Xbase++

MIME S/MIME Signing Algorithm Properties

Demonstrates the properties that control S/MIME signing: SigningAlg (the RSA signature scheme, PKCS1-V1_5 or RSASSA-PSS), SigningHashAlg (the message-digest algorithm), Micalg and Protocol (the micalg and protocol parameters of a multipart/signed Content-Type), and UseXPkcs7 (whether historical x-pkcs7 media-type names are used). The properties are configured before creating a detached signature.

Background. These settings determine how the CMS/PKCS #7 signature is produced and how a multipart/signed wrapper advertises it. The defaults (PKCS1-V1_5, sha256) suit most modern uses; the properties allow interoperability with specific requirements.

Chilkat Xbase++ Downloads

Download Chilkat for Xbase++

Xbase++

LOCAL nSuccess
LOCAL oMime
LOCAL cPfxPassword
LOCAL oCert

nSuccess := 0

oMime := CreateObject("Chilkat.Mime")
nSuccess := oMime:SetBodyFromPlainText("This message will be signed.")
IF (nSuccess == 0)
    ? oMime:LastErrorText
    oMime:destroy()
    RETURN
ENDIF

//  SigningAlg is the RSA signature scheme.  The default is PKCS1-V1_5; set RSASSA-PSS (or pss) for
//  RSASSA-PSS.
oMime:SigningAlg := "PKCS1-V1_5"

//  SigningHashAlg is the message-digest algorithm.  The default is sha256.
oMime:SigningHashAlg := "sha256"

//  Micalg and Protocol are the micalg and protocol parameters written into a multipart/signed
//  Content-Type header field.  They are normally set automatically, but can be controlled here.
oMime:Micalg := "sha-256"
oMime:Protocol := "application/pkcs7-signature"

//  UseXPkcs7 controls whether newly created S/MIME media types use the historical x-pkcs7 names.
oMime:UseXPkcs7 := 0

//  Load a signing certificate (with private key access) from a PFX.  The PFX password should come
//  from a secure source rather than being hard-coded.
cPfxPassword := "myPfxPassword"
oCert := CreateObject("Chilkat.Cert")
nSuccess := oCert:LoadPfxFile("qa_data/signer.pfx", cPfxPassword)
IF (nSuccess == 0)
    ? oCert:LastErrorText
    oMime:destroy()
    oCert:destroy()
    RETURN
ENDIF

//  Create the detached signature using the algorithms configured above.
nSuccess := oMime:AddDetachedSignature(oCert)
IF (nSuccess == 0)
    ? oMime:LastErrorText
    oMime:destroy()
    oCert:destroy()
    RETURN
ENDIF

? "Signed with SigningAlg=" + oMime:SigningAlg + " SigningHashAlg=" + oMime:SigningHashAlg

oMime:destroy()
oCert:destroy()