(Tcl) Create P7M for ISO20022 Message (Customer Credit Transfer)

Demonstrates how to create a .p7m (signed data) for an ISO20022 XML message using an HSM such as that provided by Swift 3SKey or by banks. Also shows how to validate and extract the XML message.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# What is a .p7m file?

# Load the signing certificate from the connected HSM.
set cert [new_CkCert]

set success [CkCert_LoadFromSmartcard $cert ""]
if {$success == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkCert $cert
    exit
}

set crypt [new_CkCrypt2]

# Tell the crypt class to use the cert on the ePass2003 token.
set success [CkCrypt2_SetSigningCert $crypt $cert]
if {$success != 1} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCert $cert
    delete_CkCrypt2 $crypt
    exit
}

# The CadesEnabled property applies to all methods that create CMS/PKCS7 signatures. 
# To create a CAdES-BES signature, set this property equal to true. 
CkCrypt2_put_CadesEnabled $crypt 1

CkCrypt2_put_HashAlgorithm $crypt "sha256"

# The XML file to be signed and encapsulated in the signature looks like this:

# <Document xmlns="urn:iso:std:iso:20022:tech:xsd:pain.001.001.02">
#     <CstmrCdtTrfInitn>
#         <GrpHdr>
#             <MsgId>1234567890</MsgId>
#             <CreDtTm>2024-10-02T12:00:00</CreDtTm>
#             <NbOfTxs>1</NbOfTxs>
#             <CtrlSum>1000.00</CtrlSum>
#             <InitgPty>
#                 <Nm>Example Company</Nm>
#             </InitgPty>
#         </GrpHdr>
#         <PmtInf>
#             <!-- Payment information goes here -->
#         </PmtInf>
#     </CstmrCdtTrfInitn>
# </Document>

# What is "pain.001.001.02"?
# 
#     "pain.001": This is an ISO 20022 message type for Customer Credit Transfer
#     Initiation. It is used to instruct a bank or financial institution to transfer
#     funds from a customer's account to a beneficiary's account.
#     "pain.001.001.02": This specifies version "02" of the "pain.001" message.
#     The versioning indicates that there might be other versions like
#     "pain.001.001.01", and this version "02" includes revisions or updates compared
#     to version "01".
# 
# Usage:
# 
#     This namespace is typically seen in XML files that follow the ISO 20022
#     payment initiation standards. Financial institutions, payment service providers,
#     and other entities use it to exchange structured payment data in a standardized
#     XML format.
#     A typical use case for "pain.001.001.02" is to send payment instructions for
#     credit transfers, such as payments from businesses to suppliers or salary
#     payments from employers to employees.

# We can sign any type of file, creating a .p7m as output.
# The .p7m contains the signature and also embeds the data of the file that is signed.
set inFile "qa_data/xml/cust_credit_transfer.xml"
set p7mFile "c:/temp/qa_output/cust_credit_transfer.p7m"

# -----------------------------------------------------------------------------------------
# Also see Chilkat's online tool to examine a .p7m and generate code to duplicate the .p7m
# -----------------------------------------------------------------------------------------

# Create the CAdES-BES attached signature, which contains the original data.
set success [CkCrypt2_CreateP7M $crypt $inFile $p7mFile]
if {$success == 0} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCert $cert
    delete_CkCrypt2 $crypt
    exit
}

puts "Created the .p7m"

# --------------------------------------
# Now do the reverse and validate/extract
# --------------------------------------

set outFile "c:/temp/qa_output/out.xml"
set inFile "qa_data/p7m/cust_credit_transfer.p7m"

# Verify and extract the encapsulated file:
set success [CkCrypt2_VerifyP7M $crypt $inFile $outFile]
if {$success == 0} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCert $cert
    delete_CkCrypt2 $crypt
    exit
}

puts "Success!"

delete_CkCert $cert
delete_CkCrypt2 $crypt