b41d12c0b8
* Regenerate the CRL that expired in September 2025 * Refresh the expired certificates embedded in certloadverifybuffer * Return 0 from tls servers that returned a wolfSSL_write byte count * Send a client certificate from client-tls and client-tls13-resume * Return 0 from certverify instead of WOLFSSL_SUCCESS * Give the XTS demo key two different halves * Exit success after ml_dsa prints its parameter table * Report failure from the custom io file client and server * Latch failures across every ecc-params curve lookup * Ignore SIGPIPE in the btle fifo transport * Fix the dtls rw-threads certificate paths * Make runall.sh fail when an example fails * Make openssl-verify.sh actually verify and actually fail * Raise the generate_ssl.sh common name length limit * Port the PQ examples to the current wolfSSL API * Return 0 from csr_w_ed25519_example and rsa-public-decrypt-app * Build the x509_acert openssl example against the right headers * Give the examples Makefiles a consistent wolfSSL prefix * Fix the double free and NULL derefs in the custom io cleanup paths * Stop forcing the ESP32 examples to include a developer private config * Add the missing WiFi Kconfig to the DTLS13 station examples * Use XSTRLCPY in client-dtls13 since wolfSSL has no XSTRCPY * Make the DTLS13 example ctx static so it stops colliding with libnet80211 * Set SO_REUSEADDR on the tls servers that lacked it * Give puf the wolfSSL sources and stop building the IDF 4.4 only ENC28J60 examples * Set SO_REUSEADDR on server-tcp as well * Exit the can-bus client on EOF and give it real input in CI * Re-arm the select timeout each pass in the nonblocking dtls server * Keep the shared memory BIOs alive until both sides are done * Port the ebpf tracers to the libbpf 1.0 perf_buffer__new signature * Clone wolfSSL before make builds its graph so uefi-static builds from a clean tree * Raise wolfcryptjni compileSdk to 32 for the BigInteger API its submodule uses * Link wolfentropy.o and keep wc_port socket helpers out of the UEFI build * Track the wolfSSL dilithium.c to wc_mldsa.c rename and drop a stale java import * Move uefi-library to the wc_MlDsa API after the wolfSSL dilithium rename * Declare the launcher activity exported, required from API 31 * Configure wolfSSL before make in the fullstack setup script * Track the wolfSSL io.c to wolfio.c rename in the ndk sample * Keep glibc headers out of the freestanding uefi-library build * Track the wolfSSL mlkem.h rename and give RT1060 the SDK name it selects on * Track the wolfIP struct ll rename and pin wolfIP to its v1.0 release * Use getaddrinfo in the ndk sample since bionic does not declare gethostbyname * Cross compile RT1060 with arm-none-eabi and document the SDK value the Makefile matches * Enable wolfIP HTTP so its httpd.h actually declares the API the example calls * Define HAVE_NETDB_H so wolfio.c includes the header its getaddrinfo path needs * Link pkcs12.o, which RT1060 enables by default and wolfcrypt test calls * Port the ENC28J60 examples to the ESP-IDF 5.x ethernet API * Compile dtls.c in the ndk sample, which enables WOLFSSL_DTLS * Define the PHY identifier registers the removed IDF header supplied * Compile kdf.c in the ndk sample for the TLS PRF * Give RT1060 a current_time so the benchmark stops needing clock_gettime * Port the ENC28J60 PHY to the IDF 5.x autonego_ctrl vtable * Remove the ENC28J60 server's duplicate driver copy that main already builds * Return the DTLS server to accept on close_notify so a resume is heard * Run the C# pq client/server pair under mono * Define WOLFSSL_CERT_REQ so the ndk-gradle app links wolfssljni's X509_REQ calls * Refresh the expired client ECC DER certificate * Add CI that builds and runs every example against wolfSSL master and stable * Sign OCSP staples with a responder intermediate1 actually delegated * Report a failing PKCS#11 example instead of always exiting 0 * Link the PSA library the README's PSA_LIB_PATH names * Widen the mynewt pointer prints so they build on a 64 bit native BSP * Test RSA under UEFI with a 2048 bit key so it clears wolfSSL's minimum * Left pad the ECDSA r and s so a leading zero cannot shift the signature * Document the smime and indef flags the pkcs7 examples need * Fail ecc-verify when the signature does not verify * Fail ecc-sign when a round produces an invalid signature * Fail aesgcm-file-encrypt when its sanity test does not pass * Check that ML-KEM derives the same shared secret on both sides * Fail ecdh_gen_secret when the two sides derive different secrets * Return the DH key agreement error instead of always exiting 0 * Retry the fullstack HTTPS probe so a slow sim start does not fail it * Confirm the custom-io file transfer succeeded so CI can assert it * Print a success line from the silent file-encrypt and ecc-export examples * Add device-sims job running ATECC608 STSAFE and TROPIC01 sim wolfcrypt tests * Extend device-sims to STM32 and PIC32MZ for the full sim fleet * Mount wolfSSL for the STM32 and PIC32MZ sim wolfcrypt runs * Accept the zero success return from wolfSSL_CTX_set_max_early_data * Read the earlydata reply so the client processes the session ticket before resuming * Read the earlydata reply in the DTLS client so it processes the session ticket * Run the tls13 and dtls13 earlydata pairs now that the clients process the ticket * Let expect_fail clear on refs that carry the fix via a fixed_on marker * Retry the PSA TLS 1.3 handshake so an intermittent ECC reject does not fail CI * Retry network fetches across CI so a transient blip does not fail a job * Normalize do_ecc and do_25519 exit codes like do_448 so an error is never masked to 0 * Build and run the merged-in hsm dtls_client example in CI via a dedicated hsm.yml job * Add a make check target to each applicable example * Run only the example and lint smoke set on draft PRs * Only run a per-target workflow when its own example dir changes * Assert the real se050 wolfcrypt result instead of an early sub-test line * Size the RSA 2048 key export buffers so the UEFI test does not fail on BUFFER_E * Call the always-present MLDSA context API from the UEFI driver * Cross uefi-static and uefi-library with both wolfSSL refs in the matrix * Give each tpm matrix leg a ref-unique results file and artifact * Add a codespell spellcheck pass to the lint job * Run push CI on master only so a PR branch does not double-trigger * Select valgrind by caller_run_id since event_name is the caller under workflow_call * Make example check targets catch real failures with pipefail exit checks and inputs * Wire the harness to run make check for mode check examples starting with ecc * Migrate the single-entry exec examples to mode check and fold their inputs into the check targets * Fix four make check assertions that misfired under pipefail * Give the tpm manifest entry a run step so it asserts output * Skip uefi-static in the lint make -n loop so it does not clone * Assert the actual verify result in the pkcs7 and rsa-nb checks * Return nonzero from pkcs12-create-example on a failed create so the check is not a false pass * Return nonzero from rsa-kg on any key generate or write failure * Assert the static memory checks by exit code instead of a pipefail grep that BSD make lacks * Run pkcs7 signedData stream through make check so it asserts the real verify result * Check DER certificates and CRLs in the expiry canary too * Feed the wolfHSM client its stdin so run_client actually exchanges data * Assert every make check by exit code and captured output instead of a pipefail grep so they hold under BSD make |
||
|---|---|---|
| .. | ||
| scripts | ||
| Makefile | ||
| README.md | ||
| authEnvelopedData-kari.c | ||
| authEnvelopedData-kekri.c | ||
| authEnvelopedData-ktri.c | ||
| authEnvelopedData-ori.c | ||
| authEnvelopedData-pwri.c | ||
| benchmark-streaming-envelop.c | ||
| compressedData.c | ||
| content.txt | ||
| encryptedData.c | ||
| envelopedData-kari.c | ||
| envelopedData-kekri.c | ||
| envelopedData-ktri-stream.c | ||
| envelopedData-ktri.c | ||
| envelopedData-ori.c | ||
| envelopedData-pwri.c | ||
| envelopedDataDecode.c | ||
| pkcs7-verify.c | ||
| signed.p7b | ||
| signed.p7s | ||
| signedData-CompressedFirmwarePkgData.c | ||
| signedData-DetachedSignature.c | ||
| signedData-EncryptedCompressedFirmwarePkgData.c | ||
| signedData-EncryptedFirmwareCB.c | ||
| signedData-EncryptedFirmwarePkgData.c | ||
| signedData-FirmwarePkgData.c | ||
| signedData-cryptocb.c | ||
| signedData-p7b.c | ||
| signedData-stream.c | ||
| signedData-verifyFile.c | ||
| signedData.c | ||
| smime-verify.c | ||
| smime.c | ||
README.md
PKCS7/CMS Examples
This directory contains example applications that demonstrate usage of the wolfCrypt PKCS#7/CMS API, included in the wolfSSL embedded SSL/TLS library. It includes examples of several different content types (EncryptedData, SignedData, EnvelopedData, CompressedData), and demonstrates both signing/encrypting and verifying/decrypting operations.
Building
Build and Install wolfSSL
$ ./configure --enable-pkcs7
$ make
$ sudo make install
Note, some examples require additional features, such as "--with-libz" and "--enable-pwdbased". To build wolfSSL with support for all examples, use:
$ ./configure --enable-pkcs7 --enable-indef --enable-smime --enable-pwdbased --enable-cryptocb --with-libz CFLAGS="-DWOLFSSL_DER_TO_PEM"
$ make
$ sudo make install
Build Examples
Running make will try to compile all C source files into their own
respective example application. Each source file can be compiled separately
if desired, for example:
make
gcc -o pkcs7 pkcs7.c -Wall -I/usr/local/include -Os -L/usr/local/lib -lm -lwolfssl
gcc -o ecc-verify ecc-verify.c -Wall -I/usr/local/include -Os -L/usr/local/lib -lm -lwolfssl
Some of the examples which use the CompressedData content type require the zlib library to be installed. The default Makefile has the linking against (-lz) commented out. Before making the CompressedData example, please uncomment the following line in Makefile:
#ZLIB += -lz
Debugging
To enable debug messages change the Makefile to:
CFLAGS+=$(DEBUG_FLAGS)
#CFLAGS+=$(OPTIMIZE)
Build and install wolfSSL using:
./configure --enable-pkcs7 --enable-debug
make
sudo make install
Most of the examples listed below output a DER-encoded version of the
PKCS#7/CMS bundle that was generated. These DER-encoded files can be used to
do further analysis, or debugging with external tools. Two helpful tools
for doing this include the openssl cms application and the dumpasn1 app.
Debugging with dumpasn1 (dumpasn1 source file)
$ dumpasn1 encryptedData.der
0 80: SEQUENCE {
2 9: OBJECT IDENTIFIER encryptedData (1 2 840 113549 1 7 6)
13 67: [0] {
15 65: SEQUENCE {
17 1: INTEGER 0
20 60: SEQUENCE {
22 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
33 29: SEQUENCE {
35 9: OBJECT IDENTIFIER aes256-CBC (2 16 840 1 101 3 4 1 42)
46 16: OCTET STRING 08 83 47 90 5D 9F D6 AA DC 25 CE B2 87 9A 10 CF
: }
64 16: [0] 3C 22 EA 61 64 FB 21 30 77 8A CE B0 5A A7 35 DE
: }
: }
: }
: }
0 warnings, 0 errors.
Debugging with openssl cms
$ openssl cms -inform der -in envelopedData.der -cmsout -print -noout
CMS_ContentInfo:
contentType: pkcs7-encryptedData (1.2.840.113549.1.7.6)
d.encryptedData:
version: <ABSENT>
encryptedContentInfo:
contentType: pkcs7-data (1.2.840.113549.1.7.1)
contentEncryptionAlgorithm:
algorithm: aes-256-cbc (2.16.840.1.101.3.4.1.42)
parameter: OCTET STRING:
0000 - 08 83 47 90 5d 9f d6 aa-dc 25 ce b2 87 9a 10 ..G.]....%.....
000f - cf .
encryptedContent:
0000 - 3c 22 ea 61 64 fb 21 30-77 8a ce b0 5a a7 35 <".ad.!0w...Z.5
000f - de .
unprotectedAttrs:
<EMPTY>
Examples Description and Usage
pkcs7-verify
./pkcs7-verify
Der 1633
PKCS7 Verify Success
EncryptedData
Example file: encryptedData.c
Generated bundle file: encryptedData.der
This example creates a PKCS#7/CMS EncryptedData bundle, using AES256-CBC as the encryption algorithm. After creating the bundle, it decodes the encrypted bundle and verifies the decryption operation was successful.
The generated EncryptedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./encryptedData
Successfully encoded EncryptedData bundle (encryptedData.der)
CompressedData
Example file: compressedData.c
Generated bundle file: compressedData.der
This example creates a PKCS#7/CMS CompressedData bundle. After creating the bundle, it decodes, uncompresses, and verifies the bundle.
The generated CompressedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./compressedData
Successfully encoded CompressedData bundle (compressedData.der)
EnvelopedData using KTRI RecipientInfo
Example file: envelopedData-ktri.c
Generated bundle file: envelopedDataKTRI.der
This example creates a PKCS#7/CMS EnvelopedData bundle that includes a KTRI RecipientInfo type. It uses AES256-CBC as the encryption algorithm, and specifies the enveloped content type as DATA. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./envelopedData-ktri
Successfully encoded EnvelopedData bundle (envelopedDataKTRI.der)
EnvelopedData using KARI RecipientInfo
Example file: envelopedData-kari.c
Generated bundle file: envelopedDataKARI.der
This example creates a PKCS#7/CMS EnvelopedData bundle that includes a KARI RecipientInfo type. It uses AES256-CBC as the encryption algorithm, and specifies the enveloped content type as DATA. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./envelopedData-kari
Successfully encoded EnvelopedData bundle (envelopedDataKARI.der)
EnvelopedData using KEKRI RecipientInfo
Example file: envelopedData-kekri.c
Generated bundle file: envelopedDataKEKRI.der
This example creates a PKCS#7/CMS EnvelopedData bundle that includes a KEKRI RecipientInfo type. It uses AES256-CBC as the encryption algorithm, and specifies the enveloped content type as DATA. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./envelopedData-kekri
Successfully encoded EnvelopedData bundle (envelopedDataKEKRI.der)
Successfully decoded EnvelopedData bundle (envelopedDataKEKRI.der)
EnvelopedData using PWRI RecipientInfo
Example file: envelopedData-pwri.c
Generated bundle file: envelopedDataPWRI.der
This example creates a PKCS#7/CMS EnvelopedData bundle that includes a PWRI RecipientInfo type. It uses AES256-CBC as the encryption algorithm, and specifies the enveloped content type as DATA. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./envelopedData-pwri
Successfully encoded EnvelopedData bundle (envelopedDataPWRI.der)
EnvelopedData using ORI RecipientInfo
Example file: envelopedData-ori.c
Generated bundle file: envelopedDataORI.der
This example creates a PKCS#7/CMS EnvelopedData bundle that includes a ORI RecipientInfo type. It uses AES256-CBC as the encryption algorithm, and specifies the enveloped content type as DATA. ORI is loosely defined by the CMS RFC and allows users to specify their own encoding/decoding algorithm for the RecipientInfo. This example uses a simple bitwise complement operation for the encryption operation. This is not recommended to be used in production and is simply an example of how user callbacks may be registered and used with the ORI type. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./envelopedData-ori
Successfully encoded EnvelopedData bundle (envelopedDataORI.der)
AuthEnvelopedData using KTRI RecipientInfo
Example file: authEnvelopedData-ktri.c
Generated bundle file: authEnvelopedDataKTRI.der
This example creates a PKCS#7/CMS AuthEnvelopedData bundle that includes a KTRI RecipientInfo type. It uses AES256-GCM as the encryption algorithm, and specifies the enveloped content type as DATA. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./authEnvelopedData-ktri
Successfully encoded AuthEnvelopedData bundle (authEnvelopedDataKTRI.der)
AuthEnvelopedData using KARI RecipientInfo
Example file: authEnvelopedData-kari.c
Generated bundle file: authEnvelopedDataKARI.der
This example creates a PKCS#7/CMS AuthEnvelopedData bundle that includes a KARI RecipientInfo type. It uses AES256-GCM as the encryption algorithm, and specifies the enveloped content type as DATA. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./authEnvelopedData-kari
Successfully encoded AuthEnvelopedData bundle (authEnvelopedDataKARI.der)
AuthEnvelopedData using KEKRI RecipientInfo
Example file: authEnvelopedData-kekri.c
Generated bundle file: authEnvelopedDataKEKRI.der
This example creates a PKCS#7/CMS AuthEnvelopedData bundle that includes a KEKRI RecipientInfo type. It uses AES256-GCM as the encryption algorithm, and specifies the enveloped content type as DATA. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./authEnvelopedData-kekri
Successfully encoded AuthEnvelopedData bundle (authEnvelopedDataKEKRI.der)
Successfully decoded AuthEnvelopedData bundle (authEnvelopedDataKEKRI.der)
AuthEnvelopedData using PWRI RecipientInfo
Example file: authEnvelopedData-pwri.c
Generated bundle file: authEnvelopedDataPWRI.der
This example creates a PKCS#7/CMS AuthEnvelopedData bundle that includes a PWRI RecipientInfo type. It uses AES256-GCM as the encryption algorithm, and specifies the enveloped content type as DATA. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./authEnvelopedData-pwri
Successfully encoded AuthEnvelopedData bundle (authEnvelopedDataPWRI.der)
AuthEnvelopedData using ORI RecipientInfo
Example file: authEnvelopedData-ori.c
Generated bundle file: authEnvelopedDataORI.der
This example creates a PKCS#7/CMS AuthEnvelopedData bundle that includes a ORI RecipientInfo type. It uses AES256-GCM as the encryption algorithm, and specifies the enveloped content type as DATA. ORI is losely defined by the CMS RFC and allows users to specify their own encoding/decoding algorithm for the RecipientInfo. This example uses a simple bitwise complement operation for the encryption operation. This is not recommended to be used in production and is simply an example of how user callbacks may be registered and used with the ORI type. After creating the bundle, it decodes the enveloped bundle and verifies the operation was successful.
The generated EnvelopedData bundle is written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./authEnvelopedData-ori
Successfully encoded AuthEnvelopedData bundle (authEnvelopedDataORI.der)
SignedData
Example file: signedData.c
Generated bundle files: signedData_noattrs.der, signedData_attrs.der
This example creates two PKCS#7/CMS SignedData bundles, one with attributes and one without them. It uses RSA with SHA256 as the signature algorithm, and specifies the signed content type as DATA. After creating the bundle, it decodes the bundle and verifies the operation was successful.
The generated SignedData bundles are written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./signedData
Successfully encoded SignedData bundle (signedData_noattrs.der)
Successfully verified SignedData bundle.
Successfully encoded SignedData bundle (signedData_attrs.der)
Successfully verified SignedData bundle.
SignedData encapsulating FirmwarePkgData
Example file: signedData-FirmwarePkgData.c
Generated bundle files: signedFirmwarePkgData_noattrs.der,
signedFirmwarePkgData_attrs.der
This example creates two PKCS#7/CMS SignedData bundles, one with attributes and one without them. It uses RSA with SHA256 as the signature algorithm, and specifies the signed content type as FirmwarePkgData. After creating the bundle, it decodes the bundle and verifies the operation was successful.
The generated SignedData bundles are written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./signedData-FirmwarePkgData
Successfully encoded Signed FirmwarePkgData bundle (signedFirmwarePkgData_noattrs.der)
Successfully verified SignedData bundle.
Successfully encoded Signed FirmwarePkgData bundle (signedFirmwarePkgData_attrs.der)
Successfully verified SignedData bundle.
SignedData encapsulating Encrypted FirmwarePkgData
Example file: signedData-EncryptedFirmwarePkgData.c
Generated bundle files: signedEncryptedFirmwarePkgData_noattrs.der,
signedEncryptedFirmwarePkgData_attrs.der
This example creates two PKCS#7/CMS SignedData bundles, one with attributes and one without them. It uses RSA with SHA256 as the signature algorithm, and specifies the signed content type as EncryptedData. The inner EncryptedData content type encapsulates a FirmwarePkgData type. After creating the bundles, the app decodes them and verifies the operation was successful.
The generated SignedData bundles are written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./signedData-EncryptedFirmwarePkgData
Successfully encoded Signed Encrypted FirmwarePkgData (signedEncryptedFPD_noattrs.der)
Successfully extracted and verified bundle contents
Successfully encoded Signed Encrypted FirmwarePkgData (signedEncryptedFPD_attrs.der)
Successfully extracted and verified bundle contents
SignedData encapsulating Compressed FirmwarePkgData
Example file: signedData-CompressedFirmwarePkgData.c
Generated bundle files: signedCompressedFirmwarePkgData_noattrs.der,
signedCompressedFirmwarePkgData_attrs.der
This example creates two PKCS#7/CMS SignedData bundles, one with attributes and one without them. It uses RSA with SHA256 as the signature algorithm, and specifies the signed content type as CompressedData. The inner CompressedData content type encapsulates a FirmwarePkgData type. After creating the bundles, the app decodes them and verifies the operation was successful.
The generated SignedData bundles are written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./signedData-CompressedFirmwarePkgData
Successfully encoded Signed Compressed FirmwarePkgData (signedCompressedFPD_noattrs.der)
Successfully extracted and verified bundle contents
Successfully encoded Signed Compressed FirmwarePkgData (signedCompressedFPD_attrs.der)
Successfully extracted and verified bundle contents
SignedData using Crypto Callback
Build wolfssl using: ./configure --enable-pkcs7 --enable-pwdbased --enable-cryptocb.
Example file: signedData-cryptocb.c
Generated bundle files: signedData_cryptocb_noattrs.der,
signedData_cryptocb_attrs.der
This example creates a PKCS#7/CMS SignedData bundle using the wolfCrypt Crypto callback. This allows a user to register a callback to do cryptographic operations outside of wolfCrypt proper. This can be useful in order to take advantage of hardware-based cryptography instead of the default software implementation.
It uses RSA with SHA256 as the signature algorithm, and specifies the signed content type as DATA. After creating the bundle, the app decodes it and verifies the operation was successful.
The generated SignedData bundles are written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./signedData-cryptocb
Successfully encoded SignedData bundle (signedData_cryptocb_noattrs.der)
Successfully verified SignedData bundle.
Successfully encoded SignedData bundle (signedData_cryptocb_attrs.der)
Successfully verified SignedData bundle.
Enabling PSA with the PKCS7 crypto callback example
For wolfSSL PSA support see: https://github.com/wolfSSL/wolfssl/tree/master/wolfcrypt/src/port/psa See https://github.com/wolfSSL/wolfssl/pull/4739 for details on building a PSA crypto library to test against.
Build wolfSSL with PSA enabled:
./configure --enable-psa --with-psa-lib-name=mbedcrypto --enable-cryptocb --enable-pkcallbacks CFLAGS="-DWOLFSSL_PSA_GLOBAL_LOCK"
make
sudo make install
Build example with PSA=1 set:
make clean
make PSA=1
SignedData with Detached Signature
Example file: signedData-DetachedSignature.c
Generated bundle files: signedData_detached_noattrs.der,
signedData_detached_attrs.der
This example creates a PKCS#7/CMS SignedData bundle that does not include the EncapsulatedContent eContent. This is known as a detached signature, and is useful when signing a large amount of data to decrease the size of the CMS bundle. It uses RSA with SHA256 as the signature algorithm, and specifies the signed content type as DATA. After creating the bundle, the app decodes it and verifies the operation was successful.
The generated SignedData bundles are written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./signedData-DetachedSignature
Successfully encoded SignedData bundle (signedData_detached_noattrs.der)
Successfully verified SignedData bundle.
Successfully encoded SignedData bundle (signedData_detached_attrs.der)
Successfully verified SignedData bundle.
SignedData encapsulating Encrypted Compressed FirmwarePkgData
Example file: signedData-EncryptedCompressedFirmwarePkgData.c
Generated bundle files: signedEncryptedCompressedFirmwarePkgData_noattrs.der,
signedEncryptedCompressedFirmwarePkgData_attrs.der
This example creates two PKCS#7/CMS SignedData bundles, one with attributes and one without them. It uses RSA with SHA256 as the signature algorithm, and specifies the signed content type as CompressedData. The inner CompressedData content type encapsulates an EncryptedData type, which in turn encapsulates a FirmwarePkgData type. After creating the bundles, the app decodes them and verifies the operation was successful.
The generated SignedData bundles are written out to a file for analysis and additional debugging.
If wolfSSL has been configured and compiled with debug support, the bytes of the bundle will be printed out to the terminal window.
./signedData-EncryptedCompressedFirmwarePkgData
Successfully encoded Signed Encrypted Compressed FirmwarePkgData (signedEncryptedCompressedFPD_noattrs.der)
Successfully extracted and verified bundle contents
Successfully encoded Signed Encrypted Compressed FirmwarePkgData (signedEncryptedCompressedFPD_attrs.der)
Successfully extracted and verified bundle contents
Verify SignedData bundle from existing file
Example file: signedData-verifyFile.c
This example allows the caller to pass in an existing PKCS#7/CMS bundle in DER format, then attempts to verify the SignedData bundle using wolfCrypt.
Usage for this example is:
signedData-verifyFile X.X.X (NOTE: All files relative to current directory)
-? Help, print this usage
-b <file> PKCS#7/CMS bundle to verify (DER format)
-c <content> Detached content, if needed
If wolfSSL has been configured and compiled with debug support, the bytes
of the bundle will be printed out to the terminal window. For example to verify
the bundle created by the signedData example:
./signedData-verifyFile -b signedData_noattrs.der
wolfCrypt PKCS#7/CMS SignedData verification example
Read 1982 bytes from signedData_noattrs.der
Decoded content size is 11 bytes
Successfully verified SignedData bundle!
To verify SignedData bundles that represent a detached signature (which does
not include content in the bundle), use the -c option to pass in a file to
be used as the content. For example, to verify the bundle created by the
example application signedData-DetachedSignature:
./signedData-verifyFile -b signedData_detached_attrs.der -c content.txt
wolfCrypt PKCS#7/CMS SignedData verification example
Read 1987 bytes from signedData_detached_attrs.der
Read 11 bytes from content file: content.txt
Decoded content size is 11 bytes
Successfully verified SignedData bundle!
Converting P7B Certificate Bundle to PEM using PKCS7 SignedData API
Build wolfssl using: ./configure --enable-pkcs7 CFLAGS="-DWOLFSSL_DER_TO_PEM"
Example file: signedData-p7b.c
This example parses a .p7b certificate bundle using wolfCrypt's PKCS#7 SignedData API, looping over each extracted certificate, converting each certificate to PEM format (from DER), and printing it to the terminal for info/reference.
./signedData-p7b
Successfully verified SignedData bundle.
CERT [0] size = 1291 bytes
converted DER to PEM, pemSz = 1805
CERT [0] PEM:
-----BEGIN CERTIFICATE-----
MIIFBzCCA++gAwIBAgIJAPFcmUNmPZYEMA0GCSqGSIb3DQEBCwUAMIGeMQswCQYD
VQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEVMBMG
A1UECgwMd29sZlNTTF8yMDQ4MRkwFwYDVQQLDBBQcm9ncmFtbWluZy0yMDQ4MRgw
FgYDVQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29s
ZnNzbC5jb20wHhcNMjEwMjEwMTk0OTUyWhcNMjMxMTA3MTk0OTUyWjCBnjELMAkG
A1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xFTAT
BgNVBAoMDHdvbGZTU0xfMjA0ODEZMBcGA1UECwwQUHJvZ3JhbW1pbmctMjA0ODEY
MBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdv
bGZzc2wuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwwPRK/45
pDJFO1PIhCsqfHSavaoqUgdH1qY2sgcyjtC6aXvGw0Se1IFI/S1oootnu6F1yDYs
StIb94u6zw357+zxgR57mwNHmr9lzH9lJGmm6BSJW+Q098WwFJP1Z3s6enjhAVZW
kaYTQo3SPECcTO/Rht83URsMoTv18aNKNeThzpbfG36/TpfQEOioCDCBryALQxTF
dGe0MoJvjYbCiECZNoO6HkByIhfXUmUkc7DO7xnNrv94bHvAEgPUTnINUG07ozuj
mV6dyNkMhbPZitlUJttt+qy7/yVMxNF59HHThkAYE7BjtXJOMMSXhIYtVi/XFfd/
wK71/Fvl+6G60wIDAQABo4IBRDCCAUAwHQYDVR0OBBYEFDPYRWbXaIcYflQNcCeR
xybXhWXAMIHTBgNVHSMEgcswgciAFDPYRWbXaIcYflQNcCeRxybXhWXAoYGkpIGh
MIGeMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96
ZW1hbjEVMBMGA1UECgwMd29sZlNTTF8yMDQ4MRkwFwYDVQQLDBBQcm9ncmFtbWlu
Zy0yMDQ4MRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkqhkiG9w0BCQEW
EGluZm9Ad29sZnNzbC5jb22CCQDxXJlDZj2WBDAMBgNVHRMEBTADAQH/MBwGA1Ud
EQQVMBOCC2V4YW1wbGUuY29thwR/AAABMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
BgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAuitI0ajjwoRClqF85fFGukz3h1fH
eMjBMsRp/4W7XWrdyYd+/rv0/RUKTJSVgDCQRQP4M4fKX3Q4pNBax2U4w7Doh7FJ
Mrms6fvTCB2kUXvX2Ut5NaI6C+QMoAKcoWjhXWyOLjok3rvWHKesLs1XREj2cuDH
W5PcfVtkDheEaCyVHSyG1rB0Z1Fue/TVYThRsxjjEBZzSzaKimIF9VaKviHheH2/
rUX5C/WvoGIB/T9J3zk8/0boCv5ca7tBpWTxXJtRTLxtn6Mg7elI4am+CC2FQlnW
Q31HIqX6H6JYdgtwHB1ZHaq+XS0lfLEGtsCqKKqTfNC9Q62RUBx7TfPk1w==
-----END CERTIFICATE-----
Creating an SMIME bundle and verifying it
In these example cases the content will be overridden by the content found in the SMIME bundle. The smime application creates both a detached (detached-smime-created.p7s) and a non detached bundle (smime-created.p7s).
Creating RSA signed bundles:
./smime ../certs/client-key.der ../certs/client-cert.der
./smime-verify smime-created.p7s ../certs/client-cert.der content.txt
Creating ECC signed bundles:
./smime ../certs/ecc-client-key.der ../certs/client-ecc-cert.der
./smime-verify detached-smime-created.p7s ../certs/client-ecc-cert.der content.txt
PKCS7 Benchmarking
./benchmark-streaming-envelop
Benchmarking with content size of 10000 bytes
Reading and writing files in chuncks of 1000 bytes
Using AES-256 CBC encryption
Using RSA-2048 key
Creating an encoded bundle ... 27.33 MB/s : ret = 10576
Created file [test-stream-dec.p7b] with size of 10576 bytes
Decoding bundle [test-stream-dec.p7b], size of 10576 bytes ... 9.14 MB/s : ret = 0
Processed 10576 bytes
Support
Please email wolfSSL support at support@wolfssl.com with any questions about PKCS#7/CMS support in wolfCrypt, or about issues with these examples.
References
RFC 2315 - PKCS #7: Cryptographic Message Syntax Version 1.5