// Prekey and signed prekey store
7969
func (s *store) preKeysFilePath(id uint32) string {
	return filepath.Join(s.preKeysDir, idToFilename(id))
}
658618
func (ks *KeyStore) SignTx(account *Account, tx *Transaction, chainID *BigInt) (*Transaction, error) {
	if chainID == nil { // Null passed from mobile app
		chainID = new(BigInt)
	}
	signed, err := ks.keystore.SignTx(account.account, tx.tx, chainID.bigint)
	if err != nil {
		return nil, err
	}
	return &Transaction{signed}, nil
}
509734
func (s SigningKeySigner) Sign(
	ctx context.Context, data []byte) (SignatureInfo, error) {
	return s.Key.Sign(data), nil
}
580569
func barcodeKey(bcode barcode.Barcode) string {
	return bcode.Metadata().CodeKind + bcode.Content()
}
146028
func (s *GlobalStore) keys(addr *common.Address, startKey []byte, limit int) (keys mock.Keys, err error) {
	iter := s.db.NewIterator(nil, nil)
	defer iter.Release()

	if limit <= 0 {
		limit = mock.DefaultLimit
	}

	prefix := []byte{indexForHashesPrefix}
	if addr != nil {
		prefix = indexForHashesPerNodePrefix(*addr)
	}
	if startKey != nil {
		if addr != nil {
			startKey = indexForHashesPerNode(*addr, startKey)
		} else {
			startKey = indexForHashes(startKey)
		}
	} else {
		startKey = prefix
	}

	ok := iter.Seek(startKey)
	if !ok {
		return keys, iter.Error()
	}
	for ; ok; ok = iter.Next() {
		k := iter.Key()
		if !bytes.HasPrefix(k, prefix) {
			break
		}
		key := append([]byte(nil), bytes.TrimPrefix(k, prefix)...)

		if len(keys.Keys) >= limit {
			keys.Next = key
			break
		}

		keys.Keys = append(keys.Keys, key)
	}
	return keys, iter.Error()
}
1160159
func maybeTweakPrivKey(signDesc *input.SignDescriptor,
	privKey *btcec.PrivateKey) (*btcec.PrivateKey, error) {

	var retPriv *btcec.PrivateKey
	switch {

	case signDesc.SingleTweak != nil:
		retPriv = input.TweakPrivKey(privKey,
			signDesc.SingleTweak)

	case signDesc.DoubleTweak != nil:
		retPriv = input.DeriveRevocationPrivKey(privKey,
			signDesc.DoubleTweak)

	default:
		retPriv = privKey
	}

	return retPriv, nil
}
1303377
func presignedGet(host, bucket, object string, expiry int64, creds auth.Credentials, region string) string {
	accessKey := creds.AccessKey
	secretKey := creds.SecretKey

	date := UTCNow()
	dateStr := date.Format(iso8601Format)
	credential := fmt.Sprintf("%s/%s", accessKey, getScope(date, region))

	var expiryStr = "604800" // Default set to be expire in 7days.
	if expiry < 604800 && expiry > 0 {
		expiryStr = strconv.FormatInt(expiry, 10)
	}

	query := url.Values{}
	query.Set("X-Amz-Algorithm", signV4Algorithm)
	query.Set("X-Amz-Credential", credential)
	query.Set("X-Amz-Date", dateStr)
	query.Set("X-Amz-Expires", expiryStr)
	query.Set("X-Amz-SignedHeaders", "host")
	queryStr := s3utils.QueryEncode(query)

	path := "/" + path.Join(bucket, object)

	// "host" is the only header required to be signed for Presigned URLs.
	extractedSignedHeaders := make(http.Header)
	extractedSignedHeaders.Set("host", host)
	canonicalRequest := getCanonicalRequest(extractedSignedHeaders, unsignedPayload, queryStr, path, "GET")
	stringToSign := getStringToSign(canonicalRequest, date, getScope(date, region))
	signingKey := getSigningKey(secretKey, date, region, serviceS3)
	signature := getSignature(signingKey, stringToSign)

	// Construct the final presigned URL.
	return host + s3utils.EncodePath(path) + "?" + queryStr + "&" + "X-Amz-Signature=" + signature
}
1363366
func PrecomputeKeys(count int) KeygenOption {
	return func(k *Keygen) error {
		k.precomputeCount = count
		return nil
	}
}
116221
func (m Map) SignedBase64(key string) (string, error) {
	base64, err := m.Base64()
	if err != nil {
		return "", err
	}

	sig := HashWithKey(base64, key)
	return base64 + SignatureSeparator + sig, nil
}
906387
func keyPrefix(key []byte) (pre prefix) {
	if len(key) >= prefixSize {
		return *(*prefix)(unsafe.Pointer(&key[0]))
	}
	copy(pre[:], key)
	return pre
}
1328539
func (c *ClientConn) loadPrivateKey(typ, data string) (err error) {
	requestMap := &map[string]interface{}{}

	var k = keyPayload{
		Typ:  typ,
		Data: data,
	}

	if err = ConvertToGeneral(k, requestMap); err != nil {
		return fmt.Errorf("error creating request: %v", err)
	}

	msg, err := c.Request("load-key", *requestMap)
	if msg["success"] != "yes" {
		return fmt.Errorf("unsuccessful loadPrivateKey: %v", msg["success"])
	}

	return nil
}
255803
func (k ED25519PrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) (signature []byte, err error) {
	priv := make([]byte, ed25519.PrivateKeySize)
	// The ed25519 key is serialized as public key then private key, so just use private key here.
	copy(priv, k.private[ed25519.PublicKeySize:])
	return ed25519.Sign(ed25519.PrivateKey(priv), msg)[:], nil
}
107607
func (m *MemStore) Keys(prefix string) ([]string, error) {
	m.mutex.Lock()
	defer m.mutex.Unlock()
	mk := make([]string, len(m.store))
	i := 0
	for key := range m.store {
		if strings.HasPrefix(key, prefix) {
			mk[i] = key
			i++
		}
	}
	if i == 0 {
		return []string{}, NewKeyNotFound(prefix)
	}
	return mk[0:i], nil
}
873844
func (cr *CredRequest) Sign(sk handlers.Big, ipk handlers.IssuerPublicKey, nonce []byte) (res []byte, err error) {
	defer func() {
		if r := recover(); r != nil {
			res = nil
			err = errors.Errorf("failure [%s]", r)
		}
	}()

	isk, ok := sk.(*Big)
	if !ok {
		return nil, errors.Errorf("invalid user secret key, expected *Big, got [%T]", sk)
	}
	iipk, ok := ipk.(*IssuerPublicKey)
	if !ok {
		return nil, errors.Errorf("invalid issuer public key, expected *IssuerPublicKey, got [%T]", ipk)
	}
	if len(nonce) != cryptolib.FieldBytes {
		return nil, errors.Errorf("invalid issuer nonce, expected length %d, got %d", cryptolib.FieldBytes, len(nonce))
	}

	rng := cr.NewRand()

	credRequest := cryptolib.NewCredRequest(
		isk.E,
		nonce,
		iipk.PK,
		rng)

	return proto.Marshal(credRequest)
}
285290
func (priv *DSAPrivateKey) Sign(rand io.Reader, hashed []byte) ([]byte, error) {
	r, s, err := dsa.Sign(rand, &priv.PrivateKey, hashed)
	if err == nil {
		rBytes := r.Bytes()
		sBytes := s.Bytes()

		out := make([]byte, 40)
		copy(out[20-len(rBytes):], rBytes)
		copy(out[len(out)-len(sBytes):], sBytes)
		return out, nil
	}
	return nil, err
}
1176022
func ParseSigningKeyStorePEM(keyPEM, certPEM string) (*SigningKeyStore, error) {
	_, err := ParseCertificatePEM([]byte(certPEM))
	if err != nil {
		return nil, trace.Wrap(err)
	}
	key, err := ParsePrivateKeyPEM([]byte(keyPEM))
	if err != nil {
		return nil, trace.Wrap(err)
	}
	rsaKey, ok := key.(*rsa.PrivateKey)
	if !ok {
		return nil, trace.BadParameter("key of type %T is not supported, only RSA keys are supported for signatures", key)
	}
	certASN, _ := pem.Decode([]byte(certPEM))
	if certASN == nil {
		return nil, trace.BadParameter("expected PEM-encoded block")
	}
	return &SigningKeyStore{privateKey: rsaKey, cert: certASN.Bytes}, nil
}
415880
func (s Store) ECPrivateKey() (*ecdsa.PrivateKey, bool) {
	v, ok := s[ECPrivateKey]
	if !ok {
		return nil, false
	}
	z, ok := v.(*ecdsa.PrivateKey)
	return z, ok
}