20
$\begingroup$

I always though PKCS7 was a signature format.

However, on the net I find several references to PKCS7 being a certificate format - for example, this talks about PKCS7 certificate: Extract raw certificate from PKCS#7 file in JAVA

Or: What's the difference between X.509 and PKCS#7 Certificate?

So is PKCS7 a signature format or a certificate format or both?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
18
$\begingroup$

So is PKCS7 a signature format or a certificate format or both?

Neither. PKCS7 is now Cryptographic Message Syntax(CMS). From the RFC 5652:

This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary message content.

CMS enables interoperability between different products which can operate on the same document without knowing anything about other product (implementation and such other specific info related to the product). CMS achieves this by defining specific message formats for each data type (signed data, enveloped data, authenticated enveloped data). Hence, each product which support CMS format can exchange files or messages defined in the CMS format with no trouble.

The second link you provided also talks about CMS format.

After comments from @Maarten:

It is also worth to mention that PKCS stands for "Public Key Cryptography Standards". These are a set of public key cryptography standards created by RSA Security Inc. Some of these standards handed over to standards organizations and they became industry standards after that.

Also, as @Maarten mentions, using CMS(PKCS7) format enables storing more than one certificate. (Check this answer)

Improve this answer
$\endgroup$
5
  • 2
    $\begingroup$ Nice answer. You may possibly improve it by explaining that PKCS means Public Key Cryptographic Standard, which is a set of standards from RSA Laboratories (and PKCS #7 in full is the 7th standard). Furthermore you might mention that CMS may contain signing and intermediate certificates. (sorry, previous comment was too strongly worded). $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 15, 2016 at 7:39
  • 1
    $\begingroup$ @MaartenBodewes Thanks for comment, i've edited my answer. Also, feel free to edit my answer as you like if there are some points still missing. $\endgroup$
    – Makif
    Commented Jun 15, 2016 at 9:16
  • 1
    $\begingroup$ Can you have a PKCS file which is just a certificate & does not contain any signature (other than signature which is part of the certificate itself)? That is my main question - so if I wasn't clear enough? $\endgroup$
    – user93353
    Commented Jun 15, 2016 at 14:02
  • 3
    $\begingroup$ From this answer:The .p7b or .p7c format is a special case of PKCS#7/CMS: a SignedData structure containing no "content" and zero SignerInfos, but one or more certificates (usually) and/or CRLs (rarely). So, this format enables storing only certificates. $\endgroup$
    – Makif
    Commented Jun 15, 2016 at 20:44
  • $\begingroup$ @Makif Good to know! Mind you, this is an extremely hackish way, because you would still mark it as signed content. PKCS#12 can also be used and encoded as PEM; PKCS#12 is a trust/key store format and would make a lot more sense. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 16, 2016 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.