I am using the PKCS#11 function C_Sign to sign some data. The output I get is just a signature. How do I get it in PKCS#7 format - i.e. ASN1 with signature and certificate (for detached) or ASN1 with signature, certificate & unsigned string (for attached).
$\begingroup$
$\endgroup$
2
The PKCS#7 standard is a messaging standard which includes messaging formats for signed data, enveloped data or signed and enveloped data. The PKCS#11 api will produce a "raw" signature, which you will have to wrap in the PKCS#7 signed data formats. If you are using Java or .Net I would recommend looking at the Bouncycastle apis, which include full PKCS#7 wrapper classes. If you are using C / C++ you may have to look for an appropriate ASN.1 library.
-
$\begingroup$ Thank you, can you recommend some appropriate library I can use with C++ on Windows. Are there any Microsoft APIs which provide this functionality. $\endgroup$ – user93353 Oct 10 '14 at 15:25
-
$\begingroup$ Sure. You can use the crypto API, however be sure that you can make these work safely with PKCS#11, because Micro$oft are no famous for their interoperability. You could use the CAPI drivers instead of PKCS#11. Usually the CAPI layer sits over the top of PKCS#11 anyway. $\endgroup$ – NRCocker Oct 10 '14 at 21:50
