randomly generated secret key per object also known as, Object Encryption Key ([OEK](#oek)). Neither the client-provided SSE-C key nor the KMS-managed key is directly used to en/decrypt an object. Instead, the OEK is stored as part of the object metadata next to the object in an encrypted form. To en/decrypt the OEK another secret key is needed also known as, Key Encryption Key ([KEK](#kek)).

The MinIO server runs a key-derivation algorithm to generate the KEK using a pseudo-random function ([PRF](#prf)):...

But even if you never use **FastAPI**, you would benefit from learning a bit about them.

/// note

If you are a Python expert, and you already know everything about type hints, skip to the next chapter.

///

## Motivation { #motivation }

Let's start with a simple example:

{* ../../docs_src/python_types/tutorial001_py39.py *}

Calling this program outputs:

```
John Doe
```

            String nextColor = "";
            if (matcher.find()) {
                nextColor = matcher.group(1);
                if (ANSI_RESET.equals(nextColor)) {
                    // last ANSI escape code is reset: no next color
                    nextColor = "";
                }
            }

            // effective line, with indent and reset if end is colored

		return true
	}
	i := 0
	// Skip leading slashes (for sake of Windows \ is included as well)
	for i < n && (path[i] == SlashSeparatorChar || path[i] == '\\') {
		i++
	}

	for i < n {
		// Find the next segment
		start := i
		for i < n && path[i] != SlashSeparatorChar && path[i] != '\\' {
			i++
		}

		// Trim whitespace of segment
		segmentStart, segmentEnd := start, i

	mac.Write(partIDbin[:])
	partEncryptionKey := mac.Sum(nil)

	// Limit the reader, so the decryptor doesn't receive bytes
	// from the next part (different DARE stream)
	encLenToRead := d.parts[d.partIndex].Size - d.partEncRelOffset
	decrypter, err := newDecryptReaderWithObjectKey(io.LimitReader(d.reader, encLenToRead), partEncryptionKey, d.startSeqNum)

			goi, _, gerr := er.getObjectInfoAndQuorum(ctx, bucket, object, opts)
			if gerr != nil && goi.Name == "" {
				if _, ok := gerr.(InsufficientReadQuorum); ok {
					// Add an MRF heal for next time.
					er.addPartial(bucket, object, opts.VersionID)

					return objInfo, InsufficientWriteQuorum{}
				}
				return objInfo, gerr
			}

                                logger.debug("Stored exception for step {} to be handled in TEARDOWN phase", step, e);
                                // Let the scheduler handle after:* phases and TEARDOWN in the next cycle
                                executePlan();
                            }
                        });
                        return; // Skip the rest of the method since we've handled this step

			allDistNames = append(allDistNames, parentUser)
		}
	}

	expiredUsers, err := sys.LDAPConfig.GetNonEligibleUserDistNames(allDistNames)
	if err != nil {
		// Log and return on error - perhaps it'll work the next time.
		iamLogIf(GlobalContext, err)
		return
	}

	// We ignore any errors
	_ = sys.store.DeleteUsers(ctx, expiredUsers)
}

pkg runtime, func CallersFrames([]uintptr) *Frames
pkg runtime, func KeepAlive(interface{})
pkg runtime, func SetCgoTraceback(int, unsafe.Pointer, unsafe.Pointer, unsafe.Pointer)
pkg runtime, method (*Frames) Next() (Frame, bool)
pkg runtime, type Frame struct
pkg runtime, type Frame struct, Entry uintptr
pkg runtime, type Frame struct, File string
pkg runtime, type Frame struct, Func *Func

	// as well as the initialization of bigBuf.
	runOnce(&bytes.Buffer{})
	b.ResetTimer()

	b.RunParallel(func(pb *testing.PB) {
		var buf bytes.Buffer
		for pb.Next() {
			runOnce(&buf)
		}
	})
}

func writeTestsToFS(tests []WriteTest) fs.FS {
	fsys := fstest.MapFS{}
	for _, wt := range tests {
		fsys[wt.Name] = &fstest.MapFile{
			Data: wt.Data,