Re: Creating a PKCS7 detached signature with providers

On Thu, 2 Oct 2025 at 10:40, Mad <[email protected]> wrote:

> Hello,
>
> This is the first time I've posted on a mailing list, so sorry if the tone
> isn't correct.
>
> I'm in the process of finalising a project to update OpenSSL 1.1.1 to
> 3.5.X with the purpose of doing ASN1 decoding and PKCS7 signing where I
> integrate my own cryptography via providers (digest, cipher, mac,
> signature, asym_cipher, keymgmt and kdf).
>
> When implementing the detached PKCS7 signature, I tried to use
> ‘PKCS7_sign’ or ‘CMS_sign(NULL, NULL, NULL, NULL, CMS_PARTIAL|CMS_DETACHED)
> + CMS_add1_signer(...) + CMS_final(...)’, but the problem was that I
> systematically came across the ‘EVP_get_digestbyname’ function in the base
> layers.
>
> If I understand correctly, the ‘EVP_get_digestbyname’ function is
> incompatible with the OpenSSL 3+ provider system. I wanted to know if there
> was a trick to make ‘EVP_get_digestbyname’ work or if there is a method
> that I haven't seen to make a detached signature in DER format.
>
It's not "incompatible" with the provider system - but it is restricted. It
only knows about certain built-in digests - but those digests can still
come from a provider. Where in the CMS code are you hitting it?

Matt



> Thank you for reading and your time.
>
> --
> You received this message because you are subscribed to the Google Groups
> "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
> To view this discussion visit
> https://groups.google.com/a/openssl.org/d/msgid/openssl-users/e3df5e46-f50d-4dcc-a852-38f2ca2014afn%40openssl.org
> <https://groups.google.com/a/openssl.org/d/msgid/openssl-users/e3df5e46-f50d-4dcc-a852-38f2ca2014afn%40openssl.org?utm_medium=email&utm_source=footer>
> .
>

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAODx15ciLdB%2B2XEs_jpD3wX0vmg%2BzPxcONE3hLgMpND4qBerCA%40mail.gmail.com.