Fw: RE: RE: How to extract the public key

imc-sfl*******  forward mail *****

From:  Colestock, Robert
Email: [email protected]

Tuzi:

I am not sure what you mean by "recipient", but if you are asking how the
SignedData verify process determines the appropriate certificate from the
list, it simply aligns the Signer ID element of the SignerInfo (signature)
with the certificate (through Issuer and SerialNumber, or Subject Key
Identifier).

If you are asking how you can align these individual certificates with the
address book for proper decryption (RSA), then you will have to extract the
subject DN from the certificate.  I would suggest that you determine the
e-mail address component of the subject DN, then create a file name based on
this value, if present.  There is no requirement that a certificate contain
an e-mail element in its subject DN, so it may not be obvious who the actual
user is.  Any certs built by Verisign (and others) should have an e-mail
address element.  You can extract the DN string using the following commands
(for the loop listed below):
	
	CSM_DN *pSubjectDN=pCerts->Curr()->GetSubject();
	char *ptr=pSubjectDN->GetDNString();  // OR GetDNStringRFC1779()
	... 
	// The e-mail element is usually the last element in the DN String,
	// you can search for the specific OID, or simply reverse search for
"="
	// and take the remainder as the file name.  This would also work
for
	// "CN=" (common name) non-email DNs; this last string is usually
unique.
	delete pSubjectDN;
	if (ptr) free(ptr);

The resulting string should look something like:

"C=US@O=US Government@OU=VDA Site@OU=VDA@CN=Daisy RSA [email protected].
[email protected]"

Unfortunately we do not recognize the e-mail OID, "1.2.840.113549.1.9.1", as
a specific designator (e.g. "C="), so it is printed as an OID.

Bob Colestock
VDA.

-----Original Message-----
From: tuzi [mailto:[email protected]]
Sent: Thursday, June 07, 2001 12:00 PM
To: Colestock, Robert
Subject: Re: RE: How to extract the public key


Dear Robert锛

	Thank you for your instructions. I found some code in
the sm_mimeVerifySD_ONLY function (sm_mimetest.cpp).

           if (SM_GetKwValue("dumpOrigCertsTo", certsFn, "SignedDataTest")
== 0)
           {
              CSM_CertificateChoiceLst *pCerts =
smVerifyMsg.m_pMsgCertCrls->AccessCertificates();
              CSM_Buffer *pbuf = NULL;
              char outfile[256];
              int i = 0;

              pCerts->SetCurrToFirst();
              for (i = 0; i < pCerts->CountL(); i++)
              {
                  sprintf(outfile,"%s_%d.out",certsFn, i);
                  pbuf = pCerts->Curr()->AccessEncodedCert();
                  pbuf->ConvertMemoryToFile(outfile);
                  pCerts->GoNext();
              }
            }
These code will write the certificate data to file xxx_1.out, ....
I think that they are the certificate files I want. Thank you very much.

But I have another question. If I only have these certificate files.
How can I know who should be the recipient of each certificate file?
Is the information contained in the file itself?

> 
>Tuzi:
>
>As to how to do this, the SignedData certificate must be extracted from the
>CSM_MsgCertCrls member variable and stored as a file (you can extract as a
>CSM_Buffer, then save to file with the convert to file method).  To load
>into the CSM_MsgToEncrypt class, call the AddRecipient method specifying
the
>above extracted CSM_Buffer certificate (see the
>./SMIME/testutil/util/CL_MsgToEncrypt.cpp file for an example).  You can
>create a CSM_Buffer directly from a file ("CSM_Buffer
>A("./ExampleFileWithCertificate.cer").  If you need the actual specific
>details, please e-mail back and I will lookup the necessary example logic
to
>perform these operations.

sincerely

            tuzi
            [email protected]
**** end of forward *****


            tuzi
            [email protected]