How can I check signature of a SignedCms envelope?

问题

I don't really understand how to work with PKCS#7 messages.

I sign some byte array with a X509Certificate2 I have and get also a byte array.

byte[] data = new byte[5] { 110, 111, 112, 113, 114 }, signedData;

X509Certificate2 cert = new X509Certificate2(certPath, password);

ContentInfo content = new ContentInfo(data);
SignedCms envelope = new SignedCms(content);
CmsSigner cmsSigner = new CmsSigner(cert);
envelope.ComputeSignature(cmsSigner);
signedData = envelope.Encode();

The signedData is transmitted to some remote recipient and he gets the SignedCms envelope.

SignedCms envelope = new SignedCms();
envelope.Decode(signedData);

How can he decode the envelope? He doesn't pass my public key as a parameter. There's my public key in the envelope, in SignerInfo property, but is there any reason for that, cause anyone can replace it with the whole signature?

He can the recipient make sure, using my public key that he has, that the actual sender of the envelope is me?

There's method envelope.CheckSignature(new X509Certificate2Collection(certificate), true); but I tried to use wrong certificate and there was no exception thrown.

回答1:

A PKCS#7 by itself is just a signature, could it be replaced? sure. envelope.CheckSiganture just validates that pkcs#7 has the right format and length, in other words checks if a pkcs#7 is well constructed.

Broadly putted, you need to implement a PKI (Private Key Infrastructure). Where in one end you construct your pkcs#7 using a public key, and on the other end you must validate that the pkcs#7 you have actually has a valid certificate that you recognize as your own. You must implement an OCSP to validate those certificates and if everything checks out all right you should and must request a timestamp to a third party to vouch for your pkcs#7. Also you will need a vault (database) to keep track of everything: pkcs#7's, data hashes, timestamps, original data, ocsp responses...

But if you are only interested in knowing how to identify a pkcs#7, there are various tools you could use to decode a PKCS#7, this action gives back all the information contained in it. Or you could create your own using c#.

回答2:

A PKCS#7 / CMS / S/MIME signed message is a data container which has (in addition to some other metadata):

EncapsulatedContentInfo
  ContentInfoType
  EncapsulatedContent (the message bytes)
Certificates (Optional)
CRLs (Optional)
SignerInfos
  DigestAlgorithm (e.g. SHA-1)
  SignedAttributes (Optional, allows other context information to be signed)
  SignatureAlgorithm (e.g. RSA, DSA, ECDSA)
  SignatureValue (the signature bytes)
  UnsignedAttributes (Optional, allows for after-signing information, like counter-signatures)

(This is a summary of RFC 2630 (Cryptographic Message Syntax) Section 5)

SignedCms.Decode reads the encoded message and populates members. Every direct signatory to the message can be read from the SignedCms::SignerInfos property (counter-signers, or entities which have signed that they witnessed the original signature, can be read from SignerInfo::CounterSignerInfos).

When you call SignedCms.CheckSignature, it checks every SigerInfo and verifies that the signature can be successfully verified (or throws an exception), as well as that every counter-signer signature can be worked out.

What it doesn't know is that any of the signers "made sense". For that check you would need to loop over each SignerInfo and look at (for example) the Certificate property; then perform a suitability check:

Perhaps it is a pre-registered public key
Perhaps it chains up to a well-known root or intermediate CA
Perhaps it has some sort of Extension which shows it to be suitable

This part SignedCms cannot realistically do for you, since there's no default notion of "suitable" for messages, unlike the hostname verification of TLS.

If you want to assess the signature of a single signer, you can call SignedInfo::CheckSignature, but that's redundant if you also called SignedCms::CheckSignature.

There's method envelope.CheckSignature(new X509Certificate2Collection(certificate), true); but I tried to use wrong certificate and there was no exception thrown.

The extraCerts overloads provide extra certificates. It's valid to have a SignedCms message which does not embed the signer certificates, leaving it up to the recipient to have known the valid certs ahead of time (e.g. using a per-user database of pre-registered certificates). You didn't get an exception because the correct certificates were found within the provided certificates collection.

You can see what was in the provided certificates collection via the X509Certificate2Collection.Import methods; they can read a PKCS#7 signed-data message and populate the collection with the optional embedded certificates.

来源：https://stackoverflow.com/questions/37930528/how-can-i-check-signature-of-a-signedcms-envelope

标签

digital-signature

x509certificate2

pkcs#7