Questions tagged [pkcs7]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
47 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
0
votes
1answer
24 views

What header & footer to use when storing RFC3161 token in PEM format

The RFC3161 (https://www.ietf.org/rfc/rfc3161.txt) specification states 3. Transports There is no mandatory transport mechanism for TSA messages in this document. The mechanisms described ...
2
votes
0answers
34 views

Key Exchange using RSA public key without a certificate

I want to share AES key using RSA. What is the recommended/widely used format for encrypting the AES key and its attributes with the public key? I know that PKCS#7/CMS enveloped-data allows encrypting ...
1
vote
1answer
41 views

Is it important that every TLS1.2 encrypted message have padding?

what if data we are sending is such that size(data) + size(mac) =multiple of block size If this case if possible how the receiver will determine that no padding is present ???
2
votes
0answers
689 views

What is the difference between PKCS#7 and CADES, PADES and XADES?

I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
2
votes
0answers
816 views

Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL

I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...
1
vote
1answer
151 views

Distinguish the end-entity cert in a PKCS#7 (P7B) cert chain

Is there a standard/definitive way to distinguish the end-entity cert in a PKCS#7 (P7B) cert chain? I believe the PKCS#7 standard doesn't not specify sequence when ordering the certs in the chain, ...
0
votes
0answers
2k views

How to extract and verify PDF signature (PKCS7) with openssl?

I would like to detect signed PDFs in PHP and verify if the signature is valid. From this document I have written this PHP code below. What it does is: Extract the PKCS7 code (it works because I ...
1
vote
1answer
204 views

How to convert this .NET cryptography code to openssl command?

how to sign the message with the private key of the signer using openssl command line tool to get the same result as the code below? using System.Security.Cryptography.Pkcs; using System.Security....
0
votes
1answer
2k views

Why is PKCS used? [closed]

Can anybody help me in understanding why PKCS is used? My confusion is that whether PKCS is used to transfer key in between client and server OR it is a standard to encrypt and decrypt the payload. I ...
3
votes
4answers
988 views

Common format to send encrypted data + IV?

I have an app that receive data from third parties using various protocols: MQTT, HTTP, AMQP, ... Some clients cannot use TLS (iot devices without TLS support), so we need to find some compact and ...
5
votes
1answer
1k views

How do you get the PE file hash of a signed file?

I have a PE binary with a digital signature. I want to get the original PE hash (not the hash of the whole file). I can't figure out how to read it from the file. The Authenticode spec suggests the ...
0
votes
1answer
389 views

Why is PKCS#7 used as a response to PKCS#10?

Why is the certificate that results from a CSR usually contained in a PKCS#7? The signature of the certificate is contained within the certificate itself so there's no need for an external signature ...
5
votes
1answer
478 views

Why is it called micalg?

RFC3851 says: The multipart/signed Content type has two required parameters: the protocol parameter and the micalg parameter. and The micalg parameter allows for one-pass processing when ...
1
vote
1answer
213 views

What exactly is digested in an S/MIME signated-only e-mail?

What exactly is digested in an S/MIME signated-only e-mail? It's definitely not only a sha256-digest of the original message, which means that $ openssl dgst -sha256 <<< "Text" would ...
0
votes
1answer
222 views

Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?

I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
0
votes
1answer
102 views

What all content PKCS#7 can have and what is the purpose of each?

When signed data is packaged as PKCS#7, what all content PKCS#7 could be there(Ex. certificates, signature, etc.)? And what are the purpose of packaging all those contents?
2
votes
1answer
1k views

How does actually countersignature work in authenticode?

I'm trying to understand the timestamp processing in the authenticode verification mechanism and it looks pretty simple, but I really do not understand how signature can be valid while both ...
5
votes
1answer
2k views

Sign GnuPG master key with own X.509 certificate?

Can I use a trusted X.509 digital certificate to facilitate the expansion of my personal web of trust? To be more specific: Can I use my X.509 certificate to sign my personal GnuPG master key? Will ...
2
votes
0answers
762 views

CMS signed data OpenSSL verification error

I have a CMS signed data that is successfully verified through Java BouncyCastle library. When trying to verify through OpenSSL, I am getting the following error: >openssl smime -verify -inform ...
0
votes
1answer
192 views

Standard digital signature data representation

I am creating digital signatures using various scheme, e.g. RSASSA-PSS. The result is bytes that represents signed data with private key. I would like to store signature as a standard data ...
0
votes
1answer
2k views

how to validate PKCS7 signed message signed with a self-signed cert via OpenSSL CLI

openssl cms -in demo.p7m -inform DER -verify verifies the signature on a CMS / PKCS7 encoded message but if the cert that did the signing is self-signed I get a "self signed certificate" error. ie. it ...
2
votes
1answer
283 views

Why is the digest algorithm specified in two places in CMS / PKCS7?

In RFC5652, Cryptographic Message Syntax (CMS), section 5.3. SignerInfo Type, there's a digestAlgorithm field that has values like id-sha256, id-sha1, etc. In that same RFC, section 5.1. SignedData ...
1
vote
1answer
752 views

How do I get the subject public key from a PKCS7 message?

Quoting RFC4562, Cryptographic Message Syntax (CMS), section 5.6. Signature Verification Process: The recipient MAY obtain the correct public key for the signer by any means, but the preferred ...
0
votes
1answer
87 views

extendedCertificate's in PKCS7 / CMS

In PKCS7 / CMS, for the signed-data content type, there's a CertifcateChoices field in the certicates field in SignedData that is a SET of CertificateChoices. CertificateChoices is defined thusly: ...