// encryptReaderV10 returns an io.Reader wrapping the given io.Reader.
// The returned io.Reader encrypts everything it reads using DARE 1.0.
503160
func encryptReaderV10(src io.Reader, config *Config) (*encReaderV10, error) {
	ae, err := newAuthEncV10(config)
	if err != nil {
		return nil, err
	}
	return &encReaderV10{
		authEncV10:  ae,
		src:         src,
		buffer:      make(packageV10, maxPackageSize),
		payloadSize: config.PayloadSize,
	}, nil
}
99218
func Decrypt(in io.Reader, out io.Writer, keydir string, userSuppliedPrivateKey string) error {
	data, err := ioutil.ReadAll(in)
	if err != nil {
		return err
	}

	pubkey, err := json.ExtractPublicKey(data)
	if err != nil {
		return err
	}

	privkey, err := findPrivateKey(pubkey, keydir, userSuppliedPrivateKey)
	if err != nil {
		return err
	}

	myKP := crypto.Keypair{
		Public:  pubkey,
		Private: privkey,
	}

	decrypter := myKP.Decrypter()
	walker := json.Walker{
		Action: decrypter.Decrypt,
	}

	newdata, err := walker.Walk(data)
	if err != nil {
		return err
	}

	_, err = out.Write(newdata)

	return err
}
483247
func EncryptEncodedPrivateMetadata(encodedPrivateMetadata []byte, key TLFCryptKey) (
	encryptedPrivateMetadata EncryptedPrivateMetadata, err error) {
	encryptedData, err := encryptData(encodedPrivateMetadata, key.Data())
	if err != nil {
		return EncryptedPrivateMetadata{}, err
	}

	return EncryptedPrivateMetadata{encryptedData}, nil
}
380850
func (h *KBFSHandler) EncryptFavorites(ctx context.Context,
	dataToDecrypt []byte) (res []byte, err error) {
	return encrypteddb.EncodeBox(ctx, dataToDecrypt, h.getKeyFn())
}
767393
func (ec *Envcfg) diskCertProvider(params []string) CertificateProvider {
	// "certname:keyname"
	if len(params) < 2 {
		panic("invalid certificate provider params")
	}

	dir := ec.CertPath()
	certPath, keyPath := filepath.Join(dir, params[0]), filepath.Join(dir, params[1])
	dcp, err := newDiskCertProvider(certPath, keyPath, ec.logf, ec.errf)
	if err != nil {
		panic(fmt.Sprintf("unable to load certificate and key from disk: %v", err))
	}

	return dcp
}
72640
func decryptReader(r io.Reader, config *Config) *decReader {
	return &decReader{
		config:    *config,
		src:       r,
		firstRead: true,
	}
}
515232
func EncryptFRMPayload(key AES128Key, uplink bool, devAddr DevAddr, fCnt uint32, data []byte) ([]byte, error) {
	pLen := len(data)
	if pLen%16 != 0 {
		// append with empty bytes so that len(data) is a multiple of 16
		data = append(data, make([]byte, 16-(pLen%16))...)
	}

	block, err := aes.NewCipher(key[:])
	if err != nil {
		return nil, err
	}
	if block.BlockSize() != 16 {
		return nil, errors.New("lorawan: block size of 16 was expected")
	}

	s := make([]byte, 16)
	a := make([]byte, 16)
	a[0] = 0x01
	if !uplink {
		a[5] = 0x01
	}

	b, err := devAddr.MarshalBinary()
	if err != nil {
		return nil, err
	}
	copy(a[6:10], b)
	binary.LittleEndian.PutUint32(a[10:14], uint32(fCnt))

	for i := 0; i < len(data)/16; i++ {
		a[15] = byte(i + 1)
		block.Encrypt(s, a)

		for j := 0; j < len(s); j++ {
			data[i*16+j] = data[i*16+j] ^ s[j]
		}
	}

	return data[0:pLen], nil
}
610334
func GetPasswdDecryptBytes(passphraseRetriever notary.PassRetriever, pemBytes []byte, name, alias string) (data.PrivateKey, string, error) {
	var (
		passwd  string
		privKey data.PrivateKey
	)
	for attempts := 0; ; attempts++ {
		var (
			giveup bool
			err    error
		)
		if attempts > 10 {
			return nil, "", ErrAttemptsExceeded{}
		}
		passwd, giveup, err = passphraseRetriever(name, alias, false, attempts)
		// Check if the passphrase retriever got an error or if it is telling us to give up
		if giveup || err != nil {
			return nil, "", ErrPasswordInvalid{}
		}

		// Try to convert PEM encoded bytes back to a PrivateKey using the passphrase
		privKey, err = utils.ParsePEMPrivateKey(pemBytes, passwd)
		if err == nil {
			// We managed to parse the PrivateKey. We've succeeded!
			break
		}
	}
	return privKey, passwd, nil
}
61693
func checkEncryptReceivers(receivers []BoxPublicKey) error {
	receiverCount := int64(len(receivers))
	if receiverCount <= 0 || receiverCount > maxReceiverCount {
		return ErrBadReceivers
	}

	// Make sure that each receiver only shows up in the set once.
	receiverSet := make(map[string]bool)

	// Make sure each key hasn't been used before.
	for _, receiver := range receivers {
		kid := receiver.ToKID()
		kidString := string(kid)
		if receiverSet[kidString] {
			return ErrRepeatedKey(kid)
		}
		receiverSet[kidString] = true
	}

	return nil
}
816412
func (k *Key) ExportEncryptedPrivate(password []byte) ([]byte, error) {
	var privBytes []byte
	switch priv := k.Private.(type) {
	case *rsa.PrivateKey:
		privBytes = x509.MarshalPKCS1PrivateKey(priv)
	default:
		return nil, errors.New("only RSA private key is supported")
	}

	privPEMBlock, err := x509.EncryptPEMBlock(rand.Reader, rsaPrivateKeyPEMBlockType, privBytes, password, x509.PEMCipher3DES)
	if err != nil {
		return nil, err
	}

	buf := new(bytes.Buffer)
	if err := pem.Encode(buf, privPEMBlock); err != nil {
		return nil, err
	}
	return buf.Bytes(), nil
}
1189266
func (wav Reader) GetDumbReader() (r io.Reader, err error) {
	// move reader to the first sample
	_, err = wav.input.Seek(int64(wav.firstSamplePos), os.SEEK_SET)
	if err != nil {
		return nil, err
	}

	return wav.input, nil
}
294250
func EncryptRequest(content io.Reader, r *http.Request, bucket, object string, metadata map[string]string) (reader io.Reader, objEncKey []byte, err error) {

	var (
		key []byte
	)
	if crypto.S3.IsRequested(r.Header) && crypto.SSEC.IsRequested(r.Header) {
		return nil, objEncKey, crypto.ErrIncompatibleEncryptionMethod
	}
	if crypto.SSEC.IsRequested(r.Header) {
		key, err = ParseSSECustomerRequest(r)
		if err != nil {
			return nil, objEncKey, err
		}
	}
	return newEncryptReader(content, key, bucket, object, metadata, crypto.S3.IsRequested(r.Header))
}
942456
func (c *Crypter) Encrypt(dst io.Writer, src io.Reader) (err error) {
	salt := make([]byte, c.Key.Size())
	if _, err := rand.Read(salt); err != nil {
		return err
	}
	iv := make([]byte, blockSize)
	if _, err := rand.Read(iv); err != nil {
		return err
	}

	aesKey, hmacKey := c.Key.Derive(salt)
	header := c.encHeader(salt, iv, hmacKey)
	if _, err := dst.Write(header); err != nil {
		return err
	}
	mac := hmac.New(c.HashFunc, hmacKey)
	mac.Write(header)

	block, err := aes.NewCipher(aesKey)
	if err != nil {
		return err
	}

	stream := cipher.NewCTR(block, iv)

	buf := make([]byte, c.bufSize())
	n := 0
	for {
		n, err = src.Read(buf)
		if err != nil {
			if err == io.EOF {
				break
			}
			return err
		}

		mac.Write(buf[:n])
		stream.XORKeyStream(buf[:n], buf[:n])
		if _, err = dst.Write(buf[:n]); err != nil {
			return err
		}
		if _, err = dst.Write(mac.Sum(nil)); err != nil {
			return err
		}
	}
	return nil
}
501760
func (p *PHYPayload) EncryptFRMPayload(key AES128Key) error {
	macPL, ok := p.MACPayload.(*MACPayload)
	if !ok {
		return errors.New("lorawan: MACPayload must be of type *MACPayload")
	}

	// nothing to encrypt
	if len(macPL.FRMPayload) == 0 {
		return nil
	}

	data, err := macPL.marshalPayload()
	if err != nil {
		return err
	}

	data, err = EncryptFRMPayload(key, p.isUplink(), macPL.FHDR.DevAddr, macPL.FHDR.FCnt, data)
	if err != nil {
		return err
	}

	// store the encrypted data in a DataPayload
	macPL.FRMPayload = []Payload{&DataPayload{Bytes: data}}

	return nil
}
661900
func (c *Config) EncryptBytes() ([]byte, error) {
	return base64.StdEncoding.DecodeString(c.EncryptKey)
}
975893
func (s *EncryptedStorageProvider) Reader(path ...string) (decryptReader io.ReadCloser, err error) {
	var unEncryptedReader io.ReadCloser
	stream := s.getStream()

	if unEncryptedReader, err = s.wrappedStorageProvider.Reader(path...); err == nil {

		decryptReader = &StreamReadCloser{
			StreamReader: cipher.StreamReader{S: stream, R: unEncryptedReader},
			Closer:       unEncryptedReader,
		}
	}
	return
}
69452
func (s *LKSec) EncryptClientHalfRecovery(key GenericKey) (string, error) {
	if s.clientHalf.IsNil() {
		return "", errors.New("Nil LKS Client Half")
	}
	return key.EncryptToString(s.clientHalf.Bytes(), nil)
}