// Given the supplied cipher, whose block size must be 16 bytes, return two
// subkeys that can be used in MAC generation. See section 5.3 of NIST SP
// 800-38B. Note that the other NIST-approved block size of 8 bytes is not
// supported by this function.
330669
func generateSubkeys(ciph cipher.Block) (k1 []byte, k2 []byte) {
	if ciph.BlockSize() != blockSize {
		panic("generateSubkeys requires a cipher with a block size of 16 bytes.")
	}

	// Step 1
	l := make([]byte, blockSize)
	ciph.Encrypt(l, subkeyZero)

	// Step 2: Derive the first subkey.
	if common.Msb(l) == 0 {
		// TODO(jacobsa): Accept a destination buffer in ShiftLeft and then hoist
		// the allocation in the else branch below.
		k1 = common.ShiftLeft(l)
	} else {
		k1 = make([]byte, blockSize)
		common.Xor(k1, common.ShiftLeft(l), subkeyRb)
	}

	// Step 3: Derive the second subkey.
	if common.Msb(k1) == 0 {
		k2 = common.ShiftLeft(k1)
	} else {
		k2 = make([]byte, blockSize)
		common.Xor(k2, common.ShiftLeft(k1), subkeyRb)
	}

	return
}
670381
func (x *ecbDecrypter) CryptBlocks(dst, src []byte) {
	if len(src)%x.blockSize != 0 {
		panic("ECBDecrypter: input not full blocks")
	}
	if len(dst) < len(src) {
		panic("ECBDecrypter: output smaller than input")
	}
	// See https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_Codebook_.28ECB.29
	for len(src) > 0 {
		x.b.Decrypt(dst, src[:x.blockSize])
		src = src[x.blockSize:]
		dst = dst[x.blockSize:]
	}
}
724995
func Sum(msg []byte, c cipher.Block) ([]byte, error) {
	mac, err := New(c)
	if err != nil {
		return nil, err
	}
	mac.Write(msg)
	return mac.Sum(nil), nil
}
746515
func AESGCMDecrypt(key, ciphertext []byte) ([]byte, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}

	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}

	size := gcm.NonceSize()
	if len(ciphertext)-size <= 0 {
		return nil, errors.New("Ciphertext is empty")
	}

	nonce := ciphertext[:size]
	ciphertext = ciphertext[size:]

	plainText, err := gcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return nil, err
	}

	return plainText, nil
}
814402
func (b BlockServerMeasured) GetEncodedSize(
	ctx context.Context, tlfID tlf.ID, id kbfsblock.ID,
	context kbfsblock.Context) (
	size uint32, status keybase1.BlockStatus, err error) {
	b.getEncodedSizeTimer.Time(func() {
		size, status, err = b.delegate.GetEncodedSize(ctx, tlfID, id, context)
	})
	return size, status, err
}
435849
func AesDecrypt(crypted, key []byte) []byte {
	newKey := genAesKey(key)
	block, err := aes.NewCipher(newKey)
	if err != nil {
		panic(err)
	}
	blockSize := block.BlockSize()
	blockMode := cipher.NewCBCDecrypter(block, newKey[:blockSize])
	origData := make([]byte, len(crypted))
	// origData := crypted
	blockMode.CryptBlocks(origData, crypted)
	origData = pkcs5UnPadding(origData)
	// origData = ZeroUnPadding(origData)
	return origData
}
542094
func aesDecrypt(cryptStr []byte, mode cipher.BlockMode) ([]byte, error) {
	blockSize := mode.BlockSize()
	if len(cryptStr)%blockSize != 0 {
		return nil, errors.New("Corrupted data")
	}
	data := make([]byte, len(cryptStr))
	mode.CryptBlocks(data, cryptStr)
	plain, err := PKCS7Unpad(data, blockSize)
	if err != nil {
		return nil, err
	}
	return plain, nil
}
1184320
func AESGCMEncrypt(key, plaintext []byte) ([]byte, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}

	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}

	nonce := make([]byte, gcm.NonceSize())
	if _, err := rand.Read(nonce); err != nil {
		return nil, err
	}

	ciphertext := gcm.Seal(nil, nonce, plaintext, nil)
	return append(nonce, ciphertext...), nil
}
376260
func Encrypt1024(block *[16]uint64, keys *[17]uint64, tweak *[3]uint64) {
	b0, b1, b2, b3 := block[0], block[1], block[2], block[3]
	b4, b5, b6, b7 := block[4], block[5], block[6], block[7]
	b8, b9, b10, b11 := block[8], block[9], block[10], block[11]
	b12, b13, b14, b15 := block[12], block[13], block[14], block[15]

	for r := 0; r < 19; r++ {
		b0 += keys[r%17]
		b1 += keys[(r+1)%17]
		b2 += keys[(r+2)%17]
		b3 += keys[(r+3)%17]
		b4 += keys[(r+4)%17]
		b5 += keys[(r+5)%17]
		b6 += keys[(r+6)%17]
		b7 += keys[(r+7)%17]
		b8 += keys[(r+8)%17]
		b9 += keys[(r+9)%17]
		b10 += keys[(r+10)%17]
		b11 += keys[(r+11)%17]
		b12 += keys[(r+12)%17]
		b13 += keys[(r+13)%17] + tweak[r%3]
		b14 += keys[(r+14)%17] + tweak[(r+1)%3]
		b15 += keys[(r+15)%17] + uint64(r)

		b0 += b1
		b1 = ((b1 << 24) | (b1 >> (64 - 24))) ^ b0
		b2 += b3
		b3 = ((b3 << 13) | (b3 >> (64 - 13))) ^ b2
		b4 += b5
		b5 = ((b5 << 8) | (b5 >> (64 - 8))) ^ b4
		b6 += b7
		b7 = ((b7 << 47) | (b7 >> (64 - 47))) ^ b6
		b8 += b9
		b9 = ((b9 << 8) | (b9 >> (64 - 8))) ^ b8
		b10 += b11
		b11 = ((b11 << 17) | (b11 >> (64 - 17))) ^ b10
		b12 += b13
		b13 = ((b13 << 22) | (b13 >> (64 - 22))) ^ b12
		b14 += b15
		b15 = ((b15 << 37) | (b15 >> (64 - 37))) ^ b14

		b0 += b9
		b9 = ((b9 << 38) | (b9 >> (64 - 38))) ^ b0
		b2 += b13
		b13 = ((b13 << 19) | (b13 >> (64 - 19))) ^ b2
		b6 += b11
		b11 = ((b11 << 10) | (b11 >> (64 - 10))) ^ b6
		b4 += b15
		b15 = ((b15 << 55) | (b15 >> (64 - 55))) ^ b4
		b10 += b7
		b7 = ((b7 << 49) | (b7 >> (64 - 49))) ^ b10
		b12 += b3
		b3 = ((b3 << 18) | (b3 >> (64 - 18))) ^ b12
		b14 += b5
		b5 = ((b5 << 23) | (b5 >> (64 - 23))) ^ b14
		b8 += b1
		b1 = ((b1 << 52) | (b1 >> (64 - 52))) ^ b8

		b0 += b7
		b7 = ((b7 << 33) | (b7 >> (64 - 33))) ^ b0
		b2 += b5
		b5 = ((b5 << 4) | (b5 >> (64 - 4))) ^ b2
		b4 += b3
		b3 = ((b3 << 51) | (b3 >> (64 - 51))) ^ b4
		b6 += b1
		b1 = ((b1 << 13) | (b1 >> (64 - 13))) ^ b6
		b12 += b15
		b15 = ((b15 << 34) | (b15 >> (64 - 34))) ^ b12
		b14 += b13
		b13 = ((b13 << 41) | (b13 >> (64 - 41))) ^ b14
		b8 += b11
		b11 = ((b11 << 59) | (b11 >> (64 - 59))) ^ b8
		b10 += b9
		b9 = ((b9 << 17) | (b9 >> (64 - 17))) ^ b10

		b0 += b15
		b15 = ((b15 << 5) | (b15 >> (64 - 5))) ^ b0
		b2 += b11
		b11 = ((b11 << 20) | (b11 >> (64 - 20))) ^ b2
		b6 += b13
		b13 = ((b13 << 48) | (b13 >> (64 - 48))) ^ b6
		b4 += b9
		b9 = ((b9 << 41) | (b9 >> (64 - 41))) ^ b4
		b14 += b1
		b1 = ((b1 << 47) | (b1 >> (64 - 47))) ^ b14
		b8 += b5
		b5 = ((b5 << 28) | (b5 >> (64 - 28))) ^ b8
		b10 += b3
		b3 = ((b3 << 16) | (b3 >> (64 - 16))) ^ b10
		b12 += b7
		b7 = ((b7 << 25) | (b7 >> (64 - 25))) ^ b12

		r++

		b0 += keys[r%17]
		b1 += keys[(r+1)%17]
		b2 += keys[(r+2)%17]
		b3 += keys[(r+3)%17]
		b4 += keys[(r+4)%17]
		b5 += keys[(r+5)%17]
		b6 += keys[(r+6)%17]
		b7 += keys[(r+7)%17]
		b8 += keys[(r+8)%17]
		b9 += keys[(r+9)%17]
		b10 += keys[(r+10)%17]
		b11 += keys[(r+11)%17]
		b12 += keys[(r+12)%17]
		b13 += keys[(r+13)%17] + tweak[r%3]
		b14 += keys[(r+14)%17] + tweak[(r+1)%3]
		b15 += keys[(r+15)%17] + uint64(r)

		b0 += b1
		b1 = ((b1 << 41) | (b1 >> (64 - 41))) ^ b0
		b2 += b3
		b3 = ((b3 << 9) | (b3 >> (64 - 9))) ^ b2
		b4 += b5
		b5 = ((b5 << 37) | (b5 >> (64 - 37))) ^ b4
		b6 += b7
		b7 = ((b7 << 31) | (b7 >> (64 - 31))) ^ b6
		b8 += b9
		b9 = ((b9 << 12) | (b9 >> (64 - 12))) ^ b8
		b10 += b11
		b11 = ((b11 << 47) | (b11 >> (64 - 47))) ^ b10
		b12 += b13
		b13 = ((b13 << 44) | (b13 >> (64 - 44))) ^ b12
		b14 += b15
		b15 = ((b15 << 30) | (b15 >> (64 - 30))) ^ b14

		b0 += b9
		b9 = ((b9 << 16) | (b9 >> (64 - 16))) ^ b0
		b2 += b13
		b13 = ((b13 << 34) | (b13 >> (64 - 34))) ^ b2
		b6 += b11
		b11 = ((b11 << 56) | (b11 >> (64 - 56))) ^ b6
		b4 += b15
		b15 = ((b15 << 51) | (b15 >> (64 - 51))) ^ b4
		b10 += b7
		b7 = ((b7 << 4) | (b7 >> (64 - 4))) ^ b10
		b12 += b3
		b3 = ((b3 << 53) | (b3 >> (64 - 53))) ^ b12
		b14 += b5
		b5 = ((b5 << 42) | (b5 >> (64 - 42))) ^ b14
		b8 += b1
		b1 = ((b1 << 41) | (b1 >> (64 - 41))) ^ b8

		b0 += b7
		b7 = ((b7 << 31) | (b7 >> (64 - 31))) ^ b0
		b2 += b5
		b5 = ((b5 << 44) | (b5 >> (64 - 44))) ^ b2
		b4 += b3
		b3 = ((b3 << 47) | (b3 >> (64 - 47))) ^ b4
		b6 += b1
		b1 = ((b1 << 46) | (b1 >> (64 - 46))) ^ b6
		b12 += b15
		b15 = ((b15 << 19) | (b15 >> (64 - 19))) ^ b12
		b14 += b13
		b13 = ((b13 << 42) | (b13 >> (64 - 42))) ^ b14
		b8 += b11
		b11 = ((b11 << 44) | (b11 >> (64 - 44))) ^ b8
		b10 += b9
		b9 = ((b9 << 25) | (b9 >> (64 - 25))) ^ b10

		b0 += b15
		b15 = ((b15 << 9) | (b15 >> (64 - 9))) ^ b0
		b2 += b11
		b11 = ((b11 << 48) | (b11 >> (64 - 48))) ^ b2
		b6 += b13
		b13 = ((b13 << 35) | (b13 >> (64 - 35))) ^ b6
		b4 += b9
		b9 = ((b9 << 52) | (b9 >> (64 - 52))) ^ b4
		b14 += b1
		b1 = ((b1 << 23) | (b1 >> (64 - 23))) ^ b14
		b8 += b5
		b5 = ((b5 << 31) | (b5 >> (64 - 31))) ^ b8
		b10 += b3
		b3 = ((b3 << 37) | (b3 >> (64 - 37))) ^ b10
		b12 += b7
		b7 = ((b7 << 20) | (b7 >> (64 - 20))) ^ b12
	}

	b0 += keys[3]
	b1 += keys[4]
	b2 += keys[5]
	b3 += keys[6]
	b4 += keys[7]
	b5 += keys[8]
	b6 += keys[9]
	b7 += keys[10]
	b8 += keys[11]
	b9 += keys[12]
	b10 += keys[13]
	b11 += keys[14]
	b12 += keys[15]
	b13 += keys[16] + tweak[2]
	b14 += keys[0] + tweak[0]
	b15 += keys[1] + 20

	block[0], block[1], block[2], block[3] = b0, b1, b2, b3
	block[4], block[5], block[6], block[7] = b4, b5, b6, b7
	block[8], block[9], block[10], block[11] = b8, b9, b10, b11
	block[12], block[13], block[14], block[15] = b12, b13, b14, b15
}
834169
func (b *AESGCMBarrier) GenerateKey() ([]byte, error) {
	// Generate a 256bit key
	buf := make([]byte, 2*aes.BlockSize)
	_, err := rand.Read(buf)
	return buf, err
}
1239533
func (enc *Encoder) Uint64Key(key string, v uint64) {
	if enc.hasKeys {
		if !enc.keyExists(key) {
			return
		}
	}
	enc.grow(10 + len(key))
	r := enc.getPreviousRune()
	if r != '{' {
		enc.writeByte(',')
	}
	enc.writeByte('"')
	enc.writeStringEscape(key)
	enc.writeBytes(objKey)
	enc.buf = strconv.AppendUint(enc.buf, v, 10)
}
402759
func Encrypt(key, iv, plaintext []byte) ([]byte, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	pad := aes.BlockSize - len(plaintext)%aes.BlockSize
	plaintext = append(plaintext, bytes.Repeat([]byte{byte(pad)}, pad)...)
	ciphertext := make([]byte, len(plaintext))
	mode := cipher.NewCBCEncrypter(block, iv)
	mode.CryptBlocks(ciphertext, plaintext)
	return ciphertext, nil
}
206167
func (c Context) Uint16(key string, i uint16) Context {
	c.l.context = enc.AppendUint16(enc.AppendKey(c.l.context, key), i)
	return c
}
1181342
func (cipher CipherFunction) KeySize() int {
	switch cipher {
	case Cipher3DES:
		return 24
	case CipherCAST5:
		return cast5.KeySize
	case CipherAES128:
		return 16
	case CipherAES192:
		return 24
	case CipherAES256:
		return 32
	}
	return 0
}
460580
func NewCipher(key []byte) (*Cipher, error) {
	var result Cipher
	k := len(key)
	if k < 4 || k > 56 {
		return nil, KeySizeError(k)
	}
	initCipher(key, &result)
	ExpandKey(key, &result)
	return &result, nil
}
845525
func (c *Cipher) Decrypt(dst, src []byte) {
	l := uint32(src[0])<<24 | uint32(src[1])<<16 | uint32(src[2])<<8 | uint32(src[3])
	r := uint32(src[4])<<24 | uint32(src[5])<<16 | uint32(src[6])<<8 | uint32(src[7])
	l, r = decryptBlock(l, r, c)
	dst[0], dst[1], dst[2], dst[3] = byte(l>>24), byte(l>>16), byte(l>>8), byte(l)
	dst[4], dst[5], dst[6], dst[7] = byte(r>>24), byte(r>>16), byte(r>>8), byte(r)
}
747135
func aesEncrypt(str []byte, mode cipher.BlockMode) ([]byte, error) {
	blockSize := mode.BlockSize()
	// The str arguments can be any length, and padding is automatically added to
	// str so it is a multiple of a block as required by block-based algorithms such as AES.
	// This padding is automatically removed by the AES_DECRYPT() function.
	data, err := PKCS7Pad(str, blockSize)
	if err != nil {
		return nil, err
	}
	crypted := make([]byte, len(data))
	mode.CryptBlocks(crypted, data)
	return crypted, nil
}