Questions tagged [pkcs7]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
166 views

Payment Gateway rejecting Digitally Signed Payment Message

I am new to digital signatures. I read many problem statements, solutions, and documents but nothing came to my rescue. Payment Message (Text) needs to be digitally signed with the following specs as ...
Vishal's user avatar
  • 11
1 vote
1 answer
302 views

Parse VBA Macro Digital Signature

When I open up my macro-enabled office files (i.e., .docm, .xlsm, .pptm) that contain signed macros as a Zip file, I see the following three files which I assume contain the digital signatures for the ...
Hmmmmm's user avatar
  • 245
2 votes
1 answer
3k views

What is the PKCS#7 detached signature format?

This website claims that (emphasis added): In PKCS#7 SignedData, attached and detached formats are supported… In detached format, data that is signed is not embedded inside the SignedData package ...
JamesTheAwesomeDude's user avatar
0 votes
1 answer
623 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
matthias_buehlmann's user avatar
0 votes
1 answer
195 views

What header & footer to use when storing RFC3161 token in PEM format

The RFC3161 (https://www.ietf.org/rfc/rfc3161.txt) specification states 3. Transports There is no mandatory transport mechanism for TSA messages in this document. The mechanisms described ...
matthias_buehlmann's user avatar
2 votes
2 answers
385 views

Key Exchange using RSA public key without a certificate

I want to share AES key using RSA. What is the recommended/widely used format for encrypting the AES key and its attributes with the public key? I know that PKCS#7/CMS enveloped-data allows encrypting ...
Amir's user avatar
  • 21
1 vote
1 answer
133 views

Is it important that every TLS1.2 encrypted message have padding?

what if data we are sending is such that size(data) + size(mac) =multiple of block size If this case if possible how the receiver will determine that no padding is present ???
shefaligups11 Gups's user avatar
5 votes
1 answer
3k views

What is the difference between PKCS#7 and CADES, PADES and XADES?

I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
rashid's user avatar
  • 51
3 votes
0 answers
2k views

Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL

I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...
Hmmmmm's user avatar
  • 245
2 votes
1 answer
402 views

Distinguish the end-entity cert in a PKCS#7 (P7B) cert chain

Is there a standard/definitive way to distinguish the end-entity cert in a PKCS#7 (P7B) cert chain? I believe the PKCS#7 standard doesn't not specify sequence when ordering the certs in the chain, ...
galaxis's user avatar
  • 145
0 votes
0 answers
3k views

How to extract and verify PDF signature (PKCS7) with openssl?

I would like to detect signed PDFs in PHP and verify if the signature is valid. From this document I have written this PHP code below. What it does is: Extract the PKCS7 code (it works because I ...
nowox's user avatar
  • 357
1 vote
1 answer
368 views

How to convert this .NET cryptography code to openssl command?

how to sign the message with the private key of the signer using openssl command line tool to get the same result as the code below? using System.Security.Cryptography.Pkcs; using System.Security....
User's user avatar
  • 111
0 votes
1 answer
2k views

Why is PKCS used? [closed]

Can anybody help me in understanding why PKCS is used? My confusion is that whether PKCS is used to transfer key in between client and server OR it is a standard to encrypt and decrypt the payload. I ...
Prajeesh  K P's user avatar
3 votes
4 answers
2k views

Common format to send encrypted data + IV?

I have an app that receive data from third parties using various protocols: MQTT, HTTP, AMQP, ... Some clients cannot use TLS (iot devices without TLS support), so we need to find some compact and ...
Davide Icardi's user avatar
6 votes
1 answer
2k views

How do you get the PE file hash of a signed file?

I have a PE binary with a digital signature. I want to get the original PE hash (not the hash of the whole file). I can't figure out how to read it from the file. The Authenticode spec suggests the ...
dockd's user avatar
  • 61
0 votes
1 answer
881 views

Why is PKCS#7 used as a response to PKCS#10?

Why is the certificate that results from a CSR usually contained in a PKCS#7? The signature of the certificate is contained within the certificate itself so there's no need for an external signature ...
mroman's user avatar
  • 565
6 votes
1 answer
821 views

Why is it called micalg?

RFC3851 says: The multipart/signed Content type has two required parameters: the protocol parameter and the micalg parameter. and The micalg parameter allows for one-pass processing when ...
user1511417's user avatar
1 vote
1 answer
443 views

What exactly is digested in an S/MIME signated-only e-mail?

What exactly is digested in an S/MIME signated-only e-mail? It's definitely not only a sha256-digest of the original message, which means that $ openssl dgst -sha256 <<< "Text" ...
user1511417's user avatar
0 votes
1 answer
333 views

Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?

I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
penartur's user avatar
  • 101
0 votes
1 answer
316 views

What all content PKCS#7 can have and what is the purpose of each?

When signed data is packaged as PKCS#7, what all content PKCS#7 could be there(Ex. certificates, signature, etc.)? And what are the purpose of packaging all those contents?
susthan's user avatar
  • 73
3 votes
1 answer
2k views

How does actually countersignature work in authenticode?

I'm trying to understand the timestamp processing in the Microsoft Authenticode verification mechanism and it looks pretty simple, but I really do not understand how signature can be valid while both ...
Sergey Perfilev's user avatar
7 votes
1 answer
3k views

Sign GnuPG master key with own X.509 certificate?

Can I use a trusted X.509 digital certificate to facilitate the expansion of my personal web of trust? To be more specific: Can I use my X.509 certificate to sign my personal GnuPG master key? Will ...
Matheus Moreira's user avatar
2 votes
0 answers
878 views

CMS signed data OpenSSL verification error

I have a CMS signed data that is successfully verified through Java BouncyCastle library. When trying to verify through OpenSSL, I am getting the following error: >openssl smime -verify -inform ...
user1563721's user avatar
  • 1,119
0 votes
1 answer
277 views

Standard digital signature data representation

I am creating digital signatures using various scheme, e.g. RSASSA-PSS. The result is bytes that represents signed data with private key. I would like to store signature as a standard data ...
user1563721's user avatar
  • 1,119
0 votes
1 answer
3k views

how to validate PKCS7 signed message signed with a self-signed cert via OpenSSL CLI

openssl cms -in demo.p7m -inform DER -verify verifies the signature on a CMS / PKCS7 encoded message but if the cert that did the signing is self-signed I get a "self signed certificate" error. ie. it ...
neubert's user avatar
  • 1,748
2 votes
1 answer
395 views

Why is the digest algorithm specified in two places in CMS / PKCS7?

In RFC5652, Cryptographic Message Syntax (CMS), section 5.3. SignerInfo Type, there's a digestAlgorithm field that has values like id-sha256, id-sha1, etc. In that same RFC, section 5.1. SignedData ...
neubert's user avatar
  • 1,748
1 vote
1 answer
1k views

How do I get the subject public key from a PKCS7 message?

Quoting RFC4562, Cryptographic Message Syntax (CMS), section 5.6. Signature Verification Process: The recipient MAY obtain the correct public key for the signer by any means, but the preferred ...
neubert's user avatar
  • 1,748
0 votes
1 answer
151 views

extendedCertificate's in PKCS7 / CMS

In PKCS7 / CMS, for the signed-data content type, there's a CertifcateChoices field in the certicates field in SignedData that is a SET of CertificateChoices. CertificateChoices is defined thusly: ...
neubert's user avatar
  • 1,748