Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[remote-signing]: allow p7 DigestInfo extraction and signature insertion into p7 structure #1038

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

[remote-signing]: allow p7 DigestInfo extraction and signature insertion into p7 structure #1038

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1b22dc8
add early experimental changes which allow adding signer without spec…
rohhamh May 30, 2023
effaa0b
Update README.md
rohhamh Jun 16, 2023
edc11c4
return this for object chaining
rohhamh Jun 26, 2023
6b2fd15
Add getDigestToBeSigned for csr
rohhamh Oct 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
35 changes: 34 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
[![Build Status](https://github.com/digitalbazaar/forge/workflows/Main%20Checks/badge.svg)](https://github.com/digitalbazaar/forge/actions?query=workflow%3A%22Main+Checks%22)

A native implementation of [TLS][] (and various other cryptographic tools) in
[JavaScript][].
[JavaScript][], with the addition of cms remote-signing capability (client-side signature, server-side cms generation).

Introduction
------------
Expand Down Expand Up @@ -1367,6 +1367,39 @@ var pem = forge.pkcs7.messageToPem(p7);
// Includes the signature and certificate without the signed data.
p7.sign({detached: true});

// create PKCS#7 signed data structure with authenticatedAttributes
// attributes include: PKCS#9 content-type, message-digest, and signing-time
var p7 = forge.pkcs7.createSignedData();
p7.content = forge.util.createBuffer('Some content to be signed.', 'utf8');
p7.addCertificate(certOrCertPem);
p7.addSignerTemplate({
certificate: certOrCertPem,
digestAlgorithm: forge.pki.oids.sha256,
authenticatedAttributes: [{
type: forge.pki.oids.contentType,
value: forge.pki.oids.data
}, {
type: forge.pki.oids.messageDigest
// value will be auto-populated at signing time
}, {
type: forge.pki.oids.signingTime,
// value can also be auto-populated at signing time
value: new Date()
}]
});

p7.prepare();

// DER-serialized of ASN.1's digestInfo as forge's ByteBuffer object
const dtbs = p7.getDigestToBeSigned({ signerSerialNumber: cert.serialNumber })

// Simulate client-side signature (RSASSA-PKCS1-V1_5) using crypto library
const signature = crypto.privateEncrypt(privateKeyAssociatedWithCert, Buffer.from(d.toHex(), 'hex'))

// Add available signature into cms structure
p7.addSignature({ signerSerialNumber: cert.serialNumber, signature.toString('binary') })

var pem = forge.pkcs7.messageToPem(p7);
```

<a name="pkcs8" />
Expand Down