AutoIt

A3/A4 Certificate to Create and Verify an Opaque PKCS7/CMS Signature

See more Digital Signatures Examples

Demonstrates how to use an A3 or A4 certificate w/ private key on a smartcard or token to create a PKCS7 opaque signature, and also how to verify an opaque signature.

An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content.

AutoIt

Local $bSuccess = False

;  This example assumes the Chilkat API to have been previously unlocked.
;  See Global Unlock Sample for sample code.

$oCrypt = ObjCreate("Chilkat.Crypt2")

;  A certificate and private key is needed to create a signature.
;  Chilkat provides many different ways to load a certificate and private key, such
;  as from a smartcards and hardware tokens, PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
;  This example will load the default certificate from the smartcard that is currently in
;  the smartcard reader.

$oCert = ObjCreate("Chilkat.Cert")

;  If the smartcard or token requires a PIN, we can set it here to avoid the dialog...
$oCert.SmartCardPin = "000000"

$bSuccess = $oCert.LoadFromSmartcard("")
If ($bSuccess <> True) Then
    ConsoleWrite($oCert.LastErrorText & @CRLF)
    Exit
EndIf

;  Tell it to use the cert and private key we've loaded.
$bSuccess = $oCrypt.SetSigningCert($oCert)
If ($bSuccess <> True) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

;  Indicate we want the opaque signature in base64 format:
$oCrypt.EncodingMode = "base64"

;  Sign the string using the "utf-8" byte representation:
$oCrypt.Charset = "utf-8"

;  Create the opaque signature:
Local $sOriginalData = "This is the string to be signed."
Local $sOpaqueSig = $oCrypt.OpaqueSignStringENC($sOriginalData)
If ($oCrypt.LastMethodSuccess <> True) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite($sOpaqueSig & @CRLF)

;  The output looks like this:
;  MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

;  ----------------------------------------------------------------------------------------------
;  Now let's verify the signature and retrieve the original data.
;  We'll use a new Crypt2 object to keep things completely separate...

$oVCrypt = ObjCreate("Chilkat.Crypt2")

;  We only need the certificate to verify a signature (and extract the data from
;  an opaque signature).  The public key is always embedded within a certificate.
$bSuccess = $oVCrypt.SetVerifyCert($oCert)
If ($bSuccess <> True) Then
    ConsoleWrite($oVCrypt.LastErrorText & @CRLF)
    Exit
EndIf

$oVCrypt.EncodingMode = "base64"
$oVCrypt.Charset = "utf-8"

Local $sExtractedData = $oVCrypt.OpaqueVerifyStringENC($sOpaqueSig)
If ($oVCrypt.LastMethodSuccess <> True) Then
    ConsoleWrite($oVCrypt.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("The extracted data: " & $sExtractedData & @CRLF)

;  The output is:
;  The extracted data: This is the string to be signed.