(SQL Server) A3/A4 Certificate to Create and Verify an Opaque PKCS7/CMS Signature

Demonstrates how to use an A3 or A4 certificate w/ private key on a smartcard or token to create a PKCS7 opaque signature, and also how to verify an opaque signature.

An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example assumes the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @crypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- A certificate and private key is needed to create a signature.
    -- Chilkat provides many different ways to load a certificate and private key, such
    -- as from a smartcards and hardware tokens, PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
    -- This example will load the default certificate from the smartcard that is currently in
    -- the smartcard reader.

    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    -- If the smartcard or token requires a PIN, we can set it here to avoid the dialog...
    EXEC sp_OASetProperty @cert, 'SmartCardPin', '000000'

    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadFromSmartcard', @success OUT, ''
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Tell it to use the cert and private key we've loaded.
    EXEC sp_OAMethod @crypt, 'SetSigningCert', @success OUT, @cert
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Indicate we want the opaque signature in base64 format:
    EXEC sp_OASetProperty @crypt, 'EncodingMode', 'base64'

    -- Sign the string using the "utf-8" byte representation:
    EXEC sp_OASetProperty @crypt, 'Charset', 'utf-8'

    -- Create the opaque signature:
    DECLARE @originalData nvarchar(4000)
    SELECT @originalData = 'This is the string to be signed.'
    DECLARE @opaqueSig nvarchar(4000)
    EXEC sp_OAMethod @crypt, 'OpaqueSignStringENC', @opaqueSig OUT, @originalData
    EXEC sp_OAGetProperty @crypt, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END


    PRINT @opaqueSig

    -- The output looks like this:
    -- MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

    -- ----------------------------------------------------------------------------------------------
    -- Now let's verify the signature and retrieve the original data.
    -- We'll use a new Crypt2 object to keep things completely separate...

    DECLARE @vCrypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @vCrypt OUT

    -- We only need the certificate to verify a signature (and extract the data from
    -- an opaque signature).  The public key is always embedded within a certificate.
    EXEC sp_OAMethod @vCrypt, 'SetVerifyCert', @success OUT, @cert
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @vCrypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @vCrypt
        RETURN
      END

    EXEC sp_OASetProperty @vCrypt, 'EncodingMode', 'base64'
    EXEC sp_OASetProperty @vCrypt, 'Charset', 'utf-8'

    DECLARE @extractedData nvarchar(4000)
    EXEC sp_OAMethod @vCrypt, 'OpaqueVerifyStringENC', @extractedData OUT, @opaqueSig
    EXEC sp_OAGetProperty @vCrypt, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @vCrypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @vCrypt
        RETURN
      END


    PRINT 'The extracted data: ' + @extractedData

    -- The output is:
    -- The extracted data: This is the string to be signed.

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @vCrypt


END
GO