// NewSaltedCipher creates a returns a Cipher that folds a salt into its key
// schedule. For most purposes, NewCipher, instead of NewSaltedCipher, is
// sufficient and desirable. For bcrypt compatiblity, the key can be over 56
// bytes.
500750
func NewSaltedCipher(key, salt []byte) (*Cipher, error) {
	var result Cipher
	k := len(key)
	if k < 4 {
		return nil, KeySizeError(k)
	}
	initCipher(key, &result)
	expandKeyWithSalt(key, salt, &result)
	return &result, nil
}
455865
func NewCipherReader(r io.Reader, mask [4]byte) *CipherReader {
	return &CipherReader{r, mask, 0}
}
717106
func NewSecring() *Secring {
	return &Secring{
		data: &xcpb.Secring{
			PrivateKeys: make([]*xcpb.PrivateKey, 0, 10),
		},
	}
}
915552
func newDecryptionReader(r *io.SectionReader, f *File) (io.Reader, error) {
	keyLen := aesKeyLen(f.aesStrength)
	saltLen := keyLen / 2 // salt is half of key len
	if saltLen == 0 {
		return nil, ErrDecryption
	}
	// grab the salt and pwvv
	saltpwvv := make([]byte, saltLen+2)
	if _, err := r.Read(saltpwvv); err != nil {
		return nil, err
	}
	salt := saltpwvv[:saltLen]
	pwvv := saltpwvv[saltLen : saltLen+2]
	// generate keys only if we have a password
	if f.password == nil {
		return nil, ErrPassword
	}
	decKey, authKey, pwv := generateKeys(f.password(), salt, keyLen)
	if !checkPasswordVerification(pwv, pwvv) {
		return nil, ErrPassword
	}
	dataOff := int64(saltLen + 2)
	dataLen := int64(f.CompressedSize64 - uint64(saltLen) - 2 - 10)
	// // TODO(alex): Should the compressed sizes be fixed?
	// // Not the ideal place to do this.
	// f.CompressedSize64 = uint64(dataLen)
	// f.CompressedSize = uint32(dataLen)
	data := io.NewSectionReader(r, dataOff, dataLen)
	authOff := dataOff + dataLen
	authcode := io.NewSectionReader(r, authOff, 10)
	ar := newAuthReader(authKey, data, authcode, f.DeferAuth)
	dr := decryptStream(decKey, ar)
	if dr == nil {
		return nil, ErrDecryption
	}
	return dr, nil
}
1254995
func newSelfSignedCertificate(ssconfig selfSignedConfig) (tls.Certificate, error) {
	// start by generating private key
	var privKey interface{}
	var err error
	switch ssconfig.KeyType {
	case "", certcrypto.EC256:
		privKey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	case certcrypto.EC384:
		privKey, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
	case certcrypto.RSA2048:
		privKey, err = rsa.GenerateKey(rand.Reader, 2048)
	case certcrypto.RSA4096:
		privKey, err = rsa.GenerateKey(rand.Reader, 4096)
	case certcrypto.RSA8192:
		privKey, err = rsa.GenerateKey(rand.Reader, 8192)
	default:
		return tls.Certificate{}, fmt.Errorf("cannot generate private key; unknown key type %v", ssconfig.KeyType)
	}
	if err != nil {
		return tls.Certificate{}, fmt.Errorf("failed to generate private key: %v", err)
	}

	// create certificate structure with proper values
	notBefore := time.Now()
	notAfter := ssconfig.Expire
	if notAfter.IsZero() || notAfter.Before(notBefore) {
		notAfter = notBefore.Add(24 * time.Hour * 7)
	}
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return tls.Certificate{}, fmt.Errorf("failed to generate serial number: %v", err)
	}
	cert := &x509.Certificate{
		SerialNumber: serialNumber,
		Subject:      pkix.Name{Organization: []string{"Caddy Self-Signed"}},
		NotBefore:    notBefore,
		NotAfter:     notAfter,
		KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
	}
	if len(ssconfig.SAN) == 0 {
		ssconfig.SAN = []string{""}
	}
	for _, san := range ssconfig.SAN {
		if ip := net.ParseIP(san); ip != nil {
			cert.IPAddresses = append(cert.IPAddresses, ip)
		} else {
			cert.DNSNames = append(cert.DNSNames, strings.ToLower(san))
		}
	}

	// generate the associated public key
	publicKey := func(privKey interface{}) interface{} {
		switch k := privKey.(type) {
		case *rsa.PrivateKey:
			return &k.PublicKey
		case *ecdsa.PrivateKey:
			return &k.PublicKey
		default:
			return fmt.Errorf("unknown key type")
		}
	}
	derBytes, err := x509.CreateCertificate(rand.Reader, cert, cert, publicKey(privKey), privKey)
	if err != nil {
		return tls.Certificate{}, fmt.Errorf("could not create certificate: %v", err)
	}

	chain := [][]byte{derBytes}

	return tls.Certificate{
		Certificate: chain,
		PrivateKey:  privKey,
		Leaf:        cert,
	}, nil
}
436481
func (cipher CipherFunction) new(key []byte) (block cipher.Block) {
	switch cipher {
	case Cipher3DES:
		block, _ = des.NewTripleDESCipher(key)
	case CipherCAST5:
		block, _ = cast5.NewCipher(key)
	case CipherAES128, CipherAES192, CipherAES256:
		block, _ = aes.NewCipher(key)
	}
	return
}
555951
func NewLKSecForEncrypt(m MetaContext, ui SecretUI, uid keybase1.UID) (ret *LKSec, err error) {
	m = m.WithUIs(UIs{SecretUI: ui})
	pps, err := GetPassphraseStreamStored(m)
	if err != nil {
		return nil, err
	}
	ret = NewLKSec(pps, uid)
	return ret, nil
}
554610
func (wc *WhisperClient) NewSymmetricKey(ctx *Context) (string, error) {
	return wc.client.NewSymmetricKey(ctx.context)
}
686609
func (c *blockCipher128) keySchedule(key []byte) {
	r0 := uint32(key[0])<<24 | uint32(key[1])<<16 | uint32(key[2])<<8 | uint32(key[3])
	r1 := uint32(key[4])<<24 | uint32(key[5])<<16 | uint32(key[6])<<8 | uint32(key[7])
	r2 := uint32(key[8])<<24 | uint32(key[9])<<16 | uint32(key[10])<<8 | uint32(key[11])
	r3 := uint32(key[12])<<24 | uint32(key[13])<<16 | uint32(key[14])<<8 | uint32(key[15])

	k := &(c.sk)

	k[0], k[1], k[2], k[3] = r0, r1, r2, r3

	f(&r0, &r1, &r2, &r3, sigma[0], sigma[1])
	f(&r2, &r3, &r0, &r1, sigma[2], sigma[3])

	r0 ^= k[0]
	r1 ^= k[1]
	r2 ^= k[2]
	r3 ^= k[3]
	f(&r0, &r1, &r2, &r3, sigma[4], sigma[5])
	f(&r2, &r3, &r0, &r1, sigma[6], sigma[7])

	k[4], k[5], k[6], k[7] = r0, r1, r2, r3
	rotl128(&r0, &r1, &r2, &r3, 15) // KA <<< 15
	k[12], k[13], k[14], k[15] = r0, r1, r2, r3
	rotl128(&r0, &r1, &r2, &r3, 15) // KA <<< 30
	k[16], k[17], k[18], k[19] = r0, r1, r2, r3
	rotl128(&r0, &r1, &r2, &r3, 15) // KA <<< 45
	k[24] = r0
	k[25] = r1
	rotl128(&r0, &r1, &r2, &r3, 15) // KA <<< 60
	k[28], k[29], k[30], k[31] = r0, r1, r2, r3
	rotl128(&r1, &r2, &r3, &r0, 2) // KA <<< 94
	k[40], k[41], k[42], k[43] = r1, r2, r3, r0
	rotl128(&r1, &r2, &r3, &r0, 17) // KA <<<111
	k[48], k[49], k[50], k[51] = r1, r2, r3, r0

	r0, r1, r2, r3 = k[0], k[1], k[2], k[3]
	rotl128(&r0, &r1, &r2, &r3, 15) // KL <<< 15
	k[8], k[9], k[10], k[11] = r0, r1, r2, r3
	rotl128(&r0, &r1, &r2, &r3, 30) // KL <<< 45
	k[20], k[21], k[22], k[23] = r0, r1, r2, r3
	rotl128(&r0, &r1, &r2, &r3, 15) // KL <<< 60
	k[26] = r2
	k[27] = r3
	rotl128(&r0, &r1, &r2, &r3, 17) // KL <<< 77
	k[32], k[33], k[34], k[35] = r0, r1, r2, r3
	rotl128(&r0, &r1, &r2, &r3, 17) // KL <<< 94
	k[36], k[37], k[38], k[39] = r0, r1, r2, r3
	rotl128(&r0, &r1, &r2, &r3, 17) // KL <<<111
	k[44], k[45], k[46], k[47] = r0, r1, r2, r3
}
901851
func Crypt(key, salt string) string {
	data := C.struct_crypt_data{}
	ckey := C.CString(key)
	csalt := C.CString(salt)
	out := C.GoString(C.crypt_r(ckey, csalt, &data))
	C.free(unsafe.Pointer(ckey))
	C.free(unsafe.Pointer(csalt))
	return out
}
170896
func NewSecured(s string) (secured, error) {
	var e secured
	err := e.FromString(s)
	if err != nil {
		return 0, err
	}
	return e, nil
}
965253
func NewCipher(key []byte) (Block, error) {
	k := len(key)
	switch k {
	default:
		return nil, KeySizeError(k)
	case 16, 24, 32:
		break
	}
	return newCipher(key)
}
735851
func NewSize(size int) (*Cipher, error) {
    var err error
    var internal cipherInternal

    switch size {
    case 256:
        internal, err = newThreefish256(nil, nil)
    case 512:
        internal, err = newThreefish512(nil, nil)
    case 1024:
        internal, err = newThreefish1024(nil, nil)
    default:
        return nil, KeySizeError(size)
    }
    return &Cipher{size, internal}, err
}
208110
func Decrypt(payload []byte, secret string) ([]byte, error) {
	salt := payload[:saltLength]
	key := encryptionKeyToBytes(secret, string(salt))

	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}

	// The IV needs to be unique, but not secure. Therefore it's common to
	// include it at the beginning of the ciphertext.
	if len(payload) < aes.BlockSize {
		return nil, errors.New("payload too short")
	}
	iv := payload[saltLength : saltLength+aes.BlockSize]
	payload = payload[saltLength+aes.BlockSize:]
	payloadDst := make([]byte, len(payload))

	stream := cipher.NewCFBDecrypter(block, iv)

	// XORKeyStream can work in-place if the two arguments are the same.
	stream.XORKeyStream(payloadDst, payload)
	return payloadDst, nil
}
1297791
func NewCipher(key []byte) (cipher.Block, error) {
	k := len(key)
	if k == 16 {
		c := new(blockCipher128)
		c.keySchedule(key)
		return c, nil
	}
	if k == 24 || k == 32 {
		c := new(blockCipher256)
		c.keySchedule(key)
		return c, nil
	}
	return nil, crypto.KeySizeError(k)
}
169764
func NewSecretKey(password *[]byte, N, r, p int) (*SecretKey, error) {
	sk := SecretKey{
		Key: (*CryptoKey)(&[KeySize]byte{}),
	}
	// setup parameters
	sk.Parameters.N = N
	sk.Parameters.R = r
	sk.Parameters.P = p
	_, err := io.ReadFull(prng, sk.Parameters.Salt[:])
	if err != nil {
		return nil, err
	}

	// derive key
	err = sk.deriveKey(password)
	if err != nil {
		return nil, err
	}

	// store digest
	sk.Parameters.Digest = sha256.Sum256(sk.Key[:])

	return &sk, nil
}
237326
func NewCast5BlockCrypt(key []byte) (BlockCrypt, error) {
	c := new(cast5BlockCrypt)
	block, err := cast5.NewCipher(key)
	if err != nil {
		return nil, err
	}
	c.block = block
	return c, nil
}