* host platform (like Android). In July 2018 Android had 134 trusted root certificates for its HTTP
 * clients to trust.
 *
 * For example, in order to establish a secure connection to `https://www.squareup.com/`,
 * these three certificates are used.
 *
 * ```
 * www.squareup.com certificate:
 *
 * Common Name: www.squareup.com
 * Subject Alternative Names: www.squareup.com, squareup.com, account.squareup.com...

//
//	For example: ceb8853ddc5086cc4ab9e149f8f09c88-5
//
// However, this scheme is only used for multipart objects that are
// not encrypted.
//
// # Server-side Encryption
//
// S3 specifies three types of server-side-encryption - SSE-C, SSE-S3
// and SSE-KMS - with different semantics w.r.t. ETags.
// In case of SSE-S3, the ETag of an object is computed the same as

        bufferIndex++;
        if (this.wordCount != 0) {
            int n = readParameterWordsWireFormat(buffer, bufferIndex);
            if ((n != this.wordCount * 2) && log.isTraceEnabled()) {
                log.trace("wordCount * 2=" + this.wordCount * 2 + " but readParameterWordsWireFormat returned " + n);
            }
            bufferIndex += this.wordCount * 2;
        }

        byte[] fullData = concat(messageHeader(3), data);
        InputStream in = new ByteArrayInputStream(fullData);
        SocketInputStream sis = new SocketInputStream(in);

        // Read the three data bytes
        assertEquals(1, sis.read());
        assertEquals(2, sis.read());
        assertEquals(3, sis.read());

        // After consuming all data, trying to read again will attempt to read

            final int n = readBytesWireFormat(buffer, bufferIndex);
            if (n != this.byteCount && log.isTraceEnabled()) {
                log.trace("Short read, have " + n + ", want " + this.byteCount);
            }
            bufferIndex += this.byteCount;
        }

        /*
         * if there is an andx and it itself is an andx then just recur by

- `context_values`: are values like the bucket and object name and other information which should be cryptographically bound to the KEK.

To summarize for any encrypted object there exists (at least) three different keys:

- [OEK](#oek): A secret and unique key used to encrypted the object, stored in an encrypted form as part of the object metadata and only loaded to RAM in plaintext during en/decrypting the object.

    // an SSL context for an attacking webserver. It includes both these rogue certificates plus the
    // trusted good certificate above. The attack is that by including the good certificate in the
    // chain, we may trick the certificate pinner into accepting the rouge certificate.
    val compromisedIntermediateCa =
      HeldCertificate
        .Builder()
        .signedBy(rootCa)
        .certificateAuthority(0)

    LinkedHashMultimap<K, V> result = create(multimap.keySet().size(), DEFAULT_VALUE_SET_CAPACITY);
    result.putAll(multimap);
    return result;
  }

  /**
   * LinkedHashMultimap entries are in no less than three coexisting linked lists: a bucket in the
   * hash table for a {@code Set<V>} associated with a key, the linked list of insertion-ordered
   * entries in that {@code Set<V>}, and the linked list of entries in the LinkedHashMultimap as a

    LinkedHashMultimap<K, V> result = create(multimap.keySet().size(), DEFAULT_VALUE_SET_CAPACITY);
    result.putAll(multimap);
    return result;
  }

  /**
   * LinkedHashMultimap entries are in no less than three coexisting linked lists: a bucket in the
   * hash table for a {@code Set<V>} associated with a key, the linked list of insertion-ordered
   * entries in that {@code Set<V>}, and the linked list of entries in the LinkedHashMultimap as a

It was found that the directory staging committer was the fastest among the three, S3A connector should be configured with the following parameters for optimal results:

```
cat ${HADOOP_CONF_DIR}/core-site.xml | kv-pairify | grep "s3a"

fs.s3a.access.key=minio
fs.s3a.secret.key=minio123