Hi.
I'm new to SSLey, and I have a question:
How do I read and verify a pkcs7 signature file using SSLeay?
Background:
o The "Zignature Shell" (zigbert 0.60) is used
to create manifests and signatures for Netscapes
'jar' files (for instance /usr/local/lib/netscape/java/classes/ldap10.jar
found on my system). To find the signature files, just unzip
the entire jar file, and look for '*.rsa', '*.dsa' or '*.pgp' files
in the META-INF directory, the "jar" format is just zip + manifest)
o The manifest in the ldap file above is signed using an
accompanying zigbert.rsa file, which looks like a pkcs7 signature
(hard to tell exatly, but but the first two lines of output
from "asn1parse -inform DER < zigbert.rsa" is:
0:d=0 hl=4 l=3963 cons: SEQUENCE
4:d=1 hl=2 l= 9 prim: OBJECT :pkcs7-signedData
which is an indication, and the documentation from javasoft
(see below) explicitly says that an '.rsa' file
should contain an PKCS7 signature, MD5 + RSA ;)
Now, my current task is to write a manifest verification program
(for the "Jar" manifests, specified
in http://www.javasoft.com/products/jdk/1.2/docs/guide/jar/manifest.html),
but I am having a very hard time doing so, since I can't find
anything in SSLeay which will help me read the .rsa files which
Netscape Inc. uses to sign their jar files.
Does anyone have a hint or two about where I should look or what
I should do?
(Rmz)
PS: I am using 0.8.1 from the FreeBSD Ports collection.
+-------------------------------------------------------------------------+
| Administrative requests should be sent to [EMAIL PROTECTED] |
| List service provided by Open Software Associates, http://www.osa.com/ |
+-------------------------------------------------------------------------+
