Xbase++ Requires Chilkat v11.0.0+
Xbase++
Validate CAdES-T Signature (.p7m)
See more CAdES Examples
Validates a CAdES-T CMS signature and extracts the time-stamp token and gets information about it. Also validates the time-stamp token.Chilkat Xbase++ Downloads
LOCAL nSuccess
LOCAL oCrypt
LOCAL oCmsOptions
LOCAL oJson
LOCAL i
LOCAL nCount_i
LOCAL cStrVal
LOCAL cCertSerialNumber
LOCAL cCertIssuerCN
LOCAL cCertIssuerDN
LOCAL cCertDigestAlgOid
LOCAL cCertDigestAlgName
LOCAL cContentType
LOCAL oSigningTime
LOCAL cMessageDigest
LOCAL cSigningAlgOid
LOCAL cSigningAlgName
LOCAL cAuthAttrContentTypeName
LOCAL cAuthAttrContentTypeOid
LOCAL cAuthAttrSigningTimeName
LOCAL oAuthAttrSigningTimeUtctime
LOCAL cAuthAttrMessageDigestName
LOCAL cAuthAttrMessageDigestDigest
LOCAL cAuthAttrSigningCertificateV2Name
LOCAL cAuthAttrSigningCertificateV2Der
LOCAL cUnauthAttrTimestampTokenName
LOCAL cUnauthAttrTimestampTokenDer
LOCAL nUnauthAttrTimestampTokenTimestampSignatureVerified
LOCAL cUnauthAttrTimestampTokenTstInfoTsaPolicyId
LOCAL cUnauthAttrTimestampTokenTstInfoMessageImprintHashAlg
LOCAL cUnauthAttrTimestampTokenTstInfoMessageImprintDigest
LOCAL nUnauthAttrTimestampTokenTstInfoMessageImprintDigestMatches
LOCAL cUnauthAttrTimestampTokenTstInfoSerialNumber
LOCAL oUnauthAttrTimestampTokenTstInfoGenTime
LOCAL j
LOCAL nCount_j
nSuccess := 0
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
oCrypt := CreateObject("Chilkat.Crypt2")
// Indicate that the CAdES-T timestamp tokens must also pass validation for the signature to be validated.
oCmsOptions := CreateObject("Chilkat.JsonObject")
oCmsOptions:UpdateBool("ValidateTimestampTokens", 1)
oCrypt:CmsOptions := oCmsOptions:Emit()
// Validate the .p7m and extract the original signed data to an output file.
// Note: The timestampToken is an unauthenticated attribute. See the code below that retrieves and parses the last JSON data.
// for details about examining timestampToken.
nSuccess := oCrypt:VerifyP7M("qa_data/cades/CAdES-T/Signature-C-T-1.p7m", "qa_output/out.dat")
// Get information about the CMS signature in the last JSON data.
// The detailed results of the signature validation are available in the last JSON data.
// (If the non-success return status was caused by an error such as "file not found", then the
// last JSON data would be empty.)
oJson := CreateObject("Chilkat.JsonObject")
oCrypt:GetLastJsonData(oJson)
oJson:EmitCompact := 0
? oJson:Emit()
// Here is a sample result:
// See the parsing code below..
// Use this online tool to generate parsing code from sample JSON:
// Generate Parsing Code from JSON
// {
// "pkcs7": {
// "verify": {
// "digestAlgorithms": [
// "sha256"
// ],
// "signerInfo": [
// {
// "cert": {
// "serialNumber": "00DCB814678CDB",
// "issuerCN": "LevelBCAOK",
// "issuerDN": "",
// "digestAlgOid": "2.16.840.1.101.3.4.2.1",
// "digestAlgName": "SHA256"
// },
// "contentType": "1.2.840.113549.1.7.1",
// "signingTime": "131203065741Z",
// "messageDigest": "JJZt41Nt8VsYahP+Xti4rR3vBDkUfRd6gquItl6R5Os=",
// "signingAlgOid": "1.2.840.113549.1.1.1",
// "signingAlgName": "RSA-PKCSV-1_5",
// "authAttr": {
// "1.2.840.113549.1.9.3": {
// "name": "contentType",
// "oid": "1.2.840.113549.1.7.1"
// },
// "1.2.840.113549.1.9.5": {
// "name": "signingTime",
// "utctime": "131203065741Z"
// },
// "1.2.840.113549.1.9.4": {
// "name": "messageDigest",
// "digest": "JJZt41Nt8VsYahP+Xti4rR3vBDkUfRd6gquItl6R5Os="
// },
// "1.2.840.113549.1.9.16.2.47": {
// "name": "signingCertificateV2",
// "der": "MIGIMIGFMIGCBCBJrxOU0w0dWGsVovjLv9QDH3syB5mLVv3grSYA40x9IDBeMFOkUTBPMQswCQYDVQQGEwJGUjENMAsGA1UEChMERVRTSTEcMBoGA1UECwwTUGx1Z3Rlc3RzXzIwMTMtMjAxNDETMBEGA1UEAxMKTGV2ZWxCQ0FPSwIHANy4FGeM2w=="
// }
// },
// "unauthAttr": {
// "1.2.840.113549.1.9.16.2.14": {
// "name": "timestampToken",
// "der": "MIIL+AYJKoZI...u7CfcjURNTY=",
// "verify": {
// "digestAlgorithms": [
// "sha256"
// ],
// "signerInfo": [
// {
// "cert": {
// "serialNumber": "01AA4592D36C61",
// "issuerCN": "RootCAOK",
// "issuerDN": "",
// "digestAlgOid": "2.16.840.1.101.3.4.2.1",
// "digestAlgName": "SHA256"
// },
// "contentType": "1.2.840.113549.1.9.16.1.4",
// "messageDigest": "NSsMUrfoyCQ0OszPE1YLx1j3EyyCiBmnE5Sua6ghu/Q=",
// "signingAlgOid": "1.2.840.113549.1.1.1",
// "signingAlgName": "RSA-PKCSV-1_5",
// "authAttr": {
// "1.2.840.113549.1.9.3": {
// "name": "contentType",
// "oid": "1.2.840.113549.1.9.16.1.4"
// },
// "1.2.840.113549.1.9.4": {
// "name": "messageDigest",
// "digest": "NSsMUrfoyCQ0OszPE1YLx1j3EyyCiBmnE5Sua6ghu/Q="
// },
// "1.2.840.113549.1.9.16.2.47": {
// "name": "signingCertificateV2",
// "der": "MIGGMIGDMIGABCDB/np5UxvhcPnSxD2Kme+C88uXGCMWLAvFPHNvTApTWDBcMFGkTzBNMQswCQYDVQQGEwJGUjENMAsGA1UEChMERVRTSTEcMBoGA1UECwwTUGx1Z3Rlc3RzXzIwMTMtMjAxNDERMA8GA1UEAxMIUm9vdENBT0sCBwGqRZLTbGE="
// }
// }
// }
// ]
// },
// "timestampSignatureVerified": true,
// "tstInfo": {
// "tsaPolicyId": "1.3.6.1.4.1.2706.2.2.5.2.1.1.1",
// "messageImprint": {
// "hashAlg": "sha256",
// "digest": "C8xEe9NA4X1cUyHGX9zG89ipmQ2byFs3aa+Xe4Fz2P0=",
// "digestMatches": true
// },
// "serialNumber": "313E162121D922",
// "genTime": "20131203065742Z"
// }
// }
// }
// }
// ]
// }
// }
// }
//
oSigningTime := CreateObject("Chilkat.DtObj")
oAuthAttrSigningTimeUtctime := CreateObject("Chilkat.DtObj")
oUnauthAttrTimestampTokenTstInfoGenTime := CreateObject("Chilkat.DtObj")
// Iterate over the hash algorithms used in the signature.
i := 0
nCount_i := oJson:SizeOfArray("pkcs7.verify.digestAlgorithms")
DO WHILE i < nCount_i
oJson:I := i
cStrVal := oJson:StringOf("pkcs7.verify.digestAlgorithms[i]")
i := i + 1
ENDDO
// For each signer...
i := 0
nCount_i := oJson:SizeOfArray("pkcs7.verify.signerInfo")
DO WHILE i < nCount_i
oJson:I := i
// Get information about the certificate used by this signer.
cCertSerialNumber := oJson:StringOf("pkcs7.verify.signerInfo[i].cert.serialNumber")
cCertIssuerCN := oJson:StringOf("pkcs7.verify.signerInfo[i].cert.issuerCN")
cCertIssuerDN := oJson:StringOf("pkcs7.verify.signerInfo[i].cert.issuerDN")
cCertDigestAlgOid := oJson:StringOf("pkcs7.verify.signerInfo[i].cert.digestAlgOid")
cCertDigestAlgName := oJson:StringOf("pkcs7.verify.signerInfo[i].cert.digestAlgName")
// Get additional information for this signer, such as the signingTime, signature algorithm, etc.
cContentType := oJson:StringOf("pkcs7.verify.signerInfo[i].contentType")
oJson:DtOf("pkcs7.verify.signerInfo[i].signingTime", 0, oSigningTime)
cMessageDigest := oJson:StringOf("pkcs7.verify.signerInfo[i].messageDigest")
cSigningAlgOid := oJson:StringOf("pkcs7.verify.signerInfo[i].signingAlgOid")
cSigningAlgName := oJson:StringOf("pkcs7.verify.signerInfo[i].signingAlgName")
// --------------------------------
// Examine authenticated attributes.
// --------------------------------
// contentType
IF (oJson:HasMember('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.3"') == 1)
cAuthAttrContentTypeName := oJson:StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.3".name')
cAuthAttrContentTypeOid := oJson:StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.3".oid')
ENDIF
// signingTime
IF (oJson:HasMember('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.5"') == 1)
cAuthAttrSigningTimeName := oJson:StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.5".name')
oJson:DtOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.5".utctime', 0, oAuthAttrSigningTimeUtctime)
ENDIF
// messageDigest
IF (oJson:HasMember('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.4"') == 1)
cAuthAttrMessageDigestName := oJson:StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.4".name')
cAuthAttrMessageDigestDigest := oJson:StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.4".digest')
ENDIF
// signingCertificateV2
IF (oJson:HasMember('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.16.2.47"') == 1)
cAuthAttrSigningCertificateV2Name := oJson:StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.16.2.47".name')
cAuthAttrSigningCertificateV2Der := oJson:StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.16.2.47".der')
ENDIF
// --------------------------------
// Examine unauthenticated attributes.
// --------------------------------
// timestampToken (the timestampToken is what makes this signature a CAdES-T)
IF (oJson:HasMember('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14"') == 1)
cUnauthAttrTimestampTokenName := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".name')
cUnauthAttrTimestampTokenDer := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".der')
// This is where we find out if the timestampToken's signature is valid.
nUnauthAttrTimestampTokenTimestampSignatureVerified := oJson:BoolOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".timestampSignatureVerified')
cUnauthAttrTimestampTokenTstInfoTsaPolicyId := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".tstInfo.tsaPolicyId')
cUnauthAttrTimestampTokenTstInfoMessageImprintHashAlg := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".tstInfo.messageImprint.hashAlg')
cUnauthAttrTimestampTokenTstInfoMessageImprintDigest := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".tstInfo.messageImprint.digest')
// Here is where we check to see if the digest in the timestampToken's messageImprint matches the digest of the signature of this signerInfo
nUnauthAttrTimestampTokenTstInfoMessageImprintDigestMatches := oJson:BoolOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".tstInfo.messageImprint.digestMatches')
cUnauthAttrTimestampTokenTstInfoSerialNumber := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".tstInfo.serialNumber')
// Here is where we get the date/time of the timestampToken (i.e. when it was timestamped)
oJson:DtOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".tstInfo.genTime', 0, oUnauthAttrTimestampTokenTstInfoGenTime)
// The following code gets details about the validity of the timestampToken's signature...
j := 0
nCount_j := oJson:SizeOfArray('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.digestAlgorithms')
DO WHILE j < nCount_j
oJson:J := j
cStrVal := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.digestAlgorithms[j]')
j := j + 1
ENDDO
j := 0
nCount_j := oJson:SizeOfArray('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo')
DO WHILE j < nCount_j
oJson:J := j
cCertSerialNumber := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].cert.serialNumber')
cCertIssuerCN := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].cert.issuerCN')
cCertIssuerDN := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].cert.issuerDN')
cCertDigestAlgOid := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].cert.digestAlgOid')
cCertDigestAlgName := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].cert.digestAlgName')
cContentType := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].contentType')
cMessageDigest := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].messageDigest')
cSigningAlgOid := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].signingAlgOid')
cSigningAlgName := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].signingAlgName')
cAuthAttrContentTypeName := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].authAttr."1.2.840.113549.1.9.3".name')
cAuthAttrContentTypeOid := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].authAttr."1.2.840.113549.1.9.3".oid')
cAuthAttrMessageDigestName := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].authAttr."1.2.840.113549.1.9.4".name')
cAuthAttrMessageDigestDigest := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].authAttr."1.2.840.113549.1.9.4".digest')
cAuthAttrSigningCertificateV2Name := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].authAttr."1.2.840.113549.1.9.16.2.47".name')
cAuthAttrSigningCertificateV2Der := oJson:StringOf('pkcs7.verify.signerInfo[i].unauthAttr."1.2.840.113549.1.9.16.2.14".verify.signerInfo[j].authAttr."1.2.840.113549.1.9.16.2.47".der')
j := j + 1
ENDDO
ENDIF
i := i + 1
ENDDO
IF (nSuccess != 1)
? oCrypt:LastErrorText
? "CAdES-T verification failed."
ELSE
? "CAdES-T signature is valid."
ENDIF
oCrypt:destroy()
oCmsOptions:destroy()
oJson:destroy()
oSigningTime:destroy()
oAuthAttrSigningTimeUtctime:destroy()
oUnauthAttrTimestampTokenTstInfoGenTime:destroy()