t.Errorf("Test %d: got sealed key '%v' - want sealed key '%v'", i, sealedKey.Key, test.SealedKey.Key)
		}
		if !bytes.Equal(sealedKey.IV[:], test.SealedKey.IV[:]) {
			t.Errorf("Test %d: got sealed key IV '%v' - want sealed key IV '%v'", i, sealedKey.IV, test.SealedKey.IV)
		}
	}
}

var ssecParseMetadataTests = []struct {
	Metadata    map[string]string
	ExpectedErr error

	SealedKey SealedKey
}{

	}

	iv := DB.Table(`table_invoices`).Select(`seller, SUM(total) as total, SUM(paid) as paid, SUM(balance) as balance`).Group(`seller`)
	stmt = dryDB.Table(`table_employees`).Select(`id, name, iv.total, iv.paid, iv.balance`).Joins(`LEFT JOIN (?) AS iv ON iv.seller = table_employees.id`, iv).Scan(&user).Statement

	"X-Minio-Internal-Server-Side-Encryption-Seal-Algorithm": "X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm",
	"X-Minio-Internal-Server-Side-Encryption-Iv":             "X-Minio-Replication-Server-Side-Encryption-Iv",
	"X-Minio-Internal-Encrypted-Multipart":                   "X-Minio-Replication-Encrypted-Multipart",
	"X-Minio-Internal-Actual-Object-Size":                    "X-Minio-Replication-Actual-Object-Size",

`KEK := PRF(EK, IV, context_values)` where:

- [EK](#ek): is the external key. In case of SSE-C this is the client-provided key. In case of SSE-S3  this is secret key generated by the KMS. For further details see [SSE-C](#Server-Side-Encryption-with-client-provided-Keys) or [SSE-S3](#Server-Side-Encryption-with-a-KMS).

                    designated);

                ii. a copyright notice;

               iii. a notice that refers to this Public License;

                iv. a notice that refers to the disclaimer of
                    warranties;

                 v. a URI or hyperlink to the Licensed Material to the
                    extent reasonably practicable;

including direct, indirect, special, incidental and consequential damages,
such as lost profits;

iii) states that any provisions which differ from this Agreement are offered
by that Contributor alone and not by any other party; and

iv) states that source code for the Program is available from such Contributor,
and informs licensees how to obtain it in a reasonable manner on or through
a medium customarily used for software exchange.

		}
		if kdf, ok := test.metadata[crypto.MetaAlgorithm]; !ok {
			t.Errorf("Test %d: ServerSideEncryptionKDF must be part of metadata: %v", i, kdf)
		}
		if iv, ok := test.metadata[crypto.MetaIV]; !ok {
			t.Errorf("Test %d: crypto.SSEIV must be part of metadata: %v", i, iv)
		}
		if mac, ok := test.metadata[crypto.MetaSealedKeySSEC]; !ok {
			t.Errorf("Test %d: ServerSideEncryptionKeyMAC must be part of metadata: %v", i, mac)
		}
	}
}

	// SSECustomerKeySize is the size of valid client provided encryption keys in bytes.
	// Currently AWS supports only AES256. So the SSE-C key size is fixed to 32 bytes.
	SSECustomerKeySize = 32

	// SSEIVSize is the size of the IV data
	SSEIVSize = 32 // 32 bytes

	// SSEDAREPackageBlockSize - SSE dare package block size.
	SSEDAREPackageBlockSize = 64 * 1024 // 64KiB bytes

	// SSEDAREPackageMetaSize - SSE dare package meta padding bytes.

^ößp[€ãljw[¸ °š´ørFHÔÂ.ï|c}ªcYiSqxJ cV}|ôGEªãdj†Sò; ÷SléˆL\ãltgM¢Nmªtñ|zG¼XãZyqòi€t^ku¼ ¼ BQˆ™Ž 2’ÀDàjezÄ rS8ãtî]Ù>‘Œ¸ †‰¸‘$/TgxÜ`àzÜþƒ% °`ûFq Kô*Ñå HÌò ñTˆøqËFIˆÇs^P¢jû~qÙcê|µMul qnãNde즦 GpN ?Ÿ(tŸ÷Ù atþ9 »ÊF`û~ Sãxj¯}iBr¼kñqiyhn¼TW KjôUs¼ÜTãLByy¨^i¾IZï?iv); v{rp_– !Iïºdi* Åt± _u znM¾@{ 9fh# EoAC_q†Üs„ZñRV†£ ºÌöjhàYfúêqTKAQô|½I}t¾—­cst7ayTûPCµV[pGGÀ|üà˜Ô PyG¼å}}uKXHªOïz ¦Løm†ãIV_|}¾Rcna Õ¥ ´ wq4¸}VFfW®ÈñT@¨Ö[^iCªtñ„VXw²Pm\}D òxªl[`K_ ^}zwr`kFˆinñRe’¸ CD¼aÈ9eL&1 UxˆLø%„LWXKªû ¾hBChèû)~ UeGÔÂhjhÕpÔFqNqyy~hŸåup¨7—jozE...

		ssecRepHeaders := []string{
			"X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm",
			"X-Minio-Replication-Server-Side-Encryption-Sealed-Key",
			"X-Minio-Replication-Server-Side-Encryption-Iv",
		}
		ssecRep := false
		for _, header := range ssecRepHeaders {
			if val := r.Header.Get(header); val != "" {
				ssecRep = true
				break
			}
		}
		if !(ssecRep && sourceReplReq) {