}

        this.state++;
        return out;
    }

    /**
     * Initializes session security keys for signing and sealing.
     * @param mk the master key to derive session keys from
     */
    protected void initSessionSecurity(final byte[] mk) {
        this.signKey = deriveKey(mk, C2S_SIGN_CONSTANT);
        this.verifyKey = deriveKey(mk, S2C_SIGN_CONSTANT);

        this.length = 0;
        this.deferred = this;
    }

    /**
     * Creates a derived NdrBuffer at the specified index position.
     *
     * @param idx the index position for the derived buffer
     * @return the derived NdrBuffer
     */
    public NdrBuffer derive(final int idx) {
        final NdrBuffer nb = new NdrBuffer(this.buf, this.start);
        nb.index = idx;

        mockNdrBuffer.deferred = mockDeferredBuffer;

        // Configure mocks for NdrBuffer interactions
        lenient().when(mockDeferredBuffer.derive(anyInt())).thenReturn(mockDeferredBuffer);
        lenient().doNothing().when(mockDeferredBuffer).advance(anyInt());
        // Set up index field for derive operations
        mockDeferredBuffer.index = 0;
    }

    @Nested
    @DisplayName("Protocol Information Tests")

        saltBuffer.putInt(rotationCount); // Rotation counter
        saltBuffer.putInt((int) (System.currentTimeMillis() / 1000)); // Timestamp for additional uniqueness

        // Derive new keys using SMB3 KDF with rotation-specific input
        final int dialectInt = dialect.getDialect();

            assertNull(message.getTargetInformation(), "Target information should be null when no target is set");
        }

        @Test
        @DisplayName("Constructor with CIFSContext and Type1Message should derive flags")
        void testConstructor_CIFSContext_Type1Message() {
            // Given
            CIFSContext mockContext = createMockContext();
            Type1Message type1 = new Type1Message(mockContext);

        byte[] sessionKey = new byte[16];
        byte[] preauthHash = new byte[64];
        new SecureRandom().nextBytes(sessionKey);
        new SecureRandom().nextBytes(preauthHash);

        // Derive initial keys
        int dialectInt = DialectVersion.SMB311.getDialect();
        byte[] encKey = Smb3KeyDerivation.deriveEncryptionKey(dialectInt, sessionKey, preauthHash);

        } else {
            throw new SmbUnsupportedOperationException("SMB3 required for encryption, negotiated: " + dialect);
        }

        try {
            // Derive encryption and decryption keys using SMB3 KDF
            final int dialectInt = dialect.getDialect();
            final byte[] encryptionKey = Smb3KeyDerivation.deriveEncryptionKey(dialectInt, sessionKey, preauthHash);

func (d *DecryptBlocksReader) buildDecrypter(partID int) error {
	var partIDbin [4]byte
	binary.LittleEndian.PutUint32(partIDbin[:], uint32(partID)) // marshal part ID

	mac := hmac.New(sha256.New, d.objectEncryptionKey) // derive part encryption key from part ID and object key
	mac.Write(partIDbin[:])
	partEncryptionKey := mac.Sum(nil)

	// Limit the reader, so the decryptor doesn't receive bytes
	// from the next part (different DARE stream)

import com.google.common.annotations.J2ktIncompatible;
import org.jspecify.annotations.NullUnmarked;

/** Simple derived class to verify that we handle generics correctly. */
@GwtCompatible
@NullUnmarked
class Derived extends Base {
  public Derived(String s) {
    super(s);
  }

  @GwtIncompatible @J2ktIncompatible private static final long serialVersionUID = 0;

// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package drive

import (
	"sync"
	"time"

	"github.com/minio/minio/internal/config"
	"github.com/minio/pkg/v3/env"
)

// Drive specific timeout environment variables
const (
	EnvMaxDriveTimeout       = "MINIO_DRIVE_MAX_TIMEOUT"
	EnvMaxDriveTimeoutLegacy = "_MINIO_DRIVE_MAX_TIMEOUT"