(SQL Server) Create and Verify an Opaque PKCS7/CMS Signature

Demonstrates how to create a PKCS7 opaque signature, and also how to verify an opaque signature. An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example assumes the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @crypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- A certificate and private key is needed to create a signature.
    -- Chilkat provides many different ways to load a certificate and private key, such
    -- as from a PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
    -- This example will load the certificate from a .crt and the private key from a .key file

    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    -- The LoadFromFile method will automatically detect the format and load it.
    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadFromFile', @success OUT, 'qa_data/certs/test_12345678a.cer'
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Our private key is in an encrypted PKCS8 format.
    -- If you don't know the format of your key, but you do know it's encrypted,
    -- and requires a password, then just call any of the Chilkat methods that load
    -- a private key w/ a password argument.  Chilkat will auto-detect the format
    -- and load it correctly even if it's not the format indicated by the method name..
    DECLARE @privKey int
    -- Use "Chilkat_9_5_0.PrivateKey" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.PrivateKey', @privKey OUT

    DECLARE @password nvarchar(4000)
    SELECT @password = '12345678a'
    EXEC sp_OAMethod @privKey, 'LoadPkcs8EncryptedFile', @success OUT, 'qa_data/certs/test_12345678a.key', @password
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @privKey, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @privKey
        RETURN
      END

    -- Set properties required for signing.

    -- Tell it to use the cert and private key we've loaded.
    EXEC sp_OAMethod @crypt, 'SetSigningCert2', @success OUT, @cert, @privKey
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @privKey
        RETURN
      END

    -- Indicate we want the opaque signature in base64 format:
    EXEC sp_OASetProperty @crypt, 'EncodingMode', 'base64'

    -- Sign the string using the "utf-8" byte representation:
    EXEC sp_OASetProperty @crypt, 'Charset', 'utf-8'

    -- Create the opaque signature:
    DECLARE @originalData nvarchar(4000)
    SELECT @originalData = 'This is the string to be signed.'
    DECLARE @opaqueSig nvarchar(4000)
    EXEC sp_OAMethod @crypt, 'OpaqueSignStringENC', @opaqueSig OUT, @originalData
    EXEC sp_OAGetProperty @crypt, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @privKey
        RETURN
      END


    PRINT @opaqueSig

    -- The output looks like this:
    -- MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

    -- ----------------------------------------------------------------------------------------------
    -- Now let's verify the signature and retrieve the original data.
    -- We'll use a new Crypt2 object to keep things completely separate...

    DECLARE @vCrypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @vCrypt OUT

    EXEC sp_OASetProperty @vCrypt, 'EncodingMode', 'base64'
    EXEC sp_OASetProperty @vCrypt, 'Charset', 'utf-8'

    DECLARE @extractedData nvarchar(4000)
    EXEC sp_OAMethod @vCrypt, 'OpaqueVerifyStringENC', @extractedData OUT, @opaqueSig
    EXEC sp_OAGetProperty @vCrypt, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @vCrypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @privKey
        EXEC @hr = sp_OADestroy @vCrypt
        RETURN
      END


    PRINT 'The extracted data: ' + @extractedData

    -- The output is:
    -- The extracted data: This is the string to be signed.

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @privKey
    EXEC @hr = sp_OADestroy @vCrypt


END
GO