小编典典

如何使用M2Crypto从PKCS7信封中获取签名内容?

python

我需要获取PKCS#7信封的摘要以进行手动检查。

通常,当您要验证pkcs#7信封的签名时,可以这样做:

from M2Crypto import SMIME, X509, BIO

sm_obj = SMIME.SMIME()
x509 = X509.load_cert(join(PATH, 'QualifiedChain.crt'))
sk = X509.X509_Stack()
sk.push(x509)
sm_obj.set_x509_stack(sk)

st = X509.X509_Store()

st.load_info(join(PATH, 'QualifiedChain.crt'))

sm_obj.set_x509_store(st)

# re-wrap signature so that it fits base64 standards
cooked_sig = '\n'.join(raw_sig[pos:pos + 76] for pos in
                       xrange(0, len(raw_sig), 76))

# now, wrap the signature in a PKCS7 block
sig = "-----BEGIN PKCS7-----\n%s\n-----END PKCS7-----\n" % cooked_sig


# and load it into an SMIME p7 object through the BIO I/O buffer:
buf = BIO.MemoryBuffer(sig)
p7 = SMIME.load_pkcs7_bio(buf)

signers = p7.get0_signers(sk)
certificat = signers[0]
data_bio = BIO.MemoryBuffer(MSG)
sm_obj.verify(p7, data_bio)  # This is the line that count.

但就我而言,摘要类型为md5sha1,openssl无法识别:

$ openssl list-message-digest-commands
md4
md5
rmd160
sha
sha1

我需要做的是获取pkcs#7 signatureContent并手动检查它。

我需要的是等效于Python的Python org.bouncycastle.cms.CMSSignedDataParser

如何获得摘要以能够手动验证而无需使用sm_obj.verify


阅读 220

收藏
2021-01-16

共1个答案

小编典典

PKCS7具有SignerInfos的集合。每个SignerInfo可能具有不同的消息摘要算法。

https://github.com/erny/pyx509。这需要pyasn1和pyasn1-modules。

./pkcs_parse <pkcs7 signature in DER format>

这将提取每个签署者信息的摘要算法。

2021-01-16