On Thu, 14 Feb 2002, Dr S N Henson wrote:
> Erwann ABALEA wrote:
> >
> > Hi,
> >
> > I'm facing a problem I can't manage to solve.
> >
> > I need to create a structure like this one:
> >
> > signed PKCS#7 {
> > signer certificate
> > authenticated attributes
> > content: enveloped PKCS#7 {
> > recipient certificates
> > enc_content: data
> > }
> > }
> >
> > I know how to create an enveloped PKCS#7 alone, with data encipherment, I
> > know how to create a signed PKCS#7 alone, with data signature, but I don't
> > know how to encapsulate an enveloped PKCS#7 inside a signed PKCS#7.
> >
> > Creating a signedAndEnveloped PKCS#7 is *not* an option, I *must* have
> > this encapsulation.
> >
> [snip]
> >
> > What is the correct way to do this?
>
> Don't know, yet :-) This isn't something I've ever tried. The relevant
> code my not properly handle this construct.
I'm writing my code using OpenSSL 0.9.6c, I haven't tried the CVS version
yet. The 0.9.6c code can easily read such structures, but I have to verify
and decrypt using 2 passes:
- the first time, I don't try to decrypt the inner content, and I can
then verify the signature
- the second time, I can decrypt the content
That means creating 2 BIO, but it doesn't matter in my application, as I
already do these operations in 2 passes.
> However first thing: is that really what you want to do? The usual
> reason for doing this is to generate a "signed and encrypted" S/MIME
> message which isn't the above structure at all.
Yeah, i *need* to do this. It's not related to S/MIME. In fact, I have to
interface with the VeriSign OnSite, and their interface uses a old RFC
draft, now obsolated. It was named CRS, it has been replaced and
extended later by CMS, but VeriSign still uses the old one. The CRS draft
defines this structure. As I just wrote, I'm already able to read such
messages, but not create them.
> Also this is one of the areas of incompatibility with PKCS#7 and CMS (as
> used in S/MIME v3). If want to do the equivalent in CMS its a different
> structure but with a more logical layout.
I haven't proofread CMS yet ('cause I don't really need it by now), but
I'll take a glance at it.
--
Erwann ABALEA <[EMAIL PROTECTED]> - RSA PGP Key ID: 0x2D0EABD5
-----
hier j ai sans le vouloirs j'ai envoy� un virus sur Internet
qu'une personne mal intentionn� m'avez donn� pour tous .
je leurs demande de m'excuser
-+- RP in : GNU - Le retour du fils de la vengeance d'Henry -+-
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
