// Decrypt512 decrypts the 8 words of block using the expanded 512 bit key and
// the 128 bit tweak. The keys[8] must be keys[0] xor keys[1] xor ... keys[8] xor C240.
// The tweak[2] must be tweak[0] xor tweak[1].
196498
func Decrypt512(block *[8]uint64, keys *[9]uint64, tweak *[3]uint64) {
	b0, b1, b2, b3 := block[0], block[1], block[2], block[3]
	b4, b5, b6, b7 := block[4], block[5], block[6], block[7]

	var tmp uint64
	for r := 18; r > 1; r-- {
		b0 -= keys[r%9]
		b1 -= keys[(r+1)%9]
		b2 -= keys[(r+2)%9]
		b3 -= keys[(r+3)%9]
		b4 -= keys[(r+4)%9]
		b5 -= keys[(r+5)%9] + tweak[r%3]
		b6 -= keys[(r+6)%9] + tweak[(r+1)%3]
		b7 -= keys[(r+7)%9] + uint64(r)

		tmp = b3 ^ b4
		b3 = tmp>>22 | tmp<<(64-22)
		b4 -= b3
		tmp = b5 ^ b2
		b5 = tmp>>56 | tmp<<(64-56)
		b2 -= b5
		tmp = b7 ^ b0
		b7 = tmp>>35 | tmp<<(64-35)
		b0 -= b7
		tmp = b1 ^ b6
		b1 = tmp>>8 | tmp<<(64-8)
		b6 -= b1

		tmp = b7 ^ b2
		b7 = tmp>>43 | tmp<<(64-43)
		b2 -= b7
		tmp = b5 ^ b0
		b5 = tmp>>39 | tmp<<(64-39)
		b0 -= b5
		tmp = b3 ^ b6
		b3 = tmp>>29 | tmp<<(64-29)
		b6 -= b3
		tmp = b1 ^ b4
		b1 = tmp>>25 | tmp<<(64-25)
		b4 -= b1

		tmp = b3 ^ b0
		b3 = tmp>>17 | tmp<<(64-17)
		b0 -= b3
		tmp = b5 ^ b6
		b5 = tmp>>10 | tmp<<(64-10)
		b6 -= b5
		tmp = b7 ^ b4
		b7 = tmp>>50 | tmp<<(64-50)
		b4 -= b7
		tmp = b1 ^ b2
		b1 = tmp>>13 | tmp<<(64-13)
		b2 -= b1

		tmp = b7 ^ b6
		b7 = tmp>>24 | tmp<<(64-24)
		b6 -= b7
		tmp = b5 ^ b4
		b5 = tmp>>34 | tmp<<(64-34)
		b4 -= b5
		tmp = b3 ^ b2
		b3 = tmp>>30 | tmp<<(64-30)
		b2 -= b3
		tmp = b1 ^ b0
		b1 = tmp>>39 | tmp<<(64-39)
		b0 -= b1

		r--

		b0 -= keys[r%9]
		b1 -= keys[(r+1)%9]
		b2 -= keys[(r+2)%9]
		b3 -= keys[(r+3)%9]
		b4 -= keys[(r+4)%9]
		b5 -= keys[(r+5)%9] + tweak[r%3]
		b6 -= keys[(r+6)%9] + tweak[(r+1)%3]
		b7 -= keys[(r+7)%9] + uint64(r)

		tmp = b3 ^ b4
		b3 = tmp>>56 | tmp<<(64-56)
		b4 -= b3
		tmp = b5 ^ b2
		b5 = tmp>>54 | tmp<<(64-54)
		b2 -= b5
		tmp = b7 ^ b0
		b7 = tmp>>9 | tmp<<(64-9)
		b0 -= b7
		tmp = b1 ^ b6
		b1 = tmp>>44 | tmp<<(64-44)
		b6 -= b1

		tmp = b7 ^ b2
		b7 = tmp>>39 | tmp<<(64-39)
		b2 -= b7
		tmp = b5 ^ b0
		b5 = tmp>>36 | tmp<<(64-36)
		b0 -= b5
		tmp = b3 ^ b6
		b3 = tmp>>49 | tmp<<(64-49)
		b6 -= b3
		tmp = b1 ^ b4
		b1 = tmp>>17 | tmp<<(64-17)
		b4 -= b1

		tmp = b3 ^ b0
		b3 = tmp>>42 | tmp<<(64-42)
		b0 -= b3
		tmp = b5 ^ b6
		b5 = tmp>>14 | tmp<<(64-14)
		b6 -= b5
		tmp = b7 ^ b4
		b7 = tmp>>27 | tmp<<(64-27)
		b4 -= b7
		tmp = b1 ^ b2
		b1 = tmp>>33 | tmp<<(64-33)
		b2 -= b1

		tmp = b7 ^ b6
		b7 = tmp>>37 | tmp<<(64-37)
		b6 -= b7
		tmp = b5 ^ b4
		b5 = tmp>>19 | tmp<<(64-19)
		b4 -= b5
		tmp = b3 ^ b2
		b3 = tmp>>36 | tmp<<(64-36)
		b2 -= b3
		tmp = b1 ^ b0
		b1 = tmp>>46 | tmp<<(64-46)
		b0 -= b1
	}

	b0 -= keys[0]
	b1 -= keys[1]
	b2 -= keys[2]
	b3 -= keys[3]
	b4 -= keys[4]
	b5 -= keys[5] + tweak[0]
	b6 -= keys[6] + tweak[1]
	b7 -= keys[7]

	block[0], block[1], block[2], block[3] = b0, b1, b2, b3
	block[4], block[5], block[6], block[7] = b4, b5, b6, b7
}
517639
func (cc *aesGCMContentCipher) DecryptContents(src io.ReadCloser) (io.ReadCloser, error) {
	reader := cc.Cipher.Decrypt(src)
	return &CryptoReadCloser{Body: src, Decrypter: reader}, nil
}
445505
func SHA512Pass(password string) (string, error) {
	c := sha512_crypt.New()
	return c.Generate([]byte(password), nil)
}
1289583
func Sum512(data []byte) [Size]byte {
	d := digest{function: crypto.SHA512}
	d.Reset()
	d.Write(data)
	return d.checkSum()
}
82575
func decryptBlock(dst, src []byte, sk *subkeys) {
	// Transform the input block to 4 x 32 bit registers
	r0 := uint32(src[0]) | uint32(src[1])<<8 | uint32(src[2])<<16 | uint32(src[3])<<24
	r1 := uint32(src[4]) | uint32(src[5])<<8 | uint32(src[6])<<16 | uint32(src[7])<<24
	r2 := uint32(src[8]) | uint32(src[9])<<8 | uint32(src[10])<<16 | uint32(src[11])<<24
	r3 := uint32(src[12]) | uint32(src[13])<<8 | uint32(src[14])<<16 | uint32(src[15])<<24

	// undo whitening
	r0 ^= sk[128]
	r1 ^= sk[129]
	r2 ^= sk[130]
	r3 ^= sk[131]

	// Decrypt the block with the 132 sub-keys and 8 S-Boxes
	sb7Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[124], r1^sk[125], r2^sk[126], r3^sk[127]
	linearInv(&r0, &r1, &r2, &r3)
	sb6Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[120], r1^sk[121], r2^sk[122], r3^sk[123]
	linearInv(&r0, &r1, &r2, &r3)
	sb5Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[116], r1^sk[117], r2^sk[118], r3^sk[119]
	linearInv(&r0, &r1, &r2, &r3)
	sb4Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[112], r1^sk[113], r2^sk[114], r3^sk[115]
	linearInv(&r0, &r1, &r2, &r3)
	sb3Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[108], r1^sk[109], r2^sk[110], r3^sk[111]
	linearInv(&r0, &r1, &r2, &r3)
	sb2Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[104], r1^sk[105], r2^sk[106], r3^sk[107]
	linearInv(&r0, &r1, &r2, &r3)
	sb1Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[100], r1^sk[101], r2^sk[102], r3^sk[103]
	linearInv(&r0, &r1, &r2, &r3)
	sb0Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[96], r1^sk[97], r2^sk[98], r3^sk[99]
	linearInv(&r0, &r1, &r2, &r3)

	sb7Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[92], r1^sk[93], r2^sk[94], r3^sk[95]
	linearInv(&r0, &r1, &r2, &r3)
	sb6Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[88], r1^sk[89], r2^sk[90], r3^sk[91]
	linearInv(&r0, &r1, &r2, &r3)
	sb5Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[84], r1^sk[85], r2^sk[86], r3^sk[87]
	linearInv(&r0, &r1, &r2, &r3)
	sb4Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[80], r1^sk[81], r2^sk[82], r3^sk[83]
	linearInv(&r0, &r1, &r2, &r3)
	sb3Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[76], r1^sk[77], r2^sk[78], r3^sk[79]
	linearInv(&r0, &r1, &r2, &r3)
	sb2Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[72], r1^sk[73], r2^sk[74], r3^sk[75]
	linearInv(&r0, &r1, &r2, &r3)
	sb1Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[68], r1^sk[69], r2^sk[70], r3^sk[71]
	linearInv(&r0, &r1, &r2, &r3)
	sb0Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[64], r1^sk[65], r2^sk[66], r3^sk[67]
	linearInv(&r0, &r1, &r2, &r3)

	sb7Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[60], r1^sk[61], r2^sk[62], r3^sk[63]
	linearInv(&r0, &r1, &r2, &r3)
	sb6Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[56], r1^sk[57], r2^sk[58], r3^sk[59]
	linearInv(&r0, &r1, &r2, &r3)
	sb5Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[52], r1^sk[53], r2^sk[54], r3^sk[55]
	linearInv(&r0, &r1, &r2, &r3)
	sb4Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[48], r1^sk[49], r2^sk[50], r3^sk[51]
	linearInv(&r0, &r1, &r2, &r3)
	sb3Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[44], r1^sk[45], r2^sk[46], r3^sk[47]
	linearInv(&r0, &r1, &r2, &r3)
	sb2Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[40], r1^sk[41], r2^sk[42], r3^sk[43]
	linearInv(&r0, &r1, &r2, &r3)
	sb1Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[36], r1^sk[37], r2^sk[38], r3^sk[39]
	linearInv(&r0, &r1, &r2, &r3)
	sb0Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[32], r1^sk[33], r2^sk[34], r3^sk[35]
	linearInv(&r0, &r1, &r2, &r3)

	sb7Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[28], r1^sk[29], r2^sk[30], r3^sk[31]
	linearInv(&r0, &r1, &r2, &r3)
	sb6Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[24], r1^sk[25], r2^sk[26], r3^sk[27]
	linearInv(&r0, &r1, &r2, &r3)
	sb5Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[20], r1^sk[21], r2^sk[22], r3^sk[23]
	linearInv(&r0, &r1, &r2, &r3)
	sb4Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[16], r1^sk[17], r2^sk[18], r3^sk[19]
	linearInv(&r0, &r1, &r2, &r3)
	sb3Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[12], r1^sk[13], r2^sk[14], r3^sk[15]
	linearInv(&r0, &r1, &r2, &r3)
	sb2Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[8], r1^sk[9], r2^sk[10], r3^sk[11]
	linearInv(&r0, &r1, &r2, &r3)
	sb1Inv(&r0, &r1, &r2, &r3)
	r0, r1, r2, r3 = r0^sk[4], r1^sk[5], r2^sk[6], r3^sk[7]
	linearInv(&r0, &r1, &r2, &r3)
	sb0Inv(&r0, &r1, &r2, &r3)

	r0 ^= sk[0]
	r1 ^= sk[1]
	r2 ^= sk[2]
	r3 ^= sk[3]

	// write the decrypted block to the output
	dst[0] = byte(r0)
	dst[1] = byte(r0 >> 8)
	dst[2] = byte(r0 >> 16)
	dst[3] = byte(r0 >> 24)
	dst[4] = byte(r1)
	dst[5] = byte(r1 >> 8)
	dst[6] = byte(r1 >> 16)
	dst[7] = byte(r1 >> 24)
	dst[8] = byte(r2)
	dst[9] = byte(r2 >> 8)
	dst[10] = byte(r2 >> 16)
	dst[11] = byte(r2 >> 24)
	dst[12] = byte(r3)
	dst[13] = byte(r3 >> 8)
	dst[14] = byte(r3 >> 16)
	dst[15] = byte(r3 >> 24)
}
644946
func DecryptPEMBlock(block *pem.Block, password []byte) ([]byte, error) {
	der := block.Bytes

	var privKey encryptedPrivateKeyInfo
	if _, err := asn1.Unmarshal(der, &privKey); err != nil {
		return nil, errors.New("pkcs8: only PKCS #5 v2.0 supported")
	}

	if !privKey.EncryptionAlgorithm.IDPBES2.Equal(oidPBES2) {
		return nil, errors.New("pkcs8: only PBES2 supported")
	}

	if !privKey.EncryptionAlgorithm.PBES2Params.KeyDerivationFunc.IDPBKDF2.Equal(oidPKCS5PBKDF2) {
		return nil, errors.New("pkcs8: only PBKDF2 supported")
	}

	encParam := privKey.EncryptionAlgorithm.PBES2Params.EncryptionScheme
	kdfParam := privKey.EncryptionAlgorithm.PBES2Params.KeyDerivationFunc.PBKDF2Params

	switch {
	case encParam.EncryAlgo.Equal(oidAES256CBC):
		iv := encParam.IV
		salt := kdfParam.Salt
		iter := kdfParam.IterationCount

		encryptedKey := privKey.EncryptedData
		symkey := pbkdf2.Key(password, salt, iter, 32, sha1.New)
		block, err := aes.NewCipher(symkey)
		if err != nil {
			return nil, err
		}
		mode := cipher.NewCBCDecrypter(block, iv)
		mode.CryptBlocks(encryptedKey, encryptedKey)

		if _, err := derhelpers.ParsePrivateKeyDER(encryptedKey); err != nil {
			return nil, errors.New("pkcs8: incorrect password")
		}

		// Remove padding from key as it might be used to encode to memory as pem
		keyLen := len(encryptedKey)
		padLen := int(encryptedKey[keyLen-1])
		if padLen > keyLen || padLen > aes.BlockSize {
			return nil, errors.New("pkcs8: invalid padding size")
		}
		encryptedKey = encryptedKey[:keyLen-padLen]

		return encryptedKey, nil
	default:
		return nil, errors.New("pkcs8: only AES-256-CBC supported")
	}
}
1312025
func (cs *ChaChaStream) Decrypt(data []byte) []byte {
	ret := make([]byte, len(data))
	cs.cipher.XORKeyStream(ret, data)
	return ret
}
834337
func Aes192CBCDecrypt(key [24]byte, ciphertext []byte) (plaintext []byte, err error) {
	return aesCBCDec(key[:], ciphertext)
}
794126
func (s *Sha512Reader) Sha512() string {
	return hex.EncodeToString(s.hash.Sum(nil))
}
1035501
func (ae *AESEncrypter) Decrypt(data []byte) []byte {
	ret := make([]byte, len(data))
	mode := cipher.NewCBCDecrypter(ae.block, ae.encryptionIV)
	mode.CryptBlocks(ret, data)
	return ret
}
469677
func (k NaclDHKeyPair) Decrypt(nei *NaclEncryptionInfo) (plaintext []byte, sender keybase1.KID, err error) {
	if k.Private == nil {
		err = NoSecretKeyError{}
		return
	}
	if nei.EncryptionType != kbcrypto.KIDNaclDH {
		err = DecryptBadPacketTypeError{}
		return
	}
	var nonce [NaclDHNonceSize]byte
	if len(nei.Nonce) != NaclDHNonceSize {
		err = DecryptBadNonceError{}
		return
	}
	copy(nonce[:], nei.Nonce)

	var gk GenericKey
	if gk, err = ImportKeypairFromKID(keybase1.KIDFromSlice(nei.Sender)); err != nil {
		return
	}

	var senderDH NaclDHKeyPair
	var ok bool
	if senderDH, ok = gk.(NaclDHKeyPair); !ok {
		err = DecryptBadSenderError{}
		return
	}

	rkid := keybase1.KIDFromSlice(nei.Receiver)
	if k.GetKID().NotEqual(rkid) {
		err = DecryptWrongReceiverError{}
		return
	}

	if plaintext, ok = box.Open(plaintext, nei.Ciphertext, &nonce,
		((*[32]byte)(&senderDH.Public)), ((*[32]byte)(k.Private))); !ok {
		err = DecryptOpenError{}
		return
	}
	sender = senderDH.GetKID()
	return
}
785724
func UBI512(block *[8]uint64, hVal *[9]uint64, tweak *[3]uint64) {
	b0, b1, b2, b3 := block[0], block[1], block[2], block[3]
	b4, b5, b6, b7 := block[4], block[5], block[6], block[7]

	hVal[8] = C240 ^ hVal[0] ^ hVal[1] ^ hVal[2] ^ hVal[3] ^ hVal[4] ^ hVal[5] ^ hVal[6] ^ hVal[7]
	tweak[2] = tweak[0] ^ tweak[1]

	Encrypt512(block, hVal, tweak)

	hVal[0] = block[0] ^ b0
	hVal[1] = block[1] ^ b1
	hVal[2] = block[2] ^ b2
	hVal[3] = block[3] ^ b3
	hVal[4] = block[4] ^ b4
	hVal[5] = block[5] ^ b5
	hVal[6] = block[6] ^ b6
	hVal[7] = block[7] ^ b7
}
307157
func (sk *SecretKey) Decrypt(in []byte) ([]byte, error) {
	return sk.Key.Decrypt(in)
}
646950
func CryptEncoderSSHA512(salt string) func(pass []byte, hash interface{}) []byte {
	return func(pass []byte, hash interface{}) []byte {
		s := []byte(salt)
		p := append(pass, s...)
		h := sha512.Sum512(p)
		return h[:]
	}
}
1259996
func HmacSHA512(key, origData []byte) (sum []byte) {
	mac := hmac.New(sha512.New, key)
	mac.Write(origData)
	return mac.Sum(nil)
}
57843
func (c *cipher) key(key []byte) {
	var word uint
	off := 0
	lr := []uint{0, 0}
	plen := len(c.P)
	slen := len(c.S)

	for i := 0; i < plen; i++ {
		word, off = streamtoword(key, off)
		c.P[i] = c.P[i] ^ word
	}

	for i := 0; i < plen; i += 2 {
		c.encipher(lr, 0)
		c.P[i] = lr[0]
		c.P[i+1] = lr[1]
	}

	for i := 0; i < slen; i += 2 {
		c.encipher(lr, 0)
		c.S[i] = lr[0]
		c.S[i+1] = lr[1]
	}
}
1131513
func (priv *PrivateKey) Decrypt(rand io.Reader, ciphertext []byte, opts crypto.DecrypterOpts) (plaintext []byte, err error) {
	if opts == nil {
		return DecryptPKCS1v15(rand, priv, ciphertext)
	}

	switch opts := opts.(type) {
	case *OAEPOptions:
		return DecryptOAEP(opts.Hash.New(), rand, priv, ciphertext, opts.Label)

	case *PKCS1v15DecryptOptions:
		if l := opts.SessionKeyLen; l > 0 {
			plaintext = make([]byte, l)
			if _, err := io.ReadFull(rand, plaintext); err != nil {
				return nil, err
			}
			if err := DecryptPKCS1v15SessionKey(rand, priv, ciphertext, plaintext); err != nil {
				return nil, err
			}
			return plaintext, nil
		} else {
			return DecryptPKCS1v15(rand, priv, ciphertext)
		}

	default:
		return nil, errors.New("crypto/rsa: invalid options for Decrypt")
	}
}