FW: [Fwd: Re: i have some troubles obtaining the right result with sfl.. pls help..]
"Beauchamp, Sue" <[email protected]> Thu, 28 Oct 2004 13:59:00 -0400
| Newsgroups | gmane.ietf.sfl |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
------_=_NextPart_001_01C4BD17.CD792FE6
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
For anyone who is interested,
=20
The solution for this problem verifying a signedData message that was
created with the SFL; make sure that the signedData is in an ASN.1 type
ContentInfo. The CMS associates a content type identifier with the
content.
=20
See below for specific details...
=20
Sue Beauchamp
DigitalNet=20
_____ =20
From: Beauchamp, Sue=20
Sent: Thursday, October 28, 2004 11:42 AM
To: 'Mihai Badea'
Subject: RE: [Fwd: Re: i have some troubles obtaining the right result
with sfl.. pls help..]
RumburaK,
=20
I noticed that your message, sfl.cms, is not contentInfo wrapped.=20
=20
CSM_Buffer *hau =3D msgtosign.GetEncodedContentInfo();
delete hau;
((CSM_Buffer
*)msgtosign.AccessEncapContentClear())->ConvertMemoryToFile("_SIGNED.tmp
");
You deleted it when you called: delete hau;
=20
My first suggestion would be to create a file containing contentInfo
wrapped signedData:
=20
hau->ConvertMemoryToFile("_SignedDataMsg.tmp");=20
delete hau;
=20
Then use _SignedDataMsg.tmp that contains a contentInfo wrapped
signedData instead of _SIGNED.tmp. You can see the contentInfo data in
the mozzilla.asn file. It is missing from the sfl.asn file. =20
=20
File: \\mihaib\donatii\mozilla.cms
Time: 19:24:11, 10/27/2004
---------------------------------------------------------------------
0 30 NDEF: SEQUENCE {
2 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
13 A0 NDEF: [0] {
A signedData message does not have to have a messageDigest attribute
unless there are signed attributes. You don't have any
signedAttributes in the signerInfo portion of the signedData message. =20
=20
SMP_Check gives an example of how to add signed attributes to a message,
see file smp/SMP_Check/sm_checkCreate.cpp.
=20
Try working with the contentInfo wrapped signedData message. =20
I just received your e-mail with your certificate and code. Thank you
for sending all the data. I will be running some tests with it now, but
I wanted to let you know what I think is the problem so you can continue
to work. =20
=20
Please let me know if this solves your problem or if you need further
assistance. In the meantime, I will be running the tests.
=20
Sue Beauchamp
_____ =20
From: Mihai Badea [mailto:[email protected]]=20
Sent: Thursday, October 28, 2004 4:46 AM
To: Beauchamp, Sue; [email protected]
Subject: [Fwd: Re: i have some troubles obtaining the right result with
sfl.. pls help..]
Dear Sue Beauchamp,
I really apreciate your answer.
I will try to describe here more exactly my problem regarding the use of
SFL library in my try to sign an email messge with S/MIME:
It is true that a mail client does not succesfully verify a signed
message whom content was altered by editing or other means. That is
normal.
But we have 3 diffrent situations here:
1st: An email composed and digitally signed with the mail client
(i.e. mozilla).
Verifies OK as no modifications were made afterwards.
Mozilla says:
"This message includes a valid digital signature. The message has
not been altered since it was sent."
The example eml file attached is: mozilla-good.eml
2nd: An email composed and digitally signed with the mail client,
then saved end altered manually by me.
I keep intact the "application/pkcs7-signature" MIME entity, but I
randomly modify the body of the MIME entity which was externaly signed.
As we would expect, the message does not verify. Though, the signature
is still a signature and it can be parsed in order to verify the
message. We can study the signer's certificate in a nice dialog box. The
only problem is that the signature does not match the content.
Mozilla says:
"This message includes a digital signature, but the signature is
invalid. The signature does not match the message content correctly. The
message appears to have been altered after the sender signed it. You
shoud not trust the validity of this message until you verify its
contents with the sender."
I expect to get at least the same result with the 3rd example (see
below), signed by me through SFL.
The example eml attached file is: mozilla-modified.eml
3rd: An email edited and signed by me.
I used the correct multipart/signed MIME structure, but instead of a
mozilla signature I included a signature created by me with the SFL.
Nevermind the content of the message, the signature is invalid and
cannot be parsed by the email client.
Mozilla says:
"This message includes a digital signature, but the signature is
invalid. There are unknown problems with this digital signature. You
should not trust the validity of this message until you verify its
contents with the sender."
The example eml attached file is: sfl-bad.eml
So I studied the differences between the valid signature generated with
mozilla and the invalid signature generated with SFL, in ASN1 language.
I used the tool that you indicated me, GUIdumpASN (I also found it
searching the net).
I must mention here that I also tried to use the method
MsgToSign::AccessEncapContentFromASN1() but every time the process
exited writing "Aborted".
Studying the two CMS generated objects in GUIdumpASN I noted that the
following code below is present in the valid mozilla generated
signature, but absent in the invalid SFL generated signature:
2555 30 9: SEQUENCE {
2557 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
2564 05 0: NULL
: }
2566 A0 423: [0] {
2570 30 24: SEQUENCE {
2572 06 9: OBJECT IDENTIFIER
: contentType (1 2 840 113549 1 9 3)
2583 31 11: SET {
2585 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7
1)
: }
: }
2596 30 28: SEQUENCE {
2598 06 9: OBJECT IDENTIFIER
: signingTime (1 2 840 113549 1 9 5)
2609 31 15: SET {
2611 17 13: UTCTime '041025083404Z'
: }
: }
2626 30 35: SEQUENCE {
2628 06 9: OBJECT IDENTIFIER
: messageDigest (1 2 840 113549 1 9 4)
2639 31 22: SET {
2641 04 20: OCTET STRING
: 25 34 CC 87 FF 95 DE 6A E7 15 17 2C F9
88 A2 D3
: 4D 87 22 CA
: }
: }
2663 30 82: SEQUENCE {
2665 06 9: OBJECT IDENTIFIER
: sMIMECapabilities (1 2 840 113549 1 9 15)
2676 31 69: SET {
2678 30 67: SEQUENCE {
2680 30 10: SEQUENCE {
2682 06 8: OBJECT IDENTIFIER
: des-EDE3-CBC (1 2 840 113549 3 7)
: }
2692 30 14: SEQUENCE {
2694 06 8: OBJECT IDENTIFIER rc2CBC (1 2 840
113549 3 2)
2704 02 2: INTEGER 128
: }
2708 30 13: SEQUENCE {
2710 06 8: OBJECT IDENTIFIER rc2CBC (1 2 840
113549 3 2)
2720 02 1: INTEGER 64
: }
2723 30 7: SEQUENCE {
2725 06 5: OBJECT IDENTIFIER desCBC (1 3 14 3 2
7)
: }
2732 30 13: SEQUENCE {
2734 06 8: OBJECT IDENTIFIER rc2CBC (1 2 840
113549 3 2)
2744 02 1: INTEGER 40
: }
: }
: }
: }
2747 30 120: SEQUENCE {
2749 06 9: OBJECT IDENTIFIER
: microsoftRecipientInfo (1 3 6 1 4 1 311 16
4)
2760 31 107: SET {
2762 30 105: SEQUENCE {
2764 30 98: SEQUENCE {
2766 31 11: SET {
2768 30 9: SEQUENCE {
2770 06 3: OBJECT IDENTIFIER countryName (2 5
4 6)
2775 13 2: PrintableString 'ZA'
: }
: }
2779 31 37: SET {
2781 30 35: SEQUENCE {
2783 06 3: OBJECT IDENTIFIER
: organizationName (2 5 4 10)
2788 13 28: PrintableString 'Thawte Consulting
(Pty) Ltd.'
: }
: }
2818 31 44: SET {
2820 30 42: SEQUENCE {
2822 06 3: OBJECT IDENTIFIER commonName (2 5
4 3)
2827 13 35: PrintableString 'Thawte Personal
Freemail Issuing CA'
: }
: }
: }
2864 02 3: INTEGER 859768
: }
: }
: }
2869 30 122: SEQUENCE {
2871 06 11: OBJECT IDENTIFIER
: id-aa-encrypKeyPref (1 2 840 113549 1 9 16
2 11)
2884 31 107: SET {
2886 A0 105: [0] {
2888 30 98: SEQUENCE {
2890 31 11: SET {
2892 30 9: SEQUENCE {
2894 06 3: OBJECT IDENTIFIER countryName (2 5
4 6)
2899 13 2: PrintableString 'ZA'
: }
: }
2903 31 37: SET {
2905 30 35: SEQUENCE {
2907 06 3: OBJECT IDENTIFIER
: organizationName (2 5 4 10)
2912 13 28: PrintableString 'Thawte Consulting
(Pty) Ltd.'
: }
: }
2942 31 44: SET {
2944 30 42: SEQUENCE {
2946 06 3: OBJECT IDENTIFIER commonName (2 5
4 3)
2951 13 35: PrintableString 'Thawte Personal
Freemail Issuing CA'
: }
: }
: }
2988 02 3: INTEGER 859768
: }
: }
: }
: }
We can clearly see that important infos such as messageDigest and
sMIMEcapabilities are missing from the SFL generated CMS object.
It is surely impossible to verify the content of a signe message with
the MD5 digest value missing, which leads me to the fact that the SFL
generated CMS object is indeed invalid, perhaps due to a mistake of
mine. I am studying intensively the SFL API PDF regarding on how to
include the missing code above in the generation of the CMS, but I still
can't figure it out.
The CMS objects are attached here as mozilla.cms (mozilla's signature)
and sfl.cms (SFL's signature).
I also attached the ASN1 interpretations of these CMS in the files
mozilla.asn and sfl.asn.
I hope this will help you to give me a hint of how to correctly sign a
message. I also apologize for the size of this message.
Thank you for your help.
Best regards,
RumburaK
Beauchamp, Sue wrote:=20
RumburaK/Mihai Badea,
=20
Your code example looks good, but it is always good to check the
output. First make sure the CMS message is correct by verifying the CMS
message that was built. See SMP/SMP_Check/sm_checkRead.cpp file on how
to set up to verify the cms message that was created. The verify code
starts at about line 99. =20
=20
=09
You can use the following command to get the ASN.1 binary data
to look at in a ASN.1 tool:
=20
((CSM_Buffer
*)msgtosign.AccessEncapContentFromAsn1())->ConvertMemoryToFile("_SIGNED.
bin");
=20
If you don't have an ASN.1 viewer tool, you can use the free
tool from Gemini Security:
http://www.geminisecurity.com/guidumpasn.html
As far as mime is concerned, all it takes is one improper
carraige return/linefeed for a message not to verify. Make sure that
you build your mime message correctly. Maybe the problem is as simple
as that. =20
=20
Please e-mail me if you have any further questions.
=20
Sue Beauchamp
BAE Systems (formerly DigitalNet)
[email protected]
=20
=20
=20
=20
=09
_____ =20
From: [email protected]
[mailto:[email protected]] On Behalf Of Mihai Badea
Sent: Tuesday, October 26, 2004 4:41 AM
To: [email protected]
Subject: i have some troubles obtaining the right result with
sfl.. pls help..
=20
hello everybody,
i am trying to do simple s/mime operations with e-mail:
sign, verify, encrypt, decrypt - using a valid thawte
certificate stored on disc and a password
i am testing the result in mozilla 1.7.3 on a gentoo system
i have compiled latest versions of smp, esnacc and crypto++
it seems that i am having some trouble, as mozilla doesn't read
properly the cms content in s/mime entities.
please help me with one thing:
=09
i am trying to sign a message:
=09
const char *msg =3D "Content-Type: text/plain;
charset=3Dus-ascii; format=3Dflowed\r\nContent-Transfer-Encoding:
7bit\r\n\r\nbau\r\n";
const int len =3D strlen(msg);
const CSM_Buffer encapcontent(msg, len);
CSM_MsgToSign msgtosign;
msgtosign.SetEncapContentClear((const CSM_Buffer
&)encapcontent);
msgtosign.SetIncludeContentFlag(false);
msgtosign.SetIncludeOrigCertsFlag(true);
CSM_AppLogin *papplogin =3D new CSM_AppLogin;
papplogin->AddLogin("libsm_free3DLL", "sm_free3DLL
\"cert.p12\" password");
if (msgtosign.Sign(papplogin) =3D=3D SM_NO_ERROR) printf("Signed
succesfully.\n");
CSM_Buffer *hau =3D msgtosign.GetEncodedContentInfo();
delete hau;
((CSM_Buffer
*)msgtosign.AccessEncapContentClear())->ConvertMemoryToFile("_SIGNED.tmp
");
=09
the code works ok.. i get the binary output in a file
then i convert the file "_SIGNED.tmp" to base64:
uuenview -b -o _SIGNED.tmp
then i copy the base64 data to an mime entity in an eml file
which i edit by hand
and i insert the whole message into a mozilla local folder
(storage file)
=09
if i use:
msgtosign.SetIncludeContentFlag(true)
then i use application/pcks7-mime signed-data type for the
encapsulating mime entity
=09
if i use:
msgtosign.SetIncludeContentFlag(false)
then i use application/pkcs7-signature in a multipart/signed
=09
i even tried to base64 encode and insert into an email the
outputs from the smp test program:
/SMP_Check/SMP_Check
which is for example:
TMPFirstSignedDataBinary.dat
=09
again mozilla gave me errors like (signed, but invalid
signature, encrypted with unknown method, etc).
though, the messages encrypted with mozilla work even if i edit
eml files, decode them, encode again, change mime entities and insert
back emails to local folder storage files. in worst cases i get an
(signature does not match message error) because the checksum does't
match anymore, but i can still view certificate infos etc.
=09
i once decoded a signature from mozilla
and in the same time buid a signature for the same content and
certificate
the binary files resulting were diffrent
maybe it would help me if i could compare both of them in asn.1
output to see the differences, but i didn't manage to do this yet
=09
please some one tell me why the way i sign messages is not
compatible with mozilla (which i think is the most representative secure
mail for linux) or at least some how can i be sure that i am creating
the correct cms data.
=09
as a documentation i used the sfl 2.4 api pdf, which isn't quite
a practical guide, and the sources in examples. somebody wrote perhaps a
tutorial or something? (i would be glad to if i knew better the sfl :)
=09
thank you!!
RumburaK
------_=_NextPart_001_01C4BD17.CD792FE6
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR></HEAD>
<BODY text=3D#000000 bgColor=3D#ffffff>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial color=3D#0000ff =
size=3D2><SPAN=20
class=3D750484117-28102004>For anyone who is =
interested,</SPAN></FONT></DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial color=3D#0000ff =
size=3D2><SPAN=20
class=3D750484117-28102004></SPAN></FONT> </DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial color=3D#0000ff =
size=3D2><SPAN=20
class=3D750484117-28102004>The solution for this problem verifying =
a=20
signedData message that was created with the SFL; make sure that =
the=20
signedData is in an ASN.1 type ContentInfo. The CMS =
associates a=20
content type identifier with the content.</SPAN></FONT></DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial color=3D#0000ff =
size=3D2><SPAN=20
class=3D750484117-28102004></SPAN></FONT> </DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial color=3D#0000ff =
size=3D2><SPAN=20
class=3D750484117-28102004>See below for specific =
details...</SPAN></FONT></DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial color=3D#0000ff =
size=3D2><SPAN=20
class=3D750484117-28102004></SPAN></FONT> </DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial color=3D#0000ff =
size=3D2><SPAN=20
class=3D750484117-28102004>Sue Beauchamp</SPAN></FONT></DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3DArial color=3D#0000ff =
size=3D2><SPAN=20
class=3D750484117-28102004>DigitalNet </SPAN></FONT></DIV><BR>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft>
<HR tabIndex=3D-1>
<FONT face=3DTahoma size=3D2><B>From:</B> Beauchamp, Sue =
<BR><B>Sent:</B> Thursday,=20
October 28, 2004 11:42 AM<BR><B>To:</B> 'Mihai Badea'<BR><B>Subject:</B> =
RE:=20
[Fwd: Re: i have some troubles obtaining the right result with sfl.. pls =
help..]<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D312171914-28102004>RumburaK,</SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>I noticed that your message, sfl.cms, is not =
contentInfo=20
wrapped. </FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
size=3D1><FONT=20
color=3D#000099><FONT face=3D"Courier New"> CSM_Buffer =
*hau =3D=20
msgtosign.GetEncodedContentInfo();<BR><TT> delete=20
hau;</TT></FONT><BR><TT><FONT face=3D"Courier New"> =
((CSM_Buffer=20
*)msgtosign.AccessEncapContentClear())->ConvertMemoryToFile("_SIGNED.t=
mp");</FONT></TT></FONT></FONT><BR><BR><FONT=20
face=3DArial color=3D#0000ff size=3D2>You deleted it when you =
called: delete=20
hau;</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>My first suggestion would be to create a file =
containing=20
contentInfo wrapped signedData:</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2> =20
hau->ConvertMemoryToFile("_SignedDataMsg.tmp"); </FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2> delete hau;</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>Then use _SignedDataMsg.tmp that contains a =
contentInfo=20
wrapped signedData instead of _SIGNED.tmp. You can see the =
contentInfo=20
data in the mozzilla.asn file. It is missing from the sfl.asn =
file. =20
</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
size=3D2>
<P>File: \\mihaib\donatii\mozilla.cms</P>
<P>Time: 19:24:11, 10/27/2004</P>
<P>---------------------------------------------------------------------<=
/P>
<P>0 30 NDEF: SEQUENCE {</P>
<P>2 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)</P>
<P>13 A0 NDEF: [0] {</P></FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>A signedData message does not have to have a =
messageDigest=20
attribute unless there are signed attributes. You don't =
have=20
any signedAttributes in the signerInfo portion of the signedData =
message. =20
</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>SMP_Check gives an example of how to add signed =
attributes=20
to a message, see file =
smp/SMP_Check/sm_checkCreate.cpp.</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>Try working with the contentInfo wrapped =
signedData=20
message. </FONT></SPAN><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>I just received your e-mail with your =
certificate and=20
code. Thank you for sending all the data. I will be running =
some=20
tests with it now, but I wanted to let you know what I think is the =
problem so=20
you can continue to work. </FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>Please let me know if this solves your problem =
or if you=20
need further assistance. In the meantime, I will be running the=20
tests.</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>Sue Beauchamp</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D312171914-28102004><FONT =
size=3D2>
<P dir=3Dltr align=3Dleft><FONT face=3D"Courier =
New"></FONT></P></FONT></SPAN><FONT=20
face=3DArial color=3D#0000ff size=3D2></FONT><FONT face=3DArial =
color=3D#0000ff=20
size=3D2></FONT><FONT face=3DArial color=3D#0000ff size=3D2></FONT><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT><FONT face=3DArial color=3D#0000ff =
size=3D2></FONT><FONT=20
face=3DArial color=3D#0000ff size=3D2></FONT><FONT face=3DArial =
color=3D#0000ff=20
size=3D2></FONT><FONT face=3DArial color=3D#0000ff size=3D2></FONT><FONT =
face=3DArial=20
color=3D#0000ff size=3D2></FONT><FONT face=3DArial color=3D#0000ff=20
size=3D2></FONT><BR></DIV>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft>
<HR tabIndex=3D-1>
<FONT face=3DTahoma size=3D2><B>From:</B> Mihai Badea=20
[mailto:[email protected]] <BR><B>Sent:</B> Thursday, October =
28, 2004=20
4:46 AM<BR><B>To:</B> Beauchamp, Sue; =
[email protected]<BR><B>Subject:</B> [Fwd:=20
Re: i have some troubles obtaining the right result with sfl.. pls=20
help..]<BR></FONT><BR></DIV>
<DIV></DIV>Dear Sue Beauchamp,<BR><BR>I really apreciate your =
answer.<BR>I will=20
try to describe here more exactly my problem regarding the use of SFL =
library in=20
my try to sign an email messge with S/MIME:<BR><BR>It is true that a =
mail client=20
does not succesfully verify a signed message whom content was altered by =
editing=20
or other means. That is normal.<BR>But we have 3 diffrent situations=20
here:<BR><BR> <FONT color=3D#993399><FONT=20
color=3D#cc0000>1st:</FONT> </FONT> An email composed =
and=20
digitally signed with the mail client (i.e. mozilla).<BR>Verifies OK as =
no=20
modifications were made afterwards.<BR>Mozilla says:<BR><FONT=20
face=3D"Courier New, Courier, monospace" =
color=3D#000066> "This=20
message includes a valid digital signature. The message has not been =
altered=20
since it was sent."<BR></FONT>The example eml file attached is: <FONT=20
color=3D#006600>mozilla-good.eml</FONT><BR><BR> <FONT=20
color=3D#cc0000>2nd:</FONT> An email composed and digitally =
signed=20
with the mail client, then saved end altered manually by me.<BR>I keep =
intact=20
the "application/pkcs7-signature" MIME entity, but I randomly modify the =
body of=20
the MIME entity which was externaly signed. As we would expect, the =
message does=20
not verify. Though, the signature is still a signature and it can be =
parsed in=20
order to verify the message. We can study the signer's certificate in a =
nice=20
dialog box. The only problem is that the signature does not match the=20
content.<BR>Mozilla says:<BR><FONT face=3D"Courier New, Courier, =
monospace"=20
color=3D#000066> "This message includes a digital signature, =
but the=20
signature is invalid. The signature does not match the message content=20
correctly. The message appears to have been altered after the sender =
signed it.=20
You shoud not trust the validity of this message until you verify its =
contents=20
with the sender."<BR></FONT>I expect to get at least the same result =
with the=20
3rd example (see below), signed by me through SFL.<BR>The example eml =
attached=20
file is: <FONT=20
color=3D#006600>mozilla-modified.eml<BR></FONT><BR> =
<FONT=20
color=3D#cc0000>3rd:</FONT> An email edited and signed =
by=20
me.<BR>I used the correct multipart/signed MIME structure, but instead =
of a=20
mozilla signature I included a signature created by me with the SFL. =
Nevermind=20
the content of the message, the signature is invalid and cannot be =
parsed by the=20
email client.<BR>Mozilla says:<BR><FONT =
color=3D#000066> "This=20
message includes a digital signature, but the signature is invalid. =
There are=20
unknown problems with this digital signature. You should not trust the =
validity=20
of this message until you verify its contents with the =
sender."<BR></FONT>The=20
example eml attached file is: <FONT =
color=3D#006600>sfl-bad.eml</FONT><BR><BR>So I=20
studied the differences between the valid signature generated with =
mozilla and=20
the invalid signature generated with SFL, in ASN1 language.<BR>I used =
the tool=20
that you indicated me, GUIdumpASN (I also found it searching the =
net).<BR>I must=20
mention here that I also tried to use the method <FONT=20
color=3D#006600>MsgToSign::AccessEncapContentFromASN1()</FONT> but every =
time the=20
process exited writing "<FONT =
color=3D#006600>Aborted</FONT>".<BR>Studying the two=20
CMS generated objects in GUIdumpASN I noted that the following code =
below is=20
present in the valid mozilla generated signature, but absent in the =
invalid SFL=20
generated signature:<BR><SMALL><FONT=20
face=3D"Courier New, Courier, monospace"><BR><FONT color=3D#006600>2555=20
30 =20
9: SEQUENCE=20
{<BR>2557 06 =20
5:  =
;=20
OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)<BR>2564 05 =20
0:  =
;=20
NULL<BR>  =
;=20
: =
=20
}<BR>2566 A0 =20
423: [0] =
{<BR>2570=20
30 =20
24: &nbs=
p;=20
SEQUENCE {<BR>2572 06 =20
9:  =
; =20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
=20
contentType (1 2 840 113549 1 9 3)<BR>2583 31 =20
11: &nbs=
p; =20
SET {<BR>2585 06 =20
9:  =
; =20
OBJECT IDENTIFIER data (1 2 840 113549 1 7=20
1)<BR> =
: =
=20
}<BR> =20
: =
=20
}<BR>2596 30 =20
28: &nbs=
p;=20
SEQUENCE {<BR>2598 06 =20
9:  =
; =20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
=20
signingTime (1 2 840 113549 1 9 5)<BR>2609 31 =20
15: &nbs=
p; =20
SET {<BR>2611 17 =20
13: &nbs=
p; =20
UTCTime=20
'041025083404Z'<BR> =
=20
: =
=20
}<BR> =20
: =
=20
}<BR>2626 30 =20
35: &nbs=
p;=20
SEQUENCE {<BR>2628 06 =20
9:  =
; =20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
=20
messageDigest (1 2 840 113549 1 9 4)<BR>2639 31 =20
22: &nbs=
p; =20
SET {<BR>2641 04 =20
20: &nbs=
p; =20
OCTET=20
STRING<BR> &nb=
sp;=20
: =
=20
25 34 CC 87 FF 95 DE 6A E7 15 17 2C F9 88 A2=20
D3<BR> =
: =
=20
4D 87 22=20
CA<BR> =
: =
=20
}<BR> =20
: =
=20
}<BR>2663 30 =20
82: &nbs=
p;=20
SEQUENCE {<BR>2665 06 =20
9:  =
; =20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
=20
sMIMECapabilities (1 2 840 113549 1 9 15)<BR>2676 31 =20
69: &nbs=
p; =20
SET {<BR>2678 30 =20
67: &nbs=
p; =20
SEQUENCE {<BR>2680 30 =20
10: &nbs=
p; =20
SEQUENCE {<BR>2682 06 =20
8:  =
; =20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
=20
des-EDE3-CBC (1 2 840 113549 3=20
7)<BR> =
: =
=20
}<BR>2692 30 =20
14: &nbs=
p; =20
SEQUENCE {<BR>2694 06 =20
8:  =
; =20
OBJECT IDENTIFIER rc2CBC (1 2 840 113549 3 2)<BR>2704 =
02 =20
2:  =
; =20
INTEGER=20
128<BR> =
=20
: =
=20
}<BR>2708 30 =20
13: &nbs=
p; =20
SEQUENCE {<BR>2710 06 =20
8:  =
; =20
OBJECT IDENTIFIER rc2CBC (1 2 840 113549 3 2)<BR>2720 =
02 =20
1:  =
; =20
INTEGER =
64<BR> =
: =
=20
}<BR>2723 30 =20
7:  =
; =20
SEQUENCE {<BR>2725 06 =20
5:  =
; =20
OBJECT IDENTIFIER desCBC (1 3 14 3 2=20
7)<BR> =
: =
=20
}<BR>2732 30 =20
13: &nbs=
p; =20
SEQUENCE {<BR>2734 06 =20
8:  =
; =20
OBJECT IDENTIFIER rc2CBC (1 2 840 113549 3 2)<BR>2744 =
02 =20
1:  =
; =20
INTEGER =
40<BR> =
: =
=20
}<BR> =20
: =
=20
}<BR> =20
: =
=20
}<BR> =20
: =
=20
}<BR>2747 30 =20
120: &nb=
sp;=20
SEQUENCE {<BR>2749 06 =20
9:  =
; =20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
=20
microsoftRecipientInfo (1 3 6 1 4 1 311 16 4)<BR>2760 31 =20
107: &nb=
sp; =20
SET {<BR>2762 30 =20
105: &nb=
sp; =20
SEQUENCE {<BR>2764 30 =20
98: &nbs=
p; =20
SEQUENCE {<BR>2766 31 =20
11: &nbs=
p; =20
SET {<BR>2768 30 =20
9:  =
; =20
SEQUENCE {<BR>2770 06 =20
3:  =
; =
=20
OBJECT IDENTIFIER countryName (2 5 4 6)<BR>2775 13 =20
2:  =
; =
=20
PrintableString=20
'ZA'<BR>  =
;=20
: =
=
}<BR> =20
: =
=20
}<BR>2779 31 =20
37: &nbs=
p; =20
SET {<BR>2781 30 =20
35: &nbs=
p; =20
SEQUENCE {<BR>2783 06 =20
3:  =
; =
=20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
&=
nbsp; =20
organizationName (2 5 4 10)<BR>2788 13 =20
28: &nbs=
p;  =
;=20
PrintableString 'Thawte Consulting (Pty)=20
Ltd.'<BR> &nbs=
p;=20
: =
=
}<BR> =20
: =
=20
}<BR>2818 31 =20
44: &nbs=
p; =20
SET {<BR>2820 30 =20
42: &nbs=
p; =20
SEQUENCE {<BR>2822 06 =20
3:  =
; =
=20
OBJECT IDENTIFIER commonName (2 5 4 3)<BR>2827 13 =20
35: &nbs=
p;  =
;=20
PrintableString 'Thawte Personal Freemail Issuing=20
CA'<BR> =
=20
: =
=
}<BR> =20
: =
=20
}<BR> =20
: =
=20
}<BR>2864 02 =20
3:  =
; =20
INTEGER=20
859768<BR> &nb=
sp;=20
: =
=20
}<BR> =20
: =
=20
}<BR> =20
: =
=20
}<BR>2869 30 =20
122: &nb=
sp;=20
SEQUENCE {<BR>2871 06 =20
11: &nbs=
p; =20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
=20
id-aa-encrypKeyPref (1 2 840 113549 1 9 16 2 11)<BR>2884 31 =20
107: &nb=
sp; =20
SET {<BR>2886 A0 =20
105: &nb=
sp; =20
[0] {<BR>2888 30 =20
98: &nbs=
p; =20
SEQUENCE {<BR>2890 31 =20
11: &nbs=
p; =20
SET {<BR>2892 30 =20
9:  =
; =20
SEQUENCE {<BR>2894 06 =20
3:  =
; =
=20
OBJECT IDENTIFIER countryName (2 5 4 6)<BR>2899 13 =20
2:  =
; =
=20
PrintableString=20
'ZA'<BR>  =
;=20
: =
=
}<BR> =20
: =
=20
}<BR>2903 31 =20
37: &nbs=
p; =20
SET {<BR>2905 30 =20
35: &nbs=
p; =20
SEQUENCE {<BR>2907 06 =20
3:  =
; =
=20
OBJECT=20
IDENTIFIER<BR>  =
; =20
: =
&=
nbsp; =20
organizationName (2 5 4 10)<BR>2912 13 =20
28: &nbs=
p;  =
;=20
PrintableString 'Thawte Consulting (Pty)=20
Ltd.'<BR> &nbs=
p;=20
: =
=
}<BR> =20
: =
=20
}<BR>2942 31 =20
44: &nbs=
p; =20
SET {<BR>2944 30 =20
42: &nbs=
p; =20
SEQUENCE {<BR>2946 06 =20
3:  =
; =
=20
OBJECT IDENTIFIER commonName (2 5 4 3)<BR>2951 13 =20
35: &nbs=
p;  =
;=20
PrintableString 'Thawte Personal Freemail Issuing=20
CA'<BR> =
=20
: =
=
}<BR> =20
: =
=20
}<BR> =20
: =
=20
}<BR>2988 02 =20
3:  =
; =20
INTEGER=20
859768<BR> &nb=
sp;=20
: =
=20
}<BR> =20
: =
=20
}<BR> =20
: =
=20
}<BR> =20
: =
=20
}<BR></FONT></FONT></SMALL><BR>We can clearly see that important infos =
such as=20
<FONT color=3D#006600>messageDigest</FONT> and <FONT=20
color=3D#006600>sMIMEcapabilities</FONT> are missing from the SFL =
generated CMS=20
object.<BR>It is surely impossible to verify the content of a signe =
message with=20
the MD5 digest value missing, which leads me to the fact that the SFL =
generated=20
CMS object is indeed invalid, perhaps due to a mistake of mine. I am =
studying=20
intensively the SFL API PDF regarding on how to include the missing code =
above=20
in the generation of the CMS, but I still can't figure it out.<BR>The =
CMS=20
objects are attached here as <FONT color=3D#000099>mozilla.cms</FONT> =
(mozilla's=20
signature) and <FONT color=3D#000099>sfl.cms</FONT> (SFL's =
signature).<BR>I also=20
attached the ASN1 interpretations of these CMS in the files <FONT=20
color=3D#000099>mozilla.asn</FONT> and <FONT =
color=3D#000099>sfl.asn</FONT>.<BR>I=20
hope this will help you to give me a hint of how to correctly sign a =
message. I=20
also apologize for the size of this message.<BR>Thank you for your=20
help.<BR><BR>Best regards,<BR>RumburaK<BR><BR><BR>Beauchamp, Sue wrote:=20
<BLOCKQUOTE =
cite=3Dmid6DED202D454D3B4EB7D98A7439218D61028A7680@vahqex2.gfgsi.com=20
type=3D"cite">
<META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR>
<STYLE>@font-face {
font-family: Tahoma;
}
@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times =
New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times =
New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times =
New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
TT {
FONT-FAMILY: "Courier New"
}
SPAN.EmailStyle18 {
COLOR: navy; FONT-FAMILY: Arial
}
DIV.Section1 {
page: Section1
}
</STYLE>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004>RumburaK/Mihai=20
Badea,</SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN><SPAN=20
class=3D968082613-26102004>Your code example looks good, but it is =
always good=20
to check the output. First </SPAN><SPAN =
class=3D968082613-26102004>make=20
sure the CMS message is correct by verifying the CMS message that was=20
built. See SMP/SMP_Check/sm_checkRead.cpp file on how to set up =
to=20
verify the cms message that was created. The verify code starts =
at about=20
line 99. </SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D968082613-26102004>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D968082613-26102004>You can =
use the=20
following command to get the ASN.1 binary data to look at in a=20
ASN.1 tool:</SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004> =20
((CSM_Buffer=20
=
*)msgtosign.AccessEncapContentFromAsn1())->ConvertMemoryToFile("_SIGNE=
D.bin");</SPAN></DIV>
<DIV><SPAN class=3D968082613-26102004></SPAN> </DIV>
<DIV><SPAN class=3D968082613-26102004>If you don't have an ASN.1 =
viewer tool,=20
you can use the free tool from Gemini Security: </SPAN><SPAN=20
class=3D968082613-26102004><A=20
=
href=3D"http://www.geminisecurity.com/guidumpasn.html">http://www.geminis=
ecurity.com/guidumpasn.html</A></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><BR><SPAN class=3D968082613-26102004>As =
far as mime is=20
concerned, all it takes is one improper carraige return/linefeed for=20
a message not to verify. Make sure that you build =
your mime=20
message correctly. Maybe the problem is as simple as that. =
</SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D968082613-26102004><FONT =
face=3DArial=20
size=3D2>Please e-mail me if you have any further =
questions.</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D968082613-26102004><FONT =
color=3D#0000ff>Sue=20
Beauchamp</FONT></SPAN></DIV></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D968082613-26102004><FONT =
color=3D#0000ff>BAE=20
Systems (formerly DigitalNet)</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D968082613-26102004><FONT =
color=3D#0000ff><A=20
=
href=3D"mailto:[email protected]">[email protected]=
</A></FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN =
class=3D968082613-26102004></SPAN> </DIV><BR>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT face=3DArial=20
color=3Dnavy size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: =
Arial"></SPAN></FONT> </DIV>
<DIV class=3DSection1>
<DIV>
<DIV class=3DMsoNormal style=3D"TEXT-ALIGN: center" =
align=3Dcenter><FONT=20
face=3D"Times New Roman" color=3Dblack size=3D3><SPAN=20
style=3D"FONT-SIZE: 12pt; COLOR: windowtext">
<HR tabIndex=3D-1 align=3Dcenter width=3D"100%" SIZE=3D2>
</SPAN></FONT></DIV>
<P class=3DMsoNormal><B><FONT face=3DTahoma color=3Dblack =
size=3D2><SPAN=20
style=3D"FONT-WEIGHT: bold; FONT-SIZE: 10pt; COLOR: windowtext; =
FONT-FAMILY: Tahoma">From:</SPAN></FONT></B><FONT=20
face=3DTahoma color=3Dblack size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: windowtext; FONT-FAMILY: Tahoma"> <A=20
class=3Dmoz-txt-link-abbreviated=20
=
href=3D"mailto:[email protected]">[email protected]</A>=
[<A=20
class=3Dmoz-txt-link-freetext=20
=
href=3D"mailto:[email protected]">mailto:[email protected].=
org</A>]=20
<B><SPAN style=3D"FONT-WEIGHT: bold">On Behalf Of </SPAN></B>Mihai=20
Badea<BR><B><SPAN style=3D"FONT-WEIGHT: bold">Sent:</SPAN></B> =
Tuesday, October=20
26, 2004 4:41 AM<BR><B><SPAN style=3D"FONT-WEIGHT: =
bold">To:</SPAN></B> <A=20
class=3Dmoz-txt-link-abbreviated=20
href=3D"mailto:[email protected]">[email protected]</A><BR><B><SPAN=20
style=3D"FONT-WEIGHT: bold">Subject:</SPAN></B> i have some troubles =
obtaining=20
the right result with sfl.. pls help..</SPAN></FONT></P></DIV>
<P class=3DMsoNormal><FONT face=3D"Times New Roman" color=3Dblack =
size=3D3><SPAN=20
style=3D"FONT-SIZE: 12pt"></SPAN></FONT> </P>
<P class=3DMsoNormal style=3D"MARGIN-BOTTOM: 12pt"><FONT face=3D"Times =
New Roman"=20
color=3Dblack size=3D3><SPAN style=3D"FONT-SIZE: 12pt">hello =
everybody,<BR>i am=20
trying to do simple s/mime operations with e-mail:<BR>sign, verify, =
encrypt,=20
decrypt - using a valid thawte certificate stored on disc and a =
password<BR>i=20
am testing the result in mozilla 1.7.3 on a gentoo system<BR>i have =
compiled=20
latest versions of smp, esnacc and crypto++<BR>it seems that i am =
having some=20
trouble, as mozilla doesn't read properly the cms content in =
s/mime=20
entities.<BR>please help me with one thing:<BR><BR>i am trying to sign =
a=20
message:<BR><BR></SPAN></FONT><TT><FONT face=3D"Courier New" =
color=3D#000099=20
size=3D1><SPAN style=3D"FONT-SIZE: 7.5pt; COLOR: =
rgb(0,0,153)"> =20
const char *msg =3D "Content-Type: text/plain; charset=3Dus-ascii;=20
format=3Dflowed\r\nContent-Transfer-Encoding:=20
7bit\r\n\r\nbau\r\n";</SPAN></FONT></TT><FONT face=3D"Courier New" =
color=3D#000099=20
size=3D1><SPAN=20
style=3D"FONT-SIZE: 7.5pt; COLOR: rgb(0,0,153); FONT-FAMILY: 'Courier =
New'"><BR><TT><FONT=20
face=3D"Courier New"> const int len =3D=20
strlen(msg);</FONT></TT><BR><TT><FONT face=3D"Courier =
New"> =20
const CSM_Buffer encapcontent(msg, len);</FONT></TT><BR><TT><FONT=20
face=3D"Courier New"> CSM_MsgToSign=20
msgtosign;</FONT></TT><BR><TT><FONT face=3D"Courier =
New"> =20
msgtosign.SetEncapContentClear((const CSM_Buffer=20
&)encapcontent);</FONT></TT><BR><TT><FONT=20
face=3D"Courier New"> =20
msgtosign.SetIncludeContentFlag(false);</FONT></TT><BR><TT><FONT=20
face=3D"Courier New"> =20
msgtosign.SetIncludeOrigCertsFlag(true);</FONT></TT><BR><TT><FONT=20
face=3D"Courier New"> CSM_AppLogin *papplogin =3D =
new=20
CSM_AppLogin;</FONT></TT><BR><TT><FONT face=3D"Courier =
New"> =20
papplogin->AddLogin("libsm_free3DLL", "sm_free3DLL \"cert.p12\"=20
password");</FONT></TT><BR><TT><FONT face=3D"Courier =
New"> if=20
(msgtosign.Sign(papplogin) =3D=3D SM_NO_ERROR) printf("Signed=20
succesfully.\n");</FONT></TT><BR><TT><FONT=20
face=3D"Courier New"> CSM_Buffer *hau =3D=20
msgtosign.GetEncodedContentInfo();</FONT></TT><BR><TT><FONT=20
face=3D"Courier New"> delete =
hau;</FONT></TT><BR><TT><FONT=20
face=3D"Courier New"> ((CSM_Buffer=20
=
*)msgtosign.AccessEncapContentClear())->ConvertMemoryToFile("_SIGNED.t=
mp");</FONT></TT><BR></SPAN></FONT><BR>the=20
code works ok.. i get the binary output in a file<BR>then i convert =
the file=20
"_SIGNED.tmp" to base64:<BR><TT><FONT face=3D"Courier New" =
color=3D#663366=20
size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102)"> =
uuenview -b=20
-o _SIGNED.tmp</SPAN></FONT></TT><FONT face=3D"Courier New" =
color=3D#663366=20
size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102); FONT-FAMILY: =
'Courier New'"><BR></SPAN></FONT>then=20
i copy the base64 data to an mime entity in an eml file which i edit =
by=20
hand<BR>and i insert the whole message into a mozilla local folder =
(storage=20
file)<BR><BR>if i use:<BR><TT><FONT face=3D"Courier New" =
color=3D#663366=20
size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102)"> =20
msgtosign.SetIncludeContentFlag(true)</SPAN></FONT></TT><FONT=20
face=3D"Courier New" color=3D#663366 size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102); FONT-FAMILY: =
'Courier New'"><BR></SPAN></FONT>then=20
i use application/pcks7-mime signed-data type for the encapsulating =
mime=20
entity<BR><BR>if i use:<BR><TT><FONT face=3D"Courier New" =
color=3D#663366=20
size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102)"> =20
msgtosign.SetIncludeContentFlag(false)</SPAN></FONT></TT><FONT=20
face=3D"Courier New" color=3D#663366 size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102); FONT-FAMILY: =
'Courier New'"><BR></SPAN></FONT>then=20
i use application/pkcs7-signature in a multipart/signed<BR><BR>i even =
tried to=20
base64 encode and insert into an email the outputs from the smp test=20
program:<BR><TT><FONT face=3D"Courier New" color=3D#663366 =
size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102)"> =20
/SMP_Check/SMP_Check</SPAN></FONT></TT><FONT face=3D"Courier New" =
color=3D#663366=20
size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102); FONT-FAMILY: =
'Courier New'"><BR></SPAN></FONT>which=20
is for example:<BR><TT><FONT face=3D"Courier New" color=3D#663366 =
size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102)"> =20
TMPFirstSignedDataBinary.dat</SPAN></FONT></TT><FONT face=3D"Courier =
New"=20
color=3D#663366 size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: rgb(102,51,102); FONT-FAMILY: =
'Courier New'"><BR></SPAN></FONT><BR>again=20
mozilla gave me errors like (signed, but invalid signature, encrypted =
with=20
unknown method, etc).<BR>though, the messages encrypted with mozilla =
work even=20
if i edit eml files, decode them, encode again, change mime entities =
and=20
insert back emails to local folder storage files. in worst cases i get =
an=20
(signature does not match message error) because the checksum does't =
match=20
anymore, but i can still view certificate infos etc.<BR><BR>i once =
decoded a=20
signature from mozilla<BR>and in the same time buid a signature for =
the same=20
content and certificate<BR>the binary files resulting were =
diffrent<BR>maybe=20
it would help me if i could compare both of them in asn.1 output to =
see the=20
differences, but i didn't manage to do this yet<BR><BR><U>please</U> =
some one=20
tell me why the way i sign messages is not compatible with mozilla =
(which i=20
think is the most representative secure mail for linux) or at least =
some how=20
can i be sure that i am creating the correct cms data.<BR><BR>as a=20
documentation i used the sfl 2.4 api pdf, which isn't quite a =
practical guide,=20
and the sources in examples. somebody wrote perhaps a tutorial or =
something?=20
(i would be glad to if i knew better the sfl :)<BR><BR>thank=20
you!!<BR>RumburaK</P></DIV></BLOCKQUOTE><BR></BODY></HTML>
------_=_NextPart_001_01C4BD17.CD792FE6--