Rust

Create and Verify an Opaque PKCS7/CMS Signature

See more Digital Signatures Examples

Demonstrates how to create a PKCS7 opaque signature, and also how to verify an opaque signature. An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content. Rust

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

let crypt = chilkat::Crypt2::new();

// A certificate and private key is needed to create a signature.
// Chilkat provides many different ways to load a certificate and private key, such
// as from a PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
// This example will load the certificate from a .crt and the private key from a .key file

let cert = chilkat::Cert::new();
// The LoadFromFile method will automatically detect the format and load it.
if cert.load_from_file("qa_data/certs/test_12345678a.cer").is_err() {
    println!("{}", cert.last_error_text());
    return;
}

// Our private key is in an encrypted PKCS8 format.
// If you don't know the format of your key, but you do know it's encrypted,
// and requires a password, then just call any of the Chilkat methods that load
// a private key w/ a password argument.  Chilkat will auto-detect the format
// and load it correctly even if it's not the format indicated by the method name..
let priv_key = chilkat::PrivateKey::new();
let password = "12345678a".to_string();
if priv_key.load_pkcs8_encrypted_file("qa_data/certs/test_12345678a.key", &password).is_err() {
    println!("{}", priv_key.last_error_text());
    return;
}

// Set properties required for signing.

// Tell it to use the cert and private key we've loaded.
if crypt.set_signing_cert2(&cert, &priv_key).is_err() {
    println!("{}", crypt.last_error_text());
    return;
}

// Indicate we want the opaque signature in base64 format:
crypt.set_encoding_mode("base64");

// Sign the string using the "utf-8" byte representation:
crypt.set_charset("utf-8");

// Create the opaque signature:
let original_data = "This is the string to be signed.".to_string();
let Ok(opaque_sig) = crypt.opaque_sign_string_enc(&original_data) else {
    println!("{}", crypt.last_error_text());
    return;
};

println!("{}", opaque_sig);

// The output looks like this:
// MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

// ----------------------------------------------------------------------------------------------
// Now let's verify the signature and retrieve the original data.
// We'll use a new Crypt2 object to keep things completely separate...

let v_crypt = chilkat::Crypt2::new();

v_crypt.set_encoding_mode("base64");
v_crypt.set_charset("utf-8");

let Ok(extracted_data) = v_crypt.opaque_verify_string_enc(&opaque_sig) else {
    println!("{}", v_crypt.last_error_text());
    return;
};

println!("The extracted data: {}", extracted_data);

// The output is:
// The extracted data: This is the string to be signed.