(Tcl) Extract PKCS7 Signature Digest

Demonstrates how to extract a signature digest from a PKCS7 signature.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat Crypt API to have been previously unlocked.
# See Unlock Chilkat Crypt for sample code.

set crypt [new_CkCrypt2]

set p7mFile "qa_data/p7m/test.pdf.p7m"
set outPath "qa_output/test.pdf"

# First let's see if this .p7m signature can be verified, and the original file extracted.
set verified [CkCrypt2_VerifyP7M $crypt $p7mFile $outPath]
if {$verified != 1} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCrypt2 $crypt
    exit
}

# How many signers?
# (The NumSignerCerts property is set whenever a signature is verified.)
puts "Num Signers: [CkCrypt2_get_NumSignerCerts $crypt]"

# Load the .p7m into memory...
set pkcs7Data [new_CkBinData]

CkBinData_LoadFile $pkcs7Data $p7mFile

# Check to see if this .p7m contains the binary bytes, or if it's
# already base64 encoded.  Get the 1st two bytes.  If the first two 
# bytes are the us-ascii values "MI", then we have base64.
set sbBase64 [new_CkStringBuilder]

set hexStr [CkBinData_getEncodedChunk $pkcs7Data 0 2 "hex"]
CkStringBuilder_Append $sbBase64 $hexStr

set bHaveBase64 0
if {[CkStringBuilder_ContentsEqual $sbBase64 "4D49" 1] == 1} then {
    set bHaveBase64 1
    CkStringBuilder_Clear $sbBase64
    CkStringBuilder_AppendBd $sbBase64 $pkcs7Data "utf-8" 0 0
}

# Get each signer's signature digest.
CkCrypt2_put_EncodingMode $crypt "base64"
set i 0

while {$i < [CkCrypt2_get_NumSignerCerts $crypt]} {
    if {$bHaveBase64} then {
        set digest [CkCrypt2_pkcs7ExtractDigest $crypt $i [CkStringBuilder_getAsString $sbBase64]]
    }     else {
        set digest [CkCrypt2_pkcs7ExtractDigest $crypt $i [CkBinData_getEncoded $pkcs7Data "base64"]]
    }

    if {[CkCrypt2_get_LastMethodSuccess $crypt] != 1} then {
        puts [CkCrypt2_lastErrorText $crypt]
        delete_CkCrypt2 $crypt
        delete_CkBinData $pkcs7Data
        delete_CkStringBuilder $sbBase64
        exit
    }

    puts "Signer [expr $i + 1] digest = $digest"
    set i [expr $i + 1]
}

delete_CkCrypt2 $crypt
delete_CkBinData $pkcs7Data
delete_CkStringBuilder $sbBase64