Questions tagged [pkcs7]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
38 views

does BouncyCastle implementation of AES-256-CBC meet requirements: “128-bit IV”, “PKCS7 padding” and “HMAC verification”

I'm writing an app for a client and part of the client's encryption requirements for use of AES-256-CBC are: "128-bit cryptographically random initialization vector" "PKCS7 padding" "HMAC of encrypted ...
0
votes
0answers
23 views

Dissecting and decrypting a .PFX file

Background: I have a .pfx file from a microsoft CA that some appliance dislikes, but openssl considers it valid. I can use openssl to rewrite the pkcs12 file, trimming away some unnecessary attributes....
1
vote
0answers
236 views

What is the difference between PKCS#7 and CADES, PADES and XADES?

I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
1
vote
0answers
429 views

Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL

I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...
1
vote
1answer
98 views

Distinguish the end-entity cert in a PKCS#7 (P7B) cert chain

Is there a standard/definitive way to distinguish the end-entity cert in a PKCS#7 (P7B) cert chain? I believe the PKCS#7 standard doesn't not specify sequence when ordering the certs in the chain, ...
0
votes
0answers
843 views

How to extract and verify PDF signature (PKCS7) with openssl?

I would like to detect signed PDFs in PHP and verify if the signature is valid. From this document I have written this PHP code below. What it does is: Extract the PKCS7 code (it works because I ...
1
vote
1answer
137 views

How to convert this .NET cryptography code to openssl command?

how to sign the message with the private key of the signer using openssl command line tool to get the same result as the code below? using System.Security.Cryptography.Pkcs; using System.Security....
0
votes
1answer
1k views

Why is PKCS used? [closed]

Can anybody help me in understanding why PKCS is used? My confusion is that whether PKCS is used to transfer key in between client and server OR it is a standard to encrypt and decrypt the payload. I ...
3
votes
4answers
570 views

Common format to send encrypted data + IV?

I have an app that receive data from third parties using various protocols: MQTT, HTTP, AMQP, ... Some clients cannot use TLS (iot devices without TLS support), so we need to find some compact and ...
5
votes
1answer
717 views

How do you get the PE file hash of a signed file?

I have a PE binary with a digital signature. I want to get the original PE hash (not the hash of the whole file). I can't figure out how to read it from the file. The Authenticode spec suggests the ...
0
votes
1answer
336 views

Why is PKCS#7 used as a response to PKCS#10?

Why is the certificate that results from a CSR usually contained in a PKCS#7? The signature of the certificate is contained within the certificate itself so there's no need for an external signature ...
5
votes
1answer
349 views

Why is it called micalg?

RFC3851 says: The multipart/signed Content type has two required parameters: the protocol parameter and the micalg parameter. and The micalg parameter allows for one-pass processing when ...
1
vote
1answer
153 views

What exactly is digested in an S/MIME signated-only e-mail?

What exactly is digested in an S/MIME signated-only e-mail? It's definitely not only a sha256-digest of the original message, which means that $ openssl dgst -sha256 <<< "Text" would ...
0
votes
1answer
188 views

Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?

I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
0
votes
1answer
81 views

What all content PKCS#7 can have and what is the purpose of each?

When signed data is packaged as PKCS#7, what all content PKCS#7 could be there(Ex. certificates, signature, etc.)? And what are the purpose of packaging all those contents?
2
votes
1answer
913 views

How does actually countersignature work in authenticode?

I'm trying to understand the timestamp processing in the authenticode verification mechanism and it looks pretty simple, but I really do not understand how signature can be valid while both ...
5
votes
1answer
2k views

Sign GnuPG master key with own X.509 certificate?

Can I use a trusted X.509 digital certificate to facilitate the expansion of my personal web of trust? To be more specific: Can I use my X.509 certificate to sign my personal GnuPG master key? Will ...
2
votes
0answers
730 views

CMS signed data OpenSSL verification error

I have a CMS signed data that is successfully verified through Java BouncyCastle library. When trying to verify through OpenSSL, I am getting the following error: >openssl smime -verify -inform ...
0
votes
1answer
154 views

Standard digital signature data representation

I am creating digital signatures using various scheme, e.g. RSASSA-PSS. The result is bytes that represents signed data with private key. I would like to store signature as a standard data ...
0
votes
1answer
2k views

how to validate PKCS7 signed message signed with a self-signed cert via OpenSSL CLI

openssl cms -in demo.p7m -inform DER -verify verifies the signature on a CMS / PKCS7 encoded message but if the cert that did the signing is self-signed I get a "self signed certificate" error. ie. it ...
2
votes
1answer
232 views

Why is the digest algorithm specified in two places in CMS / PKCS7?

In RFC5652, Cryptographic Message Syntax (CMS), section 5.3. SignerInfo Type, there's a digestAlgorithm field that has values like id-sha256, id-sha1, etc. In that same RFC, section 5.1. SignedData ...
1
vote
1answer
593 views

How do I get the subject public key from a PKCS7 message?

Quoting RFC4562, Cryptographic Message Syntax (CMS), section 5.6. Signature Verification Process: The recipient MAY obtain the correct public key for the signer by any means, but the preferred ...
0
votes
1answer
78 views

extendedCertificate's in PKCS7 / CMS

In PKCS7 / CMS, for the signed-data content type, there's a CertifcateChoices field in the certicates field in SignedData that is a SET of CertificateChoices. CertificateChoices is defined thusly: ...