In
an earlier post I have tried to demonstrate how to verify a PKCS#7 manually, because I wanted to know how such messages work and why it would be secure. Judging by the reactions that were posted I think a lot you are actually more interested in a proper way of decrypting and verifying PKCS#7 messages with OpenSSL. Therefore I will show you how to encrypt, decrypt, sign and verify PKCS#7 messages, with OpenSSL in a more proper way.
NOTE: to actually use these methods securely could, and probably does, require decent understanding of data encryption!
If you are in doubt, feel free to leave a message and I'll try to be of assistance.
Setup
Before we can start encrypting and signing messages we'll require some keys and certificates. Let's create a self-signed certificate based on a new key with the subject "PKCS#7 example".
openssl req -x509 -nodes -newkey rsa:1024 -keyout keyfile.key -out certificate.cer -subj "/CN=PKCS#7 example"
This should result in the creation of two new files:
- certificate.cer - containing a PEM-encoded X.509 certificate
- keyfile.key - containing a PEM-encoded (RSA) private key
To view ASN.1 encoded files, both, DER and PEM, with more ease I have created two aliases in my terminal:
alias oad='openssl asn1parse -inform der -in'
alias oap='openssl asn1parse -inform pem -in'
oad is used to "
OpenSSL
ASN.1 dump
DER"
oap is used to "
OpenSSL
ASN.1 dump
PEM"
e.g.
oap certificate.cer
0:d=0 hl=4 l= 512 cons: SEQUENCE
4:d=1 hl=4 l= 361 cons: SEQUENCE
8:d=2 hl=2 l= 3 cons: cont [ 0 ]
10:d=3 hl=2 l= 1 prim: INTEGER :02
13:d=2 hl=2 l= 9 prim: INTEGER :D28124BDCEECCCCC
24:d=2 hl=2 l= 13 cons: SEQUENCE
26:d=3 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
37:d=3 hl=2 l= 0 prim: NULL
39:d=2 hl=2 l= 25 cons: SEQUENCE
41:d=3 hl=2 l= 23 cons: SET
43:d=4 hl=2 l= 21 cons: SEQUENCE
45:d=5 hl=2 l= 3 prim: OBJECT :commonName
50:d=5 hl=2 l= 14 prim: UTF8STRING :PKCS#7 example
66:d=2 hl=2 l= 30 cons: SEQUENCE
68:d=3 hl=2 l= 13 prim: UTCTIME :130412203318Z
83:d=3 hl=2 l= 13 prim: UTCTIME :130512203318Z
98:d=2 hl=2 l= 25 cons: SEQUENCE
100:d=3 hl=2 l= 23 cons: SET
102:d=4 hl=2 l= 21 cons: SEQUENCE
104:d=5 hl=2 l= 3 prim: OBJECT :commonName
109:d=5 hl=2 l= 14 prim: UTF8STRING :PKCS#7 example
125:d=2 hl=3 l= 159 cons: SEQUENCE
128:d=3 hl=2 l= 13 cons: SEQUENCE
130:d=4 hl=2 l= 9 prim: OBJECT :rsaEncryption
141:d=4 hl=2 l= 0 prim: NULL
143:d=3 hl=3 l= 141 prim: BIT STRING
287:d=2 hl=2 l= 80 cons: cont [ 3 ]
289:d=3 hl=2 l= 78 cons: SEQUENCE
291:d=4 hl=2 l= 29 cons: SEQUENCE
293:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier
298:d=5 hl=2 l= 22 prim: OCTET STRING [HEX DUMP]:0414B2ED2165623A8E3E5EB9652E781590C314EFC5B6
322:d=4 hl=2 l= 31 cons: SEQUENCE
324:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier
329:d=5 hl=2 l= 24 prim: OCTET STRING [HEX DUMP]:30168014B2ED2165623A8E3E5EB9652E781590C314EFC5B6
355:d=4 hl=2 l= 12 cons: SEQUENCE
357:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Basic Constraints
362:d=5 hl=2 l= 5 prim: OCTET STRING [HEX DUMP]:30030101FF
369:d=1 hl=2 l= 13 cons: SEQUENCE
371:d=2 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
382:d=2 hl=2 l= 0 prim: NULL
384:d=1 hl=3 l= 129 prim: BIT STRING
Encryption
Encryption can be used to make a message only available to the target receiver and prevents eavesdropping. The message is encrypted with a public key, quiet often stored in a certificate. Because of the mathematical properties of the private and public key, the message can only be read with possession of the private key. In this example I'll show you how to encrypt a message that is only readable when decrypted with the private key created before. To encrypt a message we'll be using the newly created certificate we're using the smime command of OpenSSL. Have a look at the help for all the available options of this command (openssl smime --help).
Store the message we'll be encrypting in a file:
echo "This message won't be readable until decrypted again." > plain-original.txt
Then encrypt this message using the key from the certificate.cer created earlier. If the outform isn't specified the default output format is smime, for now I'll use pem:
openssl smime -encrypt -in plain-original.txt -outform pem -out encrypted.p7 certificate.cer
Verifiy the encrypted.p7 contains content that looks a bit like this:
oap encrypted.p7
-----BEGIN PKCS7-----
MIIBPAYJKoZIhvcNAQcDoIIBLTCCASkCAQAxgcAwgb0CAQAwJjAZMRcwFQYDVQQD
DA5QS0NTIzcgZXhhbXBsZQIJANKBJL3O7MzMMA0GCSqGSIb3DQEBAQUABIGAh/s9
JYTGgh46iAH95n2UQNuDNQWgG01akoVuj0KR9ChbRQuQPSas+p+eMK1ipyCPnLtv
7Mhcjsf0yPGkFod39LxiOhcepe2vRcwYxTaGgBHk7VMS2ilZwKZMYki1gxjCKe6b
BlK3kVGx5dA0YEEhIWNPbL4IZhn+Orx2HrL8mgAwYQYJKoZIhvcNAQcBMBoGCCqG
SIb3DQMCMA4CAgCgBAjzFuJU6hSmNoA49ZNTG5kYKkttlsot8ak+jaDPAbrwobFL
5BPmv4MyRtmBaRiHToCJMK+DfigMi3smVE2FeYC3YGQ=
-----END PKCS7-----
Decryption
A PKCS#7 encrypted message can be recognized by the PKCS#7 content type, which is pkcs7-envelopedData:
oap encrypted.p7
0:d=0 hl=4 l= 316 cons: SEQUENCE
4:d=1 hl=2 l= 9 prim: OBJECT :pkcs7-envelopedData
15:d=1 hl=4 l= 301 cons: cont [ 0 ]
19:d=2 hl=4 l= 297 cons: SEQUENCE
23:d=3 hl=2 l= 1 prim: INTEGER :00
26:d=3 hl=3 l= 192 cons: SET
29:d=4 hl=3 l= 189 cons: SEQUENCE
32:d=5 hl=2 l= 1 prim: INTEGER :00
35:d=5 hl=2 l= 38 cons: SEQUENCE
37:d=6 hl=2 l= 25 cons: SEQUENCE
39:d=7 hl=2 l= 23 cons: SET
41:d=8 hl=2 l= 21 cons: SEQUENCE
43:d=9 hl=2 l= 3 prim: OBJECT :commonName
48:d=9 hl=2 l= 14 prim: UTF8STRING :PKCS#7 example
64:d=6 hl=2 l= 9 prim: INTEGER :D28124BDCEECCCCC
75:d=5 hl=2 l= 13 cons: SEQUENCE
77:d=6 hl=2 l= 9 prim: OBJECT :rsaEncryption
88:d=6 hl=2 l= 0 prim: NULL
90:d=5 hl=3 l= 128 prim: OCTET STRING [HEX DUMP]:7A7782B34EC3C63ABAD847DC4C028AFB8C1072CB1A43154A7CBFB2CB5B31874FB0D5EF8607AE442762595CDB6C15BD6C0373F0CD21B25396AF457F3699BC87C09B7F2552BB7A9A03EE7EBD3FF8961A00D161BED2CF3214E491D18A26B3992DD1129AC2F4FC860A3E1A84C6F2115E788F6436EAD35A257FAD50D871D34E50F335
221:d=3 hl=2 l= 97 cons: SEQUENCE
223:d=4 hl=2 l= 9 prim: OBJECT :pkcs7-data
234:d=4 hl=2 l= 26 cons: SEQUENCE
236:d=5 hl=2 l= 8 prim: OBJECT :rc2-cbc
246:d=5 hl=2 l= 14 cons: SEQUENCE
248:d=6 hl=2 l= 2 prim: INTEGER :A0
252:d=6 hl=2 l= 8 prim: OCTET STRING [HEX DUMP]:A05AF334241D3C3C
262:d=4 hl=2 l= 56 prim: cont [ 0 ]
To decrypt a PKCS#7 envelopedData message we need access to the private key. In this example I will use the private key we've stored in the keyfile.key before. The OpenSSL smime command in used again:
openssl smime -decrypt -inform pem -in encrypted.p7 -inkey keyfile.key
This message won't be readable until decrypted again.
Signing
Signing a message in PKCS#7 format is almost as simple as encrypting it. Signing is done with the private key. This allows anyone who has access to the public key to verify that the message was signed by the owner of the matching private key and is used to proof the origin of a message.
Create a message to be signed:
echo "This message could only have been sent by me." > unsigned-original.txt
In this example I'm adding the -nodetach option. This option tells OpenSSL to include the original message in the PKCS#7 structure too. Besides the private key the certificate is also required for signing. This is used by OpenSSL to include a reference to the certificate in the signed message (an Issuer - SerialNumber combination, which should be unique). This reference enables the receiver to find the matching certificate, and thus public key. The command I'm using is as follows:
openssl smime -sign -nodetach -in unsigned-original.txt -out signed.p7 -outform pem -inkey keyfile.key -signer certificate.cer
The content is again PEM-encoded and can be parsed with asn1parse:
cat signed.p7
-----BEGIN PKCS7-----
MIIEFgYJKoZIhvcNAQcCoIIEBzCCBAMCAQExCzAJBgUrDgMCGgUAMD4GCSqGSIb3
DQEHAaAxBC9UaGlzIG1lc3NhZ2UgY291bGQgb25seSBoYXZlIGJlZW4gc2VudCBi
eSBtZS4NCqCCAgQwggIAMIIBaaADAgECAgkA0oEkvc7szMwwDQYJKoZIhvcNAQEF
BQAwGTEXMBUGA1UEAwwOUEtDUyM3IGV4YW1wbGUwHhcNMTMwNDEyMjAzMzE4WhcN
MTMwNTEyMjAzMzE4WjAZMRcwFQYDVQQDDA5QS0NTIzcgZXhhbXBsZTCBnzANBgkq
hkiG9w0BAQEFAAOBjQAwgYkCgYEAnvFUnLFlzYScwPXCTBdp+e3pBAV/wFc10gq2
bKCcHg6WgWrnW39HJxaYdn6Edzt8ipdTvX2Kl6iQXtjAIs8oI7YBdqxZMknddM1M
mvbe0HVYPoF0lIWiLLIySYeV6GC2X0eYyWE1FLs1qJsRSrHA8iHlDH4gngGMu71d
WCEbXg8CAwEAAaNQME4wHQYDVR0OBBYEFLLtIWViOo4+XrllLngVkMMU78W2MB8G
A1UdIwQYMBaAFLLtIWViOo4+XrllLngVkMMU78W2MAwGA1UdEwQFMAMBAf8wDQYJ
KoZIhvcNAQEFBQADgYEAG1PiV0P2iZhh88juujpr/BrlMm64BlX1hrsLyyNR6e85
iBC4kFJNndkFiCFz31EAJkzoMIUdgn07cENk2KAjf3BIrgBaeY6mp94s6lpRcfK7
lEsfbyADOQqszCuzadMHZd44XReMaf43Kw/WYwVmsHpBDpzgAwH1sxtSKcHnFmox
ggGnMIIBowIBATAmMBkxFzAVBgNVBAMMDlBLQ1MjNyBleGFtcGxlAgkA0oEkvc7s
zMwwCQYFKw4DAhoFAKCB2DAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG
SIb3DQEJBTEPFw0xMzA0MTIyMTExMTVaMCMGCSqGSIb3DQEJBDEWBBS0KhYhWkxR
nvCUyavULWwbRXaF1jB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglg
hkgBZQMEARYwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIA
gDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG
9w0BAQEFAASBgHq2NEUYm1csunOIOlekNBPW12EWMU3lTK+phxPtKZl+y2233NLN
TWaLUaRF7ePjapr71IYlrLfse9Kv8xl8o2QU+XMhj1p2I6Ng0lt3VfwjgJ5isidk
GM/suaYFITr4PxGlhZKEtoYQh4BOr0r0+iy6aFJGKAhn4slB6qdhn025
-----END PKCS7-----
oap signed.p7
0:d=0 hl=4 l=1046 cons: SEQUENCE
4:d=1 hl=2 l= 9 prim: OBJECT :pkcs7-signedData
15:d=1 hl=4 l=1031 cons: cont [ 0 ]
19:d=2 hl=4 l=1027 cons: SEQUENCE
23:d=3 hl=2 l= 1 prim: INTEGER :01
26:d=3 hl=2 l= 11 cons: SET
28:d=4 hl=2 l= 9 cons: SEQUENCE
30:d=5 hl=2 l= 5 prim: OBJECT :sha1
37:d=5 hl=2 l= 0 prim: NULL
39:d=3 hl=2 l= 62 cons: SEQUENCE
41:d=4 hl=2 l= 9 prim: OBJECT :pkcs7-data
52:d=4 hl=2 l= 49 cons: cont [ 0 ]
54:d=5 hl=2 l= 47 prim: OCTET STRING :This message could only have been sent by me.
103:d=3 hl=4 l= 516 cons: cont [ 0 ]
107:d=4 hl=4 l= 512 cons: SEQUENCE
111:d=5 hl=4 l= 361 cons: SEQUENCE
115:d=6 hl=2 l= 3 cons: cont [ 0 ]
117:d=7 hl=2 l= 1 prim: INTEGER :02
120:d=6 hl=2 l= 9 prim: INTEGER :D28124BDCEECCCCC
131:d=6 hl=2 l= 13 cons: SEQUENCE
133:d=7 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
144:d=7 hl=2 l= 0 prim: NULL
146:d=6 hl=2 l= 25 cons: SEQUENCE
148:d=7 hl=2 l= 23 cons: SET
150:d=8 hl=2 l= 21 cons: SEQUENCE
152:d=9 hl=2 l= 3 prim: OBJECT :commonName
157:d=9 hl=2 l= 14 prim: UTF8STRING :PKCS#7 example
173:d=6 hl=2 l= 30 cons: SEQUENCE
175:d=7 hl=2 l= 13 prim: UTCTIME :130412203318Z
190:d=7 hl=2 l= 13 prim: UTCTIME :130512203318Z
205:d=6 hl=2 l= 25 cons: SEQUENCE
207:d=7 hl=2 l= 23 cons: SET
209:d=8 hl=2 l= 21 cons: SEQUENCE
211:d=9 hl=2 l= 3 prim: OBJECT :commonName
216:d=9 hl=2 l= 14 prim: UTF8STRING :PKCS#7 example
232:d=6 hl=3 l= 159 cons: SEQUENCE
235:d=7 hl=2 l= 13 cons: SEQUENCE
237:d=8 hl=2 l= 9 prim: OBJECT :rsaEncryption
248:d=8 hl=2 l= 0 prim: NULL
250:d=7 hl=3 l= 141 prim: BIT STRING
394:d=6 hl=2 l= 80 cons: cont [ 3 ]
396:d=7 hl=2 l= 78 cons: SEQUENCE
398:d=8 hl=2 l= 29 cons: SEQUENCE
400:d=9 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier
405:d=9 hl=2 l= 22 prim: OCTET STRING [HEX DUMP]:0414B2ED2165623A8E3E5EB9652E781590C314EFC5B6
429:d=8 hl=2 l= 31 cons: SEQUENCE
431:d=9 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier
436:d=9 hl=2 l= 24 prim: OCTET STRING [HEX DUMP]:30168014B2ED2165623A8E3E5EB9652E781590C314EFC5B6
462:d=8 hl=2 l= 12 cons: SEQUENCE
464:d=9 hl=2 l= 3 prim: OBJECT :X509v3 Basic Constraints
469:d=9 hl=2 l= 5 prim: OCTET STRING [HEX DUMP]:30030101FF
476:d=5 hl=2 l= 13 cons: SEQUENCE
478:d=6 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
489:d=6 hl=2 l= 0 prim: NULL
491:d=5 hl=3 l= 129 prim: BIT STRING
623:d=3 hl=4 l= 423 cons: SET
627:d=4 hl=4 l= 419 cons: SEQUENCE
631:d=5 hl=2 l= 1 prim: INTEGER :01
634:d=5 hl=2 l= 38 cons: SEQUENCE
636:d=6 hl=2 l= 25 cons: SEQUENCE
638:d=7 hl=2 l= 23 cons: SET
640:d=8 hl=2 l= 21 cons: SEQUENCE
642:d=9 hl=2 l= 3 prim: OBJECT :commonName
647:d=9 hl=2 l= 14 prim: UTF8STRING :PKCS#7 example
663:d=6 hl=2 l= 9 prim: INTEGER :D28124BDCEECCCCC
674:d=5 hl=2 l= 9 cons: SEQUENCE
676:d=6 hl=2 l= 5 prim: OBJECT :sha1
683:d=6 hl=2 l= 0 prim: NULL
685:d=5 hl=3 l= 216 cons: cont [ 0 ]
688:d=6 hl=2 l= 24 cons: SEQUENCE
690:d=7 hl=2 l= 9 prim: OBJECT :contentType
701:d=7 hl=2 l= 11 cons: SET
703:d=8 hl=2 l= 9 prim: OBJECT :pkcs7-data
714:d=6 hl=2 l= 28 cons: SEQUENCE
716:d=7 hl=2 l= 9 prim: OBJECT :signingTime
727:d=7 hl=2 l= 15 cons: SET
729:d=8 hl=2 l= 13 prim: UTCTIME :130412211115Z
744:d=6 hl=2 l= 35 cons: SEQUENCE
746:d=7 hl=2 l= 9 prim: OBJECT :messageDigest
757:d=7 hl=2 l= 22 cons: SET
759:d=8 hl=2 l= 20 prim: OCTET STRING [HEX DUMP]:B42A16215A4C519EF094C9ABD42D6C1B457685D6
781:d=6 hl=2 l= 121 cons: SEQUENCE
783:d=7 hl=2 l= 9 prim: OBJECT :S/MIME Capabilities
794:d=7 hl=2 l= 108 cons: SET
796:d=8 hl=2 l= 106 cons: SEQUENCE
798:d=9 hl=2 l= 11 cons: SEQUENCE
800:d=10 hl=2 l= 9 prim: OBJECT :aes-256-cbc
811:d=9 hl=2 l= 11 cons: SEQUENCE
813:d=10 hl=2 l= 9 prim: OBJECT :aes-192-cbc
824:d=9 hl=2 l= 11 cons: SEQUENCE
826:d=10 hl=2 l= 9 prim: OBJECT :aes-128-cbc
837:d=9 hl=2 l= 10 cons: SEQUENCE
839:d=10 hl=2 l= 8 prim: OBJECT :des-ede3-cbc
849:d=9 hl=2 l= 14 cons: SEQUENCE
851:d=10 hl=2 l= 8 prim: OBJECT :rc2-cbc
861:d=10 hl=2 l= 2 prim: INTEGER :80
865:d=9 hl=2 l= 13 cons: SEQUENCE
867:d=10 hl=2 l= 8 prim: OBJECT :rc2-cbc
877:d=10 hl=2 l= 1 prim: INTEGER :40
880:d=9 hl=2 l= 7 cons: SEQUENCE
882:d=10 hl=2 l= 5 prim: OBJECT :des-cbc
889:d=9 hl=2 l= 13 cons: SEQUENCE
891:d=10 hl=2 l= 8 prim: OBJECT :rc2-cbc
901:d=10 hl=2 l= 1 prim: INTEGER :28
904:d=5 hl=2 l= 13 cons: SEQUENCE
906:d=6 hl=2 l= 9 prim: OBJECT :rsaEncryption
917:d=6 hl=2 l= 0 prim: NULL
919:d=5 hl=3 l= 128 prim: OCTET STRING [HEX DUMP]:7AB63445189B572CBA73883A57A43413D6D76116314DE54CAFA98713ED29997ECB6DB7DCD2CD4D668B51A445EDE3E36A9AFBD48625ACB7EC7BD2AFF3197CA36414F973218F5A7623A360D25B7755FC23809E62B2276418CFECB9A605213AF83F11A5859284B6861087804EAF4AF4FA2CBA685246280867E2C941EAA7619F4DB9
Verification
Verifying a PKCS#7 message is done to verify the authenticity of the message and to make sure it was sent by someone who has access to the private key. OpenSSL also tries to verify the certificate included in the message (or supplied on the commandline in some cases). Because I'm using a self signed certificate in this example the verification of the certificate will fail; because it's not signed by a trusted party.
openssl smime -verify -in signed.p7 -inform pem
Verification failure
2675740:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:342:Verify error:self signed certificate
To overcome this we could add the -noverify option. This might look a bit weird (openssl verify -noverify...), but the message is still verified against the certificate. It's just the verification of the certificate itself that is skipped. Nevertheless this option should of course only be used when the full implications are understood!
openssl smime -verify -in signed.p7 -inform pem -noverify
This message could only have been sent by me.
Verification successful
Summary
OpenSSL is a verify powerful tool that can be a bit hard to operate. Depending on your (security) requirements some of the examples provided might be more suitable to your situation than others. Using these commands, or tailored versions, for troubleshooting or in testing environments should be OK. If however you plan on using these in a production environment, please, and don't take this lightly, consult someone with decent understanding of data encryption and key management!
openssl smime -encrypt -in plain-original.txt -outform pem -out encrypted.p7 certificate.cer
openssl smime -decrypt -inform pem -in encrypted.p7 -inkey keyfile.key
openssl smime -sign -nodetach -in unsigned-original.txt -out signed.p7 -outform pem -inkey keyfile.key -signer certificate.cer
openssl smime -verify -in signed.p7 -inform pem
