}

// SealedKey represents a sealed object key. It can be stored
// at an untrusted location.
type SealedKey struct {
	Key       [64]byte // The encrypted and authenticated object-key.
	IV        [32]byte // The random IV used to encrypt the object-key.
	Algorithm string   // The sealing algorithm used to encrypt the object key.
}

// Seal encrypts the ObjectKey using the 256 bit external key and IV. The sealed

	}
	return NewBuiltin(keyID, key)
}

// NewBuiltin returns a single-key KMS that derives new DEKs from the
// given key.
func NewBuiltin(keyID string, key []byte) (*KMS, error) {
	if len(key) != 32 {
		return nil, errors.New("kms: invalid key length " + strconv.Itoa(len(key)))
	}
	return &KMS{
		Type:       Builtin,
		DefaultKey: keyID,
		conn: secretKey{
			keyID: keyID,
			key:   key,
		},

			Key:   target.MySQLPort,
			Value: cfg.Port,
		},
		config.KV{
			Key:   target.MySQLUsername,
			Value: cfg.User,
		},
		config.KV{
			Key:   target.MySQLPassword,
			Value: cfg.Password,
		},
		config.KV{
			Key:   target.MySQLDatabase,
			Value: cfg.Database,
		},
		config.KV{
			Key:   target.MySQLQueueDir,
			Value: cfg.QueueDir,
		},
		config.KV{

  }

  public void testContainsKeyAndValue() {
    for (LoadingCache<Key, String> cache : caches()) {
      // maintain strong refs so these won't be collected, regardless of cache's key/value strength
      Key key = new Key(1);
      String value = key.toString();
      assertThat(cache.getUnchecked(key)).isSameInstanceAs(value);
      assertThat(cache.asMap().containsKey(key)).isTrue();
      assertThat(cache.asMap().containsValue(value)).isTrue();

                log.debug("Failed to remove key from KeyStore: {}", e.getMessage());
            }
        }

        log.debug("Removed and wiped session key for session: {}", sessionId);
    }

    /**
     * Derive a new key from an existing key
     *
     * @param baseKey the base key
     * @param label key derivation label
     * @param context key derivation context

			asRoot: false,

			policy: `{"Effect": "Allow",
					"Action": ["kms:KeyStatus"],
					"Resource": ["arn:minio:kms:::abc-test-*"] }`,

			wantStatusCode: http.StatusOK,
			wantResp:       []string{"abc-test-key"},
		},
		{
			name:   "key status as user set policy to allow non-matching key",
			method: http.MethodGet,
			path:   kmsKeyStatusPath,

        // Then
        assertNotNull(signingKey, "Signing key should not be null");
        assertEquals(16, signingKey.length, "Signing key should be 16 bytes");
        assertFalse(Arrays.equals(sessionKey, signingKey), "Signing key should be different from session key");
    }

    @Test
    @DisplayName("Should derive signing key for SMB 3.1.1 dialect")
    void testDeriveSigningKey_SMB311() {
        // Given

        }
    }

    /**
     * @param key
     *            7-byte "raw" DES key
     * @return 8-byte DES key with parity
     */
    static byte[] des7to8(final byte[] key) {
        final byte key8[] = new byte[8];
        key8[0] = (byte) (key[0] & 0xFE);
        key8[1] = (byte) (key[0] << 7 | (key[1] & 0xFF) >>> 1);
        key8[2] = (byte) (key[1] << 6 | (key[2] & 0xFF) >>> 2);

    /** The key of the message: Realm */
    public static final String LABELS_AUTH_REALM = "{labels.authRealm}";

    /** The key of the message: Status */
    public static final String LABELS_AVAILABLE = "{labels.available}";

    /** The key of the message: Created By */
    public static final String LABELS_CREATED_BY = "{labels.createdBy}";

    /** The key of the message: Created Time */

        assertEquals(value2, settings.array().get(key)[1]);
        assertEquals(value3, settings.array().get(key)[2]);

        settings.array().delete(key, value2);
        assertEquals(2, settings.array().get(key).length);
        assertEquals(value1, settings.array().get(key)[0]);
        assertEquals(value3, settings.array().get(key)[1]);

        settings.array().delete(key);