}

    /**
     * Generate a random key
     *
     * @param length key length in bytes
     * @return random key bytes
     */
    public byte[] generateRandomKey(int length) {
        checkNotClosed();

        byte[] key = new byte[length];
        secureRandom.nextBytes(key);
        return key;
    }

    /**
     * Clear all stored keys
     */
    public void clearAllKeys() {

     *
     * @param token the PAC token bytes
     * @param keys map of Kerberos keys indexed by key type
     * @throws PACDecodingException if PAC decoding fails
     */
    public KerberosPacAuthData(byte[] token, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        this.pac = new Pac(token, keys);
    }

    /**
     * Returns the PAC object.
     *

Name      : test.file
...
Encrypted :
  X-Amz-Server-Side-Encryption: AES256
```

## Encrypted Private Key

MinIO supports encrypted KES client private keys. Therefore, you can use
an password-protected private keys for `MINIO_KMS_KES_KEY_FILE`.

When using password-protected private keys for accessing KES you need to
provide the password via:

```
export MINIO_KMS_KES_KEY_PASSWORD=<your-password>
```

    this.keys = keys;
    this.values = values;
  }

  @Override
  public SampleElements<Entry<K, V>> samples() {
    return SampleElements.mapEntries(keys, values);
  }

  @Override
  public Set<Entry<K, V>> create(Object... elements) {
    Entry<K, V>[] entries = createArray(elements.length);
    arraycopy(elements, 0, entries, 0, elements.length);

                for (KerberosKey key : keys) {
                    keysByAlgo.put(key.getKeyType(), key);
                }

                KerberosKey serverKey = keysByAlgo.get(encType.getValue().intValue());
                if (keysByAlgo.isEmpty() || serverKey == null) {
                    throw new PACDecodingException("Kerberos key not found for eType " + encType.getValue());
                }

     *
     * @param token the Kerberos AP-REQ token
     * @param keys the Kerberos keys for decryption
     * @throws PACDecodingException if the token cannot be decoded
     */
    public KerberosApRequest(byte[] token, KerberosKey[] keys) throws PACDecodingException {
        this(parseSequence(token), keys);
    }

    private static ASN1Sequence parseSequence(byte[] token) throws PACDecodingException {

                        keys ->
                            path.create(transform(keys, key -> immutableEntry(key, new Object()))),
                        keys ->
                            path.create(transform(keys, key -> immutableEntry(new Object(), key))),
                        keys -> path.create(transform(keys, key -> immutableEntry(key, key)))))
            .collect(toImmutableList()),

	errCode = ErrNone

	if values.Get("max-keys") != "" {
		var err error
		if maxkeys, err = strconv.Atoi(values.Get("max-keys")); err != nil {
			errCode = ErrInvalidMaxKeys
			return prefix, marker, delimiter, maxkeys, encodingType, versionIDMarker, errCode
		}
	} else {
		maxkeys = maxObjectList
	}

	prefix = values.Get("prefix")
	marker = values.Get("key-marker")
	delimiter = values.Get("delimiter")

  }

  /**
   * Uses a hash table to map keys to value collections.
   *
   * <p>The collections returned by {@link Multimap#keySet()}, {@link Multimap#keys()}, and {@link
   * Multimap#asMap()} will iterate through the keys in the order that they were first added to the
   * multimap, save that if all values associated with a key are removed and then the key is added
   * back into the multimap, that key will come last in the key iteration order.
   */

    int[] entries = requireEntries();
    @Nullable Object[] keys = requireKeys();
    @Nullable Object[] values = requireValues();
    int srcIndex = size() - 1;
    if (dstIndex < srcIndex) {
      // move last entry to deleted spot
      Object key = keys[srcIndex];
      keys[dstIndex] = key;
      values[dstIndex] = values[srcIndex];
      keys[srcIndex] = null;
      values[srcIndex] = null;