Repository: randombit/botan
Pull request #3242 (2023-01-31 23:45:35)

Make Cipher_Dir an enum class


Patch:
diff --git a/doc/api_ref/filters.rst b/doc/api_ref/filters.rst
index 04baebf5d..d591dee42 100644
--- a/doc/api_ref/filters.rst
+++ b/doc/api_ref/filters.rst
@@ -69,7 +69,7 @@ Here's code that uses one of them to encrypt a string with AES::
   InitializationVector iv(rng, 16); // a random 128-bit IV
 
   // The algorithm we want is specified by a string
-  Pipe pipe(get_cipher("AES-128/CBC", key, iv, ENCRYPTION));
+  Pipe pipe(get_cipher("AES-128/CBC", key, iv, Cipher_Dir::Encryption));
 
   pipe.process_msg("secrets");
   pipe.process_msg("more secrets");
@@ -134,7 +134,7 @@ Here's an example using two computational filters::
    SymmetricKey key(rng, 32);
    InitializationVector iv(rng, 16);
 
-   Pipe encryptor(get_cipher("AES/CBC/PKCS7", key, iv, ENCRYPTION),
+   Pipe encryptor(get_cipher("AES/CBC/PKCS7", key, iv, Cipher_Dir::Encryption),
                   new Base64_Encoder);
 
    encryptor.start_msg();
@@ -219,7 +219,7 @@ a case where that is useful::
    // have std::string ciphertext, auth_code, key, iv, mac_key;
 
    Pipe pipe(new Base64_Decoder,
-             get_cipher("AES-128", key, iv, DECRYPTION),
+             get_cipher("AES-128", key, iv, Cipher_Dir::Decryption),
              new Fork(
                 0, // this message gets plaintext
                 new MAC_Filter("HMAC(SHA-1)", mac_key)
@@ -579,7 +579,7 @@ The version that doesn't take an IV is useful for things that don't
 use them, like block ciphers in ECB mode, or most stream ciphers. If
 you specify a cipher spec that does want a IV, and you use the version
 that doesn't take one, an exception will be thrown. The ``dir``
-argument can be either ``ENCRYPTION`` or ``DECRYPTION``.
+argument can be either ``Cipher_Dir::Encryption`` or ``Cipher_Dir::Decryption``.
 
 The cipher_spec is a string that specifies what cipher is to be
 used. The general syntax for "cipher_spec" is "STREAM_CIPHER",
diff --git a/src/cli/cipher.cpp b/src/cli/cipher.cpp
index ab48fbeee..84b699b08 100644
--- a/src/cli/cipher.cpp
+++ b/src/cli/cipher.cpp
@@ -47,7 +47,7 @@ class Cipher final : public Command
          const Botan::InitializationVector nonce(nonce_hex);
          const std::vector<uint8_t> ad = Botan::hex_decode(ad_hex);
 
-         auto direction = flag_set("decrypt") ? Botan::Cipher_Dir::DECRYPTION : Botan::Cipher_Dir::ENCRYPTION;
+         auto direction = flag_set("decrypt") ? Botan::Cipher_Dir::Decryption : Botan::Cipher_Dir::Encryption;
 
          auto cipher = Botan::Cipher_Mode::create(cipher_algo, direction);
          if(!cipher)
diff --git a/src/cli/pk_crypt.cpp b/src/cli/pk_crypt.cpp
index 0fbeb186d..2cfcfb7af 100644
--- a/src/cli/pk_crypt.cpp
+++ b/src/cli/pk_crypt.cpp
@@ -54,7 +54,7 @@ class PK_Encrypt final : public Command
          const std::string aead_algo = get_arg("aead");
 
          std::unique_ptr<Botan::AEAD_Mode> aead =
-            Botan::AEAD_Mode::create(aead_algo, Botan::ENCRYPTION);
+            Botan::AEAD_Mode::create(aead_algo, Botan::Cipher_Dir::Encryption);
 
          if(!aead)
             throw CLI_Usage_Error("The AEAD '" + aead_algo + "' is not available");
@@ -190,7 +190,7 @@ class PK_Decrypt final : public Command
             }
 
          std::unique_ptr<Botan::AEAD_Mode> aead =
-            Botan::AEAD_Mode::create_or_throw(aead_algo, Botan::DECRYPTION);
+            Botan::AEAD_Mode::create_or_throw(aead_algo, Botan::Cipher_Dir::Decryption);
 
          const size_t expected_keylen = aead->key_spec().maximum_keylength();
 
diff --git a/src/cli/speed.cpp b/src/cli/speed.cpp
index fb4c740cb..096bb5e9c 100644
--- a/src/cli/speed.cpp
+++ b/src/cli/speed.cpp
@@ -533,9 +533,9 @@ class Speed final : public Command
                }
 #endif
 #if defined(BOTAN_HAS_CIPHER_MODES)
-            else if(auto enc = Botan::Cipher_Mode::create(algo, Botan::ENCRYPTION, provider))
+            else if(auto enc = Botan::Cipher_Mode::create(algo, Botan::Cipher_Dir::Encryption, provider))
                {
-               auto dec = Botan::Cipher_Mode::create_or_throw(algo, Botan::DECRYPTION, provider);
+               auto dec = Botan::Cipher_Mode::create_or_throw(algo, Botan::Cipher_Dir::Decryption, provider);
                bench_cipher_mode(*enc, *dec, msec, buf_sizes);
                }
 #endif
diff --git a/src/examples/aes_cbc.cpp b/src/examples/aes_cbc.cpp
index a84241cc0..e5b59f054 100644
--- a/src/examples/aes_cbc.cpp
+++ b/src/examples/aes_cbc.cpp
@@ -12,8 +12,7 @@ int main() {
                               "luck. Unfortunately, Dane's luck wasn't as good as his old man's.");
   const std::vector<uint8_t> key = Botan::hex_decode("2B7E151628AED2A6ABF7158809CF4F3C");
 
-  std::unique_ptr<Botan::Cipher_Mode> enc =
-      Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::ENCRYPTION);
+  auto enc = Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::Cipher_Dir::Encryption);
   enc->set_key(key);
 
   // generate fresh nonce (IV)
diff --git a/src/lib/compat/sodium/sodium_aead.cpp b/src/lib/compat/sodium/sodium_aead.cpp
index 0d6f35eaf..2c6a35273 100644
--- a/src/lib/compat/sodium/sodium_aead.cpp
+++ b/src/lib/compat/sodium/sodium_aead.cpp
@@ -21,7 +21,7 @@ int sodium_aead_chacha20poly1305_encrypt(uint8_t ctext[],
                                          size_t nonce_len,
                                          const uint8_t key[])
    {
-   auto chacha20poly1305 = AEAD_Mode::create_or_throw("ChaCha20Poly1305", ENCRYPTION);
+   auto chacha20poly1305 = AEAD_Mode::create_or_throw("ChaCha20Poly1305", Cipher_Dir::Encryption);
 
    chacha20poly1305->set_key(key, 32);
    chacha20poly1305->set_associated_data(ad, ad_len);
@@ -55,7 +55,7 @@ int sodium_aead_chacha20poly1305_decrypt(uint8_t ptext[],
 
    *ptext_len = 0;
 
-   auto chacha20poly1305 = AEAD_Mode::create_or_throw("ChaCha20Poly1305", DECRYPTION);
+   auto chacha20poly1305 = AEAD_Mode::create_or_throw("ChaCha20Poly1305", Cipher_Dir::Decryption);
 
    chacha20poly1305->set_key(key, 32);
    chacha20poly1305->set_associated_data(ad, ad_len);
@@ -90,7 +90,7 @@ int sodium_aead_chacha20poly1305_encrypt_detached(uint8_t ctext[],
                                                   size_t nonce_len,
                                                   const uint8_t key[])
    {
-   auto chacha20poly1305 = AEAD_Mode::create_or_throw("ChaCha20Poly1305", ENCRYPTION);
+   auto chacha20poly1305 = AEAD_Mode::create_or_throw("ChaCha20Poly1305", Cipher_Dir::Encryption);
 
    chacha20poly1305->set_key(key, 32);
    chacha20poly1305->set_associated_data(ad, ad_len);
@@ -118,7 +118,7 @@ int sodium_aead_chacha20poly1305_decrypt_detached(uint8_t ptext[],
                                                   size_t nonce_len,
                                                   const uint8_t key[])
    {
-   auto chacha20poly1305 = AEAD_Mode::create_or_throw("ChaCha20Poly1305", DECRYPTION);
+   auto chacha20poly1305 = AEAD_Mode::create_or_throw("ChaCha20Poly1305", Cipher_Dir::Decryption);
 
    chacha20poly1305->set_key(key, 32);
    chacha20poly1305->set_associated_data(ad, ad_len);
diff --git a/src/lib/ffi/ffi_cipher.cpp b/src/lib/ffi/ffi_cipher.cpp
index 3ef572838..ba1f1beb3 100644
--- a/src/lib/ffi/ffi_cipher.cpp
+++ b/src/lib/ffi/ffi_cipher.cpp
@@ -61,7 +61,9 @@ int botan_cipher_init(botan_cipher_t* cipher, const char* cipher_name, uint32_t
    {
    return ffi_guard_thunk(__func__, [=]() -> int {
       const bool encrypt_p = ((flags & BOTAN_CIPHER_INIT_FLAG_MASK_DIRECTION) == BOTAN_CIPHER_INIT_FLAG_ENCRYPT);
-      const Botan::Cipher_Dir dir = encrypt_p ? Botan::ENCRYPTION : Botan::DECRYPTION;
+      const Botan::Cipher_Dir dir = encrypt_p ?
+         Botan::Cipher_Dir::Encryption : Botan::Cipher_Dir::Decryption;
+
       std::unique_ptr<Botan::Cipher_Mode> mode(Botan::Cipher_Mode::create(cipher_name, dir));
       if(!mode)
          return BOTAN_FFI_ERROR_NOT_IMPLEMENTED;
diff --git a/src/lib/misc/cryptobox/cryptobox.cpp b/src/lib/misc/cryptobox/cryptobox.cpp
index 9384f92df..cdeeb88e3 100644
--- a/src/lib/misc/cryptobox/cryptobox.cpp
+++ b/src/lib/misc/cryptobox/cryptobox.cpp
@@ -73,7 +73,7 @@ std::string encrypt(const uint8_t input[], size_t input_len,
    const uint8_t* iv = mk + CIPHER_KEY_LEN + MAC_KEY_LEN;
 
    // Now encrypt and authenticate
-   std::unique_ptr<Cipher_Mode> ctr = Cipher_Mode::create_or_throw("Serpent/CTR-BE", ENCRYPTION);
+   std::unique_ptr<Cipher_Mode> ctr = Cipher_Mode::create_or_throw("Serpent/CTR-BE", Cipher_Dir::Encryption);
    ctr->set_key(cipher_key, CIPHER_KEY_LEN);
    ctr->start(iv, CIPHER_IV_LEN);
    ctr->finish(out_buf, CRYPTOBOX_HEADER_LEN);
@@ -143,7 +143,7 @@ decrypt_bin(const uint8_t input[], size_t input_len,
    if(!constant_time_compare(computed_mac.data(), box_mac, MAC_OUTPUT_LEN))
       throw Decoding_Error("CryptoBox integrity failure");
 
-   std::unique_ptr<Cipher_Mode> ctr(Cipher_Mode::create_or_throw("Serpent/CTR-BE", DECRYPTION));
+   std::unique_ptr<Cipher_Mode> ctr(Cipher_Mode::create_or_throw("Serpent/CTR-BE", Cipher_Dir::Decryption));
    ctr->set_key(cipher_key, CIPHER_KEY_LEN);
    ctr->start(iv, CIPHER_IV_LEN);
    ctr->finish(ciphertext, CRYPTOBOX_HEADER_LEN);
diff --git a/src/lib/modes/aead/aead.cpp b/src/lib/modes/aead/aead.cpp
index a09aedf00..86eb040d0 100644
--- a/src/lib/modes/aead/aead.cpp
+++ b/src/lib/modes/aead/aead.cpp
@@ -65,7 +65,7 @@ std::unique_ptr<AEAD_Mode> AEAD_Mode::create(const std::string& algo,
 #if defined(BOTAN_HAS_AEAD_CHACHA20_POLY1305)
    if(algo == "ChaCha20Poly1305")
       {
-      if(dir == ENCRYPTION)
+      if(dir == Cipher_Dir::Encryption)
          return std::make_unique<ChaCha20Poly1305_Encryption>();
       else
          return std::make_unique<ChaCha20Poly1305_Decryption>();
@@ -115,7 +115,7 @@ std::unique_ptr<AEAD_Mode> AEAD_Mode::create(const std::string& algo,
       {
       size_t tag_len = req.arg_as_integer(1, 16);
       size_t L_len = req.arg_as_integer(2, 3);
-      if(dir == ENCRYPTION)
+      if(dir == Cipher_Dir::Encryption)
          return std::make_unique<CCM_Encryption>(std::move(bc), tag_len, L_len);
       else
          return std::make_unique<CCM_Decryption>(std::move(bc), tag_len, L_len);
@@ -126,7 +126,7 @@ std::unique_ptr<AEAD_Mode> AEAD_Mode::create(const std::string& algo,
    if(req.algo_name() == "GCM")
       {
       size_t tag_len = req.arg_as_integer(1, 16);
-      if(dir == ENCRYPTION)
+      if(dir == Cipher_Dir::Encryption)
          return std::make_unique<GCM_Encryption>(std::move(bc), tag_len);
       else
          return std::make_unique<GCM_Decryption>(std::move(bc), tag_len);
@@ -137,7 +137,7 @@ std::unique_ptr<AEAD_Mode> AEAD_Mode::create(const std::string& algo,
    if(req.algo_name() == "OCB")
       {
       size_t tag_len = req.arg_as_integer(1, 16);
-      if(dir == ENCRYPTION)
+      if(dir == Cipher_Dir::Encryption)
          return std::make_unique<OCB_Encryption>(std::move(bc), tag_len);
       else
          return std::make_unique<OCB_Decryption>(std::move(bc), tag_len);
@@ -148,7 +148,7 @@ std::unique_ptr<AEAD_Mode> AEAD_Mode::create(const std::string& algo,
    if(req.algo_name() == "EAX")
       {
       size_t tag_len = req.arg_as_integer(1, bc->block_size());
-      if(dir == ENCRYPTION)
+      if(dir == Cipher_Dir::Encryption)
          return std::make_unique<EAX_Encryption>(std::move(bc), tag_len);
       else
          return std::make_unique<EAX_Decryption>(std::move(bc), tag_len);
@@ -158,7 +158,7 @@ std::unique_ptr<AEAD_Mode> AEAD_Mode::create(const std::string& algo,
 #if defined(BOTAN_HAS_AEAD_SIV)
    if(req.algo_name() == "SIV")
       {
-      if(dir == ENCRYPTION)
+      if(dir == Cipher_Dir::Encryption)
          return std::make_unique<SIV_Encryption>(std::move(bc));
       else
          return std::make_unique<SIV_Decryption>(std::move(bc));
diff --git a/src/lib/modes/aead/aead.h b/src/lib/modes/aead/aead.h
index 3d3dc0ed3..ec6b42123 100644
--- a/src/lib/modes/aead/aead.h
+++ b/src/lib/modes/aead/aead.h
@@ -133,7 +133,7 @@ class BOTAN_PUBLIC_API(2,0) AEAD_Mode : public Cipher_Mode
 /**
 * Get an AEAD mode by name (eg "AES-128/GCM" or "Serpent/EAX")
 * @param name AEAD name
-* @param direction ENCRYPTION or DECRYPTION
+* @param direction Cipher_Dir::Encryption or Cipher_Dir::Decryption
 */
 inline AEAD_Mode* get_aead(const std::string& name, Cipher_Dir direction)
    {
diff --git a/src/lib/modes/cipher_mode.cpp b/src/lib/modes/cipher_mode.cpp
index 79b297c37..bc0b54f8d 100644
--- a/src/lib/modes/cipher_mode.cpp
+++ b/src/lib/modes/cipher_mode.cpp
@@ -122,7 +122,7 @@ std::unique_ptr<Cipher_Mode> Cipher_Mode::create(const std::string& algo,
 
       if(padding == "CTS")
          {
-         if(direction == ENCRYPTION)
+         if(direction == Cipher_Dir::Encryption)
             return std::make_unique<CTS_Encryption>(std::move(bc));
          else
             return std::make_unique<CTS_Decryption>(std::move(bc));
@@ -133,7 +133,7 @@ std::unique_ptr<Cipher_Mode> Cipher_Mode::create(const std::string& algo,
 
          if(pad)
             {
-            if(direction == ENCRYPTION)
+            if(direction == Cipher_Dir::Encryption)
                return std::make_unique<CBC_Encryption>(std::move(bc), std::move(pad));
             else
                return std::make_unique<CBC_Decryption>(std::move(bc), std::move(pad));
@@ -145,7 +145,7 @@ std::unique_ptr<Cipher_Mode> Cipher_Mode::create(const std::string& algo,
 #if defined(BOTAN_HAS_MODE_XTS)
    if(spec.algo_name() == "XTS")
       {
-      if(direction == ENCRYPTION)
+      if(direction == Cipher_Dir::Encryption)
          return std::make_unique<XTS_Encryption>(std::move(bc));
       else
          return std::make_unique<XTS_Decryption>(std::move(bc));
@@ -156,7 +156,7 @@ std::unique_ptr<Cipher_Mode> Cipher_Mode::create(const std::string& algo,
    if(spec.algo_name() == "CFB")
       {
       const size_t feedback_bits = spec.arg_as_integer(1, 8*bc->block_size());
-      if(direction == ENCRYPTION)
+      if(direction == Cipher_Dir::Encryption)
          return std::make_unique<CFB_Encryption>(std::move(bc), feedback_bits);
       else
          return std::make_unique<CFB_Decryption>(std::move(bc), feedback_bits);
@@ -175,7 +175,7 @@ std::vector<std::string> Cipher_Mode::providers(const std::string& algo_spec)
    std::vector<std::string> providers;
    for(auto&& prov : possible)
       {
-      std::unique_ptr<Cipher_Mode> mode = Cipher_Mode::create(algo_spec, ENCRYPTION, prov);
+      std::unique_ptr<Cipher_Mode> mode = Cipher_Mode::create(algo_spec, Cipher_Dir::Encryption, prov);
       if(mode)
          {
          providers.push_back(prov); // available
diff --git a/src/lib/modes/cipher_mode.h b/src/lib/modes/cipher_mode.h
index a401cb997..c87d9d1dc 100644
--- a/src/lib/modes/cipher_mode.h
+++ b/src/lib/modes/cipher_mode.h
@@ -20,7 +20,13 @@ namespace Botan {
 * The two possible directions for cipher filters, determining whether they
 * actually perform encryption or decryption.
 */
-enum Cipher_Dir : int { ENCRYPTION, DECRYPTION };
+enum class Cipher_Dir : int {
+   Encryption,
+   Decryption,
+
+   ENCRYPTION BOTAN_DEPRECATED("Use Cipher_Dir::Encryption") = Encryption,
+   DECRYPTION BOTAN_DEPRECATED("Use Cipher_Dir::Decryption") = Decryption,
+};
 
 /**
 * Interface for cipher modes
@@ -209,7 +215,7 @@ class BOTAN_PUBLIC_API(2,0) Cipher_Mode : public SymmetricAlgorithm
 /**
 * Get a cipher mode by name (eg "AES-128/CBC" or "Serpent/XTS")
 * @param algo_spec cipher name
-* @param direction ENCRYPTION or DECRYPTION
+* @param direction Cipher_Dir::Encryption or Cipher_Dir::Decryption
 * @param provider provider implementation to choose
 */
 BOTAN_DEPRECATED("Use Cipher_Mode::create")
diff --git a/src/lib/prov/commoncrypto/commoncrypto.h b/src/lib/prov/commoncrypto/commoncrypto.h
index 5e17adc0a..b1e4c2bab 100644
--- a/src/lib/prov/commoncrypto/commoncrypto.h
+++ b/src/lib/prov/commoncrypto/commoncrypto.h
@@ -19,7 +19,7 @@ namespace Botan {
 class Cipher_Mode;
 class BlockCipher;
 class HashFunction;
-enum Cipher_Dir : int;
+enum class Cipher_Dir : int;
 typedef int32_t CCCryptorStatus;
 
 class BOTAN_PUBLIC_API(2, 0) CommonCrypto_Error final : public Exception
diff --git a/src/lib/prov/commoncrypto/commoncrypto_mode.cpp b/src/lib/prov/commoncrypto/commoncrypto_mode.cpp
index dded367ac..a0a60bb40 100644
--- a/src/lib/prov/commoncrypto/commoncrypto_mode.cpp
+++ b/src/lib/prov/commoncrypto/commoncrypto_mode.cpp
@@ -159,7 +159,7 @@ size_t CommonCrypto_Cipher_Mode::ideal_granularity() const
 
 size_t CommonCrypto_Cipher_Mode::minimum_final_size() const
    {
-   if(m_direction == ENCRYPTION)
+   if(m_direction == Cipher_Dir::Encryption)
       return 0;
    else
       return m_opts.block_size;
@@ -223,7 +223,7 @@ Key_Length_Specification CommonCrypto_Cipher_Mode::key_spec() const
 void CommonCrypto_Cipher_Mode::key_schedule(const uint8_t key[], size_t length)
    {
    CCCryptorStatus status;
-   CCOperation op = m_direction == ENCRYPTION ? kCCEncrypt : kCCDecrypt;
+   CCOperation op = m_direction == Cipher_Dir::Encryption ? kCCEncrypt : kCCDecrypt;
    status = CCCryptorCreateWithMode(op, m_opts.mode, m_opts.algo, m_opts.padding,
                                     nullptr, key, length, nullptr, 0, 0, 0, &m_cipher);
    if(status != kCCSuccess)
diff --git a/src/lib/pubkey/ecies/ecies.cpp b/src/lib/pubkey/ecies/ecies.cpp
index a1142c369..47b6c558e 100644
--- a/src/lib/pubkey/ecies/ecies.cpp
+++ b/src/lib/pubkey/ecies/ecies.cpp
@@ -250,7 +250,7 @@ ECIES_Encryptor::ECIES_Encryptor(const PK_Key_Agreement_Key& private_key,
       m_eph_public_key_bin = m_params.domain().OS2ECP(m_eph_public_key_bin).encode(ecies_params.compression_type());
       }
    m_mac = m_params.create_mac();
-   m_cipher = m_params.create_cipher(ENCRYPTION);
+   m_cipher = m_params.create_cipher(Cipher_Dir::Encryption);
    }
 
 /*
@@ -338,7 +338,7 @@ ECIES_Decryptor::ECIES_Decryptor(const PK_Key_Agreement_Key& key,
       }
 
    m_mac = m_params.create_mac();
-   m_cipher = m_params.create_cipher(DECRYPTION);
+   m_cipher = m_params.create_cipher(Cipher_Dir::Decryption);
    }
 
 size_t ECIES_Decryptor::plaintext_length(size_t ctext_len) const
diff --git a/src/lib/pubkey/pbes2/pbes2.cpp b/src/lib/pubkey/pbes2/pbes2.cpp
index 99706ff76..a0c5c511c 100644
--- a/src/lib/pubkey/pbes2/pbes2.cpp
+++ b/src/lib/pubkey/pbes2/pbes2.cpp
@@ -216,7 +216,7 @@ pbes2_encrypt_shared(const secure_vector<uint8_t>& key_bits,
    if(cipher_oid.empty())
       throw Encoding_Error("PBE-PKCS5 v2.0: No OID assigned for " + cipher);
 
-   std::unique_ptr<Cipher_Mode> enc = Cipher_Mode::create(cipher, ENCRYPTION);
+   std::unique_ptr<Cipher_Mode> enc = Cipher_Mode::create(cipher, Cipher_Dir::Encryption);
 
    if(!enc)
       throw Decoding_Error("PBE-PKCS5 cannot encrypt no cipher " + cipher);
@@ -320,7 +320,7 @@ pbes2_decrypt(const secure_vector<uint8_t>& key_bits,
    secure_vector<uint8_t> iv;
    BER_Decoder(enc_algo.get_parameters()).decode(iv, ASN1_Type::OctetString).verify_end();
 
-   std::unique_ptr<Cipher_Mode> dec = Cipher_Mode::create(cipher, DECRYPTION);
+   std::unique_ptr<Cipher_Mode> dec = Cipher_Mode::create(cipher, Cipher_Dir::Decryption);
    if(!dec)
       throw Decoding_Error("PBE-PKCS5 cannot decrypt no cipher " + cipher);
 
diff --git a/src/lib/tls/tls12/tls_cbc/tls_cbc.cpp b/src/lib/tls/tls12/tls_cbc/tls_cbc.cpp
index f30888d46..61efdd380 100644
--- a/src/lib/tls/tls12/tls_cbc/tls_cbc.cpp
+++ b/src/lib/tls/tls12/tls_cbc/tls_cbc.cpp
@@ -45,7 +45,7 @@ TLS_CBC_HMAC_AEAD_Mode::TLS_CBC_HMAC_AEAD_Mode(Cipher_Dir dir,
    m_mac = std::move(mac);
 
    auto null_padding = std::make_unique<Null_Padding>();
-   if(dir == ENCRYPTION)
+   if(dir == Cipher_Dir::Encryption)
       m_cbc.reset(new CBC_Encryption(std::move(cipher), std::move(null_padding)));
    else
       m_cbc.reset(new CBC_Decryption(std::move(cipher), std::move(null_padding)));
diff --git a/src/lib/tls/tls12/tls_cbc/tls_cbc.h b/src/lib/tls/tls12/tls_cbc/tls_cbc.h
index 6f6bc1f73..76248c8b4 100644
--- a/src/lib/tls/tls12/tls_cbc/tls_cbc.h
+++ b/src/lib/tls/tls12/tls_cbc/tls_cbc.h
@@ -117,7 +117,7 @@ class BOTAN_TEST_API TLS_CBC_HMAC_AEAD_Encryption final : public TLS_CBC_HMAC_AE
                              const size_t mac_keylen,
                              const Protocol_Version version,
                              bool use_encrypt_then_mac) :
-         TLS_CBC_HMAC_AEAD_Mode(ENCRYPTION,
+         TLS_CBC_HMAC_AEAD_Mode(Cipher_Dir::Encryption,
                                 std::move(cipher),
                                 std::move(mac),
                                 cipher_keylen,
@@ -152,7 +152,7 @@ class BOTAN_TEST_API TLS_CBC_HMAC_AEAD_Decryption final : public TLS_CBC_HMAC_AE
                                    const size_t mac_keylen,
                                    const Protocol_Version version,
                                    bool use_encrypt_then_mac) :
-         TLS_CBC_HMAC_AEAD_Mode(DECRYPTION,
+         TLS_CBC_HMAC_AEAD_Mode(Cipher_Dir::Decryption,
                                 std::move(cipher),
                                 std::move(mac),
                                 cipher_keylen,
diff --git a/src/lib/tls/tls12/tls_record.cpp b/src/lib/tls/tls12/tls_record.cpp
index 88ae1b930..3901c006c 100644
--- a/src/lib/tls/tls12/tls_record.cpp
+++ b/src/lib/tls/tls12/tls_record.cpp
@@ -75,7 +75,7 @@ Connection_Cipher_State::Connection_Cipher_State(Protocol_Version version,
       }
    else
       {
-      m_aead = AEAD_Mode::create_or_throw(suite.cipher_algo(), our_side ? ENCRYPTION : DECRYPTION);
+      m_aead = AEAD_Mode::create_or_throw(suite.cipher_algo(), our_side ? Cipher_Dir::Encryption : Cipher_Dir::Decryption);
       }
 
    m_aead->set_key(aead_key);
diff --git a/src/lib/tls/tls13/tls_cipher_state.cpp b/src/lib/tls/tls13/tls_cipher_state.cpp
index f63d27e13..ea9104412 100644
--- a/src/lib/tls/tls13/tls_cipher_state.cpp
+++ b/src/lib/tls/tls13/tls_cipher_state.cpp
@@ -474,8 +474,8 @@ void Cipher_State::advance_with_server_hello(const Ciphersuite& cipher,
    BOTAN_ASSERT_NOMSG(!m_decrypt);
    BOTAN_STATE_CHECK(is_compatible_with(cipher));
 
-   m_encrypt = AEAD_Mode::create_or_throw(cipher.cipher_algo(), ENCRYPTION);
-   m_decrypt = AEAD_Mode::create_or_throw(cipher.cipher_algo(), DECRYPTION);
+   m_encrypt = AEAD_Mode::create_or_throw(cipher.cipher_algo(), Cipher_Dir::Encryption);
+   m_decrypt = AEAD_Mode::create_or_throw(cipher.cipher_algo(), Cipher_Dir::Decryption);
 
    const auto handshake_secret = hkdf_extract(std::move(shared_secret));
 
diff --git a/src/lib/tls/tls_policy.cpp b/src/lib/tls/tls_policy.cpp
index 0282b0978..66b101f44 100644
--- a/src/lib/tls/tls_policy.cpp
+++ b/src/lib/tls/tls_policy.cpp
@@ -584,7 +584,7 @@ void Policy::print(std::ostream& o) const
    print_bool(o, "tls_13_middlebox_compatibility_mode", tls_13_middlebox_compatibility_mode());
    print_bool(o, "hash_hello_random", hash_hello_random());
    if (record_size_limit().has_value()) {
-      o << "record_size_limit = " << record_size_limit().value() << '\n';
+      o << "record_size_limit = " << record_size_limit().has_value() << '\n';
    }
    o << "session_ticket_lifetime = " << session_ticket_lifetime() << '\n';
    o << "minimum_dh_group_size = " << minimum_dh_group_size() << '\n';
diff --git a/src/lib/tls/tls_session.cpp b/src/lib/tls/tls_session.cpp
index 6a1703739..b26dac97b 100644
--- a/src/lib/tls/tls_session.cpp
+++ b/src/lib/tls/tls_session.cpp
@@ -370,7 +370,7 @@ Session::encrypt(const SymmetricKey& key, RandomNumberGenerator& rng) const
    buf += key_seed;
    buf += aead_nonce;
 
-   std::unique_ptr<AEAD_Mode> aead = AEAD_Mode::create_or_throw(TLS_SESSION_CRYPT_AEAD, ENCRYPTION);
+   std::unique_ptr<AEAD_Mode> aead = AEAD_Mode::create_or_throw(TLS_SESSION_CRYPT_AEAD, Cipher_Dir::Encryption);
    BOTAN_ASSERT_NOMSG(aead->valid_nonce_length(TLS_SESSION_CRYPT_AEAD_NONCE_LEN));
    BOTAN_ASSERT_NOMSG(aead->tag_size() == TLS_SESSION_CRYPT_AEAD_TAG_SIZE);
    aead->set_key(aead_key);
@@ -415,7 +415,7 @@ Session Session::decrypt(const uint8_t in[], size_t in_len, const SymmetricKey&
       hmac->update(key_seed, TLS_SESSION_CRYPT_AEAD_KEY_SEED_LEN);
       const secure_vector<uint8_t> aead_key = hmac->final();
 
-      auto aead = AEAD_Mode::create_or_throw(TLS_SESSION_CRYPT_AEAD, DECRYPTION);
+      auto aead = AEAD_Mode::create_or_throw(TLS_SESSION_CRYPT_AEAD, Cipher_Dir::Decryption);
       aead->set_key(aead_key);
       aead->set_associated_data(in, TLS_SESSION_CRYPT_HDR_LEN);
       aead->start(aead_nonce, TLS_SESSION_CRYPT_AEAD_NONCE_LEN);


Test patch:
diff --git a/src/cli/timing_tests.cpp b/src/cli/timing_tests.cpp
index 1125a6743..723f94677 100644
--- a/src/cli/timing_tests.cpp
+++ b/src/cli/timing_tests.cpp
@@ -226,7 +226,7 @@ std::vector<uint8_t> Lucky13_Timing_Test::prepare_input(const std::string& input
    const std::vector<uint8_t> key(16);
    const std::vector<uint8_t> iv(16);
 
-   std::unique_ptr<Botan::Cipher_Mode> enc(Botan::Cipher_Mode::create("AES-128/CBC/NoPadding", Botan::ENCRYPTION));
+   auto enc = Botan::Cipher_Mode::create("AES-128/CBC/NoPadding", Botan::Cipher_Dir::Encryption);
    enc->set_key(key);
    enc->start(iv);
    Botan::secure_vector<uint8_t> buf(input_vector.begin(), input_vector.end());
diff --git a/src/tests/test_aead.cpp b/src/tests/test_aead.cpp
index 48fa8d660..688dcaef9 100644
--- a/src/tests/test_aead.cpp
+++ b/src/tests/test_aead.cpp
@@ -33,7 +33,7 @@ class AEAD_Tests final : public Text_Based_Test
 
          Test::Result result(algo);
 
-         std::unique_ptr<Botan::AEAD_Mode> enc(Botan::AEAD_Mode::create(algo, Botan::ENCRYPTION));
+         std::unique_ptr<Botan::AEAD_Mode> enc(Botan::AEAD_Mode::create(algo, Botan::Cipher_Dir::Encryption));
 
          result.test_eq("AEAD encrypt output_length is correct", enc->output_length(input.size()), expected.size());
 
@@ -204,7 +204,7 @@ class AEAD_Tests final : public Text_Based_Test
 
          Test::Result result(algo);
 
-         std::unique_ptr<Botan::AEAD_Mode> dec(Botan::AEAD_Mode::create(algo, Botan::DECRYPTION));
+         std::unique_ptr<Botan::AEAD_Mode> dec(Botan::AEAD_Mode::create(algo, Botan::Cipher_Dir::Decryption));
 
          result.test_eq("AEAD decrypt output_length is correct", dec->output_length(input.size()), expected.size());
 
@@ -439,8 +439,8 @@ class AEAD_Tests final : public Text_Based_Test
 
          Test::Result result(algo);
 
-         std::unique_ptr<Botan::AEAD_Mode> enc(Botan::AEAD_Mode::create(algo, Botan::ENCRYPTION));
-         std::unique_ptr<Botan::AEAD_Mode> dec(Botan::AEAD_Mode::create(algo, Botan::DECRYPTION));
+         std::unique_ptr<Botan::AEAD_Mode> enc(Botan::AEAD_Mode::create(algo, Botan::Cipher_Dir::Encryption));
+         std::unique_ptr<Botan::AEAD_Mode> dec(Botan::AEAD_Mode::create(algo, Botan::Cipher_Dir::Decryption));
 
          if(!enc || !dec)
             {
diff --git a/src/tests/test_dlies.cpp b/src/tests/test_dlies.cpp
index 653436c35..641eb9fa2 100644
--- a/src/tests/test_dlies.cpp
+++ b/src/tests/test_dlies.cpp
@@ -64,8 +64,8 @@ class DLIES_KAT_Tests final : public Text_Based_Test
 
          if(cipher_algo != "XOR")
             {
-            enc = Botan::Cipher_Mode::create(cipher_algo, Botan::ENCRYPTION);
-            dec = Botan::Cipher_Mode::create(cipher_algo, Botan::DECRYPTION);
+            enc = Botan::Cipher_Mode::create(cipher_algo, Botan::Cipher_Dir::Encryption);
+            dec = Botan::Cipher_Mode::create(cipher_algo, Botan::Cipher_Dir::Decryption);
 
             if(!enc || !dec)
                {
diff --git a/src/tests/test_filters.cpp b/src/tests/test_filters.cpp
index 5709b5cf2..23be31c2c 100644
--- a/src/tests/test_filters.cpp
+++ b/src/tests/test_filters.cpp
@@ -383,10 +383,10 @@ class Filter_Tests final : public Test
             "7195FFE735B0A95065BA244C77A11F",
          };
 
-         Botan::Keyed_Filter* cfb_enc = Botan::get_cipher("Blowfish/CFB", key, iv, Botan::ENCRYPTION);
+         Botan::Keyed_Filter* cfb_enc = Botan::get_cipher("Blowfish/CFB", key, iv, Botan::Cipher_Dir::Encryption);
          Botan::Pipe enc_pipe(cfb_enc, new Botan::Hex_Encoder);
 
-         Botan::Keyed_Filter* cfb_dec = Botan::get_cipher("Blowfish/CFB", key, Botan::DECRYPTION);
+         Botan::Keyed_Filter* cfb_dec = Botan::get_cipher("Blowfish/CFB", key, Botan::Cipher_Dir::Decryption);
          cfb_dec->set_iv(iv);
          Botan::Pipe dec_pipe(new Botan::Hex_Decoder, cfb_dec, new Botan::Hex_Encoder);
 
@@ -423,7 +423,7 @@ class Filter_Tests final : public Test
 
 #if defined(BOTAN_HAS_AES) && defined(BOTAN_HAS_MODE_CBC) && defined(BOTAN_HAS_CIPHER_MODE_PADDING)
          Botan::Cipher_Mode_Filter* cipher =
-            new Botan::Cipher_Mode_Filter(Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::ENCRYPTION));
+            new Botan::Cipher_Mode_Filter(Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::Cipher_Dir::Encryption));
 
          result.test_eq("Cipher filter name", cipher->name(), "AES-128/CBC/PKCS7");
 
@@ -458,7 +458,7 @@ class Filter_Tests final : public Test
          result.test_eq("Ciphertext3", ciphertext3, "1241B9976F73051BCF809525D6E86C25");
 
          Botan::Cipher_Mode_Filter* dec_cipher =
-            new Botan::Cipher_Mode_Filter(Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::DECRYPTION));
+            new Botan::Cipher_Mode_Filter(Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::Cipher_Dir::Decryption));
          pipe.append(dec_cipher);
          dec_cipher->set_key(Botan::SymmetricKey("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"));
          dec_cipher->set_iv(Botan::InitializationVector("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB"));
diff --git a/src/tests/test_modes.cpp b/src/tests/test_modes.cpp
index fae96d251..fd476bc2d 100644
--- a/src/tests/test_modes.cpp
+++ b/src/tests/test_modes.cpp
@@ -47,9 +47,9 @@ class Cipher_Mode_Tests final : public Text_Based_Test
          for(auto&& provider_ask : providers)
             {
             std::unique_ptr<Botan::Cipher_Mode> enc(Botan::Cipher_Mode::create(
-                  algo, Botan::ENCRYPTION, provider_ask));
+                  algo, Botan::Cipher_Dir::Encryption, provider_ask));
             std::unique_ptr<Botan::Cipher_Mode> dec(Botan::Cipher_Mode::create(
-                  algo, Botan::DECRYPTION, provider_ask));
+                  algo, Botan::Cipher_Dir::Decryption, provider_ask));
 
             if(!enc || !dec)
                {
@@ -285,9 +285,9 @@ class Cipher_Mode_IV_Carry_Tests final : public Test
 
 #if defined(BOTAN_HAS_MODE_CBC) && defined(BOTAN_HAS_AES)
          std::unique_ptr<Botan::Cipher_Mode> enc(
-            Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::ENCRYPTION));
+            Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::Cipher_Dir::Encryption));
          std::unique_ptr<Botan::Cipher_Mode> dec(
-            Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::DECRYPTION));
+            Botan::Cipher_Mode::create("AES-128/CBC/PKCS7", Botan::Cipher_Dir::Decryption));
 
          const std::vector<uint8_t> key(16, 0xAA);
          const std::vector<uint8_t> iv(16, 0xAA);
@@ -338,9 +338,9 @@ class Cipher_Mode_IV_Carry_Tests final : public Test
          Test::Result result("CFB IV carry");
 #if defined(BOTAN_HAS_MODE_CFB) && defined(BOTAN_HAS_AES)
          std::unique_ptr<Botan::Cipher_Mode> enc(
-            Botan::Cipher_Mode::create("AES-128/CFB(8)", Botan::ENCRYPTION));
+            Botan::Cipher_Mode::create("AES-128/CFB(8)", Botan::Cipher_Dir::Encryption));
          std::unique_ptr<Botan::Cipher_Mode> dec(
-            Botan::Cipher_Mode::create("AES-128/CFB(8)", Botan::DECRYPTION));
+            Botan::Cipher_Mode::create("AES-128/CFB(8)", Botan::Cipher_Dir::Decryption));
 
          const std::vector<uint8_t> key(16, 0xAA);
          const std::vector<uint8_t> iv(16, 0xAB);
@@ -387,9 +387,9 @@ class Cipher_Mode_IV_Carry_Tests final : public Test
 #if defined(BOTAN_HAS_CTR_BE) && defined(BOTAN_HAS_AES)
 
          std::unique_ptr<Botan::Cipher_Mode> enc(
-            Botan::Cipher_Mode::create("AES-128/CTR-BE", Botan::ENCRYPTION));
+            Botan::Cipher_Mode::create("AES-128/CTR-BE", Botan::Cipher_Dir::Encryption));
          std::unique_ptr<Botan::Cipher_Mode> dec(
-            Botan::Cipher_Mode::create("AES-128/CTR-BE", Botan::DECRYPTION));
+            Botan::Cipher_Mode::create("AES-128/CTR-BE", Botan::Cipher_Dir::Decryption));
 
          const std::vector<uint8_t> key =
             Botan::hex_decode("2B7E151628AED2A6ABF7158809CF4F3C");
diff --git a/src/tests/test_siv.cpp b/src/tests/test_siv.cpp
index 4b11c8bb9..c838be555 100644
--- a/src/tests/test_siv.cpp
+++ b/src/tests/test_siv.cpp
@@ -35,7 +35,7 @@ class SIV_Tests final : public Text_Based_Test
 
          Test::Result result(siv_name);
 
-         auto siv = Botan::AEAD_Mode::create(siv_name, Botan::ENCRYPTION);
+         auto siv = Botan::AEAD_Mode::create(siv_name, Botan::Cipher_Dir::Encryption);
 
          if(!siv)
             {