Tom Tresansky <******@****.***> 1697026569 -0400

Tom Tresansky <******@****.***> 1697026569 -0400

Tom Tresansky <******@****.***> 1697026569 -0400

Tom Tresansky <******@****.***> 1697026569 -0400

	}
	return &KMS{
		Type:       Builtin,
		DefaultKey: keyID,
		conn: secretKey{
			keyID: keyID,
			key:   key,
		},
		latencyBuckets: defaultLatencyBuckets,
		latency:        make([]atomic.Uint64, len(defaultLatencyBuckets)),
	}, nil
}

// secretKey is a KMS implementation that derives new DEKs
// from a single key.
type secretKey struct {
	keyID string
	key   []byte
}

public class IgnoredKey implements Comparable<IgnoredKey> {
    private final String keyId;
    private final String reason;

    public IgnoredKey(String keyId, @Nullable String reason) {
        this.keyId = keyId.toUpperCase(Locale.ROOT);
        this.reason = reason;
    }

    public String getKeyId() {
        return keyId;
    }

    @Nullable
    public String getReason() {
        return reason;
    }

        return readSecretKey(keyRingCollection, normalizeKeyId(keyId), sourceDescription);
    }

    protected PGPSecretKey readSecretKey(PGPSecretKeyRingCollection keyRings, final PgpKeyId keyId, String sourceDescription) {
        PGPSecretKey key = findSecretKey(keyRings, keyId);
        if (key == null) {
            throw new InvalidUserDataException("did not find secret key for id '" + keyId + "' in key source '" + sourceDescription + "'");
        }

            if (keyId.getBytes(StandardCharsets.US_ASCII).length < 40) {
                throw new InvalidGpgKeyIdsException(Collections.singletonList(keyId));
            } else {
                this.keyId = keyId.toUpperCase(Locale.ROOT);
            }
        }

        public String getKeyId() {
            return keyId;
        }

        @Override

// KMS master key ID nor a sealed KMS data key it returns an empty keyID and
// KMS data key. Otherwise, it returns an error.
func (sses3) ParseMetadata(metadata map[string]string) (keyID string, kmsKey []byte, sealedKey SealedKey, err error) {
	// Extract all required values from object metadata
	b64IV, ok := metadata[MetaIV]
	if !ok {
		return keyID, kmsKey, sealedKey, errMissingInternalIV
	}

//
// ### SSE-S3 and KMS
//
// SSE-S3 requires that the KMS provides two functions:
//
//  1. Generate(KeyID) -> (Key, EncKey)
//
//  2. Unseal(KeyID, EncKey) -> Key
//
//  1. Encrypt:
//     Input: KeyID, bucket, object, metadata, object_data
//     -     Key, EncKey := Generate(KeyID)
//     -              IV := Random({0,1}²⁵⁶)
//     -       ObjectKey := SHA256(Key, Random({0,1}²⁵⁶))