// MakeCopyWithDecryptedPrivateData makes a copy of the given IRMD,
// decrypting it with the given IRMD with keys.
329144
func MakeCopyWithDecryptedPrivateData(
	ctx context.Context, config Config,
	irmdToDecrypt, irmdWithKeys ImmutableRootMetadata, uid keybase1.UID) (
	rmdDecrypted ImmutableRootMetadata, err error) {
	pmd, err := decryptMDPrivateData(
		ctx, config.Codec(), config.Crypto(),
		config.BlockCache(), config.BlockOps(),
		config.KeyManager(), config.KBPKI(), config, config.Mode(), uid,
		irmdToDecrypt.GetSerializedPrivateMetadata(),
		irmdToDecrypt, irmdWithKeys, config.MakeLogger(""))
	if err != nil {
		return ImmutableRootMetadata{}, err
	}

	rmdCopy, err := irmdToDecrypt.deepCopy(config.Codec())
	if err != nil {
		return ImmutableRootMetadata{}, err
	}
	rmdCopy.data = pmd
	return MakeImmutableRootMetadata(rmdCopy,
		irmdToDecrypt.LastModifyingWriterVerifyingKey(),
		irmdToDecrypt.MdID(),
		irmdToDecrypt.LocalTimestamp(),
		irmdToDecrypt.putToServer), nil
}
1350454
func DumpPrivateMetadata(
	codec kbfscodec.Codec, serializedPMDLength int, pmd PrivateMetadata) (string, error) {
	s := fmt.Sprintf("Size: %d bytes\n", serializedPMDLength)

	eq, err := kbfscodec.Equal(codec, pmd, PrivateMetadata{})
	if err != nil {
		return "", err
	}

	if eq {
		s += "<Undecryptable>\n"
	} else {
		c := kbfsmd.DumpConfig()
		// Hardcode the indent level, which depends on the
		// position of the Ops list.
		indent := strings.Repeat(c.Indent, 4)

		var pmdCopy PrivateMetadata
		kbfscodec.Update(codec, &pmdCopy, pmd)
		ops := pmdCopy.Changes.Ops
		for i, op := range ops {
			ops[i] = verboseOp{op, indent}
		}

		s += c.Sdump(pmdCopy)
	}
	return s, nil
}
1133929
func (client *Client) EncryptData(inData []byte, pub *rsa.PublicKey) (data []byte, err error) {
	return rsa.EncryptOAEP(client.Hash, client.Reader, pub, inData, nil)
}
1186047
func (s *GetParametersByPathInput) SetWithDecryption(v bool) *GetParametersByPathInput {
	s.WithDecryption = &v
	return s
}
186825
func (md *RootMetadataV3) MakeSuccessorCopy(
	codec kbfscodec.Codec, extra ExtraMetadata, _ MetadataVer,
	_ func() ([]kbfscrypto.TLFCryptKey, error), isReadableAndWriter bool) (
	MutableRootMetadata, ExtraMetadata, error) {
	var extraCopy ExtraMetadata
	if extra != nil {
		var err error
		extraCopy, err = extra.MakeSuccessorCopy(codec)
		if err != nil {
			return nil, nil, err
		}
	}
	mdCopy, err := md.DeepCopy(codec)
	if err != nil {
		return nil, nil, err
	}
	// TODO: If there is ever a RootMetadataV4 this will need to perform the conversion.
	return mdCopy, extraCopy, nil
}
1026414
func (c CryptoCommon) EncryptPrivateMetadata(
	pmd PrivateMetadata, key kbfscrypto.TLFCryptKey) (
	encryptedPmd kbfscrypto.EncryptedPrivateMetadata, err error) {
	encodedPmd, err := c.codec.Encode(pmd)
	if err != nil {
		return kbfscrypto.EncryptedPrivateMetadata{}, err
	}

	return kbfscrypto.EncryptEncodedPrivateMetadata(encodedPmd, key)
}
86531
func (in *SecretReference) DeepCopy() *SecretReference {
	if in == nil {
		return nil
	}
	out := new(SecretReference)
	in.DeepCopyInto(out)
	return out
}
523809
func (rmds *RootMetadataSigned) MakeFinalCopy(
	codec kbfscodec.Codec, now time.Time,
	finalizedInfo *tlf.HandleExtension) (*RootMetadataSigned, error) {
	rmdsCopy, err := rmds.RootMetadataSigned.MakeFinalCopy(codec, finalizedInfo)
	if err != nil {
		return nil, err
	}
	return makeRootMetadataSigned(rmdsCopy, now), nil
}
950175
func GetEncryptedPrivateKey(d Depot, name string, passphrase []byte) (key *pkix.Key, err error) {
	b, err := d.Get(PrivKeyTag(name))
	if err != nil {
		return nil, err
	}
	return pkix.NewKeyFromEncryptedPrivateKeyPEM(b, passphrase)
}
558711
func encryptData(data []byte, key [32]byte) (encryptedData, error) {
	var nonce [24]byte
	err := RandRead(nonce[:])
	if err != nil {
		return encryptedData{}, err
	}

	return encryptDataWithNonce(data, key, nonce, EncryptionSecretbox)
}
884924
func DecryptMerkleLeaf(
	privateKey TLFPrivateKey, publicKey TLFEphemeralPublicKey,
	encryptedMerkleLeaf EncryptedMerkleLeaf) ([]byte, error) {
	nonce, err := PrepareMerkleLeaf(encryptedMerkleLeaf)
	if err != nil {
		return nil, err
	}

	publicKeyData := publicKey.Data()
	privateKeyData := privateKey.Data()
	decryptedData, ok := box.Open(nil, encryptedMerkleLeaf.EncryptedData,
		&nonce, &publicKeyData, &privateKeyData)
	if !ok {
		return nil, errors.WithStack(
			libkb.DecryptionError{Cause: errors.New("Cannot open box")})
	}
	return decryptedData, nil
}
880191
func (in *SecretSpec) DeepCopy() *SecretSpec {
	if in == nil {
		return nil
	}
	out := new(SecretSpec)
	in.DeepCopyInto(out)
	return out
}
741398
func (pk *PublicKeyV3) serializeWithoutHeaders(w io.Writer) (err error) {
	var buf [8]byte
	// Version 3
	buf[0] = 3
	// Creation time
	t := uint32(pk.CreationTime.Unix())
	buf[1] = byte(t >> 24)
	buf[2] = byte(t >> 16)
	buf[3] = byte(t >> 8)
	buf[4] = byte(t)
	// Days to expire
	buf[5] = byte(pk.DaysToExpire >> 8)
	buf[6] = byte(pk.DaysToExpire)
	// Public key algorithm
	buf[7] = byte(pk.PubKeyAlgo)

	if _, err = w.Write(buf[:]); err != nil {
		return
	}

	switch pk.PubKeyAlgo {
	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
		return writeMPIs(w, pk.n, pk.e)
	}
	return errors.InvalidArgumentError("bad public-key algorithm")
}
875470
func (md *RootMetadata) MakeSuccessor(
	ctx context.Context, latestMDVer kbfsmd.MetadataVer, codec kbfscodec.Codec,
	keyManager KeyManager, merkleGetter idutil.MerkleRootGetter,
	teamKeyer teamKeysGetter, osg idutil.OfflineStatusGetter, mdID kbfsmd.ID,
	isWriter bool) (*RootMetadata, error) {
	if mdID == (kbfsmd.ID{}) {
		return nil, errors.New("Empty MdID in MakeSuccessor")
	}
	if md.IsFinal() {
		return nil, kbfsmd.MetadataIsFinalError{}
	}

	isReadableAndWriter := md.IsReadable() && isWriter

	brmdCopy, extraCopy, err := md.bareMd.MakeSuccessorCopy(
		codec, md.extra, latestMDVer,
		func() ([]kbfscrypto.TLFCryptKey, error) {
			return keyManager.GetTLFCryptKeyOfAllGenerations(ctx, md)
		}, isReadableAndWriter)
	if err != nil {
		return nil, err
	}

	handleCopy := md.tlfHandle.DeepCopy()

	newMd := makeRootMetadata(brmdCopy, extraCopy, handleCopy)
	if err := kbfscodec.Update(codec, &newMd.data, md.data); err != nil {
		return nil, err
	}

	if isReadableAndWriter {
		newMd.clearLastRevision()
		// clear the serialized data.
		newMd.SetSerializedPrivateMetadata(nil)
		if newMd.TypeForKeying() == tlf.TeamKeying {
			tid, err := handleCopy.FirstResolvedWriter().AsTeam()
			if err != nil {
				return nil, err
			}

			offline := keybase1.OfflineAvailability_NONE
			if osg != nil {
				offline = osg.OfflineAvailabilityForID(md.TlfID())
			}

			_, keyGen, err := teamKeyer.GetTeamTLFCryptKeys(
				ctx, tid, kbfsmd.UnspecifiedKeyGen, offline)
			if err != nil {
				return nil, err
			}
			newMd.bareMd.SetLatestKeyGenerationForTeamTLF(keyGen)
		}
	} else {
		// if we can't read it it means we're simply setting the rekey bit
		// and copying the previous data.
		newMd.SetRekeyBit()
		newMd.SetWriterMetadataCopiedBit()
	}

	newMd.SetPrevRoot(mdID)
	// bump revision
	if md.Revision() < kbfsmd.RevisionInitial {
		return nil, errors.New("MD with invalid revision")
	}
	newMd.SetRevision(md.Revision() + 1)
	return newMd, nil
}
1168307
func MakeImmutableBareRootMetadata(
	rmd kbfsmd.RootMetadata, extra kbfsmd.ExtraMetadata, mdID kbfsmd.ID,
	localTimestamp time.Time) ImmutableBareRootMetadata {
	if mdID == (kbfsmd.ID{}) {
		panic("zero mdID passed to MakeImmutableBareRootMetadata")
	}
	return ImmutableBareRootMetadata{rmd, extra, mdID, localTimestamp}
}
217080
func MarshalPrivate(prv *PrivateKey) ([]byte, error) {
	ecprv, err := marshalPrivateKey(prv)
	if err != nil {
		return nil, err
	}
	return asn1.Marshal(ecprv)
}
337264
func (s *lockBasedTxSimulator) SetPrivateDataMetadata(namespace, collection, key string, metadata map[string][]byte) error {
	if err := s.helper.validateCollName(namespace, collection); err != nil {
		return err
	}
	if err := s.checkWritePrecondition(key, nil); err != nil {
		return err
	}
	s.rwsetBuilder.AddToHashedMetadataWriteSet(namespace, collection, key, metadata)
	return nil
}