我需要获取PKCS#7信封的摘要以进行手动检查。
通常,当您要验证pkcs#7信封的签名时,可以这样做:
from M2Crypto import SMIME, X509, BIO sm_obj = SMIME.SMIME() x509 = X509.load_cert(join(PATH, 'QualifiedChain.crt')) sk = X509.X509_Stack() sk.push(x509) sm_obj.set_x509_stack(sk) st = X509.X509_Store() st.load_info(join(PATH, 'QualifiedChain.crt')) sm_obj.set_x509_store(st) # re-wrap signature so that it fits base64 standards cooked_sig = '\n'.join(raw_sig[pos:pos + 76] for pos in xrange(0, len(raw_sig), 76)) # now, wrap the signature in a PKCS7 block sig = "-----BEGIN PKCS7-----\n%s\n-----END PKCS7-----\n" % cooked_sig # and load it into an SMIME p7 object through the BIO I/O buffer: buf = BIO.MemoryBuffer(sig) p7 = SMIME.load_pkcs7_bio(buf) signers = p7.get0_signers(sk) certificat = signers[0] data_bio = BIO.MemoryBuffer(MSG) sm_obj.verify(p7, data_bio) # This is the line that count.
但就我而言,摘要类型为md5sha1,openssl无法识别:
$ openssl list-message-digest-commands md4 md5 rmd160 sha sha1
我需要做的是获取pkcs#7 signatureContent并手动检查它。
我需要的是等效于Python的Python org.bouncycastle.cms.CMSSignedDataParser。
org.bouncycastle.cms.CMSSignedDataParser
如何获得摘要以能够手动验证而无需使用sm_obj.verify?
sm_obj.verify
PKCS7具有SignerInfos的集合。每个SignerInfo可能具有不同的消息摘要算法。
见https://github.com/erny/pyx509。这需要pyasn1和pyasn1-modules。
./pkcs_parse <pkcs7 signature in DER format>
这将提取每个签署者信息的摘要算法。