Merge #6312: M1: a document that encrypts only its embedded files opens without a password (core.attachment-only-encryption)

# Conflicts:
#	crates/render/src/inspect/tests.rs
#	vendor/README.md

crates/cos/src/document/open.rs

@@ -230,13 +230,24 @@ impl Document {
         // Read here, while nothing is decrypted yet.
         let members = self.encryption_members(enc);
         let handler = match credentials {
-            Credentials::Password(password) => Arc::new(pdfcraft_crypt::SecurityHandler::open(params, &id0, *password).map_err(|e| match e {
-                pdfcraft_crypt::CryptError::WrongPassword if password.is_none() => CosError::NeedsPassword,
-                pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
-                other => CosError::Security(other.to_string()),
-            })?),
-            // The same encryption as the document whose key this is: that key opens it.
-            Credentials::Handler { handler, id0: known } if *handler.dict() == params && *known == id0 => Arc::clone(handler),
+            Credentials::Password(password) => match pdfcraft_crypt::SecurityHandler::open(params.clone(), &id0, *password) {
+                Ok(handler) => Arc::new(handler),
+                // No password, or the empty one: what only the embedded files need isn't asked.
+                Err(pdfcraft_crypt::CryptError::WrongPassword) => match self.without_password(&dict, params) {
+                    Some(handler) if password.is_none_or(str::is_empty) => Arc::new(handler),
+                    _ if password.is_none() => return Err(CosError::NeedsPassword),
+                    _ => return Err(CosError::WrongPassword),
+                },
+                Err(other) => return Err(CosError::Security(other.to_string())),
+            },
+            // The same encryption as the document whose key this is: that key opens it. A handler
+            // without the key opens only what it would open by itself.
+            Credentials::Handler { handler, id0: known } if *handler.dict() == params && *known == id0 => {
+                if !handler.has_key() && !crate::security::efopen_only(self, &dict) {
+                    return Err(CosError::NeedsPassword);
+                }
+                Arc::clone(handler)
+            }
             Credentials::Handler { .. } => return Err(CosError::NeedsPassword),
         };
         self.security = Some(handler);
@@ -249,6 +260,46 @@ impl Document {
         Ok(())
     }
 
+    /// The handler for a document opened without a password that only its embedded files need
+    /// (see [`crate::security::efopen_only`]). Not a repair: ISO 32000-2 §7.6.6 has such a
+    /// document open so; [`Document::embedded_files_locked`] tells it.
+    fn without_password(&self, dict: &Dict, params: pdfcraft_crypt::EncryptDict) -> Option<pdfcraft_crypt::SecurityHandler> {
+        crate::security::efopen_only(self, dict).then(|| pdfcraft_crypt::SecurityHandler::without_key(params)).flatten()
+    }
+
+    /// A document opened without the password its embedded files need takes either password
+    /// later: with the file key its embedded files decrypt, so what was read as stored is read
+    /// again. Refused while an edited stream holds data read as stored, which the key would
+    /// encrypt a second time.
+    fn unlock_embedded_files(&mut self, password: &str) -> Result<(), CosError> {
+        let Some(current) = self.security.as_deref() else { return Ok(()) };
+        if self.overlay_entries().any(|(_, _, o)| matches!(o.as_deref(), Some(Object::Stream(s)) if self.reads_as_stored(s))) {
+            return Err(CosError::Security("an embedded file was edited before the password was given: save or undo that edit first".into()));
+        }
+        let handler = pdfcraft_crypt::SecurityHandler::open(current.dict().clone(), &self.first_id(), Some(password)).map_err(|e| match e {
+            pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
+            other => CosError::Security(other.to_string()),
+        })?;
+        self.security = Some(Arc::new(handler));
+        self.source_identity = Arc::new(());
+        self.cache = Arc::default();
+        self.objstms = Arc::default();
+        Ok(())
+    }
+
+    /// Whether the document opened without the password its embedded files need (`/AuthEvent
+    /// /EFOpen`): their data is held, and saved, as stored, and isn't to be read as the files.
+    pub fn embedded_files_locked(&self) -> bool {
+        self.security.as_deref().is_some_and(|h| !h.has_key())
+    }
+
+    /// Whether `s`, a stream of this document, holds encrypted data that reads as stored because the
+    /// document opened without the password its embedded files need (see
+    /// [`Document::embedded_files_locked`]). Such data isn't the file it encrypts.
+    pub fn reads_as_stored(&self, s: &crate::Stream) -> bool {
+        self.security.as_deref().is_some_and(|h| crate::security::stream_reads_as_stored(self, h, s))
+    }
+
     /// The first file identifier, part of the encryption key (empty when there is none).
     fn first_id(&self) -> Vec<u8> {
         let id = self.trailer.get(b"ID").map(|id| self.resolve(id));
@@ -295,6 +346,9 @@ impl Document {
     /// Both passwords unlock the same file key, so nothing read so far is decoded again.
     pub fn unlock(&mut self, password: &str) -> Result<(), CosError> {
         let Some(current) = self.security.as_deref() else { return Ok(()) };
+        if !current.has_key() {
+            return self.unlock_embedded_files(password);
+        }
         if current.auth() == pdfcraft_crypt::Auth::Owner {
             return Ok(());
         }

crates/cos/src/security.rs

@@ -128,6 +128,46 @@ pub(crate) fn encrypt_dict(doc: &Document, d: &Dict) -> EncryptDict {
     }
 }
 
+/// Whether `d`, an `/Encrypt` dictionary, has crypt filters that encrypt (`/CFM` `V2`, `AESV2` or
+/// `AESV3`), each authorised only when an embedded file is opened (`/AuthEvent /EFOpen`, ISO
+/// 32000-2 §7.6.6, Table 25): what a document asks for its embedded files alone, which it opens
+/// without (§7.6.6: "EFOpen Authorization shall be required when accessing embedded files"). The
+/// files use them through `/EFF` or through a `/Crypt` filter of their own. Its strings and streams
+/// have to be in the clear too, which [`SecurityHandler::without_key`] checks.
+pub(crate) fn efopen_only(doc: &Document, d: &Dict) -> bool {
+    let name = |d: &Dict, k: &[u8]| d.get(k).and_then(|v| doc.resolve(v).as_name().map(<[u8]>::to_vec));
+    let Some(cf) = d.get(b"CF").map(|c| doc.resolve(c)).and_then(|c| c.as_dict().cloned()) else { return false };
+    let mut encrypting = Vec::new();
+    for (k, v) in cf.iter() {
+        let Some(f) = doc.resolve(v).as_dict().cloned() else { continue };
+        if !matches!(name(&f, b"CFM").as_deref(), Some(b"V2" | b"AESV2" | b"AESV3")) {
+            continue;
+        }
+        if name(&f, b"AuthEvent").as_deref() != Some(b"EFOpen") {
+            return false;
+        }
+        encrypting.push(k.clone());
+    }
+    !encrypting.is_empty()
+}
+
+/// Whether `s`, read from a document whose handler has no file key, holds data that handler would
+/// decrypt, which therefore reads as stored: still encrypted.
+pub(crate) fn stream_reads_as_stored(doc: &Document, h: &SecurityHandler, s: &Stream) -> bool {
+    if h.has_key() {
+        return false;
+    }
+    let _scope = FollowScope::enter();
+    let named = named_crypt_filter(doc, &s.dict);
+    let ty = s.dict.get(b"Type").map(|t| followed(doc, t));
+    let kind = match (&named, ty.as_deref().and_then(Object::as_name)) {
+        (Some(n), _) => StreamKind::Named(n),
+        (None, Some(b"EmbeddedFile")) => StreamKind::EmbeddedFile,
+        _ => StreamKind::Normal,
+    };
+    h.decrypts(kind)
+}
+
 /// Whether `f`, an entry of a `/Filter` chain or its only filter, is `/Crypt`.
 fn is_crypt(doc: &Document, f: &Object) -> bool {
     followed(doc, f).as_name() == Some(b"Crypt")

crates/cos/src/writer.rs

@@ -166,6 +166,24 @@ fn write_stream(s: &Stream, out: &mut Vec<u8>) {
     out.extend_from_slice(b"\nendstream");
 }
 
+/// A document opened without the password its embedded files need holds their data as stored and
+/// can't encrypt: a save keeps its `/Encrypt` as it is, and writes no edited or added stream that
+/// would have to be encrypted (an attached file put in, say), which would be written in the clear.
+fn keyless_check(doc: &Document) -> Result<(), CosError> {
+    if !doc.embedded_files_locked() {
+        return Ok(());
+    }
+    let refuse =
+        |what: &str| Err(CosError::Security(format!("{what} without the password of the document's embedded files: open it with the password")));
+    if doc.encryption_changed() || doc.trailer().get(b"Encrypt").is_none() {
+        return refuse("the document's security can't change");
+    }
+    if doc.overlay_entries().any(|(_, _, o)| matches!(o.as_deref(), Some(Object::Stream(s)) if doc.reads_as_stored(s))) {
+        return refuse("an edited or added embedded file can't be encrypted");
+    }
+    Ok(())
+}
+
 /// The object as written: encrypted with its (output) number when the document is encrypted,
 /// except the `/Encrypt` dictionary itself (`source_num` is its number in the source document).
 /// `o` has the document's numbers in its references ([`crate::security::transform`]).
@@ -242,6 +260,7 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>,
     if doc.stream_limited() {
         return Err(CosError::ReadOnlyLimit);
     }
+    keyless_check(doc)?;
     // Reconstructed files have no chain to append to; added or removed encryption must
     // rewrite every object; redaction must not leave the old revision behind. All need a full save.
     if doc.reconstructed() || doc.encryption_changed() || doc.full_save_required() {
@@ -384,6 +403,14 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
     if doc.stream_limited() {
         return Err(CosError::ReadOnlyLimit);
     }
+    keyless_check(doc)?;
+    // Renumbering breaks a key that mixes in the object number.
+    if doc.security().is_some_and(|h| !h.has_key() && !h.survives_renumbering()) {
+        return Err(CosError::Security(
+            "the embedded files are encrypted and the document was opened without their password: open it with the password to save it in full"
+                .into(),
+        ));
+    }
     // A full traversal must not fill the editor's shared caches (which undo snapshots also
     // own). Parsed objects and decoded object streams are temporary working data here.
     let mut reader = doc.object_reader();

crates/cos/tests/it/efopen.rs

@@ -0,0 +1,224 @@
+//! A document that encrypts only its embedded files, authorised when one is opened (`/AuthEvent
+//! /EFOpen`, ISO 32000-2 §7.6.6, Table 25): it opens without a password, its pages read as stored,
+//! and its embedded files keep their encrypted bytes, flagged as such, through every save.
+
+use std::sync::Arc;
+
+use pdfcraft_cos::{Algorithm, CosError, Document, NewEncryption, ObjRef, Object, SaveOptions, write_full, write_incremental};
+use pdfcraft_crypt::StreamKind;
+
+const PAGE: &str = "BT /F1 12 Tf 20 100 Td (Visible page) Tj ET";
+const ATTACHED: &[u8] = b"the attached file's own words";
+const PASSWORD: &str = "attach pw";
+const EMBEDDED: ObjRef = ObjRef { num: 6, generation: 0 };
+const CONTENT: ObjRef = ObjRef { num: 4, generation: 0 };
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|b| format!("{b:02X}")).collect()
+}
+
+/// One page in the clear and one attachment encrypted with `/StdCF`, whose `/AuthEvent` is
+/// `auth_event`: AES-256 (V5, R6) or AES-128 (V4, R4), `/StmF` and `/StrF` `/Identity`.
+fn fixture(algorithm: Algorithm, auth_event: &str) -> Vec<u8> {
+    fixture_with(algorithm, auth_event, false)
+}
+
+/// [`fixture`], the attachment naming `/StdCF` in a `/Crypt` filter of its own when `named`, with
+/// no `/EFF` (ISO 32000-2 §7.4.10).
+fn fixture_with(algorithm: Algorithm, auth_event: &str, named: bool) -> Vec<u8> {
+    let id0 = [7u8; 16];
+    let params =
+        NewEncryption { algorithm, user_password: PASSWORD, owner_password: "owner pw", permissions: -4, encrypt_metadata: true, seed: [3; 32] };
+    let handler = pdfcraft_crypt::create(&params, &id0).unwrap();
+    let d = handler.dict();
+    let kind = if named { StreamKind::Named(b"StdCF") } else { StreamKind::EmbeddedFile };
+    let cipher = handler.encrypt_stream(EMBEDDED.num, 0, ATTACHED, kind);
+    let (eff, crypt) = if named { ("", " /Filter [/Crypt] /DecodeParms [<< /Name /StdCF >>]") } else { (" /EFF /StdCF", "") };
+    let (version, cfm, r6) = match algorithm {
+        Algorithm::Aes256 => ("/V 5 /R 6", "/AESV3 /Length 32", format!("/OE <{}> /UE <{}> /Perms <{}>", hex(&d.oe), hex(&d.ue), hex(&d.perms))),
+        _ => ("/V 4 /R 4 /Length 128", "/AESV2 /Length 16", String::new()),
+    };
+    let encrypt = format!(
+        "<< /Filter /Standard {version} /O <{}> /U <{}> {r6} /P {} /CF << /StdCF << /AuthEvent /{auth_event} /CFM {cfm} >> >> /StmF /Identity /StrF /Identity{eff} >>",
+        hex(&d.o),
+        hex(&d.u),
+        d.p
+    );
+    let mut objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [(note.txt) 5 0 R] >> >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R >>".to_vec(),
+        format!("<< /Length {} >>\nstream\n{PAGE}\nendstream", PAGE.len()).into_bytes(),
+        b"<< /Type /Filespec /F (note.txt) /UF (note.txt) /EF << /F 6 0 R >> >>".to_vec(),
+    ];
+    let mut stream = format!("<< /Type /EmbeddedFile{crypt} /Length {} >>\nstream\n", cipher.len()).into_bytes();
+    stream.extend_from_slice(&cipher);
+    stream.extend_from_slice(b"\nendstream");
+    objs.push(stream);
+    objs.push(encrypt.into_bytes());
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    let trailer = format!(
+        "trailer\n<< /Size {} /Root 1 0 R /Encrypt 7 0 R /ID [<{}> <{}>] >>\nstartxref\n{xref}\n%%EOF\n",
+        objs.len() + 1,
+        hex(&id0),
+        hex(&id0)
+    );
+    out.extend_from_slice(trailer.as_bytes());
+    out
+}
+
+fn stream(doc: &Document, r: ObjRef) -> pdfcraft_cos::Stream {
+    match &*doc.get(r) {
+        Object::Stream(s) => s.clone(),
+        other => panic!("object {} isn't a stream: {other:?}", r.num),
+    }
+}
+
+/// The attachment as the password reads it from `bytes`.
+fn attachment_with_password(bytes: Vec<u8>) -> Vec<u8> {
+    let doc = Document::open_with_password(Arc::new(bytes), Some(PASSWORD)).unwrap();
+    assert!(!doc.embedded_files_locked());
+    let embedded = doc.root().and_then(|r| doc.get(r).as_dict().cloned()).unwrap();
+    assert!(embedded.get(b"Names").is_some());
+    stream(&doc, EMBEDDED).decoded().unwrap()
+}
+
+#[test]
+fn a_document_encrypting_only_its_embedded_files_opens_without_a_password() {
+    let bytes = fixture(Algorithm::Aes256, "EFOpen");
+    let doc = Document::open(Arc::new(bytes.clone())).unwrap();
+    assert!(doc.embedded_files_locked());
+    // Not a repair: the specification has it open so.
+    assert!(doc.repair_log().is_empty(), "{:?}", doc.repair_log());
+    assert!(doc.trailer().get(b"Encrypt").is_some());
+    // The page reads as stored; the attachment keeps its encrypted bytes and says so.
+    let content = stream(&doc, CONTENT);
+    assert_eq!(content.decoded().unwrap(), PAGE.as_bytes());
+    assert!(!doc.reads_as_stored(&content));
+    let embedded = stream(&doc, EMBEDDED);
+    assert!(doc.reads_as_stored(&embedded));
+    assert_ne!(embedded.decoded().unwrap(), ATTACHED);
+    // The password still opens it, and reads the attachment.
+    assert_eq!(attachment_with_password(bytes.clone()), ATTACHED);
+    // A wrong password is still refused.
+    assert!(matches!(Document::open_with_password(Arc::new(bytes), Some("nope")), Err(CosError::WrongPassword)));
+}
+
+#[test]
+fn a_crypt_filter_authorised_when_the_document_opens_still_needs_the_password() {
+    let bytes = fixture(Algorithm::Aes256, "DocOpen");
+    assert!(matches!(Document::open(Arc::new(bytes.clone())), Err(CosError::NeedsPassword)));
+    assert_eq!(attachment_with_password(bytes), ATTACHED);
+}
+
+#[test]
+fn saves_keep_the_encrypted_embedded_files_as_stored() {
+    for algorithm in [Algorithm::Aes256, Algorithm::Aes128] {
+        let mut doc = Document::open(Arc::new(fixture(algorithm, "EFOpen"))).unwrap();
+        assert!(doc.embedded_files_locked(), "{algorithm:?}");
+        let root = doc.root().unwrap();
+        doc.update_dict(root, |c| c.set(b"PageMode".to_vec(), Object::name("UseAttachments"))).unwrap();
+        // An incremental save keeps /Encrypt, and the attachment decrypts with the password.
+        let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+        assert_eq!(attachment_with_password(saved), ATTACHED, "{algorithm:?}");
+        // A full save renumbers: AES-256 keys don't depend on the number, AES-128 keys do.
+        match algorithm {
+            Algorithm::Aes256 => {
+                let full = write_full(&doc, &SaveOptions::default()).unwrap();
+                let reopened = Document::open(Arc::new(full.clone())).unwrap();
+                assert!(reopened.embedded_files_locked());
+                let doc = Document::open_with_password(Arc::new(full), Some(PASSWORD)).unwrap();
+                let names = doc.root().and_then(|r| doc.get(r).as_dict().cloned()).unwrap();
+                let tree = doc.resolve(names.get(b"Names").unwrap()).as_dict().cloned().unwrap();
+                let files = doc.resolve(tree.get(b"EmbeddedFiles").unwrap()).as_dict().cloned().unwrap();
+                let list = doc.resolve(files.get(b"Names").unwrap()).as_array().cloned().unwrap();
+                let spec = doc.resolve(&list[1]).as_dict().cloned().unwrap();
+                let ef = doc.resolve(spec.get(b"EF").unwrap()).as_dict().cloned().unwrap();
+                let file = match &*doc.resolve(ef.get(b"F").unwrap()) {
+                    Object::Stream(s) => s.decoded().unwrap(),
+                    other => panic!("{other:?}"),
+                };
+                assert_eq!(file, ATTACHED);
+            }
+            _ => assert!(matches!(write_full(&doc, &SaveOptions::default()), Err(CosError::Security(_))), "{algorithm:?}"),
+        }
+    }
+}
+
+#[test]
+fn security_cannot_change_without_the_embedded_files_password() {
+    let mut doc = Document::open(Arc::new(fixture(Algorithm::Aes256, "EFOpen"))).unwrap();
+    doc.remove_encryption();
+    assert!(matches!(write_full(&doc, &SaveOptions::default()), Err(CosError::Security(_))));
+    assert!(matches!(write_incremental(&doc, &SaveOptions::default()), Err(CosError::Security(_))));
+}
+
+/// From the review of the EFOpen change: the empty password opens it too, and the credentials of a
+/// document opened without the key open no other.
+#[test]
+fn the_empty_password_opens_it_and_keyless_credentials_open_nothing_more() {
+    let bytes = fixture(Algorithm::Aes256, "EFOpen");
+    let doc = Document::open_with_password(Arc::new(bytes.clone()), Some("")).unwrap();
+    assert!(doc.embedded_files_locked());
+    assert!(doc.open_with_same_credentials(Arc::new(bytes)).unwrap().embedded_files_locked());
+    // The same /Encrypt values and /ID, authorised when the document opens.
+    let doc_open = fixture(Algorithm::Aes256, "DocOpen");
+    assert!(matches!(doc.open_with_same_credentials(Arc::new(doc_open.clone())), Err(CosError::NeedsPassword)));
+    assert!(matches!(Document::open_with_password(Arc::new(doc_open), Some("")), Err(CosError::WrongPassword)));
+}
+
+/// An embedded file that names an EFOpen crypt filter of its own, with no `/EFF`, opens the same way.
+#[test]
+fn an_embedded_file_naming_its_own_crypt_filter_opens_without_a_password() {
+    let bytes = fixture_with(Algorithm::Aes256, "EFOpen", true);
+    let doc = Document::open(Arc::new(bytes.clone())).unwrap();
+    assert!(doc.embedded_files_locked());
+    assert!(doc.reads_as_stored(&stream(&doc, EMBEDDED)));
+    assert_eq!(stream(&doc, CONTENT).decoded().unwrap(), PAGE.as_bytes());
+    assert_eq!(attachment_with_password(bytes), ATTACHED);
+}
+
+/// A save can't encrypt without the key: removing `/Encrypt` through the trailer, or putting in an
+/// embedded file, is refused rather than written in the clear.
+#[test]
+fn saves_refuse_what_would_need_the_key() {
+    let open = || Document::open(Arc::new(fixture(Algorithm::Aes256, "EFOpen"))).unwrap();
+    let mut doc = open();
+    doc.trailer_mut().remove(b"Encrypt");
+    assert!(matches!(write_incremental(&doc, &SaveOptions::default()), Err(CosError::Security(_))));
+    assert!(matches!(write_full(&doc, &SaveOptions::default()), Err(CosError::Security(_))));
+    let mut doc = open();
+    let mut replaced = stream(&doc, EMBEDDED);
+    replaced.raw = b"new words".to_vec().into();
+    doc.set(EMBEDDED, Object::Stream(replaced));
+    assert!(matches!(write_incremental(&doc, &SaveOptions::default()), Err(CosError::Security(_))));
+}
+
+/// The password given after opening unlocks the embedded files; a wrong one doesn't.
+#[test]
+fn the_password_given_later_unlocks_the_embedded_files() {
+    let mut doc = Document::open(Arc::new(fixture(Algorithm::Aes256, "EFOpen"))).unwrap();
+    assert!(matches!(doc.unlock("nope"), Err(CosError::WrongPassword)));
+    assert!(doc.embedded_files_locked());
+    doc.unlock(PASSWORD).unwrap();
+    assert!(!doc.embedded_files_locked());
+    assert_eq!(stream(&doc, EMBEDDED).decoded().unwrap(), ATTACHED);
+    assert_eq!(stream(&doc, CONTENT).decoded().unwrap(), PAGE.as_bytes());
+    // Not while an embedded file read as stored has been edited.
+    let mut doc = Document::open(Arc::new(fixture(Algorithm::Aes256, "EFOpen"))).unwrap();
+    let edited = stream(&doc, EMBEDDED);
+    doc.set(EMBEDDED, Object::Stream(edited));
+    assert!(matches!(doc.unlock(PASSWORD), Err(CosError::Security(_))));
+}

crates/cos/tests/it/main.rs

@@ -2,6 +2,7 @@
 
 mod bounded_writer;
 mod corpus;
+mod efopen;
 mod encryption;
 mod generations;
 mod proptests;

crates/crypt/src/lib.rs

@@ -234,6 +234,42 @@ impl SecurityHandler {
         Ok(Self::new(dict, key, auth, recovered_user))
     }
 
+    /// A handler with no file key, for a document opened without a password whose strings and
+    /// streams aren't encrypted and whose encrypted crypt filters are all ones the caller found
+    /// authorised only when an embedded file is opened (`/AuthEvent /EFOpen`, ISO 32000-2 §7.6.6,
+    /// Table 25). Data such a filter encrypts is left as stored, read and written alike, so it
+    /// keeps its encrypted bytes; [`SecurityHandler::decrypts`] tells which. `None` when strings or
+    /// streams are encrypted, which needs the key, or the handler is older than crypt filters (V4).
+    pub fn without_key(dict: EncryptDict) -> Option<Self> {
+        if dict.v < 4 {
+            return None;
+        }
+        let methods = Methods::new(&dict);
+        if methods.string != Method::Identity || methods.stream != Method::Identity {
+            return None;
+        }
+        Some(Self { dict, key: Vec::new(), auth: Auth::User, recovered_user: None, methods })
+    }
+
+    /// Whether the handler has the file key: false for [`SecurityHandler::without_key`].
+    pub fn has_key(&self) -> bool {
+        !self.key.is_empty()
+    }
+
+    /// Whether data of `kind` is encrypted, so that reading it needs the file key.
+    pub fn decrypts(&self, kind: StreamKind) -> bool {
+        self.method(Some(kind)) != Method::Identity
+    }
+
+    /// Whether data left as stored by a handler without the key still decrypts after its object
+    /// is renumbered: only AES-256 doesn't mix the object number into the key (Algorithm 1.A).
+    pub fn survives_renumbering(&self) -> bool {
+        [self.methods.string, self.methods.stream, self.methods.embedded_file]
+            .into_iter()
+            .chain(self.methods.named.values().copied())
+            .all(|m| matches!(m, Method::Identity | Method::Aes256))
+    }
+
     /// Upgrade to owner access with the owner (permissions) password, as when a restricted
     /// document is unlocked after opening. The user password, or any other, is `WrongPassword`.
     /// Both passwords unlock the same file key, so what was decrypted so far stays valid; a
@@ -267,7 +303,7 @@ impl SecurityHandler {
 
     /// `/P` as `/Perms` holds it: AES-256 ECB of one block (= CBC with a zero IV), marked `adb`.
     fn perms_p(&self) -> Option<i32> {
-        if !matches!(self.dict.r, 5 | 6) {
+        if !matches!(self.dict.r, 5 | 6) || !self.has_key() {
             return None;
         }
         let plain = aes_cbc_decrypt(&self.key, &[0; 16], self.dict.perms.first_chunk::<16>()?, false);
@@ -332,6 +368,10 @@ impl SecurityHandler {
     }
 
     fn apply(&self, method: Method, num: u32, generation: u16, data: &[u8], encrypt: bool) -> Vec<u8> {
+        // Without the key, encrypted data stays as stored (see `without_key`).
+        if !self.has_key() {
+            return data.to_vec();
+        }
         match method {
             Method::Identity => data.to_vec(),
             Method::Rc4 => rc4(&self.object_key(method, num, generation), data),

crates/engine/src/tests.rs

@@ -11838,3 +11838,53 @@ fn imported_bookmarks_undo_in_one_step() {
     assert!(err.to_string().contains("no bookmark"), "{err}");
     assert!(s.get(id).unwrap().info.outline.is_empty());
 }
+
+/// ISO 32000-2 §7.6.6, Table 25: a document whose only encryption is for its embedded files,
+/// authorised when one is opened (`/AuthEvent /EFOpen`), opens without a password, lists its
+/// attachment, and saves with the attachment still encrypted.
+#[test]
+fn a_document_encrypting_only_its_embedded_files_opens_and_saves_without_a_password() {
+    // The password values of an AES-256 protection, as a save writes them.
+    let protected = protected("pw", "owner", -1);
+    let source = pdfcraft_cos::Document::open_with_password(protected, Some("pw")).unwrap();
+    let encrypt = source.resolve(source.trailer().get(b"Encrypt").unwrap());
+    let values: String = ["O", "U", "OE", "UE", "Perms"]
+        .iter()
+        .map(|k| {
+            let value = source.resolve(encrypt.as_dict().unwrap().get(k.as_bytes()).unwrap());
+            format!(" /{k} <{}>", value.as_string().unwrap().bytes.iter().map(|b| format!("{b:02X}")).collect::<String>())
+        })
+        .collect();
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [(note.txt) 4 0 R] >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >>".to_string(),
+        "<< /Type /Filespec /F (note.txt) /EF << /F 5 0 R >> >>".to_string(),
+        "<< /Type /EmbeddedFile /Length 32 >>\nstream\n0123456789abcdef0123456789abcdef\nendstream".to_string(),
+        format!(
+            "<< /Filter /Standard /V 5 /R 6{values} /P -4 /CF << /StdCF << /AuthEvent /EFOpen /CFM /AESV3 /Length 32 >> >> /StmF /Identity /StrF /Identity /EFF /StdCF >>"
+        ),
+    ];
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(
+        format!("trailer\n<< /Size {} /Root 1 0 R /Encrypt 6 0 R /ID [<00> <00>] >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes(),
+    );
+    let mut s = Session::new();
+    let id = s.open("efopen.pdf", None, Arc::new(pdf), None).expect("opens without a password");
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.info.pages.len(), 1);
+    assert_eq!(doc.info.attachments.len(), 1);
+    let saved = s.save_bytes(id).unwrap();
+    let reopened = pdfcraft_cos::Document::open(saved).unwrap();
+    assert!(reopened.embedded_files_locked(), "the attachment stays encrypted");
+}

crates/organize/src/import/copy.rs

@@ -107,6 +107,11 @@ impl<'a> Copier<'a> {
             Object::Ref(r) => self.copy_ref(dst, *r).map(Object::Ref),
             Object::Array(a) => a.iter().map(|x| self.copy_value(dst, x, None)).collect::<Result<Vec<_>, _>>().map(Object::Array),
             Object::Dict(d) => self.copy_dict(dst, d, this).map(Object::Dict),
+            // Opened without the password its embedded files need, the source holds their data
+            // encrypted: copied into another document, it would read as the file.
+            Object::Stream(s) if self.src.reads_as_stored(s) => Err(OrganizeError::Invalid(
+                "an attached file is encrypted and the document was opened without its password: open it with the password to copy it".into(),
+            )),
             Object::Stream(s) => self.copy_dict(dst, &s.dict, None).map(|dict| {
                 let mut s = s.clone();
                 s.dict = dict;

crates/organize/tests/efopen_attachments.rs

@@ -0,0 +1,78 @@
+//! A document that encrypts only its embedded files (`/AuthEvent /EFOpen`, ISO 32000-2 §7.6.6,
+//! Table 25), opened without its password, holds them encrypted: combining it into another
+//! document must not copy that data as if it were the files.
+
+use std::sync::Arc;
+
+use pdfcraft_cos::{Algorithm, Document, NewEncryption, SaveOptions, write_full};
+use pdfcraft_organize::{OrganizeError, combine};
+
+/// The password values (`/O`, `/U`, `/OE`, `/UE`, `/Perms`) of an AES-256 (R6) protection with a
+/// user password, as a save writes them.
+fn r6_password_values() -> String {
+    let plain = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [] /Count 0 >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF".to_vec();
+    let mut doc = Document::open(Arc::new(plain)).unwrap();
+    let params = NewEncryption {
+        algorithm: Algorithm::Aes256,
+        user_password: "user pw",
+        owner_password: "owner pw",
+        permissions: -4,
+        encrypt_metadata: true,
+        seed: [5; 32],
+    };
+    doc.set_encryption(&params).unwrap();
+    let saved = Document::open_with_password(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap()), Some("user pw")).unwrap();
+    let encrypt = saved.resolve(saved.trailer().get(b"Encrypt").unwrap());
+    let encrypt = encrypt.as_dict().unwrap();
+    ["O", "U", "OE", "UE", "Perms"]
+        .iter()
+        .map(|k| {
+            let value = saved.resolve(encrypt.get(k.as_bytes()).unwrap());
+            let hex: String = value.as_string().unwrap().bytes.iter().map(|b| format!("{b:02X}")).collect();
+            format!("/{k} <{hex}>")
+        })
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+/// One page in the clear and one attached file encrypted with `/StdCF`, authorised by `/EFOpen`.
+fn efopen_pdf() -> Vec<u8> {
+    let encrypt = format!(
+        "<< /Filter /Standard /V 5 /R 6 {} /P -4 /CF << /StdCF << /AuthEvent /EFOpen /CFM /AESV3 /Length 32 >> >> /StmF /Identity /StrF /Identity /EFF /StdCF >>",
+        r6_password_values()
+    );
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [(note.txt) 4 0 R] >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >>".to_string(),
+        "<< /Type /Filespec /F (note.txt) /EF << /F 5 0 R >> >>".to_string(),
+        "<< /Type /EmbeddedFile /Length 32 >>\nstream\n0123456789abcdef0123456789abcdef\nendstream".to_string(),
+        encrypt,
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(
+        format!("trailer\n<< /Size {} /Root 1 0 R /Encrypt 6 0 R /ID [<00> <00>] >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes(),
+    );
+    out
+}
+
+#[test]
+fn combining_does_not_copy_attachments_held_encrypted() {
+    let src = Document::open(Arc::new(efopen_pdf())).unwrap();
+    assert!(src.embedded_files_locked());
+    match combine(&[("efopen.pdf", &src)]) {
+        Err(OrganizeError::Invalid(why)) => assert!(why.contains("password"), "{why}"),
+        Err(other) => panic!("{other}"),
+        Ok(_) => panic!("an encrypted attachment was copied as the file"),
+    }
+}

crates/render/src/inspect/resources.rs

@@ -231,9 +231,15 @@ impl<'a> Inspector<'a> {
     }
 }
 
-/// Fetch an attachment's bytes (decoded). Capped at 1 GiB to defuse decompression bombs.
+/// Fetch an attachment's bytes (decoded). Capped at 1 GiB to defuse decompression bombs. A
+/// document opened without the password its embedded files need (`/AuthEvent /EFOpen`, ISO
+/// 32000-2 §7.6.6) holds them encrypted: asking for one is an error, never its encrypted bytes.
 pub fn attachment_data(bytes: &[u8], password: Option<&str>, att: &Attachment) -> Result<Vec<u8>, String> {
     let run = || -> Result<Vec<u8>, String> {
+        // Read through lopdf, which can't read a document opened without its key at all.
+        if pdfcraft_cos::Document::open_with_password(std::sync::Arc::new(bytes.to_vec()), password).is_ok_and(|d| d.embedded_files_locked()) {
+            return Err("the attachment is encrypted: open the document with its password to read it".into());
+        }
         let options = load_options(password);
         let doc = Document::load_mem_with_options(bytes, options).map_err(|e| e.to_string())?;
         let insp = Inspector::new(&doc);

crates/render/src/inspect/tests.rs

@@ -2071,3 +2071,107 @@ trailer << /Root 1 0 R >>
     let listed: Vec<_> = info.fields.iter().map(|f| (f.name.as_str(), f.page, f.rect.map(|r| r[1]))).collect();
     assert_eq!(listed, [("radio", Some(0), Some(120.0)), ("pair", Some(0), Some(90.0)), ("other", Some(0), Some(60.0))], "{:?}", info.fields);
 }
+
+/// The password values (`/O`, `/U`, `/OE`, `/UE`, `/Perms`) of an AES-256 (R6) protection with a
+/// user password, as a save writes them.
+fn r6_password_values() -> String {
+    let plain = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [] /Count 0 >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF".to_vec();
+    let mut doc = pdfcraft_cos::Document::open(Arc::new(plain)).unwrap();
+    doc.set_encryption(&pdfcraft_cos::NewEncryption {
+        algorithm: pdfcraft_cos::Algorithm::Aes256,
+        user_password: "user pw",
+        owner_password: "owner pw",
+        permissions: -4,
+        encrypt_metadata: true,
+        seed: [5; 32],
+    })
+    .unwrap();
+    let saved = pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions::default()).unwrap();
+    let saved = pdfcraft_cos::Document::open_with_password(Arc::new(saved), Some("user pw")).unwrap();
+    let encrypt = saved.resolve(saved.trailer().get(b"Encrypt").unwrap());
+    let encrypt = encrypt.as_dict().unwrap();
+    ["O", "U", "OE", "UE", "Perms"]
+        .iter()
+        .map(|k| {
+            let value = saved.resolve(encrypt.get(k.as_bytes()).unwrap());
+            let hex: String = value.as_string().unwrap().bytes.iter().map(|b| format!("{b:02X}")).collect();
+            format!("/{k} <{hex}>")
+        })
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+/// A page with text in the clear and an attachment, `note.txt`, encrypted with `/StdCF` (through
+/// `/EFF`, or a `/Crypt` filter of its own when `named`). `/StdCF` is authorised by `auth_event`,
+/// under the handler `version`.
+fn efopen_pdf_with(auth_event: &str, named: bool, version: &str) -> Vec<u8> {
+    let (eff, crypt) = if named { ("", " /Filter [/Crypt] /DecodeParms [<< /Name /StdCF >>]") } else { (" /EFF /StdCF", "") };
+    let encrypt = format!(
+        "<< /Filter /Standard {version} {} /P -4 /CF << /StdCF << /AuthEvent /{auth_event} /CFM /AESV3 /Length 32 >> >> /StmF /Identity /StrF /Identity{eff} >>",
+        r6_password_values()
+    );
+    let page = "BT /F1 12 Tf 20 100 Td (Visible page) Tj ET";
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [(note.txt) 4 0 R] >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /Font << /F1 7 0 R >> >> /Contents 6 0 R >>".to_string(),
+        "<< /Type /Filespec /F (note.txt) /EF << /F 5 0 R >> >>".to_string(),
+        format!("<< /Type /EmbeddedFile{crypt} /Length 32 >>\nstream\n0123456789abcdef0123456789abcdef\nendstream"),
+        format!("<< /Length {} >>\nstream\n{page}\nendstream", page.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_string(),
+        encrypt,
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(
+        format!("trailer\n<< /Size {} /Root 1 0 R /Encrypt {} 0 R /ID [<00> <00>] >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1, objs.len())
+            .as_bytes(),
+    );
+    out
+}
+
+fn efopen_pdf(auth_event: &str) -> Vec<u8> {
+    efopen_pdf_with(auth_event, false, "/V 5 /R 6")
+}
+
+/// ISO 32000-2 §7.6.6, Table 25: a crypt filter whose `/AuthEvent` is `/EFOpen` needs its password
+/// only when an embedded file is opened. Such a document opens without one, its page reads, and
+/// its attachment is listed; asking for the attachment's bytes is an error, not its encrypted data.
+#[test]
+fn a_document_encrypting_only_its_embedded_files_opens_without_a_password() {
+    let bytes = Arc::new(efopen_pdf("EFOpen"));
+    assert!(check_pages(bytes.clone(), None, 1).is_ok());
+    let info = inspect(bytes.clone(), None).expect("opens without a password");
+    assert_eq!(info.pages.len(), 1);
+    let mut renderer = crate::PageRenderer::new(bytes.clone(), crate::RenderConfig::default());
+    let text = renderer.render(crate::RenderRequest { page: 0, kind: crate::RequestKind::Text, ..Default::default() });
+    assert!(text.text.is_some_and(|page| page.plain_text().contains("Visible page")), "{:?}", text.error);
+    let listed = |name: &str| info.attachments.iter().find(|a| a.name == name).unwrap_or_else(|| panic!("{name} is listed")).clone();
+    let refused = attachment_data(&bytes, None, &listed("note.txt")).expect_err("encrypted bytes aren't the file");
+    assert!(refused.contains("password"), "{refused}");
+    // Authorised when the document opens, the same filter still needs the password.
+    let doc_open = Arc::new(efopen_pdf("DocOpen"));
+    assert!(matches!(inspect(doc_open.clone(), None), Err(OpenError::NeedsPassword)));
+    assert!(matches!(check_pages(doc_open, None, 1), Err(OpenError::NeedsPassword)));
+}
+
+/// From the review of the EFOpen change: an attachment naming its own EFOpen crypt filter, with no
+/// `/EFF`, opens the same way; a handler older than crypt filters (V2) still needs the password.
+#[test]
+fn efopen_filters_named_by_the_file_open_and_older_handlers_do_not() {
+    let named = Arc::new(efopen_pdf_with("EFOpen", true, "/V 5 /R 6"));
+    let info = inspect(named.clone(), None).expect("opens without a password");
+    let note = info.attachments.iter().find(|a| a.name == "note.txt").expect("listed").clone();
+    assert!(attachment_data(&named, None, &note).is_err());
+    let legacy = Arc::new(efopen_pdf_with("EFOpen", false, "/V 2 /R 3 /Length 128"));
+    assert!(matches!(check_pages(legacy, None, 1), Err(OpenError::NeedsPassword)));
+}

parity/acrobat-features.toml

@@ -235,11 +235,11 @@ title = "Attachment-only encryption (/EFF) opens without a password"
 area = "A"
 tier = "P1"
 milestone = "M1"
-status = "partial"
+status = "shipped"
 commands = []
 tools = []
-evidence = []
-notes = "two corpus files still ask for a password (M1.6)"
+evidence = ["crates/cos/tests/it/efopen.rs::a_document_encrypting_only_its_embedded_files_opens_without_a_password", "crates/cos/tests/it/efopen.rs::saves_keep_the_encrypted_embedded_files_as_stored", "crates/render/src/inspect/tests.rs::a_document_encrypting_only_its_embedded_files_opens_without_a_password", "crates/engine/src/tests.rs::a_document_encrypting_only_its_embedded_files_opens_and_saves_without_a_password", "crates/organize/tests/efopen_attachments.rs::combining_does_not_copy_attachments_held_encrypted"]
+notes = "a document whose encrypting crypt filters are all /AuthEvent /EFOpen, with /StmF and /StrF /Identity, opens without a password (ISO 32000-2 7.6.6, Table 25); with /EFF or a /Crypt filter of the file naming the filter; its attachments are listed but not read or copied without the password, and saves keep them encrypted (a full save is refused where the key depends on the object number, as is any save that would have to encrypt). The password given later (Document::unlock) unlocks the embedded files. Not yet: reading an attachment stored in the clear in such a document without the password (attachment_data reads through lopdf, which can't read the document without its key, so every attachment of it is refused), and the app asking for the password when such an attachment is saved. pdf.js encrypted-attachment.pdf has no /AuthEvent (DocOpen) and a non-empty user password, so it rightly asks for one; its broken startxref currently reports it as unreadable instead"
 
 [[feature]]
 id = "core.unencrypted-metadata"

vendor/hayro-syntax/src/crypto/mod.rs

@@ -114,6 +114,52 @@ pub(crate) fn get(
     dict: &Dict<'_>,
     id: &[u8],
     password: &[u8],
+) -> Result<Decryptor, DecryptionError> {
+    match decryptor(dict, id, password) {
+        // PdfCraft patch (37): a document that encrypts only its embedded files, authorised when
+        // one is opened (`/AuthEvent /EFOpen`, ISO 32000-2 §7.6.6, Table 25), opens without a
+        // password: its strings and streams are in the clear, and nothing drawn reads an embedded
+        // file.
+        Err(DecryptionError::PasswordProtected) if password.is_empty() && efopen_only(dict) => {
+            Ok(Decryptor::None)
+        }
+        other => other,
+    }
+}
+
+/// PdfCraft patch (37): whether `dict` has crypt filters (V4 or later) that encrypt, each
+/// authorised only when an embedded file is opened (`/AuthEvent /EFOpen`), and neither `/StmF` nor
+/// `/StrF` names one. The embedded files use them through `/EFF` or a `/Crypt` filter of their
+/// own; earlier handlers (V1, V2) encrypt everything with RC4.
+fn efopen_only(dict: &Dict<'_>) -> bool {
+    if dict.get::<u8>(V).is_none_or(|v| v < 4) {
+        return false;
+    }
+    let Some(cf) = dict.get::<Dict<'_>>(CF) else {
+        return false;
+    };
+    let mut encrypting = Vec::new();
+    for key in cf.keys() {
+        let Some(filter) = cf.get::<Dict<'_>>(key.as_ref()) else {
+            continue;
+        };
+        let method = filter.get::<Name<'_>>(CFM).and_then(|n| DecryptorTag::from_name(&n));
+        if matches!(method, None | Some(DecryptorTag::None)) {
+            continue;
+        }
+        if filter.get::<Name<'_>>(b"AuthEvent").is_none_or(|e| e.as_str() != "EFOpen") {
+            return false;
+        }
+        encrypting.push(key.as_str().to_string());
+    }
+    let names = |key: &[u8]| dict.get::<Name<'_>>(key).is_some_and(|n| encrypting.iter().any(|e| e == n.as_str()));
+    !encrypting.is_empty() && !names(STM_F) && !names(STR_F)
+}
+
+fn decryptor(
+    dict: &Dict<'_>,
+    id: &[u8],
+    password: &[u8],
 ) -> Result<Decryptor, DecryptionError> {
     let filter = dict.get::<Name<'_>>(FILTER).ok_or(InvalidEncryption)?;