from Pk7_doit.c
if ((sk != NULL) && (sk_X509_ATTRIBUTE_num(sk) != 0))
{
unsigned char md_data[EVP_MAX_MD_SIZE], *abuf=NULL;
unsigned int md_len, alen;
ASN1_OCTET_STRING *digest;
ASN1_UTCTIME *sign_time;
const EVP_MD *md_tmp;
/* Add signing time if not already present */
if (!PKCS7_get_signed_attribute(si,
NID_pkcs9_signingTime))
{
sign_time=X509_gmtime_adj(NULL,0);
PKCS7_add_signed_attribute(si,
NID_pkcs9_signingTime,
V_ASN1_UTCTIME,sign_time);
}
/* Add digest */
md_tmp=EVP_MD_CTX_md(&ctx_tmp);
EVP_DigestFinal_ex(&ctx_tmp,md_data,&md_len);
digest=M_ASN1_OCTET_STRING_new();
M_ASN1_OCTET_STRING_set(digest,md_data,md_len);
PKCS7_add_signed_attribute(si,
NID_pkcs9_messageDigest,
V_ASN1_OCTET_STRING,digest);
/* Now sign the attributes */
EVP_SignInit_ex(&ctx_tmp,md_tmp,NULL);
Seems that EVP_DigestFinal_ex and then EVP_SignInit_ex reinitialize MD
calculation.
Then
alen = ASN1_item_i2d((ASN1_VALUE *)sk,&abuf,
ASN1_ITEM_rptr(PKCS7_ATTR_SIGN));
if(!abuf) goto err;
EVP_SignUpdate(&ctx_tmp,abuf,alen);
calculate digest only on attributes.
Where is my error?
Francesco Petruzzi
[EMAIL PROTECTED]
--------
The information contained in this electronic message and any attachments
(the "Message") is intended for one or more specific individuals or
entities, and may be confidential, proprietary, privileged or otherwise
protected by law. If you are not the intended recipient, please notify the
sender immediately, delete this Message and do not disclose, distribute, or
copy it to any third party or otherwise use this Message. Electronic
messages are not secure or error free and can contain viruses or may be
delayed, and the sender is not liable for any of these occurrences. The
sender reserves the right to monitor, record and retain electronic messages.
--------
Le informazioni contenute in questo messaggio e gli eventuali allegati (il
"Messaggio") si intendono inviate a uno o pi� specifici destinatari. Il
contenuto del Messaggio pu� essere confidenziale, riservato e comunque
protetto dalla legge applicabile. Se non siete i destinatari del Messaggio,
siete pregati di informare immediatamente il mittente, cancellare questo
Messaggio, non rivelarlo, non distribuirlo ne' inoltrarlo a terzi, non
copiarlo n� farne alcun uso. I messaggi di posta elettronica non sono sicuri
e sono soggetti ad alterazioni, possono essere trasmettitori di Virus
informatici o soggetti a ritardi nella distribuzione. Il mittente del
Messaggio non pu� essere in alcun modo considerato responsabile per queste
evenienze. Il mittente si riserva il diritto di archiviare, ritenere e
controllare i messaggi di posta elettronica.
----- Original Message -----
From: "Dr. Stephen Henson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 17, 2004 5:53 PM
Subject: Re: Fw: PKCS7 signature process standard question
> On Wed, Mar 17, 2004, [EMAIL PROTECTED] wrote:
>
> > >From RFC2630:
> >
> > 5.4 Message Digest Calculation Process
> >
> > The message digest calculation process computes a message digest on
> > either the content being signed or the content together with the
> > signed attributes. In either case, the initial input to the message
> > digest calculation process is the "value" of the encapsulated content
> > being signed. Specifically, the initial input is the
> > encapContentInfo eContent OCTET STRING to which the signing process
> > is applied. Only the octets comprising the value of the eContent
> > OCTET STRING are input to the message digest algorithm, not the tag
> > or the length octets.
> > The result of the message digest calculation process depends on
> > whether the signedAttributes field is present. When the field is
> > absent, the result is just the message digest of the content as
> > described above. When the field is present, however, the result is
> > the message digest of the complete DER encoding of the
> > SignedAttributes value contained in the signedAttributes field.
> >
> >
> > Is this the standard?
>
> Yes.
>
> > Why openssl use only the authenticated attributes for digest
calculation?
> >
>
> It doesn't. What makes you think it does?
>
> Steve.
> --
> Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage
> OpenSSL project core developer and freelance consultant.
> Funding needed! Details on homepage.
> Homepage: http://www.drh-consultancy.demon.co.uk
> ______________________________________________________________________
> OpenSSL Project http://www.openssl.org
> Development Mailing List [EMAIL PROTECTED]
> Automated List Manager [EMAIL PROTECTED]
>
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
