/**
 * Sets the certificate encryption options for this document. An array of one or more public certificates
 * must be provided together with an array of the same size for the permissions for each certificate.
 *  The open permissions for the document can be
 *  AllowPrinting, AllowModifyContents, AllowCopy, AllowModifyAnnotations,
 *  AllowFillIn, AllowScreenReaders, AllowAssembly and AllowDegradedPrinting.
 *  The permissions can be combined by ORing them.
 * Optionally DO_NOT_ENCRYPT_METADATA can be ored to output the metadata in cleartext
 * @param certs the public certificates to be used for the encryption
 * @param permissions the user permissions for each of the certicates
 * @param encryptionType the type of encryption. It can be one of STANDARD_ENCRYPTION_40, STANDARD_ENCRYPTION_128 or ENCRYPTION_AES128.
 * @throws DocumentException if the document is already open
 */
 public void SetEncryption(X509Certificate[] certs, int[] permissions, int encryptionType) {
     if (pdf.IsOpen())
         throw new DocumentException(MessageLocalization.GetComposedMessage("encryption.can.only.be.added.before.opening.the.document"));
     crypto = new PdfEncryption();
     if (certs != null) {
         for (int i=0; i < certs.Length; i++) {
             crypto.AddRecipient(certs[i], permissions[i]);
         }
     }
     crypto.SetCryptoMode(encryptionType, 0);
     crypto.GetEncryptionDictionary();
 }

        /** Creates new PdfStamperImp.
        * @param reader the read PDF
        * @param os the output destination
        * @param pdfVersion the new pdf version or '\0' to keep the same version as the original
        * document
        * @param append
        * @throws DocumentException on error
        * @throws IOException
        */
        internal protected PdfStamperImp(PdfReader reader, Stream os, char pdfVersion, bool append) : base(new PdfDocument(), os) {
            if (!reader.IsOpenedWithFullPermissions)
                throw new BadPasswordException(MessageLocalization.GetComposedMessage("pdfreader.not.opened.with.owner.password"));
            if (reader.Tampered)
                throw new DocumentException(MessageLocalization.GetComposedMessage("the.original.document.was.reused.read.it.again.from.file"));
            reader.Tampered = true;
            this.reader = reader;
            file = reader.SafeFile;
            this.append = append;
            if (reader.IsEncrypted() && (append || PdfReader.unethicalreading)) {
                crypto = new PdfEncryption(reader.Decrypt);
            }
            if (append) {
                if (reader.IsRebuilt())
                    throw new DocumentException(MessageLocalization.GetComposedMessage("append.mode.requires.a.document.without.errors.even.if.recovery.was.possible"));
                pdf_version.SetAppendmode(true);
                if (pdfVersion == 0) {
                    pdf_version.PdfVersion = reader.PdfVersion;
                }
                else {
                    pdf_version.PdfVersion = pdfVersion;
                }
                byte[] buf = new byte[8192];
                int n;
                while ((n = file.Read(buf)) > 0)
                    this.os.Write(buf, 0, n);
                prevxref = reader.LastXref;
                reader.Appendable = true;
            }
            else {
                if (pdfVersion == 0)
                    base.PdfVersion = reader.PdfVersion;
                else
                    base.PdfVersion = pdfVersion;
            }

            if (reader.IsTagged()) {
                this.SetTagged();
            }

            base.Open();
            pdf.AddWriter(this);
            if (append) {
                body.Refnum = reader.XrefSize;
                marked = new IntHashtable();
                if (reader.IsNewXrefType())
                    fullCompression = true;
                if (reader.IsHybridXref())
                    fullCompression = false;
            }
            initialXrefSize = reader.XrefSize;
            ReadColorProfile();
        }

//.........这里部分代码省略.........
                    if (dic == null)
                        throw new InvalidPdfException(MessageLocalization.GetComposedMessage("defaultcryptfilter.not.found.encryption"));
                    if (PdfName.V2.Equals(dic.Get(PdfName.CFM))) {
                        cryptoMode = PdfWriter.STANDARD_ENCRYPTION_128;
                        lengthValue = 128;
                    }
                    else if (PdfName.AESV2.Equals(dic.Get(PdfName.CFM))) {
                        cryptoMode = PdfWriter.ENCRYPTION_AES_128;
                        lengthValue = 128;
                    }
                    else if (PdfName.AESV3.Equals(dic.Get(PdfName.CFM))) {
                        cryptoMode = PdfWriter.ENCRYPTION_AES_256;
                        lengthValue = 256;
                    }
                    else
                        throw new UnsupportedPdfException(MessageLocalization.GetComposedMessage("no.compatible.encryption.found"));
                    PdfObject em = dic.Get(PdfName.ENCRYPTMETADATA);
                    if (em != null && em.ToString().Equals("false"))
                        cryptoMode |= PdfWriter.DO_NOT_ENCRYPT_METADATA;

                    recipients = (PdfArray)dic.Get(PdfName.RECIPIENTS);
                    break;
                default:
                    throw new UnsupportedPdfException(MessageLocalization.GetComposedMessage("unknown.encryption.type.v.eq.1", vValue));
                }
                for (int i = 0; i<recipients.Size; i++)
                {
                    PdfObject recipient = recipients[i];
                    if (recipient is PdfString)
                        strings.Remove((PdfString)recipient);
                    
                    CmsEnvelopedData data = null;
                    data = new CmsEnvelopedData(recipient.GetBytes());
                
                    foreach (RecipientInformation recipientInfo in data.GetRecipientInfos().GetRecipients()) {
                        if (recipientInfo.RecipientID.Match(certificate) && !foundRecipient) {
                            envelopedData = recipientInfo.GetContent(certificateKey);
                            foundRecipient = true;                         
                        }
                    }                        
                }
                
                if (!foundRecipient || envelopedData == null)
                {
                    throw new UnsupportedPdfException(MessageLocalization.GetComposedMessage("bad.certificate.and.key"));
                }            

                IDigest sh;
                if ((cryptoMode & PdfWriter.ENCRYPTION_MASK) == PdfWriter.ENCRYPTION_AES_256)
                    sh = DigestUtilities.GetDigest("SHA-256");
                else
                    sh = DigestUtilities.GetDigest("SHA-1");
                sh.BlockUpdate(envelopedData, 0, 20);
                for (int i=0; i<recipients.Size; i++) {
                    byte[] encodedRecipient = recipients[i].GetBytes();  
                    sh.BlockUpdate(encodedRecipient, 0, encodedRecipient.Length);
                }
                if ((cryptoMode & PdfWriter.DO_NOT_ENCRYPT_METADATA) != 0)
                    sh.BlockUpdate(PdfEncryption.metadataPad, 0, PdfEncryption.metadataPad.Length);
                encryptionKey = new byte[sh.GetDigestSize()];
                sh.DoFinal(encryptionKey, 0);
            }
            decrypt = new PdfEncryption();
            decrypt.SetCryptoMode(cryptoMode, lengthValue);
            
            if (filter.Equals(PdfName.STANDARD)) {
                if (rValue == 5) {
                    ownerPasswordUsed = decrypt.ReadKey(enc, password);
                    pValue = decrypt.GetPermissions();
                }
                else {
                    //check by owner password
                    decrypt.SetupByOwnerPassword(documentID, password, uValue, oValue, pValue);
                    if (!EqualsArray(uValue, decrypt.userKey, (rValue == 3 || rValue == 4) ? 16 : 32)) {
                        //check by user password
                        decrypt.SetupByUserPassword(documentID, password, oValue, pValue);
                        if (!EqualsArray(uValue, decrypt.userKey, (rValue == 3 || rValue == 4) ? 16 : 32)) {
                            throw new BadPasswordException(MessageLocalization.GetComposedMessage("bad.user.password"));
                        }
                    }
                    else
                        ownerPasswordUsed = true;
                }
            } else if (filter.Equals(PdfName.PUBSEC)) {   
                if ((cryptoMode & PdfWriter.ENCRYPTION_MASK) == PdfWriter.ENCRYPTION_AES_256)
                    decrypt.SetKey(encryptionKey);
                else
                    decrypt.SetupByEncryptionKey(encryptionKey, lengthValue); 
                ownerPasswordUsed = true;
            }
            for (int k = 0; k < strings.Count; ++k) {
                PdfString str = strings[k];
                str.Decrypt(this);
            }
            if (encDic.IsIndirect()) {
                cryptoRef = (PRIndirectReference)encDic;
                xrefObj[cryptoRef.Number] = null;
            }
            encryptionError = false;
        }

 /** Creates new PdfStamperImp.
 * @param reader the read PDF
 * @param os the output destination
 * @param pdfVersion the new pdf version or '\0' to keep the same version as the original
 * document
 * @param append
 * @throws DocumentException on error
 * @throws IOException
 */
 internal PdfStamperImp(PdfReader reader, Stream os, char pdfVersion, bool append)
     : base(new PdfDocument(), os)
 {
     if (reader.Tampered)
         throw new DocumentException("The original document was reused. Read it again from file.");
     reader.Tampered = true;
     this.reader = reader;
     file = reader.SafeFile;
     this.append = append;
     if (append) {
         if (reader.IsRebuilt())
             throw new DocumentException("Append mode requires a document without errors even if recovery was possible.");
         if (reader.IsEncrypted())
             crypto = new PdfEncryption(reader.Decrypt);
         pdf_version.SetAppendmode(true);
         file.ReOpen();
         byte[] buf = new byte[8192];
         int n;
         while ((n = file.Read(buf)) > 0)
             this.os.Write(buf, 0, n);
         file.Close();
         prevxref = reader.LastXref;
         reader.Appendable = true;
     }
     else {
         if (pdfVersion == 0)
             base.PdfVersion = reader.PdfVersion;
         else
             base.PdfVersion = pdfVersion;
     }
     base.Open();
     pdf.AddWriter(this);
     if (append) {
         body.Refnum = reader.XrefSize;
         marked = new IntHashtable();
         if (reader.IsNewXrefType())
             fullCompression = true;
         if (reader.IsHybridXref())
             fullCompression = false;
     }
     initialXrefSize = reader.XrefSize;
 }

 /** Creates an independent duplicate.
 * @param reader the <CODE>PdfReader</CODE> to duplicate
 */    
 public PdfReader(PdfReader reader) {
     this.appendable = reader.appendable;
     this.consolidateNamedDestinations = reader.consolidateNamedDestinations;
     this.encrypted = reader.encrypted;
     this.rebuilt = reader.rebuilt;
     this.sharedStreams = reader.sharedStreams;
     this.tampered = reader.tampered;
     this.password = reader.password;
     this.pdfVersion = reader.pdfVersion;
     this.eofPos = reader.eofPos;
     this.freeXref = reader.freeXref;
     this.lastXref = reader.lastXref;
     this.newXrefType = reader.newXrefType;
     this.tokens = new PRTokeniser(reader.tokens.SafeFile);
     if (reader.decrypt != null)
         this.decrypt = new PdfEncryption(reader.decrypt);
     this.pValue = reader.pValue;
     this.rValue = reader.rValue;
     this.xrefObj = new List<PdfObject>(reader.xrefObj);
     for (int k = 0; k < reader.xrefObj.Count; ++k) {
         this.xrefObj[k] = DuplicatePdfObject(reader.xrefObj[k], this);
     }
     this.pageRefs = new PageRefs(reader.pageRefs, this);
     this.trailer = (PdfDictionary)DuplicatePdfObject(reader.trailer, this);
     this.catalog = trailer.GetAsDict(PdfName.ROOT);
     this.rootPages = catalog.GetAsDict(PdfName.PAGES);
     this.fileLength = reader.fileLength;
     this.partial = reader.partial;
     this.hybridXref = reader.hybridXref;
     this.objStmToOffset = reader.objStmToOffset;
     this.xref = reader.xref;
     this.cryptoRef = (PRIndirectReference)DuplicatePdfObject(reader.cryptoRef, this);
     this.ownerPasswordUsed = reader.ownerPasswordUsed;
 }

 public PdfEncryption(PdfEncryption enc) : this() {
     if (enc.key != null)
         key = (byte[]) enc.key.Clone();
     keySize = enc.keySize;
     mkey = (byte[])enc.mkey.Clone();
     ownerKey = (byte[])enc.ownerKey.Clone();
     userKey = (byte[])enc.userKey.Clone();
     permissions = enc.permissions;
     if (enc.documentID != null)
         documentID = (byte[])enc.documentID.Clone();
     revision = enc.revision;
     keyLength = enc.keyLength;
     encryptMetadata = enc.encryptMetadata;
     embeddedFilesOnly = enc.embeddedFilesOnly;
     publicKeyHandler = enc.publicKeyHandler;
 }

 /**
 * Sets the certificate encryption options for this document. An array of one or more public certificates
 * must be provided together with an array of the same size for the permissions for each certificate.
 *  The open permissions for the document can be
 *  AllowPrinting, AllowModifyContents, AllowCopy, AllowModifyAnnotations,
 *  AllowFillIn, AllowScreenReaders, AllowAssembly and AllowDegradedPrinting.
 *  The permissions can be combined by ORing them.
 * Optionally DO_NOT_ENCRYPT_METADATA can be ored to output the metadata in cleartext
 * @param certs the public certificates to be used for the encryption
 * @param permissions the user permissions for each of the certicates
 * @param encryptionType the type of encryption. It can be one of STANDARD_ENCRYPTION_40, STANDARD_ENCRYPTION_128 or ENCRYPTION_AES128.
 * @throws DocumentException if the document is already open
 */
 public void SetEncryption(X509Certificate[] certs, int[] permissions, int encryptionType)
 {
     if (pdf.IsOpen())
         throw new DocumentException("Encryption can only be added before opening the document.");
     crypto = new PdfEncryption();
     if (certs != null) {
         for (int i=0; i < certs.Length; i++) {
             crypto.AddRecipient(certs[i], permissions[i]);
         }
     }
     crypto.SetCryptoMode(encryptionType, 0);
     crypto.GetEncryptionDictionary();
 }

//.........这里部分代码省略.........
                    o = enc.Get(PdfName.LENGTH);
                    if (!o.IsNumber())
                        throw new InvalidPdfException("Illegal Length value.");
                    lengthValue = ( (PdfNumber) o).IntValue;
                    if (lengthValue > 128 || lengthValue < 40 || lengthValue % 8 != 0)
                        throw new InvalidPdfException("Illegal Length value.");
                    cryptoMode = PdfWriter.STANDARD_ENCRYPTION_128;
                    recipients = (PdfArray)enc.Get(PdfName.RECIPIENTS);
                    break;
                case 4:
                    PdfDictionary dic = (PdfDictionary)enc.Get(PdfName.CF);
                    if (dic == null)
                        throw new InvalidPdfException("/CF not found (encryption)");
                    dic = (PdfDictionary)dic.Get(PdfName.DEFAULTCRYPTFILTER);
                    if (dic == null)
                        throw new InvalidPdfException("/DefaultCryptFilter not found (encryption)");
                    if (PdfName.V2.Equals(dic.Get(PdfName.CFM))) {
                        cryptoMode = PdfWriter.STANDARD_ENCRYPTION_128;
                        lengthValue = 128;
                    }
                    else if (PdfName.AESV2.Equals(dic.Get(PdfName.CFM))) {
                        cryptoMode = PdfWriter.ENCRYPTION_AES_128;
                        lengthValue = 128;
                    }
                    else
                        throw new UnsupportedPdfException("No compatible encryption found");
                    PdfObject em = dic.Get(PdfName.ENCRYPTMETADATA);
                    if (em != null && em.ToString().Equals("false"))
                        cryptoMode |= PdfWriter.DO_NOT_ENCRYPT_METADATA;

                    recipients = (PdfArray)dic.Get(PdfName.RECIPIENTS);
                    break;
                default:
                    throw new UnsupportedPdfException("Unknown encryption type V = " + rValue);
                }

                for (int i = 0; i<recipients.Size; i++)
                {
                    PdfObject recipient = recipients[i];
                    strings.Remove(recipient);
                    
                    CmsEnvelopedData data = null;
                    data = new CmsEnvelopedData(recipient.GetBytes());
                
                    foreach (RecipientInformation recipientInfo in data.GetRecipientInfos().GetRecipients()) {
                        if (recipientInfo.RecipientID.Match(certificate) && !foundRecipient) {
    
                        envelopedData = recipientInfo.GetContent(certificateKey);
                        foundRecipient = true;                         
                        }
                    }                        
                }
                
                if (!foundRecipient || envelopedData == null)
                {
                    throw new UnsupportedPdfException("Bad certificate and key.");
                }            

                SHA1 sh = new SHA1CryptoServiceProvider();

                sh.TransformBlock(envelopedData, 0, 20, envelopedData, 0);
                for (int i=0; i<recipients.Size; i++) {
                    byte[] encodedRecipient = recipients[i].GetBytes();  
                    sh.TransformBlock(encodedRecipient, 0, encodedRecipient.Length, encodedRecipient, 0);
                }
                if ((cryptoMode & PdfWriter.DO_NOT_ENCRYPT_METADATA) != 0)
                    sh.TransformBlock(PdfEncryption.metadataPad, 0, PdfEncryption.metadataPad.Length, PdfEncryption.metadataPad, 0);
                sh.TransformFinalBlock(envelopedData, 0, 0);        
                encryptionKey = sh.Hash;
            }
            decrypt = new PdfEncryption();
            decrypt.SetCryptoMode(cryptoMode, lengthValue);
            
            if (filter.Equals(PdfName.STANDARD))
            {
                //check by owner password
                decrypt.SetupByOwnerPassword(documentID, password, uValue, oValue, pValue);
                if (!EqualsArray(uValue, decrypt.userKey, (rValue == 3 || rValue == 4) ? 16 : 32)) {
                    //check by user password
                    decrypt.SetupByUserPassword(documentID, password, oValue, pValue);
                    if (!EqualsArray(uValue, decrypt.userKey, (rValue == 3 || rValue == 4) ? 16 : 32)) {
                        throw new BadPasswordException("Bad user password");
                    }
                }
                else
                    ownerPasswordUsed = true;
            } else if (filter.Equals(PdfName.PUBSEC)) {   
                decrypt.SetupByEncryptionKey(encryptionKey, lengthValue); 
                ownerPasswordUsed = true;
            }
            for (int k = 0; k < strings.Count; ++k) {
                PdfString str = (PdfString)strings[k];
                str.Decrypt(this);
            }
            if (encDic.IsIndirect()) {
                cryptoRef = (PRIndirectReference)encDic;
                xrefObj[cryptoRef.Number] = null;
            }
            encryptionError = false;
        }