3

I'm trying to create a PKCS#7 signed message in C#. The digital signature is being computed separately in an HSM so I already have the value of the signature, I just want to create a PKCS#7 structure that contains it.

I've looked into using the SignedCms in the System.Security.Cryptography.Pkcs namespace but this doesn't seem to have an option for providing a precomputed signature.

What is the best way to generate a PKCS#7 structure in C# when I already have the value of the digital signature?

Andy Gibson
  • 187
  • 2
  • 7

2 Answers2

3

AFAIK you cannot do that with "built-in" .NET classes.

However I have created an example application - Pkcs7SignatureGenerator - for CMS signature creation with Pkcs11Interop (which I am author of) and Bouncy Castle libraries.

In this application Pkcs11Interop library performs signing operation via PKCS#11 API with the private key stored in the hardware device and BouncyCastle library is responsible for construction of a CMS (PKCS#7) signature structure.

jariq
  • 11,681
  • 3
  • 33
  • 52
  • That's very helpful, thanks. I ended up using the code in your Pkcs7SignatureGenerator project as a starting point and adjusting it slightly to fit my needs. – Andy Gibson Jan 22 '17 at 16:36
0

I think what you want is the X509Certificate2 class, use the static CreateFromSignedFile function to retrieve the certificate from the signed file, or use CreateFromCertFile to create from the specified certification file:

X509Certificate2 cert = X509Certificate2.CreateFromSignedFile(filename);
CmsSigner signer = new CmsSigner(cert);
gmiley
  • 6,531
  • 1
  • 13
  • 25
  • The problem with this approach is that the CmsSigner will try to compute a signature using the private key on the certificate when there is no private key on the certificate, the private key only exists in the HSM. I essentially want a version of the SignedCms class where I can provide it with a digital signature, rather than having a CmsSigner that calculates one. – Andy Gibson Jan 21 '17 at 13:41
  • @AndyGibson Could you provide a simplified example in your OP to illustrate what you have, and what you are trying to achieve? Also include any example code that might be relevant, even if it might be pseudo-code, – gmiley Jan 21 '17 at 13:50