如何从M2Crypto获取PKCS7信封的签名内容？

Question

我需要获取PKCS#7信封的摘要来手动检查它.

通常,当您想要验证pkcs#7信封的签名时,您可以这样做:

from M2Crypto import SMIME, X509, BIO

sm_obj = SMIME.SMIME()
x509 = X509.load_cert(join(PATH, 'QualifiedChain.crt'))
sk = X509.X509_Stack()
sk.push(x509)
sm_obj.set_x509_stack(sk)

st = X509.X509_Store()

st.load_info(join(PATH, 'QualifiedChain.crt'))

sm_obj.set_x509_store(st)

# re-wrap signature so that it fits base64 standards
cooked_sig = '\n'.join(raw_sig[pos:pos + 76] for pos in
                       xrange(0, len(raw_sig), 76))

# now, wrap the signature in a PKCS7 block
sig = "-----BEGIN PKCS7-----\n%s\n-----END PKCS7-----\n" % cooked_sig


# and load it into an SMIME p7 object through the BIO I/O buffer:
buf = BIO.MemoryBuffer(sig)
p7 = SMIME.load_pkcs7_bio(buf)

signers = p7.get0_signers(sk)
certificat = signers[0]
data_bio = BIO.MemoryBuffer(MSG)
sm_obj.verify(p7, data_bio)  # This is the line that count.

但就我而言,摘要类型是md5sha1,openssl无法识别:

$ openssl list-message-digest-commands
md4
md5
rmd160
sha
sha1

我需要做什么才能获得pkcs#7 signedContent并手动检查它.

我需要的是Python相当于org.bouncycastle.cms.CMSSignedDataParser.

如何让摘要能够手动验证而无需使用sm_obj.verify？

Answer 1

PKCS7 具有 SignerInfo 的集合。每个SignerInfo可能有不同的消息摘要算法。

请参阅https://github.com/erny/pyx509。这需要 pyasn1 和 pyasn1-modules。

./pkcs_parse <pkcs7 signature in DER format>

这会提取每个签名者信息的摘要算法。