Objective-C

A3/A4 Certificate to Create and Verify an Opaque PKCS7/CMS Signature

See more Digital Signatures Examples

Demonstrates how to use an A3 or A4 certificate w/ private key on a smartcard or token to create a PKCS7 opaque signature, and also how to verify an opaque signature.

An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content.

Objective-C

#import <CkoCrypt2.h>
#import <CkoCert.h>
#import <NSString.h>

BOOL success = NO;

//  This example assumes the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

CkoCrypt2 *crypt = [[CkoCrypt2 alloc] init];

//  A certificate and private key is needed to create a signature.
//  Chilkat provides many different ways to load a certificate and private key, such
//  as from a smartcards and hardware tokens, PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
//  This example will load the default certificate from the smartcard that is currently in
//  the smartcard reader.

CkoCert *cert = [[CkoCert alloc] init];

//  If the smartcard or token requires a PIN, we can set it here to avoid the dialog...
cert.SmartCardPin = @"000000";

success = [cert LoadFromSmartcard: @""];
if (success != YES) {
    NSLog(@"%@",cert.LastErrorText);
    return;
}

//  Tell it to use the cert and private key we've loaded.
success = [crypt SetSigningCert: cert];
if (success != YES) {
    NSLog(@"%@",crypt.LastErrorText);
    return;
}

//  Indicate we want the opaque signature in base64 format:
crypt.EncodingMode = @"base64";

//  Sign the string using the "utf-8" byte representation:
crypt.Charset = @"utf-8";

//  Create the opaque signature:
NSString *originalData = @"This is the string to be signed.";
NSString *opaqueSig = [crypt OpaqueSignStringENC: originalData];
if (crypt.LastMethodSuccess != YES) {
    NSLog(@"%@",crypt.LastErrorText);
    return;
}

NSLog(@"%@",opaqueSig);

//  The output looks like this:
//  MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

//  ----------------------------------------------------------------------------------------------
//  Now let's verify the signature and retrieve the original data.
//  We'll use a new Crypt2 object to keep things completely separate...

CkoCrypt2 *vCrypt = [[CkoCrypt2 alloc] init];

//  We only need the certificate to verify a signature (and extract the data from
//  an opaque signature).  The public key is always embedded within a certificate.
success = [vCrypt SetVerifyCert: cert];
if (success != YES) {
    NSLog(@"%@",vCrypt.LastErrorText);
    return;
}

vCrypt.EncodingMode = @"base64";
vCrypt.Charset = @"utf-8";

NSString *extractedData = [vCrypt OpaqueVerifyStringENC: opaqueSig];
if (vCrypt.LastMethodSuccess != YES) {
    NSLog(@"%@",vCrypt.LastErrorText);
    return;
}

NSLog(@"%@%@",@"The extracted data: ",extractedData);

//  The output is:
//  The extracted data: This is the string to be signed.