
     hV              	          d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlm	Z	m
Z
mZmZmZmZ d dlmZmZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d
dl m!Z!m"Z" ddl#m$Z$m%Z%m&Z&m'Z' ddl(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 ddl3m4Z4m5Z5 ddl6m7Z7m8Z8  ej9        e:          Z; G d de,e j<                  Z= G d de=e7          Z> G d de=e8          Z?	  e!j@        d          ZA	  e!j@        d          ZB	 	 d8dZCd8dZD	 ejE         G d dejF                              ZG	 d9deHdeIfd ZJ	 d:d"eHd#ejK        fd$ZL	 	 d;d%e
ejK                 deHdeId&ejM        fd'ZN G d( d)          ZO G d* d+ejP                  ZQ G d, d-eOe4          ZR e4jS        eR           d.ejM        d/eOd&eeeH         eeI         f         fd0ZTd1e!jU        fd2ZVd3 ZWd4 ZXd5 ZYe0jS         G d6 d7e0                      ZZdS )<    N)sha1sha256)DictListOptionalSetTupleUnion)algoscmscorex509)PrivateKeyInfoPublicKeyAlgorithm)serialization)PKCS1v15)RSAPrivateKeyRSAPublicKey)pkcs12   )genericmisc   )aes_cbc_decryptaes_cbc_encrypt	as_signedrc4_encrypt)
	ALL_PERMS
AuthResult
AuthStatusCryptFilterCryptFilterBuilderCryptFilterConfigurationIdentityCryptFilterSecurityHandlerSecurityHandlerVersionbuild_crypt_filter)SerialisableCredentialSerialisedCredential)AESCryptFilterMixinRC4CryptFilterMixinc                        e Zd ZU dZdZed         ed<   dddd fd
Zed	e	fd
            Z
 fdZedfdeej                 fdZd	efdZd	efdZ fdZ xZS )PubKeyCryptFiltera  
    Crypt filter for use with public key security handler.
    These are a little more independent than their counterparts for
    the standard security handlers, since different crypt filters
    can cater to different sets of recipients.

    :param recipients:
        List of CMS objects encoding recipient information for this crypt
        filters.
    :param acts_as_default:
        Indicates whether this filter is intended to be used in
        ``/StrF`` or ``/StmF``.
    :param encrypt_metadata:
        Whether this crypt filter should encrypt document-level metadata.

        .. warning::
            See :class:`.SecurityHandler` for some background on the
            way pyHanko interprets this value.
    NPubKeySecurityHandler_handlerFT)
recipientsacts_as_defaultencrypt_metadatac                    || _         || _        || _        d| _        d x| _        | _         t                      j        di | d S )NF )r0   r1   r2   _pubkey_auth_failed_shared_key_recp_key_seedsuper__init__)selfr0   r1   r2   kwargs	__class__s        Z/var/www/html/Sam_Eipo/venv/lib/python3.11/site-packages/pyhanko/pdf_utils/crypt/pubkey.pyr9   zPubKeyCryptFilter.__init__>   sW     %. 0#( 1554.""6"""""    returnc                     | j         S N)r5   r:   s    r=   _auth_failedzPubKeyCryptFilter._auth_failedM   s    ''r>   c                     t          |t                    st          t                                          |           d x| _        | _        d S rA   )
isinstancer.   	TypeErrorr8   _set_security_handlerr6   r7   )r:   handlerr<   s     r=   rG   z'PubKeyCryptFilter._set_security_handlerQ   sI    '#899 	O%%g...1554...r>   certsc                 f   | j         s| j        rt          j        d          | j         t	          j        d          | _        g | _        | j        | j        t          j        d          t          || j        t          |          | j         |          }| j        
                    |           dS )a  
        Add recipients to this crypt filter.
        This always adds one full CMS object to the Recipients array

        :param certs:
            A list of recipient certificates.
        :param perms:
            The permission bits to assign to the listed recipients.
        :param ignore_key_usage:
            If ``False``, the *keyEncipherment* key usage extension is required.
        zCA non-default crypt filter cannot have multiple sets of recipients.N   zYAdding recipients after deriving the shared key or before authenticating is not possible.)include_permissionsignore_key_usage)r1   r0   r   PdfErrorsecretstoken_bytesr7   r6   construct_recipient_cmsr   append)r:   rI   permsrM   new_cmss        r=   add_recipientsz PubKeyCryptFilter.add_recipientsW   s    $ # 	 	-   ?" #*"5b"9"9D DO'4+>+F-9   *e $ 4-
 
 
 	w'''''r>   c                     | j         D ]:}t          ||          \  }}|#|| _        t          t          j        |          c S ;t          t          j                  S )a  
        Authenticate to this crypt filter in particular.
        If used in ``/StmF`` or ``/StrF``, you don't need to worry about
        calling this method directly.

        :param credential:
            The :class:`.EnvelopeKeyDecrypter` to authenticate with.
        :return:
            An :class:`AuthResult` object indicating the level of access
            obtained.
        )r0   read_seed_from_recipient_cmsr7   r   r    USERFAILED)r:   
credentialrecpseedrS   s        r=   authenticatezPubKeyCryptFilter.authenticate   sf     O 	: 	:D6tZHHKD%&*#!*/599999   *+,,,r>   c                    | j         J | j        t          j        d          | j         j        t
          j        k    rt                      }nt                      }|	                    | j                   | j
        D ])}|	                    |                                           *| j        s| j        r|	                    d           |                                d | j                 S )Nz&No seed available; authenticate first.s   )r/   r7   r   rN   versionr&   AES256r   r   updater0   dumpr2   r1   digestkeylen)r:   mdr[   s      r=   derive_shared_encryption_keyz.PubKeyCryptFilter.derive_shared_encryption_key   s    }(((&- HIII= $:$AAABBB
		$%&&&O 	# 	#DIIdiikk""""$ 	+)= 	+II)***yy{{=T[=))r>   c                 4   t                                                      }t          j        | j        dz            |d<   t          j        d | j        D                       }| j        r||d<   n|d         |d<   t          j        | j	                  |d<   |S )N   /Lengthc              3   b   K   | ]*}t          j        |                                          V  +d S rA   r   ByteStringObjectrb   .0r[   s     r=   	<genexpr>z2PubKeyCryptFilter.as_pdf_object.<locals>.<genexpr>   sF       )
 )
6:G$TYY[[11)
 )
 )
 )
 )
 )
r>   /Recipientsr   /EncryptMetadata)
r8   as_pdf_objectr   NumberObjectrd   ArrayObjectr0   r1   BooleanObjectr2   )r:   resultr0   r<   s      r=   rr   zPubKeyCryptFilter.as_pdf_object   s    &&((#0qAAy( )
 )
>Bo)
 )
 )
 
 

  	2$.F=!! %/qMF=!%,%:!&
 &
!" r>   )__name__
__module____qualname____doc__r/   r   __annotations__r9   propertyboolrC   rG   r   r   r   CertificaterU   r   r]   bytesrf   rr   __classcell__r<   s   @r=   r-   r-   '   s2         ( 37Hh./666
 # # # # # # # (d ( ( ( X(6 6 6 6 6 	)( )(D$%)( )( )( )(V-* - - - -&*e * * * *        r>   r-   c                       e Zd ZdZdS )PubKeyAESCryptFilterz<
    AES crypt filter for public key security handlers.
    Nrw   rx   ry   rz   r4   r>   r=   r   r                	Dr>   r   c                       e Zd ZdZdS )PubKeyRC4CryptFilterz<
    RC4 crypt filter for public key security handlers.
    Nr   r4   r>   r=   r   r      r   r>   r   z/DefaultCryptFilterz/DefEmbeddedFileTc           	      j    t          t          t          | d||          it          t                    S NT)rd   r1   r0   r2   )default_stream_filterdefault_string_filter)r#   DEFAULT_CRYPT_FILTERr   rd   r0   r2   s      r=   _pubkey_rc4_configr      G    # "6 $%!1	# # #	
 32   r>   c           	      j    t          t          t          | d||          it          t                    S r   )r#   r   r   r   s      r=   _pubkey_aes_configr      r   r>   c                   r    e Zd ZdZ ej        d          Z ej        d          Z ej        d          ZdS )PubKeyAdbeSubFilterz{
    Enum describing the different subfilters that can be used for public key
    encryption in the PDF specification.
    z/adbe.pkcs7.s3z/adbe.pkcs7.s4z/adbe.pkcs7.s5N)	rw   rx   ry   rz   r   
NameObjectS3S4S5r4   r>   r=   r   r      sS         
 
	,	-	-B		,	-	-B		,	-	-BBBr>   r   r\   rS   c                 d    t          |           dk    sJ | |rt          j        d|          ndz   S )NrK   <ir>   )lenstructpack)r\   rS   rL   s      r=   construct_envelope_contentr   
  s9     t99????/BK6;tU+++LLr>   Fenvelope_keycertc           
         |j         }|d         }|d         j        }|dk    rt          d| d          t          |           dk    sJ |s4|j        }|	d|j        vr"t          j        d|j        j         d          t          j
        |j                                                   }t          |t                    sJ |                    | t                      	          }t!          j        d
t!          j        |j        |j        d          i          }	t!          j        dt!          j        d          i          }
t!          j        dt!          j        d|	|
|d          i          S )N	algorithmrsaz3Certificate public key must be of type 'rsa', not ''.    key_enciphermentzCertificate for subject z8 does not have the 'key_encipherment' key usage bit set.paddingissuer_and_serial_number)issuerserial_numberrsaes_pkcs1v15ktrir   )r_   ridkey_encryption_algorithmencrypted_key)
public_keynativeNotImplementedErrorr   key_usage_valuer   PdfWriteErrorsubjecthuman_friendlyr   load_der_public_keyrb   rE   r   encryptr   r   RecipientIdentifierIssuerAndSerialNumberr   r   KeyEncryptionAlgorithmKeyEncryptionAlgorithmIdRecipientInfoKeyTransRecipientInfo)r   r   rM   pubkeypubkey_algo_infoalgorithm_name	key_usagepub_keyencrypted_datar   algos              r=   _recipient_infor     s    _F+1++>%k29N!'"' ' '
 
 	

 |"""" (	 2):J J J$F4<+F F F F  
 /0D0D0F0FGGGg|,,,,, __\8::_FFN 
!&(A;9KLL) )	
 C %	c23CDDE D C- 04%3	  		
  r>   certificatesr?   c                    t          |||          }t          j        d          t          |d           \  }}fd| D             }t	          j        t          j        d          |d          }	t	          j        t	          j	        d          |	|d          }
t	          j
        d	||
d
          }t	          j        t	          j	        d          |d          S )N)rL   r   )ivc                 4    g | ]}t          |           S ))rM   )r   )rn   r   r   rM   s     r=   
<listcomp>z+construct_recipient_cms.<locals>.<listcomp>i  s9        	d=MNNN  r>   
aes256_cbc)r   
parametersdata)content_typecontent_encryption_algorithmencrypted_contentr   )r_   recipient_infosencrypted_content_infoenveloped_data)r   content)r   rO   rP   r   r   EncryptionAlgorithmr   EncryptionAlgorithmIdEncryptedContentInfoContentTypeEnvelopedDataContentInfo)r   r\   rS   rL   rM   envelope_contentr   encrypted_envelope_content	rec_infosr   r   r   r   s       `       @r=   rQ   rQ   H  s=   , 2e)<   &r**L%4&4& & &"B"
       I
 "4\BB	
 	
 D !5OF33,0!;	
 	
  &(&<	
 	
 N ?O,<==%	
 	
  r>   c                   F    e Zd ZdZdej        fdZdedej	        defdZ
dS )	EnvelopeKeyDecrypterz
    General credential class for use with public key security handlers.

    This allows the key decryption process to happen offline, e.g. on a smart
    card.

    :param cert:
        The recipient's certificate.
    r   c                     || _         d S rA   )r   )r:   r   s     r=   r9   zEnvelopeKeyDecrypter.__init__  s    			r>   r   algo_paramsr?   c                     t           )a  
        Invoke the actual key decryption algorithm.

        :param encrypted_key:
            Payload to decrypt.
        :param algo_params:
            Specification of the encryption algorithm as a CMS object.
        :return:
            The decrypted payload.
        )r   )r:   r   r   s      r=   decryptzEnvelopeKeyDecrypter.decrypt  s
     "!r>   N)rw   rx   ry   rz   r   r~   r9   r   r   r   r   r4   r>   r=   r   r     sk         T-    """141K"	" " " " " "r>   r   c                   (    e Zd Zdefdej        fgZdS )_PrivKeyAndCertkeyr   N)rw   rx   ry   r   r   r~   _fieldsr4   r>   r=   r   r     s%        ~&1A(BCGGGr>   r   c                        e Zd ZdZedefd            ZdefdZedefd            Z	de
j        def fd	Zedd            Zedd            Zdedej        defdZ xZS )SimpleEnvelopeKeyDecrypterz
    Implementation of :class:`.EnvelopeKeyDecrypter` where the private key
    is an RSA key residing in memory.

    :param cert:
        The recipient's certificate.
    :param private_key:
        The recipient's private key.
    r?   c                     dS )Nraw_privkeyr4   clss    r=   get_namez#SimpleEnvelopeKeyDecrypter.get_name  s    }r>   c                 b    | j         | j        d}t          |                                          S )N)r   r   )private_keyr   r   rb   )r:   valuess     r=   
_ser_valuez%SimpleEnvelopeKeyDecrypter._ser_value  s.    )49==v&&++---r>   r   c                     	 t                               |          }|d         }|d         }n'# t          $ r}t          j        d          |d }~ww xY wt          ||          S )Nr   r   z-Failed to decode serialised pubkey credentialr   r   )r   load
ValueErrorr   PdfReadErrorr   )r   r   decodedr   r   es         r=   _deser_valuez'SimpleEnvelopeKeyDecrypter._deser_value  s}    	%**400G%.C6?DD 	 	 	#? 	 *tEEEEs   *- 
AAAr   r   c                 X    t                                          |           || _        d S rA   )r8   r9   r   )r:   r   r   r<   s      r=   r9   z#SimpleEnvelopeKeyDecrypter.__init__  s)    +6r>   Nc                     ddl m} 	  || |          }ddl m}  ||          }nA# t          t          t
          f$ r'}t                              d|           Y d}~dS d}~ww xY wt          ||          S )	a  
        Load a key decrypter using key material from files on disk.

        :param key_file:
            File containing the recipient's private key.
        :param cert_file:
            File containing the recipient's certificate.
        :param key_passphrase:
            Passphrase for the key file, if applicable.
        :return:
            An instance of :class:`.SimpleEnvelopeKeyDecrypter`.
           )load_private_key_from_pemder)
passphrase)load_cert_from_pemderz%Could not load cryptographic materialexc_infoNr   )	keysr   r  IOErrorr   rF   loggererrorr   )key_file	cert_filekey_passphraser   r   r  r   r   s           r=   r   zSimpleEnvelopeKeyDecrypter.load  s     	988888		66^  K 655555((33DDY/ 	 	 	LL@1LMMM44444	 *tMMMMs   ' A%A  A%c                    	 t          |d          5 }|                                }ddd           n# 1 swxY w Y   t          j        ||          \  }}}ddlm}m}	  ||          } |	|          }nE# t          t          t          f$ r+}
t                              d| d|
           Y d}
~
dS d}
~
ww xY wt          ||          S )	aZ  
        Load a key decrypter using key material from a PKCS#12 file on disk.

        :param pfx_file:
            Path to the PKCS#12 file containing the key material.
        :param passphrase:
            Passphrase for the private key, if applicable.
        :return:
            An instance of :class:`.SimpleEnvelopeKeyDecrypter`.
        rbNr   ))_translate_pyca_cryptography_cert_to_asn1(_translate_pyca_cryptography_key_to_asn1zCould not open PKCS#12 file .r  r   )openreadr   load_key_and_certificatesr  r  r  r  r   rF   r  r  r   )r   pfx_filer   f	pfx_bytesr   r   other_certsr  r  r   s              r=   load_pkcs12z&SimpleEnvelopeKeyDecrypter.load_pkcs12  sJ   	h%% %FFHH	% % % % % % % % % % % % % % %/5/O:0 0,[$       
 =<TBBDBB;OOKKY/ 	 	 	LLCCCCaLPPP44444	 *tMMMMs2   A6 3A6 7A6 7:A6 6B8 B33B8r   r   c                 6   |d         j         }|dk    rt          d| d          t          j        | j                                        d          }t          |t                    st          d          |                    |t                                S )	a  
        Decrypt the payload using RSA with PKCS#1 v1.5 padding.
        Other schemes are not (currently) supported by this implementation.

        :param encrypted_key:
            Payload to decrypt.
        :param algo_params:
            Specification of the encryption algorithm as a CMS object.
            Must use ``rsaes_pkcs1v15``.
        :return:
            The decrypted payload.
        r   r   zAOnly 'rsaes_pkcs1v15' is supported for envelope encryption, not 'r   N)passwordz5The loaded key does not seem to be an RSA private keyr   )
r   r   r   load_der_private_keyr   rb   rE   r   r   r   )r:   r   r   	algo_namepriv_keys        r=   r   z"SimpleEnvelopeKeyDecrypter.decrypt  s      ,3	(((%&!& & &   !5!!##d
 
 
 (M22 	%G   xzzBBBr>   rA   )rw   rx   ry   rz   classmethodstrr   r   r   r   r   r~   r   r9   staticmethodr   r  r   r   r   r   r   s   @r=   r   r     sI             [.E . . . . 	F 	F 	F 	F [	F7T- 7N 7 7 7 7 7 7 N N N \N6 N N N [N@C"C141KC	C C C C C C C Cr>   r   recipient_cms	decrypterc                    | d         j         }|dk    rt          j        d|z             | d         }|d         }|d         D ]}|j        }t	          |t
          j                  st          d          |d         j        }t	          |t
          j                  st          d	          |d
         }|d         j         }	|j	        j
        |k    rb|j	        j        |	k    rR	 |                    |d         j         |d                   }
n'# t          $ r}t          j        d          |d }~ww xY w ndS |d         }|d         j         }	 |j        }n$# t          t           f$ r |d         j         }Y nw xY wdt"          i}	 ddlm} |                    |j        |j        |j        d           n## t0          $ r |dv rt          d          Y nw xY w||v r||         }|j        } ||
||          }n/|dk    rt5          |
|          }nt          j        d| d          |d d         }d }t7          |          dk    r#t9          j        d|dd                    d         }||fS )Nr   r   z7Recipient CMS content type must be enveloped data, not r   r   r   z4RecipientInfo must be of type KeyTransRecipientInfo.r   z;Recipient identifier must be of type IssuerAndSerialNumber.r   r   r   r   zFailed to decrypt envelope key)NNr   r   r   aesr   )	symmetric)des	tripledesrc2z0DES, 3DES and RC2 require oscrypto to be presentrc4zCipher z is not allowed in PDF 2.0.rK      r   )r   r   r   chosenrE   r   r   r   r   r   r   r   r   	Exceptionencryption_cipherr   KeyErrorr   oscryptor$  ra   des_cbc_pkcs5_decrypttripledes_cbc_pkcs5_decryptrc2_cbc_pkcs5_decryptImportErrorencryption_ivr   r   r   unpack)r   r!  r   edr   rec_infor   issuer_and_serialr   serialr   r   r   r   cipher_namewith_ivr$  decryption_funr   r   r\   rS   s                         r=   rW   rW   4  sK    !07L'''E
 
 	
 *)4B 89()  $ 9:: 	%F   !K.+S-FGG 	%M   #8,"?3:N!V++,66
Q(00)034     Q Q Q'(HIIqPQEz
 %;&%D "8" /,! / / /;'./ o&G&&&&&& 	 6&B 6 	
 	
 	
 	
    555%B   65 g - ./I2NN			l,FGG>k>>>
 
 	
 3B3<DE
7||rdGBCCL11!4;s<   !'D		
D-D((D-E E43E4.F0 0GGcfdictc                     	 | d         }n"# t           $ r t          j        d          w xY wt          |t          j                  r|f}d |D             }|                     dd          }||dS )Nrp   z.PubKey CF dictionary must have /Recipients keyc                 V    g | ]&}t           j                            |j                  'S r4   r   r   r   original_bytesrn   xs     r=   r   z0_read_generic_pubkey_cf_info.<locals>.<listcomp>  s8       34Q-..  r>   rq   Tr0   r2   )r-  r   r   rE   r   rl   get)r<  r0   recipient_objsr2   s       r=   _read_generic_pubkey_cf_inforF    s    
M*

 
 
 
<
 
 	

 *g677 # ]
 8B  N zz"4d;;(>NOOOs    *c                 l    |                      dd          }t          d|dz  |dt          |           S )Nri   (   rh   rd   r1   r4   )rD  r   rF  )r<  r1   keylen_bitss      r=   _build_legacy_pubkey_cfrK    sN    **Y++K a'  'v
.
.  r>   c                 :    t          dd|dt          |           S )N   rI  r4   r   rF  r<  r1   s     r=   _build_aes128_pubkey_cfrP    6     '  'v
.
.  r>   c                 :    t          dd|dt          |           S )Nr   rI  r4   rN  rO  s     r=   _build_aes256_pubkey_cfrS    rQ  r>   c            
           e Zd ZU dZ ej        d          e ej        d          e ej        d          e ej        d          d iZ	e
ej        ef         ed<   edej        d	d	ed	d
fdeej                 dedd fd            Z	 	 	 	 d%dededed         dee         f fdZedefd            Zedee         fd            Zedej        dede fd            Z!edej        ded         f fd            Z"edej        fd            Z#edej        fd            Z$edej        fd            Z%d  Z&ed
fdeej                 fd!Z'	 d&d"e(e)e*f         de+fd#Z,de-fd$Z. xZ/S )'r.   z
    Security handler for public key encryption in PDF.

    As with the standard security handler, you essentially shouldn't ever
    have to instantiate these yourself (see :meth:`build_from_certs`).
    z/V2z/AESV2z/AESV3z	/Identityc                     t                      S rA   )r$   )___s     r=   <lambda>zPubKeySecurityHandler.<lambda>  s    7J7L7L r>   _known_crypt_filtersrM  TFrI   rS   r?   c	                     |rt           j        nt           j        }
d}|t          j        k    r'|rt          d|d          }nt          |d|          } | ||
|f||dd|	}|                    |||           |S )a  
        Create a new public key security handler.

        This method takes many parameters, but only ``certs`` is mandatory.
        The default behaviour is to create a public key encryption handler
        where the underlying symmetric encryption is provided by AES-256.
        Any remaining keyword arguments will be passed to the constructor.

        :param certs:
            The recipients' certificates.
        :param keylen_bytes:
            The key length (in bytes). This is only relevant for legacy
            security handlers.
        :param version:
            The security handler version to use.
        :param use_aes:
            Use AES-128 instead of RC4 (only meaningful if the ``version``
            parameter is :attr:`~.SecurityHandlerVersion.RC4_OR_AES128`).
        :param use_crypt_filters:
            Whether to use crypt filters. This is mandatory for security
            handlers of version :attr:`~.SecurityHandlerVersion.RC4_OR_AES128`
            or higher.
        :param perms:
            Permission flags (as a 4-byte signed integer).
        :param encrypt_metadata:
            Whether to encrypt document metadata.

            .. warning::
                See :class:`.SecurityHandler` for some background on the
                way pyHanko interprets this value.
        :param ignore_key_usage:
            If ``False``, the *keyEncipherment* key usage extension is required.
        :return:
            An instance of :class:`.PubKeySecurityHandler`.
        NrM  )r2   r0   rC  )r2   crypt_filter_configrE  rS   rM   )r   r   r   r&   RC4_OR_AES128r   r   rU   )r   rI   keylen_bytesr_   use_aesuse_crypt_filtersrS   r2   rM   r;   	subfiltercfcshs                r=   build_from_certsz&PubKeySecurityHandler.build_from_certs  s    d !(""$' 	
 ,:::  	()9d   ) #%5   S
 . #
 
 
 
 	%u?OPPP	r>   Nr_   pubkey_handler_subfilterr[  r#   rE  c                    |t           j        k    r$|t          j        k    rt	          j        d          |}|t           j        k    rt          d||          }nZ|t           j        k    rt          |||          }n7|t           j	        k    rt          d||          }nt	          j        d          t                                          |||||           || _        || _        d | _        d S )NzESubfilter /adbe.pkcs7.s5 is required for security handlers beyond V4.   )rd   r2   r0   r   z1Failed to impute a reasonable crypt filter config)r2   compat_entries)r&   r]  r   r   r   rN   RC4_40r   RC4_LONGER_KEYSr`   r   r8   r9   ra  r2   r6   )	r:   r_   re  legacy_keylenr2   r[  rE  rh  r<   s	           r=   r9   zPubKeySecurityHandler.__init__#  sD    -;;;(,?,BBB-  
 &0777&8%5-' ' '##
 2BBB&8(%5-' ' '##
 2999 '9%5-' ' '## mG   	-) 	 	
 	
 	
 2 0r>   c                 *    t          j        d          S )Nz/Adobe.PubSec)r   r   r   s    r=   r   zPubKeySecurityHandler.get_name]  s    !/222r>   c                 $    d t           D             S )Nc                     h | ]	}|j         
S r4   )valuerA  s     r=   	<setcomp>zCPubKeySecurityHandler.support_generic_subfilters.<locals>.<setcomp>c  s    555A555r>   )r   r   s    r=   support_generic_subfiltersz0PubKeySecurityHandler.support_generic_subfiltersa  s    55!45555r>   r<  r1   c                 ^    t          | j        ||          }|t          j        d          |S )NzJAn absent CFM or CFM of /None doesn't make sense in a PubSec CF dictionary)r'   rY  r   r   )r   r<  r1   cfs       r=   read_cf_dictionaryz(PubKeySecurityHandler.read_cf_dictionarye  sE      $fo
 
 :#'   	r>   encrypt_dictc                    t                                          |          }|                     |          }|$|t          j        k    rt          j        d          |$|t          j        k    rt          j        d          |S )Nz=Crypt filters require /adbe.pkcs7.s5 as the declared handler.z./adbe.pkcs7.s5 handler requires crypt filters.)r8   process_crypt_filters_determine_subfilterr   r   r   r   )r   ru  rb  ra  r<   s       r=   rw  z+PubKeySecurityHandler.process_crypt_filterss  s     gg++L99,,\::	?y,?,BBB#   [Y*=*@@@#@   
r>   c                     |                     dd          }|dz  dk    rt          j        d          |dz  }t          j        |dd           }|                    dt          d	
          }t          |||          S )Nri      rh   r   z"Key length must be a multiple of 8rp   c                     d | D             S )Nc                 V    g | ]&}t           j                            |j                  'S r4   r?  rA  s     r=   r   zSPubKeySecurityHandler.gather_pub_key_metadata.<locals>.<lambda>.<locals>.<listcomp>  s+    MMMA--a.>??MMMr>   r4   )lsts    r=   rX  z?PubKeySecurityHandler.gather_pub_key_metadata.<locals>.<lambda>  s    MMMMM r>   rq   Tdefault)rk  rE  r2   )rD  r   rN   get_and_applyr}   dict)r   ru  rJ  rd   r0   r2   s         r=   gather_pub_key_metadataz-PubKeySecurityHandler.gather_pub_key_metadata  s    "&&y#66!O!!- DEEE!'MM
 

 (55d 6 
 
  %-
 
 
 	
r>   c                     	 t          j        |dt          d|v rt          j        nt          j                  S # t
          $ r t          j        d|d         z             w xY w)N
/SubFilterz/CFr~  z8Invalid /SubFilter in public key encryption dictionary: )r   r  r   r   r   r   r   )r   ru  s     r=   rx  z*PubKeySecurityHandler._determine_subfilter  s    	%# ,, (**,/	 	 	 	  	 	 	#J|,-  	s	   69 (A!c                     t          j        |d                   }t          d||                     |          |                     |          d|                     |          S )N/V)r_   re  r[  r4   )r&   from_numberr.   rx  rw  r  )r   ru  vs      r=   instantiate_from_pdf_objectz1PubKeySecurityHandler.instantiate_from_pdf_object  sr     #.|D/ABB$ 
%(%=%=l%K%K # 9 9, G G
 
 )),77	
 
 	
r>   c                    t          j                    }t          j        |                                           |d<   | j        j        |d<   | j                                        |d<   | j        s| j        t          j
        k    rt          j        | j        dz            |d<   | j        t          j
        k    rt          j        | j                  |d<   | j        t          j        k    r-|                    | j                                                   nV|                                 }t)          |t*                    st,          t          j        d |j        D                       |d<   |S )	Nz/Filterr  r  rh   ri   rq   c              3   b   K   | ]*}t          j        |                                          V  +d S rA   rk   rm   s     r=   ro   z6PubKeySecurityHandler.as_pdf_object.<locals>.<genexpr>  sI       8 8 (558 8 8 8 8 8r>   rp   )r   DictionaryObjectr   r   ra  ro  r_   rr   _compat_entriesr&   rj  rs   rd   ru   r2   r   r   ra   r[  get_stream_filterrE   r-   rF   rt   r0   )r:   rv   
default_cfs      r=   rr   z#PubKeySecurityHandler.as_pdf_object  sY   )++#.t}}??y#~3||1133t 	F|5EEE ' 4T[1_ E EF9<0@@@)0)>%* *F%& >0333MM$2@@BBCCCC //11Jj*;<<  $+$7 8 8&18 8 8 % %F=! r>   c                     | j                                         D ]0}t          |t                    s|                    |||           1d S )Nr\  )r[  standard_filtersrE   r-   rU   )r:   rI   rS   rM   rs  s        r=   rU   z$PubKeySecurityHandler.add_recipients  sl     *;;== 	 	Bb"344 U5E     	 	r>   rZ   c                 >   t          |t                    rQt          j        |          }t          |t                    s%t          j        dt          |           d          |}n|}d}| j        	                                D ]W}t          |t                    s|                    |          }|j        t          j        k    r|c S |j        
||j        z  }Xt          |t                    r|| _        t#          t          j        t'          |                    S )a  
        Authenticate a user to this security handler.

        :param credential:
            The credential to use (an instance of :class:`.EnvelopeKeyDecrypter`
            in this case).
        :param id1:
            First part of the document ID.
            Public key encryption handlers ignore this key.
        :return:
            An :class:`AuthResult` object indicating the level of access
            obtained.
        zRPubkey authentication credential must be an instance of EnvelopeKeyDecrypter, not r  l    )rE   r)   r(   deserialiser   r   r   typer[  r  r-   r]   statusr    rY   permission_flags_credentialr   rX   r   )r:   rZ   id1deser_credentialactual_credentialrS   rs  rv   s           r=   r]   z"PubKeySecurityHandler.authenticate  s9   ( j"677 		+5A*MM.0DEE 'K156F1G1GK K K   !1 **;;== 	1 	1Bb"344 __%677F}
 111 &200')?@@ 	10D*/9U+;+;<<<r>   c                 >    | j                                         j        S rA   )r[  get_for_stream
shared_keyrB   s    r=   get_file_encryption_keyz-PubKeySecurityHandler.get_file_encryption_key  s    '6688CCr>   )TNNTrA   )0rw   rx   ry   rz   r   r   rK  rP  rS  rY  r   r"   r{   r  r&   r`   r   r   r   r~   intrd  r   r   listr9   r  r   r   rq  r  r}   r!   rt  rw  r  rx  r  rr   rU   r
   r   r)   r   r]   r   r  r   r   s   @r=   r.   r.     sb          	5!!#:8$$&=8$$&=;'')L)L	J$w13EEF     &-M MD$%M M 
!M M M [Mh DH)-8  8 '8  #68  &&@A8  !8  8  8  8  8  8 t 3 3 3 3 [3 63s8 6 6 6 [6 -@D	   [ "3	,	-     [" 
73K 
 
 
 [
. 0H    [$ 

"3

 

 

 [

  > 	 D$%   ( .= .=.0DDE.= 
	.= .= .= .=`D D D D D D D D Dr>   r.   )NT)T)F)TF)[abcenumloggingrO   r   hashlibr   r   typingr   r   r   r   r	   r
   
asn1cryptor   r   r   r   asn1crypto.keysr   r   cryptography.hazmat.primitivesr   1cryptography.hazmat.primitives.asymmetric.paddingr   -cryptography.hazmat.primitives.asymmetric.rsar   r   ,cryptography.hazmat.primitives.serializationr    r   r   _utilr   r   r   r   apir   r   r    r!   r"   r#   r$   r%   r&   r'   cred_serr(   r)   filter_mixinsr*   r+   	getLoggerrw   r  ABCr-   r   r   r   r   DEF_EMBEDDED_FILEr   r   uniqueEnumr   r   r  r   r~   r   r   rQ   r   Sequencer   r   registerrW   r  rF  rK  rP  rS  r.   r4   r>   r=   <module>r     s   



                     : : : : : : : : : : : : : : : : - - - - - - - - - - - - > > > > > > > > 8 8 8 8 8 8 F F F F F F        @ ? ? ? ? ?         K K K K K K K K K K K K                        C B B B B B B B C C C C C C C C		8	$	$K K K K KSW K K K\	 	 	 	 	,.A 	 	 		 	 	 	 	,.A 	 	 	
 *w)*?@@ 
 'G&'9:: 

      
 . . . . .$) . . . 26M M
MM M M M CH4 44#/4 4 4 4v D Dt'(D
D D 	_D D D DP" " " " " " " "<D D D D Ddm D D D|C |C |C |C |C!57M |C |C |C~     : ; ; ;c?c/Cc
8E?HSM)*c c c cLP)A P P P P        XD XD XD XD XDO XD XD XD XD XDr>   