#### Secret Keys

The MinIO server uses a unique, randomly generated secret key per object also known as, Object Encryption Key ([OEK](#oek)). Neither the client-provided SSE-C key nor the KMS-managed key is directly used to en/decrypt an object. Instead, the OEK is stored as part of the object metadata next to the object in an encrypted form. To en/decrypt the OEK another secret key is needed also known as, Key Encryption Key ([KEK](#kek)).

      return;
    }
    fail("Should get not equal to equal object error");
  }

  /**
   * Test for an invalid hashCode method, i.e., one that returns different value for objects that
   * are equal according to the equals method
   */
  public void testInvalidHashCode() {
    Object a = new InvalidHashCodeObject(1, 2);
    Object b = new InvalidHashCodeObject(1, 2);
    equalsTester.addEqualityGroup(a, b);

    Set<Object> observed = Sets.newIdentityHashSet(); // for the sake of weakly referenced locks.
    // this gets the stripes with #getAt(index)
    for (int i = 0; i < striped.size(); i++) {
      Object object = striped.getAt(i);
      assertThat(object).isNotNull();
      assertSame(object, striped.getAt(i)); // idempotent
      observed.add(object);
    }

    Set<Object> observed = Sets.newIdentityHashSet(); // for the sake of weakly referenced locks.
    // this gets the stripes with #getAt(index)
    for (int i = 0; i < striped.size(); i++) {
      Object object = striped.getAt(i);
      assertThat(object).isNotNull();
      assertSame(object, striped.getAt(i)); // idempotent
      observed.add(object);
    }

	return key, err
}

// UnsealObjectsKeys extracts and decrypts all sealed object keys
// from the metadata using the KMS and returns the decrypted object
// keys.
//
// The metadata, buckets and objects slices must have the same length.
func (s3 sses3) UnsealObjectKeys(ctx context.Context, k *kms.KMS, metadata []map[string]string, buckets, objects []string) ([]ObjectKey, error) {
	if k == nil {

@GwtCompatible
@NullMarked
final class Platform {
  /** Serializes and deserializes the specified object. */
  @SuppressWarnings("unchecked")
  static <T> T reserialize(T object) {
    checkNotNull(object);
    ByteArrayOutputStream bytes = new ByteArrayOutputStream();
    try {
      ObjectOutputStream out = new ObjectOutputStream(bytes);
      out.writeObject(object);

}

// ListObjectsV2MHandler - GET Bucket (List Objects) Version 2 with metadata.
// --------------------------
// This implementation of the GET operation returns some or all (up to 1000)
// of the objects in a bucket. You can use the request parameters as selection
// criteria to return a subset of the objects in a bucket.
//
// NOTE: It is recommended that this API to be used for application development.

			metaErr = metadata(object.Name, policy.GetObjectAction)
			lastObjMetaName = object.Name
		}
		content := ObjectVersion{}
		content.Key = s3EncodeName(object.Name, encodingType)
		content.LastModified = amztime.ISO8601Format(object.ModTime.UTC())
		if object.ETag != "" {
			content.ETag = "\"" + object.ETag + "\""
		}
		content.Size = object.Size

    @Override
    public boolean containsKey(@Nullable Object key) {
      Object obverseValue = key;
      return obverse.containsValue(obverseValue);
    }

    @Override
    public boolean containsValue(@Nullable Object value) {
      Object obverseKey = value;
      return obverse.containsKey(obverseKey);
    }

    @Override
    public @Nullable K get(@Nullable Object key) {
      Object obverseValue = key;

		"Total number of objects replicated to the target",
		bucketL, targetArnL)
	bucketReplTotalFailedBytesMD = NewCounterMD(bucketReplTotalFailedBytes,
		"Total number of bytes failed at least once to replicate since server start",
		bucketL, targetArnL)
	bucketReplTotalFailedCountMD = NewCounterMD(bucketReplTotalFailedCount,
		"Total number of objects which failed replication since server start",