def _extract_encryption_metadata(entity, require_encryption, key_encryption_key, key_resolver):
_validate_not_none('<STR_LIT>', entity)<EOL>try:<EOL><INDENT>encrypted_properties_list = _decode_base64_to_bytes(entity['<STR_LIT>'])<EOL>encryption_data = entity['<STR_LIT>']<EOL>encryption_data = _dict_to_encryption_data(loads(encryption_data))<EOL><DEDENT>except Exception as e:<EOL><INDENT>if require_encryption:<EOL><INDENT>raise ValueError(_ERROR_ENTITY_NOT_ENCRYPTED)<EOL><DEDENT>else:<EOL><INDENT>return (None,None,None,None)<EOL><DEDENT><DEDENT>if not(encryption_data.encryption_agent.encryption_algorithm == _EncryptionAlgorithm.AES_CBC_256):<EOL><INDENT>raise ValueError(_ERROR_UNSUPPORTED_ENCRYPTION_ALGORITHM)<EOL><DEDENT>content_encryption_key = _validate_and_unwrap_cek(encryption_data, key_encryption_key, key_resolver)<EOL>isJavaV1 = (encryption_data.key_wrapping_metadata is None) or((encryption_data.encryption_agent.protocol == _ENCRYPTION_PROTOCOL_V1) and'<STR_LIT>' in encryption_data.key_wrapping_metadata and'<STR_LIT>' in encryption_data.key_wrapping_metadata['<STR_LIT>'])<EOL>metadataIV = _generate_property_iv(encryption_data.content_encryption_IV,<EOL>entity['<STR_LIT>'], entity['<STR_LIT>'],<EOL>'<STR_LIT>', isJavaV1)<EOL>cipher = _generate_AES_CBC_cipher(content_encryption_key, metadataIV)<EOL>decryptor = cipher.decryptor()<EOL>encrypted_properties_list = decryptor.update(encrypted_properties_list) + decryptor.finalize()<EOL>unpadder = PKCS7(<NUM_LIT>).unpadder()<EOL>encrypted_properties_list = unpadder.update(encrypted_properties_list) + unpadder.finalize()<EOL>encrypted_properties_list = encrypted_properties_list.decode('<STR_LIT:utf-8>')<EOL>if isJavaV1:<EOL><INDENT>encrypted_properties_list = encrypted_properties_list[<NUM_LIT:1>:-<NUM_LIT:1>]<EOL>encrypted_properties_list = encrypted_properties_list.split('<STR_LIT:U+002CU+0020>')<EOL><DEDENT>else:<EOL><INDENT>encrypted_properties_list = loads(encrypted_properties_list)<EOL><DEDENT>return (encryption_data.content_encryption_IV, encrypted_properties_list, content_encryption_key, isJavaV1)<EOL>
Extracts the encryption metadata from the given entity, setting them to be utf-8 strings.
If no encryption metadata is present, will return None for all return values unless
require_encryption is true, in which case the method will throw.

:param entity:
    The entity being retrieved and decrypted. Could be a dict or an entity object.
:param bool require_encryption:
    If set, will enforce that the retrieved entity is encrypted and decrypt it.
:param object key_encryption_key:
    The user-provided key-encryption-key. Must implement the following methods:
    unwrap_key(key, algorithm)--returns the unwrapped form of the specified symmetric key using the 
    string-specified algorithm.
    get_kid()--returns a string key id for this key-encryption-key.
:param function key_resolver(kid):
    The user-provided key resolver. Uses the kid string to return a key-encryption-key implementing
    the interface defined above.
:returns: a tuple containing the entity iv, the list of encrypted properties, the entity cek,
    and whether the entity was encrypted using JavaV1.
:rtype: tuple (bytes[], list, bytes[], bool)