// AESEncryptWithCFB decrypts data using AES with CFB mode.
966460
func AESEncryptWithCFB(cryptStr, key []byte, iv []byte) ([]byte, error) {
	cb, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	cfb := cipher.NewCFBEncrypter(cb, iv)
	crypted := make([]byte, len(cryptStr))
	cfb.XORKeyStream(crypted, cryptStr)
	return crypted, nil
}
1029900
func Aes128CFBDecrypt(key [16]byte, cipherReader io.Reader) (plainReader io.Reader, err error) {
	return aesCFBDec(key[:], cipherReader)
}
957637
func (s *ServerConfig) EncryptBytes() ([]byte, error) {
	return base64.StdEncoding.DecodeString(s.EncryptKey)
}
133590
func (e RSAPKCSKeyEncrypt) KeyEncrypt(cek []byte) (ByteSource, error) {
	if e.alg != jwa.RSA1_5 {
		return nil, errors.Wrap(ErrUnsupportedAlgorithm, "invalid RSA PKCS encrypt algorithm")
	}
	encrypted, err := rsa.EncryptPKCS1v15(rand.Reader, e.pubkey, cek)
	if err != nil {
		return nil, errors.Wrap(err, "failed to encrypt using PKCS1v15")
	}
	return ByteKey(encrypted), nil
}
1088765
func (csp *CSP) Decrypt(k bccsp.Key, ciphertext []byte, opts bccsp.DecrypterOpts) (plaintext []byte, err error) {
	// Validate arguments
	if k == nil {
		return nil, errors.New("Invalid Key. It must not be nil.")
	}

	decryptor, found := csp.Decryptors[reflect.TypeOf(k)]
	if !found {
		return nil, errors.Errorf("Unsupported 'DecryptKey' provided [%v]", k)
	}

	plaintext, err = decryptor.Decrypt(k, ciphertext, opts)
	if err != nil {
		return nil, errors.Wrapf(err, "Failed decrypting with opts [%v]", opts)
	}

	return
}
1249477
func Aes256ECBDecrypt(key [32]byte, ciphertext []byte) (plaintext []byte, err error) {
	return aesECBDec(key[:], ciphertext)
}
336874
func (b *AESGCMBarrier) aeadFromKey(key []byte) (cipher.AEAD, error) {
	// Create the AES cipher
	aesCipher, err := aes.NewCipher(key)
	if err != nil {
		return nil, errwrap.Wrapf("failed to create cipher: {{err}}", err)
	}

	// Create the GCM mode AEAD
	gcm, err := cipher.NewGCM(aesCipher)
	if err != nil {
		return nil, fmt.Errorf("failed to initialize GCM mode")
	}
	return gcm, nil
}
590122
func AESEncryptWithOFB(plainStr []byte, key []byte, iv []byte) ([]byte, error) {
	cb, err := aes.NewCipher(key)
	if err != nil {
		return nil, errors.Trace(err)
	}
	mode := cipher.NewOFB(cb, iv)
	crypted := make([]byte, len(plainStr))
	mode.XORKeyStream(crypted, plainStr)
	return crypted, nil
}
214967
func (c *cipherState) Encrypt(associatedData, cipherText, plainText []byte) []byte {
	defer func() {
		c.nonce++

		if c.nonce == keyRotationInterval {
			c.rotateKey()
		}
	}()

	var nonce [12]byte
	binary.LittleEndian.PutUint64(nonce[4:], c.nonce)

	return c.cipher.Seal(cipherText, nonce[:], plainText, associatedData)
}
888990
func (s *AESEncryptedStorage) writeEncryptedStorage(creds map[string]storedCredential) error {
	raw, err := json.Marshal(creds)
	if err != nil {
		return err
	}
	if err = ioutil.WriteFile(s.filename, raw, 0600); err != nil {
		return err
	}
	return nil
}
674601
func (o OpenSSL) EncryptBinaryBytes(passphrase string, plainData []byte, kdf DigestFunc) ([]byte, error) {
	salt, err := o.GenerateSalt()
	if err != nil {
		return nil, err
	}

	return o.EncryptBinaryBytesWithSaltAndDigestFunc(passphrase, salt, plainData, kdf)
}
501760
func (p *PHYPayload) EncryptFRMPayload(key AES128Key) error {
	macPL, ok := p.MACPayload.(*MACPayload)
	if !ok {
		return errors.New("lorawan: MACPayload must be of type *MACPayload")
	}

	// nothing to encrypt
	if len(macPL.FRMPayload) == 0 {
		return nil
	}

	data, err := macPL.marshalPayload()
	if err != nil {
		return err
	}

	data, err = EncryptFRMPayload(key, p.isUplink(), macPL.FHDR.DevAddr, macPL.FHDR.FCnt, data)
	if err != nil {
		return err
	}

	// store the encrypted data in a DataPayload
	macPL.FRMPayload = []Payload{&DataPayload{Bytes: data}}

	return nil
}
544564
func (x *XC) Decrypt(ctx context.Context, buf []byte) ([]byte, error) {
	// unmarshal the protobuf message, the header and body are still encrypted
	// afterwards (parts of the header are plaintext!)
	msg := &xcpb.Message{}
	if err := proto.Unmarshal(buf, msg); err != nil {
		return nil, err
	}

	// try to find a suiteable decryption key in the header
	sk, err := x.decryptSessionKey(ctx, msg.Header)
	if err != nil {
		return nil, err
	}

	var secretKey [32]byte
	copy(secretKey[:], sk)

	plainBuf := &bytes.Buffer{}

	for i, chunk := range msg.Chunks {
		// reconstruct nonce from chunk number
		// in case chunks have been reordered by some adversary
		// decryption will fail
		var nonce [24]byte
		binary.BigEndian.PutUint64(nonce[:], uint64(i))

		// decrypt and verify the ciphertext
		//plaintext, err := cp.Open(nil, nonce, chunk.Body, nil)
		plaintext, ok := secretbox.Open(nil, chunk.Body, &nonce, &secretKey)
		if !ok {
			return nil, fmt.Errorf("failed to decrypt")
		}

		plainBuf.Write(plaintext)
	}

	if !msg.Compressed {
		return plainBuf.Bytes(), nil
	}

	return decompress(plainBuf.Bytes())
}
329687
func Aes128CFBEncrypt(key [16]byte, plainReader io.Reader) (cipherReader io.Reader, err error) {
	return aesCFBEnc(key[:], plainReader)
}
1353657
func AESEncryptWithCBC(str, key []byte, iv []byte) ([]byte, error) {
	cb, err := aes.NewCipher(key)
	if err != nil {
		return nil, errors.Trace(err)
	}
	mode := cipher.NewCBCEncrypter(cb, iv)
	return aesEncrypt(str, mode)
}
880031
func Aes256CBCEncrypt(key [32]byte, plaintext []byte) (ciphertext []byte, err error) {
	return aesCBCEnc(key[:], plaintext)
}
1153445
func (b *AESGCMBarrier) Encrypt(ctx context.Context, key string, plaintext []byte) ([]byte, error) {
	b.l.RLock()
	if b.sealed {
		b.l.RUnlock()
		return nil, ErrBarrierSealed
	}

	term := b.keyring.ActiveTerm()
	primary, err := b.aeadForTerm(term)
	b.l.RUnlock()
	if err != nil {
		return nil, err
	}

	ciphertext, err := b.encrypt(key, term, primary, plaintext)
	if err != nil {
		return nil, err
	}
	return ciphertext, nil
}