PureBasic

Create Egypt ITIDA CAdES-BES .p7s Signature (with strings in-memory)

See more Egypt ITIDA Examples

Demonstrates how to create a .p7s signature that fits Egypt's ITIDA requirements.

Note: This example requires Chilkat v9.5.0.75 or greater.

PureBasic

IncludeFile "CkCert.pb"
IncludeFile "CkJsonObject.pb"
IncludeFile "CkCrypt2.pb"

Procedure ChilkatExample()

    success.i = 0

    ; This example assumes the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    cert.i = CkCert::ckCreate()
    If cert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; There are many ways to load the certificate.  
    ; This example was created for a customer using an ePass2003 USB token.
    ; Assuming the USB token is the only source of a hardware-based private key..
    success = CkCert::ckLoadFromSmartcard(cert,"")
    If success <> 1
        Debug CkCert::ckLastErrorText(cert)
        CkCrypt2::ckDispose(crypt)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    ; Tell the crypt component to use this cert.
    success = CkCrypt2::ckSetSigningCert(crypt,cert)
    If success <> 1
        Debug CkCrypt2::ckLastErrorText(crypt)
        CkCrypt2::ckDispose(crypt)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    cmsOptions.i = CkJsonObject::ckCreate()
    If cmsOptions.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Setting "DigestData" causes OID 1.2.840.113549.1.7.5 (digestData) to be used.
    CkJsonObject::ckUpdateBool(cmsOptions,"DigestData",1)
    CkJsonObject::ckUpdateBool(cmsOptions,"OmitAlgorithmIdNull",1)
    CkCrypt2::setCkCmsOptions(crypt, CkJsonObject::ckEmit(cmsOptions))

    ; The CadesEnabled property applies to all methods that create CMS/PKCS7 signatures. 
    ; To create a CAdES-BES signature, set this property equal to true. 
    CkCrypt2::setCkCadesEnabled(crypt, 1)

    CkCrypt2::setCkHashAlgorithm(crypt, "sha256")

    jsonSigningAttrs.i = CkJsonObject::ckCreate()
    If jsonSigningAttrs.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckUpdateInt(jsonSigningAttrs,"contentType",1)
    CkJsonObject::ckUpdateInt(jsonSigningAttrs,"signingTime",1)
    CkJsonObject::ckUpdateInt(jsonSigningAttrs,"messageDigest",1)
    CkJsonObject::ckUpdateInt(jsonSigningAttrs,"signingCertificateV2",1)
    CkCrypt2::setCkSigningAttributes(crypt, CkJsonObject::ckEmit(jsonSigningAttrs))

    ; By default, all the certs in the chain of authentication are included in the signature.
    ; If desired, we can choose to only include the signing certificate:
    CkCrypt2::setCkIncludeCertChain(crypt, 0)

    ; Make sure we sign the utf-8 byte representation of the JSON string
    CkCrypt2::setCkCharset(crypt, "utf-8")

    ; Create the CAdES-BES signature.
    textToSign.s = Chr(34) + "issuer" + Chr(34) + Chr(34) + "address" + Chr(34) + Chr(34) + "branchID" + Chr(34) + Chr(34) + "0" + Chr(34) + Chr(34) + "country" + Chr(34) + Chr(34) + "EG" + Chr(34) + Chr(34) + "regionCity..."

    CkCrypt2::setCkEncodingMode(crypt, "base64")
    sigBase64.s = CkCrypt2::ckSignStringENC(crypt,textToSign)
    If CkCrypt2::ckLastMethodSuccess(crypt) = 0
        Debug CkCrypt2::ckLastErrorText(crypt)
        CkCrypt2::ckDispose(crypt)
        CkCert::ckDispose(cert)
        CkJsonObject::ckDispose(cmsOptions)
        CkJsonObject::ckDispose(jsonSigningAttrs)
        ProcedureReturn
    EndIf

    Debug "Base64 signature:"
    Debug sigBase64


    CkCrypt2::ckDispose(crypt)
    CkCert::ckDispose(cert)
    CkJsonObject::ckDispose(cmsOptions)
    CkJsonObject::ckDispose(jsonSigningAttrs)


    ProcedureReturn
EndProcedure