"github.com/minio/minio/internal/logger"
)

type sses3 struct{}

var (
	// S3 represents AWS SSE-S3. It provides functionality to handle
	// SSE-S3 requests.
	S3 = sses3{}

	_ Type = S3
)

// String returns the SSE domain as string. For SSE-S3 the
// domain is "SSE-S3".
func (sses3) String() string { return "SSE-S3" }

func (sses3) IsRequested(h http.Header) bool {

		return nil
	}
	sseKMS := crypto.S3KMS.IsEncrypted(objInfo.UserDefined)
	sseS3 := crypto.S3.IsEncrypted(objInfo.UserDefined)
	if !sseKMS && !sseS3 { // neither sse-s3 nor sse-kms disallowed
		return errInvalidEncryptionParameters
	}
	if sseKMS && r.Encryption.Type == sses3 { // previously encrypted with sse-kms, now sse-s3 disallowed
		return errInvalidEncryptionParameters
	}

- **SSE-S3**: The MinIO server en/decrypts an object with a secret key managed by a KMS. Therefore, MinIO requires a valid KMS configuration for [SSE-S3](#sses3).

### Server-Side Encryption - Preliminaries

#### Secret Keys

	if err != nil {
		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
		return
	}

	if isEncrypted {
		sseS3 := crypto.S3.IsRequested(r.Header) || crypto.S3.IsEncrypted(mi.UserDefined)
		partInfo.ETag = tryDecryptETag(objectEncryptionKey[:], partInfo.ETag, sseS3)
	}

	response := generateCopyObjectPartResponse(partInfo.ETag, partInfo.LastModified)
	encodedSuccessResponse := encodeResponse(response)

func tryDecryptETag(key []byte, encryptedETag string, sses3 bool) string {
	// ETag for SSE-C or SSE-KMS encrypted objects need not be content MD5Sum.While encrypted
	// md5sum is stored internally, return just the last 32 bytes of hex-encoded and
	// encrypted md5sum string for SSE-C
	if !sses3 {
		return encryptedETag[len(encryptedETag)-32:]
	}
	var objectKey crypto.ObjectKey

	sseC := crypto.SSEC.IsRequested(r.Header)
	sseS3 := crypto.S3.IsRequested(r.Header)
	sseKMS := crypto.S3KMS.IsRequested(r.Header)

	isSourceEncrypted := sseCopyC || sseCopyS3 || sseCopyKMS
	isTargetEncrypted := sseC || sseS3 || sseKMS

	if sseC {
		newKey, err = ParseSSECustomerRequest(r)
		if err != nil {

command: go run ctr_amd64_asm.go -out ../../ctr_amd64.s. DO NOT EDIT. //go:build !purego #include "textflag.h" // func ctrBlocks1Asm(nr int, xk *[60]uint32, dst *[16]byte, src *[16]byte, ivlo uint64, ivhi uint64) // Requires: AES, SSE, SSE2, SSE4.1, SSSE3 TEXT ·ctrBlocks1Asm(SB), $0-48 MOVQ nr+0(FP), AX MOVQ xk+8(FP), CX MOVQ dst+16(FP), DX MOVQ src+24(FP), BX MOVQ ivlo+32(FP), SI MOVQ ivhi+40(FP), DI MOVOU bswapMask<>+0(SB), X0 MOVQ SI, X1 PINSRQ $0x01, DI, X1 PSHUFB X0, X1 MOVUPS (CX), X0 PXOR X0,...

command: go run ctr_amd64_asm.go -out ../../ctr_amd64.s. DO NOT EDIT. //go:build !purego #include "textflag.h" // func ctrBlocks1Asm(nr int, xk *[60]uint32, dst *[16]byte, src *[16]byte, ivlo uint64, ivhi uint64) // Requires: AES, SSE, SSE2, SSE4.1, SSSE3 TEXT ·ctrBlocks1Asm(SB), $0-48 MOVQ nr+0(FP), AX MOVQ xk+8(FP), CX MOVQ dst+16(FP), DX MOVQ src+24(FP), BX MOVQ ivlo+32(FP), SI MOVQ ivhi+40(FP), DI MOVOU bswapMask<>+0(SB), X0 MOVQ SI, X1 PINSRQ $0x01, DI, X1 PSHUFB X0, X1 MOVUPS (CX), X0 PXOR X0,...