// onionEncrypt obfuscates the data with compliance with BOLT#4. As we use a
// stream cipher, calling onionEncrypt on an already encrypted piece of data
// will decrypt it.
421232
func onionEncrypt(sharedSecret *Hash256, data []byte) []byte {
	p := make([]byte, len(data))

	ammagKey := generateKey("ammag", sharedSecret)
	streamBytes := generateCipherStream(ammagKey, uint(len(data)))
	xor(p, data, streamBytes)

	return p
}
929424
func Encrypt256(block *[4]uint64, keys *[5]uint64, tweak *[3]uint64) {
	b0, b1, b2, b3 := block[0], block[1], block[2], block[3]

	for r := 0; r < 17; r++ {
		b0 += keys[r%5]
		b1 += keys[(r+1)%5] + tweak[r%3]
		b2 += keys[(r+2)%5] + tweak[(r+1)%3]
		b3 += keys[(r+3)%5] + uint64(r)

		b0 += b1
		b1 = ((b1 << 14) | (b1 >> (64 - 14))) ^ b0
		b2 += b3
		b3 = ((b3 << 16) | (b3 >> (64 - 16))) ^ b2

		b0 += b3
		b3 = ((b3 << 52) | (b3 >> (64 - 52))) ^ b0
		b2 += b1
		b1 = ((b1 << 57) | (b1 >> (64 - 57))) ^ b2

		b0 += b1
		b1 = ((b1 << 23) | (b1 >> (64 - 23))) ^ b0
		b2 += b3
		b3 = ((b3 << 40) | (b3 >> (64 - 40))) ^ b2

		b0 += b3
		b3 = ((b3 << 5) | (b3 >> (64 - 5))) ^ b0
		b2 += b1
		b1 = ((b1 << 37) | (b1 >> (64 - 37))) ^ b2

		r++

		b0 += keys[r%5]
		b1 += keys[(r+1)%5] + tweak[r%3]
		b2 += keys[(r+2)%5] + tweak[(r+1)%3]
		b3 += keys[(r+3)%5] + uint64(r)

		b0 += b1
		b1 = ((b1 << 25) | (b1 >> (64 - 25))) ^ b0
		b2 += b3
		b3 = ((b3 << 33) | (b3 >> (64 - 33))) ^ b2

		b0 += b3
		b3 = ((b3 << 46) | (b3 >> (64 - 46))) ^ b0
		b2 += b1
		b1 = ((b1 << 12) | (b1 >> (64 - 12))) ^ b2

		b0 += b1
		b1 = ((b1 << 58) | (b1 >> (64 - 58))) ^ b0
		b2 += b3
		b3 = ((b3 << 22) | (b3 >> (64 - 22))) ^ b2

		b0 += b3
		b3 = ((b3 << 32) | (b3 >> (64 - 32))) ^ b0
		b2 += b1
		b1 = ((b1 << 32) | (b1 >> (64 - 32))) ^ b2
	}

	b0 += keys[3]
	b1 += keys[4] + tweak[0]
	b2 += keys[0] + tweak[1]
	b3 += keys[1] + uint64(18)

	block[0], block[1], block[2], block[3] = b0, b1, b2, b3
}
133590
func (e RSAPKCSKeyEncrypt) KeyEncrypt(cek []byte) (ByteSource, error) {
	if e.alg != jwa.RSA1_5 {
		return nil, errors.Wrap(ErrUnsupportedAlgorithm, "invalid RSA PKCS encrypt algorithm")
	}
	encrypted, err := rsa.EncryptPKCS1v15(rand.Reader, e.pubkey, cek)
	if err != nil {
		return nil, errors.Wrap(err, "failed to encrypt using PKCS1v15")
	}
	return ByteKey(encrypted), nil
}
558711
func encryptData(data []byte, key [32]byte) (encryptedData, error) {
	var nonce [24]byte
	err := RandRead(nonce[:])
	if err != nil {
		return encryptedData{}, err
	}

	return encryptDataWithNonce(data, key, nonce, EncryptionSecretbox)
}
1316550
func (kw KeyWrapEncrypt) KeyEncrypt(cek []byte) (ByteSource, error) {
	block, err := aes.NewCipher(kw.sharedkey)
	if err != nil {
		return nil, errors.Wrap(err, "failed to create cipher from shared key")
	}
	encrypted, err := keywrap(block, cek)
	if err != nil {
		return nil, errors.Wrap(err, `keywrap: failed to wrap key`)
	}
	return ByteKey(encrypted), nil
}
1229295
func (m *Mocker) Encrypt(ctx context.Context, content []byte, recipients []string) ([]byte, error) {
	return content, nil
}
597483
func (g *gRPCService) Encrypt(plain []byte) ([]byte, error) {
	ctx, cancel := context.WithTimeout(context.Background(), g.callTimeout)
	defer cancel()
	if err := g.checkAPIVersion(ctx); err != nil {
		return nil, err
	}

	request := &kmsapi.EncryptRequest{Plain: plain, Version: kmsapiVersion}
	response, err := g.kmsClient.Encrypt(ctx, request)
	if err != nil {
		return nil, err
	}
	return response.Cipher, nil
}
960328
func (kw EcdhesKeyWrapEncrypt) KeyEncrypt(cek []byte) (ByteSource, error) {
	kg, err := kw.generator.KeyGenerate()
	if err != nil {
		return nil, errors.Wrap(err, "failed to create key generator")
	}

	bwpk, ok := kg.(ByteWithECPrivateKey)
	if !ok {
		return nil, errors.New("key generator generated invalid key (expected ByteWithECPrivateKey)")
	}

	block, err := aes.NewCipher(bwpk.Bytes())
	if err != nil {
		return nil, errors.Wrap(err, "failed to generate cipher from generated key")
	}

	jek, err := keywrap(block, cek)
	if err != nil {
		return nil, errors.Wrap(err, "failed to wrap data")
	}

	bwpk.ByteKey = ByteKey(jek)

	return bwpk, nil
}
1292094
func (s *Seal) Encrypt(_ context.Context, plaintext []byte) (blob *physical.EncryptedBlobInfo, err error) {
	defer func(now time.Time) {
		metrics.MeasureSince([]string{"seal", "encrypt", "time"}, now)
		metrics.MeasureSince([]string{"seal", "transit", "encrypt", "time"}, now)

		if err != nil {
			metrics.IncrCounter([]string{"seal", "encrypt", "error"}, 1)
			metrics.IncrCounter([]string{"seal", "transit", "encrypt", "error"}, 1)
		}
	}(time.Now())

	metrics.IncrCounter([]string{"seal", "encrypt"}, 1)
	metrics.IncrCounter([]string{"seal", "transit", "encrypt"}, 1)

	ciphertext, err := s.client.Encrypt(plaintext)
	if err != nil {
		return nil, err
	}

	splitKey := strings.Split(string(ciphertext), ":")
	if len(splitKey) != 3 {
		return nil, errors.New("invalid ciphertext returned")
	}
	keyID := splitKey[1]
	s.currentKeyID.Store(keyID)

	ret := &physical.EncryptedBlobInfo{
		Ciphertext: ciphertext,
		KeyInfo: &physical.SealKeyInfo{
			KeyID: keyID,
		},
	}
	return ret, nil
}
766652
func (o OpenSSL) EncryptBytes(passphrase string, plainData []byte, kdf DigestFunc) ([]byte, error) {
	salt, err := o.GenerateSalt()
	if err != nil {
		return nil, err
	}

	return o.EncryptBytesWithSaltAndDigestFunc(passphrase, salt, plainData, kdf)
}
773823
func (s *storage) decryptBlob(plaintext, ciphertext []byte) ([]byte, error) {
	if len(ciphertext) < overhead {
		return nil, errors.New("blob too short to be encrypted")
	}
	if ciphertext[0] != version {
		return nil, errors.New("unknown encrypted blob version")
	}
	var nonce [24]byte
	copy(nonce[:], ciphertext[1:])
	plaintext, success := secretbox.Open(plaintext, ciphertext[25:], &nonce, &s.key)
	if !success {
		return nil, errors.New("encrypted blob failed authentication")
	}
	return plaintext, nil
}
66592
func (c *Cipher) Encrypt64(dst, src []uint64) {
    c.encrypt(src, dst)
}
990074
func (o *OnionErrorEncrypter) Decode(r io.Reader) error {
	_, err := io.ReadFull(r, o.sharedSecret[:])
	return err
}
1114509
func (e *encryption) Transcrypt(i int, in []byte, out []byte) {
	// first hash key with counter (initial counter + i)
	hasher := e.hashFunc()
	hasher.Write(e.key)

	ctrBytes := make([]byte, 4)
	binary.LittleEndian.PutUint32(ctrBytes, uint32(i)+e.initCtr)
	hasher.Write(ctrBytes)

	ctrHash := hasher.Sum(nil)
	hasher.Reset()

	// second round of hashing for selective disclosure
	hasher.Write(ctrHash)
	segmentKey := hasher.Sum(nil)
	hasher.Reset()

	// XOR bytes uptil length of in (out must be at least as long)
	inLength := len(in)
	for j := 0; j < inLength; j++ {
		out[j] = in[j] ^ segmentKey[j]
	}
	// insert padding if out is longer
	pad(out[inLength:])
}
248703
func (ae *AESEncrypter) Encrypt(data []byte) []byte {
	ret := make([]byte, len(data))
	mode := cipher.NewCBCEncrypter(ae.block, ae.encryptionIV)
	mode.CryptBlocks(ret, data)
	return ret
}
208110
func Decrypt(payload []byte, secret string) ([]byte, error) {
	salt := payload[:saltLength]
	key := encryptionKeyToBytes(secret, string(salt))

	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}

	// The IV needs to be unique, but not secure. Therefore it's common to
	// include it at the beginning of the ciphertext.
	if len(payload) < aes.BlockSize {
		return nil, errors.New("payload too short")
	}
	iv := payload[saltLength : saltLength+aes.BlockSize]
	payload = payload[saltLength+aes.BlockSize:]
	payloadDst := make([]byte, len(payload))

	stream := cipher.NewCFBDecrypter(block, iv)

	// XORKeyStream can work in-place if the two arguments are the same.
	stream.XORKeyStream(payloadDst, payload)
	return payloadDst, nil
}
674601
func (o OpenSSL) EncryptBinaryBytes(passphrase string, plainData []byte, kdf DigestFunc) ([]byte, error) {
	salt, err := o.GenerateSalt()
	if err != nil {
		return nil, err
	}

	return o.EncryptBinaryBytesWithSaltAndDigestFunc(passphrase, salt, plainData, kdf)
}