- For instructions on using KES for encrypting the MinIO backend, follow the [KMS Quick Start](https://github.com/minio/minio/tree/master/docs/kms). The SSE-S3 configuration setup also supports MinIO KMS backend encryption.

## FAQ

> Why is this change needed?

Before, there were two separate mechanisms - S3 objects got encrypted using a KMS,

	clientETag, err := etag.FromContentMD5(formValues)
	if err != nil {
		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrInvalidDigest), r.URL)
		return
	}

	var forceMD5 []byte
	// Optimization: If SSE-KMS and SSE-C did not request Content-Md5. Use uuid as etag. Optionally enable this also
	// for server that is started with `--no-compat`.
	kind, _ := crypto.IsRequested(formValues)

  an older version you must use an `S3 API client` such as [`mc`](https://github.com/minio/mc).

- All features currently used by your buckets will work as is without any changes
  - SSE (Server Side Encryption)
  - Replication (Server Side Replication)

## Prerequisites

- It is assumed you have users created and configured with relevant access policies, to start with

				}
				defer logger.AuditLog(r.Context(), w, r, mustGetClaimsFromToken(r))
				writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrInvalidBucketName), r.URL)
				return
			}
		}
		// Deny SSE-C requests if not made over TLS
		if !globalIsTLS && (crypto.SSEC.IsRequested(r.Header) || crypto.SSECopy.IsRequested(r.Header)) {
			if r.Method == http.MethodHead {
				if ok {
					tc.FuncName = "handler.ValidRequest"

		rand.Read(md5sumCurr)
		appendHyphen = true
	}
	if p.sealMD5Fn != nil {
		md5sumCurr = p.sealMD5Fn(md5sumCurr)
	}
	if appendHyphen {
		// Make sure to return etag string upto 32 length, for SSE
		// requests ETag might be longer and the code decrypting the
		// ETag ignores ETag in multipart ETag form i.e <hex>-N
		return hex.EncodeToString(md5sumCurr)[:32] + "-1"
	}
	return hex.EncodeToString(md5sumCurr)

		}
		// Make sure to return object info to provide extra information.
		return &GetObjectReader{
			ObjInfo: objInfo,
		}, toObjectErr(errMethodNotAllowed, bucket, object)
	}

	// Set NoDecryption for SSE-C objects and if replication request
	if crypto.SSEC.IsEncrypted(objInfo.UserDefined) && opts.ReplicationRequest {
		opts.NoDecryption = true
	}

	if objInfo.Size == 0 {

		if err != nil {
			return wrapSRErr(err)
		}
		return nil
	}

	return nil
}

// PeerBucketSSEConfigHandler - copies/deletes SSE config to local cluster.
func (c *SiteReplicationSys) PeerBucketSSEConfigHandler(ctx context.Context, bucket string, sseConfig *string, updatedAt time.Time) error {
	// skip overwrite if local update is newer than peer update.

SUBQ $0x10, BX ADDQ $0x10, DX DECQ CX JNZ Lexp_dec_loop MOVUPS -16(BX), X0 MOVUPS X0, 16(DX) RET // func _expand_key_128<>() // Requires: SSE, SSE2 TEXT _expand_key_128<>(SB), NOSPLIT, $0 PSHUFD $0xff, X1, X1 SHUFPS $0x10, X0, X4 PXOR X4, X0 SHUFPS $0x8c, X0, X4 PXOR X4, X0 PXOR X1, X0 MOVUPS X0, (BX) ADDQ $0x10, BX RET // func _expand_key_192a<>() // Requires: SSE, SSE2 TEXT _expand_key_192a<>(SB), NOSPLIT, $0 PSHUFD $0x55, X1, X1 SHUFPS $0x10, X0, X4 PXOR X4, X0 SHUFPS $0x8c, X0, X4 PXOR X4, X0 PXOR...

    <glob pattern="*.skp"/>
    <glob pattern="*.skd"/>
    <glob pattern="*.skt"/>
    <glob pattern="*.skm"/>
  </mime-type>
  <mime-type type="application/vnd.kodak-descriptor">
    <glob pattern="*.sse"/>
  </mime-type>
  <mime-type type="application/vnd.liberty-request+xml"/>
  <mime-type type="application/vnd.llamagraphics.life-balance.desktop">
    <glob pattern="*.lbd"/>
  </mime-type>