On Fri, 15 Feb 2002, Erwann ABALEA wrote:
> On Thu, 14 Feb 2002, Dr S N Henson wrote:
>
> > Erwann ABALEA wrote:
> > >
> > > Hi,
> > >
> > > I'm facing a problem I can't manage to solve.
> > >
> > > I need to create a structure like this one:
> > >
> > > signed PKCS#7 {
> > > signer certificate
> > > authenticated attributes
> > > content: enveloped PKCS#7 {
> > > recipient certificates
> > > enc_content: data
> > > }
> > > }
It works now. I forgot that I also had to perform a few 'hacks' in order
to verify the signature, because native OpenSSL code can't verify the
signature of such a structure.
Now I can create those. I had to:
- create a signed pkcs7, set it to detached
- transform my enveloped pkcs7 to DER into a BIO
- read the first 23 bytes of the BIO (it's a magic value, in real life it
has to be calculated) to 'consume' them
- create a BIO on the signed pkcs7
- write to the signed BIO the rest of the partly-consumed BIO (write into
the second ont the rest of the first)
- finalize the signed BIO
- set the signed pkcs7 to non-detached
- place in the signed pkcs7->d.sign->contents my enveloped pkcs7
- and I get it
Hard to do it right... :(
The process of 'consuming' the first bytes of the inner enveloped pkcs7
allows me to verify the signature on the outter signed pkcs7 (what is
signed is the contents of the enveloped pkcs7, without the first tag and
length). Natively, OpenSSL doesn't handle this situation correctly.
I also have a request for a change in OpenSSL: remove the automatically
added 'signingTime' attribute... If a developer wants it to be there, he
should explicitely put it there. In my case, I don't want it, but I can't
do that without modifying the OpenSSL source code, which I'd like to avoid
as much as possible.
--
Erwann ABALEA <[EMAIL PROTECTED]> - RSA PGP Key ID: 0x2D0EABD5
-----
C'est tout b�te mais avec OE 4 je n'arrive plus � envoyer de
mails (...) alors que j'arrive � me connecter sur le net, �
envoyer des mails,... Please please sauvez-moi...
-+- JC in GNU : Docteur, quand je fais ca, je n'y arrive pas ! -+-
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
