// VerifyMaster is used to check if the given key matches the master key
970471
func (b *AESGCMBarrier) VerifyMaster(key []byte) error {
	b.l.RLock()
	defer b.l.RUnlock()
	if b.sealed {
		return ErrBarrierSealed
	}
	if subtle.ConstantTimeCompare(key, b.keyring.MasterKey()) != 1 {
		return ErrBarrierInvalidKey
	}
	return nil
}
744883
func Verify(secret, userResponse string) error {
	// Make sure secret key is not blank
	if len(secret) < 1 {
		return errors.New("Server Error: No reCAPTCHA secret key")
	}
	data := map[string]string{
		"secret":   secret,
		"response": userResponse,
	}
	var result map[string]interface{}
	err := XURLRequest(VerifyURL, data, &result)
	if err != nil {
		return err
	}
	success, ok := result["success"]
	if !ok {
		return errors.New("Response did not contain \"success\"")
	}
	if success != true {
		log.Println("reCAPTCHA verification failed:", result)
		return errors.New("reCAPTCHA was invalid")
	}
	return nil
}
966063
func (c *configCommand) verifyKnownKeys(client configCommandAPI, keys []string) error {
	known, err := client.ModelGet()
	if err != nil {
		return errors.Trace(err)
	}

	allKeys := keys[:]
	for _, key := range allKeys {
		// check if the key exists in the known config
		// and warn the user if the key is not defined
		if _, exists := known[key]; !exists {
			logger.Warningf(
				"key %q is not defined in the current model configuration: possible misspelling", key)
		}
	}
	return nil
}
823305
func (lh *LookupUnicodeLooseMD5Hash) Verify(vcursor VCursor, ids []sqltypes.Value, ksids [][]byte) ([]bool, error) {
	if lh.writeOnly {
		out := make([]bool, len(ids))
		for i := range ids {
			out[i] = true
		}
		return out, nil
	}

	values, err := unhashList(ksids)
	if err != nil {
		return nil, fmt.Errorf("lookup.Verify.vunhash: %v", err)
	}
	ids, err = convertIds(ids)
	if err != nil {
		return nil, fmt.Errorf("lookup.Verify.vunhash: %v", err)
	}
	return lh.lkp.Verify(vcursor, ids, values)
}
866186
func (m *SigningMethodHMAC) Verify(signingString, signature string, key interface{}) error {
	// Verify the key is the right type
	keyBytes, ok := key.([]byte)
	if !ok {
		return ErrInvalidKeyType
	}

	// Decode signature, for comparison
	sig, err := DecodeSegment(signature)
	if err != nil {
		return err
	}

	// Can we use the specified hashing method?
	if !m.Hash.Available() {
		return ErrHashUnavailable
	}

	// This signing method is symmetric, so we validate the signature
	// by reproducing the signature from the signing string and key, then
	// comparing that against the provided signature.
	hasher := hmac.New(m.Hash.New, keyBytes)
	hasher.Write([]byte(signingString))
	if !hmac.Equal(sig, hasher.Sum(nil)) {
		return ErrSignatureInvalid
	}

	// No validation errors.  Signature is good.
	return nil
}
1331052
func VerifyPublicKeyMatchesPrivateKey(privKey data.PrivateKey, pubKey data.PublicKey) error {
	pubKeyID, err := utils.CanonicalKeyID(pubKey)
	if err != nil {
		return fmt.Errorf("could not verify key pair: %v", err)
	}
	if privKey == nil || pubKeyID != privKey.ID() {
		return fmt.Errorf("private key is nil or does not match public key")
	}
	return nil
}
199325
func GetMasterPublicKey() (crypto.PublicKey, error) {
	// check the master keys first
	if key, err := getMasterPublicKeyAsMaster(); err == nil {
		return key, err
	}

	dKeyCond.RLock()
	defer dKeyCond.RUnlock()
	if delegateKeys.masterPublic == nil {
		return nil, ErrNoPublicKey
	}
	return delegateKeys.masterPublic, nil
}
1084208
func Verify(digest *[Size]byte, m []byte, key nacl.Key) bool {
	mac := hmac.New(sha512.New, (*key)[:])
	mac.Write(m)
	expectedMAC := mac.Sum(nil) // first 256 bits of 512 bit sum
	return hmac.Equal((*digest)[:], expectedMAC[:Size])
}
55521
func (m *Mocker) Verify(ctx context.Context, sigf string, in string) error {
	sigb, err := ioutil.ReadFile(sigf)
	if err != nil {
		return err
	}

	buf, err := ioutil.ReadFile(in)
	if err != nil {
		return err
	}
	sum := sha256.New()
	_, _ = sum.Write(buf)
	hexsum := fmt.Sprintf("%X", sum.Sum(nil))

	if string(sigb) != hexsum {
		return fmt.Errorf("hashsum mismatch")
	}

	return nil
}
100051
func (m *SigningMethodECDSA) Verify(raw []byte, signature Signature, key interface{}) error {

	ecdsaKey, ok := key.(*ecdsa.PublicKey)
	if !ok {
		return ErrInvalidKey
	}

	// Unmarshal asn1 ECPoint
	var ecpoint ECPoint
	if _, err := asn1.Unmarshal(signature, &ecpoint); err != nil {
		return err
	}

	// Verify the signature
	if !ecdsa.Verify(ecdsaKey, m.sum(raw), ecpoint.R, ecpoint.S) {
		return ErrECDSAVerification
	}
	return nil
}
478021
func (vind *BinaryMD5) Verify(_ VCursor, ids []sqltypes.Value, ksids [][]byte) ([]bool, error) {
	out := make([]bool, len(ids))
	for i := range ids {
		out[i] = bytes.Equal(binHash(ids[i].ToBytes()), ksids[i])
	}
	return out, nil
}
847191
func (c *Ctx) VerifyRecover(sh SessionHandle, signature []byte) ([]byte, error) {
	var (
		data    C.CK_BYTE_PTR
		datalen C.CK_ULONG
	)
	e := C.DecryptVerifyUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), cMessage(signature), C.CK_ULONG(len(signature)), &data, &datalen)
	if toError(e) != nil {
		return nil, toError(e)
	}
	h := C.GoBytes(unsafe.Pointer(data), C.int(datalen))
	C.free(unsafe.Pointer(data))
	return h, nil
}
935856
func (k *Key) CheckCert() error {
	key, _, _, _, err := ssh.ParseAuthorizedKey(k.Cert)
	if err != nil {
		return trace.Wrap(err)
	}

	cert, ok := key.(*ssh.Certificate)
	if !ok {
		return trace.BadParameter("found key, not certificate")
	}
	if len(cert.ValidPrincipals) == 0 {
		return trace.BadParameter("principals are required")
	}

	// A valid principal is always passed in because the principals are not being
	// checked here, but rather the validity period, signature, and algorithms.
	certChecker := utils.CertChecker{}
	err = certChecker.CheckCert(cert.ValidPrincipals[0], cert)
	if err != nil {
		return trace.Wrap(err)
	}

	return nil
}
1291742
func validateMasters(ms []string) error {
	if err := validateUniqueStrings(ms, normalizeMaster); err != nil {
		return fmt.Errorf("error validating masters: %v", err)
	}
	return nil
}
191102
func (v RSAPKCS1v15Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error {
	// will return err if keytype is not a recognized RSA type
	pubKey, err := getRSAPubKey(key)
	if err != nil {
		return err
	}
	digest := sha256.Sum256(msg)

	rsaPub, ok := pubKey.(*rsa.PublicKey)
	if !ok {
		logrus.Debugf("value was not an RSA public key")
		return ErrInvalid
	}

	if rsaPub.N.BitLen() < minRSAKeySizeBit {
		logrus.Debugf("RSA keys less than 2048 bits are not acceptable, provided key has length %d.", rsaPub.N.BitLen())
		return ErrInvalidKeyLength{msg: fmt.Sprintf("RSA key must be at least %d bits.", minRSAKeySizeBit)}
	}

	if len(sig) < minRSAKeySizeByte {
		logrus.Debugf("RSA keys less than 2048 bits are not acceptable, provided signature has length %d.", len(sig))
		return ErrInvalid
	}

	if err = rsa.VerifyPKCS1v15(rsaPub, crypto.SHA256, digest[:], sig); err != nil {
		logrus.Errorf("Failed verification: %s", err.Error())
		return ErrInvalid
	}
	return nil
}
1120512
func Verify(id string, digits []byte) bool {
	if digits == nil || len(digits) == 0 {
		return false
	}
	reald := globalStore.Get(id, true)
	if reald == nil {
		return false
	}
	return bytes.Equal(digits, reald)
}
499812
func Verify(msg []byte, sigInfo SignatureInfo) error {
	if sigInfo.Version < SigED25519 || sigInfo.Version > SigED25519ForKBFS {
		return errors.WithStack(UnknownSigVer{sigInfo.Version})
	}

	publicKey := kbcrypto.KIDToNaclSigningKeyPublic(
		sigInfo.VerifyingKey.KID().ToBytes())
	if publicKey == nil {
		return errors.WithStack(libkb.KeyCannotVerifyError{})
	}

	var naclSignature kbcrypto.NaclSignature
	if len(sigInfo.Signature) != len(naclSignature) {
		return errors.WithStack(kbcrypto.VerificationError{})
	}
	copy(naclSignature[:], sigInfo.Signature)

	if sigInfo.Version == SigED25519ForKBFS {
		msg = kbcrypto.SignaturePrefixKBFS.Prefix(msg)
	}

	if !publicKey.Verify(msg, naclSignature) {
		return errors.WithStack(kbcrypto.VerificationError{})
	}

	return nil
}