// NewLKSForEncrypt gets a verified passphrase stream, and returns
// an LKS that works for encryption.
555951
func NewLKSecForEncrypt(m MetaContext, ui SecretUI, uid keybase1.UID) (ret *LKSec, err error) {
	m = m.WithUIs(UIs{SecretUI: ui})
	pps, err := GetPassphraseStreamStored(m)
	if err != nil {
		return nil, err
	}
	ret = NewLKSec(pps, uid)
	return ret, nil
}
483578
func New(key Key, padding int, initCtr uint32, hashFunc func() hash.Hash) *encryption {
	return &encryption{
		key:      key,
		keyLen:   len(key),
		padding:  padding,
		initCtr:  initCtr,
		hashFunc: hashFunc,
	}
}
58382
func NewKeyFromEncryptedPrivateKeyPEM(data []byte, password []byte) (*Key, error) {
	pemBlock, _ := pem.Decode(data)
	if pemBlock == nil {
		return nil, errors.New("cannot find the next PEM formatted block")
	}
	if pemBlock.Type != rsaPrivateKeyPEMBlockType {
		return nil, errors.New("unmatched type or headers")
	}

	b, err := x509.DecryptPEMBlock(pemBlock, password)
	if err != nil {
		return nil, err
	}

	priv, err := x509.ParsePKCS1PrivateKey(b)
	if err != nil {
		return nil, err
	}

	return NewKey(&priv.PublicKey, priv), nil
}
228564
func NewCipher(passphrase []byte, salt []byte, version Version) (*Cipher, error) {
	return NewCipherWithRng(passphrase, salt, version, NewCryptoRandGenerator())
}
892217
func (c *CryptoLocal) DecryptTLFCryptKeyClientHalf(ctx context.Context,
	publicKey kbfscrypto.TLFEphemeralPublicKey,
	encryptedClientHalf kbfscrypto.EncryptedTLFCryptKeyClientHalf) (
	kbfscrypto.TLFCryptKeyClientHalf, error) {
	return kbfscrypto.DecryptTLFCryptKeyClientHalf(
		c.cryptPrivateKey, publicKey, encryptedClientHalf)
}
808524
func NewFilledHash(kvs map[string]interface{}) Hash {
	h := NewHash()
	for k, v := range kvs {
		h.Set(k, v)
	}
	return h
}
786243
func (n NACLSecretbox) Encrypt(data []byte) (*api.MaybeEncryptedRecord, error) {
	var nonce [24]byte
	if _, err := io.ReadFull(cryptorand.Reader, nonce[:]); err != nil {
		return nil, err
	}

	// Seal's first argument is an "out", the data that the new encrypted message should be
	// appended to.  Since we don't want to append anything, we pass nil.
	encrypted := secretbox.Seal(nil, data, &nonce, &n.key)
	return &api.MaybeEncryptedRecord{
		Algorithm: n.Algorithm(),
		Data:      encrypted,
		Nonce:     nonce[:],
	}, nil
}
427808
func (s *PassphraseStreamCache) PassphraseStream() *PassphraseStream {
	if s == nil {
		return nil
	}
	s.Lock()
	defer s.Unlock()
	return s.passphraseStream.Clone()
}
1324636
func NewAESEncrypter(key []byte, iv []byte) (*AESEncrypter, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}

	e := AESEncrypter{
		block:        block,
		encryptionIV: iv,
	}
	return &e, nil
}
891225
func (kw KeyWrapEncrypt) KeyDecrypt(enckey []byte) ([]byte, error) {
	block, err := aes.NewCipher(kw.sharedkey)
	if err != nil {
		return nil, errors.Wrap(err, "failed to create cipher from shared key")
	}

	cek, err := keyunwrap(block, enckey)
	if err != nil {
		return nil, errors.Wrap(err, "failed to unwrap data")
	}
	return cek, nil
}
598904
func (c *Cipher) initEncrypt() (iv []byte, err error) {
	if c.iv == nil {
		iv = make([]byte, c.info.ivLen)
		if _, err := io.ReadFull(rand.Reader, iv); err != nil {
			return nil, err
		}
		c.iv = iv
	} else {
		iv = c.iv
	}
	c.enc, err = c.info.newStream(c.key, iv, Encrypt)
	return
}
918888
func (ck *CryptoKey) Encrypt(in []byte) ([]byte, error) {
	var nonce [NonceSize]byte
	_, err := io.ReadFull(prng, nonce[:])
	if err != nil {
		return nil, err
	}
	blob := secretbox.Seal(nil, in, &nonce, (*[KeySize]byte)(ck))
	return append(nonce[:], blob...), nil
}
674601
func (o OpenSSL) EncryptBinaryBytes(passphrase string, plainData []byte, kdf DigestFunc) ([]byte, error) {
	salt, err := o.GenerateSalt()
	if err != nil {
		return nil, err
	}

	return o.EncryptBinaryBytesWithSaltAndDigestFunc(passphrase, salt, plainData, kdf)
}
1320574
func (k NaclDHKeyPair) DecryptFromString(ciphertext string) (msg []byte, sender keybase1.KID, err error) {
	var nei NaclEncryptionInfo

	if nei, err = DecodeArmoredNaclEncryptionInfoPacket(ciphertext); err != nil {
		return
	}

	return k.Decrypt(&nei)
}
85077
func NewClientTLS(certFile, keyFile, caFile string) (*tls.Config, error) {
	return newTLSConfigCommon(certFile, keyFile, caFile)
}
823996
func NewBreachHintFromHash(hash *chainhash.Hash) BreachHint {
	var hint BreachHint
	copy(hint[:], hash[:BreachHintSize])
	return hint
}
1366495
func NewOpenPGPDecrypter(secRingPath string, passphrase string) (*OpenPGPDecrypter, error) {
	var dk *openpgp.EntityList
	var od *OpenPGPDecrypter
	var err error

	dk, err = ReadSecRing(secRingPath)
	if err != nil {
		return nil, err
	}

	od = &OpenPGPDecrypter{
		Keys:       dk,
		passphrase: passphrase,
	}

	return od, err
}