jM ddlZddlZddlZddlZddlZddlZddlmZddlm Z m Z ddl m Z m Z mZmZmZmZddlmZmZmZmZddlmZddlmZmZddlmZmZmZdd l m!Z!m"Z"m#Z#dd l$m%Z%m&Z&m'Z'dd l$m(Z)dd l*m+Z+m,Z,m-Z-m.Z.dd l/m0Z0m1Z1ddl2m3Z3m4Z4ddl5m6Z6m7Z7ddl8m9Z9ddl:m;Z;ddlm?Z?ddl@mAZAmBZBddlCmDZDmEZEmFZFmGZGmHZHddlImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRddlSmTZTmUZUddlVmWZWmXZXmYZYddlZm[Z[ej\e]Z^edGddZ_Gd d!eLej`ZaGd"d#eaeWZbGd$d%eaeXZcGd&d'eaeYZd eAjed(Zf eAjed)Zg dad*Zhdad+Zidad,ZjejkGd-d.ejlZm dbd/end0e[fd1Zod2ed3ejpd4enfd5Zqd2ed3ejpd4enfd6Zrd3ejpd7ejd8enfd9Zsd2ed:ee!jteeffd;Zud2ed3ejvd4enfd<Zwd3ejvd=ed7ejd>end8enf d?Zxd4end@ejydAe_fdBZz dbdCe ejyd/end0e[dAe_d:ej{f dDZ|GdEdFe}Z~GdGdHZGdIdJejZGdKdLejZejdMZdNe!jtdOejdPeend:e9fdQZGdRdSeeTZeTjedTejdUed:eenfdVZdWej{dUed:eeenee[ffdXZdYeAjfdZZd[Zd\Zd]Zd^ZePjGd_d`ePZdS)cN) dataclass)sha1sha256)DictListOptionalSetTupleUnion)algoscmscorex509)RSAESOAEPParams)KeyEncryptionAlgorithmKeyEncryptionAlgorithmId)PrivateKeyInfoPublicKeyAlgorithm PublicKeyInfo)hasheskeywrap serialization)ECDHEllipticCurvePrivateKeyEllipticCurvePublicKey)generate_private_key)MGF1OAEPAsymmetricPaddingPKCS1v15) RSAPrivateKey RSAPublicKey)X448PrivateKey X448PublicKey)X25519PrivateKeyX25519PublicKey)KeyDerivationFunction)X963KDF)pkcs12)get_pyca_cryptography_hash)genericmisc)aes_cbc_decryptaes_cbc_encrypt rc2_decrypt rc4_encrypttripledes_decrypt) AuthResult AuthStatus CryptFilterCryptFilterBuilderCryptFilterConfigurationIdentityCryptFilterSecurityHandlerSecurityHandlerVersionbuild_crypt_filter)SerialisableCredentialSerialisedCredential)AESCryptFilterMixinAESGCMCryptFilterMixinRC4CryptFilterMixin)PubKeyPermissionsT)frozenc.eZdZUdZeed< dZeed<dS)RecipientEncryptionPolicyFignore_key_usage prefer_oaepN)__name__ __module__ __qualname__rFbool__annotations__rGm/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/pdf_utils/crypt/pubkey.pyrErEMs>"d"""KrNrEceZdZUdZdZeded<ddddfd Zed e fd Z fd Z e j fd eejd ede fdZd efdZd efdZfdZxZS)PubKeyCryptFiltera Crypt filter for use with public key security handler. These are a little more independent than their counterparts for the standard security handlers, since different crypt filters can cater to different sets of recipients. :param recipients: List of CMS objects encoding recipient information for this crypt filters. :param acts_as_default: Indicates whether this filter is intended to be used in ``/StrF`` or ``/StmF``. :param encrypt_metadata: Whether this crypt filter should encrypt document-level metadata. .. warning:: See :class:`.SecurityHandler` for some background on the way pyHanko interprets this value. NPubKeySecurityHandler_handlerFT) recipientsacts_as_defaultencrypt_metadatac ||_||_||_d|_dx|_|_t jdi|dS)NFrM)rTrUrV_pubkey_auth_failed _shared_key_recp_key_seedsuper__init__)selfrTrUrVkwargs __class__s rOr\zPubKeyCryptFilter.__init__tsW%. 0#( 1554.""6"""""rNreturnc|jSN)rXr]s rO _auth_failedzPubKeyCryptFilter._auth_faileds ''rNct|tstt|dx|_|_dSrb) isinstancerR TypeErrorr[_set_security_handlerrYrZ)r]handlerr_s rOrhz'PubKeyCryptFilter._set_security_handlersI'#899 O %%g...1554...rNcertspolicypermscL|js|jrtjd|j t jd|_g|_|j|jtjdt||j|||j}|j |dS)ay Add recipients to this crypt filter. This always adds one full CMS object to the Recipients array :param certs: A list of recipient certificates. :param policy: Encryption policy choices for the chosen set of recipients. :param perms: The permission bits to assign to the listed recipients. zCA non-default crypt filter cannot have multiple sets of recipients.NzYAdding recipients after deriving the shared key or before authenticating is not possible.)rkinclude_permissions) rUrTr-PdfErrorsecrets token_bytesrZrYconstruct_recipient_cmsappend)r]rjrkrlnew_cmss rOadd_recipientsz PubKeyCryptFilter.add_recipientss$#  -  ? "#*"5b"9"9D  DO   '4+>+F-9 *     $ 4     w'''''rNc|jD]:}t||\}}|#||_ttj|cS;ttjS)a Authenticate to this crypt filter in particular. If used in ``/StmF`` or ``/StrF``, you don't need to worry about calling this method directly. :param credential: The :class:`.EnvelopeKeyDecrypter` to authenticate with. :return: An :class:`AuthResult` object indicating the level of access obtained. )rTread_seed_from_recipient_cmsrZr4r5USERFAILED)r] credentialrecpseedrls rO authenticatezPubKeyCryptFilter.authenticatesfO : :D6tZHHKD%&*#!*/599999 *+,,,rNc|jJ|jtjd|jjt jkrt}nt}| |j|j D])}| | *|j s|j r| d|d|jS)Nz&No seed available; authenticate first.s)rSrZr-rpversionr;AES256rrupdaterTdumprVrUdigestkeylen)r]mdr|s rOderive_shared_encryption_keyz.PubKeyCryptFilter.derive_shared_encryption_keys}(((   &- HII I = $:$A A ABBB $%&&&O # #D IIdiikk " " " "$ +)= + II) * * *yy{{=T[=))rNc4t}tj|jdz|d<tjd|jD}|jr||d<n |d|d<tj|j |d<|S)N/Lengthc3bK|]*}tj|V+dSrbr,ByteStringObjectr.0r|s rO z2PubKeyCryptFilter.as_pdf_object..sF) ) 6:G $TYY[[ 1 1) ) ) ) ) ) rN /Recipientsr/EncryptMetadata) r[ as_pdf_objectr, NumberObjectr ArrayObjectrTrU BooleanObjectrV)r]resultrTr_s rOrzPubKeyCryptFilter.as_pdf_objects&&((#0qAAy() ) >Bo) ) )      2$.F= ! !%/qMF= !%,%:  !& & !" rN)rHrIrJ__doc__rSrrLr\propertyrKrdrhrBallow_everythingrr CertificaterErvr4r~bytesrr __classcell__r_s@rOrQrQ]sP(37Hh./666  # # # # # # #(d(((X(66666$F#4#E#G#G )()(D$%)(*)(! )()()()(V-*----& *e * * * *rNrQceZdZdZdS)PubKeyAESCryptFilterz< AES crypt filter for public key security handlers. NrHrIrJrrMrNrOrr DrNrceZdZdZdS)PubKeyAESGCMCryptFilterz@ AES-GCM crypt filter for public key security handlers. NrrMrNrOrrrrNrceZdZdZdS)PubKeyRC4CryptFilterz< RC4 crypt filter for public key security handlers. NrrMrNrOrrrrNrz/DefaultCryptFilterz/DefEmbeddedFilec jttt|d||ittSNT)rrUrTrVdefault_stream_filterdefault_string_filter)r8DEFAULT_CRYPT_FILTERrrrTrVs rO_pubkey_rc4_configrG # "6 $%!1 ### 32    rNc jttt|d||ittSr)r8rrrs rO_pubkey_aes_configr(rrNchtttd||ittS)NT)rUrTrVr)r8rrrTrVs rO_pubkey_gcm_configr7sD # "9 $%!1### 32    rNcreZdZdZejdZejdZejdZdS)PubKeyAdbeSubFilterz{ Enum describing the different subfilters that can be used for public key encryption in the PDF specification. z/adbe.pkcs7.s3z/adbe.pkcs7.s4z/adbe.pkcs7.s5N) rHrIrJrr, NameObjectS3S4S5rMrNrOrrEsS  , - -B  , - -B  , - -BBBrNrr}rlcbt|dksJ||r|ndzS)NrnrN)lenas_bytes)r}rlros rOconstruct_envelope_contentrQs7 t99???? ':C5>>### DDrN pub_key_inforid envelope_keyc:t}tjdtjdi}t j|}t|tsJ| ||}t|||S)N algorithmrsaes_pkcs1v15paddingralgoencrypted_data) r r rrrload_der_public_keyrrfr"encrypt _format_ktri)rrrrrpub_keyrs rO_rsaes_pkcs1v15_recipientrXs jjG  % c23CDDE  D/ 0A0A0C0CDDG g| , ,,,,__\7_CCN Cd> J J JJrNc ddlm}||}t|}tjtjdt d|idd|iddd}tt||d}tj | }t|tsJ||| } t||| S) Nr)select_suitable_signing_md rsaes_oaeprmgf1r parameters)hash_algorithmmask_gen_algorithmmgfrlabelrr)pyhanko.sign.signers.pdf_cmsrr*r rrrrrrrrrfr"rr) rrrrdigest_function_name digest_specrrrrs rO_rsaes_oaep_recipientris HGGGGG55lCC,-ABBK  %5lCC)'24H&I%+'24H&I++   DtK((KtLLLG/ 0A0A0C0CDDG g| , ,,,,__\7_CCN Cd> J J JJrNrrc \tjdtjd|||diS)Nktrir)rrkey_encryption_algorithm encrypted_key)r RecipientInfoKeyTransRecipientInfors rOrrsF   C- 04%3     rNr`c|j}|dkr |jdz}n |dkrd}nd}|dkr0tjt dt dfS|dkr0tjt d t d fStjt d t d fS) Necr+x25519 aes128_wrapz1.3.132.1.11.1 aes192_wrapz1.3.132.1.11.2 aes256_wrapz1.3.132.1.11.3)rbit_sizerSHA256rSHA384SHA512)r algo_nameapprox_sec_levels rO_choose_ecdh_settingsrs &ID'0A5 h  3 MOO $] 3 3 $%5 6 6  S MOO $] 3 3 $%5 6 6   MOO $] 3 3 $%5 6 6  rNc t|\}}}td|i}tj|}t |t r7t|j}| t|} nt |tr)tj }| |} nEt |tr)tj }| |} nt t#j|tjjtjj} t3jd} t7||| } | | } t;j| |}t?|| tAj||d| |S)Nr kdf_digest key_wrap_algouser_keying_material) wrapping_key key_to_wraprroriginator_keyrukmr)!rrrrrrfrgenerate_ec_private_keycurveexchangerr&r%generater$r#NotImplementedErrorrload public_key public_bytesEncodingDER PublicFormatSubjectPublicKeyInforqrr_kdf_for_exchangederiver aes_key_wrap _format_karir )rrrrkey_wrap_algo_idkey_exch_algo_idrrr ecdh_valueoriginator_key_inforkdfkekrs rO_ecdh_recipientrs 7L773K!#3+K9I+JKKM/ 0A0A0C0CDDG '122 "0??#,,TVVW== G_ - -")244#,,W55 G] + +"'022#,,W55 !!',!!##00  " &  & ;    b ! !C #    C **Z C)lN  *  '-+    %    rNrrctjdtjdtjd|||tj||dgdS)Nkarir)namevalue)rr)r originatorrrrecipient_encrypted_keys)r rKeyAgreeRecipientInfoOriginatorIdentifierOrKeyRecipientEncryptedKeyrs rOrrs   '!;),0- #nEE-       rNcertrkc"|j}|d}|dj}t|dksJ|js4|j}| d|jvr"t jd|jjdtj |j |j d}|dkr?tj d|i}|jrt|||St!|||S|d vr'tjd|i} t%|| |St'd |d ) Nr key_enciphermentzCertificate for subject z8 does not have the 'key_encipherment' key usage bit set.)issuer serial_numberrsaissuer_and_serial_number)rrx448zCannot encrypt for key type '')rnativerrFkey_usage_valuer- PdfWriteErrorsubjecthuman_friendlyr IssuerAndSerialNumberr$r%RecipientIdentifierrGrrKeyAgreementRecipientIdentifierrr) rr rkrpubkey_algo_infoalgorithm_name key_usageiss_serial_ridrka_rids rO_recipient_infor7sn ?L+7 +D%k29N |   " " " "  "(   2):J J J$F4<+FFFF  .;1CDDN% ' 8     N(sLII I,\3 MM M 3 3 34 ' 8  |V\BBB! =N = = =   rN certificatesc t|||}tjd t |d\}} fd|D}t jt jd|d} t jt j d| |d} t j d || d } t j t j d | d S) N)ror")ivc4g|]}t|S))rk)r7)rr rrks rO z+construct_recipient_cms..^s8   d6:::rN aes256_cbcrdata) content_typecontent_encryption_algorithmencrypted_contentr)rrecipient_infosencrypted_content_infoenveloped_data)r?content) rrqrrr0r EncryptionAlgorithmr EncryptionAlgorithmIdEncryptedContentInfo ContentType EnvelopedData ContentInfo) r8r}rlrkroenvelope_contentr:encrypted_envelope_content rec_infosrrCrDrs ` @rOrsrs=s=,2 e)<&r**L%4&4&&&"B"  I  "4\BB    D !5OF33,0!;  &(&<  N ?O,<==%    rNceZdZdS)InappropriateCredentialErrorN)rHrIrJrMrNrOrPrPsDrNrPc eZdZdZedejfdZdede j defdZ dede j de j dedef d Z d S) EnvelopeKeyDecrypterz General credential class for use with public key security handlers. This allows the key decryption process to happen offline, e.g. on a smart card. r`ct)zI :return: Return the recipient's certificate rrcs rOr zEnvelopeKeyDecrypter.certs "!rNr algo_paramsct)a Invoke the actual key decryption algorithm. Used with key transport. :param encrypted_key: Payload to decrypt. :param algo_params: Specification of the encryption algorithm as a CMS object. :raises InappropriateCredentialError: if the credential cannot be used for key transport. :return: The decrypted payload. rT)r]rrUs rOdecryptzEnvelopeKeyDecrypter.decrypts "!rNoriginator_identifierrct)a" Decrypt an envelope key using a key derived from a key exchange. :param encrypted_key: Payload to decrypt. :param algo_params: Specification of the encryption algorithm as a CMS object. :param originator_identifier: Information about the originator necessary to complete the key exchange. :param user_keying_material: The user keying material that will be used in the key derivation. :return: The decrypted payload. rT)r]rrUrXrs rOdecrypt_with_exchangez*EnvelopeKeyDecrypter.decrypt_with_exchanges ,"!rNN)rHrIrJrrrrr rr rrWrrZrMrNrOrRrRs"d&"""X""""141K" """"$""/" #< " $ "  """"""rNrRc(eZdZdefdejfgZdS)_PrivKeyAndCertkeyr N)rHrIrJrrr_fieldsrMrNrOr\r\s%~&1A(BCGGGrNr\cFeZdZdefdejdddfdejddifgZd S) ECCCMSSharedInfokey_info entityUInforT)explicitoptional suppPubInforcr+N)rHrIrJrr OctetStringr^rMrNrOr`r`sJ +,    - - (:q/:GGGrNr`zaes(\d+)_wrap(_pad)?rrrc V|dj}t|}|st|dt |d}t ||dzt||tj d|d }|S)Nr* is not a supported key wrapping algorithmr.rz>I)rarbre)rlength sharedinfo) r*AES_WRAP_PATTERN fullmatchrintgroupr(r`structpackr)rrrr wrap_match kek_bit_lenrs rOr r s *+6=!++,<==J  ! K K K   j&&q))**K a#)3%{4==    $&&   C JrNc @eZdZdZejdZedefdZ de fdZ ede fdZ de jd efd Zede jfd Zedd ZeddZde dejde fdZde dejdejdee de f dZd S)SimpleEnvelopeKeyDecrypterz Implementation of :class:`.EnvelopeKeyDecrypter` where the private key is an RSA or ECC key residing in memory. :param cert: The recipient's certificate. :param private_key: The recipient's private key. z1\.3\.132\.1\.11\.(\d+)r`cdS)N raw_privkeyrMclss rOget_namez#SimpleEnvelopeKeyDecrypter.get_names}rNcb|j|jd}t|S)N)r]r ) private_keyr r\r)r]valuess rO _ser_valuez%SimpleEnvelopeKeyDecrypter._ser_values.)49==v&&++---rNr>c t|}|d}|d}n'#t$r}tjd|d}~wwxYwt ||S)Nr]r z-Failed to decode serialised pubkey credentialr r{)r\r ValueErrorr- PdfReadErrorrt)rxr>decodedr]r es rO _deser_valuez'SimpleEnvelopeKeyDecrypter._deser_values} %**400G%.C6?DD   #?  *tEEEEs*- AA  Ar r{c"||_||_dSrb)r{_cert)r]r r{s rOr\z#SimpleEnvelopeKeyDecrypter.__init__s+6 rNc|jSrb)rrcs rOr zSimpleEnvelopeKeyDecrypter.certs zrNNcddlm} |||}ddlm}||}nA#ttt f$r'}t d|Yd}~dSd}~wwxYwt||S) a Load a key decrypter using key material from files on disk. :param key_file: File containing the recipient's private key. :param cert_file: File containing the recipient's certificate. :param key_passphrase: Passphrase for the key file, if applicable. :return: An instance of :class:`.SimpleEnvelopeKeyDecrypter`. r)load_private_key_from_pemder) passphrase)load_cert_from_pemderz%Could not load cryptographic materialexc_infoNr) keysrrIOErrorrrgloggererrorrt)key_file cert_filekey_passphraserr{rr rs rOrzSimpleEnvelopeKeyDecrypter.loads 988888 66^K 6 5 5 5 5 5((33DDY/    LL@1L M M M44444 *tMMMMs'A%A  A%c t|d5}|}dddn #1swxYwYtj||\}}}ddlm}m} ||}| |}nE#tttf$r+} t d|d| Yd} ~ dSd} ~ wwxYwt||S) aZ Load a key decrypter using key material from a PKCS#12 file on disk. :param pfx_file: Path to the PKCS#12 file containing the key material. :param passphrase: Passphrase for the private key, if applicable. :return: An instance of :class:`.SimpleEnvelopeKeyDecrypter`. rbNr)(translate_pyca_cryptography_cert_to_asn1'translate_pyca_cryptography_key_to_asn1zCould not open PKCS#12 file .rr) openreadr)load_key_and_certificates keys.internalrrrrrgrrrt) rxpfx_filerf pfx_bytesr{r  other_certsrrrs rO load_pkcs12z&SimpleEnvelopeKeyDecrypter.load_pkcs127sJ h%% %FFHH  % % % % % % % % % % % % % % %/5/O:00 ,[$          <;DAADAA+NNKKY/    LLCCCCaL P P P44444 *tMMMMs2A63 A67A67:A66B8 B33B8rrUcn|dj}|dkrt}n|dkr|d}|d}|dj}|dkrtd|dtt t |ddj t |d djd }ntd |dt j|j d }t|tstd| ||S)a Decrypt the payload using RSA with PKCS#1 v1.5 padding or OAEP. Other schemes are not (currently) supported by this implementation. :param encrypted_key: Payload to decrypt. :param algo_params: Specification of the encryption algorithm as a CMS object. Must use ``rsaes_pkcs1v15`` or ``rsaes_oaep``. :return: The decrypted payload. rrrrrrz#Only MGF1 is implemented, but got 'r))rrNrzSOnly 'rsaes_pkcs1v15' and 'rsaes_oaep' are supported for envelope decryption, not 'z'.passwordz5The loaded key does not seem to be an RSA private keyr)r*r rrrr*rload_der_private_keyr{rrfr!rPrW) r]rrUrr oaep_paramsrmgf_namepriv_keys rOrWz"SimpleEnvelopeKeyDecrypter.decryptXs ,3 ( ( (jjGG , & &+6|+DK23C;'.H6!!)E(EEE8L)+6= 5 01+>E   GG&;-6;;; !5   ! ! # #d   (M22 .G  w???rNrXrcV|d}|j|j}d}|rrtjtjtjtjd| dd}|stdtj |d}|dj} t | st| d| dr t$jn t$j} t+||| } |jd krtd |j} t3j| } t3j|jd }d }t;|t<rat;| t>r| j j|j jkrtC||"tG| }nt;|tHr:t;| tJstC||"| }n^t;|tLr:t;| tNstC||"| }ntQd| )|}| ||S)am Decrypt the payload using a key agreed via ephemeral-static standard (non-cofactor) ECDH with X9.63 key derivation. Other schemes aer not supported at this time. :param encrypted_key: Payload to decrypt. :param algo_params: Specification of the encryption algorithm as a CMS object. :param originator_identifier: The originator info, which must be an EC key. :param user_keying_material: The user keying material that will be used in the key derivation. :return: The decrypted payload. rN)0123r.zGOnly dhSinglePass-stdDH algorithms from SEC 1 / RFC 5753 are supported.rrh_padrrz Only originator_key is supportedrzCOriginator's public key is not compatible with selected private keyz4The loaded key does not seem to be an EC private key)r wrapped_key)*dhsinglepass_stddh_arc_patternrldottedrSHA224rrrgetrnrr rrrr*rkendswithraes_key_unwrap_with_paddingaes_key_unwrapr rchosenuntagrrrr{rfrrrrrrr%r&r#r$rPr )r]rrUrXroidmatchrrr unwrap_keyroriginator_pub_key_infooriginator_pub_keyr mismatch_msgr derived_keks rOrZz0SimpleEnvelopeKeyDecrypter.decrypt_with_exchanges.2+&3==cjII59  (]__]__]__]__  c%++a..$''   %  277  % * * , ,  !.k : A))*:;; %#OOO   ((00 (G / /'   !'!5    ! %)9 9 9%&HII I " ( . . 0 0 +> # ( ( * *  !5   ! ! # #d     (  h 7 8 8 13IJJ /%+0HN4GGG ...!**4663EFFJJ "2 3 3 0/BB / ...!**+=>>JJ . 1 1 0-@@ / ...!**+=>>JJ.F jj,, z{ NNNNrNrb)rHrIrJrrecompiler classmethodstrryrr}rrrrr\rr  staticmethodrrr rrWrrrZrMrNrOrtrts&0RZ0J%K%K"[.E.... F F F F[ FT-Nd&XNNN\N6NNN[N@2@"2@141K2@ 2@2@2@2@hfOfO/fO #< fO 'uo fO  fOfOfOfOfOfOrNrted decrypterc |dD]}|jdkr|j}|dj}t|tjst d|d}|dj}|jj|krp|jj |kr` | |dj|dcS#t$r}|d}~wt$r}tjd |d}~wwxYw|jd kr|j}|d D]} | dj}t|tjst d|d}|dj}|jj|kr|jj |krv || dj|d|d |d jccS#t$r}|d}~wt$r}tjd |d}~wwxYwt ddS)NrBrrz;Recipient identifier must be of type IssuerAndSerialNumber.r$r%rrzFailed to decrypt envelope keyrrrr)rXrzLRecipientInfo must be of type KeyTransRecipientInfo or KeyAgreeRecipientInfo)rrrfr r/rr*r r$r%rWrP Exceptionr-rrZ) rrrec_inforissuer_and_serialr$serialrrrecipient_enc_keys rOread_envelope_keyrs()99 =F " "?D $U 2 /1JKK )Q'x0F&7>F%//N0F:: $,,_-4784G +8]f $ $?D%)*D%E ! !!$5e$<$C!!"3S5NOO-U+84*?;BN)V33!4>> !(>>-o>E !;<26|2D15e1C ?   8   $!!!"/< !!- !6&+  4sH &B33 C&=B?? C& C!!C&2:F11 G$;F== G$ GG$ recipient_cmsc|dj}|dkrtjd|z|d}|d}t||}|dS|d}|dj} |j}n$#t t f$r|d j}YnwxYw|d krtd |d kr|j} t||| } nm|d kr|j} t||| } nN|dkr|j} t||| } n/|dkrt||} ntjd|d| dd} d} t| dkrtj| dd} | | fS)Nr?rDz7Recipient CMS content type must be enveloped data, not rErC)NNr@rArdesz2Support for DES has been dropped in pyHanko 0.26.0aes tripledesrc2rc4zCipher z is not allowed in PDF 2.0.rn)r*r-rrencryption_cipherrKeyErrorr encryption_ivr/r3r1r2rrB from_bytes) rrr?rrCrrrM cipher_namer:rEr}rls rOrxrx:s!07L''' E    *)4B 89$R33Lz %;&%D"8" /,  !///;'. /e! @        !,0JBOO  # #  # 4b       l,FKK   l,FGG >k > > >    3B3.s834Q-..rNrTr)rr-rrfr,rr)rrTrecipient_objsrVs rO_read_generic_pubkey_cf_inforys M*     <    *g677# ] 8BNzz"4d;;(>N O OOs *cl|dd}td|dz|dt|S)Nr(rrrUrM)rrr)rrU keylen_bitss rO_build_legacy_pubkey_cfrsN**Y++K  a'   'v . .  rNc:tdd|dt|S)NrrrMrrrrUs rO_build_aes128_pubkey_cfr6  '   'v . .  rNc:tdd|dt|S)Nr"rrMrrs rO_build_aes256_pubkey_cfrrrNc8tdd|it|S)NrUrM)rrrs rO_build_aesgcm_pubkey_cfrs1 "  ' +G+O+O  rNc jeZdZUdZejdeejdeejdeejde ejddiZ e eje fe d<ed ejd d ejd ed fd eejd ed ededdf dZ d(dedededdeedeef fd ZedefdZede efdZ!edej"dede#fdZ$edej"dedffd Z%edej"fd Z&edej"fd!Z'edej"fd"Z(d#Z)ejefd eejd ed efd$Z* d)d%e+e,e-fde.fd&Z/defd'Z0xZ1S)*rRz Security handler for public key encryption in PDF. As with the standard security handler, you essentially shouldn't ever have to instantiate these yourself (see :meth:`build_from_certs`). z/V2z/AESV2z/AESV3z/AESV4z /IdentityctSrb)r9)___s rOzPubKeySecurityHandler.s 7J7L7LrN_known_crypt_filtersrTrjrlrkpdf_macr`c  n|r tjn tj} d} |tjkr'|rt d|d} nt |d|} | r5|tjkr%|tj z}tj d} nd} ||| |f|| d| d| }| ||||S)aO Create a new public key security handler. This method takes many parameters, but only ``certs`` is mandatory. The default behaviour is to create a public key encryption handler where the underlying symmetric encryption is provided by AES-256. Any remaining keyword arguments will be passed to the constructor. :param certs: The recipients' certificates. :param keylen_bytes: The key length (in bytes). This is only relevant for legacy security handlers. :param version: The security handler version to use. :param use_aes: Use AES-128 instead of RC4 (only meaningful if the ``version`` parameter is :attr:`~.SecurityHandlerVersion.RC4_OR_AES128`). :param use_crypt_filters: Whether to use crypt filters. This is mandatory for security handlers of version :attr:`~.SecurityHandlerVersion.RC4_OR_AES128` or higher. :param perms: Permission flags. :param encrypt_metadata: Whether to encrypt document metadata. .. warning:: See :class:`.SecurityHandler` for some background on the way pyHanko interprets this value. :param pdf_mac: Include an ISO 32004 MAC. .. warning:: Only works for PDF 2.0 security handlers. :param policy: Encryption policy choices for the chosen set of recipients. :return: An instance of :class:`.PubKeySecurityHandler`. Nr)rVrTrr")rVcrypt_filter_configrkdf_saltrlrk) rrrr; RC4_OR_AES128rrrrBTOLERATE_MISSING_PDF_MACrqrrrv)rxrj keylen_bytesruse_aesuse_crypt_filtersrlrVrkrr^ subfiltercfcrshs rObuild_from_certsz&PubKeySecurityHandler.build_from_certssp! (  " "$'   ,: : : ()9d) #%5  w"8"??? '@@ @E*2..HHH S     . #       %uV<<< rNNrpubkey_handler_subfilterrr8rrc *|tjkr$|tjkrt jd||tjkrtd||}n||tjkrt|||}nY|tj krt||}n7|tj krtd||}nt jdt||||||||_||_d|_dS)NzESubfilter /adbe.pkcs7.s5 is required for security handlers beyond V4.)rrVrTrr"z1Failed to impute a reasonable crypt filter config)rVcompat_entriesr)r;rrrr-rpRC4_40rRC4_LONGER_KEYSAES_GCMrrrr[r\rrVrY) r]rr legacy_keylenrVrrr rr_s rOr\zPubKeySecurityHandler.__init__sv -; ; ;(,?,BBB-   &0777&8%5-'''## 2BBB&8(%5-'''## 2:::&8-@P'''##2999 '9%5-'''## mG    -)    2 0rNc*tjdS)Nz /Adobe.PubSec)r,rrws rOryzPubKeySecurityHandler.get_nameXs!/222rNc$dtDS)Nch|] }|j SrM)rrs rO zCPubKeySecurityHandler.support_generic_subfilters..^s555A555rN)rrws rOsupport_generic_subfiltersz0PubKeySecurityHandler.support_generic_subfilters\s55!45555rNrrUc^t|j||}|tjd|S)NzJAn absent CFM or CFM of /None doesn't make sense in a PubSec CF dictionary)r<rr-r)rxrrUcfs rOread_cf_dictionaryz(PubKeySecurityHandler.read_cf_dictionary`sE  $fo   :#'  rN encrypt_dictc t|}||}|$|tjkrt jd|$|tjkrt jd|S)Nz=Crypt filters require /adbe.pkcs7.s5 as the declared handler.z./adbe.pkcs7.s5 handler requires crypt filters.)r[process_crypt_filters_determine_subfilterrrr-r)rxrrrr_s rOrz+PubKeySecurityHandler.process_crypt_filtersnsgg++L99,,\:: ?y,?,BBB#O [Y*=*@@@#@  rNc *|dd}|dzdkrtjd|dz}tj|dd}|dtd }t ||||d d  S)Nrrrrz"Key length must be a multiple of 8rcd|DS)NcVg|]&}tj|j'SrMrrs rOr<zSPubKeySecurityHandler.gather_pub_key_metadata....s+MMMA--a.>??MMMrNrM)lsts rOrz?PubKeySecurityHandler.gather_pub_key_metadata..sMMMMMrNrTdefault/KDFSaltc`t|tjtjfr|jndSrb)rfr,TextStringObjectrr)rs rOrz?PubKeySecurityHandler.gather_pub_key_metadata..s6!G4g6NOA$$ rN)rrrVr)rr-rp get_and_applyrKdict)rxrrrrTrVs rOgather_pub_key_metadataz-PubKeySecurityHandler.gather_pub_key_metadatas"&&y#66 !O ! !- DEE E!'   M M  (55 d6   %-!//       rNc tj|dtd|vr tjn tjS#t $rtjd|dzwxYw)N /SubFilterz/CFrz8Invalid /SubFilter in public key encryption dictionary: )r-r$rrrrr)rxrs rOrz*PubKeySecurityHandler._determine_subfilters %# ,,(**,/       #J|,-  s 69(A!ctj|d}td|||||d||S)N/V)rrrrM)r; from_numberrRrrr&)rxrvs rOinstantiate_from_pdf_objectz1PubKeySecurityHandler.instantiate_from_pdf_objectsr # .|D/A B B$ %(%=%=l%K%K # 9 9, G G  )),77    rNc"tj}tj||d<|jj|d<|j|d<|jrtj |j|d<|j s|jtj krtj |jdz|d<|jtj krtj|j|d<|jt"jkr-||jnV|}t-|t.st0tjd|jD|d <|S) Nz/Filterr(r*r!rrrc3bK|]*}tj|V+dSrbrrs rOrz6PubKeySecurityHandler.as_pdf_object..sI88(55888888rNr)r,DictionaryObjectrryrrrr _kdf_saltr_compat_entriesr;r rrrrVrrrrget_stream_filterrfrQrgrrT)r]r default_cfs rOrz#PubKeySecurityHandler.as_pdf_objects{)++#.t}}??y#~3||1133t > J!(!9$.!I!IF:    F|5EEE ' 4T[1_ E EF9  <0@ @ @)0)>%**F% & >03 3 3 MM$2@@BB C C C C//11Jj*;<< $+$788&1888%%F= ! rNc|jD]0}t|ts||||1dS)Nr)rstandard_filtersrfrQrv)r]rjrlrkrs rOrvz$PubKeySecurityHandler.add_recipientssd*;;== A ABb"344    e5  @ @ @ @ A ArNr{cnt|trQtj|}t|ts%t jdt|d|}n|}tj }|j D]k}t|ts| |}|jtjkr|cS|j}|t|tsJ||z}lt|tr||_t'tj|S)a Authenticate a user to this security handler. :param credential: The credential to use (an instance of :class:`.EnvelopeKeyDecrypter` in this case). :param id1: First part of the document ID. Public key encryption handlers ignore this key. :return: An :class:`AuthResult` object indicating the level of access obtained. zRPubkey authentication credential must be an instance of EnvelopeKeyDecrypter, not r)rfr>r= deserialiserRr-rtyperBrrr6rQr~statusr5rzpermission_flags _credentialr4ry) r]r{id1deser_credentialactual_credentialrlrrcf_flagss rOr~z"PubKeySecurityHandler.authenticatesS( j"6 7 7 +5A*MM .0DEE 'K156F1G1GKKK!1   * !244*;;== " "Bb"344 __%677F} 111 .H#!(,=>>>>>! ')? @ @ 10D */5111rNc>|jjSrb)rget_for_stream shared_keyrcs rOget_file_encryption_keyz-PubKeySecurityHandler.get_file_encryption_keys'6688CCrN)TNNTNrb)2rHrIrJrr,rrrrrrrr7rLrr;rrBrrErrrrKrrrlistrr\rryr rr0r6rrr&rr-rrvr rRr>r4r~rDrrs@rOrRrRs 5!!#:8$$&=8$$&=8$$&=;'')L)L J$w13EEF&-#E#4#E#G#G,E,E,G,GYYD$%Y!Y*YY !YYY[Y@DH)-$(A A 'A #6A &&@A A !A 5/A A A A A A F3333[363s8666[6 - @D     [ "3 , -[  73K   [ B0H[$  "3    [  B$F#4#E#G#G,E,E,G,G A AD$% A! A* A A A A$ /2/2.0DDE/2  /2/2/2/2bDDDDDDDDDrNrR)NT)T)abcenumloggingrrqro dataclassesrhashlibrrtypingrrrr r r asn1cryptor r rrasn1crypto.algosrasn1crypto.cmsrrasn1crypto.keysrrrcryptography.hazmat.primitivesrrr,cryptography.hazmat.primitives.asymmetric.ecrrrrr1cryptography.hazmat.primitives.asymmetric.paddingrrrr -cryptography.hazmat.primitives.asymmetric.rsar!r".cryptography.hazmat.primitives.asymmetric.x448r#r$0cryptography.hazmat.primitives.asymmetric.x25519r%r&"cryptography.hazmat.primitives.kdfr'*cryptography.hazmat.primitives.kdf.x963kdfr(,cryptography.hazmat.primitives.serializationr)pyhanko_certvalidator.utilr*r,r-_utilr/r0r1r2r3apir4r5r6r7r8r9r:r;r<cred_serr=r> filter_mixinsr?r@rA permissionsrB getLoggerrHrrEABCrQrrrrrDEF_EMBEDDED_FILErrruniqueEnumrrrr0rrr HashAlgorithmrr1rrrr7rKrsrgrPrRSequencer\r`rrkr rtregisterrJrrxr0rrrrrrRrMrNrOrhs    !!!!!! ::::::::::::::::------------,,,,,,KKKKKKKKMMMMMMMMMMIIIIIIIIII  EDDDDD>>>>>>??????AAAAAA                      CBBBBBBB +*****  8 $ $ $        KKKKK SWKKK\     ,.A        /1G        ,.A    *w)*?@@ 'G&'9::             .....$).. .@DEE E)EEEEKK KKKKK"KK KKKKK@  $&    24LL    B77 ,77777t ,!  $    6( (  (  &( ( ( ( ` DDt'(D D D & D  _ DDDDN     9   8"8"8"8"8"8"8"8"vDDDDDdmDDD     t}   2:566$-#5/   6@O@O@O@O@O!57M@O@O@OF  :;;;? ?&:? e_????D<?</C< 8E?H%67 78<<<<~ P)A P P P P  xDxDxDxDxDOxDxDxDxDxDrN