12

For S/MIME, I now know I can verify PKCS#7 detached signatures with:

openssl smime -verify -in detachedsign.pem -content content.txt

But what about non-MIME messages?
So if I sign the message Hello, World! with openssl smime -sign -text.... it will actually be signing

Content-Type: plain/text

Hello, World!

Is it possible to use openssl to sign a normal text file (as it is)? When -sign outputs a PKCS#7 detached signature and -verify accepts a PKCS#7 detached signature and content

Improve this question
0

2 Answers 2

Reset to default
11

Yes, you can use OpenSSL to create and sign a message digest of the plain text file and later use that signed digest to confirm the validity of the text.

openssl sha1 -sign rsaprivate.pem -out rsasign.bin file.txt

and later verify the validity of the text message using

openssl sha1 -verify rsapublic.pem -signature rsasign.bin file.txt

Check out the O'Reilly book Network Security with OpenSSL for a good documentation source for these functions. The example above came from that book.

Improve this answer
6
  • Thanks Zedman, but I meant signing into a PKCS#7 object just like smime option does (and verifying from a PKCS#7 public key certificate as well). I'll add this to the question to become more explicit.
    – Filipe Pina
    Nov 17, 2011 at 10:44
  • One other question, on pure terminology, you say "sign a message digest", but it is "encrypt message digest" or "sign message" right? As signing is basically encrypting an hash, as far I as understand.
    – Filipe Pina
    Nov 17, 2011 at 10:49
  • 1
    @Filipe by 'sign a message digest’ I mean encrypt a message digest (with the author's private key) which is how a message is signed using PKI. Sorry if I confused the issue. The message itself can also be encrypted but that is a different subject. By definition, the public key certificate is checked for trust since that is the foundation requirement of PKI functionality. The syntax of the example commands should work for any keypair OpenSSL supports.
    – zedman9991
    Nov 17, 2011 at 14:19
  • Right, so you agree with what I said in previous comment: it's not "sign message digest" as you used in your answer, it's just "sign message" as "sign message digest" would imply "encrypt digest of message digest" :) anyway, the above commands do not output PKCS7 objects, just plain signature. I was hoping command line openssl tool would be able to the PKCS7_sign that the (openssl) library provides openssl.org/docs/crypto/PKCS7_sign.html but it seems it can't...
    – Filipe Pina
    Nov 17, 2011 at 15:29
  • 2
    Very late now, but in case anyone searches: openssl smime does support plain CMS signing and enveloping in either DER (standard) or PEM (semistandard) format as well as S/MIME. Specify -outform der|pem to create and -inform der|pem to read (actually just d or p is enough). For signature detached is the default, but you can specify -nodetach for embedded.
    – dave_thompson_085
    Jun 23, 2015 at 10:21
1

According to qistoph's blog (and dave_thompson_085's comment), to sign a message

openssl smime -sign -nodetach -inkey keyfile.key -signer cert.cer -in unsigned.txt -inform pem -out signed.p7m

Where unsigned.txt is the file to sign; keyfile.key is a PKCS#8 private key (not encrypted); cert.cer is an X.509 certificate. signed.p7s will be an attached PKCS#7 signature, meaning that the payload (unsigned.txt) is included in the signature. To get detached signature, remove the flag -nodetach (and name the output file with extension .p7s, according to the standard).

To verify the signature:

openssl smime -verify -in signed.p7 -inform pem

If the certificate itself don’t need to be verified (for example, when it isn’t signed by public CA), add a -noverify flag. -noverify only disables certificate verification; payload signature is still verified.

Improve this answer
3
  • You forgot -outform p[em] on sign
    – dave_thompson_085
    May 3, 2019 at 3:21
  • Looks to me like OP already knows about smime and doesn't want that. He also wants a detached signature.
    – AndrolGenhald
    May 3, 2019 at 14:34
  • @AndrolGenhald I re-read the question, and found that OP was confused about different things than I was. My question was “how do I create (sign) and verify a PKCS#7”. Shall I create another (self-answering) question about it? I searched a while in this site and found no other question about it.
    – Franklin Yu
    May 3, 2019 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .