cms

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 15, 2024 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

Package cms verifies Signed-Data defined in RFC 5652 Cryptographic Message Syntax (CMS) / PKCS7

References: - RFC 5652 Cryptographic Message Syntax (CMS)

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrSignerInfoNotFound  = VerificationError{Message: "signerInfo not found"}
	ErrCertificateNotFound = VerificationError{Message: "certificate not found"}
)

Verification errors

View Source 
var ErrAttributeNotFound = errors.New("attribute not found")

ErrAttributeNotFound is returned if attribute is not found in a given set.

View Source 
var ErrNotSignedData = errors.New("cms: content type is not signed-data")

ErrNotSignedData is returned if wrong content is provided when signed data is expected.

Functions

This section is empty.

Types

type Attribute 

type Attribute struct {
	// Type field specifies the type of the attribute.
	Type asn1.ObjectIdentifier

	// Values field contains the actual value of the attribute.
	Values asn1.RawValue `asn1:"set"`
}

Attribute struct is used to represent a attribute with type and values.

Reference: RFC 5652 5.3 SignerInfo 

Attribute ::= SEQUENCE {
  attrType    OBJECT IDENTIFIER,
  attrValues  SET OF AttributeValue }

type Attributes 

type Attributes []Attribute

Attributes ::= SET SIZE (0..MAX) OF Attribute

func (Attributes) Get 

func (a Attributes) Get(identifier asn1.ObjectIdentifier, out any) error

Get tries to find the attribute by the given identifier, parse and store the result in the value pointed to by out.

type ContentInfo 

type ContentInfo struct {
	// ContentType field specifies the type of the content, which can be one of
	// several predefined types, such as data, signedData, envelopedData, or
	// encryptedData. Only signedData is supported currently.
	ContentType asn1.ObjectIdentifier

	// Content field contains the actual content of the message.
	Content asn1.RawValue `asn1:"explicit,tag:0"`
}

ContentInfo struct is used to represent the content of a CMS message, which can be encrypted, signed, or both.

References: RFC 5652 3 ContentInfo Type 

ContentInfo ::= SEQUENCE {
  contentType ContentType,
  content [0] EXPLICIT ANY DEFINED BY contentType }

type EncapsulatedContentInfo 

type EncapsulatedContentInfo struct {
	// ContentType is an object identifier. The object identifier uniquely
	// specifies the content type.
	ContentType asn1.ObjectIdentifier

	// Content field contains the actual content of the message.
	Content []byte `asn1:"explicit,optional,tag:0"`
}

EncapsulatedContentInfo struct is used to represent the content of a CMS message.

References: RFC 5652 5.2 EncapsulatedContentInfo 

EncapsulatedContentInfo ::= SEQUENCE {
 eContentType    ContentType,
 eContent        [0] EXPLICIT OCTET STRING   OPTIONAL }

type IssuerAndSerialNumber 

type IssuerAndSerialNumber struct {
	// Issuer field identifies the certificate issuer.
	Issuer asn1.RawValue

	// SerialNumber field identifies the certificate.
	SerialNumber *big.Int
}

IssuerAndSerialNumber struct is used to identify a certificate.

Reference: RFC 5652 5.3 SignerIdentifier 

IssuerAndSerialNumber ::= SEQUENCE {
 issuer          Name,
 serialNumber    CertificateSerialNumber }

type ParsedSignedData 

type ParsedSignedData struct {
	// Content is the content of the EncapsulatedContentInfo.
	Content []byte

	// ContentType is the content type of the EncapsulatedContentInfo.
	ContentType asn1.ObjectIdentifier

	// Certificates is the list of certificates in the SignedData.
	Certificates []*x509.Certificate

	// CRLs is the list of certificate revocation lists in the SignedData.
	CRLs []x509.RevocationList

	// SignerInfos is the list of signer information in the SignedData.
	SignerInfos []SignerInfo
}

ParsedSignedData is a parsed SignedData structure for golang friendly types.

func ParseSignedData 

func ParseSignedData(berData []byte) (*ParsedSignedData, error)

ParseSignedData parses ASN.1 BER-encoded SignedData structure to golang friendly types.

Only supported SignedData version is 3.

func (*ParsedSignedData) GetCertificate 

func (d *ParsedSignedData) GetCertificate(ref IssuerAndSerialNumber) *x509.Certificate

GetCertificate finds the certificate by issuer name and issuer-specific serial number. Reference: RFC 5652 5 Signed-data Content Type

func (*ParsedSignedData) Verify 

func (d *ParsedSignedData) Verify(ctx context.Context, opts x509.VerifyOptions) ([][]*x509.Certificate, error)

Verify attempts to verify the content in the parsed signed data against the signer information. The `Intermediates` in the verify options will be ignored and re-contrusted using the certificates in the parsed signed data. If more than one signature is present, the successful validation of any signature implies that the content in the parsed signed data is valid. On successful verification, the list of signing certificates that successfully verify is returned. If all signatures fail to verify, the last error is returned.

References:

  • RFC 5652 5 Signed-data Content Type
  • RFC 5652 5.4 Message Digest Calculation Process
  • RFC 5652 5.6 Signature Verification Process

WARNING: this function doesn't do any revocation checking.

func (*ParsedSignedData) VerifySigner 

func (d *ParsedSignedData) VerifySigner(ctx context.Context, signerInfo *SignerInfo, signingCertificate *x509.Certificate, opts x509.VerifyOptions) ([]*x509.Certificate, error)

VerifySigner verifies the signerInfo against the user specified signingCertificate.

This function should be used when:

1. The certificates field of d is missing. This function allows the caller to provide a signing certificate to verify the signerInfo.

2. The caller doesn't trust the signer identifier (unsigned field) of signerInfo to identify signing certificate. This function allows such caller to use their trusted signing certificate.

Note: the intermediate certificates (if any) and root certificates in the verify options MUST be set by the caller. The certificates field of d is not used in this function.

References:

  • RFC 5652 5 Signed-data Content Type
  • RFC 5652 5.4 Message Digest Calculation Process
  • RFC 5652 5.6 Signature Verification Process

WARNING: this function doesn't do any revocation checking.

type SignedData 

type SignedData struct {
	// Version field specifies the syntax version number of the SignedData.
	Version int

	// DigestAlgorithmIdentifiers field specifies the digest algorithms used
	// by one or more signatures in SignerInfos.
	DigestAlgorithmIdentifiers []pkix.AlgorithmIdentifier `asn1:"set"`

	// EncapsulatedContentInfo field specifies the content that is signed.
	EncapsulatedContentInfo EncapsulatedContentInfo

	// Certificates field contains the certificates that are used to verify the
	// signatures in SignerInfos.
	Certificates asn1.RawValue `asn1:"optional,tag:0"`

	// CRLs field contains the Certificate Revocation Lists that are used to
	// verify the signatures in SignerInfos.
	CRLs []x509.RevocationList `asn1:"optional,tag:1"`

	// SignerInfos field contains one or more signatures.
	SignerInfos []SignerInfo `asn1:"set"`
}

SignedData struct is used to represent a signed CMS message, which contains one or more signatures that are used to verify the authenticity and integrity of the message.

Reference: RFC 5652 5.1 SignedData 

SignedData ::= SEQUENCE {
 version             CMSVersion,
 digestAlgorithms    DigestAlgorithmIdentifiers,
 encapContentInfo    EncapsulatedContentInfo,
 certificates        [0] IMPLICIT CertificateSet             OPTIONAL,
 crls                [1] IMPLICIT CertificateRevocationLists OPTIONAL,
 signerInfos         SignerInfos }

type SignerInfo 

type SignerInfo struct {
	// Version field specifies the syntax version number of the SignerInfo.
	Version int

	// SignerIdentifier field specifies the signer's certificate. Only IssuerAndSerialNumber
	// is supported currently.
	SignerIdentifier IssuerAndSerialNumber

	// DigestAlgorithm field specifies the digest algorithm used by the signer.
	DigestAlgorithm pkix.AlgorithmIdentifier

	// SignedAttributes field contains a collection of attributes that are
	// signed.
	SignedAttributes Attributes `asn1:"optional,tag:0"`

	// SignatureAlgorithm field specifies the signature algorithm used by the
	// signer.
	SignatureAlgorithm pkix.AlgorithmIdentifier

	// Signature field contains the actual signature.
	Signature []byte

	// UnsignedAttributes field contains a collection of attributes that are
	// not signed.
	UnsignedAttributes Attributes `asn1:"optional,tag:1"`
}

SignerInfo struct is used to represent a signature and related information that is needed to verify the signature.

Reference: RFC 5652 5.3 SignerInfo 

SignerInfo ::= SEQUENCE {
 version             CMSVersion,
 sid                 SignerIdentifier,
 digestAlgorithm     DigestAlgorithmIdentifier,
 signedAttrs         [0] IMPLICIT SignedAttributes   OPTIONAL,
 signatureAlgorithm  SignatureAlgorithmIdentifier,
 signature           SignatureValue,
 unsignedAttrs       [1] IMPLICIT UnsignedAttributes OPTIONAL }

Only version 1 is supported. As defined in RFC 5652 5.3, SignerIdentifier is IssuerAndSerialNumber when version is 1.

type SyntaxError 

type SyntaxError struct {
	Message string
	Detail  error
}

SyntaxError indicates that the ASN.1 data is invalid.

func (SyntaxError) Error 

func (e SyntaxError) Error() string

Error returns error message.

func (SyntaxError) Unwrap 

func (e SyntaxError) Unwrap() error

Unwrap returns the internal error.

type VerificationError 

type VerificationError struct {
	Message string
	Detail  error
}

VerificationError indicates verification failures.

func (VerificationError) Error 

func (e VerificationError) Error() string

Error returns error message.

func (VerificationError) Unwrap 

func (e VerificationError) Unwrap() error

Unwrap returns the internal error.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.