(Tcl) Sign a Byte Array to Create an Opaque Signature in a Byte Array

Signs data contained in a byte array to produce an opaque signature (also in a byte array). An opaque signature is a PKCS7 signature (also known as CAdES) that embeds the signed data. Also shows how to verify the signature and extract the original data.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set cert [new_CkCert]

set success [CkCert_LoadPfxFile $cert "qa_data/pfx/cert_test123.pfx" "test123"]
if {$success == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkCert $cert
    exit
}

set fac [new_CkFileAccess]

set fileBytes [new_CkByteData]

set success [CkFileAccess_ReadEntireFile $fac "qa_data/pdf/sample.pdf" $fileBytes]
if {[CkFileAccess_get_LastMethodSuccess $fac] != 1} then {
    puts [CkFileAccess_lastErrorText $fac]
    delete_CkCert $cert
    delete_CkFileAccess $fac
    delete_CkByteData $fileBytes
    exit
}

set crypt [new_CkCrypt2]

set success [CkCrypt2_SetSigningCert $crypt $cert]

# We can sign any type of file.

set sigBytes [new_CkByteData]

set success [CkCrypt2_OpaqueSignBytes $crypt $fileBytes $sigBytes]
if {[CkCrypt2_get_LastMethodSuccess $crypt] != 1} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCert $cert
    delete_CkFileAccess $fac
    delete_CkByteData $fileBytes
    delete_CkCrypt2 $crypt
    delete_CkByteData $sigBytes
    exit
}

set success [CkFileAccess_WriteEntireFile $fac "qa_output/sample.pdf.p7m" $sigBytes]
if {[CkFileAccess_get_LastMethodSuccess $fac] != 1} then {
    puts [CkFileAccess_lastErrorText $fac]
    delete_CkCert $cert
    delete_CkFileAccess $fac
    delete_CkByteData $fileBytes
    delete_CkCrypt2 $crypt
    delete_CkByteData $sigBytes
    exit
}

# We can verify the opaque signature and extract the original data like this
set originalData [new_CkByteData]

set success [CkCrypt2_OpaqueVerifyBytes $crypt $sigBytes $originalData]
if {[CkCrypt2_get_LastMethodSuccess $crypt] != 1} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCert $cert
    delete_CkFileAccess $fac
    delete_CkByteData $fileBytes
    delete_CkCrypt2 $crypt
    delete_CkByteData $sigBytes
    delete_CkByteData $originalData
    exit
}

set success [CkFileAccess_WriteEntireFile $fac "qa_output/sample.pdf" $originalData]
if {[CkFileAccess_get_LastMethodSuccess $fac] != 1} then {
    puts [CkFileAccess_lastErrorText $fac]
    delete_CkCert $cert
    delete_CkFileAccess $fac
    delete_CkByteData $fileBytes
    delete_CkCrypt2 $crypt
    delete_CkByteData $sigBytes
    delete_CkByteData $originalData
    exit
}

puts "Signature is verified and the original data was extracted."

delete_CkCert $cert
delete_CkFileAccess $fac
delete_CkByteData $fileBytes
delete_CkCrypt2 $crypt
delete_CkByteData $sigBytes
delete_CkByteData $originalData