PublicKeySecurityHandler Class

Definition

The public-key security handler: documents encrypted for certificate recipients, SubFilters adbe.pkcs7.s3, adbe.pkcs7.s4 and adbe.pkcs7.s5. Registered by default.

public sealed class PublicKeySecurityHandler : ISecurityHandler

Remarks

ISO 32000-2 §7.6.5. Each Recipients string is a CMS enveloped-data object (RFC 5652) listing recipients with equal access; the reader's certificates (PdfCertificateCredentials) are matched against them by issuer and serial number or subject key identifier, and the first matching list's enveloped data, decrypted with the certificate's private key, holds a 20-byte seed and 4 bytes of permissions, most significant byte first (§7.6.5.3). The file encryption key is the first n/8 bytes of the SHA-1 (up to 128 bits) or SHA-256 (256 bits) digest of the seed, every string of the Recipients array in order, and four 0xFF bytes when the document-level metadata is left in plaintext.

Where the recipients are: adbe.pkcs7.s3 and s4 list them in the encryption dictionary (Table 23); adbe.pkcs7.s5 in the crypt filter StmF (else StrF) names (Table 27). Other crypt filters with their own Recipients (a single string when streams name them in their Crypt decode parameters) get keys of their own, from a 20-byte seed without permissions; one whose recipients do not include the reader is not authorized, and the streams that use it stay encrypted. The key length comes from the crypt filter's method (AESV2 128 bits, AESV3 256) or its Length, in bits (Table 25), else from the encryption dictionary's Length (default 40); V 5 and later always use 256 bits.

Permissions (Table 24): adbe.pkcs7.s3 has the meanings of the standard handler's revision 2, the others those of revision 3 (UserPermissions(Int32, Int32)); bit 2 permits changing the encryption and enables every permission, which gives Owner access. The integrity MAC of ISO/TS 32004 §6.4 uses the file encryption key, the key of the crypt filter DefaultCryptFilter in an adbe.pkcs7.s5 document.

Certificates and CMS are not available in a browser (WebAssembly): there the handler throws PdfEncryptionNotSupportedException with Platform, as it does for a key-agreement recipient or a content-encryption algorithm (RC4, DES, RC2) the platform's CMS implementation cannot decrypt.

Properties (2)

Methods (1)