#### Key rotation - Basic Operation

The MinIO server supports key rotation for SSE-S3 encrypted objects. The minio server decrypts the OEK using the current encrypted data key and the master key ID of the object metadata. If this succeeds, the server requests a new data key from the KMS using the master key ID of the **current MinIO KMS configuration** and re-wraps the *OEK* with a new *KEK* derived from the new data key / EK:

##### Figure 3 - KMS data key rotation

 *
 * <ul>
 *   <li><b>collision-resistant:</b> while the definition above requires making at least <i>some</i>
 *       token attempt, one measure of the quality of a hash function is <i>how well</i> it succeeds
 *       at this goal. Important note: it may be easy to achieve the theoretical minimum collision
 *       rate when using completely <i>random</i> sample input. The true test of a hash function is

 *
 * <ul>
 *   <li><b>collision-resistant:</b> while the definition above requires making at least <i>some</i>
 *       token attempt, one measure of the quality of a hash function is <i>how well</i> it succeeds
 *       at this goal. Important note: it may be easy to achieve the theoretical minimum collision
 *       rate when using completely <i>random</i> sample input. The true test of a hash function is

    // lockD -> lockA
    lockD.lock();
    lockA.lock();
    lockA.unlock();
    lockD.unlock();

    // lockA -> lockD should warn but otherwise succeed because lockD was
    // created by a factory with the WARN policy.
    lockA.lock();
    lockD.lock();
  }

  public void testReentrantLock_tryLock() throws Exception {

   * expectedOldValue} with {@code newValue} and returns true; otherwise, this method returns false.
   *
   * <p>If {@code expectedOldValue} is zero, this method will succeed if {@code (key, zero)} is
   * currently in the map, or if {@code key} is not in the map at all.
   */
  boolean replace(K key, long expectedOldValue, long newValue) {
    if (expectedOldValue == 0L) {

		switch c := sn[i]; {
		case c < '0' || c > '9':
			return time.Time{}, ErrHeader
		case i < len(nanoDigits):
			nanoDigits[i] = c
		}
	}
	nsecs, _ := strconv.ParseInt(string(nanoDigits[:]), 10, 64) // Must succeed after validation
	if len(ss) > 0 && ss[0] == '-' {
		return time.Unix(secs, -1*nsecs), nil // Negative correction
	}
	return time.Unix(secs, nsecs), nil
}

            // or completion values.
            newFuture.setFuture(oldFuture);
          } else if (outputFuture.isCancelled() && taskExecutor.trySetCancelled()) {
            // If this CAS succeeds, we know that the provided callable will never be invoked,
            // so when oldFuture completes it is safe to allow the next submitted task to

        // The code returns true on line 281 when signatures DON'T match
        boolean result = verifyDigest.verify(data, 0, data.length, 0, mockRequest);

        // The verification should succeed (return false) since we're using the same key
        assertFalse(result);
    }

    @Test
    @DisplayName("Test verify method with unsigned response")
    void testVerifyWithUnsignedResponse() {

        executor.shutdown();

        // Then - Verify results
        assertEquals(threadCount * operationsPerThread, successCount.get(), "All encryption operations should succeed");
        assertEquals(threadCount * operationsPerThread, encrypted.size(), "Should have encrypted results for each message");

   * of this queue less the current {@code size} of this queue.
   *
   * <p>Note that you cannot always tell if an attempt to insert an element will succeed by
   * inspecting {@code remainingCapacity} because it may be the case that another thread is about to
   * insert or remove an element.
   */
  @CanIgnoreReturnValue
  @Override
  public int remainingCapacity() {