int[] entries = requireEntries();
    @Nullable Object[] keys = requireKeys();
    @Nullable Object[] values = requireValues();
    int srcIndex = size() - 1;
    if (dstIndex < srcIndex) {
      // move last entry to deleted spot
      Object key = keys[srcIndex];
      keys[dstIndex] = key;
      values[dstIndex] = values[srcIndex];
      keys[srcIndex] = null;
      values[srcIndex] = null;

     *
     * @param token the Kerberos AP-REQ token
     * @param keys the Kerberos keys for decryption
     * @throws PACDecodingException if the token cannot be decoded
     */
    public KerberosApRequest(byte[] token, KerberosKey[] keys) throws PACDecodingException {
        this(parseSequence(token), keys);
    }

    private static ASN1Sequence parseSequence(byte[] token) throws PACDecodingException {

        keys.put(PacSignature.ETYPE_ARCFOUR_HMAC, hmacKey);
        keys.put(PacSignature.ETYPE_AES128_CTS_HMAC_SHA1_96, aes128Key);
        keys.put(PacSignature.ETYPE_AES256_CTS_HMAC_SHA1_96, aes256Key);

        // Test HMAC-MD5
        byte[] mac1 = PacMac.calculateMac(PacSignature.KERB_CHECKSUM_HMAC_MD5, keys, TEST_DATA);
        assertNotNull(mac1);

     *
     * @param token the PAC token bytes
     * @param keys map of Kerberos keys indexed by key type
     * @throws PACDecodingException if PAC decoding fails
     */
    public KerberosPacAuthData(byte[] token, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        this.pac = new Pac(token, keys);
    }

    /**
     * Returns the PAC object.
     *

        // Test with whitespace around keys and values
        value = "  key1  =  value1  \n  key2=value2\n";
        paramMap = ParameterUtil.parse(value);
        assertEquals(2, paramMap.size());
        assertEquals("value1", paramMap.get("key1"));
        assertEquals("value2", paramMap.get("key2"));

        // Test with empty lines and mixed whitespace
        value = "key1=value1\n\n\t\nkey2=value2\n \n";

   *     multimap already contained the key-value pair and doesn't allow duplicates
   */
  @CanIgnoreReturnValue
  boolean put(@ParametricNullness K key, @ParametricNullness V value);

  /**
   * Removes a single key-value pair with the key {@code key} and the value {@code value} from this
   * multimap, if such exists. If multiple key-value pairs in the multimap fit this description,
   * which one is removed is unspecified.
   *

   *
   * @param keys the unique, non-null keys whose values should be loaded
   * @return a map from each key in {@code keys} to the value associated with that key; <b>may not
   *     contain null values</b>
   * @throws Exception if unable to load the result
   * @throws InterruptedException if this method is interrupted. {@code InterruptedException} is

Name      : test.file
...
Encrypted :
  X-Amz-Server-Side-Encryption: AES256
```

## Encrypted Private Key

MinIO supports encrypted KES client private keys. Therefore, you can use
an password-protected private keys for `MINIO_KMS_KES_KEY_FILE`.

When using password-protected private keys for accessing KES you need to
provide the password via:

```
export MINIO_KMS_KES_KEY_PASSWORD=<your-password>
```

  /** Discards any cached value for key {@code key}. */
  void invalidate(@CompatibleWith("K") Object key);

  /**
   * Discards any cached values for keys {@code keys}.
   *
   * @since 11.0
   */
  // For discussion of <? extends Object>, see getAllPresent.
  void invalidateAll(Iterable<? extends Object> keys);

  /** Discards all entries in the cache. */
  void invalidateAll();

     *
     * @param key the base Kerberos key
     * @param constant the key derivation constant
     * @return the derived key bytes
     * @throws GeneralSecurityException if cryptographic operations fail
     */
    public static byte[] deriveKeyAES(KerberosKey key, byte[] constant) throws GeneralSecurityException {
        byte[] keybytes = key.getEncoded();