U m?Z?m@Z@ddlAmBZBmCZCmDZDddlEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNddlOmPZPmQZQddlRmSZSmTZTmUZUddlVmWZWeXeYZZeddGdddZ[Gdd d eHej\Z]Gd!d"d"e]eSZ^Gd#d$d$e]eTZ_Gd%d&d&e]eUZ`e?ad'Zbe?ad(Zcdkd)d*Zddld+d,Zedmd-d.ZfejgGd/d0d0ejhZidnejeWd1d2d3Zkeejlejd4d5d6Zmeejlejd4d7d8Znejlejejd9d:d;Zoeee!jpeefd<d=d>Zqeejrejd4d?d@ZsejreejejejdAdBdCZtejejue[dDdEdFZvdoe ejuejeWe[ejwdGdHdIZxGdJdKdKeyZzGdLdMdMZ{GdNdOdOej|Z}GdPdQdQej|Z~edRZe!jpejeeje9dSdTdUZGdVdWdWe{ePZePeeje{eejdXdYdZZejwe{eeejeeWfd[d\d]Ze?jd^d_d`ZdadbZdcddZdedfZdgdhZeLjGdidjdjeLZdS)pN) dataclass)sha1sha256)DictListOptionalSetTupleUnion)algoscmscorex509)RSAESOAEPParams)KeyEncryptionAlgorithmKeyEncryptionAlgorithmId)PrivateKeyInfoPublicKeyAlgorithm PublicKeyInfo)hasheskeywrap serialization)ECDHEllipticCurvePrivateKeyEllipticCurvePublicKey)generate_private_key)MGF1OAEPAsymmetricPaddingPKCS1v15) RSAPrivateKey RSAPublicKey)X448PrivateKey X448PublicKey)X25519PrivateKeyX25519PublicKey)KeyDerivationFunction)X963KDF)pkcs12)genericmisc)aes_cbc_decryptaes_cbc_encrypt rc4_encrypt) AuthResult AuthStatus CryptFilterCryptFilterBuilderCryptFilterConfigurationIdentityCryptFilterSecurityHandlerSecurityHandlerVersionbuild_crypt_filter)SerialisableCredentialSerialisedCredential)AESCryptFilterMixinAESGCMCryptFilterMixinRC4CryptFilterMixin)PubKeyPermissionsT)frozenc@s&eZdZUdZeed<dZeed<dS)RecipientEncryptionPolicyFignore_key_usage prefer_oaepN)__name__ __module__ __qualname__rAbool__annotations__rBrHrHB/tmp/pip-unpacked-wheel-w101_d3s/pyhanko/pdf_utils/crypt/pubkey.pyr@Fs   r@cseZdZUdZdZeded<ddddfdd Zee d d d Z fd dZ e feejee dddZed ddZed ddZfddZZS)PubKeyCryptFiltera Crypt filter for use with public key security handler. These are a little more independent than their counterparts for the standard security handlers, since different crypt filters can cater to different sets of recipients. :param recipients: List of CMS objects encoding recipient information for this crypt filters. :param acts_as_default: Indicates whether this filter is intended to be used in ``/StrF`` or ``/StmF``. :param encrypt_metadata: Whether this crypt filter should encrypt document-level metadata. .. warning:: See :class:`.SecurityHandler` for some background on the way pyHanko interprets this value. NPubKeySecurityHandler_handlerFT) recipientsacts_as_defaultencrypt_metadatac s6||_||_||_d|_d|_|_tjf|dS)NF)rMrNrO_pubkey_auth_failed _shared_key_recp_key_seedsuper__init__)selfrMrNrOkwargs __class__rHrIrTms  zPubKeyCryptFilter.__init__returncCs|jSN)rPrUrHrHrI _auth_failed|szPubKeyCryptFilter._auth_failedcs*t|tstt|d|_|_dSr[) isinstancerK TypeErrorrS_set_security_handlerrQrR)rUhandlerrWrHrIr`s  z'PubKeyCryptFilter._set_security_handler)certspolicypermscCsv|js|jrtd|jdkr2td|_g|_|jdk sF|jdkrPtdt||j|||jd}|j |dS)ay Add recipients to this crypt filter. This always adds one full CMS object to the Recipients array :param certs: A list of recipient certificates. :param policy: Encryption policy choices for the chosen set of recipients. :param perms: The permission bits to assign to the listed recipients. zCA non-default crypt filter cannot have multiple sets of recipients.NzYAdding recipients after deriving the shared key or before authenticating is not possible.)rcinclude_permissions) rNrMr+PdfErrorsecrets token_bytesrRrQconstruct_recipient_cmsappend)rUrbrcrdZnew_cmsrHrHrIadd_recipientss&   z PubKeyCryptFilter.add_recipientscCsB|jD]0}t||\}}|dk r||_ttj|SqttjS)a Authenticate to this crypt filter in particular. If used in ``/StmF`` or ``/StrF``, you don't need to worry about calling this method directly. :param credential: The :class:`.EnvelopeKeyDecrypter` to authenticate with. :return: An :class:`AuthResult` object indicating the level of access obtained. N)rMread_seed_from_recipient_cmsrRr0r1USERFAILED)rU credentialrecpseedrdrHrHrI authenticates zPubKeyCryptFilter.authenticatecCs|jdk st|jdkr"td|jjtjkr8t}nt }| |j|j D]}| | qP|j sz|jrz| d|d|jS)Nz&No seed available; authenticate first.s)rLAssertionErrorrRr+rgversionr7AES256rrupdaterMdumprOrNdigestkeylen)rUZmdrqrHrHrIderive_shared_encryption_keys      z.PubKeyCryptFilter.derive_shared_encryption_keycsdt}t|jd|d<tdd|jD}|jrD||d<n |d|d<t|j |d<|S)N/Lengthcss|]}t|VqdSr[r*ByteStringObjectrx.0rqrHrHrI sz2PubKeyCryptFilter.as_pdf_object.. /Recipientsr/EncryptMetadata) rS as_pdf_objectr* NumberObjectrz ArrayObjectrMrN BooleanObjectrO)rUresultrMrWrHrIrs    zPubKeyCryptFilter.as_pdf_object)rCrDrE__doc__rLrrGrTpropertyrFr]r`r>allow_everythingrr Certificater@rlr0rsbytesr{r __classcell__rHrHrWrIrJVs$   +rJc@seZdZdZdS)PubKeyAESCryptFilterz< AES crypt filter for public key security handlers. NrCrDrErrHrHrHrIrsrc@seZdZdZdS)PubKeyAESGCMCryptFilterz@ AES-GCM crypt filter for public key security handlers. NrrHrHrHrIrsrc@seZdZdZdS)PubKeyRC4CryptFilterz< RC4 crypt filter for public key security handlers. NrrHrHrHrIrsrz/DefaultCryptFilterz/DefEmbeddedFilecCsttt|d||dittdSNT)rzrNrMrOZdefault_stream_filterZdefault_string_filter)r4DEFAULT_CRYPT_FILTERrrzrMrOrHrHrI_pubkey_rc4_configsrcCsttt|d||dittdSr)r4rrrrHrHrI_pubkey_aes_config!srcCstttd||dittdS)NT)rNrMrOr)r4rrrMrOrHrHrI_pubkey_gcm_config0src@s.eZdZdZedZedZedZdS)PubKeyAdbeSubFilterz{ Enum describing the different subfilters that can be used for public key encryption in the PDF specification. z/adbe.pkcs7.s3z/adbe.pkcs7.s4z/adbe.pkcs7.s5N) rCrDrErr* NameObjectZS3S4S5rHrHrHrIr>s  r)rrrdcCs$t|dkst||r|ndS)Nre)lenrtas_bytes)rrrdrfrHrHrIconstruct_envelope_contentJsr) pub_key_inforid envelope_keycCsRt}tdtdi}t|}t|ts6t |j ||d}t |||dS)N algorithmrsaes_pkcs1v15paddingralgoencrypted_data) rr rrrload_der_public_keyrxr^r!rtencrypt _format_ktri)rrrrrpub_keyrrHrHrI_rsaes_pkcs1v15_recipientQs rc Csddlm}ddlm}||}||}ttdtd|idd|iddd}tt ||dd }t | } t | tst| j||d } t||| d S) Nrget_pyca_cryptography_hash)select_suitable_signing_md rsaes_oaeprmgf1r parameters)hash_algorithmmask_gen_algorithmmgfrlabelrr)pyhanko.sign.generalrZpyhanko.sign.signers.pdf_cmsrr rrrrrrrrxr^r!rtrr) rrrrrZdigest_function_name digest_specrrrrrHrHrI_rsaes_oaep_recipientbs(  rrc Cstdtd|||diS)Nktrir)rurkey_encryption_algorithm encrypted_key)r RecipientInfoZKeyTransRecipientInforrHrHrIrsr)rrZcCs|j}|dkr|jd}n|dkr(d}nd}|dkrJttdtdfS|dkrhttd td fSttd td fSdS) Necr)x25519Z aes128_wrapz1.3.132.1.11.1Z aes192_wrapz1.3.132.1.11.2Z aes256_wrapz1.3.132.1.11.3)rZbit_sizerSHA256rSHA384SHA512)r algo_nameZapprox_sec_levelrHrHrI_choose_ecdh_settingss( rcCst|\}}}td|i}t|}t|trLt|j}| t |} n@t|t rjt }| |} n"t|trt }| |} ntt|tjjtjj} td} t||| d} | | } tj| |d}t|| t ||d| |dS)Nr kdf_digest key_wrap_algouser_keying_material) wrapping_keyZ key_to_wraprroriginator_keyrukmr)!rrrrrxr^rgenerate_ec_private_keycurveexchangerr%r$generater#r"NotImplementedErrorrload public_key public_bytesEncodingDER PublicFormatSubjectPublicKeyInforhri_kdf_for_exchangederiverZ aes_key_wrap _format_karir )rrrrkey_wrap_algo_idZkey_exch_algo_idrrr ecdh_valueZoriginator_key_inforkdfZkekrrHrHrI_ecdh_recipientsV          rrc Cs8tjdtdtjd|d||t||dgddS)Nkarir)namevalue)rr)ru originatorrrrecipient_encrypted_keys)r rZKeyAgreeRecipientInfoOriginatorIdentifierOrKeyZRecipientEncryptedKeyrrHrHrIrs"r)rcertrcc Cs|j}|d}|dj}t|dks(t|js\|j}|dksFd|jkr\td|jj dt |j |j d}|dkrt d|i}|jrt|||St|||Sn2|d krt d|i} t|| |Std |d dS) Nr key_enciphermentzCertificate for subject z8 does not have the 'key_encipherment' key usage bit set.)issuer serial_numberrsaZissuer_and_serial_number)rrx448zCannot encrypt for key type '')rnativerrtrAZkey_usage_valuer+Z PdfWriteErrorsubjectZhuman_friendlyr IssuerAndSerialNumberrrRecipientIdentifierrBrrKeyAgreementRecipientIdentifierrr) rrrcrZpubkey_algo_infoZalgorithm_nameZ key_usageZiss_serial_ridrZka_ridrHrHrI_recipient_info s8     r) certificatesrrrdrcrZc st|||d}tdt|dd\}}fdd|D}ttd|d} tt d| |d } t d || d } t t d | d S)N)rfr)ivcsg|]}t|dqS))rc)r)rrrrcrHrI Xsz+construct_recipient_cms..Z aes256_cbcrdata) content_typecontent_encryption_algorithmencrypted_contentr)rurecipient_infosencrypted_content_infoenveloped_data)rcontent) rrhrir.r ZEncryptionAlgorithmr ZEncryptionAlgorithmIdZEncryptedContentInfoZ ContentType EnvelopedData ContentInfo) rrrrdrcrfZenvelope_contentrencrypted_envelope_contentZ rec_infosrr r rHrrIrj7sH     rjc@s eZdZdS)InappropriateCredentialErrorN)rCrDrErHrHrHrIr~src@sReZdZdZeejdddZee j edddZ ee j e j eedd d Z d S) EnvelopeKeyDecrypterz General credential class for use with public key security handlers. This allows the key decryption process to happen offline, e.g. on a smart card. rYcCstdS)zI :return: Return the recipient's certificate Nrr\rHrHrIrszEnvelopeKeyDecrypter.certr algo_paramsrZcCstdS)a Invoke the actual key decryption algorithm. Used with key transport. :param encrypted_key: Payload to decrypt. :param algo_params: Specification of the encryption algorithm as a CMS object. :raises InappropriateCredentialError: if the credential cannot be used for key transport. :return: The decrypted payload. Nr)rUrrrHrHrIdecryptszEnvelopeKeyDecrypter.decryptrroriginator_identifierrrZcCstdS)a" Decrypt an envelope key using a key derived from a key exchange. :param encrypted_key: Payload to decrypt. :param algo_params: Specification of the encryption algorithm as a CMS object. :param originator_identifier: Information about the originator necessary to complete the key exchange. :param user_keying_material: The user keying material that will be used in the key derivation. :return: The decrypted payload. Nr)rUrrrrrHrHrIdecrypt_with_exchangesz*EnvelopeKeyDecrypter.decrypt_with_exchangeN)rCrDrErrrrrrr rrrrrHrHrHrIrs rc@seZdZdefdejfgZdS)_PrivKeyAndCertkeyrN)rCrDrErrr_fieldsrHrHrHrIrsrc@s4eZdZdefdejdddfdejddifgZd S) ECCCMSSharedInfokey_info entityUInforT)explicitoptional suppPubInforr)N)rCrDrErr OctetStringrrHrHrHrIrsrzaes(\d+)_wrap(_pad)?)rrrrZc Cs^|dj}t|}|s&t|dt|d}t||dt||t d|d dS)Nr* is not a supported key wrapping algorithmr,r|z>I)rrr!)rlengthZ sharedinfo) rAES_WRAP_PATTERN fullmatchrintgroupr'rstructpackrx)rrrrZ wrap_matchZ kek_bit_lenrHrHrIrs"   rc@seZdZdZedZeedddZ e dddZ ee dd d Z e jed d d Zee jdddZedddZedddZe eje dddZe ejejee e dddZdS)SimpleEnvelopeKeyDecrypterz Implementation of :class:`.EnvelopeKeyDecrypter` where the private key is an RSA or ECC key residing in memory. :param cert: The recipient's certificate. :param private_key: The recipient's private key. z1\.3\.132\.1\.11\.(\d+)rYcCsdS)NZ raw_privkeyrHclsrHrHrIget_namesz#SimpleEnvelopeKeyDecrypter.get_namecCs|j|jd}t|S)N)rr) private_keyrrrx)rUvaluesrHrHrI _ser_valuesz%SimpleEnvelopeKeyDecrypter._ser_value)rc CsZzt|}|d}|d}Wn.tk rL}ztd|W5d}~XYnXt||dS)Nrrz-Failed to decode serialised pubkey credentialrr/)rr ValueErrorr+ PdfReadErrorr+)r-rdecodedrrerHrHrI _deser_values  z'SimpleEnvelopeKeyDecrypter._deser_valuer2cCs||_||_dSr[)r/_cert)rUrr/rHrHrIrT sz#SimpleEnvelopeKeyDecrypter.__init__cCs|jSr[)r8r\rHrHrIrszSimpleEnvelopeKeyDecrypter.certNc Cszddlm}z$|||d}ddlm}||}Wn<tttfk rl}ztjd|dWYdSd}~XYnXt||dS) a Load a key decrypter using key material from files on disk. :param key_file: File containing the recipient's private key. :param cert_file: File containing the recipient's certificate. :param key_passphrase: Passphrase for the key file, if applicable. :return: An instance of :class:`.SimpleEnvelopeKeyDecrypter`. r)load_private_key_from_pemder) passphrase)load_cert_from_pemderz%Could not load cryptographic materialexc_infoNr2) keysr9r;IOErrorr3r_loggererrorr+)key_file cert_fileZkey_passphraser9r/r;rr6rHrHrIrs   zSimpleEnvelopeKeyDecrypter.loadc CszTt|d}|}W5QRXt||\}}}ddlm}m} ||}| |}WnDttt fk r} z t j d|d| dWYdSd} ~ XYnXt ||dS) aZ Load a key decrypter using key material from a PKCS#12 file on disk. :param pfx_file: Path to the PKCS#12 file containing the key material. :param passphrase: Passphrase for the private key, if applicable. :return: An instance of :class:`.SimpleEnvelopeKeyDecrypter`. rbr))_translate_pyca_cryptography_cert_to_asn1(_translate_pyca_cryptography_key_to_asn1zCould not open PKCS#12 file .r<Nr2) openreadr(load_key_and_certificatesr>rErFr?r3r_r@rAr+) r-Zpfx_filer:fZ pfx_bytesr/rZ other_certsrErFr6rHrHrI load_pkcs120s    z&SimpleEnvelopeKeyDecrypter.load_pkcs12rc Cs|dj}|dkrt}n|dkrddlm}|d}|d}|dj}|dkr`td |d tt||ddjd ||d djd d}ntd|dtj|j d d} t | t st d| j||dS)a Decrypt the payload using RSA with PKCS#1 v1.5 padding or OAEP. Other schemes are not (currently) supported by this implementation. :param encrypted_key: Payload to decrypt. :param algo_params: Specification of the encryption algorithm as a CMS object. Must use ``rsaes_pkcs1v15`` or ``rsaes_oaep``. :return: The decrypted payload. rrrrrrrrz#Only MGF1 is implemented, but got 'r)rrNrzSOnly 'rsaes_pkcs1v15' and 'rsaes_oaep' are supported for envelope decryption, not 'z'.passwordz5The loaded key does not seem to be an RSA private keyr)rrrrrrrrload_der_private_keyr/rxr^r rr) rUrrrrrZ oaep_paramsrZmgf_namepriv_keyrHrHrIrQsF         z"SimpleEnvelopeKeyDecrypter.decryptrcCs|d}|j|j}d}|rJttttd| dd}|sVt dt j |d}|dj} t| st | d| drtjntj} t|||d } |jd krt d |j} t| } tj|jdd }d }t|tr4t| tr| j j|j jkr$t!||"t#| }n`t|t$r`t| t%sTt!||"| }n4t|t&rt| t'st!||"| }nt(d| )|}| ||dS)am Decrypt the payload using a key agreed via ephemeral-static standard (non-cofactor) ECDH with X9.63 key derivation. Other schemes aer not supported at this time. :param encrypted_key: Payload to decrypt. :param algo_params: Specification of the encryption algorithm as a CMS object. :param originator_identifier: The originator info, which must be an EC key. :param user_keying_material: The user keying material that will be used in the key derivation. :return: The decrypted payload. rN)0123r,zGOnly dhSinglePass-stdDH algorithms from SEC 1 / RFC 5753 are supported.rr#Z_padrrz Only originator_key is supportedrMzCOriginator's public key is not compatible with selected private keyz4The loaded key does not seem to be an EC private key)rZ wrapped_key)*dhsinglepass_stddh_arc_patternr&ZdottedrSHA224rrrgetr(rr rrrxrr%endswithrZaes_key_unwrap_with_paddingZaes_key_unwraprrchosenZuntagrrrOr/r^rrrr3rrr$r%r"r#rr)rUrrrroidmatchrrrZ unwrap_keyrZoriginator_pub_key_infoZoriginator_pub_keyrPZ mismatch_msgrZ derived_kekrHrHrIrs            z0SimpleEnvelopeKeyDecrypter.decrypt_with_exchange)N)N)rCrDrErrecompilerU classmethodstrr.rr1r7rrrrTrr staticmethodrrLr rrrrrrHrHrHrIr+s0    ! 8r+)ed decrypterrZc Cs|dD]}|jdkr|j}|dj}t|tjs from_bytes)rfrbrrar rrrZ cipher_nameZdecryption_funrr rrrdrHrHrIrm5sP      rm)cfdictcCsbz |d}Wntk r*tdYnXt|tjr>|f}dd|D}|dd}||dS)Nrz.PubKey CF dictionary must have /Recipients keycSsg|]}tj|jqSrHr rroriginal_bytesrxrHrHrIrwsz0_read_generic_pubkey_cf_info..rTr)rhr+r4r^r*rrW)rjrMrecipient_objsrOrHrHrI_read_generic_pubkey_cf_infons    rpcCs(|dd}tf|d|dt|S)Nr}(r|rzrN)rWrrp)rjrN keylen_bitsrHrHrI_build_legacy_pubkey_cf~s rtcCstfd|dt|S)NrrrrrprjrNrHrHrI_build_aes128_pubkey_cfs rwcCstfd|dt|S)NrrrrurvrHrHrI_build_aes256_pubkey_cfs rxcCstfd|it|S)NrN)rrprvrHrHrI_build_aesgcm_pubkey_cfs ryc seZdZUdZedeedeedeede edddiZ e eje fe d <ed ejd d ed ed feejeeedd d dZd0eeedeeeedfdd ZeedddZee edddZ!eej"ee#dddZ$eej"eddfdd Z%eej"dd d!Z&eej"dd"d#Z'eej"dd$d%Z(d&d'Z)eefeejeed(d)d*Z*d1e+e,e-fe.d+d,d-Z/edd.d/Z0Z1S)2rKz Security handler for public key encryption in PDF. As with the standard security handler, you essentially shouldn't ever have to instantiate these yourself (see :meth:`build_from_certs`). z/V2z/AESV2z/AESV3z/AESV4z /IdentitycCstSr[)r5)___rHrHrIrzPubKeySecurityHandler._known_crypt_filtersrT)rbrdrcpdf_macrZc Ks|r tjntj} d} |tjkr@|r2td|dd} nt|d|d} | rf|tjkrf|tj M}t d} nd} ||| |f|| d| d| }|j |||d|S)aO Create a new public key security handler. This method takes many parameters, but only ``certs`` is mandatory. The default behaviour is to create a public key encryption handler where the underlying symmetric encryption is provided by AES-256. Any remaining keyword arguments will be passed to the constructor. :param certs: The recipients' certificates. :param keylen_bytes: The key length (in bytes). This is only relevant for legacy security handlers. :param version: The security handler version to use. :param use_aes: Use AES-128 instead of RC4 (only meaningful if the ``version`` parameter is :attr:`~.SecurityHandlerVersion.RC4_OR_AES128`). :param use_crypt_filters: Whether to use crypt filters. This is mandatory for security handlers of version :attr:`~.SecurityHandlerVersion.RC4_OR_AES128` or higher. :param perms: Permission flags. :param encrypt_metadata: Whether to encrypt document metadata. .. warning:: See :class:`.SecurityHandler` for some background on the way pyHanko interprets this value. :param pdf_mac: Include an ISO 32004 MAC. .. warning:: Only works for PDF 2.0 security handlers. :param policy: Encryption policy choices for the chosen set of recipients. :return: An instance of :class:`.PubKeySecurityHandler`. Nr)rOrMrr)rOcrypt_filter_configrokdf_saltrdrc) rrrr7 RC4_OR_AES128rrrvr>ZTOLERATE_MISSING_PDF_MACrhrirl)r-rbZ keylen_bytesruZuse_aesZuse_crypt_filtersrdrOrcr~rV subfiltercfcrshrHrHrIbuild_from_certssF8    z&PubKeySecurityHandler.build_from_certsNr4)rupubkey_handler_subfilterrrorc s|tjkr|tjkrtd|dkr|tjkr@td||d}nV|tjkrZt|||d}n<|tj krrt ||d}n$|tj krt d||d}n tdt j||||||d||_||_d|_dS)NzESubfilter /adbe.pkcs7.s5 is required for security handlers beyond V4.)rzrOrMrrz1Failed to impute a reasonable crypt filter config)rOcompat_entriesr)r7rrrr+rgZRC4_40rRC4_LONGER_KEYSZAES_GCMrrvrrSrTrrOrQ) rUrur legacy_keylenrOrrorrrWrHrIrT sZ    zPubKeySecurityHandler.__init__rYcCs tdS)Nz /Adobe.PubSec)r*rr,rHrHrIr.MszPubKeySecurityHandler.get_namecCsddtDS)NcSsh|] }|jqSrH)rrmrHrHrI SszCPubKeySecurityHandler.support_generic_subfilters..)rr,rHrHrIsupport_generic_subfiltersQsz0PubKeySecurityHandler.support_generic_subfilters)rjrNrZcCs$t|j||}|dkr td|S)NzJAn absent CFM or CFM of /None doesn't make sense in a PubSec CF dictionary)r8r}r+r4)r-rjrNcfrHrHrIread_cf_dictionaryUsz(PubKeySecurityHandler.read_cf_dictionary) encrypt_dictrZcsTt|}||}|dk r4|tjkr4tdn|dkrP|tjkrPtd|S)Nz=Crypt filters require /adbe.pkcs7.s5 as the declared handler.z./adbe.pkcs7.s5 handler requires crypt filters.)rSprocess_crypt_filters_determine_subfilterrrr+r4)r-rrrrWrHrIrcs  z+PubKeySecurityHandler.process_crypt_filters)rc Csh|dd}|ddkr"td|d}t|ddd}|jd td d }t||||d d ddS)Nr}rr|rz"Key length must be a multiple of 8rcSsdd|DS)NcSsg|]}tj|jqSrHrkrmrHrHrIrszSPubKeySecurityHandler.gather_pub_key_metadata....rH)lstrHrHrIr|rz?PubKeySecurityHandler.gather_pub_key_metadata..rTdefault/KDFSaltcSst|tjtjfr|jSdSr[)r^r*ZTextStringObjectrrl)rnrHrHrIr|s  )rrorOr)rWr+rg get_and_applyrFdict)r-rrsrzrMrOrHrHrIgather_pub_key_metadataus.   z-PubKeySecurityHandler.gather_pub_key_metadatacCsPz$tj|dtd|krtjntjdWStk rJtd|dYnXdS)N /SubFilterz/CFrz8Invalid /SubFilter in public key encryption dictionary: )r+rrrrr3r4)r-rrHrHrIrs z*PubKeySecurityHandler._determine_subfiltercCs6t|d}tf|||||d||S)N/V)rurr)r7Z from_numberrKrrr)r-rvrHrHrIinstantiate_from_pdf_objectsz1PubKeySecurityHandler.instantiate_from_pdf_objectcCst}t||d<|jj|d<|j|d<|jrJt |j|d<|j s\|jt j krpt |jd|d<|jt j krt|j|d<|jtjkr||jn0|}t|tsttdd |jD|d <|S) Nz/Filterrrrr|r}rcss|]}t|VqdSr[r~rrHrHrIrsz6PubKeySecurityHandler.as_pdf_object..r)r*DictionaryObjectrr.rrrurZ _kdf_saltrZ_compat_entriesr7rrrzrrOrrrwrZget_stream_filterr^rJr_rrM)rUrZ default_cfrHrHrIrs0       z#PubKeySecurityHandler.as_pdf_object)rbrdrccCs0|jD] }t|tsq |j|||dq dS)Nr)rstandard_filtersr^rJrl)rUrbrdrcrrHrHrIrls  z$PubKeySecurityHandler.add_recipients)rprZc Cst|tr:t|}t|ts4tdt|d|}n|}t }|j D]R}t|t s`qP| |}|jtjkr~|S|j}|dk rPt|tst||M}qPt|tr||_ttj|S)a Authenticate a user to this security handler. :param credential: The credential to use (an instance of :class:`.EnvelopeKeyDecrypter` in this case). :param id1: First part of the document ID. Public key encryption handlers ignore this key. :return: An :class:`AuthResult` object indicating the level of access obtained. zRPubkey authentication credential must be an instance of EnvelopeKeyDecrypter, not rGN)r^r:r9Z deserialiserr+r4typer>rrrrJrsstatusr1roZpermission_flagsrtZ _credentialr0rn) rUrpZid1Zdeser_credentialZactual_credentialrdrrZcf_flagsrHrHrIrss,        z"PubKeySecurityHandler.authenticatecCs |jjSr[)rZget_for_streamZ shared_keyr\rHrHrIget_file_encryption_keysz-PubKeySecurityHandler.get_file_encryption_key)TNNTN)N)2rCrDrErr*rrtrwrxryr}rr3rGr^r7rvr>rr@rrrrFrrrlistrrTr_r.rrrr2rrrrrrrlr rr:r0rsrrrHrHrWrIrKs `C ! !   2rK)NT)NT)NT)T)T)abcenumloggingr\rhr) dataclassesrhashlibrrtypingrrrrr r Z asn1cryptor r r rZasn1crypto.algosrZasn1crypto.cmsrrZasn1crypto.keysrrrZcryptography.hazmat.primitivesrrrZ,cryptography.hazmat.primitives.asymmetric.ecrrrrrZ1cryptography.hazmat.primitives.asymmetric.paddingrrrrZ-cryptography.hazmat.primitives.asymmetric.rsar r!Z.cryptography.hazmat.primitives.asymmetric.x448r"r#Z0cryptography.hazmat.primitives.asymmetric.x25519r$r%Z"cryptography.hazmat.primitives.kdfr&Z*cryptography.hazmat.primitives.kdf.x963kdfr',cryptography.hazmat.primitives.serializationr(r*r+_utilr-r.r/apir0r1r2r3r4r5r6r7r8Zcred_serr9r:Z filter_mixinsr;r<r= permissionsr> getLoggerrCr@r@ABCrJrrrrrZDEF_EMBEDDED_FILErrruniqueEnumrrrrrrr HashAlgorithmrrrrrrrrjr_rrSequencerrr]r%rr+registerr rermrrprtrwrxryrKrHrHrHrIs       ,           "   " ;  0 G;    C 9