- `X-Amz-Server-Side-Encryption-Customer-Key`: Base64 encoded new key.
- `X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key`: Base64 encoded current key.

Such a special COPY request is also known as S3 SSE-C key rotation.

### Server-Side Encryption with a KMS

    void testWriteUShortNegative() {
        byte[] dest = new byte[2];
        NtlmMessage.writeUShort(dest, 0, -2);
        assertArrayEquals(new byte[] { -2, -1 }, dest, "Negative short should be encoded unsigned");
    }

    @Test
    @DisplayName("writeSecurityBuffer writes zero length buffer unchanged")
    void testWriteSecurityBufferZeroLength() {
        byte[] dest = new byte[10];

    public int size() {
        // Context header (16) + name length (4) + padding to 8-byte alignment (4) + data (32)
        return 16 + 4 + 4 + STRUCTURE_SIZE;
    }

    @Override
    public int encode(byte[] dst, int dstIndex) {
        int start = dstIndex;

        // Write context header
        SMBUtil.writeInt4(0, dst, dstIndex); // Next (offset to next context, 0 for last)
        dstIndex += 4;

        System.arraycopy(this.fileId, 0, dst, dstIndex, 16);
        dstIndex += 16;

        SMBUtil.writeInt2(dstIndex - getHeaderStart(), dst, bufferOffsetOffset);
        final int len = this.info.encode(dst, dstIndex);
        SMBUtil.writeInt4(len, dst, bufferLengthOffset);
        dstIndex += len;
        return dstIndex - start;
    }

    /**
     * {@inheritDoc}
     *

	if err != nil {
		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
		return
	}

	// Call site replication hook.
	//
	// We encode the xml bytes as base64 to ensure there are no encoding
	// errors.
	cfgStr := base64.StdEncoding.EncodeToString(configData)
	replLogIf(ctx, globalSiteReplicationSys.BucketMetaHook(ctx, madmin.SRBucketMeta{

	values.Set("client_id", clientID)
	values.Set("client_secret", clientSecret)
	values.Set("grant_type", "client_credentials")

	req, err := http.NewRequest(http.MethodPost, k.oeConfig.TokenEndpoint, strings.NewReader(values.Encode()))
	if err != nil {
		return err
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	resp, err := k.client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()

  return IdnaMappingTableData(
    sections = sectionIndexBuffer.readUtf8(),
    ranges = rangesBuffer.readUtf8(),
    mappings = mappingsBuffer.toString(),
  )
}

/**
 * If [mapping] qualifies to be encoded as [MappedRange.InlineDelta] return new instance, otherwise null.
 * An [MappedRange.InlineDelta] must be a mapping from a single code-point to a single code-point with a difference
 * that can be represented in 2^18-1.
 */

  @Deprecated(
    message = "moved to val",
    replaceWith = ReplaceWith(expression = "subtype"),
    level = DeprecationLevel.ERROR,
  )
  fun subtype(): String = subtype

  /**
   * Returns the encoded media type, like "text/plain; charset=utf-8", appropriate for use in a
   * Content-Type header.
   */
  override fun toString(): String = mediaType

	// MD5 checksum.
	ErrMissingCustomerKeyMD5 = Errorf("The SSE-C request is missing the customer key MD5")

	// ErrInvalidCustomerKey indicates that the SSE-C client key is not valid - e.g. not a
	// base64-encoded string or not 256 bits long.
	ErrInvalidCustomerKey = Errorf("The SSE-C client key is invalid")

	// ErrSecretKeyMismatch indicates that the provided secret key (SSE-C client key / SSE-S3 KMS key)

  private fun String.asciiToLowercase(): String =
    when {
      isAscii() -> lowercase(Locale.US)

      // This is an ASCII string.
      else -> this
    }

  /** Returns true if the [String] is ASCII encoded (0-127). */
  private fun String.isAscii() = length == utf8Size().toInt()

  /**
   * Returns true if [hostname] matches the domain name [pattern].
   *
   * @param hostname lower-case host name.