On Sun, Feb 22, 2009, Jan F. Schnellbaecher wrote: > Hi, > > > Dr. Stephen Henson wrote: > > >> $ openssl.exe smime -verify -inform DER -in sig -content > >> openssl-0.9.8h.tar.gz > >> -noverify -out c.tar.gz > >> Verification failure > >> 3776:error:21071065:PKCS7 routines:PKCS7_signatureVerify:digest > >> failure:pk7_doit > >> .c:948: > >> 3776:error:21075069:PKCS7 routines:PKCS7_verify:signature > >> failure:pk7_smime.c:31 > >> 2: > >> > > > > Try including the -binary switch. > > > > Even with the binary switch I get the same verification failure. Is there a > debug switch that shows the calculated hash? >
That particular failure is caused by the digest contained explicitly in the PKCS #7 structure not matching the calculated value. If you do: openssl sha1 content then openssl asn1parse -inform DER -in sig You should see something like: 730:d=7 hl=2 l= 9 prim: OBJECT :messageDigest 741:d=7 hl=2 l= 22 cons: SET 743:d=8 hl=2 l= 20 prim: OCTET STRING [HEX DUMP]:7AA2461C5ED26B8A3B7CADF3435D8A068A2C2758 The actual offsets at the start don't matter it's the OCTET STRING after messageDigest which is of interest. That is the explicit message digest of the content. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
