The MinIO server runs a key-derivation algorithm to generate the KEK using a pseudo-random function ([PRF](#prf)):
`KEK := PRF(EK, IV, context_values)` where:

	}

	const randSize = 28
	random, err := sioutil.Random(randSize)
	if err != nil {
		return DEK{}, err
	}
	iv, nonce := random[:16], random[16:]

	prf := hmac.New(sha256.New, s.key)
	prf.Write(iv)
	key := prf.Sum(make([]byte, 0, prf.Size()))

	block, err := aes.NewCipher(key)
	if err != nil {
		return DEK{}, err
	}
	aead, err := cipher.NewGCM(block)
	if err != nil {
		return DEK{}, err

        final int r = 32;
        final byte[] suffix = new byte[label.length + context.length + 5];
        // per bouncycastle
        // <li>1: K(i) := PRF( KI, [i]_2 || Label || 0x00 || Context || [L]_2 ) with the counter at the very beginning
        // of the fixedInputData (The default implementation has this format)</li>
        // with the parameters

concatenation, ^ means XOR // for each block T_i = U_1 ^ U_2 ^ ... ^ U_iter // U_1 = PRF(password, salt || uint(i)) prf.Reset() prf.Write(salt) buf[0] = byte(block >> 24) buf[1] = byte(block >> 16) buf[2] = byte(block >> 8) buf[3] = byte(block) prf.Write(buf[:4]) dk = prf.Sum(dk) T := dk[len(dk)-hashLen:] copy(U, T) // U_n = PRF(password, U_(n-1)) for n := 2; n <= iter; n++ { prf.Reset() prf.Write(U) U = U[:0] U = prf.Sum(U) for x := range U { T[x] ^= U[x] } } } return dk[:keyLength], nil } func se...

concatenation, ^ means XOR // for each block T_i = U_1 ^ U_2 ^ ... ^ U_iter // U_1 = PRF(password, salt || uint(i)) prf.Reset() prf.Write(salt) buf[0] = byte(block >> 24) buf[1] = byte(block >> 16) buf[2] = byte(block >> 8) buf[3] = byte(block) prf.Write(buf[:4]) dk = prf.Sum(dk) T := dk[len(dk)-hashLen:] copy(U, T) // U_n = PRF(password, U_(n-1)) for n := 2; n <= iter; n++ { prf.Reset() prf.Write(U) U = U[:0] U = prf.Sum(U) for x := range U { T[x] ^= U[x] } } } return dk[:keyLength], nil } func se...

  <mime-type type="application/pgp-signature">
    <glob pattern="*.asc"/>
    <glob pattern="*.sig"/>
  </mime-type>

  <mime-type type="application/pics-rules">
    <glob pattern="*.prf"/>
  </mime-type>
  <mime-type type="application/pidf+xml"/>
  <mime-type type="application/pidf-diff+xml"/>
  <mime-type type="application/pkcs10">
    <glob pattern="*.p10"/>
  </mime-type>