSIGNAL);
+            ssize_t sent = ::send(m_socket, buf, length, MSG_NOSIGNAL);
 
             if(sent == -1)
                {
-               error_output() << "Error writing to socket - " << err_to_string(errno) << std::endl;
+               error_output() << "Error writing to socket - " << std::strerror(errno) << std::endl;
                }
             else if(sent != static_cast<ssize_t>(length))
                {
@@ -318,7 +316,7 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
             {
             while(length)
                {
-               ssize_t sent = ::send(m_socket, buf, static_cast<sendrecv_len_type>(length), MSG_NOSIGNAL);
+               ssize_t sent = ::send(m_socket, buf, length, MSG_NOSIGNAL);
 
                if(sent == -1)
                   {
@@ -349,7 +347,7 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
          return "echo/0.1";
          }
 
-      socket_type m_socket = invalid_socket();
+      int m_socket = -1;
       bool m_is_tcp = false;
       uint32_t m_socket_id = 0;
       std::string m_line_buf;
diff --git a/src/lib/block/aes/aes_vperm/aes_vperm.cpp b/src/lib/block/aes/aes_vperm/aes_vperm.cpp
index b454e01e9..1703bd856 100644
--- a/src/lib/block/aes/aes_vperm/aes_vperm.cpp
+++ b/src/lib/block/aes/aes_vperm/aes_vperm.cpp
@@ -85,7 +85,7 @@ const SIMD_4x32 mc_forward[4] = {
    SIMD_4x32(0x0C0F0E0D, 0x00030201, 0x04070605, 0x080B0A09)
 };
 
-const SIMD_4x32 vperm_sr[4] = {
+const SIMD_4x32 sr[4] = {
    SIMD_4x32(0x03020100, 0x07060504, 0x0B0A0908, 0x0F0E0D0C),
    SIMD_4x32(0x0F0A0500, 0x030E0904, 0x07020D08, 0x0B06010C),
    SIMD_4x32(0x0B020900, 0x0F060D04, 0x030A0108, 0x070E050C),
@@ -161,7 +161,7 @@ inline SIMD_4x32 aes_enc_last_round(SIMD_4x32 B, SIMD_4x32 K, size_t r)
    const SIMD_4x32 t5 = Bl ^ shuffle(k_inv1, t2 ^ shuffle(k_inv1, Bh));
    const SIMD_4x32 t6 = Bh ^ shuffle(k_inv1, t2 ^ shuffle(k_inv1, Bl));
 
-   return shuffle(shuffle(sbou, t5) ^ shuffle(sbot, t6) ^ K, vperm_sr[r % 4]);
+   return shuffle(shuffle(sbou, t5) ^ shuffle(sbot, t6) ^ K, sr[r % 4]);
    }
 
 inline SIMD_4x32 aes_dec_first_round(SIMD_4x32 B, SIMD_4x32 K)
@@ -227,7 +227,7 @@ inline SIMD_4x32 aes_dec_last_round(SIMD_4x32 B, SIMD_4x32 K, size_t r)
    const SIMD_4x32 t6 = Bh ^ shuffle(k_inv1, t2 ^ shuffle(k_inv1, B));
 
    const SIMD_4x32 x = shuffle(sbou, t5) ^ shuffle(sbot, t6) ^ K;
-   return shuffle(x, vperm_sr[which_sr]);
+   return shuffle(x, sr[which_sr]);
    }
 
 void vperm_encrypt_blocks(const uint8_t in[], uint8_t out[], size_t blocks,
@@ -414,12 +414,13 @@ SIMD_4x32 aes_schedule_transform(SIMD_4x32 input,
 SIMD_4x32 aes_schedule_mangle(SIMD_4x32 k, uint8_t round_no)
    {
    const SIMD_4x32 mc_forward0(0x00030201, 0x04070605, 0x080B0A09, 0x0C0F0E0D);
+   const SIMD_4x32 srx(sr[round_no % 4]);
 
    SIMD_4x32 t = shuffle(k ^ SIMD_4x32::splat_u8(0x5B), mc_forward0);
    SIMD_4x32 t2 = t;
    t = shuffle(t, mc_forward0);
    t2 = t ^ t2 ^ shuffle(t, mc_forward0);
-   return shuffle(t2, vperm_sr[round_no % 4]);
+   return shuffle(t2, srx);
    }
 
 SIMD_4x32 aes_schedule_mangle_dec(SIMD_4x32 k, uint8_t round_no)
@@ -449,7 +450,7 @@ SIMD_4x32 aes_schedule_mangle_dec(SIMD_4x32 k, uint8_t round_no)
    t = aes_schedule_transform(t, dsk[6], dsk[7]);
    output = shuffle(t ^ output, mc_forward0);
 
-   return shuffle(output, vperm_sr[round_no % 4]);
+   return shuffle(output, sr[round_no % 4]);
    }
 
 SIMD_4x32 aes_schedule_mangle_last(SIMD_4x32 k, uint8_t round_no)
@@ -457,7 +458,7 @@ SIMD_4x32 aes_schedule_mangle_last(SIMD_4x32 k, uint8_t round_no)
    const SIMD_4x32 out_tr1(0xD6B66000, 0xFF9F4929, 0xDEBE6808, 0xF7974121);
    const SIMD_4x32 out_tr2(0x50BCEC00, 0x01EDBD51, 0xB05C0CE0, 0xE10D5DB1);
 
-   k = shuffle(k, vperm_sr[round_no % 4]);
+   k = shuffle(k, sr[round_no % 4]);
    k ^= SIMD_4x32::splat_u8(0x5B);
    return aes_schedule_transform(k, out_tr1, out_tr2);
    }
@@ -518,7 +519,7 @@ void AES_128::vperm_key_schedule(const uint8_t keyb[], size_t)
 
    SIMD_4x32 key = SIMD_4x32::load_le(keyb);
 
-   shuffle(key, vperm_sr[2]).store_le(&m_DK[4*10]);
+   shuffle(key, sr[2]).store_le(&m_DK[4*10]);
 
    key = aes_schedule_transform(key, k_ipt1, k_ipt2);
    key.store_le(&m_EK[0]);
@@ -545,7 +546,7 @@ void AES_192::vperm_key_schedule(const uint8_t keyb[], size_t)
    SIMD_4x32 key1 = SIMD_4x32::load_le(keyb);
    SIMD_4x32 key2 = SIMD_4x32::load_le(keyb + 8);
 
-   shuffle(key1, vperm_sr[0]).store_le(&m_DK[12*4]);
+   shuffle(key1, sr[0]).store_le(&m_DK[12*4]);
 
    key1 = aes_schedule_transform(key1, k_ipt1, k_ipt2);
    key2 = aes_schedule_transform(key2, k_ipt1, k_ipt2);
@@ -592,7 +593,7 @@ void AES_256::vperm_key_schedule(const uint8_t keyb[], size_t)
    SIMD_4x32 key1 = SIMD_4x32::load_le(keyb);
    SIMD_4x32 key2 = SIMD_4x32::load_le(keyb + 16);
 
-   shuffle(key1, vperm_sr[2]).store_le(&m_DK[4*14]);
+   shuffle(key1, sr[2]).store_le(&m_DK[4*14]);
 
    key1 = aes_schedule_transform(key1, k_ipt1, k_ipt2);
    key2 = aes_schedule_transform(key2, k_ipt1, k_ipt2);
diff --git a/src/lib/compression/zlib/info.txt b/src/lib/compression/zlib/info.txt
index 1102bc5e1..8e3a12261 100644
--- a/src/lib/compression/zlib/info.txt
+++ b/src/lib/compression/zlib/info.txt
@@ -5,6 +5,5 @@ ZLIB -> 20160412
 load_on vendor
 
 <libs>
-all!windows -> z
-windows -> zlib
+all -> z
 </libs>
diff --git a/src/lib/entropy/win32_stats/info.txt b/src/lib/entropy/win32_stats/info.txt
index 065d48cda..3e3268183 100644
--- a/src/lib/entropy/win32_stats/info.txt
+++ b/src/lib/entropy/win32_stats/info.txt
@@ -15,5 +15,5 @@ win32
 </os_features>
 
 <libs>
-windows -> user32
+windows -> user32.lib
 </libs>
diff --git a/src/lib/ffi/ffi.cpp b/src/lib/ffi/ffi.cpp
index 4600d5785..58afb1c56 100644
--- a/src/lib/ffi/ffi.cpp
+++ b/src/lib/ffi/ffi.cpp
@@ -18,8 +18,7 @@ namespace Botan_FFI {
 
 int ffi_error_exception_thrown(const char* func_name, const char* exn, int rc)
    {
-   std::string val;
-   if(Botan::OS::read_env_variable(val, "BOTAN_FFI_PRINT_EXCEPTIONS") == true && val != "")
+   if(Botan::OS::read_env_variable("BOTAN_FFI_PRINT_EXCEPTIONS") != nullptr)
       {
       std::fprintf(stderr, "in %s exception '%s' returning %d\n", func_name, exn, rc);
       }
diff --git a/src/lib/ffi/ffi.h b/src/lib/ffi/ffi.h
index a7cd11d25..aac196494 100644
--- a/src/lib/ffi/ffi.h
+++ b/src/lib/ffi/ffi.h
@@ -1590,41 +1590,6 @@ BOTAN_PUBLIC_API(2,8) int botan_x509_cert_verify(
 */
 BOTAN_PUBLIC_API(2,8) const char* botan_x509_cert_validation_status(int code);
 
-/*
-* X.509 CRL
-**************************/
-
-typedef struct botan_x509_crl_struct* botan_x509_crl_t;
-
-BOTAN_PUBLIC_API(2,13) int botan_x509_crl_load_file(botan_x509_crl_t* crl_obj, const char* crl_path);
-BOTAN_PUBLIC_API(2,13) int botan_x509_crl_load(botan_x509_crl_t* crl_obj, const uint8_t crl_bits[], size_t crl_bits_len);
-
-BOTAN_PUBLIC_API(2,13) int botan_x509_crl_destroy(botan_x509_crl_t crl);
-
-/**
- * Given a CRL and a certificate, 
- * check if the certificate is revoked on that particular CRL
- */
-BOTAN_PUBLIC_API(2,13) int botan_x509_is_revoked(botan_x509_crl_t crl, botan_x509_cert_t cert);
-
-/**
- * Different flavor of `botan_x509_cert_verify`, supports revocation lists.
- * CRLs are passed as an array, same as intermediates and trusted CAs 
- */
-BOTAN_PUBLIC_API(2,13) int botan_x509_cert_verify_with_crl(
-   int* validation_result,
-   botan_x509_cert_t cert,
-   const botan_x509_cert_t* intermediates,
-   size_t intermediates_len,
-   const botan_x509_cert_t* trusted,
-   size_t trusted_len,
-   const botan_x509_crl_t* crls,
-   size_t crls_len,
-   const char* trusted_path,
-   size_t required_strength,
-   const char* hostname,
-   uint64_t reference_time);
-
 /**
  * Key wrapping as per RFC 3394
  */
diff --git a/src/lib/ffi/ffi_block.cpp b/src/lib/ffi/ffi_block.cpp
index fa5c25c57..71de6943b 100644
--- a/src/lib/ffi/ffi_block.cpp
+++ b/src/lib/ffi/ffi_block.cpp
@@ -61,8 +61,8 @@ int botan_block_cipher_set_key(botan_block_cipher_t bc,
 */
 int botan_block_cipher_block_size(botan_block_cipher_t bc)
    {
-   return BOTAN_FFI_RETURNING(Botan::BlockCipher, bc, b,
-                              { return static_cast<int>(b.block_size()); });
+   return BOTAN_FFI_DO(Botan::BlockCipher, bc, b,
+                       { return static_cast<int>(b.block_size()); });
    }
 
 int botan_block_cipher_encrypt_blocks(botan_block_cipher_t bc,
diff --git a/src/lib/ffi/ffi_cert.cpp b/src/lib/ffi/ffi_cert.cpp
index 1baaa18d6..dd7f37ecb 100644
--- a/src/lib/ffi/ffi_cert.cpp
+++ b/src/lib/ffi/ffi_cert.cpp
@@ -11,7 +11,6 @@
 #if defined(BOTAN_HAS_X509_CERTIFICATES)
    #include <botan/x509cert.h>
    #include <botan/x509path.h>
-   #include <botan/x509_crl.h>
    #include <botan/data_src.h>
 #endif
 
@@ -136,7 +135,7 @@ int botan_x509_cert_to_string(botan_x509_cert_t cert, char out[], size_t* out_le
 int botan_x509_cert_allowed_usage(botan_x509_cert_t cert, unsigned int key_usage)
    {
 #if defined(BOTAN_HAS_X509_CERTIFICATES)
-   return BOTAN_FFI_RETURNING(Botan::X509_Certificate, cert, c, {
+   return BOTAN_FFI_DO(Botan::X509_Certificate, cert, c, {
       const Botan::Key_Constraints k = static_cast<Botan::Key_Constraints>(key_usage);
       if(c.allowed_usage(k))
          return BOTAN_FFI_SUCCESS;
@@ -350,154 +349,4 @@ const char* botan_x509_cert_validation_status(int code)
 #endif
    }
 
-#if defined(BOTAN_HAS_X509_CERTIFICATES)
-
-BOTAN_FFI_DECLARE_STRUCT(botan_x509_crl_struct, Botan::X509_CRL, 0x2C628910);
-
-#endif
-
-int botan_x509_crl_load_file(botan_x509_crl_t* crl_obj, const char* crl_path)
-   {
-   if(!crl_obj || !crl_path)
-      return BOTAN_FFI_ERROR_NULL_POINTER;
-
-#if defined(BOTAN_HAS_X509_CERTIFICATES) && defined(BOTAN_TARGET_OS_HAS_FILESYSTEM)
-
-   return ffi_guard_thunk(__func__, [=]() -> int {
-      std::unique_ptr<Botan::X509_CRL> c(new Botan::X509_CRL(crl_path));
-      *crl_obj = new botan_x509_crl_struct(c.release());
-      return BOTAN_FFI_SUCCESS;
-      });
-
-#else
-   return BOTAN_FFI_ERROR_NOT_IMPLEMENTED;
-#endif
-   }
-
-int botan_x509_crl_load(botan_x509_crl_t* crl_obj, const uint8_t crl_bits[], size_t crl_bits_len)
-   {
-   if(!crl_obj || !crl_bits)
-      return BOTAN_FFI_ERROR_NULL_POINTER;
-
-#if defined(BOTAN_HAS_X509_CERTIFICATES)
-   return ffi_guard_thunk(__func__, [=]() -> int {
-      Botan::DataSource_Memory bits(crl_bits, crl_bits_len);
-      std::unique_ptr<Botan::X509_CRL> c(new Botan::X509_CRL(bits));
-      *crl_obj = new botan_x509_crl_struct(c.release());
-      return BOTAN_FFI_SUCCESS;
-      });
-#else
-   BOTAN_UNUSED(crl_bits_len);
-   return BOTAN_FFI_ERROR_NOT_IMPLEMENTED;
-#endif
-   }
-
-int botan_x509_crl_destroy(botan_x509_crl_t crl)
-   {
-#if defined(BOTAN_HAS_X509_CERTIFICATES)
-   return BOTAN_FFI_CHECKED_DELETE(crl);
-#else
-   BOTAN_UNUSED(crl);
-   return BOTAN_FFI_ERROR_NOT_IMPLEMENTED;
-#endif
-   }
-
-int botan_x509_is_revoked(botan_x509_crl_t crl, botan_x509_cert_t cert)
-   {
-#if defined(BOTAN_HAS_X509_CERTIFICATES)
-   return BOTAN_FFI_RETURNING(Botan::X509_CRL, crl, c, {
-      return c.is_revoked(safe_get(cert)) ? 0 : -1;
-      });
-#else
-   BOTAN_UNUSED(cert);
-   BOTAN_UNUSED(crl);
-   return BOTAN_FFI_ERROR_NOT_IMPLEMENTED;
-#endif
-   }
-
-int botan_x509_cert_verify_with_crl(
-   int* result_code,
-   botan_x509_cert_t cert,
-   const botan_x509_cert_t* intermediates,
-   size_t intermediates_len,
-   const botan_x509_cert_t* trusted,
-   size_t trusted_len,
-   const botan_x509_crl_t* crls,
-   size_t crls_len,
-   const char* trusted_path,
-   size_t required_strength,
-   const char* hostname_cstr,
-   uint64_t reference_time)
-   {
-   if(required_strength == 0)
-      required_strength = 110;
-
-#if defined(BOTAN_HAS_X509_CERTIFICATES)
-   return ffi_guard_thunk(__func__, [=]() -> int {
-      const std::string hostname((hostname_cstr == nullptr) ? "" : hostname_cstr);
-      const Botan::Usage_Type usage = Botan::Usage_Type::UNSPECIFIED;
-      const auto validation_time = reference_time == 0 ?
-         std::chrono::system_clock::now() :
-         std::chrono::system_clock::from_time_t(static_cast<time_t>(reference_time));
-
-      std::vector<Botan::X509_Certificate> end_certs;
-      end_certs.push_back(safe_get(cert));
-      for(size_t i = 0; i != intermediates_len; ++i)
-         end_certs.push_back(safe_get(intermediates[i]));
-
-      std::unique_ptr<Botan::Certificate_Store> trusted_from_path;
-      std::unique_ptr<Botan::Certificate_Store_In_Memory> trusted_extra;
-      std::unique_ptr<Botan::Certificate_Store_In_Memory> trusted_crls;
-      std::vector<Botan::Certificate_Store*> trusted_roots;
-
-      if(trusted_path && *trusted_path)
-         {
-         trusted_from_path.reset(new Botan::Certificate_Store_In_Memory(trusted_path));
-         trusted_roots.push_back(trusted_from_path.get());
-         }
-
-      if(trusted_len > 0)
-         {
-         trusted_extra.reset(new Botan::Certificate_Store_In_Memory);
-         for(size_t i = 0; i != trusted_len; ++i)
-            {
-            trusted_extra->add_certificate(safe_get(trusted[i]));
-            }
-         trusted_roots.push_back(trusted_extra.get());
-         }
-
-      if(crls_len > 0)
-         {
-         trusted_crls.reset(new Botan::Certificate_Store_In_Memory);
-         for(size_t i = 0; i != crls_len; ++i)
-            {
-            trusted_crls->add_crl(safe_get(crls[i]));
-            }
-         trusted_roots.push_back(trusted_crls.get());
-         }
-
-      Botan::Path_Validation_Restrictions restrictions(false, required_strength);
-
-      auto validation_result = Botan::x509_path_validate(end_certs,
-                                                         restrictions,
-                                                         trusted_roots,
-                                                         hostname,
-                                                         usage,
-                                                         validation_time);
-
-      if(result_code)
-         *result_code = static_cast<int>(validation_result.result());
-
-      if(validation_result.successful_validation())
-         return 0;
-      else
-         return 1;
-      });
-#else
-   BOTAN_UNUSED(result_code, cert, intermediates, intermediates_len, trusted);
-   BOTAN_UNUSED(trusted_len, trusted_path, hostname_cstr, reference_time, crls, crls_len);
-   return BOTAN_FFI_ERROR_NOT_IMPLEMENTED;
-#endif
-   }
-
 }
diff --git a/src/lib/ffi/ffi_cipher.cpp b/src/lib/ffi/ffi_cipher.cpp
index 17f443c89..3c74a524f 100644
--- a/src/lib/ffi/ffi_cipher.cpp
+++ b/src/lib/ffi/ffi_cipher.cpp
@@ -192,7 +192,7 @@ int botan_cipher_set_associated_data(botan_cipher_t cipher,
                                      const uint8_t* ad,
                                      size_t ad_len)
    {
-   return BOTAN_FFI_RETURNING(Botan::Cipher_Mode, cipher, c, {
+   return BOTAN_FFI_DO(Botan::Cipher_Mode, cipher, c, {
       if(Botan::AEAD_Mode* aead = dynamic_cast<Botan::AEAD_Mode*>(&c))
          {
          aead->set_associated_data(ad, ad_len);
@@ -204,9 +204,7 @@ int botan_cipher_set_associated_data(botan_cipher_t cipher,
 
 int botan_cipher_valid_nonce_length(botan_cipher_t cipher, size_t nl)
    {
-   return BOTAN_FFI_RETURNING(Botan::Cipher_Mode, cipher, c, {
-      return c.valid_nonce_length(nl) ? 1 : 0;
-      });
+   return BOTAN_FFI_DO(Botan::Cipher_Mode, cipher, c, { return c.valid_nonce_length(nl) ? 1 : 0; });
    }
 
 int botan_cipher_get_default_nonce_length(botan_cipher_t cipher, size_t* nl)
diff --git a/src/lib/ffi/ffi_hotp.cpp b/src/lib/ffi/ffi_hotp.cpp
index 779b7b128..e1c4c40e8 100644
--- a/src/lib/ffi/ffi_hotp.cpp
+++ b/src/lib/ffi/ffi_hotp.cpp
@@ -80,7 +80,7 @@ int botan_hotp_check(botan_hotp_t hotp,
                      size_t resync_range)
    {
 #if defined(BOTAN_HAS_HOTP)
-   return BOTAN_FFI_RETURNING(Botan::HOTP, hotp, h, {
+   return BOTAN_FFI_DO(Botan::HOTP, hotp, h, {
 
       auto resp = h.verify_hotp(hotp_code, hotp_counter, resync_range);
 
diff --git a/src/lib/ffi/ffi_mp.cpp b/src/lib/ffi/ffi_mp.cpp
index 513dbbb0c..be94a2c3d 100644
--- a/src/lib/ffi/ffi_mp.cpp
+++ b/src/lib/ffi/ffi_mp.cpp
@@ -106,7 +106,7 @@ int botan_mp_to_hex(const botan_mp_t mp, char* out)
 
 int botan_mp_to_str(const botan_mp_t mp, uint8_t digit_base, char* out, size_t* out_len)
    {
-   return BOTAN_FFI_RETURNING(Botan::BigInt, mp, bn, {
+   return BOTAN_FFI_DO(Botan::BigInt, mp, bn, {
 
       if(digit_base == 0 || digit_base == 10)
          return write_str_output(out, out_len, bn.to_dec_string());
@@ -199,22 +199,22 @@ int botan_mp_div(botan_mp_t quotient,
 
 int botan_mp_equal(const botan_mp_t x_w, const botan_mp_t y_w)
    {
-   return BOTAN_FFI_RETURNING(Botan::BigInt, x_w, x, { return x == safe_get(y_w); });
+   return BOTAN_FFI_DO(Botan::BigInt, x_w, x, { return x == safe_get(y_w); });
    }
 
 int botan_mp_is_zero(const botan_mp_t mp)
    {
-   return BOTAN_FFI_RETURNING(Botan::BigInt, mp, bn, { return bn.is_zero(); });
+   return BOTAN_FFI_DO(Botan::BigInt, mp, bn, { return bn.is_zero(); });
    }
 
 int botan_mp_is_odd(const botan_mp_t mp)
    {
-   return BOTAN_FFI_RETURNING(Botan::BigInt, mp, bn, { return bn.is_odd(); });
+   return BOTAN_FFI_DO(Botan::BigInt, mp, bn, { return bn.is_odd(); });
    }
 
 int botan_mp_is_even(const botan_mp_t mp)
    {
-   return BOTAN_FFI_RETURNING(Botan::BigInt, mp, bn, { return bn.is_even(); });
+   return BOTAN_FFI_DO(Botan::BigInt, mp, bn, { return bn.is_even(); });
    }
 
 int botan_mp_cmp(int* result, const botan_mp_t x_w, const botan_mp_t y_w)
@@ -280,13 +280,13 @@ int botan_mp_gcd(botan_mp_t out, const botan_mp_t x, const botan_mp_t y)
 
 int botan_mp_is_prime(const botan_mp_t mp, botan_rng_t rng, size_t test_prob)
    {
-   return BOTAN_FFI_RETURNING(Botan::BigInt, mp, n,
+   return BOTAN_FFI_DO(Botan::BigInt, mp, n,
                        { return (Botan::is_prime(n, safe_get(rng), test_prob)) ? 1 : 0; });
    }
 
 int botan_mp_get_bit(const botan_mp_t mp, size_t bit)
    {
-   return BOTAN_FFI_RETURNING(Botan::BigInt, mp, n, { return (n.get_bit(bit)); });
+   return BOTAN_FFI_DO(Botan::BigInt, mp, n, { return (n.get_bit(bit)); });
    }
 
 int botan_mp_set_bit(botan_mp_t mp, size_t bit)
diff --git a/src/lib/ffi/ffi_pk_op.cpp b/src/lib/ffi/ffi_pk_op.cpp
index 525f28eeb..10fd379b4 100644
--- a/src/lib/ffi/ffi_pk_op.cpp
+++ b/src/lib/ffi/ffi_pk_op.cpp
@@ -185,7 +185,7 @@ int botan_pk_op_verify_update(botan_pk_op_verify_t op, const uint8_t in[], size_
 
 int botan_pk_op_verify_finish(botan_pk_op_verify_t op, const uint8_t sig[], size_t sig_len)
    {
-   return BOTAN_FFI_RETURNING(Botan::PK_Verifier, op, o, {
+   return BOTAN_FFI_DO(Botan::PK_Verifier, op, o, {
       const bool legit = o.check_signature(sig, sig_len);
 
       if(legit)
diff --git a/src/lib/ffi/ffi_pkey.cpp b/src/lib/ffi/ffi_pkey.cpp
index 2fb3d338e..e0ba2380a 100644
--- a/src/lib/ffi/ffi_pkey.cpp
+++ b/src/lib/ffi/ffi_pkey.cpp
@@ -137,17 +137,15 @@ int botan_pubkey_check_key(botan_pubkey_t key, botan_rng_t rng, uint32_t flags)
    {
    const bool strong = (flags & BOTAN_CHECK_KEY_EXPENSIVE_TESTS);
 
-   return BOTAN_FFI_RETURNING(Botan::Public_Key, key, k, {
-      return (k.check_key(safe_get(rng), strong) == true) ? 0 : BOTAN_FFI_ERROR_INVALID_INPUT;
-      });
+   return BOTAN_FFI_DO(Botan::Public_Key, key, k,
+                       { return (k.check_key(safe_get(rng), strong) == true) ? 0 : BOTAN_FFI_ERROR_INVALID_INPUT; });
    }
 
 int botan_privkey_check_key(botan_privkey_t key, botan_rng_t rng, uint32_t flags)
    {
    const bool strong = (flags & BOTAN_CHECK_KEY_EXPENSIVE_TESTS);
-   return BOTAN_FFI_RETURNING(Botan::Private_Key, key, k, {
-      return (k.check_key(safe_get(rng), strong) == true) ? 0 : BOTAN_FFI_ERROR_INVALID_INPUT;
-      });
+   return BOTAN_FFI_DO(Botan::Private_Key, key, k,
+                       { return (k.check_key(safe_get(rng), strong) == true) ? 0 : BOTAN_FFI_ERROR_INVALID_INPUT; });
    }
 
 int botan_pubkey_export(botan_pubkey_t key, uint8_t out[], size_t* out_len, uint32_t flags)
diff --git a/src/lib/ffi/ffi_totp.cpp b/src/lib/ffi/ffi_totp.cpp
index 4fd5dc94a..c51f77954 100644
--- a/src/lib/ffi/ffi_totp.cpp
+++ b/src/lib/ffi/ffi_totp.cpp
@@ -80,7 +80,7 @@ int botan_totp_check(botan_totp_t totp,
                      size_t acceptable_clock_drift)
    {
 #if defined(BOTAN_HAS_TOTP)
-   return BOTAN_FFI_RETURNING(Botan::TOTP, totp, t, {
+   return BOTAN_FFI_DO(Botan::TOTP, totp, t, {
       const bool ok = t.verify_totp(totp_code, timestamp, acceptable_clock_drift);
       return (ok ? BOTAN_FFI_SUCCESS : BOTAN_FFI_INVALID_VERIFIER);
       });
diff --git a/src/lib/ffi/ffi_util.h b/src/lib/ffi/ffi_util.h
index 4269aa3e8..e77a2debb 100644
--- a/src/lib/ffi/ffi_util.h
+++ b/src/lib/ffi/ffi_util.h
@@ -89,19 +89,10 @@ int apply_fn(botan_struct<T, M>* o, const char* func_name, F func)
    return ffi_guard_thunk(func_name, [&]() { return func(*p); });
    }
 
-#define BOTAN_FFI_DO(T, obj, param, block)                \
+#define BOTAN_FFI_DO(T, obj, param, block)                              \
    apply_fn(obj, __func__,                                \
             [=](T& param) -> int { do { block } while(0); return BOTAN_FFI_SUCCESS; })
 
-/*
-* Like BOTAN_FFI_DO but with no trailing return with the expectation
-* that the block always returns a value. This exists because otherwise
-* MSVC warns about the dead return after the block in FFI_DO.
-*/
-#define BOTAN_FFI_RETURNING(T, obj, param, block)         \
-   apply_fn(obj, __func__,                                \
-            [=](T& param) -> int { do { block } while(0); })
-
 template<typename T, uint32_t M>
 int ffi_delete_object(botan_struct<T, M>* obj, const char* func_name)
    {
diff --git a/src/lib/filters/codec_filt/info.txt b/src/lib/filters/codec_filt/info.txt
new file mode 100644
index 000000000..fd7b3fbd3
--- /dev/null
+++ b/src/lib/filters/codec_filt/info.txt
@@ -0,0 +1,6 @@
+<defines>
+</defines>
+
+<requires>
+filters
+</requires>
diff --git a/src/lib/filters/info.txt b/src/lib/filters/info.txt
index 2fe933579..9fb8ef7ce 100644
--- a/src/lib/filters/info.txt
+++ b/src/lib/filters/info.txt
@@ -10,9 +10,6 @@ cipher_filter.h
 buf_filt.h
 key_filt.h
 
-b64_filt.h
-hex_filt.h
-
 secqueue.h
 
 data_snk.h
diff --git a/src/lib/hash/blake2/blake2b.cpp b/src/lib/hash/blake2/blake2b.cpp
index 0280d0c8b..9617fb4fb 100644
--- a/src/lib/hash/blake2/blake2b.cpp
+++ b/src/lib/hash/blake2/blake2b.cpp
@@ -51,7 +51,6 @@ void BLAKE2b::state_init()
    m_H[0] ^= 0x01010000 ^ static_cast<uint8_t>(output_length());
    m_T[0] = m_T[1] = 0;
    m_F[0] = m_F[1] = 0;
-   m_bufpos = 0;
    }
 
 namespace {
@@ -178,7 +177,7 @@ void BLAKE2b::final_result(uint8_t output[])
    m_F[0] = 0xFFFFFFFFFFFFFFFF;
    compress(m_buffer.data(), 1, m_bufpos);
    copy_out_vec_le(output, output_length(), m_H);
-   state_init();
+   clear();
    }
 
 std::string BLAKE2b::name() const
diff --git a/src/lib/hash/mdx_hash/mdx_hash.cpp b/src/lib/hash/mdx_hash/mdx_hash.cpp
index 64ae516a8..5e58155ec 100644
--- a/src/lib/hash/mdx_hash/mdx_hash.cpp
+++ b/src/lib/hash/mdx_hash/mdx_hash.cpp
@@ -21,7 +21,7 @@ MDx_HashFunction::MDx_HashFunction(size_t block_len,
                                    uint8_t cnt_size) :
    m_pad_char(bit_big_endian == true ? 0x80 : 0x01),
    m_counter_size(cnt_size),
-   m_block_bits(ceil_log2(block_len)),
+   m_block_bits(static_cast<uint8_t>(ceil_log2(block_len))),
    m_count_big_endian(byte_big_endian),
    m_count(0),
    m_buffer(block_len),
diff --git a/src/lib/math/mp/mp_asmi.h b/src/lib/math/mp/mp_asmi.h
index e1518d51c..c99d8b7e5 100644
--- a/src/lib/math/mp/mp_asmi.h
+++ b/src/lib/math/mp/mp_asmi.h
@@ -154,6 +154,33 @@ inline word word8_add2(word x[8], const word y[8], word carry)
       : "cc", "memory");
    return carry;
 
+#elif defined(BOTAN_MP_USE_X86_32_MSVC_ASM)
+
+   __asm {
+      mov edx,[x]
+      mov esi,[y]
+      xor eax,eax
+      sub eax,[carry] //force CF=1 iff *carry==1
+      mov eax,[esi]
+      adc [edx],eax
+      mov eax,[esi+4]
+      adc [edx+4],eax
+      mov eax,[esi+8]
+      adc [edx+8],eax
+      mov eax,[esi+12]
+      adc [edx+12],eax
+      mov eax,[esi+16]
+      adc [edx+16],eax
+      mov eax,[esi+20]
+      adc [edx+20],eax
+      mov eax,[esi+24]
+      adc [edx+24],eax
+      mov eax,[esi+28]
+      adc [edx+28],eax
+      sbb eax,eax
+      neg eax
+      }
+
 #else
    x[0] = word_add(x[0], y[0], &carry);
    x[1] = word_add(x[1], y[1], &carry);
@@ -190,6 +217,50 @@ inline word word8_add3(word z[8], const word x[8],
       : "cc", "memory");
    return carry;
 
+#elif defined(BOTAN_MP_USE_X86_32_MSVC_ASM)
+
+    __asm {
+      mov edi,[x]
+      mov esi,[y]
+      mov ebx,[z]
+      xor eax,eax
+      sub eax,[carry] //force CF=1 iff *carry==1
+      mov eax,[edi]
+      adc eax,[esi]
+      mov [ebx],eax
+
+      mov eax,[edi+4]
+      adc eax,[esi+4]
+      mov [ebx+4],eax
+
+      mov eax,[edi+8]
+      adc eax,[esi+8]
+      mov [ebx+8],eax
+
+      mov eax,[edi+12]
+      adc eax,[esi+12]
+      mov [ebx+12],eax
+
+      mov eax,[edi+16]
+      adc eax,[esi+16]
+      mov [ebx+16],eax
+
+      mov eax,[edi+20]
+      adc eax,[esi+20]
+      mov [ebx+20],eax
+
+      mov eax,[edi+24]
+      adc eax,[esi+24]
+      mov [ebx+24],eax
+
+      mov eax,[edi+28]
+      adc eax,[esi+28]
+      mov [ebx+28],eax
+
+      sbb eax,eax
+      neg eax
+      }
+
 #else
    z[0] = word_add(x[0], y[0], &carry);
    z[1] = word_add(x[1], y[1], &carry);
@@ -256,6 +327,41 @@ inline word word8_sub2(word x[8], const word y[8], word carry)
       : "cc", "memory");
    return carry;
 
+#elif defined(BOTAN_MP_USE_X86_32_MSVC_ASM)
+
+    __asm {
+      mov edi,[x]
+      mov esi,[y]
+      xor eax,eax
+      sub eax,[carry] //force CF=1 iff *carry==1
+      mov eax,[edi]
+      sbb eax,[esi]
+      mov [edi],eax
+      mov eax,[edi+4]
+      sbb eax,[esi+4]
+      mov [edi+4],eax
+      mov eax,[edi+8]
+      sbb eax,[esi+8]
+      mov [edi+8],eax
+      mov eax,[edi+12]
+      sbb eax,[esi+12]
+      mov [edi+12],eax
+      mov eax,[edi+16]
+      sbb eax,[esi+16]
+      mov [edi+16],eax
+      mov eax,[edi+20]
+      sbb eax,[esi+20]
+      mov [edi+20],eax
+      mov eax,[edi+24]
+      sbb eax,[esi+24]
+      mov [edi+24],eax
+      mov eax,[edi+28]
+      sbb eax,[esi+28]
+      mov [edi+28],eax
+      sbb eax,eax
+      neg eax
+      }
+
 #else
    x[0] = word_sub(x[0], y[0], &carry);
    x[1] = word_sub(x[1], y[1], &carry);
@@ -327,6 +433,42 @@ inline word word8_sub3(word z[8], const word x[8],
       : "cc", "memory");
    return carry;
 
+#elif defined(BOTAN_MP_USE_X86_32_MSVC_ASM)
+
+   __asm {
+      mov edi,[x]
+      mov esi,[y]
+      xor eax,eax
+      sub eax,[carry] //force CF=1 iff *carry==1
+      mov ebx,[z]
+      mov eax,[edi]
+      sbb eax,[esi]
+      mov [ebx],eax
+      mov eax,[edi+4]
+      sbb eax,[esi+4]
+      mov [ebx+4],eax
+      mov eax,[edi+8]
+      sbb eax,[esi+8]
+      mov [ebx+8],eax
+      mov eax,[edi+12]
+      sbb eax,[esi+12]
+      mov [ebx+12],eax
+      mov eax,[edi+16]
+      sbb eax,[esi+16]
+      mov [ebx+16],eax
+      mov eax,[edi+20]
+      sbb eax,[esi+20]
+      mov [ebx+20],eax
+      mov eax,[edi+24]
+      sbb eax,[esi+24]
+      mov [ebx+24],eax
+      mov eax,[edi+28]
+      sbb eax,[esi+28]
+      mov [ebx+28],eax
+      sbb eax,eax
+      neg eax
+      }
+
 #else
    z[0] = word_sub(x[0], y[0], &carry);
    z[1] = word_sub(x[1], y[1], &carry);
@@ -362,6 +504,68 @@ inline word word8_linmul2(word x[8], word y, word carry)
       : "cc", "%rax", "%rdx");
    return carry;
 
+#elif defined(BOTAN_MP_USE_X86_32_MSVC_ASM)
+
+   __asm {
+      mov esi,[x]
+      mov eax,[esi]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,[carry]      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [esi],eax        //load a
+
+      mov eax,[esi+4]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [esi+4],eax        //load a
+
+      mov eax,[esi+8]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [esi+8],eax        //load a
+
+      mov eax,[esi+12]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [esi+12],eax        //load a
+
+      mov eax,[esi+16]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [esi+16],eax        //load a
+
+      mov eax,[esi+20]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [esi+20],eax        //load a
+
+      mov eax,[esi+24]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [esi+24],eax        //load a
+
+      mov eax,[esi+28]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov [esi+28],eax        //load a
+
+      mov eax,edx      //store carry
+      }
+
 #else
    x[0] = word_madd2(x[0], y, &carry);
    x[1] = word_madd2(x[1], y, &carry);
@@ -396,6 +600,68 @@ inline word word8_linmul3(word z[8], const word x[8], word y, word carry)
       : "cc", "%rax", "%rdx");
    return carry;
 
+#elif defined(BOTAN_MP_USE_X86_32_MSVC_ASM)
+
+   __asm {
+      mov edi,[z]
+      mov esi,[x]
+      mov eax,[esi]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,[carry]    //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [edi],eax        //load a
+
+      mov eax,[esi+4]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [edi+4],eax        //load a
+
+      mov eax,[esi+8]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [edi+8],eax        //load a
+
+      mov eax,[esi+12]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [edi+12],eax        //load a
+
+      mov eax,[esi+16]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [edi+16],eax        //load a
+
+      mov eax,[esi+20]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [edi+20],eax        //load a
+
+      mov eax,[esi+24]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov ecx,edx      //store carry
+      mov [edi+24],eax        //load a
+
+      mov eax,[esi+28]        //load a
+      mul [y]           //edx(hi):eax(lo)=a*b
+      add eax,ecx      //sum lo carry
+      adc edx,0          //sum hi carry
+      mov [edi+28],eax        //load a
+      mov eax,edx      //store carry
+      }
+
 #else
    z[0] = word_madd2(x[0], y, &carry);
    z[1] = word_madd2(x[1], y, &carry);
diff --git a/src/lib/math/mp/mp_madd.h b/src/lib/math/mp/mp_madd.h
index 531d6e663..25659172b 100644
--- a/src/lib/math/mp/mp_madd.h
+++ b/src/lib/math/mp/mp_madd.h
@@ -30,14 +30,16 @@ namespace Botan {
   #error BOTAN_MP_WORD_BITS must be 32 or 64
 #endif
 
-#if defined(BOTAN_USE_GCC_INLINE_ASM)
+#if defined(BOTAN_TARGET_ARCH_IS_X86_32) && (BOTAN_MP_WORD_BITS == 32)
 
-  #if defined(BOTAN_TARGET_ARCH_IS_X86_32) && (BOTAN_MP_WORD_BITS == 32)
+  #if defined(BOTAN_USE_GCC_INLINE_ASM)
     #define BOTAN_MP_USE_X86_32_ASM
-  #elif defined(BOTAN_TARGET_ARCH_IS_X86_64) && (BOTAN_MP_WORD_BITS == 64)
-    #define BOTAN_MP_USE_X86_64_ASM
+  #elif defined(BOTAN_BUILD_COMPILER_IS_MSVC)
+    #define BOTAN_MP_USE_X86_32_MSVC_ASM
   #endif
 
+#elif defined(BOTAN_TARGET_ARCH_IS_X86_64) && (BOTAN_MP_WORD_BITS == 64) && defined(BOTAN_USE_GCC_INLINE_ASM)
+  #define BOTAN_MP_USE_X86_64_ASM
 #endif
 
 /*
diff --git a/src/lib/math/numbertheory/numthry.cpp b/src/lib/math/numbertheory/numthry.cpp
index 90f1279b6..0d21f0237 100644
--- a/src/lib/math/numbertheory/numthry.cpp
+++ b/src/lib/math/numbertheory/numthry.cpp
@@ -93,7 +93,7 @@ BigInt gcd(const BigInt& a, const BigInt& b)
       f.shrink_to_fit();
       sub_abs(newg, f, g);
 
-      const bool need_swap = (g.is_odd() && delta > 0);
+      const uint8_t need_swap = (g.is_odd() && delta > 0);
 
       // if(need_swap) delta *= -1
       delta *= CT::Mask<uint8_t>::expand(need_swap).select(0, 2) - 1;
diff --git a/src/lib/math/numbertheory/primality.cpp b/src/lib/math/numbertheory/primality.cpp
index 028e2a7ef..5e683c1ff 100644
--- a/src/lib/math/numbertheory/primality.cpp
+++ b/src/lib/math/numbertheory/primality.cpp
@@ -62,7 +62,7 @@ bool is_lucas_probable_prime(const BigInt& C, const Modular_Reducer& mod_C)
 
    for(size_t i = 0; i != K_bits; ++i)
       {
-      const bool k_bit = K.get_bit(K_bits - 1 - i);
+      const uint8_t k_bit = K.get_bit(K_bits - 1 - i);
 
       Ut = mod_C.multiply(U, V);
 
diff --git a/src/lib/modes/aead/ccm/ccm.cpp b/src/lib/modes/aead/ccm/ccm.cpp
index 7a82f1a47..ab2cfcb95 100644
--- a/src/lib/modes/aead/ccm/ccm.cpp
+++ b/src/lib/modes/aead/ccm/ccm.cpp
@@ -118,7 +118,7 @@ void CCM_Mode::encode_length(uint64_t len, uint8_t out[])
    {
    const size_t len_bytes = L();
 
-   BOTAN_ASSERT_NOMSG(len_bytes >= 1 && len_bytes <= 8);
+   BOTAN_ASSERT_NOMSG(len_bytes >= 2 && len_bytes <= 8);
 
    for(size_t i = 0; i != len_bytes; ++i)
       out[len_bytes-1-i] = get_byte(sizeof(uint64_t)-1-i, len);
diff --git a/src/lib/modes/aead/gcm/ghash.cpp b/src/lib/modes/aead/gcm/ghash.cpp
index 43772803b..3a4301113 100644
--- a/src/lib/modes/aead/gcm/ghash.cpp
+++ b/src/lib/modes/aead/gcm/ghash.cpp
@@ -96,7 +96,7 @@ void GHASH::gcm_multiply(secure_vector<uint8_t>& x,
 void GHASH::ghash_update(secure_vector<uint8_t>& ghash,
                          const uint8_t input[], size_t length)
    {
-   verify_key_set(!m_HM.empty());
+   verify_key_set(m_HM.size());
 
    /*
    This assumes if less than block size input then we're just on the
diff --git a/src/lib/modes/cfb/cfb.cpp b/src/lib/modes/cfb/cfb.cpp
index 0c619e322..e1bee0427 100644
--- a/src/lib/modes/cfb/cfb.cpp
+++ b/src/lib/modes/cfb/cfb.cpp
@@ -82,7 +82,7 @@ void CFB_Mode::start_msg(const uint8_t nonce[], size_t nonce_len)
    if(!valid_nonce_length(nonce_len))
       throw Invalid_IV_Length(name(), nonce_len);
 
-   verify_key_set(!m_keystream.empty());
+   verify_key_set(m_keystream.size());
 
    if(nonce_len == 0)
       {
@@ -116,7 +116,7 @@ void CFB_Mode::shift_register()
 
 size_t CFB_Encryption::process(uint8_t buf[], size_t sz)
    {
-   verify_key_set(!m_keystream.empty());
+   verify_key_set(m_keystream.size());
    BOTAN_STATE_CHECK(m_state.empty() == false);
 
    const size_t shift = feedback();
@@ -181,7 +181,7 @@ inline void xor_copy(uint8_t buf[], uint8_t key_buf[], size_t len)
 
 size_t CFB_Decryption::process(uint8_t buf[], size_t sz)
    {
-   verify_key_set(!m_keystream.empty());
+   verify_key_set(m_keystream.size());
    BOTAN_STATE_CHECK(m_state.empty() == false);
 
    const size_t shift = feedback();
diff --git a/src/lib/pbkdf/argon2/argon2pwhash.cpp b/src/lib/pbkdf/argon2/argon2pwhash.cpp
index 96f7f74fe..4eb2570f6 100644
--- a/src/lib/pbkdf/argon2/argon2pwhash.cpp
+++ b/src/lib/pbkdf/argon2/argon2pwhash.cpp
@@ -75,8 +75,8 @@ std::unique_ptr<PasswordHash> Argon2_Family::tune(size_t /*output_length*/,
    const size_t max_kib = (max_memory == 0) ? 256*1024 : max_memory*1024;
 
    // Tune with a large memory otherwise we measure cache vs RAM speeds and underestimate
-   // costs for larger params. Default is 36 MiB, or use 128 for long times.
-   const size_t tune_M = (msec >= std::chrono::milliseconds(500) ? 128 : 36) * 1024;
+   // costs for larger params
+   const size_t tune_M = 256*1024; // in KiB
    const size_t p = 1;
    size_t t = 1;
 
@@ -84,7 +84,7 @@ std::unique_ptr<PasswordHash> Argon2_Family::tune(size_t /*output_length*/,
    const auto tune_time = BOTAN_PBKDF_TUNING_TIME;
 
    timer.run_until_elapsed(tune_time, [&]() {
-      uint8_t output[64] = { 0 };
+      uint8_t output[32] = { 0 };
       argon2(output, sizeof(output), "test", 4, nullptr, 0, nullptr, 0, nullptr, 0, m_family, p, tune_M, t);
       });
 
diff --git a/src/lib/prov/openssl/info.txt b/src/lib/prov/openssl/info.txt
index 32e71a848..043ade614 100644
--- a/src/lib/prov/openssl/info.txt
+++ b/src/lib/prov/openssl/info.txt
@@ -10,7 +10,7 @@ openssl.h
 
 <libs>
 all!windows -> crypto
-windows -> libeay32
+windows -> libeay32.lib
 </libs>
 
 <requires>
diff --git a/src/lib/prov/openssl/openssl_hash.cpp b/src/lib/prov/openssl/openssl_hash.cpp
index a4c04cb9f..4eaca12b4 100644
--- a/src/lib/prov/openssl/openssl_hash.cpp
+++ b/src/lib/prov/openssl/openssl_hash.cpp
@@ -37,7 +37,7 @@ class OpenSSL_HashFunction final : public HashFunction
          {
          std::unique_ptr<OpenSSL_HashFunction> copy(new OpenSSL_HashFunction(m_name, nullptr));
          EVP_MD_CTX_copy(copy->m_md, m_md);
-         return std::unique_ptr<HashFunction>(copy.release());
+         return std::move(copy);
          }
 
       size_t output_length() const override
diff --git a/src/lib/prov/pkcs11/p11_ecc_key.cpp b/src/lib/prov/pkcs11/p11_ecc_key.cpp
index 874621b78..186315e21 100644
--- a/src/lib/prov/pkcs11/p11_ecc_key.cpp
+++ b/src/lib/prov/pkcs11/p11_ecc_key.cpp
@@ -95,8 +95,7 @@ PKCS11_EC_PrivateKey::PKCS11_EC_PrivateKey(Session& session, const std::vector<u
    ObjectHandle priv_key_handle = CK_INVALID_HANDLE;
    Mechanism mechanism = { CKM_EC_KEY_PAIR_GEN, nullptr, 0 };
    session.module()->C_GenerateKeyPair(session.handle(), &mechanism,
-                                       pub_key_props.data(), static_cast<Ulong>(pub_key_props.count()),
-                                       props.data(), static_cast<Ulong>(props.count()),
+                                       pub_key_props.data(), pub_key_props.count(), props.data(), props.count(),
                                        &pub_key_handle, &priv_key_handle);
 
    this->reset_handle(priv_key_handle);
diff --git a/src/lib/prov/pkcs11/p11_ecdh.cpp b/src/lib/prov/pkcs11/p11_ecdh.cpp
index 4110fd486..32904aef6 100644
--- a/src/lib/prov/pkcs11/p11_ecdh.cpp
+++ b/src/lib/prov/pkcs11/p11_ecdh.cpp
@@ -76,7 +76,7 @@ class PKCS11_ECDH_KA_Operation final : public PK_Ops::Key_Agreement
          attributes.add_numeric(AttributeType::KeyType, static_cast< CK_KEY_TYPE >(KeyType::GenericSecret));
          attributes.add_numeric(AttributeType::ValueLen, static_cast< CK_ULONG >(key_len));
          m_key.module()->C_DeriveKey(m_key.session().handle(), m_mechanism.data(), m_key.handle(), attributes.data(),
-                                     static_cast<Ulong>(attributes.count()), &secret_handle);
+                                     attributes.count(), &secret_handle);
 
          Object secret_object(m_key.session(), secret_handle);
          secure_vector<uint8_t> secret = secret_object.get_attribute_value(AttributeType::Value);
@@ -112,8 +112,7 @@ PKCS11_ECDH_KeyPair generate_ecdh_keypair(Session& session, const EC_PublicKeyGe
    Mechanism mechanism = { static_cast< CK_MECHANISM_TYPE >(MechanismType::EcKeyPairGen), nullptr, 0 };
 
    session.module()->C_GenerateKeyPair(session.handle(), &mechanism,
-                                       pub_props.data(), static_cast<Ulong>(pub_props.count()),
-                                       priv_props.data(), static_cast<Ulong>(priv_props.count()),
+                                       pub_props.data(), pub_props.count(), priv_props.data(), priv_props.count(),
                                        &pub_key_handle, &priv_key_handle);
 
    return std::make_pair(PKCS11_ECDH_PublicKey(session, pub_key_handle), PKCS11_ECDH_PrivateKey(session, priv_key_handle));
diff --git a/src/lib/prov/pkcs11/p11_ecdsa.cpp b/src/lib/prov/pkcs11/p11_ecdsa.cpp
index a990933da..bdea2c1fa 100644
--- a/src/lib/prov/pkcs11/p11_ecdsa.cpp
+++ b/src/lib/prov/pkcs11/p11_ecdsa.cpp
@@ -79,7 +79,7 @@ class PKCS11_ECDSA_Signature_Operation final : public PK_Ops::Signature
             m_first_message.clear();
             }
 
-         m_key.module()->C_SignUpdate(m_key.session().handle(), const_cast<Byte*>(msg), static_cast<Ulong>(msg_len));
+         m_key.module()->C_SignUpdate(m_key.session().handle(), const_cast<Byte*>(msg), msg_len);
          }
 
       secure_vector<uint8_t> sign(RandomNumberGenerator&) override
@@ -136,7 +136,7 @@ class PKCS11_ECDSA_Verification_Operation final : public PK_Ops::Verification
             m_first_message.clear();
             }
 
-         m_key.module()->C_VerifyUpdate(m_key.session().handle(), const_cast<Byte*>(msg), static_cast<Ulong>(msg_len));
+         m_key.module()->C_VerifyUpdate(m_key.session().handle(), const_cast<Byte*>(msg), msg_len);
          }
 
       bool is_valid_signature(const uint8_t sig[], size_t sig_len) override
@@ -145,16 +145,14 @@ class PKCS11_ECDSA_Verification_Operation final : public PK_Ops::Verification
          if(!m_first_message.empty())
             {
             // single call to update: perform single-part operation
-            m_key.module()->C_Verify(m_key.session().handle(),
-                                     m_first_message.data(), static_cast<Ulong>(m_first_message.size()),
-                                     const_cast<Byte*>(sig), static_cast<Ulong>(sig_len),
-                                     &return_value);
+            m_key.module()->C_Verify(m_key.session().handle(), m_first_message.data(), m_first_message.size(),
+                                     const_cast<Byte*>(sig), sig_len, &return_value);
             m_first_message.clear();
             }
          else
             {
             // multiple calls to update (or none): finish multiple-part operation
-            m_key.module()->C_VerifyFinal(m_key.session().handle(), const_cast<Byte*>(sig), static_cast<Ulong>(sig_len), &return_value);
+            m_key.module()->C_VerifyFinal(m_key.session().handle(), const_cast<Byte*>(sig), sig_len, &return_value);
             }
          m_initialized = false;
          if(return_value != ReturnValue::OK && return_value != ReturnValue::SignatureInvalid)
@@ -198,8 +196,7 @@ PKCS11_ECDSA_KeyPair generate_ecdsa_keypair(Session& session, const EC_PublicKey
    Mechanism mechanism = { static_cast<CK_MECHANISM_TYPE>(MechanismType::EcKeyPairGen), nullptr, 0 };
 
    session.module()->C_GenerateKeyPair(session.handle(), &mechanism,
-                                       pub_props.data(), static_cast<Ulong>(pub_props.count()),
-                                       priv_props.data(), static_cast<Ulong>(priv_props.count()),
+                                       pub_props.data(), pub_props.count(), priv_props.data(), priv_props.count(),
                                        &pub_key_handle, &priv_key_handle);
 
    return std::make_pair(PKCS11_ECDSA_PublicKey(session, pub_key_handle), PKCS11_ECDSA_PrivateKey(session,
diff --git a/src/lib/prov/pkcs11/p11_mechanism.cpp b/src/lib/prov/pkcs11/p11_mechanism.cpp
index 4d5778bd8..08249cf22 100644
--- a/src/lib/prov/pkcs11/p11_mechanism.cpp
+++ b/src/lib/prov/pkcs11/p11_mechanism.cpp
@@ -208,7 +208,7 @@ MechanismWrapper MechanismWrapper::create_rsa_sign_mechanism(const std::string&
       mech.m_parameters = std::make_shared<MechanismParameters>();
       mech.m_parameters->pss_params.hashAlg = static_cast<CK_MECHANISM_TYPE>(mechanism_info.hash);
       mech.m_parameters->pss_params.mgf = static_cast<CK_RSA_PKCS_MGF_TYPE>(mechanism_info.mgf);
-      mech.m_parameters->pss_params.sLen = static_cast<Ulong>(mechanism_info.salt_size);
+      mech.m_parameters->pss_params.sLen = mechanism_info.salt_size;
       mech.m_mechanism.pParameter = mech.m_parameters.get();
       mech.m_mechanism.ulParameterLen = sizeof(RsaPkcsPssParams);
       }
diff --git a/src/lib/prov/pkcs11/p11_object.cpp b/src/lib/prov/pkcs11/p11_object.cpp
index 4dd191efe..66fe535b3 100644
--- a/src/lib/prov/pkcs11/p11_object.cpp
+++ b/src/lib/prov/pkcs11/p11_object.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/p11_object.h>
+
 #include <map>
 
 namespace Botan {
@@ -21,21 +22,19 @@ AttributeContainer::AttributeContainer(ObjectClass object_class)
 void AttributeContainer::add_class(ObjectClass object_class)
    {
    m_numerics.emplace_back(static_cast< uint64_t >(object_class));
-   add_attribute(AttributeType::Class,
-                 reinterpret_cast< uint8_t* >(&m_numerics.back()),
-                 static_cast<Ulong>(sizeof(ObjectClass)));
+   add_attribute(AttributeType::Class, reinterpret_cast< uint8_t* >(&m_numerics.back()), sizeof(ObjectClass));
    }
 
 void AttributeContainer::add_string(AttributeType attribute, const std::string& value)
    {
    m_strings.push_back(value);
-   add_attribute(attribute, reinterpret_cast<const uint8_t*>(m_strings.back().data()), static_cast<Ulong>(value.size()));
+   add_attribute(attribute, reinterpret_cast< const uint8_t* >(m_strings.back().data()), value.size());
    }
 
 void AttributeContainer::add_binary(AttributeType attribute, const uint8_t* value, size_t length)
    {
    m_vectors.push_back(secure_vector<uint8_t>(value, value + length));
-   add_attribute(attribute, reinterpret_cast< const uint8_t* >(m_vectors.back().data()), static_cast<Ulong>(length));
+   add_attribute(attribute, reinterpret_cast< const uint8_t* >(m_vectors.back().data()), length);
    }
 
 void AttributeContainer::add_bool(AttributeType attribute, bool value)
@@ -87,9 +86,8 @@ void AttributeContainer::add_attribute(AttributeType attribute, const uint8_t* v
 ObjectFinder::ObjectFinder(Session& session, const std::vector<Attribute>& search_template)
    : m_session(session), m_search_terminated(false)
    {
-   module()->C_FindObjectsInit(m_session.get().handle(),
-                               const_cast< Attribute* >(search_template.data()),
-                               static_cast<Ulong>(search_template.size()));
+   module()->C_FindObjectsInit(m_session.get().handle(), const_cast< Attribute* >(search_template.data()),
+                               search_template.size());
    }
 
 ObjectFinder::~ObjectFinder() noexcept
@@ -194,7 +192,7 @@ Object::Object(Session& session, ObjectHandle handle)
 Object::Object(Session& session, const ObjectProperties& obj_props)
    : m_session(session), m_handle(0)
    {
-   m_session.get().module()->C_CreateObject(m_session.get().handle(), obj_props.data(), static_cast<Ulong>(obj_props.count()), &m_handle);
+   m_session.get().module()->C_CreateObject(m_session.get().handle(), obj_props.data(), obj_props.count(), &m_handle);
    }
 
 secure_vector<uint8_t> Object::get_attribute_value(AttributeType attribute) const
@@ -218,8 +216,7 @@ void Object::destroy() const
 ObjectHandle Object::copy(const AttributeContainer& modified_attributes) const
    {
    ObjectHandle copied_handle;
-   module()->C_CopyObject(m_session.get().handle(), m_handle,
-                          modified_attributes.data(), static_cast<Ulong>(modified_attributes.count()),
+   module()->C_CopyObject(m_session.get().handle(), m_handle, modified_attributes.data(), modified_attributes.count(),
                           &copied_handle);
    return copied_handle;
    }
diff --git a/src/lib/prov/pkcs11/p11_rsa.cpp b/src/lib/prov/pkcs11/p11_rsa.cpp
index 0e434c5b3..1a760e1b2 100644
--- a/src/lib/prov/pkcs11/p11_rsa.cpp
+++ b/src/lib/prov/pkcs11/p11_rsa.cpp
@@ -80,8 +80,7 @@ PKCS11_RSA_PrivateKey::PKCS11_RSA_PrivateKey(Session& session, uint32_t bits,
    ObjectHandle priv_key_handle = CK_INVALID_HANDLE;
    Mechanism mechanism = { static_cast< CK_MECHANISM_TYPE >(MechanismType::RsaPkcsKeyPairGen), nullptr, 0 };
    session.module()->C_GenerateKeyPair(session.handle(), &mechanism,
-                                       pub_key_props.data(), static_cast<Ulong>(pub_key_props.count()),
-                                       priv_key_props.data(), static_cast<Ulong>(priv_key_props.count()),
+                                       pub_key_props.data(), pub_key_props.count(), priv_key_props.data(), priv_key_props.count(),
                                        &pub_key_handle, &priv_key_handle);
 
    this->reset_handle(priv_key_handle);
@@ -229,7 +228,7 @@ class PKCS11_RSA_Signature_Operation final : public PK_Ops::Signature
             m_first_message.clear();
             }
 
-         m_key.module()->C_SignUpdate(m_key.session().handle(), const_cast< Byte* >(msg), static_cast<Ulong>(msg_len));
+         m_key.module()->C_SignUpdate(m_key.session().handle(), const_cast< Byte* >(msg), msg_len);
          }
 
       secure_vector<uint8_t> sign(RandomNumberGenerator&) override
@@ -284,7 +283,7 @@ class PKCS11_RSA_Verification_Operation final : public PK_Ops::Verification
             m_first_message.clear();
             }
 
-         m_key.module()->C_VerifyUpdate(m_key.session().handle(), const_cast< Byte* >(msg), static_cast<Ulong>(msg_len));
+         m_key.module()->C_VerifyUpdate(m_key.session().handle(), const_cast< Byte* >(msg), msg_len);
          }
 
       bool is_valid_signature(const uint8_t sig[], size_t sig_len) override
@@ -293,15 +292,14 @@ class PKCS11_RSA_Verification_Operation final : public PK_Ops::Verification
          if(!m_first_message.empty())
             {
             // single call to update: perform single-part operation
-            m_key.module()->C_Verify(m_key.session().handle(),
-                                     m_first_message.data(), static_cast<Ulong>(m_first_message.size()),
-                                     const_cast< Byte* >(sig), static_cast<Ulong>(sig_len), &return_value);
+            m_key.module()->C_Verify(m_key.session().handle(), m_first_message.data(), m_first_message.size(),
+                                     const_cast< Byte* >(sig), sig_len, &return_value);
             m_first_message.clear();
             }
          else
             {
             // multiple calls to update (or none): finish multiple-part operation
-            m_key.module()->C_VerifyFinal(m_key.session().handle(), const_cast< Byte* >(sig), static_cast<Ulong>(sig_len), &return_value);
+            m_key.module()->C_VerifyFinal(m_key.session().handle(), const_cast< Byte* >(sig), sig_len, &return_value);
             }
          m_initialized = false;
          if(return_value != ReturnValue::OK && return_value != ReturnValue::SignatureInvalid)
@@ -360,8 +358,7 @@ PKCS11_RSA_KeyPair generate_rsa_keypair(Session& session, const RSA_PublicKeyGen
    Mechanism mechanism = { static_cast< CK_MECHANISM_TYPE >(MechanismType::RsaPkcsKeyPairGen), nullptr, 0 };
 
    session.module()->C_GenerateKeyPair(session.handle(), &mechanism,
-                                       pub_props.data(), static_cast<Ulong>(pub_props.count()),
-                                       priv_props.data(), static_cast<Ulong>(priv_props.count()),
+                                       pub_props.data(), pub_props.count(), priv_props.data(), priv_props.count(),
                                        &pub_key_handle, &priv_key_handle);
 
    return std::make_pair(PKCS11_RSA_PublicKey(session, pub_key_handle), PKCS11_RSA_PrivateKey(session, priv_key_handle));
diff --git a/src/lib/pubkey/mce/code_based_key_gen.cpp b/src/lib/pubkey/mce/code_based_key_gen.cpp
index 2768f5d36..8d662cb24 100644
--- a/src/lib/pubkey/mce/code_based_key_gen.cpp
+++ b/src/lib/pubkey/mce/code_based_key_gen.cpp
@@ -25,7 +25,7 @@ class binary_matrix final
       binary_matrix(size_t m_rown, size_t m_coln);
 
       void row_xor(size_t a, size_t b);
-      secure_vector<size_t> row_reduced_echelon_form();
+      secure_vector<int> row_reduced_echelon_form();
 
       /**
       * return the coefficient out of F_2
@@ -75,41 +75,42 @@ void binary_matrix::row_xor(size_t a, size_t b)
    }
 
 //the matrix is reduced from LSB...(from right)
-secure_vector<size_t> binary_matrix::row_reduced_echelon_form()
+secure_vector<int> binary_matrix::row_reduced_echelon_form()
    {
-   secure_vector<size_t> perm(m_coln);
+   secure_vector<int> perm(m_coln);
    for(size_t i = 0; i != m_coln; i++)
       {
-      perm[i] = i; // initialize permutation.
+      perm[i] = i;//initialize permutation.
       }
 
    uint32_t failcnt = 0;
 
-   size_t max = m_coln - 1;
+   uint32_t max = m_coln - 1;
    for(size_t i = 0; i != m_rown; i++, max--)
       {
-      bool found_row = false;
-
-      for(size_t j = i; !found_row && j != m_rown; j++)
+      uint32_t findrow = 0;
+      for(size_t j = i; j != m_rown; j++)
          {
          if(coef(j, max))
             {
             if(i != j) //not needed as ith row is 0 and jth row is 1.
                {
-               row_xor(i, j);//xor to the row.(swap)?
+               row_xor(i ,j);//xor to the row.(swap)?
                }
 
-            found_row = true;
-            }
+            findrow=1;
+            break;
+            } //largest value found (end if)
          }
 
-      //if no row with a 1 found then swap last column and the column with no 1 down.
-      if(!found_row)
+      if(!findrow)//if no row with a 1 found then swap last column and the column with no 1 down.
          {
-         perm[m_coln - m_rown - 1 - failcnt] = static_cast<int>(max);
+         perm[m_coln - m_rown - 1 - failcnt] = max;
          failcnt++;
-         if(!max)
+         if (!max)
             {
+            //CSEC_FREE_MEM_CHK_SET_NULL(*p_perm);
+            //CSEC_THR_RETURN();
             perm.resize(0);
             }
          i--;
@@ -119,18 +120,17 @@ secure_vector<size_t> binary_matrix::row_reduced_echelon_form()
          perm[i+m_coln - m_rown] = max;
          for(size_t j=i+1;j<m_rown;j++)//fill the column downwards with 0's
             {
-            if(coef(j, max))
+            if(coef(j,(max)))
                {
                row_xor(j,i);//check the arg. order.
                }
             }
 
-         //fill the column with 0's upwards too.
-         for(size_t j = i; j != 0; --j)
+         for(int j=i-1;j>=0;j--)//fill the column with 0's upwards too.
             {
-            if(coef(j - 1, max))
+            if(coef(j,(max)))
                {
-               row_xor(j - 1, i);
+               row_xor(j,i);
                }
             }
          }
@@ -149,23 +149,25 @@ void randomize_support(std::vector<gf2m>& L, RandomNumberGenerator& rng)
       }
    }
 
-std::unique_ptr<binary_matrix> generate_R(std::vector<gf2m> &L, polyn_gf2m* g, std::shared_ptr<GF2m_Field> sp_field, size_t code_length, size_t t)
+std::unique_ptr<binary_matrix> generate_R(std::vector<gf2m> &L, polyn_gf2m* g, std::shared_ptr<GF2m_Field> sp_field, uint32_t code_length, uint32_t t )
    {
    //L- Support
    //t- Number of errors
    //n- Length of the Goppa code
    //m- The extension degree of the GF
    //g- The generator polynomial.
-
-   const size_t r = t * sp_field->get_extension_degree();
+   gf2m x,y;
+   uint32_t r;
+   std::vector<int> Laux(code_length);
+   r=t*sp_field->get_extension_degree();
 
    binary_matrix H(r, code_length);
 
    for(size_t i = 0; i != code_length; i++)
       {
-      gf2m x = g->eval(lex_to_gray(L[i]));//evaluate the polynomial at the point L[i].
+      x = g->eval(lex_to_gray(L[i]));//evaluate the polynomial at the point L[i].
       x = sp_field->gf_inv(x);
-      gf2m y = x;
+      y = x;
       for(size_t j=0;j<t;j++)
          {
          for(size_t k=0;k<sp_field->get_extension_degree();k++)
@@ -180,10 +182,11 @@ std::unique_ptr<binary_matrix> generate_R(std::vector<gf2m> &L, polyn_gf2m* g, s
          }
       }//The H matrix is fed.
 
-   secure_vector<size_t> perm = H.row_reduced_echelon_form();
-   if(perm.size() == 0)
+   secure_vector<int> perm = H.row_reduced_echelon_form();
+   if (perm.size() == 0)
       {
-      throw Invalid_State("McEliece keygen failed - could not bring matrix to row reduced echelon form");
+      // result still is NULL
+      throw Invalid_State("could not bring matrix in row reduced echelon form");
       }
 
    std::unique_ptr<binary_matrix> result(new binary_matrix(code_length-r, r)) ;
@@ -191,14 +194,12 @@ std::unique_ptr<binary_matrix> generate_R(std::vector<gf2m> &L, polyn_gf2m* g, s
       {
       for(size_t j = 0; j < result->columns(); ++j)
          {
-         if(H.coef(j, perm[i]))
+         if (H.coef(j,perm[i]))
             {
             result->toggle_coeff(i,j);
             }
          }
       }
-
-   std::vector<gf2m> Laux(code_length);
    for(size_t i = 0; i < code_length; ++i)
       {
       Laux[i] = L[perm[i]];
@@ -206,7 +207,7 @@ std::unique_ptr<binary_matrix> generate_R(std::vector<gf2m> &L, polyn_gf2m* g, s
 
    for(size_t i = 0; i < code_length; ++i)
       {
-      L[i] = Laux[i];
+      L[i] = static_cast<gf2m>(Laux[i]);
       }
    return result;
    }
@@ -239,7 +240,7 @@ McEliece_PrivateKey generate_mceliece_key(RandomNumberGenerator & rng, size_t ex
    do
       {
       // create a random irreducible polynomial
-      g = polyn_gf2m(t, rng, sp_field);
+      g = polyn_gf2m (t, rng, sp_field);
 
       try
          {
@@ -252,7 +253,7 @@ McEliece_PrivateKey generate_mceliece_key(RandomNumberGenerator & rng, size_t ex
       } while (!success);
 
    std::vector<polyn_gf2m> sqrtmod = polyn_gf2m::sqrt_mod_init( g);
-   std::vector<polyn_gf2m> F = syndrome_init(g, L, static_cast<int>(code_length));
+   std::vector<polyn_gf2m> F = syndrome_init(g, L, code_length);
 
    // Each F[i] is the (precomputed) syndrome of the error vector with
    // a single '1' in i-th position.
@@ -260,6 +261,7 @@ McEliece_PrivateKey generate_mceliece_key(RandomNumberGenerator & rng, size_t ex
    // as binary vectors of length ext_deg * t (this will
    // speed up the syndrome computation)
    //
+   //
    std::vector<uint32_t> H(bit_size_to_32bit_size(codimension) * code_length);
    uint32_t* sk = H.data();
    for(size_t i = 0; i < code_length; ++i)
@@ -267,7 +269,7 @@ McEliece_PrivateKey generate_mceliece_key(RandomNumberGenerator & rng, size_t ex
       for(size_t l = 0; l < t; ++l)
          {
          const size_t k = (l * ext_deg) / 32;
-         const uint8_t j = (l * ext_deg) % 32;
+         const size_t j = (l * ext_deg) % 32;
          sk[k] ^= static_cast<uint32_t>(F[i].get_coef(l)) << j;
          if(j + ext_deg > 32)
             {
diff --git a/src/lib/pubkey/mce/code_based_util.h b/src/lib/pubkey/mce/code_based_util.h
index 5b0a9195a..291954a45 100644
--- a/src/lib/pubkey/mce/code_based_util.h
+++ b/src/lib/pubkey/mce/code_based_util.h
@@ -42,12 +42,12 @@ inline gf2m lex_to_gray(gf2m lex)
    return (lex >> 1) ^ lex;
    }
 
-inline size_t bit_size_to_byte_size(size_t bit_size)
+inline size_t bit_size_to_byte_size(uint32_t bit_size)
    {
    return (bit_size - 1) / 8 + 1;
    }
 
-inline size_t bit_size_to_32bit_size(size_t bit_size)
+inline size_t bit_size_to_32bit_size(uint32_t bit_size)
    {
    return (bit_size - 1) / 32 + 1;
    }
diff --git a/src/lib/pubkey/mce/gf2m_rootfind_dcmp.cpp b/src/lib/pubkey/mce/gf2m_rootfind_dcmp.cpp
index 5fd88f3d7..2c0f32194 100644
--- a/src/lib/pubkey/mce/gf2m_rootfind_dcmp.cpp
+++ b/src/lib/pubkey/mce/gf2m_rootfind_dcmp.cpp
@@ -15,9 +15,9 @@ namespace Botan {
 
 namespace {
 
-void patch_root_array(gf2m res_root_arr[],
-                      size_t res_root_arr_len,
-                      size_t root_pos)
+uint32_t patch_root_array(gf2m* res_root_arr,
+                        uint32_t res_root_arr_len,
+                        uint32_t root_pos)
    {
    volatile gf2m patch_elem = 0x01;
    volatile gf2m cond_mask = (root_pos == res_root_arr_len);
@@ -29,21 +29,21 @@ void patch_root_array(gf2m res_root_arr[],
       gf2m masked_patch_elem = (patch_elem++) & cond_mask;
       res_root_arr[i] ^= masked_patch_elem++;
       }
+   return res_root_arr_len;
    }
 
 class gf2m_decomp_rootfind_state
    {
    public:
-      gf2m_decomp_rootfind_state(const polyn_gf2m & p_polyn, size_t code_length);
+      gf2m_decomp_rootfind_state(const polyn_gf2m & p_polyn, uint32_t code_length);
 
       void calc_LiK(const polyn_gf2m & sigma);
       gf2m calc_Fxj_j_neq_0( const polyn_gf2m & sigma, gf2m j_gray);
       void calc_next_Aij();
       void calc_Ai_zero(const polyn_gf2m & sigma);
       secure_vector<gf2m> find_roots(const polyn_gf2m & sigma);
-
-   private:
-      size_t m_code_length;
+      uint32_t get_code_length() const { return code_length; }
+      uint32_t code_length;
       secure_vector<gf2m> m_Lik; // size is outer_summands * m
       secure_vector<gf2m> m_Aij; // ...
       uint32_t m_outer_summands;
@@ -84,8 +84,8 @@ uint32_t brootf_decomp_calc_sum_limit(uint32_t t)
    return result;
    }
 
-gf2m_decomp_rootfind_state::gf2m_decomp_rootfind_state(const polyn_gf2m & polyn, size_t code_length) :
-   m_code_length(code_length), m_j(0), m_j_gray(0)
+gf2m_decomp_rootfind_state::gf2m_decomp_rootfind_state(const polyn_gf2m & polyn, uint32_t the_code_length) :
+   code_length(the_code_length), m_j(0), m_j_gray(0)
    {
    gf2m coeff_3;
    gf2m coeff_head;
@@ -272,13 +272,12 @@ secure_vector<gf2m> gf2m_decomp_rootfind_state::find_roots(const polyn_gf2m & si
 
    this->calc_Ai_zero(sigma);
    this->calc_LiK(sigma);
-   for(;;)
+   do
       {
       gf2m eval_result;
-
       if(this->m_j_gray == 0)
          {
-         eval_result = sigma.get_coef(0);
+         eval_result = sigma.get_coef( 0);
          }
       else
          {
@@ -287,25 +286,27 @@ secure_vector<gf2m> gf2m_decomp_rootfind_state::find_roots(const polyn_gf2m & si
 
       if(eval_result == 0)
          {
+
          result[root_pos] = this->m_j_gray;
          root_pos++;
-         }
 
-      if(this->m_j + static_cast<uint32_t>(1) == m_code_length)
+         }
+      if(this->m_j + static_cast<uint32_t>(1) == this->get_code_length())
          {
          break;
          }
       this->calc_next_Aij();
-      }
+      }while(1);
 
    // side channel / fault attack countermeasure:
-   patch_root_array(result.data(), result.size(), root_pos);
+   root_pos = patch_root_array(result.data(), result.size(), root_pos);
+   result.resize(root_pos);
    return result;
    }
 
 } // end anonymous namespace
 
-secure_vector<gf2m> find_roots_gf2m_decomp(const polyn_gf2m & polyn, size_t code_length)
+secure_vector<gf2m> find_roots_gf2m_decomp(const polyn_gf2m & polyn, uint32_t code_length)
    {
    gf2m_decomp_rootfind_state state(polyn, code_length);
    return state.find_roots(polyn);
diff --git a/src/lib/pubkey/mce/gf2m_small_m.cpp b/src/lib/pubkey/mce/gf2m_small_m.cpp
index 341b45d03..47b4c34ae 100644
--- a/src/lib/pubkey/mce/gf2m_small_m.cpp
+++ b/src/lib/pubkey/mce/gf2m_small_m.cpp
@@ -41,13 +41,13 @@ std::vector<gf2m> gf_exp_table(size_t deg, gf2m prime_poly)
    {
    // construct the table gf_exp[i]=alpha^i
 
-   std::vector<gf2m> tab((static_cast<size_t>(1) << deg) + 1);
+   std::vector<gf2m> tab((1 << deg) + 1);
 
    tab[0] = 1;
    for(size_t i = 1; i < tab.size(); ++i)
       {
-      const gf2m overflow = tab[i-1] >> (deg - 1);
-      tab[i] = (tab[i-1] << 1) ^ (overflow * prime_poly);
+      const bool overflow = tab[i - 1] >> (deg - 1);
+      tab[i] = (tab[i-1] << 1) ^ (overflow ? prime_poly : 0);
       }
 
    return tab;
@@ -68,9 +68,9 @@ const std::vector<gf2m>& exp_table(size_t deg)
 
 std::vector<gf2m> gf_log_table(size_t deg, const std::vector<gf2m>& exp)
    {
-   std::vector<gf2m> tab(static_cast<size_t>(1) << deg);
+   std::vector<gf2m> tab(1 << deg);
 
-   tab[0] = static_cast<gf2m>((static_cast<gf2m>(1) << deg) - 1); // log of 0 is the order by convention
+   tab[0] = (1 << deg) - 1; // log of 0 is the order by convention
    for(size_t i = 0; i < tab.size(); ++i)
       {
       tab[exp[i]] = static_cast<gf2m>(i);
@@ -118,9 +118,28 @@ GF2m_Field::GF2m_Field(size_t extdeg) : m_gf_extension_degree(extdeg),
 gf2m GF2m_Field::gf_div(gf2m x, gf2m y) const
    {
    const int32_t sub_res = static_cast<int32_t>(gf_log(x) - static_cast<int32_t>(gf_log(y)));
-   const gf2m modq_res = _gf_modq_1(sub_res);
+   const int32_t modq_res = static_cast<int32_t>(_gf_modq_1(sub_res));
    const int32_t div_res = static_cast<int32_t>(x) ? static_cast<int32_t>(gf_exp(modq_res)) : 0;
    return static_cast<gf2m>(div_res);
    }
 
+// we suppose i >= 0. Par convention 0^0 = 1
+gf2m GF2m_Field::gf_pow(gf2m x, int i) const
+   {
+   if (i == 0)
+      return 1;
+   else if (x == 0)
+      return 0;
+   else
+      {
+      // i mod (q-1)
+      while (i >> get_extension_degree())
+         i = (i & (gf_ord())) + (i >> get_extension_degree());
+      i *= gf_log(x);
+      while (i >> get_extension_degree())
+         i = (i & (gf_ord())) + (i >> get_extension_degree());
+      return gf_exp(i);
+      }
+   }
+
 }
diff --git a/src/lib/pubkey/mce/gf2m_small_m.h b/src/lib/pubkey/mce/gf2m_small_m.h
index 44903bc46..9acc50c72 100644
--- a/src/lib/pubkey/mce/gf2m_small_m.h
+++ b/src/lib/pubkey/mce/gf2m_small_m.h
@@ -171,6 +171,8 @@ class BOTAN_PUBLIC_API(2,0) GF2m_Field
 
       gf2m gf_div(gf2m x, gf2m y) const;
 
+      gf2m gf_pow(gf2m x, int i) const;
+
       gf2m gf_exp(gf2m i) const
          {
          return m_gf_exp_table.at(i); /* alpha^i */
diff --git a/src/lib/pubkey/mce/goppa_code.cpp b/src/lib/pubkey/mce/goppa_code.cpp
index f26716fab..a1c493a13 100644
--- a/src/lib/pubkey/mce/goppa_code.cpp
+++ b/src/lib/pubkey/mce/goppa_code.cpp
@@ -17,19 +17,18 @@ namespace Botan {
 namespace {
 
 void matrix_arr_mul(std::vector<uint32_t> matrix,
-                    size_t numo_rows,
-                    size_t words_per_row,
-                    const uint8_t input_vec[],
-                    uint32_t output_vec[],
-                    size_t output_vec_len)
+                    uint32_t numo_rows,
+                    uint32_t words_per_row,
+                    const uint8_t* input_vec,
+                    uint32_t* output_vec, uint32_t output_vec_len)
    {
    for(size_t j = 0; j < numo_rows; j++)
       {
       if((input_vec[j / 8] >> (j % 8)) & 1)
          {
-         for(size_t i = 0; i < output_vec_len; i++)
+         for(size_t i = 0; i < output_vec_len; i ++)
             {
-            output_vec[i] ^= matrix[j * (words_per_row) + i];
+            output_vec[i] ^= matrix[ j * (words_per_row) + i];
             }
          }
       }
@@ -43,8 +42,8 @@ secure_vector<gf2m> goppa_decode(const polyn_gf2m & syndrom_polyn,
                                  const std::vector<polyn_gf2m> & sqrtmod,
                                  const std::vector<gf2m> & Linv)
    {
-   const size_t code_length = Linv.size();
    gf2m a;
+   uint32_t code_length = Linv.size();
    uint32_t t = g.get_degree();
 
    std::shared_ptr<GF2m_Field> sp_field = g.get_sp_field();
@@ -165,13 +164,13 @@ void mceliece_decrypt(
 * array */
 secure_vector<uint8_t> mceliece_decrypt(
    secure_vector<gf2m> & error_pos,
-   const uint8_t *ciphertext, size_t ciphertext_len,
+   const uint8_t *ciphertext, uint32_t ciphertext_len,
    const McEliece_PrivateKey & key)
    {
 
-   const size_t dimension = key.get_dimension();
-   const size_t codimension = key.get_codimension();
-   const uint32_t t = key.get_goppa_polyn().get_degree();
+   uint32_t dimension = key.get_dimension();
+   uint32_t codimension = key.get_codimension();
+   uint32_t t = key.get_goppa_polyn().get_degree();
    polyn_gf2m syndrome_polyn(key.get_goppa_polyn().get_sp_field()); // init as zero polyn
    const unsigned unused_pt_bits = dimension % 8;
    const uint8_t unused_pt_bits_mask = (1 << unused_pt_bits) - 1;
@@ -180,7 +179,7 @@ secure_vector<uint8_t> mceliece_decrypt(
       {
       throw Invalid_Argument("wrong size of McEliece ciphertext");
       }
-   const size_t cleartext_len = (key.get_message_word_bit_length()+7)/8;
+   uint32_t cleartext_len = (key.get_message_word_bit_length()+7)/8;
 
    if(cleartext_len != bit_size_to_byte_size(dimension))
       {
@@ -195,10 +194,10 @@ secure_vector<uint8_t> mceliece_decrypt(
                   syndrome_vec.data(), syndrome_vec.size());
 
    secure_vector<uint8_t> syndrome_byte_vec(bit_size_to_byte_size(codimension));
-   const size_t syndrome_byte_vec_size = syndrome_byte_vec.size();
-   for(size_t i = 0; i < syndrome_byte_vec_size; i++)
+   uint32_t syndrome_byte_vec_size = syndrome_byte_vec.size();
+   for(uint32_t i = 0; i < syndrome_byte_vec_size; i++)
       {
-      syndrome_byte_vec[i] = static_cast<uint8_t>(syndrome_vec[i/4] >> (8 * (i % 4)));
+      syndrome_byte_vec[i] = static_cast<uint8_t>(syndrome_vec[i/4] >> (8* (i % 4)));
       }
 
    syndrome_polyn = polyn_gf2m(t-1, syndrome_byte_vec.data(), bit_size_to_byte_size(codimension), key.get_goppa_polyn().get_sp_field());
@@ -206,12 +205,12 @@ secure_vector<uint8_t> mceliece_decrypt(
    syndrome_polyn.get_degree();
    error_pos = goppa_decode(syndrome_polyn, key.get_goppa_polyn(), key.get_sqrtmod(), key.get_Linv());
 
-   const size_t nb_err = error_pos.size();
+   uint32_t nb_err = error_pos.size();
 
    secure_vector<uint8_t> cleartext(cleartext_len);
    copy_mem(cleartext.data(), ciphertext, cleartext_len);
 
-   for(size_t i = 0; i < nb_err; i++)
+   for(uint32_t i = 0; i < nb_err; i++)
       {
       gf2m current = error_pos[i];
 
diff --git a/src/lib/pubkey/mce/mce_internal.h b/src/lib/pubkey/mce/mce_internal.h
index f3845b286..62dafcc5a 100644
--- a/src/lib/pubkey/mce/mce_internal.h
+++ b/src/lib/pubkey/mce/mce_internal.h
@@ -32,7 +32,7 @@ void mceliece_decrypt(secure_vector<uint8_t>& plaintext_out,
 
 secure_vector<uint8_t> mceliece_decrypt(
    secure_vector<gf2m> & error_pos,
-   const uint8_t *ciphertext, size_t ciphertext_len,
+   const uint8_t *ciphertext, uint32_t ciphertext_len,
    const McEliece_PrivateKey & key);
 
 void mceliece_encrypt(secure_vector<uint8_t>& ciphertext_out,
diff --git a/src/lib/pubkey/mce/mceliece.cpp b/src/lib/pubkey/mce/mceliece.cpp
index c5fe74b05..a68ae2a16 100644
--- a/src/lib/pubkey/mce/mceliece.cpp
+++ b/src/lib/pubkey/mce/mceliece.cpp
@@ -18,10 +18,8 @@ namespace Botan {
 
 namespace {
 
-secure_vector<uint8_t> concat_vectors(const secure_vector<uint8_t>& a,
-                                      const secure_vector<uint8_t>& b,
-                                      size_t dimension,
-                                      size_t codimension)
+secure_vector<uint8_t> concat_vectors(const secure_vector<uint8_t>& a, const secure_vector<uint8_t>& b,
+                                   uint32_t dimension, uint32_t codimension)
    {
    secure_vector<uint8_t> x(bit_size_to_byte_size(dimension) + bit_size_to_byte_size(codimension));
 
@@ -36,10 +34,10 @@ secure_vector<uint8_t> concat_vectors(const secure_vector<uint8_t>& a,
    else
       {
       copy_mem(&x[0], a.data(), (dimension / 8));
-      size_t l = dimension / 8;
+      uint32_t l = dimension / 8;
       x[l] = static_cast<uint8_t>(a[l] & ((1 << final_bits) - 1));
 
-      for(size_t k = 0; k < codimension / 8; ++k)
+      for(uint32_t k = 0; k < codimension / 8; ++k)
          {
          x[l] ^= static_cast<uint8_t>(b[k] << final_bits);
          ++l;
@@ -52,12 +50,12 @@ secure_vector<uint8_t> concat_vectors(const secure_vector<uint8_t>& a,
    }
 
 secure_vector<uint8_t> mult_by_pubkey(const secure_vector<uint8_t>& cleartext,
-                                      std::vector<uint8_t> const& public_matrix,
-                                      size_t code_length, size_t t)
+                                   std::vector<uint8_t> const& public_matrix,
+                                   uint32_t code_length, uint32_t t)
    {
-   const size_t ext_deg = ceil_log2(code_length);
-   const size_t codimension = ext_deg * t;
-   const size_t dimension = code_length - codimension;
+   const uint32_t ext_deg = ceil_log2(code_length);
+   const uint32_t codimension = ext_deg * t;
+   const uint32_t dimension = code_length - codimension;
    secure_vector<uint8_t> cR(bit_size_to_32bit_size(codimension) * sizeof(uint32_t));
 
    const uint8_t* pt = public_matrix.data();
@@ -88,9 +86,9 @@ secure_vector<uint8_t> mult_by_pubkey(const secure_vector<uint8_t>& cleartext,
    return ciphertext;
    }
 
-secure_vector<uint8_t> create_random_error_vector(size_t code_length,
-                                                  size_t error_weight,
-                                                  RandomNumberGenerator& rng)
+secure_vector<uint8_t> create_random_error_vector(unsigned code_length,
+                                               unsigned error_weight,
+                                               RandomNumberGenerator& rng)
    {
    secure_vector<uint8_t> result((code_length+7)/8);
 
@@ -98,10 +96,9 @@ secure_vector<uint8_t> create_random_error_vector(size_t code_length,
 
    while(bits_set < error_weight)
       {
-      gf2m x = random_code_element(static_cast<uint16_t>(code_length), rng);
+      gf2m x = random_code_element(code_length, rng);
 
-      const size_t byte_pos = x / 8;
-      const size_t bit_pos = x % 8;
+      const size_t byte_pos = x / 8, bit_pos = x % 8;
 
       const uint8_t mask = (1 << bit_pos);
 
@@ -123,12 +120,10 @@ void mceliece_encrypt(secure_vector<uint8_t>& ciphertext_out,
                       const McEliece_PublicKey& key,
                       RandomNumberGenerator& rng)
    {
-   const uint16_t code_length = static_cast<uint16_t>(key.get_code_length());
-
-   secure_vector<uint8_t> error_mask = create_random_error_vector(code_length, key.get_t(), rng);
+   secure_vector<uint8_t> error_mask = create_random_error_vector(key.get_code_length(), key.get_t(), rng);
 
    secure_vector<uint8_t> ciphertext = mult_by_pubkey(plaintext, key.get_public_matrix(),
-                                                      key.get_code_length(), key.get_t());
+                                                   key.get_code_length(), key.get_t());
 
    ciphertext ^= error_mask;
 
diff --git a/src/lib/pubkey/mce/mceliece.h b/src/lib/pubkey/mce/mceliece.h
index 0c86ec8c4..54f043472 100644
--- a/src/lib/pubkey/mce/mceliece.h
+++ b/src/lib/pubkey/mce/mceliece.h
@@ -23,9 +23,9 @@ class BOTAN_PUBLIC_API(2,0) McEliece_PublicKey : public virtual Public_Key
    public:
       explicit McEliece_PublicKey(const std::vector<uint8_t>& key_bits);
 
-      McEliece_PublicKey(const std::vector<uint8_t>& pub_matrix, size_t t, size_t the_code_length) :
+      McEliece_PublicKey(const std::vector<uint8_t>& pub_matrix, uint32_t the_t, uint32_t the_code_length) :
          m_public_matrix(pub_matrix),
-         m_t(t),
+         m_t(the_t),
          m_code_length(the_code_length){}
 
       McEliece_PublicKey(const McEliece_PublicKey& other) = default;
@@ -46,9 +46,9 @@ class BOTAN_PUBLIC_API(2,0) McEliece_PublicKey : public virtual Public_Key
       bool check_key(RandomNumberGenerator&, bool) const override
          { return true; }
 
-      size_t get_t() const { return m_t; }
-      size_t get_code_length() const { return m_code_length; }
-      size_t get_message_word_bit_length() const;
+      uint32_t get_t() const { return m_t; }
+      uint32_t get_code_length() const { return m_code_length; }
+      uint32_t get_message_word_bit_length() const;
       const std::vector<uint8_t>& get_public_matrix() const { return m_public_matrix; }
 
       bool operator==(const McEliece_PublicKey& other) const;
@@ -63,8 +63,8 @@ class BOTAN_PUBLIC_API(2,0) McEliece_PublicKey : public virtual Public_Key
       McEliece_PublicKey() : m_t(0), m_code_length(0) {}
 
       std::vector<uint8_t> m_public_matrix;
-      size_t m_t;
-      size_t m_code_length;
+      uint32_t m_t;
+      uint32_t m_code_length;
    };
 
 class BOTAN_PUBLIC_API(2,0) McEliece_PrivateKey final : public virtual McEliece_PublicKey,
@@ -101,9 +101,9 @@ class BOTAN_PUBLIC_API(2,0) McEliece_PrivateKey final : public virtual McEliece_
       std::vector<gf2m> const& get_Linv() const { return m_Linv; }
       std::vector<polyn_gf2m> const& get_sqrtmod() const { return m_sqrtmod; }
 
-      inline size_t get_dimension() const { return m_dimension; }
+      inline uint32_t get_dimension() const { return m_dimension; }
 
-      inline size_t get_codimension() const { return m_codimension; }
+      inline uint32_t get_codimension() const { return m_codimension; }
 
       secure_vector<uint8_t> private_key_bits() const override;
 
@@ -121,8 +121,8 @@ class BOTAN_PUBLIC_API(2,0) McEliece_PrivateKey final : public virtual McEliece_
       std::vector<gf2m> m_Linv;
       std::vector<uint32_t> m_coeffs;
 
-      size_t m_codimension;
-      size_t m_dimension;
+      uint32_t m_codimension;
+      uint32_t m_dimension;
    };
 
 /**
diff --git a/src/lib/pubkey/mce/mceliece_key.cpp b/src/lib/pubkey/mce/mceliece_key.cpp
index bd386a0f9..433e65171 100644
--- a/src/lib/pubkey/mce/mceliece_key.cpp
+++ b/src/lib/pubkey/mce/mceliece_key.cpp
@@ -43,9 +43,9 @@ McEliece_PrivateKey::McEliece_PrivateKey(RandomNumberGenerator& rng, size_t code
    *this = generate_mceliece_key(rng, ext_deg, code_length, t);
    }
 
-size_t McEliece_PublicKey::get_message_word_bit_length() const
+uint32_t McEliece_PublicKey::get_message_word_bit_length() const
    {
-   size_t codimension = ceil_log2(m_code_length) * m_t;
+   uint32_t codimension = ceil_log2(m_code_length) * m_t;
    return m_code_length - codimension;
    }
 
@@ -234,7 +234,7 @@ McEliece_PrivateKey::McEliece_PrivateKey(const secure_vector<uint8_t>& key_bits)
       {
       throw Decoding_Error("encoded parity check matrix has length which is not a multiple of four");
       }
-   if(enc_H.size() / 4 != bit_size_to_32bit_size(m_codimension) * m_code_length)
+   if(enc_H.size()/4 != bit_size_to_32bit_size(m_codimension) * m_code_length )
       {
       throw Decoding_Error("encoded parity check matrix has wrong length");
       }
@@ -285,7 +285,7 @@ bool McEliece_PublicKey::operator==(const McEliece_PublicKey& other) const
       {
       return false;
       }
-   if(m_t != other.m_t)
+   if(m_t != other.m_t )
       {
       return false;
       }
diff --git a/src/lib/pubkey/mce/polyn_gf2m.cpp b/src/lib/pubkey/mce/polyn_gf2m.cpp
index 592ab7262..763e0f293 100644
--- a/src/lib/pubkey/mce/polyn_gf2m.cpp
+++ b/src/lib/pubkey/mce/polyn_gf2m.cpp
@@ -45,7 +45,7 @@ unsigned nlz_16bit(uint16_t x)
 
 int polyn_gf2m::calc_degree_secure() const
    {
-   int i = static_cast<int>(this->coeff.size()) - 1;
+   int i = this->coeff.size() - 1;
    int result = 0;
    uint32_t found_mask = 0;
    uint32_t tracker_mask = 0xffff;
@@ -68,14 +68,14 @@ gf2m random_gf2m(RandomNumberGenerator& rng)
    return make_uint16(b[1], b[0]);
    }
 
-gf2m random_code_element(uint16_t code_length, RandomNumberGenerator& rng)
+gf2m random_code_element(unsigned code_length, RandomNumberGenerator& rng)
    {
    if(code_length == 0)
       {
       throw Invalid_Argument("random_code_element() was supplied a code length of zero");
       }
    const unsigned nlz = nlz_16bit(code_length-1);
-   const gf2m mask = (1 << (16-nlz)) - 1;
+   const gf2m mask = (1 << (16-nlz)) -1;
 
    gf2m result;
 
@@ -94,7 +94,7 @@ polyn_gf2m::polyn_gf2m(polyn_gf2m const& other)
     m_sp_field(other.m_sp_field)
    { }
 
-polyn_gf2m::polyn_gf2m(int d, std::shared_ptr<GF2m_Field> sp_field)
+polyn_gf2m::polyn_gf2m(   int d, std::shared_ptr<GF2m_Field> sp_field)
    :m_deg(-1),
     coeff(d+1),
     m_sp_field(sp_field)
@@ -128,7 +128,7 @@ polyn_gf2m::polyn_gf2m(const uint8_t* mem, uint32_t mem_len, std::shared_ptr<GF2
    {
    if(mem_len % sizeof(gf2m))
       {
-      throw Decoding_Error("illegal length of memory to decode ");
+      throw Botan::Decoding_Error("illegal length of memory to decode ");
       }
 
    uint32_t size = (mem_len / sizeof(this->coeff[0])) ;
@@ -143,7 +143,7 @@ polyn_gf2m::polyn_gf2m(const uint8_t* mem, uint32_t mem_len, std::shared_ptr<GF2
       {
       if(this->coeff[i] >= (1 << sp_field->get_extension_degree()))
          {
-         throw Decoding_Error("error decoding polynomial");
+         throw Botan::Decoding_Error("error decoding polynomial");
          }
       }
    this->get_degree();
@@ -154,7 +154,7 @@ polyn_gf2m::polyn_gf2m( std::shared_ptr<GF2m_Field> sp_field) :
    m_deg(-1), coeff(1), m_sp_field(sp_field)
    {}
 
-polyn_gf2m::polyn_gf2m(int degree, const uint8_t* mem, size_t mem_byte_len, std::shared_ptr<GF2m_Field> sp_field)
+polyn_gf2m::polyn_gf2m(int degree, const unsigned  char* mem, uint32_t mem_byte_len, std::shared_ptr<GF2m_Field> sp_field)
    :m_sp_field(sp_field)
    {
    uint32_t j, k, l;
@@ -163,10 +163,10 @@ polyn_gf2m::polyn_gf2m(int degree, const uint8_t* mem, size_t mem_byte_len, std:
    polyn_size = degree + 1;
    if(polyn_size * sp_field->get_extension_degree() > 8 * mem_byte_len)
       {
-      throw Decoding_Error("memory vector for polynomial has wrong size");
+      throw Botan::Decoding_Error("memory vector for polynomial has wrong size");
       }
    this->coeff = secure_vector<gf2m>(degree+1);
-   gf2m ext_deg = static_cast<gf2m>(this->m_sp_field->get_extension_degree());
+   gf2m ext_deg = this->m_sp_field->get_extension_degree();
    for (l = 0; l < polyn_size; l++)
       {
       k = (l * ext_deg) / 8;
@@ -227,7 +227,7 @@ void polyn_gf2m::set_to_zero()
 
 int polyn_gf2m::get_degree() const
    {
-   int d = static_cast<int>(this->coeff.size()) - 1;
+   int d = this->coeff.size() - 1;
    while ((d >= 0) && (this->coeff[d] == 0))
       --d;
    const_cast<polyn_gf2m*>(this)->m_deg = d;
@@ -387,7 +387,7 @@ polyn_gf2m polyn_gf2m::gcd(polyn_gf2m const& p1, polyn_gf2m const& p2)
 
 
 // Returns the degree of the smallest factor
-size_t polyn_gf2m::degppf(const polyn_gf2m& g)
+void polyn_gf2m::degppf(const polyn_gf2m & g, int* p_result)
    {
    polyn_gf2m s(g.get_sp_field());
 
@@ -399,7 +399,7 @@ size_t polyn_gf2m::degppf(const polyn_gf2m& g)
 
    p.set_degree(1);
    (*&p).set_coef(1, 1);
-   size_t result = static_cast<size_t>(d);
+   (*p_result) = d;
    for(size_t i = 1; i <= (d / 2) * ext_deg; ++i)
       {
       polyn_gf2m r = p.sqmod(u, d);
@@ -411,7 +411,7 @@ size_t polyn_gf2m::degppf(const polyn_gf2m& g)
 
          if(s.get_degree() > 0)
             {
-            result = i / ext_deg;
+            (*p_result) = i / ext_deg;
             break;
             }
          r[1] ^= 1;
@@ -423,7 +423,7 @@ size_t polyn_gf2m::degppf(const polyn_gf2m& g)
       r = s;
       }
 
-   return result;
+
    }
 
 void polyn_gf2m::patchup_deg_secure( uint32_t trgt_deg, volatile gf2m patch_elem)
@@ -636,26 +636,25 @@ std::pair<polyn_gf2m, polyn_gf2m> polyn_gf2m::eea_with_coefficients( const polyn
    return std::make_pair(u1,r1); // coefficients u,v
    }
 
-polyn_gf2m::polyn_gf2m(size_t t, RandomNumberGenerator& rng, std::shared_ptr<GF2m_Field> sp_field)
-   :m_deg(static_cast<int>(t)),
+polyn_gf2m::polyn_gf2m(int t, Botan::RandomNumberGenerator& rng, std::shared_ptr<GF2m_Field> sp_field)
+   :m_deg(t),
     coeff(t+1),
     m_sp_field(sp_field)
    {
-   this->set_coef(t, 1);
-   for(;;)
+   (*this).set_coef( t, 1);
+   int degree = 0;
+   do
       {
-      for(size_t i = 0; i < t; ++i)
+      for (int i = 0; i < t; ++i)
          {
-         this->set_coef(i, random_code_element(sp_field->get_cardinality(), rng));
+         (*this).set_coef( i, random_code_element(sp_field->get_cardinality(), rng));
          }
-
-      const size_t degree = polyn_gf2m::degppf(*this);
-
-      if(degree >= t)
-         break;
+      polyn_gf2m::degppf(*this, &degree);
       }
+   while (degree < t);
    }
 
+
 void polyn_gf2m::poly_shiftmod( const polyn_gf2m & g)
    {
    if(g.get_degree() <= 1)
diff --git a/src/lib/pubkey/mce/polyn_gf2m.h b/src/lib/pubkey/mce/polyn_gf2m.h
index 55e865a29..e4d3d4d1c 100644
--- a/src/lib/pubkey/mce/polyn_gf2m.h
+++ b/src/lib/pubkey/mce/polyn_gf2m.h
@@ -29,34 +29,15 @@ class polyn_gf2m
       /**
       * create a zero polynomial:
       */
-      explicit polyn_gf2m(std::shared_ptr<GF2m_Field> sp_field);
+      explicit polyn_gf2m( std::shared_ptr<GF2m_Field> sp_field );
 
-      polyn_gf2m() : m_deg(-1) {}
+      polyn_gf2m()
+         :m_deg(-1) {}
 
-      polyn_gf2m(const secure_vector<uint8_t>& encoded, std::shared_ptr<GF2m_Field> sp_field);
+      polyn_gf2m(const secure_vector<uint8_t>& encoded, std::shared_ptr<GF2m_Field> sp_field );
 
       polyn_gf2m& operator=(const polyn_gf2m&) = default;
 
-      /**
-      * create zero polynomial with reservation of space for a degree d polynomial
-      */
-      polyn_gf2m(int d, std::shared_ptr<GF2m_Field> sp_field);
-
-      polyn_gf2m(polyn_gf2m const& other);
-
-      /**
-      * random irreducible polynomial of degree t
-      */
-      polyn_gf2m(size_t t, RandomNumberGenerator& rng, std::shared_ptr<GF2m_Field> sp_field);
-
-      /** decode a polynomial from memory: **/
-      polyn_gf2m(const uint8_t* mem, uint32_t mem_len, std::shared_ptr<GF2m_Field> sp_field);
-
-      /**
-      *  create a polynomial from memory area (encoded)
-      */
-      polyn_gf2m(int degree, const uint8_t* mem, size_t mem_byte_len, std::shared_ptr<GF2m_Field> sp_field);
-
       bool operator==(const polyn_gf2m & other) const ;
 
       bool operator!=(const polyn_gf2m & other) const { return !(*this == other); }
@@ -78,6 +59,20 @@ class polyn_gf2m
       void swap(polyn_gf2m& other);
 
       secure_vector<uint8_t> encode() const;
+      /**
+      * create zero polynomial with reservation of space for a degree d polynomial
+      */
+      polyn_gf2m(int d, std::shared_ptr<GF2m_Field> sp_field);
+
+      polyn_gf2m(polyn_gf2m const& other);
+      /**
+      * create zero polynomial with allocated size determined by specified degree d:
+      */
+
+      /**
+      * random irreducible polynomial of degree t
+      */
+      polyn_gf2m(int t, RandomNumberGenerator& rng, std::shared_ptr<GF2m_Field> sp_field);
 
       std::shared_ptr<GF2m_Field> get_sp_field() const
          { return m_sp_field; }
@@ -88,20 +83,28 @@ class polyn_gf2m
 
       gf2m get_lead_coef() const { return coeff[m_deg]; }
 
-      gf2m get_coef(size_t i) const { return coeff[i]; }
+      gf2m get_coef(uint32_t i) const { return coeff[i]; }
 
-      inline void set_coef(size_t i, gf2m v)
+      inline void set_coef(uint32_t i, gf2m v)
          {
          coeff[i] = v;
          }
 
-      inline void add_to_coef(size_t i, gf2m v)
+      inline void add_to_coef(uint32_t i, gf2m v)
          {
-         coeff[i] ^= v;
+         coeff[i] = coeff[i] ^ v;
          }
 
       std::string to_string() const;
 
+      /** decode a polynomial from memory: **/
+      polyn_gf2m(const uint8_t* mem, uint32_t mem_len, std::shared_ptr<GF2m_Field> sp_field);
+      // remove one! ^v!
+      /**
+      *  create a polynomial from memory area (encoded)
+      */
+      polyn_gf2m(int degree, const unsigned  char* mem, uint32_t mem_byte_len, std::shared_ptr<GF2m_Field> sp_field);
+
       void encode(uint32_t min_numo_coeffs, uint8_t* mem, uint32_t mem_len) const;
 
       int get_degree() const;
@@ -113,7 +116,7 @@ class polyn_gf2m
       */
       int calc_degree_secure() const;
 
-      size_t degppf(const polyn_gf2m& g);
+      void degppf(const polyn_gf2m & g, int* p_result);
 
       static std::vector<polyn_gf2m> sqmod_init(const polyn_gf2m & g);
 
@@ -156,14 +159,15 @@ class polyn_gf2m
    };
 
 gf2m random_gf2m(RandomNumberGenerator& rng);
-gf2m random_code_element(uint16_t code_length, RandomNumberGenerator& rng);
+gf2m random_code_element(unsigned code_length, RandomNumberGenerator& rng);
 
 std::vector<polyn_gf2m> syndrome_init(polyn_gf2m const& generator, std::vector<gf2m> const& support, int n);
 
 /**
-* Find the roots of a polynomial over GF(2^m) using the method by Federenko et al.
+* Find the roots of a polynomial over GF(2^m) using the method by Federenko
+* et al.
 */
-secure_vector<gf2m> find_roots_gf2m_decomp(const polyn_gf2m & polyn, size_t code_length);
+secure_vector<gf2m> find_roots_gf2m_decomp(const polyn_gf2m & polyn, uint32_t code_length);
 
 }
 
diff --git a/src/lib/pubkey/newhope/newhope.cpp b/src/lib/pubkey/newhope/newhope.cpp
index 3a5069636..a6fbc7cdc 100644
--- a/src/lib/pubkey/newhope/newhope.cpp
+++ b/src/lib/pubkey/newhope/newhope.cpp
@@ -45,7 +45,7 @@ inline uint16_t barrett_reduce(uint16_t a)
    {
    uint32_t u = (static_cast<uint32_t>(a) * 5) >> 16;
    u *= PARAM_Q;
-   a = static_cast<uint16_t>(a - u);
+   a -= u;
    return a;
    }
 
diff --git a/src/lib/pubkey/xmss/xmss_privatekey.cpp b/src/lib/pubkey/xmss/xmss_privatekey.cpp
index e9363bba6..6a728ac72 100644
--- a/src/lib/pubkey/xmss/xmss_privatekey.cpp
+++ b/src/lib/pubkey/xmss/xmss_privatekey.cpp
@@ -29,18 +29,18 @@ namespace {
 
 // fall back to raw decoding for previous versions, which did not encode an OCTET STRING
 secure_vector<uint8_t> extract_raw_key(const secure_vector<uint8_t>& key_bits)
-   {
+{
    secure_vector<uint8_t> raw_key;
    try
-      {
+   {
       BER_Decoder(key_bits).decode(raw_key, OCTET_STRING);
-      }
-   catch(Decoding_Error&)
-      {
+   }
+   catch(Decoding_Error& e)
+   {
       raw_key = key_bits;
-      }
-   return raw_key;
    }
+   return raw_key;
+}
 
 }
 
@@ -116,8 +116,7 @@ XMSS_PrivateKey::tree_hash(size_t start_idx,
                            size_t target_node_height,
                            XMSS_Address& adrs)
    {
-   BOTAN_ASSERT_NOMSG(target_node_height <= 30);
-   BOTAN_ASSERT((start_idx % (static_cast<size_t>(1) << target_node_height)) == 0,
+   BOTAN_ASSERT((start_idx % (1 << target_node_height)) == 0,
                 "Start index must be divisible by 2^{target node height}.");
 
 #if defined(BOTAN_HAS_THREAD_UTILS)
@@ -138,8 +137,7 @@ XMSS_PrivateKey::tree_hash(size_t start_idx,
    const size_t subtrees = static_cast<size_t>(1) << split_level;
    const size_t last_idx = (static_cast<size_t>(1) << (target_node_height)) + start_idx;
    const size_t offs = (last_idx - start_idx) / subtrees;
-   // this cast cannot overflow because target_node_height is limited
-   uint8_t level = static_cast<uint8_t>(split_level); // current level in the tree
+   uint8_t level = split_level; // current level in the tree
 
    BOTAN_ASSERT((last_idx - start_idx) % subtrees == 0,
                 "Number of worker threads in tree_hash need to divide range "
@@ -184,13 +182,13 @@ XMSS_PrivateKey::tree_hash(size_t start_idx,
    while(level-- > 1)
       {
       std::vector<secure_vector<uint8_t>> ro_nodes(
-         nodes.begin(), nodes.begin() + (static_cast<size_t>(1) << (level+1)));
+         nodes.begin(), nodes.begin() + (1 << (level+1)));
 
-      for(size_t i = 0; i < (static_cast<size_t>(1) << level); i++)
+      for(size_t i = 0; i < (1U << level); i++)
          {
          BOTAN_ASSERT_NOMSG(xmss_hash.size() > i);
 
-         node_addresses[i].set_tree_height(static_cast<uint32_t>(target_node_height - (level + 1)));
+         node_addresses[i].set_tree_height(target_node_height - (level + 1));
          node_addresses[i].set_tree_index(
             (node_addresses[2 * i + 1].get_tree_index() - 1) >> 1);
          using rnd_tree_hash_fn_t =
@@ -222,7 +220,7 @@ XMSS_PrivateKey::tree_hash(size_t start_idx,
       }
 
    // Avoid creation an extra thread to calculate root node.
-   node_addresses[0].set_tree_height(static_cast<uint32_t>(target_node_height - 1));
+   node_addresses[0].set_tree_height(target_node_height - 1);
    node_addresses[0].set_tree_index(
       (node_addresses[1].get_tree_index() - 1) >> 1);
    randomize_tree_hash(nodes[0],
@@ -264,7 +262,7 @@ XMSS_PrivateKey::tree_hash_subtree(secure_vector<uint8_t>& result,
    for(size_t i = start_idx; i < last_idx; i++)
       {
       adrs.set_type(XMSS_Address::Type::OTS_Hash_Address);
-      adrs.set_ots_address(static_cast<uint32_t>(i));
+      adrs.set_ots_address(i);
       this->wots_private_key().generate_public_key(
          pk,
          // getWOTS_SK(SK, s + i), reference implementation uses adrs
@@ -273,13 +271,13 @@ XMSS_PrivateKey::tree_hash_subtree(secure_vector<uint8_t>& result,
          adrs,
          hash);
       adrs.set_type(XMSS_Address::Type::LTree_Address);
-      adrs.set_ltree_address(static_cast<uint32_t>(i));
+      adrs.set_ltree_address(i);
       create_l_tree(nodes[level], pk, adrs, seed, hash);
       node_levels[level] = 0;
 
       adrs.set_type(XMSS_Address::Type::Hash_Tree_Address);
       adrs.set_tree_height(0);
-      adrs.set_tree_index(static_cast<uint32_t>(i));
+      adrs.set_tree_index(i);
 
       while(level > 0 && node_levels[level] ==
             node_levels[level - 1])
diff --git a/src/lib/pubkey/xmss/xmss_privatekey.h b/src/lib/pubkey/xmss/xmss_privatekey.h
index 06378fdd0..301fef04b 100644
--- a/src/lib/pubkey/xmss/xmss_privatekey.h
+++ b/src/lib/pubkey/xmss/xmss_privatekey.h
@@ -203,6 +203,7 @@ class BOTAN_PUBLIC_API(2,0) XMSS_PrivateKey final : public virtual XMSS_PublicKe
       secure_vector<uint8_t> private_key_bits() const override
          {
          return DER_Encoder().encode(raw_private_key(), OCTET_STRING).get_contents();
+         return raw_private_key();
          }
 
       size_t size() const override
diff --git a/src/lib/pubkey/xmss/xmss_publickey.cpp b/src/lib/pubkey/xmss/xmss_publickey.cpp
index c19a2f972..43f7417cf 100644
--- a/src/lib/pubkey/xmss/xmss_publickey.cpp
+++ b/src/lib/pubkey/xmss/xmss_publickey.cpp
@@ -25,18 +25,18 @@ namespace {
 
 // fall back to raw decoding for previous versions, which did not encode an OCTET STRING
 std::vector<uint8_t> extract_raw_key(const std::vector<uint8_t>& key_bits)
-   {
+{
    std::vector<uint8_t> raw_key;
    try
-      {
+   {
       BER_Decoder(key_bits).decode(raw_key, OCTET_STRING);
-      }
-   catch(Decoding_Error&)
-      {
+   }
+   catch(Decoding_Error& e)
+   {
       raw_key = key_bits;
-      }
-   return raw_key;
    }
+   return raw_key;
+}
 
 }
 
diff --git a/src/lib/pubkey/xmss/xmss_signature_operation.cpp b/src/lib/pubkey/xmss/xmss_signature_operation.cpp
index 38659a88b..6402ffac4 100644
--- a/src/lib/pubkey/xmss/xmss_signature_operation.cpp
+++ b/src/lib/pubkey/xmss/xmss_signature_operation.cpp
@@ -100,7 +100,7 @@ void XMSS_Signature_Operation::initialize()
    secure_vector<uint8_t> index_bytes;
    // reserve leaf index so it can not be reused in by another signature
    // operation using the same private key.
-   m_leaf_idx = static_cast<uint32_t>(m_priv_key.reserve_unused_leaf_index());
+   m_leaf_idx = m_priv_key.reserve_unused_leaf_index();
 
    // write prefix for message hashing into buffer.
    XMSS_Tools::concat(index_bytes, m_leaf_idx, 32);
diff --git a/src/lib/pubkey/xmss/xmss_signature_operation.h b/src/lib/pubkey/xmss/xmss_signature_operation.h
index bba860602..c279faffd 100644
--- a/src/lib/pubkey/xmss/xmss_signature_operation.h
+++ b/src/lib/pubkey/xmss/xmss_signature_operation.h
@@ -84,7 +84,7 @@ class XMSS_Signature_Operation final : public virtual PK_Ops::Signature,
 
       XMSS_PrivateKey m_priv_key;
       secure_vector<uint8_t> m_randomness;
-      uint32_t m_leaf_idx;
+      size_t m_leaf_idx;
       bool m_is_initialized;
    };
 
diff --git a/src/lib/pubkey/xmss/xmss_verification_operation.cpp b/src/lib/pubkey/xmss/xmss_verification_operation.cpp
index a38f7f63c..2eacc19fd 100644
--- a/src/lib/pubkey/xmss/xmss_verification_operation.cpp
+++ b/src/lib/pubkey/xmss/xmss_verification_operation.cpp
@@ -26,9 +26,8 @@ XMSS_Verification_Operation::root_from_signature(const XMSS_Signature& sig,
       XMSS_Address& adrs,
       const secure_vector<uint8_t>& seed)
    {
-   const uint32_t next_index = static_cast<uint32_t>(sig.unused_leaf_index());
    adrs.set_type(XMSS_Address::Type::OTS_Hash_Address);
-   adrs.set_ots_address(next_index);
+   adrs.set_ots_address(sig.unused_leaf_index());
 
    XMSS_WOTS_PublicKey pub_key_ots(m_pub_key.wots_parameters().oid(),
                                    msg,
@@ -37,18 +36,18 @@ XMSS_Verification_Operation::root_from_signature(const XMSS_Signature& sig,
                                    seed);
 
    adrs.set_type(XMSS_Address::Type::LTree_Address);
-   adrs.set_ltree_address(next_index);
+   adrs.set_ltree_address(sig.unused_leaf_index());
 
    std::array<secure_vector<uint8_t>, 2> node;
    create_l_tree(node[0], pub_key_ots, adrs, seed);
 
    adrs.set_type(XMSS_Address::Type::Hash_Tree_Address);
-   adrs.set_tree_index(next_index);
+   adrs.set_tree_index(sig.unused_leaf_index());
 
    for(size_t k = 0; k < m_xmss_params.tree_height(); k++)
       {
-      adrs.set_tree_height(static_cast<uint32_t>(k));
-      if(((next_index / (static_cast<size_t>(1) << k)) & 0x01) == 0)
+      adrs.set_tree_height(k);
+      if(((sig.unused_leaf_index() / (1 << k)) & 0x01) == 0)
          {
          adrs.set_tree_index(adrs.get_tree_index() >> 1);
          randomize_tree_hash(node[1],
diff --git a/src/lib/pubkey/xmss/xmss_wots_privatekey.cpp b/src/lib/pubkey/xmss/xmss_wots_privatekey.cpp
index d3c00f765..5b48d2d4d 100644
--- a/src/lib/pubkey/xmss/xmss_wots_privatekey.cpp
+++ b/src/lib/pubkey/xmss/xmss_wots_privatekey.cpp
@@ -50,7 +50,7 @@ XMSS_WOTS_PrivateKey::generate_public_key(XMSS_WOTS_PublicKey& pub_key,
    pub_key.set_key_data(std::move(in_key_data));
    for(size_t i = 0; i < m_wots_params.len(); i++)
       {
-      adrs.set_chain_address(static_cast<uint32_t>(i));
+      adrs.set_chain_address(i);
       chain(pub_key[i], 0, m_wots_params.wots_parameter() - 1, adrs,
             public_seed(), hash);
       }
@@ -72,7 +72,7 @@ XMSS_WOTS_PrivateKey::sign(const secure_vector<uint8_t>& msg,
 
    for(size_t i = 0; i < m_wots_params.len(); i++)
       {
-      adrs.set_chain_address(static_cast<uint32_t>(i));
+      adrs.set_chain_address(i);
       chain(sig[i], 0 , msg_digest[i], adrs, m_public_seed, hash);
       }
 
diff --git a/src/lib/pubkey/xmss/xmss_wots_publickey.cpp b/src/lib/pubkey/xmss/xmss_wots_publickey.cpp
index 667c8574a..a7a445963 100644
--- a/src/lib/pubkey/xmss/xmss_wots_publickey.cpp
+++ b/src/lib/pubkey/xmss/xmss_wots_publickey.cpp
@@ -26,7 +26,7 @@ XMSS_WOTS_PublicKey::chain(secure_vector<uint8_t>& result,
          i < (start_idx + steps) && i < m_wots_params.wots_parameter();
          i++)
       {
-      adrs.set_hash_address(static_cast<uint32_t>(i));
+      adrs.set_hash_address(i);
 
       //Calculate tmp XOR bitmask
       adrs.set_key_mask_mode(XMSS_Address::Key_Mask::Mask_Mode);
@@ -58,7 +58,7 @@ XMSS_WOTS_PublicKey::pub_key_from_signature(const secure_vector<uint8_t>& msg,
 
    for(size_t i = 0; i < m_wots_params.len(); i++)
       {
-      adrs.set_chain_address(static_cast<uint32_t>(i));
+      adrs.set_chain_address(i);
       chain(result[i],
             msg_digest[i],
             m_wots_params.wots_parameter() - 1 - msg_digest[i],
diff --git a/src/lib/rng/system_rng/info.txt b/src/lib/rng/system_rng/info.txt
index e77328b82..da4fce4e3 100644
--- a/src/lib/rng/system_rng/info.txt
+++ b/src/lib/rng/system_rng/info.txt
@@ -10,7 +10,7 @@ crypto_ng
 </os_features>
 
 <libs>
-uwp -> bcrypt
+uwp -> bcrypt.lib
 </libs>
 
 <requires>
diff --git a/src/lib/utils/bit_ops.h b/src/lib/utils/bit_ops.h
index fc93bbf2e..352035bf4 100644
--- a/src/lib/utils/bit_ops.h
+++ b/src/lib/utils/bit_ops.h
@@ -116,14 +116,12 @@ inline size_t ctz(T n)
    }
 
 template<typename T>
-uint8_t ceil_log2(T x)
+size_t ceil_log2(T x)
    {
-   static_assert(sizeof(T) < 32, "Abnormally large scalar");
-
    if(x >> (sizeof(T)*8-1))
       return sizeof(T)*8;
 
-   uint8_t result = 0;
+   size_t result = 0;
    T compare = 1;
 
    while(compare < x)
diff --git a/src/lib/utils/compiler.h b/src/lib/utils/compiler.h
index 3f1dc4f8b..6e3f14418 100644
--- a/src/lib/utils/compiler.h
+++ b/src/lib/utils/compiler.h
@@ -173,7 +173,7 @@
 * Define BOTAN_IF_CONSTEXPR
 */
 #if !defined(BOTAN_IF_CONSTEXPR)
-   #if __cplusplus >= 201703
+   #if __cplusplus > 201402
       #define BOTAN_IF_CONSTEXPR if constexpr
    #else
       #define BOTAN_IF_CONSTEXPR if
diff --git a/src/lib/utils/cpuid/cpuid_arm.cpp b/src/lib/utils/cpuid/cpuid_arm.cpp
index b422de9d2..6c947c62b 100644
--- a/src/lib/utils/cpuid/cpuid_arm.cpp
+++ b/src/lib/utils/cpuid/cpuid_arm.cpp
@@ -200,11 +200,11 @@ uint64_t CPUID::CPUID_Data::detect_cpu_features(size_t* cache_line_size)
    NEON registers v0-v7 are caller saved in Aarch64
    */
 
-   auto neon_probe  = []() noexcept -> int { asm("and v0.16b, v0.16b, v0.16b"); return 1; };
-   auto aes_probe   = []() noexcept -> int { asm(".word 0x4e284800"); return 1; };
-   auto pmull_probe = []() noexcept -> int { asm(".word 0x0ee0e000"); return 1; };
-   auto sha1_probe  = []() noexcept -> int { asm(".word 0x5e280800"); return 1; };
-   auto sha2_probe  = []() noexcept -> int { asm(".word 0x5e282800"); return 1; };
+   auto neon_probe  = []() -> int { asm("and v0.16b, v0.16b, v0.16b"); return 1; };
+   auto aes_probe   = []() -> int { asm(".word 0x4e284800"); return 1; };
+   auto pmull_probe = []() -> int { asm(".word 0x0ee0e000"); return 1; };
+   auto sha1_probe  = []() -> int { asm(".word 0x5e280800"); return 1; };
+   auto sha2_probe  = []() -> int { asm(".word 0x5e282800"); return 1; };
 
    // Only bother running the crypto detection if we found NEON
 
diff --git a/src/lib/utils/cpuid/cpuid_ppc.cpp b/src/lib/utils/cpuid/cpuid_ppc.cpp
index 4fb24f24b..ff528d88e 100644
--- a/src/lib/utils/cpuid/cpuid_ppc.cpp
+++ b/src/lib/utils/cpuid/cpuid_ppc.cpp
@@ -86,7 +86,7 @@ uint64_t CPUID::CPUID_Data::detect_cpu_features(size_t* cache_line_size)
    (others, too, maybe?) will trap and emulate it for us.
    */
 
-   int pvr = OS::run_cpu_instruction_probe([]() noexcept -> int {
+   int pvr = OS::run_cpu_instruction_probe([]() -> int {
       uint32_t pvr = 0;
       asm volatile("mfspr %0, 287" : "=r" (pvr));
       // Top 16 bits suffice to identify the model
diff --git a/src/lib/utils/http_util/http_util.cpp b/src/lib/utils/http_util/http_util.cpp
index 804b1d2c6..3fd08b5b8 100644
--- a/src/lib/utils/http_util/http_util.cpp
+++ b/src/lib/utils/http_util/http_util.cpp
@@ -195,8 +195,7 @@ Response http_sync(http_exch_fn http_transact,
    while(io.good())
       {
       io.read(cast_uint8_ptr_to_char(buf.data()), buf.size());
-      const size_t got = static_cast<size_t>(io.gcount());
-      resp_body.insert(resp_body.end(), buf.data(), &buf[got]);
+      resp_body.insert(resp_body.end(), buf.data(), &buf[io.gcount()]);
       }
 
    const std::string header_size = search_map(headers, std::string("Content-Length"));
diff --git a/src/lib/utils/mem_ops.h b/src/lib/utils/mem_ops.h
index ea811ee50..8878603fc 100644
--- a/src/lib/utils/mem_ops.h
+++ b/src/lib/utils/mem_ops.h
@@ -132,10 +132,7 @@ template<typename T> inline void clear_mem(T* ptr, size_t n)
 template<typename T> inline void copy_mem(T* out, const T* in, size_t n)
    {
    static_assert(std::is_trivial<typename std::decay<T>::type>::value, "");
-   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr,
-                            "If n > 0 then args are not null");
-
-   if(in != nullptr && out != nullptr && n > 0)
+   if(n > 0)
       {
       std::memmove(out, in, sizeof(T)*n);
       }
diff --git a/src/lib/utils/mem_pool/mem_pool.cpp b/src/lib/utils/mem_pool/mem_pool.cpp
index 1ff3f0759..25a3fb408 100644
--- a/src/lib/utils/mem_pool/mem_pool.cpp
+++ b/src/lib/utils/mem_pool/mem_pool.cpp
@@ -149,7 +149,7 @@ class BitMap final
       BitMap(size_t bits) : m_len(bits)
          {
          m_bits.resize((bits + BITMASK_BITS - 1) / BITMASK_BITS);
-         m_main_mask = static_cast<bitmask_type>(~0);
+         m_main_mask = static_cast<bitmask_type>(0) - 1; // all bits set
          m_last_mask = m_main_mask;
 
          if(bits % BITMASK_BITS != 0)
diff --git a/src/lib/utils/os_utils.cpp b/src/lib/utils/os_utils.cpp
index b37c06d6e..72de063e8 100644
--- a/src/lib/utils/os_utils.cpp
+++ b/src/lib/utils/os_utils.cpp
@@ -384,40 +384,21 @@ size_t OS::get_memory_locking_limit()
    return 0;
    }
 
-bool OS::read_env_variable(std::string& value_out, const std::string& name)
+const char* OS::read_env_variable(const std::string& name)
    {
-   value_out = "";
-
    if(running_in_privileged_state())
-      return false;
+      return nullptr;
 
-#if defined(BOTAN_TARGET_OS_HAS_WIN32) && defined(BOTAN_BUILD_COMPILER_IS_MSVC)
-   char val[128] = { 0 };
-   size_t req_size = 0;
-   if(getenv_s(&req_size, val, sizeof(val), name.c_str()) == 0)
-      {
-      value_out = std::string(val, req_size);
-      return true;
-      }
-#else
-   if(const char* val = std::getenv(name.c_str()))
-      {
-      value_out = val;
-      return true;
-      }
-#endif
-
-   return false;
+   return std::getenv(name.c_str());
    }
 
 size_t OS::read_env_variable_sz(const std::string& name, size_t def)
    {
-   std::string value;
-   if(read_env_variable(value, name))
+   if(const char* env = read_env_variable(name))
       {
       try
          {
-         const size_t val = std::stoul(value, nullptr);
+         const size_t val = std::stoul(env, nullptr);
          return val;
          }
       catch(std::exception&) { /* ignore it */ }
@@ -633,6 +614,19 @@ int OS::run_cpu_instruction_probe(std::function<int ()> probe_fn)
    if(rc != 0)
       throw System_Error("run_cpu_instruction_probe sigaction restore failed", errno);
 
+#elif defined(BOTAN_TARGET_OS_IS_WINDOWS) && defined(BOTAN_TARGET_COMPILER_IS_MSVC)
+
+   // Windows SEH
+   __try
+      {
+      probe_result = probe_fn();
+      }
+   __except(::GetExceptionCode() == EXCEPTION_ILLEGAL_INSTRUCTION ?
+            EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH)
+      {
+      probe_result = -1;
+      }
+
 #else
    BOTAN_UNUSED(probe_fn);
 #endif
diff --git a/src/lib/utils/os_utils.h b/src/lib/utils/os_utils.h
index d31dcb3ba..5b8c49f99 100644
--- a/src/lib/utils/os_utils.h
+++ b/src/lib/utils/os_utils.h
@@ -95,12 +95,12 @@ size_t get_memory_locking_limit();
 size_t system_page_size();
 
 /**
-* Read the value of an environment variable, setting it to value_out if it
-* exists.  Returns false and sets value_out to empty string if no such variable
-* is set. If the process seems to be running in a privileged state (such as
-* setuid) then always returns false and does not examine the environment.
+* Read the value of an environment variable. Return nullptr if
+* no such variable is set. If the process seems to be running in
+* a privileged state (such as setuid) then always returns nullptr,
+* similiar to glibc's secure_getenv.
 */
-bool read_env_variable(std::string& value_out, const std::string& var_name);
+const char* read_env_variable(const std::string& var_name);
 
 /**
 * Read the value of an environment variable and convert it to an
diff --git a/src/lib/utils/socket/info.txt b/src/lib/utils/socket/info.txt
index 3862f0f74..ceeaa18ee 100644
--- a/src/lib/utils/socket/info.txt
+++ b/src/lib/utils/socket/info.txt
@@ -11,7 +11,7 @@ socket_udp.h
 <libs>
 linux -> rt
 mingw -> ws2_32
-windows -> ws2_32
+windows -> ws2_32.lib
 haiku -> network
 solaris -> socket,nsl
 qnx -> socket
diff --git a/src/lib/utils/socket/socket.cpp b/src/lib/utils/socket/socket.cpp
index bc632259a..3c742c3ca 100644
--- a/src/lib/utils/socket/socket.cpp
+++ b/src/lib/utils/socket/socket.cpp
@@ -139,7 +139,6 @@ class BSD_Socket final : public OS::Socket
       typedef SOCKET socket_type;
       typedef int socket_op_ret_type;
       typedef int socklen_type;
-      typedef int sendrecv_len_type;
       static socket_type invalid_socket() { return INVALID_SOCKET; }
       static void close_socket(socket_type s) { ::closesocket(s); }
       static std::string get_last_socket_error() { return std::to_string(::WSAGetLastError()); }
@@ -180,7 +179,6 @@ class BSD_Socket final : public OS::Socket
       typedef int socket_type;
       typedef ssize_t socket_op_ret_type;
       typedef socklen_t socklen_type;
-      typedef size_t sendrecv_len_type;
       static socket_type invalid_socket() { return -1; }
       static void close_socket(socket_type s) { ::close(s); }
       static std::string get_last_socket_error() { return ::strerror(errno); }
@@ -245,7 +243,7 @@ class BSD_Socket final : public OS::Socket
                   // Weirdly, Winsock uses a SOCKET type but wants FD_SET to get an int instead
                   FD_SET(static_cast<int>(m_socket), &write_set);
 
-                  active = ::select(static_cast<int>(m_socket + 1), nullptr, &write_set, nullptr, &timeout_tv);
+                  active = ::select(m_socket + 1, nullptr, &write_set, nullptr, &timeout_tv);
 
                   if(active)
                      {
@@ -297,13 +295,13 @@ class BSD_Socket final : public OS::Socket
          while(sent_so_far != len)
             {
             struct timeval timeout = make_timeout_tv();
-            int active = ::select(static_cast<int>(m_socket + 1), nullptr, &write_set, nullptr, &timeout);
+            int active = ::select(m_socket + 1, nullptr, &write_set, nullptr, &timeout);
 
             if(active == 0)
                throw System_Error("Timeout during socket write");
 
             const size_t left = len - sent_so_far;
-            socket_op_ret_type sent = ::send(m_socket, cast_uint8_ptr_to_char(&buf[sent_so_far]), static_cast<sendrecv_len_type>(left), 0);
+            socket_op_ret_type sent = ::send(m_socket, cast_uint8_ptr_to_char(&buf[sent_so_far]), left, 0);
             if(sent < 0)
                throw System_Error("Socket write failed", errno);
             else
@@ -318,12 +316,12 @@ class BSD_Socket final : public OS::Socket
          FD_SET(m_socket, &read_set);
 
          struct timeval timeout = make_timeout_tv();
-         int active = ::select(static_cast<int>(m_socket + 1), &read_set, nullptr, nullptr, &timeout);
+         int active = ::select(m_socket + 1, &read_set, nullptr, nullptr, &timeout);
 
          if(active == 0)
             throw System_Error("Timeout during socket read");
 
-         socket_op_ret_type got = ::recv(m_socket, cast_uint8_ptr_to_char(buf), static_cast<sendrecv_len_type>(len), 0);
+         socket_op_ret_type got = ::recv(m_socket, cast_uint8_ptr_to_char(buf), len, 0);
 
          if(got < 0)
             throw System_Error("Socket read failed", errno);
@@ -335,8 +333,8 @@ class BSD_Socket final : public OS::Socket
       struct timeval make_timeout_tv() const
          {
          struct timeval tv;
-         tv.tv_sec = static_cast<decltype(timeval::tv_sec)>(m_timeout.count() / 1000000);
-         tv.tv_usec = static_cast<decltype(timeval::tv_usec)>(m_timeout.count() % 1000000);;
+         tv.tv_sec = static_cast<time_t>(m_timeout.count() / 1000000);
+         tv.tv_usec = static_cast<long>(m_timeout.count() % 1000000);;
          return tv;
          }
 
diff --git a/src/lib/utils/socket/socket_udp.cpp b/src/lib/utils/socket/socket_udp.cpp
index 5833d55b2..6e7cb1f11 100644
--- a/src/lib/utils/socket/socket_udp.cpp
+++ b/src/lib/utils/socket/socket_udp.cpp
@@ -175,7 +175,7 @@ class BSD_SocketUDP final : public OS::SocketUDP
 
             set_nonblocking(m_socket);
             memcpy(&sa, res->ai_addr, res->ai_addrlen);
-            salen = static_cast<socklen_t>(res->ai_addrlen);
+            salen=res->ai_addrlen;
             }
 
          ::freeaddrinfo(res);
@@ -204,13 +204,13 @@ class BSD_SocketUDP final : public OS::SocketUDP
          while(sent_so_far != len)
             {
             struct timeval timeout = make_timeout_tv();
-            int active = ::select(static_cast<int>(m_socket + 1), nullptr, &write_set, nullptr, &timeout);
+            int active = ::select(m_socket + 1, nullptr, &write_set, nullptr, &timeout);
 
             if(active == 0)
                { throw System_Error("Timeout during socket write"); }
 
             const size_t left = len - sent_so_far;
-            socket_op_ret_type sent = ::sendto(m_socket, cast_uint8_ptr_to_char(buf + sent_so_far), static_cast<sendrecv_len_type>(left), 0, (sockaddr*)&sa, salen);
+            socket_op_ret_type sent = ::sendto(m_socket, cast_uint8_ptr_to_char(buf + sent_so_far), left, 0, (sockaddr*)&sa, salen);
             if(sent < 0)
                { throw System_Error("Socket write failed", errno); }
             else
@@ -225,12 +225,12 @@ class BSD_SocketUDP final : public OS::SocketUDP
          FD_SET(m_socket, &read_set);
 
          struct timeval timeout = make_timeout_tv();
-         int active = ::select(static_cast<int>(m_socket + 1), &read_set, nullptr, nullptr, &timeout);
+         int active = ::select(m_socket + 1, &read_set, nullptr, nullptr, &timeout);
 
          if(active == 0)
             { throw System_Error("Timeout during socket read"); }
 
-         socket_op_ret_type got = ::recvfrom(m_socket, cast_uint8_ptr_to_char(buf), static_cast<sendrecv_len_type>(len), 0, nullptr, nullptr);
+         socket_op_ret_type got = ::recvfrom(m_socket, cast_uint8_ptr_to_char(buf), len, 0, nullptr, nullptr);
 
          if(got < 0)
             { throw System_Error("Socket read failed", errno); }
@@ -242,7 +242,6 @@ class BSD_SocketUDP final : public OS::SocketUDP
 #if defined(BOTAN_TARGET_OS_HAS_WINSOCK2)
       typedef SOCKET socket_type;
       typedef int socket_op_ret_type;
-      typedef int sendrecv_len_type;
       static socket_type invalid_socket() { return INVALID_SOCKET; }
       static void close_socket(socket_type s) { ::closesocket(s); }
       static std::string get_last_socket_error() { return std::to_string(::WSAGetLastError()); }
@@ -282,7 +281,6 @@ class BSD_SocketUDP final : public OS::SocketUDP
 #else
       typedef int socket_type;
       typedef ssize_t socket_op_ret_type;
-      typedef size_t sendrecv_len_type;
       static socket_type invalid_socket() { return -1; }
       static void close_socket(socket_type s) { ::close(s); }
       static std::string get_last_socket_error() { return ::strerror(errno); }
@@ -301,8 +299,8 @@ class BSD_SocketUDP final : public OS::SocketUDP
       struct timeval make_timeout_tv() const
          {
          struct timeval tv;
-         tv.tv_sec = static_cast<decltype(timeval::tv_sec)>(m_timeout.count() / 1000000);
-         tv.tv_usec = static_cast<decltype(timeval::tv_usec)>(m_timeout.count() % 1000000);;
+         tv.tv_sec = m_timeout.count() / 1000000;
+         tv.tv_usec = m_timeout.count() % 1000000;
          return tv;
          }
 
diff --git a/src/lib/utils/thread_utils/barrier.h b/src/lib/utils/thread_utils/barrier.h
index 749da92a7..faa3188ef 100644
--- a/src/lib/utils/thread_utils/barrier.h
+++ b/src/lib/utils/thread_utils/barrier.h
@@ -31,7 +31,7 @@ class Barrier final
       void sync();
 
    private:
-      size_t m_value;
+      int m_value;
       size_t m_syncs;
       std::mutex m_mutex;
       std::condition_variable m_cond;
diff --git a/src/lib/x509/certstor_sql/certstor_sql.cpp b/src/lib/x509/certstor_sql/certstor_sql.cpp
index e8a511645..1ffa2e8ca 100644
--- a/src/lib/x509/certstor_sql/certstor_sql.cpp
+++ b/src/lib/x509/certstor_sql/certstor_sql.cpp
@@ -282,7 +282,7 @@ void Certificate_Store_In_SQL::revoke_cert(const X509_Certificate& cert, CRL_Cod
       }
    else
       {
-      stmt1->bind(3, static_cast<size_t>(-1));
+      stmt1->bind(3,-1);
       }
 
    stmt1->spin();
diff --git a/src/lib/x509/certstor_system_windows/info.txt b/src/lib/x509/certstor_system_windows/info.txt
index 0499feeec..8d6dce6c6 100644
--- a/src/lib/x509/certstor_system_windows/info.txt
+++ b/src/lib/x509/certstor_system_windows/info.txt
@@ -11,5 +11,5 @@ certstor_windows.h
 </header:public>
 
 <libs>
-windows -> crypt32
-</libs>
+windows -> crypt32.lib
+</libs>
\ No newline at end of file
diff --git a/src/lib/x509/key_constraint.cpp b/src/lib/x509/key_constraint.cpp
index f7f9523bf..05bd8edb0 100644
--- a/src/lib/x509/key_constraint.cpp
+++ b/src/lib/x509/key_constraint.cpp
@@ -97,7 +97,7 @@ void verify_cert_constraints_valid_for_key_type(const Public_Key& pub_key,
       permitted |= DIGITAL_SIGNATURE | NON_REPUDIATION | KEY_CERT_SIGN | CRL_SIGN;
       }
 
-   if(Key_Constraints(constraints & permitted) != constraints)
+   if((constraints & permitted) != constraints)
       {
       throw Invalid_Argument("Invalid " + name + " constraints " + key_constraints_to_string(constraints));
       }
diff --git a/src/lib/x509/name_constraint.cpp b/src/lib/x509/name_constraint.cpp
index ab654ae5e..b64e04d29 100644
--- a/src/lib/x509/name_constraint.cpp
+++ b/src/lib/x509/name_constraint.cpp
@@ -227,14 +227,14 @@ std::ostream& operator<<(std::ostream& os, const GeneralName& gn)
 GeneralSubtree::GeneralSubtree(const std::string& str) : GeneralSubtree()
    {
    size_t p0, p1;
-   const auto min = std::stoull(str, &p0, 10);
-   const auto max = std::stoull(str.substr(p0 + 1), &p1, 10);
+   size_t min = std::stoull(str, &p0, 10);
+   size_t max = std::stoull(str.substr(p0 + 1), &p1, 10);
    GeneralName gn(str.substr(p0 + p1 + 2));
 
    if(p0 > 0 && p1 > 0)
       {
-      m_minimum = static_cast<size_t>(min);
-      m_maximum = static_cast<size_t>(max);
+      m_minimum = min;
+      m_maximum = max;
       m_base = gn;
       }
    else
diff --git a/src/python/botan2.py b/src/python/botan2.py
index ee8baa296..2018cae20 100755
--- a/src/python/botan2.py
+++ b/src/python/botan2.py
@@ -383,14 +383,6 @@ def _set_prototypes(dll):
     dll.botan_x509_cert_validation_status.argtypes = [c_int]
     dll.botan_x509_cert_validation_status.restype = c_char_p
 
-    # X509 CRL
-    ffi_api(dll.botan_x509_crl_load, [c_void_p, c_char_p, c_size_t])
-    ffi_api(dll.botan_x509_crl_load_file, [c_void_p, c_char_p])
-    ffi_api(dll.botan_x509_crl_destroy, [c_void_p])
-    ffi_api(dll.botan_x509_is_revoked, [c_void_p, c_void_p], [-1])
-    ffi_api(dll.botan_x509_cert_verify_with_crl,
-            [POINTER(c_int), c_void_p, c_void_p, c_size_t, c_void_p, c_size_t, c_void_p, c_size_t, c_char_p, c_size_t, c_char_p, c_uint64])
-
     ffi_api(dll.botan_key_wrap3394,
             [c_char_p, c_size_t, c_char_p, c_size_t, c_char_p, POINTER(c_size_t)])
     ffi_api(dll.botan_key_unwrap3394,
@@ -1264,28 +1256,22 @@ def mceies_decrypt(mce, aead, ct, ad):
                                                             b, bl))
 
 
-def _load_buf_or_file(filename, buf, file_fn, buf_fn):
-    if filename is None and buf is None:
-        raise BotanException("No filename or buf given")
-    if filename is not None and buf is not None:
-        raise BotanException("Both filename and buf given")
-
-    obj = c_void_p(0)
-
-    if filename is not None:
-        file_fn(byref(obj), _ctype_str(filename))
-    elif buf is not None:
-        buf_fn(byref(obj), _ctype_bits(buf), len(buf))
-
-    return obj
-
-
 #
 # X.509 certificates
 #
 class X509Cert(object): # pylint: disable=invalid-name
     def __init__(self, filename=None, buf=None):
-        self.__obj = _load_buf_or_file(filename, buf, _DLL.botan_x509_cert_load_file, _DLL.botan_x509_cert_load)
+        if filename is None and buf is None:
+            raise BotanException("No filename or buf given")
+        if filename is not None and buf is not None:
+            raise BotanException("Both filename and buf given")
+
+        if filename is not None:
+            self.__obj = c_void_p(0)
+            _DLL.botan_x509_cert_load_file(byref(self.__obj), _ctype_str(filename))
+        elif buf is not None:
+            self.__obj = c_void_p(0)
+            _DLL.botan_x509_cert_load(byref(self.__obj), _ctype_bits(buf), len(buf))
 
     def __del__(self):
         _DLL.botan_x509_cert_destroy(self.__obj)
@@ -1390,7 +1376,7 @@ class X509Cert(object): # pylint: disable=invalid-name
         rc = _DLL.botan_x509_cert_allowed_usage(self.__obj, c_uint(usage))
         return rc == 0
 
-    def handle_(self):
+    def get_obj(self):
         return self.__obj
 
     def verify(self,
@@ -1399,83 +1385,39 @@ class X509Cert(object): # pylint: disable=invalid-name
                trusted_path=None,
                required_strength=0,
                hostname=None,
-               reference_time=0,
-               crls=None):
-        #pylint: disable=too-many-locals
-
-        if intermediates is not None:
-            c_intermediates = len(intermediates) * c_void_p
-            arr_intermediates = c_intermediates()
-            for i, ca in enumerate(intermediates):
-                arr_intermediates[i] = ca.handle_()
-            len_intermediates = c_size_t(len(intermediates))
-        else:
-            arr_intermediates = c_void_p(0)
-            len_intermediates = c_size_t(0)
-
-        if trusted is not None:
-            c_trusted = len(trusted) * c_void_p
-            arr_trusted = c_trusted()
-            for i, ca in enumerate(trusted):
-                arr_trusted[i] = ca.handle_()
-            len_trusted = c_size_t(len(trusted))
-        else:
-            arr_trusted = c_void_p(0)
-            len_trusted = c_size_t(0)
-
-        if crls is not None:
-            c_crls = len(crls) * c_void_p
-            arr_crls = c_crls()
-            for i, crl in enumerate(crls):
-                arr_crls[i] = crl.handle_()
-            len_crls = c_size_t(len(crls))
-        else:
-            arr_crls = c_void_p(0)
-            len_crls = c_size_t(0)
+               reference_time=0):
 
-        error_code = c_int(0)
+        c_intermediates = len(intermediates) * c_void_p
+        arr_intermediates = c_intermediates()
+        for i, ca in enumerate(intermediates):
+            arr_intermediates[i] = ca.get_obj()
 
-        _DLL.botan_x509_cert_verify_with_crl(byref(error_code),
-                                             self.__obj,
-                                             byref(arr_intermediates),
-                                             len_intermediates,
-                                             byref(arr_trusted),
-                                             len_trusted,
-                                             byref(arr_crls),
-                                             len_crls,
-                                             _ctype_str(trusted_path),
-                                             c_size_t(required_strength),
-                                             _ctype_str(hostname),
-                                             c_uint64(reference_time))
+        c_trusted = len(trusted) * c_void_p
+        arr_trusted = c_trusted()
+        for i, ca in enumerate(trusted):
+            arr_trusted[i] = ca.get_obj()
 
+        error_code = c_int(0)
+
+        _DLL.botan_x509_cert_verify(byref(error_code),
+                                    self.__obj,
+                                    byref(arr_intermediates),
+                                    c_size_t(len(intermediates)),
+                                    byref(arr_trusted),
+                                    c_size_t(len(trusted)),
+                                    _ctype_str(trusted_path),
+                                    c_size_t(required_strength),
+                                    _ctype_str(hostname),
+                                    c_uint64(reference_time))
         return error_code.value
 
     @classmethod
     def validation_status(cls, error_code):
         return _ctype_to_str(_DLL.botan_x509_cert_validation_status(c_int(error_code)))
 
-    def is_revoked(self, crl):
-        rc = _DLL.botan_x509_is_revoked(crl.handle_(), self.__obj)
-        return rc == 0
+class MPI(object):
 
-
-#
-# X.509 Certificate revocation lists
-#
-class X509CRL(object):
-    def __init__(self, filename=None, buf=None):
-        self.__obj = _load_buf_or_file(filename, buf, _DLL.botan_x509_crl_load_file, _DLL.botan_x509_crl_load)
-
-    def __del__(self):
-        _DLL.botan_x509_crl_destroy(self.__obj)
-
-    def handle_(self):
-        return self.__obj
-
-
-class MPI(object): # pylint: disable=too-many-public-methods
-
-    def __init__(self, initial_value=None, radix=None):
+    def __init__(self, initial_value=None):
 
         self.__obj = c_void_p(0)
         _DLL.botan_mp_init(byref(self.__obj))
@@ -1484,8 +1426,6 @@ class MPI(object): # pylint: disable=too-many-public-methods
             pass # left as zero
         elif isinstance(initial_value, MPI):
             _DLL.botan_mp_set_from_mp(self.__obj, initial_value.handle_())
-        elif radix is not None:
-            _DLL.botan_mp_set_from_radix_str(self.__obj, _ctype_str(initial_value), c_size_t(radix))
         elif isinstance(initial_value, str):
             _DLL.botan_mp_set_from_str(self.__obj, _ctype_str(initial_value))
         else:
@@ -1651,16 +1591,6 @@ class MPI(object): # pylint: disable=too-many-public-methods
         _DLL.botan_mp_rshift(self.__obj, self.__obj, shift)
         return self
 
-    def mod_mul(self, other, modulus):
-        r = MPI()
-        _DLL.botan_mp_mod_mul(r.handle_(), self.__obj, other.handle_(), modulus.handle_())
-        return r
-
-    def gcd(self, other):
-        r = MPI()
-        _DLL.botan_mp_gcd(r.handle_(), self.__obj, other.handle_())
-        return r
-
     def pow_mod(self, exponent, modulus):
         r = MPI()
         _DLL.botan_mp_powmod(r.handle_(), self.__obj, exponent.handle_(), modulus.handle_())
diff --git a/src/scripts/ci/appveyor.yml b/src/scripts/ci/appveyor.yml
index d1aaf07f8..b323a1f6d 100644
--- a/src/scripts/ci/appveyor.yml
+++ b/src/scripts/ci/appveyor.yml
@@ -23,10 +23,9 @@ environment:
       APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
       BOOST_ROOT: "C:\\Libraries\\boost_1_69_0"
       BOOST_LIBRARYDIR: "C:\\Libraries\\boost_1_69_0\\lib32-msvc-14.0"
-      BOOST_SYSTEM_LIBRARY: "libboost_system-vc140-mt-x32-1_69"
+      BOOST_SYSTEM_LIBRARY: "libboost_system-vc140-mt-x32-1_69.lib"
       MAKE_TOOL: nmake
       TARGET_CC: msvc
-      EXTRA_FLAGS: "--disable-werror"
 
     # MSVC 2017 DLL x86-32
     - CC: VC2017
@@ -35,7 +34,7 @@ environment:
       APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
       BOOST_ROOT: "C:\\Libraries\\boost_1_69_0"
       BOOST_LIBRARYDIR: "C:\\Libraries\\boost_1_69_0\\lib32-msvc-14.1"
-      BOOST_SYSTEM_LIBRARY: "libboost_system-vc141-mt-x32-1_69"
+      BOOST_SYSTEM_LIBRARY: "libboost_system-vc141-mt-x32-1_69.lib"
       MAKE_TOOL: jom
       TARGET_CC: msvc
 
@@ -46,7 +45,7 @@ environment:
       APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
       BOOST_ROOT: "C:\\Libraries\\boost_1_69_0"
       BOOST_LIBRARYDIR: "C:\\Libraries\\boost_1_69_0\\lib64-msvc-14.1"
-      BOOST_SYSTEM_LIBRARY: "libboost_system-vc141-mt-x64-1_69"
+      BOOST_SYSTEM_LIBRARY: "libboost_system-vc141-mt-x64-1_69.lib"
       MAKE_TOOL: jom
       TARGET_CC: msvc
 
@@ -57,7 +56,7 @@ environment:
       APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
       BOOST_ROOT: "C:\\Libraries\\boost_1_69_0"
       BOOST_LIBRARYDIR: "C:\\Libraries\\boost_1_69_0\\lib64-msvc-14.1"
-      BOOST_SYSTEM_LIBRARY: "libboost_system-vc141-mt-x64-1_69"
+      BOOST_SYSTEM_LIBRARY: "libboost_system-vc141-mt-x64-1_69.lib"
       MAKE_TOOL: jom
       TARGET_CC: msvc
 
@@ -81,7 +80,7 @@ install:
   - call src\scripts\ci\setup_appveyor.bat
 
 build_script:
-  - python src\scripts\ci_build.py --os=windows --cc=%TARGET_CC% --without-python3 --compiler-cache=sccache --make-tool=%MAKE_TOOL% --cpu=%PLATFORM% %EXTRA_FLAGS% %TARGET%
+  - python src\scripts\ci_build.py --os=windows --cc=%TARGET_CC% --without-python3 --compiler-cache=sccache --make-tool=%MAKE_TOOL% --cpu=%PLATFORM% %TARGET%
 
 # whitelist branches to avoid testing feature branches twice (as branch and as pull request)
 branches:
diff --git a/src/scripts/ci/travis.yml b/src/scripts/ci/travis.yml
index 844988cc3..7f7e3bb27 100644
--- a/src/scripts/ci/travis.yml
+++ b/src/scripts/ci/travis.yml
@@ -5,7 +5,6 @@ sudo: required
 env:
   global:
     - CCACHE_MAXSIZE=1G
-    - PKCS11_LIB=/usr/lib/softhsm/libsofthsm2.so
 
 jobs:
   include:
@@ -130,7 +129,6 @@ jobs:
       compiler: gcc
       env:
        - TARGET="gcc4.8"
-       - EXTRA_FLAGS="--disable-werror"
 
     - os: linux
       dist: bionic
@@ -171,7 +169,7 @@ install:
   - ./src/scripts/ci/setup_travis.sh
 
 script:
-  - ./src/scripts/ci_build.py --os=$TRAVIS_OS_NAME --cc=$CC --cc-bin=$CXX --without-pylint3 --pkcs11-lib=$PKCS11_LIB $EXTRA_FLAGS $TARGET
+  - ./src/scripts/ci_build.py --os=$TRAVIS_OS_NAME --cc=$CC --cc-bin=$CXX --without-pylint3 --pkcs11-lib=/usr/lib/softhsm/libsofthsm2.so $TARGET
 
 # whitelist branches to avoid testing feature branches twice (as branch and as pull request)
 branches:
diff --git a/src/scripts/ci_build.py b/src/scripts/ci_build.py
index ebbaf84f8..b75b52e84 100755
--- a/src/scripts/ci_build.py
+++ b/src/scripts/ci_build.py
@@ -26,8 +26,7 @@ def get_concurrency():
     except ImportError:
         return def_concurrency
 
-def determine_flags(target, target_os, target_cpu, target_cc, cc_bin,
-                    ccache, root_dir, pkcs11_lib, use_gdb, disable_werror):
+def determine_flags(target, target_os, target_cpu, target_cc, cc_bin, ccache, root_dir, pkcs11_lib, use_gdb):
     # pylint: disable=too-many-branches,too-many-statements,too-many-arguments,too-many-locals
 
     """
@@ -71,9 +70,6 @@ def determine_flags(target, target_os, target_cpu, target_cc, cc_bin,
              '--os=%s' % (target_os)]
     build_targets = ['cli', 'tests']
 
-    if not disable_werror:
-        flags += ['--werror-mode']
-
     if target_cpu is not None:
         flags += ['--cpu=%s' % (target_cpu)]
 
@@ -384,9 +380,6 @@ def parse_args(args):
     parser.add_option('--without-pylint3', dest='use_pylint3', action='store_false',
                       help='Disable using python3 pylint')
 
-    parser.add_option('--disable-werror', action='store_true', default=False,
-                      help='Allow warnings to compile')
-
     parser.add_option('--run-under-gdb', dest='use_gdb', action='store_true', default=False,
                       help='Run test suite under gdb and capture backtrace')
 
@@ -403,7 +396,7 @@ def have_prog(prog):
     return False
 
 def main(args=None):
-    # pylint: disable=too-many-branches,too-many-statements,too-many-locals,too-many-return-statements,too-many-locals
+    # pylint: disable=too-many-branches,too-many-statements,too-many-locals,too-many-return-statements
     """
     Parse options, do the things
     """
@@ -511,7 +504,7 @@ def main(args=None):
         config_flags, run_test_command, make_prefix = determine_flags(
             target, options.os, options.cpu, options.cc,
             options.cc_bin, options.compiler_cache, root_dir,
-            options.pkcs11_lib, options.use_gdb, options.disable_werror)
+            options.pkcs11_lib, options.use_gdb)
 
         cmds.append([py_interp, os.path.join(root_dir, 'configure.py')] + config_flags)
 
@@ -568,11 +561,9 @@ def main(args=None):
         if target in ['shared', 'coverage'] and options.os != 'windows':
             botan_exe = os.path.join(root_dir, 'botan-cli.exe' if options.os == 'windows' else 'botan')
 
-            test_scripts = ['test_cli.py', 'test_cli_crypt.py']
+            test_scripts = ['cli_tests.py', 'test_cli.py']
             for script in test_scripts:
-                cmds.append([py_interp,
-                             os.path.join(root_dir, 'src/scripts', script),
-                             '--threads=%d' % (options.build_jobs),
+                cmds.append([py_interp, os.path.join(root_dir, 'src/scripts', script),
                              botan_exe])
 
         python_tests = os.path.join(root_dir, 'src/scripts/test_python.py')


Test patch:
diff --git a/src/scripts/test_cli_crypt.py b/src/scripts/cli_tests.py
similarity index 55%
rename from src/scripts/test_cli_crypt.py
rename to src/scripts/cli_tests.py
index 780c14314..b4e973c2b 100755
--- a/src/scripts/test_cli_crypt.py
+++ b/src/scripts/cli_tests.py
@@ -13,18 +13,23 @@ import vecparser
 
 cli_binary = ""
 
-SUPPORTED_ALGORITHMS = {
-    "AES-128/CFB": "aes-128-cfb",
-    "AES-192/CFB": "aes-192-cfb",
-    "AES-256/CFB": "aes-256-cfb",
-    "AES-128/GCM": "aes-128-gcm",
-    "AES-192/GCM": "aes-192-gcm",
-    "AES-256/GCM": "aes-256-gcm",
-    "AES-128/OCB": "aes-128-ocb",
-    "AES-128/XTS": "aes-128-xts",
-    "AES-256/XTS": "aes-256-xts",
-    "ChaCha20Poly1305": "chacha20poly1305",
-}
+SUPPORTED_ALGORITHMS = [
+    'AES-128/CFB',
+    'AES-192/CFB',
+    'AES-256/CFB',
+    'AES-128/GCM',
+    'AES-192/GCM',
+    'AES-256/GCM',
+    'AES-128/OCB',
+    'AES-128/XTS',
+    'AES-256/XTS',
+    'ChaCha20Poly1305',
+]
+
+def append_ordered(base, additional_elements):
+    for key in additional_elements:
+        value = additional_elements[key]
+        base[key] = value
 
 class TestSequence(unittest.TestCase):
     pass
@@ -39,8 +44,32 @@ def create_test(data):
         algorithm = data['Algorithm']
         direction = data['Direction']
 
-        mode = SUPPORTED_ALGORITHMS.get(algorithm)
-        if mode is None:
+        # CFB
+        if algorithm == "AES-128/CFB":
+            mode = "aes-128-cfb"
+        elif algorithm == "AES-192/CFB":
+            mode = "aes-192-cfb"
+        elif algorithm == "AES-256/CFB":
+            mode = "aes-256-cfb"
+        # GCM
+        elif algorithm == "AES-128/GCM":
+            mode = "aes-128-gcm"
+        elif algorithm == "AES-192/GCM":
+            mode = "aes-192-gcm"
+        elif algorithm == "AES-256/GCM":
+            mode = "aes-256-gcm"
+        # OCB
+        elif algorithm == "AES-128/OCB":
+            mode = "aes-128-ocb"
+        # XTS
+        elif algorithm == "AES-128/XTS":
+            mode = "aes-128-xts"
+        elif algorithm == "AES-256/XTS":
+            mode = "aes-256-xts"
+        # ChaCha20Poly1305
+        elif algorithm == "ChaCha20Poly1305":
+            mode = "chacha20poly1305"
+        else:
             raise Exception("Unknown algorithm: '" + algorithm + "'")
 
         cmd = [
@@ -52,12 +81,15 @@ def create_test(data):
             "--key=%s" % key]
         if direction == "decrypt":
             cmd += ['--decrypt']
+        # out_raw = subprocess.check_output(cmd)
 
         if direction == "decrypt":
             invalue = ciphertext
         else:
             invalue = plaintext
 
+        #print(cmd)
+
         p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stdin=subprocess.PIPE, stderr=subprocess.PIPE)
         out_raw = p.communicate(input=binascii.unhexlify(invalue))[0]
         out = binascii.hexlify(out_raw).decode("UTF-8").lower()
@@ -100,29 +132,36 @@ if __name__ == '__main__':
     parser.add_argument('cli_binary',
                         help='path to the botan cli binary')
     parser.add_argument('--max-tests', type=int, default=20)
-    parser.add_argument('--threads', type=int, default=0)
     parser.add_argument('unittest_args', nargs="*")
     args = parser.parse_args()
 
     cli_binary = args.cli_binary
     max_tests = args.max_tests
 
-    test_data_dir = os.path.join('src', 'tests', 'data')
-
-    mode_test_data = [os.path.join(test_data_dir, 'modes', 'cfb.vec'),
-                      os.path.join(test_data_dir, 'aead', 'gcm.vec'),
-                      os.path.join(test_data_dir, 'aead', 'ocb.vec'),
-                      os.path.join(test_data_dir, 'modes', 'xts.vec'),
-                      os.path.join(test_data_dir, 'aead', 'chacha20poly1305.vec')]
+    vecfile_cfb = vecparser.VecDocument(os.path.join('src', 'tests', 'data', 'modes', 'cfb.vec'))
+    vecfile_gcm = vecparser.VecDocument(os.path.join('src', 'tests', 'data', 'aead', 'gcm.vec'))
+    vecfile_ocb = vecparser.VecDocument(os.path.join('src', 'tests', 'data', 'aead', 'ocb.vec'))
+    vecfile_xts = vecparser.VecDocument(os.path.join('src', 'tests', 'data', 'modes', 'xts.vec'))
+    vecfile_chacha20poly1305 = vecparser.VecDocument(os.path.join('src', 'tests', 'data', 'aead', 'chacha20poly1305.vec'))
+    #data = vecfile.get_data()
+    #for algo in data:
+    #    print(algo)
+    #    i = 0
+    #    for testcase in data[algo]:
+    #        i += 1
+    #        print(str(i) + ":", testcase)
 
     testdata = OrderedDict()
-
-    for f in mode_test_data:
-        vecfile = vecparser.VecDocument(f)
-        vecdata = get_testdata(vecfile.get_data(), max_tests)
-        for key in vecdata:
-            testdata[key] = vecdata[key]
-
+    append_ordered(testdata, get_testdata(vecfile_cfb.get_data(), max_tests))
+    append_ordered(testdata, get_testdata(vecfile_gcm.get_data(), max_tests))
+    append_ordered(testdata, get_testdata(vecfile_ocb.get_data(), max_tests))
+    append_ordered(testdata, get_testdata(vecfile_xts.get_data(), max_tests))
+    append_ordered(testdata, get_testdata(vecfile_chacha20poly1305.get_data(), max_tests))
+
+    #for testname in testdata:
+    #    print(testname)
+    #    for key in testdata[testname]:
+    #        print("    " + key + ": " + testdata[testname][key])
     for testname in testdata:
         test_method = create_test(testdata[testname])
         test_method.__name__ = 'test_%s' % testname
diff --git a/src/scripts/test_cli.py b/src/scripts/test_cli.py
index fcf5d5018..661b2dbcb 100755
--- a/src/scripts/test_cli.py
+++ b/src/scripts/test_cli.py
@@ -18,8 +18,6 @@ import re
 import random
 import json
 import binascii
-import multiprocessing
-from multiprocessing.pool import ThreadPool
 
 # pylint: disable=global-statement,unused-argument
 
@@ -1107,46 +1105,6 @@ def cli_tls_client_hello_tests(_tmp_dir):
     output_hash = "8EBFC3205ACFA98461128FE5D081D19254237AF84F7DAF000A3C992C3CF6DE44"
     test_cli("hash", ["--no-fsname", "--algo=SHA-256", "-"], output_hash, output)
 
-def cli_speed_pk_tests(_tmp_dir):
-    msec = 1
-
-    pk_algos = ["ECDSA", "ECDH", "SM2", "ECKCDSA", "ECGDSA", "GOST-34.10",
-                "DH", "DSA", "ElGamal", "Ed25519", "Curve25519", "NEWHOPE", "McEliece",
-                "RSA", "XMSS"]
-
-    output = test_cli("speed", ["--msec=%d" % (msec)] + pk_algos, None).split('\n')
-
-    # ECDSA-secp256r1 106 keygen/sec; 9.35 ms/op 37489733 cycles/op (1 op in 9 ms)
-    format_re = re.compile(r'^.* [0-9]+ ([A-Za-z ]+)/sec; [0-9]+\.[0-9]+ ms/op .*\([0-9]+ (op|ops) in [0-9\.]+ ms\)')
-    for line in output:
-        if format_re.match(line) is None:
-            logging.error("Unexpected line %s", line)
-
-def cli_speed_pbkdf_tests(_tmp_dir):
-    msec = 1
-    pbkdf_ops = ['bcrypt', 'passhash9', 'argon2']
-
-    format_re = re.compile(r'^.* [0-9]+ /sec; [0-9]+\.[0-9]+ ms/op .*\([0-9]+ (op|ops) in [0-9]+(\.[0-9]+)? ms\)')
-    for op in pbkdf_ops:
-        output = test_cli("speed", ["--msec=%d" % (msec), op], None).split('\n')
-        for line in output:
-            if format_re.match(line) is None:
-                logging.error("Unexpected line %s", line)
-
-def cli_speed_math_tests(_tmp_dir):
-    msec = 1
-    # these all have a common output format
-    math_ops = ['mp_mul', 'mp_div', 'mp_div10', 'modexp', 'random_prime', 'inverse_mod',
-                'rfc3394', 'fpe_fe1', 'ecdsa_recovery', 'ecc_init', 'poly_dbl',
-                'bn_redc', 'nistp_redc', 'ecc_mult', 'ecc_ops', 'os2ecp', 'primality_test']
-
-    format_re = re.compile(r'^.* [0-9]+ /sec; [0-9]+\.[0-9]+ ms/op .*\([0-9]+ (op|ops) in [0-9]+(\.[0-9]+)? ms\)')
-    for op in math_ops:
-        output = test_cli("speed", ["--msec=%d" % (msec), op], None).split('\n')
-        for line in output:
-            if format_re.match(line) is None:
-                logging.error("Unexpected line %s", line)
-
 def cli_speed_tests(_tmp_dir):
     # pylint: disable=too-many-branches
 
@@ -1179,6 +1137,31 @@ def cli_speed_tests(_tmp_dir):
             if format_re_cipher.match(line) is None:
                 logging.error('Unexpected line %s', line)
 
+    pk_algos = ["ECDSA", "ECDH", "SM2", "ECKCDSA", "ECGDSA", "GOST-34.10",
+                "DH", "DSA", "ElGamal", "Ed25519", "Curve25519", "NEWHOPE", "McEliece",
+                "RSA", "XMSS"]
+
+    output = test_cli("speed", ["--msec=%d" % (msec)] + pk_algos, None).split('\n')
+
+    # ECDSA-secp256r1 106 keygen/sec; 9.35 ms/op 37489733 cycles/op (1 op in 9 ms)
+    format_re = re.compile(r'^.* [0-9]+ ([A-Za-z ]+)/sec; [0-9]+\.[0-9]+ ms/op .*\([0-9]+ (op|ops) in [0-9\.]+ ms\)')
+    for line in output:
+        if format_re.match(line) is None:
+            logging.error("Unexpected line %s", line)
+
+    # these all have a common output format
+    math_ops = ['mp_mul', 'mp_div', 'mp_div10', 'modexp', 'random_prime', 'inverse_mod',
+                'rfc3394', 'fpe_fe1', 'ecdsa_recovery', 'ecc_init', 'poly_dbl',
+                'bn_redc', 'nistp_redc', 'ecc_mult', 'ecc_ops', 'os2ecp', 'primality_test',
+                'bcrypt', 'passhash9', 'argon2']
+
+    format_re = re.compile(r'^.* [0-9]+ /sec; [0-9]+\.[0-9]+ ms/op .*\([0-9]+ (op|ops) in [0-9]+(\.[0-9]+)? ms\)')
+    for op in math_ops:
+        output = test_cli("speed", ["--msec=%d" % (msec), op], None).split('\n')
+        for line in output:
+            if format_re.match(line) is None:
+                logging.error("Unexpected line %s", line)
+
     output = test_cli("speed", ["--msec=%d" % (msec), "scrypt"], None).split('\n')
 
     format_re = re.compile(r'^scrypt-[0-9]+-[0-9]+-[0-9]+ \([0-9]+ MiB\) [0-9]+ /sec; [0-9]+\.[0-9]+ ms/op .*\([0-9]+ (op|ops) in [0-9\.]+ ms\)')
@@ -1213,20 +1196,8 @@ def cli_speed_tests(_tmp_dir):
             if field not in b:
                 logging.error('Missing field %s in JSON record %s' % (field, b))
 
-def run_test(fn_name, fn):
-    start = time.time()
-    tmp_dir = tempfile.mkdtemp(prefix='botan_cli_')
-    try:
-        fn(tmp_dir)
-    except Exception as e: # pylint: disable=broad-except
-        logging.error("Test %s threw exception: %s", fn_name, e)
-
-    shutil.rmtree(tmp_dir)
-    end = time.time()
-    logging.info("Ran %s in %.02f sec", fn_name, end-start)
 
 def main(args=None):
-    # pylint: disable=too-many-branches
     if args is None:
         args = sys.argv
 
@@ -1235,24 +1206,19 @@ def main(args=None):
 
     parser.add_option('--verbose', action='store_true', default=False)
     parser.add_option('--quiet', action='store_true', default=False)
-    parser.add_option('--threads', action='store', type='int', default=0)
 
     (options, args) = parser.parse_args(args)
 
     setup_logging(options)
 
     if len(args) < 2:
-        logging.error("Usage: %s path_to_botan_cli [test_regex]", args[0])
+        logging.error("Usage: ./cli_tests.py path_to_botan_cli [test_regex]")
         return 1
 
     if not os.access(args[1], os.X_OK):
         logging.error("Could not access/execute %s", args[1])
         return 2
 
-    threads = options.threads
-    if threads == 0:
-        threads = multiprocessing.cpu_count()
-
     global CLI_PATH
     CLI_PATH = args[1]
 
@@ -1264,14 +1230,9 @@ def main(args=None):
             logging.error("Invalid regex: %s", str(e))
             return 1
 
-    # some of the slowest tests are grouped up front
-    test_fns = [
-        cli_speed_tests,
-        cli_speed_pk_tests,
-        cli_speed_math_tests,
-        cli_speed_pbkdf_tests,
-        cli_xmss_sign_tests,
+    start_time = time.time()
 
+    test_fns = [
         cli_argon2_tests,
         cli_asn1_tests,
         cli_base32_tests,
@@ -1295,6 +1256,7 @@ def main(args=None):
         cli_hmac_tests,
         cli_is_prime_tests,
         cli_key_tests,
+        cli_xmss_sign_tests,
         cli_mod_inverse_tests,
         cli_pbkdf_tune_tests,
         cli_pk_encrypt_tests,
@@ -1303,6 +1265,7 @@ def main(args=None):
         cli_rng_tests,
         cli_roughtime_check_tests,
         cli_roughtime_tests,
+        cli_speed_tests,
         cli_timing_test_tests,
         cli_tls_ciphersuite_tests,
         cli_tls_client_hello_tests,
@@ -1315,26 +1278,25 @@ def main(args=None):
         cli_version_tests,
         ]
 
-    tests_to_run = []
     for fn in test_fns:
         fn_name = fn.__name__
 
-        if test_regex is None or test_regex.search(fn_name) is not None:
-            tests_to_run.append((fn_name, fn))
+        if test_regex is not None:
+            if test_regex.search(fn_name) is None:
+                continue
 
-    start_time = time.time()
+        logging.info("Running %s" % (fn_name))
 
-    if threads > 1:
-        pool = ThreadPool(processes=threads)
-        results = []
-        for test in tests_to_run:
-            results.append(pool.apply_async(run_test, test))
+        start = time.time()
+        tmp_dir = tempfile.mkdtemp(prefix='botan_cli_')
+        try:
+            fn(tmp_dir)
+        except Exception as e: # pylint: disable=broad-except
+            logging.error("Test %s threw exception: %s", fn_name, e)
 
-        for result in results:
-            result.get()
-    else:
-        for test in tests_to_run:
-            run_test(test[0], test[1])
+        shutil.rmtree(tmp_dir)
+        end = time.time()
+        logging.debug("Ran %s in %.02f sec", fn_name, end-start)
 
     end_time = time.time()
 
diff --git a/src/scripts/test_python.py b/src/scripts/test_python.py
index 73cb29258..60cb80ec5 100644
--- a/src/scripts/test_python.py
+++ b/src/scripts/test_python.py
@@ -17,7 +17,7 @@ def hex_decode(buf):
     return binascii.unhexlify(buf.encode('ascii'))
 
 class BotanPythonTests(unittest.TestCase):
-    # pylint: disable=too-many-public-methods,too-many-locals
+    # pylint: disable=too-many-public-methods
 
     def test_version(self):
         version_str = botan2.version_string()
@@ -442,7 +442,6 @@ ofvkP1EDmpx50fHLawIDAQAB
             self.assertEqual(a_pem, new_a.to_pem())
 
     def test_certs(self):
-        # pylint: disable=too-many-statements
         cert = botan2.X509Cert(filename="src/tests/data/x509/ecc/CSCA.CSCA.csca-germany.1.crt")
         pubkey = cert.subject_public_key()
 
@@ -499,30 +498,8 @@ ofvkP1EDmpx50fHLawIDAQAB
         self.assertEqual(botan2.X509Cert.validation_status(3000), 'Certificate issuer not found')
         self.assertEqual(botan2.X509Cert.validation_status(4008), 'Certificate does not match provided name')
 
-        rootcrl = botan2.X509CRL("src/tests/data/x509/nist/root.crl")
-
-        end01 = botan2.X509Cert("src/tests/data/x509/nist/test01/end.crt")
-        self.assertEqual(end01.verify([], [root], required_strength=80, crls=[rootcrl]), 0)
-
-        int20 = botan2.X509Cert("src/tests/data/x509/nist/test20/int.crt")
-        end20 = botan2.X509Cert("src/tests/data/x509/nist/test20/end.crt")
-        int20crl = botan2.X509CRL("src/tests/data/x509/nist/test20/int.crl")
-
-        self.assertEqual(end20.verify([int20], [root], required_strength=80, crls=[int20crl, rootcrl]), 5000)
-        self.assertEqual(botan2.X509Cert.validation_status(5000), 'Certificate is revoked')
-
-        int21 = botan2.X509Cert("src/tests/data/x509/nist/test21/int.crt")
-        end21 = botan2.X509Cert("src/tests/data/x509/nist/test21/end.crt")
-        int21crl = botan2.X509CRL("src/tests/data/x509/nist/test21/int.crl")
-        self.assertEqual(end21.verify([int21], [root], required_strength=80, crls=[int21crl, rootcrl]), 5000)
-
-        self.assertTrue(int20.is_revoked(rootcrl))
-        self.assertFalse(int04_1.is_revoked(rootcrl))
-        self.assertTrue(end21.is_revoked(int21crl))
-
-
     def test_mpi(self):
-        # pylint: disable=too-many-statements,too-many-locals
+        # pylint: disable=too-many-statements
         z = botan2.MPI()
         self.assertEqual(z.bit_count(), 0)
         five = botan2.MPI('5')
@@ -530,13 +507,11 @@ ofvkP1EDmpx50fHLawIDAQAB
         big = botan2.MPI('0x85839682368923476892367235')
         self.assertEqual(big.bit_count(), 104)
         small = botan2.MPI(0xDEADBEEF)
-        radix = botan2.MPI("DEADBEEF", 16)
 
         self.assertEqual(hex_encode(small.to_bytes()), "deadbeef")
         self.assertEqual(hex_encode(big.to_bytes()), "85839682368923476892367235")
 
         self.assertEqual(int(small), 0xDEADBEEF)
-        self.assertEqual(int(radix), int(small))
 
         self.assertEqual(int(small >> 16), 0xDEAD)
 
@@ -602,20 +577,6 @@ ofvkP1EDmpx50fHLawIDAQAB
         p = inv.pow_mod(botan2.MPI(46), mod)
         self.assertEqual(int(p), 42)
 
-        one = botan2.MPI(1)
-        twelve = botan2.MPI("C", 16)
-        eight = botan2.MPI(8)
-
-        mul = twelve.mod_mul(eight, inv)
-        self.assertEqual(int(mul), 27)
-
-        gcd = one.gcd(one)
-        self.assertEqual(one, gcd)
-        gcd = one.gcd(twelve)
-        self.assertEqual(one, gcd)
-        gcd = twelve.gcd(eight)
-        self.assertEqual(4, int(gcd))
-
     def test_mpi_random(self):
         rng = botan2.RandomNumberGenerator()
 
diff --git a/src/tests/main.cpp b/src/tests/main.cpp
index 6f511bcf2..d6815bd31 100644
--- a/src/tests/main.cpp
+++ b/src/tests/main.cpp
@@ -111,7 +111,7 @@ int main(int argc, char* argv[])
 
       int rc = tests.run(opts);
 
-#if defined(BOTAN_HAS_OPENSSL) && defined(OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER < 0x01010000)
+#if defined(BOTAN_HAS_OPENSSL)
       if(opts.provider().empty() || opts.provider() == "openssl")
          {
          ERR_free_strings();
diff --git a/src/tests/test_ffi.cpp b/src/tests/test_ffi.cpp
index 4baf3983c..03974589d 100644
--- a/src/tests/test_ffi.cpp
+++ b/src/tests/test_ffi.cpp
@@ -61,7 +61,6 @@ class FFI_Unit_Tests final : public Test
          results.push_back(ffi_test_mp(rng));
          results.push_back(ffi_test_pkcs_hash_id());
          results.push_back(ffi_test_cert_validation());
-         results.push_back(ffi_test_crl());
 
 #if defined(BOTAN_HAS_AES)
          results.push_back(ffi_test_block_ciphers());
@@ -281,55 +280,6 @@ class FFI_Unit_Tests final : public Test
          return result;
          }
 
-
-      Test::Result ffi_test_crl()
-         {
-         Test::Result result("FFI CRL");
-
-#if defined(BOTAN_HAS_X509_CERTIFICATES)
-         
-         const char *crl_string = "-----BEGIN X509 CRL-----\n"
-                                 "MIICoTCCAQkCAQEwDQYJKoZIhvcNAQELBQAwgZQxLTArBgNVBAMTJFVzYWJsZSBj\n"
-                                 "ZXJ0IHZhbGlkYXRpb246IFRlbXBvcmFyeSBDQTE5MDcGA1UECxMwQ2VudHJlIGZv\n"
-                                 "ciBSZXNlYXJjaCBvbiBDcnlwdG9ncmFwaHkgYW5kIFNlY3VyaXR5MRswGQYDVQQK\n"
-                                 "ExJNYXNhcnlrIFVuaXZlcnNpdHkxCzAJBgNVBAYTAkNaGA8yMDUwMDIyNTE1MjE0\n"
-                                 "MloYDzIwNTAwMjI1MTUyNDQxWjAAoDowODAfBgNVHSMEGDAWgBRKzxAvI4+rVVo/\n"
-                                 "JzLigRznREyB+TAVBgNVHRQEDgIMXcr16yNys/gjeuCFMA0GCSqGSIb3DQEBCwUA\n"
-                                 "A4IBgQCfxv/5REM/KUnzeVycph3dJr1Yrtxhc6pZmQ9pMzSW/nawLN3rUHm5oG44\n"
-                                 "ZuQgjvzE4PnbU0/DNRu/4w3H58kgrctJHHXbbvkU3lf2ZZLh2wBl+EUh92+/COow\n"
-                                 "ZyGB+jqj/XwB99hYUhrY6NLEWRz08kpgG6dnNMEU0uFqdQKWk0CQPnmgPRgDb8BW\n"
-                                 "IuMBcjY7aF9XoCZFOqPYdEvUKzAo4QGCf7uJ7fNGS3LqvjaLjAHJseSr5/yR7Q9r\n"
-                                 "nEdI38yKPbRj0tNHe7j+BbYg31C+X+AZZKJtlTg8GxYR3qfQio1kDgpZ3rQLzHY3\n"
-                                 "ea2MLX/Kdx9cPSwh4KwlcDxQmQKoELb4EnZW1CScSBHi9HQyCBNyCkgkOBMGcJqz\n"
-                                 "Ihq1dGeSf8eca9+Avk5kAQ3yjXK1TI2CDEi0msrXLr9XbgowXiOLLzR+rYkhQz+V\n"
-                                 "RnIoBwjnrGoJoz636KS170SZCB9ARNs17WE4IvbJdZrTXNOGaVZCQUUpiLRj4ZSO\n"
-                                 "Na/nobI=\n"
-                                 "-----END X509 CRL-----";
-         
-         botan_x509_crl_t bytecrl;
-         REQUIRE_FFI_OK(botan_x509_crl_load, (&bytecrl, (const uint8_t*)crl_string, 966));
-
-         botan_x509_crl_t crl;
-         REQUIRE_FFI_OK(botan_x509_crl_load_file, (&crl, Test::data_file("x509/nist/root.crl").c_str()));
-         
-         botan_x509_cert_t cert1;
-         REQUIRE_FFI_OK(botan_x509_cert_load_file, (&cert1, Test::data_file("x509/nist/test01/end.crt").c_str()));
-         TEST_FFI_RC(-1, botan_x509_is_revoked, (crl, cert1));
-         TEST_FFI_OK(botan_x509_cert_destroy, (cert1));
-            
-         botan_x509_cert_t cert2;
-         REQUIRE_FFI_OK(botan_x509_cert_load_file, (&cert2, Test::data_file("x509/nist/test20/int.crt").c_str()));
-         TEST_FFI_RC(0, botan_x509_is_revoked, (crl, cert2));
-         TEST_FFI_RC(-1, botan_x509_is_revoked, (bytecrl, cert2));
-         TEST_FFI_OK(botan_x509_cert_destroy, (cert2));
-
-         TEST_FFI_OK(botan_x509_crl_destroy, (crl));
-         TEST_FFI_OK(botan_x509_crl_destroy, (bytecrl));
-#endif
-         return result;
-         }
-
-
       Test::Result ffi_test_cert_validation()
          {
          Test::Result result("FFI Cert validation");
@@ -368,38 +318,11 @@ class FFI_Unit_Tests final : public Test
          result.confirm("Validation passed", rc == 0);
          result.test_eq("Validation status string", botan_x509_cert_validation_status(rc), "Verified");
 
-         TEST_FFI_RC(1, botan_x509_cert_verify_with_crl, (&rc, end7, subs, 2, nullptr, 0, nullptr, 0, "x509/farce", 0, nullptr, 0));
-         result.confirm("Validation failed", rc == 3000);
-         result.test_eq("Validation status string", botan_x509_cert_validation_status(rc), "Certificate issuer not found");
-
-         botan_x509_crl_t rootcrl;
-
-         REQUIRE_FFI_OK(botan_x509_crl_load_file, (&rootcrl, Test::data_file("x509/nist/root.crl").c_str()));
-         TEST_FFI_RC(0, botan_x509_cert_verify_with_crl, (&rc, end7, subs, 2, &root, 1, &rootcrl, 1, nullptr, 80, nullptr, 0));
-         result.confirm("Validation passed", rc == 0);
-         result.test_eq("Validation status string", botan_x509_cert_validation_status(rc), "Verified");
-
-         botan_x509_cert_t end20;
-         botan_x509_cert_t sub20;
-         botan_x509_crl_t sub20crl;
-         REQUIRE_FFI_OK(botan_x509_cert_load_file, (&end20, Test::data_file("x509/nist/test20/end.crt").c_str()));
-         REQUIRE_FFI_OK(botan_x509_cert_load_file, (&sub20, Test::data_file("x509/nist/test20/int.crt").c_str()));
-         REQUIRE_FFI_OK(botan_x509_crl_load_file, (&sub20crl, Test::data_file("x509/nist/test20/int.crl").c_str()));
-         botan_x509_crl_t crls[2] = {sub20crl, rootcrl};
-         TEST_FFI_RC(1, botan_x509_cert_verify_with_crl, (&rc, end20, &sub20, 1, &root, 1, crls, 2, nullptr, 80, nullptr, 0));
-         result.confirm("Validation failed", rc == 5000);
-         result.test_eq("Validation status string", botan_x509_cert_validation_status(rc),
-                        "Certificate is revoked");
-         
          TEST_FFI_OK(botan_x509_cert_destroy, (end2));
          TEST_FFI_OK(botan_x509_cert_destroy, (sub2));
          TEST_FFI_OK(botan_x509_cert_destroy, (end7));
          TEST_FFI_OK(botan_x509_cert_destroy, (sub7));
-         TEST_FFI_OK(botan_x509_cert_destroy, (end20));
-         TEST_FFI_OK(botan_x509_cert_destroy, (sub20));
-         TEST_FFI_OK(botan_x509_crl_destroy, (sub20crl));
          TEST_FFI_OK(botan_x509_cert_destroy, (root));
-         TEST_FFI_OK(botan_x509_crl_destroy, (rootcrl));
 
 #endif
          return result;
diff --git a/src/tests/test_gf2m.cpp b/src/tests/test_gf2m.cpp
index 6c56438b9..af2798352 100644
--- a/src/tests/test_gf2m.cpp
+++ b/src/tests/test_gf2m.cpp
@@ -37,7 +37,7 @@ class GF2m_Tests final : public Test
          * This is testing one specific case where an overflow
          * occurred. It should be extended to test more of the interface.
          */
-         for(size_t degree = 2; degree <= 15; ++degree)
+         for(size_t degree = 2; degree <= 16; ++degree)
             {
             Botan::GF2m_Field field(degree);
 
diff --git a/src/tests/test_ocsp.cpp b/src/tests/test_ocsp.cpp
index 94da76c95..5ccebdb41 100644
--- a/src/tests/test_ocsp.cpp
+++ b/src/tests/test_ocsp.cpp
@@ -151,7 +151,7 @@ class OCSP_Tests final : public Test
             return result.test_eq("Expected size of ocsp_status", ocsp_status.size(), 1) &&
                    result.test_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1) &&
                    result.confirm(std::string("Status: '") + Botan::to_string(expected) + "'",
-                                  ocsp_status[0].count(expected) > 0);
+                                  ocsp_status[0].count(expected));
             };
 
          check_ocsp(Botan::calendar_point(2016, 11, 11, 12, 30, 0).to_std_timepoint(),
@@ -192,7 +192,7 @@ class OCSP_Tests final : public Test
             return result.test_eq("Expected size of ocsp_status", ocsp_status.size(), 1) &&
                    result.test_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1) &&
                    result.confirm(std::string("Status: '") + Botan::to_string(expected) + "'",
-                                  ocsp_status[0].count(expected) > 0);
+                                  ocsp_status[0].count(expected));
             };
 
          check_ocsp(Botan::calendar_point(2016, 11, 11, 12, 30, 0).to_std_timepoint(),
@@ -233,7 +233,7 @@ class OCSP_Tests final : public Test
             return result.test_eq("Expected size of ocsp_status", ocsp_status.size(), 1) &&
                    result.test_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1) &&
                    result.confirm(std::string("Status: '") + Botan::to_string(expected) + "'",
-                                  ocsp_status[0].count(expected) > 0);
+                                  ocsp_status[0].count(expected));
             };
 
          check_ocsp(Botan::calendar_point(2019, 5, 28, 7, 0, 0).to_std_timepoint(),
@@ -269,7 +269,7 @@ class OCSP_Tests final : public Test
             return result.test_eq("Expected size of ocsp_status", ocsp_status.size(), 1) &&
                    result.test_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1) &&
                    result.confirm(std::string("Status: '") + Botan::to_string(expected) + "'",
-                                  ocsp_status[0].count(expected) > 0);
+                                  ocsp_status[0].count(expected));
             };
 
          check_ocsp(Botan::calendar_point(2019, 5, 28, 7, 0, 0).to_std_timepoint(),
@@ -306,7 +306,7 @@ class OCSP_Tests final : public Test
             {
             if(result.test_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1))
                {
-               result.confirm("Status warning", ocsp_status[0].count(Botan::Certificate_Status_Code::OCSP_NO_REVOCATION_URL) > 0);
+               result.confirm("Status warning", ocsp_status[0].count(Botan::Certificate_Status_Code::OCSP_NO_REVOCATION_URL));
                }
             }
 
@@ -335,7 +335,7 @@ class OCSP_Tests final : public Test
             {
             if(result.test_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1))
                {
-               result.confirm("Status ok", ocsp_status[0].count(Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD) > 0);
+               result.confirm("Status ok", ocsp_status[0].count(Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD));
                }
             }
 
diff --git a/src/tests/test_os_utils.cpp b/src/tests/test_os_utils.cpp
index 997e6208a..1ed90d8a3 100644
--- a/src/tests/test_os_utils.cpp
+++ b/src/tests/test_os_utils.cpp
@@ -99,7 +99,7 @@ class OS_Utils_Tests final : public Test
 
          // TODO better tests
          const uint64_t hr_ts1 = Botan::OS::get_high_resolution_clock();
-         result.confirm("high resolution timestamp value is never zero", hr_ts1 != 0);
+         result.test_ne("high resolution timestamp value is never zero", hr_ts1, 0);
 
          size_t counts = 0;
          while(counts < max_trials && (Botan::OS::get_high_resolution_clock() == hr_ts1))
@@ -128,7 +128,7 @@ class OS_Utils_Tests final : public Test
          Test::Result result("OS::get_system_timestamp_ns");
 
          uint64_t sys_ts1 = Botan::OS::get_system_timestamp_ns();
-         result.confirm("System timestamp value is never zero", sys_ts1 != 0);
+         result.test_ne("System timestamp value is never zero", sys_ts1, 0);
 
          // do something that consumes a little time
          Botan::OS::get_process_id();
@@ -155,7 +155,7 @@ class OS_Utils_Tests final : public Test
 
          // OS::run_cpu_instruction_probe only implemented for Unix signals or Windows SEH
 
-         std::function<int ()> ok_fn = []() noexcept -> int { return 5; };
+         std::function<int ()> ok_fn = []() -> int { return 5; };
          const int run_rc = Botan::OS::run_cpu_instruction_probe(ok_fn);
 
          if(run_rc == -3)
@@ -169,17 +169,17 @@ class OS_Utils_Tests final : public Test
          std::function<int ()> crash_probe;
 
 #if defined(BOTAN_TARGET_COMPILER_IS_MSVC)
-         crash_probe = []() noexcept -> int { __ud2(); return 3; };
+         crash_probe = []() -> int { __ud2(); return 3; };
 
 #elif defined(BOTAN_USE_GCC_INLINE_ASM)
 
 #if defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
-         crash_probe = []() noexcept -> int { asm volatile("ud2"); return 3; };
+         crash_probe = []() -> int { asm volatile("ud2"); return 3; };
 
 #elif defined(BOTAN_TARGET_CPU_IS_ARM_FAMILY)
          //ARM: asm volatile (".word 0xf7f0a000\n");
          // illegal instruction in both ARM and Thumb modes
-         crash_probe = []() noexcept -> int { asm volatile(".word 0xe7f0def0\n"); return 3; };
+         crash_probe = []() -> int { asm volatile(".word 0xe7f0def0\n"); return 3; };
 
 #else
          /*
diff --git a/src/tests/test_passhash.cpp b/src/tests/test_passhash.cpp
index 32d6f60a4..0b39e7ffc 100644
--- a/src/tests/test_passhash.cpp
+++ b/src/tests/test_passhash.cpp
@@ -102,7 +102,7 @@ class Argon2_Tests final : public Text_Based_Test
          else if(header == "Generate")
             {
             const std::vector<uint8_t> salt = vars.get_req_bin("Salt");
-            const uint8_t y = vars.get_req_u8("Mode");
+            const size_t y = vars.get_req_sz("Mode");
             const size_t M = vars.get_req_sz("M");
             const size_t t = vars.get_req_sz("T");
             const size_t p = vars.get_req_sz("P");
diff --git a/src/tests/test_pkcs11_low_level.cpp b/src/tests/test_pkcs11_low_level.cpp
index 7934fb3cd..6cf3dcdd0 100644
--- a/src/tests/test_pkcs11_low_level.cpp
+++ b/src/tests/test_pkcs11_low_level.cpp
@@ -307,11 +307,8 @@ Test::Result test_c_get_slot_list()
    // assumes at least one smartcard reader is attached
    bool token_present = false;
 
-   auto binder = std::bind(static_cast< bool (LowLevel::*)(bool, std::vector<SlotId>&, ReturnValue*) const>(&LowLevel::C_GetSlotList),
-                           *p11_low_level.get(),
-                           std::ref(token_present),
-                           std::ref(slot_vec),
-                           std::placeholders::_1);
+   auto binder = std::bind(static_cast< bool (LowLevel::*)(bool, std::vector<SlotId>&, ReturnValue*) const>
+                           (&LowLevel::C_GetSlotList), *p11_low_level.get(), std::ref(token_present), std::ref(slot_vec), std::placeholders::_1);
 
    Test::Result result = test_function("C_GetSlotList", binder);
    result.test_ne("C_GetSlotList number of slots without attached token > 0", slot_vec.size(), 0);
@@ -619,16 +616,15 @@ std::array<Attribute, 4> dtemplate =
       {
          { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Class), &object_class, sizeof(object_class) },
          { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Token), &btrue, sizeof(btrue) },
-         { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Label), const_cast<char*>(label.c_str()), static_cast<CK_ULONG>(label.size()) },
-         { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Value), const_cast<char*>(data.c_str()), static_cast<CK_ULONG>(data.size()) }
+         { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Label), const_cast< char* >(label.c_str()), label.size() },
+         { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Value), const_cast< char* >(data.c_str()), data.size() }
       }
    };
 
 ObjectHandle create_simple_data_object(const RAII_LowLevel& p11_low_level)
    {
    ObjectHandle object_handle;
-   p11_low_level.get()->C_CreateObject(p11_low_level.get_session_handle(),
-                                       dtemplate.data(), static_cast<Ulong>(dtemplate.size()),
+   p11_low_level.get()->C_CreateObject(p11_low_level.get_session_handle(), dtemplate.data(), dtemplate.size(),
                                        &object_handle);
    return object_handle;
    }
@@ -641,8 +637,7 @@ Test::Result test_c_create_object_c_destroy_object()
    ObjectHandle object_handle(0);
 
    auto create_bind = std::bind(&LowLevel::C_CreateObject, *p11_low_level.get(),
-                                session_handle, dtemplate.data(), static_cast<Ulong>(dtemplate.size()),
-                                &object_handle, std::placeholders::_1);
+                                session_handle, dtemplate.data(), dtemplate.size(), &object_handle, std::placeholders::_1);
 
    auto destroy_bind = std::bind(&LowLevel::C_DestroyObject, *p11_low_level.get(), session_handle,
                                  std::ref(object_handle), std::placeholders::_1);
@@ -771,9 +766,7 @@ Test::Result test_c_copy_object()
 
    std::string copied_label = "A copied data object";
 
-   Attribute copy_attribute_values = {
-      static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Label), const_cast<char*>(copied_label.c_str()), static_cast<CK_ULONG>(copied_label.size())
-   };
+   Attribute copy_attribute_values = { static_cast< CK_ATTRIBUTE_TYPE >(AttributeType::Label), const_cast< char* >(copied_label.c_str()), copied_label.size() };
 
    auto binder = std::bind(&LowLevel::C_CopyObject, *p11_low_level.get(), session_handle, object_handle,
                            &copy_attribute_values, 1, &copied_object_handle, std::placeholders::_1);
diff --git a/src/tests/test_simd.cpp b/src/tests/test_simd.cpp
index b381012bd..91cef75d0 100644
--- a/src/tests/test_simd.cpp
+++ b/src/tests/test_simd.cpp
@@ -36,13 +36,6 @@ class SIMD_32_Tests final : public Test
          const uint32_t pat3 = 0x01234567;
          const uint32_t pat4 = 0xC0D0E0F0;
 
-         // pat1 + pat{1,2,3,4}
-         // precomputed to avoid integer overflow warnings
-         const uint32_t pat1_1 = 0x557799BA;
-         const uint32_t pat1_2 = 0x32210FFE;
-         const uint32_t pat1_3 = 0xABDF1244;
-         const uint32_t pat1_4 = 0x6B8CADCD;
-
          test_eq(result, "default init", Botan::SIMD_4x32(), 0, 0, 0, 0);
          test_eq(result, "SIMD scalar constructor", Botan::SIMD_4x32(1, 2, 3, 4), 1, 2, 3, 4);
 
@@ -69,13 +62,13 @@ class SIMD_32_Tests final : public Test
                  Botan::rotr<9>(pat4));
 
          Botan::SIMD_4x32 add = input + splat;
-         test_eq(result, "add +", add, pat1_1, pat1_2, pat1_3, pat1_4);
+         test_eq(result, "add +", add, pat1 + pat1, pat2 + pat1, pat3 + pat1, pat4 + pat1);
 
          add -= splat;
          test_eq(result, "sub -=", add, pat1, pat2, pat3, pat4);
 
          add += splat;
-         test_eq(result, "add +=", add, pat1_1, pat1_2, pat1_3, pat1_4);
+         test_eq(result, "add +=", add, pat1 + pat1, pat2 + pat1, pat3 + pat1, pat4 + pat1);
 
          test_eq(result, "xor", input ^ splat, 0, pat2 ^ pat1, pat3 ^ pat1, pat4 ^ pat1);
          test_eq(result, "or", input | splat, pat1, pat2 | pat1, pat3 | pat1, pat4 | pat1);
diff --git a/src/tests/tests.cpp b/src/tests/tests.cpp
index 5eaf911a3..5a3379cee 100644
--- a/src/tests/tests.cpp
+++ b/src/tests/tests.cpp
@@ -568,7 +568,7 @@ std::vector<uint8_t> Test::read_binary_data_file(const std::string& path)
       {
       std::vector<uint8_t> buf(4096);
       file.read(reinterpret_cast<char*>(buf.data()), buf.size());
-      const size_t got = static_cast<size_t>(file.gcount());
+      size_t got = file.gcount();
 
       if(got == 0 && file.eof())
          {
diff --git a/src/tests/unit_ecc.cpp b/src/tests/unit_ecc.cpp
index 459d6a594..14236d8ae 100644
--- a/src/tests/unit_ecc.cpp
+++ b/src/tests/unit_ecc.cpp
@@ -52,7 +52,7 @@ Botan::BigInt test_integer(Botan::RandomNumberGenerator& rng, size_t bits, BigIn
                        return .01;
                        };
 
-   bool active = (rng.next_byte() > 128) ? true : false;
+   bool active = rng.next_byte() % 2;
    for(size_t i = 0; i != bits; ++i)
       {
       x <<= 1;
diff --git a/src/tests/unit_ecdsa.cpp b/src/tests/unit_ecdsa.cpp
index 23d03768a..a103e67b0 100644
--- a/src/tests/unit_ecdsa.cpp
+++ b/src/tests/unit_ecdsa.cpp
@@ -215,7 +215,7 @@ Test::Result test_ecdsa_create_save_load()
    Botan::DataSource_Memory pem_src(ecc_private_key_pem);
    std::unique_ptr<Botan::Private_Key> loaded_key(Botan::PKCS8::load_key(pem_src, Test::rng()));
    Botan::ECDSA_PrivateKey* loaded_ec_key = dynamic_cast<Botan::ECDSA_PrivateKey*>(loaded_key.get());
-   result.confirm("the loaded key could be converted into an ECDSA_PrivateKey", loaded_ec_key != nullptr);
+   result.confirm("the loaded key could be converted into an ECDSA_PrivateKey", loaded_ec_key);
 
    if(loaded_ec_key)
       {
@@ -257,7 +257,7 @@ Test::Result test_unusual_curve()
    Botan::DataSource_Memory key_data_src(key_odd_curve_str);
    std::unique_ptr<Botan::Private_Key> loaded_key(Botan::PKCS8::load_key(key_data_src, Test::rng()));
 
-   result.confirm("reloaded key", loaded_key.get() != nullptr);
+   result.confirm("reloaded key", loaded_key.get());
 
    return result;
    }
@@ -365,9 +365,9 @@ Test::Result test_ecc_key_with_rfc5915_extensions()
       std::unique_ptr<Botan::Private_Key> pkcs8(
          Botan::PKCS8::load_key(Test::data_file("x509/ecc/ecc_private_with_rfc5915_ext.pem"), Test::rng()));
 
-      result.confirm("loaded RFC 5915 key", pkcs8.get() != nullptr);
+      result.confirm("loaded RFC 5915 key", pkcs8.get());
       result.test_eq("key is ECDSA", pkcs8->algo_name(), "ECDSA");
-      result.confirm("key type is ECDSA", dynamic_cast<Botan::ECDSA_PrivateKey*>(pkcs8.get()) != nullptr);
+      result.confirm("key type is ECDSA", dynamic_cast<Botan::ECDSA_PrivateKey*>(pkcs8.get()));
       }
    catch(std::exception& e)
       {
@@ -386,9 +386,9 @@ Test::Result test_ecc_key_with_rfc5915_parameters()
       std::unique_ptr<Botan::Private_Key> pkcs8(
          Botan::PKCS8::load_key(Test::data_file("x509/ecc/ecc_private_with_rfc5915_parameters.pem"), Test::rng()));
 
-      result.confirm("loaded RFC 5915 key", pkcs8.get() != nullptr);
+      result.confirm("loaded RFC 5915 key", pkcs8.get());
       result.test_eq("key is ECDSA", pkcs8->algo_name(), "ECDSA");
-      result.confirm("key type is ECDSA", dynamic_cast<Botan::ECDSA_PrivateKey*>(pkcs8.get()) != nullptr);
+      result.confirm("key type is ECDSA", dynamic_cast<Botan::ECDSA_PrivateKey*>(pkcs8.get()));
       }
    catch(std::exception& e)
       {
diff --git a/src/tests/unit_tls.cpp b/src/tests/unit_tls.cpp
index 527d797d7..9c14ff5f1 100644
--- a/src/tests/unit_tls.cpp
+++ b/src/tests/unit_tls.cpp
@@ -32,10 +32,6 @@
       #include <botan/dsa.h>
    #endif
 
-   #if defined(BOTAN_HAS_SRP6)
-      #include <botan/srp6.h>
-   #endif
-
    #if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
       #include <botan/tls_session_manager_sqlite.h>
    #endif
@@ -301,88 +297,6 @@ create_creds(Botan::RandomNumberGenerator& rng,
    return cmt;
    }
 
-#if defined(BOTAN_HAS_SRP6)
-Botan::Credentials_Manager*
-create_srp6_creds(Botan::RandomNumberGenerator& rng)
-   {
-   class Credentials_Manager_SRP6 : public Botan::Credentials_Manager
-      {
-      public:
-         Credentials_Manager_SRP6(Botan::RandomNumberGenerator& rng)
-            {
-            m_group_id = "modp/srp/1024";
-            m_username = "srp6_username";
-            m_password = "srp6_password";
-            m_salt.resize(16);
-            rng.randomize(m_salt.data(), m_salt.size());
-
-            m_verifier = Botan::generate_srp6_verifier(m_username,
-                                                       m_password,
-                                                       m_salt,
-                                                       m_group_id,
-                                                       "SHA-1");
-            }
-
-         bool attempt_srp(const std::string& /*type*/,
-                          const std::string& /*context*/) override
-            {
-            return true;
-            }
-
-         std::string srp_identifier(const std::string& /*type*/,
-                                    const std::string& /*context*/) override
-            {
-            return m_username;
-            }
-
-         std::string srp_password(const std::string& /*type*/,
-                                  const std::string& /*context*/,
-                                  const std::string& identifier) override
-            {
-            if(identifier == m_username)
-               return m_password;
-            return "";
-            }
-
-         bool srp_verifier(const std::string& /*type*/,
-                           const std::string& /*context*/,
-                           const std::string& identifier,
-                           std::string& group_name,
-                           Botan::BigInt& verifier,
-                           std::vector<uint8_t>& salt,
-                           bool generate_fake_on_unknown) override
-            {
-            // FIXME test generate_fake_on_unknown behavior
-            if(identifier == m_username)
-               {
-               group_name = m_group_id;
-               verifier = m_verifier;
-               salt = m_salt;
-               return true;
-               }
-            else if(generate_fake_on_unknown)
-               {
-               group_name = m_group_id;
-               verifier = m_verifier + 1;
-               salt = m_salt;
-               return true;
-               }
-            else
-               return false;
-            }
-
-         std::string m_username;
-         std::string m_password;
-         std::vector<uint8_t> m_salt;
-         std::string m_group_id;
-         Botan::BigInt m_verifier;
-      };
-
-   return new Credentials_Manager_SRP6(rng);
-   }
-#endif
-
-
 class TLS_Handshake_Test final
    {
    public:
@@ -847,7 +761,7 @@ class TLS_Unit_Tests final : public Test
          policy.set("allow_dtls10", "true");
          policy.set("allow_dtls12", "true");
 
-         if(kex_policy.find("RSA") != std::string::npos || kex_policy.find("SRP") != std::string::npos)
+         if(kex_policy.find("RSA") != std::string::npos)
             {
             policy.set("signature_methods", "IMPLICIT");
             }
@@ -980,11 +894,6 @@ class TLS_Unit_Tests final : public Test
                               { { "signature_methods", "DSA" } });
 #endif
 
-#if defined(BOTAN_HAS_SRP6)
-         std::unique_ptr<Botan::Credentials_Manager> srp6_creds(create_srp6_creds(rng));
-         test_all_versions("SRP6 AES", results, *client_ses, *server_ses, *srp6_creds, "SRP_SHA", "AES-128", "SHA-1", "false");
-#endif
-
 #endif
 
          Botan::TLS::Strict_Policy strict_policy;