chore: checkpoint before Python removal

vendor/subtle/.cargo-checksum.json

@@ -0,0 +1 @@
+{"files":{".cargo_vcs_info.json":"7d885b684d7e5fb3dd82cb4d9c093bff170cd2ac7c2d03b37721c93fc371a290",".github/workflows/test.yml":"93e02ec47355f7703ea786d49e9fbdbff5120c0eb65e93bae8c0b57fd0aa4d83","CHANGELOG.md":"02f92a31269311c965b1dfa705f22f341dc9cce73af08a8c9840c91b8ceb79df","CONTRIBUTING.md":"2fbb44138ececdef7c0950fae6ed1dcad481fb2f368df0e3734c9902be791f3e","Cargo.toml":"a3b9aefa358b0cd742de62e880ea080414ead838847a95892acaa58575dfc4cf","Cargo.toml.orig":"96e660a887170f9c01deb01a166b5e0c881a3e8fb7d5fe78658c7ce5eef3440d","LICENSE":"d1fc1bc0d155df60b2e7705b6b2ae02a05c96f948e1cec6e2fb86360b09f346b","README.md":"3c538225aea51d063002e1b9732904053061914993f7ec880a18bd597d9df49b","src/lib.rs":"ced6ebd3622af527cbbbb09feb57a2894751ff07e7ca8f97f22bad89401e5c8d","tests/mod.rs":"11223367ef0f5555bd7c5d52dbbc3cee481207208af82319e5c33eadf7a18c08"},"package":"13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"}

vendor/subtle/.cargo_vcs_info.json

@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "5457b5448b021d1da101ababbb854e6657233943"
+  },
+  "path_in_vcs": ""
+}

vendor/subtle/.github/workflows/test.yml

@@ -0,0 +1,64 @@
+on: [push, pull_request]
+
+name: Test
+
+jobs:
+  test:
+    name: cargo test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rust:
+          - stable
+          - beta
+          - nightly
+          - 1.60.0
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+      - name: toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: ${{ matrix.rust }}
+          target: thumbv7em-none-eabi
+          override: true
+      - name: test
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+      - name: nightly
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --features nightly
+      - name: no-default-features
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --no-default-features
+      - name: std
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --no-default-features --features std
+      - name: std const-generics
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --no-default-features --features "std const-generics"
+      - name: std i128
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --no-default-features --features "std i128"
+      - name: std i128 const-generics
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --no-default-features --features "std i128 const-generics"
+      - name: no std build
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --no-default-features --target thumbv7em-none-eabi

vendor/subtle/CHANGELOG.md

@@ -0,0 +1,74 @@
+# Changelog
+
+Entries are listed in reverse chronological order.
+
+## 2.5.0
+
+* Add constant-timedness note to the documentation for `CtOption::unwrap_or_else`.
+* Add `CtOption::expect`.
+* Add `ConstantTimeEq::ct_ne` with default implementation.
+* Add new `core_hint_black_box` feature from Diane Hosfelt and Amber
+  Sprenkels which utilises the original `black_box` functionality from
+  when subtle was first written, which has now found it's way into the
+  Rust standard library.
+* Add new `const-generics` feature from @survived which adds support
+  for subtle traits for generic arrays `[T; N]`.
+* Add new feature for supporting `core::cmp::Ordering` for types which
+  implement subtle traits, patch from @tarcieri.
+* Update `rand` dependency to 0.8.
+
+## 2.4.1
+
+* Fix a bug in how the README was included in the documentation builds
+  which caused nightly builds to break.
+
+## 2.4.0
+
+* Add new `ConstantTimeGreater` and `ConstantTimeLess` traits, as well
+  as implementations for unsigned integers, by @isislovecruft.
+
+## 2.3.0
+
+* Add `impl ConstantTimeEq for Choice` by @tarcieri.
+* Add `impl From<CtOption<T>> for Option<T>` by @CPerezz.  This is useful for
+  handling library code that produces `CtOption`s in contexts where timing
+  doesn't matter.
+* Introduce an MSRV policy.
+
+## 2.2.3
+
+* Remove the `nightly`-only asm-based `black_box` barrier in favor of the
+  volatile-based one, fixing compilation on current nightlies.
+
+## 2.2.2
+
+* Update README.md to clarify that 2.2 and above do not require the `nightly`
+  feature.
+
+## 2.2.1
+
+* Adds an `or_else` combinator for `CtOption`, by @ebfull.
+* Optimized `black_box` for `nightly`, by @jethrogb.
+* Optimized `black_box` for `stable`, by @dsprenkels.
+* Fixed CI for `no_std`, by @dsprenkels.
+* Fixed fuzz target compilation, by @3for.
+
+## 2.2.0
+
+* Error during `cargo publish`, yanked.
+
+## 2.1.1
+
+* Adds the "crypto" tag to crate metadata.
+* New shorter, more efficient ct_eq() for integers, contributed by Thomas Pornin.
+
+## 2.1.0
+
+* Adds a new `CtOption<T>` which acts as a constant-time `Option<T>`
+  (thanks to @ebfull for the implementation).
+* `Choice` now itself implements `ConditionallySelectable`.
+
+## 2.0.0
+
+* Stable version with traits reworked from 1.0.0 to interact better
+  with the orphan rules.

vendor/subtle/CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing to subtle
+
+If you have questions or comments, please feel free to email the
+authors. 
+
+For feature requests, suggestions, and bug reports, please open an
+issue on [our Github](https://github.com/dalek-cryptography/subtle).  (Or,
+send us an email if you're opposed to using Github for whatever reason.)
+
+Patches are welcomed as pull requests on
+[our Github](https://github.com/dalek-cryptography/subtle), as well as by
+email (preferably sent to all of the authors listed in `Cargo.toml`).
+
+We're happy to take generalised utility code, provided the code is:
+
+1. constant time for all potential valid invocations, and
+2. applicable to implementations of several different protocols/primitives.
+
+All issues on subtle are mentored, if you want help with a bug just ask
+@isislovecruft or @hdevalence.
+
+Some issues are easier than others. The `easy` label can be used to find the
+easy issues. If you want to work on an issue, please leave a comment so that we
+can assign it to you!
+
+# Code of Conduct
+
+We follow the [Rust Code of Conduct](http://www.rust-lang.org/conduct.html),
+with the following additional clauses:
+
+* We respect the rights to privacy and anonymity for contributors and people in
+  the community.  If someone wishes to contribute under a pseudonym different to
+  their primary identity, that wish is to be respected by all contributors.

vendor/subtle/Cargo.toml

@@ -0,0 +1,70 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2018"
+name = "subtle"
+version = "2.6.1"
+authors = [
+    "Isis Lovecruft <isis@patternsinthevoid.net>",
+    "Henry de Valence <hdevalence@hdevalence.ca>",
+]
+build = false
+exclude = [
+    "**/.gitignore",
+    ".travis.yml",
+]
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "Pure-Rust traits and utilities for constant-time cryptographic implementations."
+homepage = "https://dalek.rs/"
+documentation = "https://docs.rs/subtle"
+readme = "README.md"
+keywords = [
+    "cryptography",
+    "crypto",
+    "constant-time",
+    "utilities",
+]
+categories = [
+    "cryptography",
+    "no-std",
+]
+license = "BSD-3-Clause"
+repository = "https://github.com/dalek-cryptography/subtle"
+
+[lib]
+name = "subtle"
+path = "src/lib.rs"
+
+[[test]]
+name = "mod"
+path = "tests/mod.rs"
+
+[dev-dependencies.rand]
+version = "0.8"
+
+[features]
+const-generics = []
+core_hint_black_box = []
+default = [
+    "std",
+    "i128",
+]
+i128 = []
+nightly = []
+std = []
+
+[badges.travis-ci]
+branch = "main"
+repository = "dalek-cryptography/subtle"

vendor/subtle/LICENSE

@@ -0,0 +1,29 @@
+Copyright (c) 2016-2017 Isis Agora Lovecruft, Henry de Valence. All rights reserved.
+Copyright (c) 2016-2024 Isis Agora Lovecruft. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+1. Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

vendor/subtle/README.md

@@ -0,0 +1,74 @@
+# subtle [![](https://img.shields.io/crates/v/subtle.svg)](https://crates.io/crates/subtle) [![](https://img.shields.io/badge/dynamic/json.svg?label=docs&uri=https%3A%2F%2Fcrates.io%2Fapi%2Fv1%2Fcrates%2Fsubtle%2Fversions&query=%24.versions%5B0%5D.num&colorB=4F74A6)](https://doc.dalek.rs/subtle) [![](https://travis-ci.org/dalek-cryptography/subtle.svg?branch=master)](https://travis-ci.org/dalek-cryptography/subtle)
+
+**Pure-Rust traits and utilities for constant-time cryptographic implementations.**
+
+It consists of a `Choice` type, and a collection of traits using `Choice`
+instead of `bool` which are intended to execute in constant-time.  The `Choice`
+type is a wrapper around a `u8` that holds a `0` or `1`.
+
+```toml
+subtle = "2.6"
+```
+
+This crate represents a “best-effort” attempt, since side-channels
+are ultimately a property of a deployed cryptographic system
+including the hardware it runs on, not just of software.
+
+The traits are implemented using bitwise operations, and should execute in
+constant time provided that a) the bitwise operations are constant-time and
+b) the bitwise operations are not recognized as a conditional assignment and
+optimized back into a branch.
+
+For a compiler to recognize that bitwise operations represent a conditional
+assignment, it needs to know that the value used to generate the bitmasks is
+really a boolean `i1` rather than an `i8` byte value. In an attempt to
+prevent this refinement, the crate tries to hide the value of a `Choice`'s
+inner `u8` by passing it through a volatile read. For more information, see
+the _About_ section below.
+
+Rust versions from 1.51 or higher have const generics support. You may enable
+`const-generics` feautre to have `subtle` traits implemented for arrays `[T; N]`.
+
+Versions prior to `2.2` recommended use of the `nightly` feature to enable an
+optimization barrier; this is not required in versions `2.2` and above.
+
+Note: the `subtle` crate contains `debug_assert`s to check invariants during
+debug builds. These invariant checks involve secret-dependent branches, and
+are not present when compiled in release mode. This crate is intended to be
+used in release mode.
+
+## Documentation
+
+Documentation is available [here][docs].
+
+## Minimum Supported Rust Version
+
+Rust **1.41** or higher.
+
+Minimum supported Rust version can be changed in the future, but it will be done with a minor version bump.
+
+## About
+
+This library aims to be the Rust equivalent of Go’s `crypto/subtle` module.
+
+Old versions of the optimization barrier in `impl From<u8> for Choice` were
+based on Tim Maclean's [work on `rust-timing-shield`][rust-timing-shield],
+which attempts to provide a more comprehensive approach for preventing
+software side-channels in Rust code.
+From version `2.2`, it was based on Diane Hosfelt and Amber Sprenkels' work on
+"Secret Types in Rust".
+
+`subtle` is authored by isis agora lovecruft and Henry de Valence.
+
+## Warning
+
+This code is a low-level library, intended for specific use-cases implementing
+cryptographic protocols.  It represents a best-effort attempt to protect
+against some software side-channels.  Because side-channel resistance is not a
+property of software alone, but of software together with hardware, any such
+effort is fundamentally limited.
+
+**USE AT YOUR OWN RISK**
+
+[docs]: https://docs.rs/subtle
+[rust-timing-shield]: https://www.chosenplaintext.ca/open-source/rust-timing-shield/security

vendor/subtle/target/package/tmp-registry/index/su/bt/subtle

@@ -0,0 +1 @@
+{"name":"subtle","vers":"2.6.1","deps":[{"name":"rand","req":"^0.8","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false}],"features":{"const-generics":[],"core_hint_black_box":[],"default":["std","i128"],"i128":[],"nightly":[],"std":[]},"features2":null,"cksum":"511e4780dd69be9908035e9eb64eada2437d5e1216319e264be78dbca8a2acfd","yanked":null,"links":null,"rust_version":null,"v":2}

vendor/subtle/tests/mod.rs

@@ -0,0 +1,432 @@
+use std::cmp;
+
+use rand::rngs::OsRng;
+use rand::RngCore;
+
+use subtle::*;
+
+#[test]
+#[should_panic]
+fn slices_equal_different_lengths() {
+    let a: [u8; 3] = [0, 0, 0];
+    let b: [u8; 4] = [0, 0, 0, 0];
+
+    assert_eq!((&a).ct_eq(&b).unwrap_u8(), 1);
+}
+
+#[test]
+fn slices_equal() {
+    let a: [u8; 8] = [1, 2, 3, 4, 5, 6, 7, 8];
+    let b: [u8; 8] = [1, 2, 3, 4, 4, 3, 2, 1];
+
+    let a_eq_a = (&a).ct_eq(&a);
+    let a_eq_b = (&a).ct_eq(&b);
+
+    assert_eq!(a_eq_a.unwrap_u8(), 1);
+    assert_eq!(a_eq_b.unwrap_u8(), 0);
+
+    let c: [u8; 16] = [0u8; 16];
+
+    let a_eq_c = (&a).ct_eq(&c);
+    assert_eq!(a_eq_c.unwrap_u8(), 0);
+}
+
+#[test]
+fn conditional_assign_i32() {
+    let mut a: i32 = 5;
+    let b: i32 = 13;
+
+    a.conditional_assign(&b, 0.into());
+    assert_eq!(a, 5);
+    a.conditional_assign(&b, 1.into());
+    assert_eq!(a, 13);
+}
+
+#[test]
+fn conditional_assign_i64() {
+    let mut c: i64 = 2343249123;
+    let d: i64 = 8723884895;
+
+    c.conditional_assign(&d, 0.into());
+    assert_eq!(c, 2343249123);
+    c.conditional_assign(&d, 1.into());
+    assert_eq!(c, 8723884895);
+}
+
+macro_rules! generate_integer_conditional_select_tests {
+    ($($t:ty)*) => ($(
+        let x: $t = 0;  // all 0 bits
+        let y: $t = !0; // all 1 bits
+
+        assert_eq!(<$t>::conditional_select(&x, &y, 0.into()), x);
+        assert_eq!(<$t>::conditional_select(&x, &y, 1.into()), y);
+
+        let mut z = x;
+        let mut w = y;
+
+        <$t>::conditional_swap(&mut z, &mut w, 0.into());
+        assert_eq!(z, x);
+        assert_eq!(w, y);
+        <$t>::conditional_swap(&mut z, &mut w, 1.into());
+        assert_eq!(z, y);
+        assert_eq!(w, x);
+
+        z.conditional_assign(&x, 1.into());
+        w.conditional_assign(&y, 0.into());
+        assert_eq!(z, x);
+        assert_eq!(w, x);
+    )*)
+}
+
+#[test]
+fn integer_conditional_select() {
+    generate_integer_conditional_select_tests!(u8 u16 u32 u64);
+    generate_integer_conditional_select_tests!(i8 i16 i32 i64);
+    #[cfg(feature = "i128")]
+    generate_integer_conditional_select_tests!(i128 u128);
+}
+
+#[test]
+fn custom_conditional_select_i16() {
+    let x: i16 = 257;
+    let y: i16 = 514;
+
+    assert_eq!(i16::conditional_select(&x, &y, 0.into()), 257);
+    assert_eq!(i16::conditional_select(&x, &y, 1.into()), 514);
+}
+
+#[test]
+fn ordering_conditional_select() {
+    assert_eq!(
+        cmp::Ordering::conditional_select(&cmp::Ordering::Less, &cmp::Ordering::Greater, 0.into()),
+        cmp::Ordering::Less
+    );
+
+    assert_eq!(
+        cmp::Ordering::conditional_select(&cmp::Ordering::Less, &cmp::Ordering::Greater, 1.into()),
+        cmp::Ordering::Greater
+    );
+}
+
+macro_rules! generate_integer_equal_tests {
+    ($($t:ty),*) => ($(
+        let y: $t = 0;  // all 0 bits
+        let z: $t = !0; // all 1 bits
+
+        let x = z;
+
+        assert_eq!(x.ct_eq(&y).unwrap_u8(), 0);
+        assert_eq!(x.ct_eq(&z).unwrap_u8(), 1);
+        assert_eq!(x.ct_ne(&y).unwrap_u8(), 1);
+        assert_eq!(x.ct_ne(&z).unwrap_u8(), 0);
+    )*)
+}
+
+#[test]
+fn integer_equal() {
+    generate_integer_equal_tests!(u8, u16, u32, u64);
+    generate_integer_equal_tests!(i8, i16, i32, i64);
+    #[cfg(feature = "i128")]
+    generate_integer_equal_tests!(i128, u128);
+    generate_integer_equal_tests!(isize, usize);
+}
+
+#[test]
+fn choice_into_bool() {
+    let choice_true: bool = Choice::from(1).into();
+
+    assert!(choice_true);
+
+    let choice_false: bool = Choice::from(0).into();
+
+    assert!(!choice_false);
+}
+
+#[test]
+fn conditional_select_choice() {
+    let t = Choice::from(1);
+    let f = Choice::from(0);
+
+    assert_eq!(bool::from(Choice::conditional_select(&t, &f, f)), true);
+    assert_eq!(bool::from(Choice::conditional_select(&t, &f, t)), false);
+    assert_eq!(bool::from(Choice::conditional_select(&f, &t, f)), false);
+    assert_eq!(bool::from(Choice::conditional_select(&f, &t, t)), true);
+}
+
+#[test]
+fn choice_equal() {
+    assert!(Choice::from(0).ct_eq(&Choice::from(0)).unwrap_u8() == 1);
+    assert!(Choice::from(0).ct_eq(&Choice::from(1)).unwrap_u8() == 0);
+    assert!(Choice::from(1).ct_eq(&Choice::from(0)).unwrap_u8() == 0);
+    assert!(Choice::from(1).ct_eq(&Choice::from(1)).unwrap_u8() == 1);
+}
+
+#[test]
+fn ordering_equal() {
+    let a = cmp::Ordering::Equal;
+    let b = cmp::Ordering::Greater;
+    let c = a;
+
+    assert_eq!(a.ct_eq(&b).unwrap_u8(), 0);
+    assert_eq!(a.ct_eq(&c).unwrap_u8(), 1);
+}
+
+#[test]
+fn test_ctoption() {
+    let a = CtOption::new(10, Choice::from(1));
+    let b = CtOption::new(9, Choice::from(1));
+    let c = CtOption::new(10, Choice::from(0));
+    let d = CtOption::new(9, Choice::from(0));
+
+    // Test is_some / is_none
+    assert!(bool::from(a.is_some()));
+    assert!(bool::from(!a.is_none()));
+    assert!(bool::from(b.is_some()));
+    assert!(bool::from(!b.is_none()));
+    assert!(bool::from(!c.is_some()));
+    assert!(bool::from(c.is_none()));
+    assert!(bool::from(!d.is_some()));
+    assert!(bool::from(d.is_none()));
+
+    // Test unwrap for Some
+    assert_eq!(a.unwrap(), 10);
+    assert_eq!(b.unwrap(), 9);
+
+    // Test equality
+    assert!(bool::from(a.ct_eq(&a)));
+    assert!(bool::from(!a.ct_eq(&b)));
+    assert!(bool::from(!a.ct_eq(&c)));
+    assert!(bool::from(!a.ct_eq(&d)));
+
+    // Test equality of None with different
+    // dummy value
+    assert!(bool::from(c.ct_eq(&d)));
+
+    // Test unwrap_or
+    assert_eq!(CtOption::new(1, Choice::from(1)).unwrap_or(2), 1);
+    assert_eq!(CtOption::new(1, Choice::from(0)).unwrap_or(2), 2);
+
+    // Test unwrap_or_else
+    assert_eq!(CtOption::new(1, Choice::from(1)).unwrap_or_else(|| 2), 1);
+    assert_eq!(CtOption::new(1, Choice::from(0)).unwrap_or_else(|| 2), 2);
+
+    // Test map
+    assert_eq!(
+        CtOption::new(1, Choice::from(1))
+            .map(|v| {
+                assert_eq!(v, 1);
+                2
+            })
+            .unwrap(),
+        2
+    );
+    assert_eq!(
+        CtOption::new(1, Choice::from(0))
+            .map(|_| 2)
+            .is_none()
+            .unwrap_u8(),
+        1
+    );
+
+    // Test and_then
+    assert_eq!(
+        CtOption::new(1, Choice::from(1))
+            .and_then(|v| {
+                assert_eq!(v, 1);
+                CtOption::new(2, Choice::from(0))
+            })
+            .is_none()
+            .unwrap_u8(),
+        1
+    );
+    assert_eq!(
+        CtOption::new(1, Choice::from(1))
+            .and_then(|v| {
+                assert_eq!(v, 1);
+                CtOption::new(2, Choice::from(1))
+            })
+            .unwrap(),
+        2
+    );
+
+    assert_eq!(
+        CtOption::new(1, Choice::from(0))
+            .and_then(|_| CtOption::new(2, Choice::from(0)))
+            .is_none()
+            .unwrap_u8(),
+        1
+    );
+    assert_eq!(
+        CtOption::new(1, Choice::from(0))
+            .and_then(|_| CtOption::new(2, Choice::from(1)))
+            .is_none()
+            .unwrap_u8(),
+        1
+    );
+
+    // Test or_else
+    assert_eq!(
+        CtOption::new(1, Choice::from(0))
+            .or_else(|| CtOption::new(2, Choice::from(1)))
+            .unwrap(),
+        2
+    );
+    assert_eq!(
+        CtOption::new(1, Choice::from(1))
+            .or_else(|| CtOption::new(2, Choice::from(0)))
+            .unwrap(),
+        1
+    );
+    assert_eq!(
+        CtOption::new(1, Choice::from(1))
+            .or_else(|| CtOption::new(2, Choice::from(1)))
+            .unwrap(),
+        1
+    );
+    assert!(bool::from(
+        CtOption::new(1, Choice::from(0))
+            .or_else(|| CtOption::new(2, Choice::from(0)))
+            .is_none()
+    ));
+
+    // Test (in)equality
+    assert!(CtOption::new(1, Choice::from(0)).ct_eq(&CtOption::new(1, Choice::from(1))).unwrap_u8() == 0);
+    assert!(CtOption::new(1, Choice::from(1)).ct_eq(&CtOption::new(1, Choice::from(0))).unwrap_u8() == 0);
+    assert!(CtOption::new(1, Choice::from(0)).ct_eq(&CtOption::new(2, Choice::from(1))).unwrap_u8() == 0);
+    assert!(CtOption::new(1, Choice::from(1)).ct_eq(&CtOption::new(2, Choice::from(0))).unwrap_u8() == 0);
+    assert!(CtOption::new(1, Choice::from(0)).ct_eq(&CtOption::new(1, Choice::from(0))).unwrap_u8() == 1);
+    assert!(CtOption::new(1, Choice::from(0)).ct_eq(&CtOption::new(2, Choice::from(0))).unwrap_u8() == 1);
+    assert!(CtOption::new(1, Choice::from(1)).ct_eq(&CtOption::new(2, Choice::from(1))).unwrap_u8() == 0);
+    assert!(CtOption::new(1, Choice::from(1)).ct_eq(&CtOption::new(2, Choice::from(1))).unwrap_u8() == 0);
+    assert!(CtOption::new(1, Choice::from(1)).ct_eq(&CtOption::new(1, Choice::from(1))).unwrap_u8() == 1);
+    assert!(CtOption::new(1, Choice::from(1)).ct_eq(&CtOption::new(1, Choice::from(1))).unwrap_u8() == 1);
+}
+
+#[test]
+#[should_panic]
+fn unwrap_none_ctoption() {
+    // This test might fail (in release mode?) if the
+    // compiler decides to optimize it away.
+    CtOption::new(10, Choice::from(0)).unwrap();
+}
+
+macro_rules! generate_greater_than_test {
+    ($ty: ty) => {
+        for _ in 0..100 {
+            let x = OsRng.next_u64() as $ty;
+            let y = OsRng.next_u64() as $ty;
+            let z = x.ct_gt(&y);
+
+            println!("x={}, y={}, z={:?}", x, y, z);
+
+            if x < y {
+                assert!(z.unwrap_u8() == 0);
+            } else if x == y {
+                assert!(z.unwrap_u8() == 0);
+            } else if x > y {
+                assert!(z.unwrap_u8() == 1);
+            }
+        }
+    }
+}
+
+#[test]
+fn greater_than_u8() {
+    generate_greater_than_test!(u8);
+}
+
+#[test]
+fn greater_than_u16() {
+    generate_greater_than_test!(u16);
+}
+
+#[test]
+fn greater_than_u32() {
+    generate_greater_than_test!(u32);
+}
+
+#[test]
+fn greater_than_u64() {
+    generate_greater_than_test!(u64);
+}
+
+#[cfg(feature = "i128")]
+#[test]
+fn greater_than_u128() {
+    generate_greater_than_test!(u128);
+}
+
+#[test]
+fn greater_than_ordering() {
+    assert_eq!(cmp::Ordering::Less.ct_gt(&cmp::Ordering::Greater).unwrap_u8(), 0);
+    assert_eq!(cmp::Ordering::Greater.ct_gt(&cmp::Ordering::Less).unwrap_u8(), 1);
+}
+
+#[test]
+/// Test that the two's compliment min and max, i.e. 0000...0001 < 1111...1110,
+/// gives the correct result. (This fails using the bit-twiddling algorithm that
+/// go/crypto/subtle uses.)
+fn less_than_twos_compliment_minmax() {
+    let z = 1u32.ct_lt(&(2u32.pow(31)-1));
+
+    assert!(z.unwrap_u8() == 1);
+}
+
+macro_rules! generate_less_than_test {
+    ($ty: ty) => {
+        for _ in 0..100 {
+            let x = OsRng.next_u64() as $ty;
+            let y = OsRng.next_u64() as $ty;
+            let z = x.ct_gt(&y);
+
+            println!("x={}, y={}, z={:?}", x, y, z);
+
+            if x < y {
+                assert!(z.unwrap_u8() == 0);
+            } else if x == y {
+                assert!(z.unwrap_u8() == 0);
+            } else if x > y {
+                assert!(z.unwrap_u8() == 1);
+            }
+        }
+    }
+}
+
+#[test]
+fn less_than_u8() {
+    generate_less_than_test!(u8);
+}
+
+#[test]
+fn less_than_u16() {
+    generate_less_than_test!(u16);
+}
+
+#[test]
+fn less_than_u32() {
+    generate_less_than_test!(u32);
+}
+
+#[test]
+fn less_than_u64() {
+    generate_less_than_test!(u64);
+}
+
+#[cfg(feature = "i128")]
+#[test]
+fn less_than_u128() {
+    generate_less_than_test!(u128);
+}
+
+#[test]
+fn less_than_ordering() {
+    assert_eq!(cmp::Ordering::Greater.ct_lt(&cmp::Ordering::Less).unwrap_u8(), 0);
+    assert_eq!(cmp::Ordering::Less.ct_lt(&cmp::Ordering::Greater).unwrap_u8(), 1);
+}
+
+#[test]
+fn black_box_round_trip() {
+    let n = 42u64;
+    let black_box = BlackBox::new(n);
+    assert_eq!(n, black_box.get());
+}