RE: Using SFL to verify

Margaret:

You are correct, it does nothing.  The CTIL, or instance reference, does not
contain any OIDs to associate an algorithm for verification.

Creative use of the CTIL constructor.  It was not intended to be used in
this fashion, but it can work.  The creation of your TokenInterface is
incomplete, there is a lot more information necessary, like the OIDs, name,
functionality, etc.  This is done by the individual CTIL library when loaded
dynamically.  Our design intent is to dynamically load the CTIL DLLs as a
string, with a startup string.

It is possible to link and manipulate the CTIL directly.  The following
logic is modified from "sm_free3.cpp":

		CSM_Buffer CertBuf("DaisyRsaExts.out");	// Be sure to
specify the path.
            CSM_TokenInterface  *pTokenInterface;
		CSM_Free3 *pFree = new CSM_Free3(rsa);
            pTokenInterface  = CSM_Free3::AddLoginStatic(pFree, CertBuf,
                NULL, NULL, NULL, NULL);
            GLOBALAddLoginFinish(Csmime, pTokenInterface, argv1[4],
pCertPath);
		// AT THIS POINT, the Csmime instance is read to verify.

Unfortunately, at this time the library requires a certificate to align the
OIDs; even for verification (where an originator certificate is
unnecessary).  The logic for simple verification logic is partially
implemented, but the library requires at least a dummy certificate for the
instance; the dummy certificate MUST be an RSA certificate.

As to building with RSA, you will need to construct the sm_free3 CTIL with
the "SM_FREE3_RSA_INCLUDED" define.  (Be aware of the RSA licensing
restrictions, even if using the Crypto++ implementation, this logic should
not be used in commercial applications unless a license is granted by RSA).

As to certificates, they are probably already in the SignedData of the
message (this is generally the case).  If not, then it is up to the
application to extract the certificates and load them into the
CSM_MsgToVerify instance for processing.  Normally they are not a separate
attachment in an e-mail where they must be extracted, but it is common that
they are not sent as part of the SignedData (or sent only the 1st time,
expecting the e-mail client to extract them and associate the certificate(s)
with a particular e-mail recipient in the address book for later use).  If
you do not have the certificate within the SignedData, I would suggest you
re-generate the SignedData with the certificate(s) contained (usually a flag
in the options of e-mail clients).

I will attempt to create a test case this week, and modify the CTIL for a
future release to accommodate a missing certificate.  In the meantime, this
certificate will do fine for a dummy login to use for RSA verification.

Bob.

-----Original Message-----
From: Margaret Cyrzan [mailto:[email protected]]
Sent: Wednesday, May 10, 2000 1:29 PM
To: [email protected]
Subject: Using SFL to verify



I'm having some trouble using SFL to verify a message that I received. I'm 
using the Crypto++ library, and verify is failing. Here is my code:

	// put it in the instance list in pCSMIME
	if (pCSMIME->m_pCSInsts == NULL)
	{
		if ((pCSMIME->m_pCSInsts = new CSM_CSInstLst) == NULL)
			return E_OUTOFMEMORY;
	}

	// Set up a RSA instance
	if ((pNewInstance = new CSM_CSInst) == NULL)
		return E_OUTOFMEMORY;
	pCSMIME->m_pCSInsts->AppendL(pNewInstance);

	// generate a new FREE CTI class
	if ((pFree = new CSM_Free3(rsa)) == NULL)
		return E_OUTOFMEMORY;
	// CSM_Free3 constructor sets Alg IDs
	// now, fill in what we can in the instance
	// store token interface pointer
	pNewInstance->SetTokenInterface((CSM_TokenInterface *)pFree);

	// Create the contentInfoMsg class with the content which was
	// loaded in a buffer earlier.
	CSM_ContentInfoMsg contentInfo(&buf);
	if(contentInfo.IsSignedData())
	{
		CSM_MsgToVerify msg(&contentInfo);
		msg.PreProc(pCSMIME);
		long l = msg.Verify(pCSMIME);
	}


Maybe someone can suggest what I'm missing or using incorrectly. Right now 
verify doesn't look like it does anything.  Do I have to load certificates 
into the instance? If so, how do I extract them from the e-mail and put them

into the instance?

Thanks,

Margaret

________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com