RE: Problem when verifying a signed message without SignerInfo

Tuzi:

I am not sure what you are trying to do, but you CANNOT take a SignerInfo
from a previous message and verify the present message.  You can take the
certificate from a previous message and use it on the current message's
SignerInfo.

I will assume you intend to verify an existing SignerInfo, but the signing
certificate was not in the SignedData.  In this case, the SFL code behaves
as intended,  the PreProc(...) operation decodes the message, then the
calling application calls Verify(...).  In this case, it is up to the
application to determine that the public key is missing and provide it.
There in an example of such a check in the CL_MsgToVerify::Check(...) method
(in ./SMIME/testsrc/util/CL_MsgToVerify.cpp).  It is up to the application
to retrieve the key on demand and store it in the appropriate matching
SignerInfo (based on SID).  When this extra step is performed, then the
check you mention below will succeed.  If there are no certificates
available, the verify operation cannot proceed.

If this example code is not clear enough, please e-mail back and I will
extract the few statements necessary to check, then load a certificate to
the appropriate SignerInfo.

Bob Colestock
VDA

-----Original Message-----
From: tuzi [mailto:[email protected]]
Sent: Thursday, July 05, 2001 5:40 AM
To: [email protected]
Subject: Problem when verifying a signed message without SignerInfo



imc-sfl锛

	When I use the  function CSM_MsgToVerify::Verify(pCSMIME) to verify
a signed mail which doesn't include any SignerInfo ( set
SetIncludeOrigCertsFlag(0)
when you generate it) mail, I found some flaw, or say bug, in SFL. As I
traced into the 
CSM_DataToVerify::Verify[1] function, I found that the program will only do
some empty loop because the condition "if (tmpSI->AccessCerts())" will never
be met.
Does this mean that such a mail will never be actually verified?

	My question is: If user A send me a signed mail wich does not
contain
any SignerInfo. And fortunately I can obtain A's public key and Signerinfo
from a earlier mail. How can I use his public key to verify the new mail?

Thank you very much.


[1]There are too many funcitons that named Verify. The prototype of the one
that
	I referred to is
CSM_DataToVerify::Verify(
    CSMIME          *pCSMIME,              // IN, logged-on Instance list
    CSM_Buffer      *pOriginalEncapContent,// IN, optional content if not in
SD
    CSM_MsgCertCrls *pMsgCertCrls,         // IN, Originator(s) certs+++
    CSM_MsgSignerInfos *pMsgSignerInfos)

sincerely

            tuzi
            [email protected]