AutoIt

Create and Verify an Opaque PKCS7/CMS Signature

See more Digital Signatures Examples

Demonstrates how to create a PKCS7 opaque signature, and also how to verify an opaque signature. An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content. AutoIt

Local $bSuccess = False

; This example assumes the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

$oCrypt = ObjCreate("Chilkat.Crypt2")

; A certificate and private key is needed to create a signature.
; Chilkat provides many different ways to load a certificate and private key, such
; as from a PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
; This example will load the certificate from a .crt and the private key from a .key file

$oCert = ObjCreate("Chilkat.Cert")
; The LoadFromFile method will automatically detect the format and load it.
$bSuccess = $oCert.LoadFromFile("qa_data/certs/test_12345678a.cer")
If ($bSuccess <> True) Then
    ConsoleWrite($oCert.LastErrorText & @CRLF)
    Exit
EndIf

; Our private key is in an encrypted PKCS8 format.
; If you don't know the format of your key, but you do know it's encrypted,
; and requires a password, then just call any of the Chilkat methods that load
; a private key w/ a password argument.  Chilkat will auto-detect the format
; and load it correctly even if it's not the format indicated by the method name..
$oPrivKey = ObjCreate("Chilkat.PrivateKey")
Local $sPassword = "12345678a"
$bSuccess = $oPrivKey.LoadPkcs8EncryptedFile("qa_data/certs/test_12345678a.key",$sPassword)
If ($bSuccess <> True) Then
    ConsoleWrite($oPrivKey.LastErrorText & @CRLF)
    Exit
EndIf

; Set properties required for signing.

; Tell it to use the cert and private key we've loaded.
$bSuccess = $oCrypt.SetSigningCert2($oCert,$oPrivKey)
If ($bSuccess <> True) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

; Indicate we want the opaque signature in base64 format:
$oCrypt.EncodingMode = "base64"

; Sign the string using the "utf-8" byte representation:
$oCrypt.Charset = "utf-8"

; Create the opaque signature:
Local $sOriginalData = "This is the string to be signed."
Local $sOpaqueSig = $oCrypt.OpaqueSignStringENC($sOriginalData)
If ($oCrypt.LastMethodSuccess <> True) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite($sOpaqueSig & @CRLF)

; The output looks like this:
; MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

; ----------------------------------------------------------------------------------------------
; Now let's verify the signature and retrieve the original data.
; We'll use a new Crypt2 object to keep things completely separate...

$oVCrypt = ObjCreate("Chilkat.Crypt2")

$oVCrypt.EncodingMode = "base64"
$oVCrypt.Charset = "utf-8"

Local $sExtractedData = $oVCrypt.OpaqueVerifyStringENC($sOpaqueSig)
If ($oVCrypt.LastMethodSuccess <> True) Then
    ConsoleWrite($oVCrypt.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("The extracted data: " & $sExtractedData & @CRLF)

; The output is:
; The extracted data: This is the string to be signed.