Lua

A3/A4 Certificate to Create and Verify an Opaque PKCS7/CMS Signature

See more Digital Signatures Examples

Demonstrates how to use an A3 or A4 certificate w/ private key on a smartcard or token to create a PKCS7 opaque signature, and also how to verify an opaque signature.

An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content.

Lua

local chilkat = require("chilkat")

-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local crypt = chilkat.Crypt2.new()

-- A certificate and private key is needed to create a signature.
-- Chilkat provides many different ways to load a certificate and private key, such
-- as from a smartcards and hardware tokens, PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
-- This example will load the default certificate from the smartcard that is currently in
-- the smartcard reader.

local cert = chilkat.Cert.new()

-- If the smartcard or token requires a PIN, we can set it here to avoid the dialog...
cert.smart_card_pin = "000000"

local success = cert:load_from_smartcard("")
if not success then
    print(cert.last_error_text)
    return
end

-- Tell it to use the cert and private key we've loaded.
success = crypt:set_signing_cert(cert)
if not success then
    print(crypt.last_error_text)
    return
end

-- Indicate we want the opaque signature in base64 format:
crypt.encoding_mode = "base64"

-- Sign the string using the "utf-8" byte representation:
crypt.charset = "utf-8"

-- Create the opaque signature:
local originalData = "This is the string to be signed."
local opaqueSig = crypt:opaque_sign_string_enc(originalData)
if not crypt.last_method_success then
    print(crypt.last_error_text)
    return
end

print(opaqueSig)

-- The output looks like this:
-- MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

-- ----------------------------------------------------------------------------------------------
-- Now let's verify the signature and retrieve the original data.
-- We'll use a new Crypt2 object to keep things completely separate...

local vCrypt = chilkat.Crypt2.new()

-- We only need the certificate to verify a signature (and extract the data from
-- an opaque signature).  The public key is always embedded within a certificate.
success = vCrypt:set_verify_cert(cert)
if not success then
    print(vCrypt.last_error_text)
    return
end

vCrypt.encoding_mode = "base64"
vCrypt.charset = "utf-8"

local extractedData = vCrypt:opaque_verify_string_enc(opaqueSig)
if not vCrypt.last_method_success then
    print(vCrypt.last_error_text)
    return
end

print("The extracted data: " .. extractedData)

-- The output is:
-- The extracted data: This is the string to be signed.