Oh dear. I guess I'd better pass the news up the line to those who write requirements!
Thanks very much for your help Rob > Date: Wed, 28 Jul 2010 18:49:51 +0200 > From: [email protected] > To: [email protected] > Subject: Re: Signing using PSS padding programmatically > > On Wed, Jul 28, 2010, Bob Smith wrote: > > > > > Hello, > > > > I'm working on some code that uses the PKCS7 routines to sign some data. > > The code so far is (lots of return values cut out for brevity)... > > > > int flags = 0x00 | PKCS7_NOSMIMECAP | PKCS7_BINARY; > > p7 = PKCS7_sign( cert, pkey, NULL, datain, flags ); > > PKCS7_final( p7, datain, flags ); > > dataout = BIO_new_file( ..., "wb" ); > > i2d_PKCS7_bio_stream( dataout, p7, datain, flags ); > > > > This works fine for PKCS1 padding. But I'd need to use PSS padding. Having > > spent a great deal of time trying to work out how to do this from the > > source code, can someone help me with some suggestions on what I need to do? > > > > I've found these functions - EVP_PKEY_CTX_set_rsa_padding() and > > EVP-PKEY_CTX_set_rsa_saltlen(), however I'm struggling to determine how to > > use that function with the PKCS7 functions. > > > > I'm afraid your are currently out of luck. The PKCS#7 standard doesn't support > PSS: the CMS standard does but OpenSSL doesn't currently include support in > its CMS code. There is support for PSS signatures in certificates though in > HEAD which will be backported to 1.0.1 at some point. > > Steve. > -- > Dr Stephen N. Henson. OpenSSL project core developer. > Commercial tech support now available see: http://www.openssl.org > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [email protected] > Automated List Manager [email protected]
