Rust

A3/A4 Certificate to Create and Verify an Opaque PKCS7/CMS Signature

See more Digital Signatures Examples

Demonstrates how to use an A3 or A4 certificate w/ private key on a smartcard or token to create a PKCS7 opaque signature, and also how to verify an opaque signature.

An opaque signature is different than a detached PKCS7 signature in that it contains the original data. Verifying an opaque signature retrieves the original content.

Rust

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

let crypt = chilkat::Crypt2::new();

// A certificate and private key is needed to create a signature.
// Chilkat provides many different ways to load a certificate and private key, such
// as from a smartcards and hardware tokens, PFX/.p12, Java keystore, JWK, Windows registry-based certificate stores, and other sources.
// This example will load the default certificate from the smartcard that is currently in
// the smartcard reader.

let cert = chilkat::Cert::new();

// If the smartcard or token requires a PIN, we can set it here to avoid the dialog...
cert.set_smart_card_pin("000000");

if cert.load_from_smartcard("").is_err() {
    println!("{}", cert.last_error_text());
    return;
}

// Tell it to use the cert and private key we've loaded.
if crypt.set_signing_cert(&cert).is_err() {
    println!("{}", crypt.last_error_text());
    return;
}

// Indicate we want the opaque signature in base64 format:
crypt.set_encoding_mode("base64");

// Sign the string using the "utf-8" byte representation:
crypt.set_charset("utf-8");

// Create the opaque signature:
let original_data = "This is the string to be signed.".to_string();
let Ok(opaque_sig) = crypt.opaque_sign_string_enc(&original_data) else {
    println!("{}", crypt.last_error_text());
    return;
};

println!("{}", opaque_sig);

// The output looks like this:
// MIIPgQYJKoZIhvcNAQcCoIIPcjCCD24CAQExCzAJBgUrDgMCGgUAMC8GCSqGSIb3DQEHAaAiBCBUaGlzIGlzIHRoZSBzdHJpbmcgdG8gYmUgc...

// ----------------------------------------------------------------------------------------------
// Now let's verify the signature and retrieve the original data.
// We'll use a new Crypt2 object to keep things completely separate...

let v_crypt = chilkat::Crypt2::new();

// We only need the certificate to verify a signature (and extract the data from
// an opaque signature).  The public key is always embedded within a certificate.
if v_crypt.set_verify_cert(&cert).is_err() {
    println!("{}", v_crypt.last_error_text());
    return;
}

v_crypt.set_encoding_mode("base64");
v_crypt.set_charset("utf-8");

let Ok(extracted_data) = v_crypt.opaque_verify_string_enc(&opaque_sig) else {
    println!("{}", v_crypt.last_error_text());
    return;
};

println!("The extracted data: {}", extracted_data);

// The output is:
// The extracted data: This is the string to be signed.