On Wed, Jul 28, 2010, Bob Smith wrote: > > Hello, > > I'm working on some code that uses the PKCS7 routines to sign some data. The > code so far is (lots of return values cut out for brevity)... > > int flags = 0x00 | PKCS7_NOSMIMECAP | PKCS7_BINARY; > p7 = PKCS7_sign( cert, pkey, NULL, datain, flags ); > PKCS7_final( p7, datain, flags ); > dataout = BIO_new_file( ..., "wb" ); > i2d_PKCS7_bio_stream( dataout, p7, datain, flags ); > > This works fine for PKCS1 padding. But I'd need to use PSS padding. Having > spent a great deal of time trying to work out how to do this from the source > code, can someone help me with some suggestions on what I need to do? > > I've found these functions - EVP_PKEY_CTX_set_rsa_padding() and > EVP-PKEY_CTX_set_rsa_saltlen(), however I'm struggling to determine how to > use that function with the PKCS7 functions. >
I'm afraid your are currently out of luck. The PKCS#7 standard doesn't support PSS: the CMS standard does but OpenSSL doesn't currently include support in its CMS code. There is support for PSS signatures in certificates though in HEAD which will be backported to 1.0.1 at some point. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
