alexdean
commented
1 year ago also tried an approach based on code cited in https://stackoverflow.com/questions/53044007/how-to-use-sha1-digest-during-signing-with-opensslpkcs7-sign-when-creating-smi
micalg = 'sha-256'
# construct the signature
pkcs7 = OpenSSL::PKCS7.new
pkcs7.type = :signed
signer = OpenSSL::PKCS7::Signer.new(
@server_info.certificate,
@server_info.pkey,
As2::DigestSelector.for_code(micalg).new
)
pkcs7.add_data(mdn_text)
pkcs7.add_certificate(@server_info.certificate)
pkcs7.add_signer(signer)
pkcs7.detached = true
File.open('test_sig.p7m', 'wb') { |fp| fp.write(pkcs7.to_pem) }
File.open('test_sig_message.txt', 'wb') { |fp| fp.write(mdn_text) }This signature is missing some important data which prevents it from being verified. Note unable to find message digest in the verification error at the bottom.
-> % openssl smime -verify -binary -inform PEM \
-in test_sig.p7m \
-content test_sig_message.txt \
-certfile test/certificates/server.crt \
-nointern \
-noverify
Content-Type: multipart/report; report-type=disposition-notification;
boundary="----=_Part_7_20230405102219370"
------=_Part_7_20230405102219370
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
The AS2 message has been received successfully
------=_Part_7_20230405102219370
Content-Type: message/disposition-notification
Content-Transfer-Encoding: 7bit
Reporting-UA: BOB
Original-Recipient: rfc822; BOB
Final-Recipient: rfc822; BOB
Original-Message-ID: <message@server>
Disposition: automatic-action/MDN-sent-automatically; processed
Received-Content-MIC: micmicmic, sha256
------=_Part_7_20230405102219370--
Verification failure
140704403170880:error:21FFF06C:PKCS7 routines:CRYPTO_internal:unable to find message digest:/AppleInternal/Library/BuildRoots/9e200cfa-7d96-11ed-886f-a23c4f261b56/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/pkcs7/pk7_doit.c:1036:
140704403170880:error:21FFF069:PKCS7 routines:CRYPTO_internal:signature failure:/AppleInternal/Library/BuildRoots/9e200cfa-7d96-11ed-886f-a23c4f261b56/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/pkcs7/pk7_smime.c:407:
in #25 i added a new MDN format which does not use
OpenSSL::PKCS7.write_smime.One item i wasn't able to solve in that PR was how to specify the
micalgparameter used in theContent-Typeheader. The workaround in that PR is to still callwrite_smimeand use a regex to extract themicalgparameter. Would like to remove that hack when possible.what we need to replicate
write_smimeproduces a header like this:but i have not been able to figure out where/how it chooses the
sha-256value. it is unconnected to the certificate we use or the MIC alg we use in the MDN report we're signing.looking for input
asked for help in https://stackoverflow.com/questions/75934159/how-does-openssl-smime-determine-micalg-parameter should check back there periodically to look for an answer.