Lua

Create and Verify an Opaque PKCS7/CMS Signature

See more Digital Signatures Examples

Demonstrates how to create a PKCS7 opaque signature, and also how to verify an opaque signature. An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content. Lua

local chilkat = require("chilkat")

-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local crypt = chilkat.Crypt2.new()

-- A certificate and private key is needed to create a signature.
-- Chilkat provides many different ways to load a certificate and private key, such
-- as from a PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
-- This example will load the certificate from a .crt and the private key from a .key file

local cert = chilkat.Cert.new()
-- The LoadFromFile method will automatically detect the format and load it.
local success = cert:load_from_file("qa_data/certs/test_12345678a.cer")
if not success then
    print(cert.last_error_text)
    return
end

-- Our private key is in an encrypted PKCS8 format.
-- If you don't know the format of your key, but you do know it's encrypted,
-- and requires a password, then just call any of the Chilkat methods that load
-- a private key w/ a password argument.  Chilkat will auto-detect the format
-- and load it correctly even if it's not the format indicated by the method name..
local privKey = chilkat.PrivateKey.new()
local password = "12345678a"
success = privKey:load_pkcs8_encrypted_file("qa_data/certs/test_12345678a.key", password)
if not success then
    print(privKey.last_error_text)
    return
end

-- Set properties required for signing.

-- Tell it to use the cert and private key we've loaded.
success = crypt:set_signing_cert2(cert, privKey)
if not success then
    print(crypt.last_error_text)
    return
end

-- Indicate we want the opaque signature in base64 format:
crypt.encoding_mode = "base64"

-- Sign the string using the "utf-8" byte representation:
crypt.charset = "utf-8"

-- Create the opaque signature:
local originalData = "This is the string to be signed."
local opaqueSig = crypt:opaque_sign_string_enc(originalData)
if not crypt.last_method_success then
    print(crypt.last_error_text)
    return
end

print(opaqueSig)

-- The output looks like this:
-- MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

-- ----------------------------------------------------------------------------------------------
-- Now let's verify the signature and retrieve the original data.
-- We'll use a new Crypt2 object to keep things completely separate...

local vCrypt = chilkat.Crypt2.new()

vCrypt.encoding_mode = "base64"
vCrypt.charset = "utf-8"

local extractedData = vCrypt:opaque_verify_string_enc(opaqueSig)
if not vCrypt.last_method_success then
    print(vCrypt.last_error_text)
    return
end

print("The extracted data: " .. extractedData)

-- The output is:
-- The extracted data: This is the string to be signed.