A utility class to perform CMS/PKCS7 operations, as specified by RFC3852. :param store: a ROOT CA certificate list to trust. :param crls: a list of CRLs to include. This is currently not checked.
| 1703 | |
| 1704 | |
| 1705 | class CMS_Engine: |
| 1706 | """ |
| 1707 | A utility class to perform CMS/PKCS7 operations, as specified by RFC3852. |
| 1708 | |
| 1709 | :param store: a ROOT CA certificate list to trust. |
| 1710 | :param crls: a list of CRLs to include. This is currently not checked. |
| 1711 | """ |
| 1712 | |
| 1713 | def __init__( |
| 1714 | self, |
| 1715 | store: CertList, |
| 1716 | crls: List[X509_CRL] = [], |
| 1717 | ): |
| 1718 | self.store = store |
| 1719 | self.crls = crls |
| 1720 | |
| 1721 | def sign( |
| 1722 | self, |
| 1723 | message: Union[bytes, Packet], |
| 1724 | eContentType: ASN1_OID, |
| 1725 | cert: Cert, |
| 1726 | key: PrivKey, |
| 1727 | h: Optional[str] = None, |
| 1728 | ): |
| 1729 | """ |
| 1730 | Sign a message using CMS. |
| 1731 | |
| 1732 | :param message: the inner content to sign. |
| 1733 | :param eContentType: the OID of the inner content. |
| 1734 | :param cert: the certificate whose key to use use for signing. |
| 1735 | :param key: the private key to use for signing. |
| 1736 | :param h: the hash to use (default: same as the certificate's signature) |
| 1737 | |
| 1738 | We currently only support X.509 certificates ! |
| 1739 | """ |
| 1740 | # RFC3852 - 5.4. Message Digest Calculation Process |
| 1741 | h = h or _get_cert_sig_hashname(cert) |
| 1742 | hash = hashes.Hash(_get_hash(h)) |
| 1743 | hash.update(bytes(message)) |
| 1744 | hashed_message = hash.finalize() |
| 1745 | |
| 1746 | # 5.5. Signature Generation Process |
| 1747 | signerInfo = CMS_SignerInfo( |
| 1748 | version=1, |
| 1749 | sid=CMS_IssuerAndSerialNumber( |
| 1750 | issuer=cert.tbsCertificate.issuer, |
| 1751 | serialNumber=cert.tbsCertificate.serialNumber, |
| 1752 | ), |
| 1753 | digestAlgorithm=X509_AlgorithmIdentifier( |
| 1754 | algorithm=ASN1_OID(h), |
| 1755 | parameters=ASN1_NULL(0), |
| 1756 | ), |
| 1757 | signedAttrs=[ |
| 1758 | X509_Attribute( |
| 1759 | type=ASN1_OID("contentType"), |
| 1760 | values=[ |
| 1761 | X509_AttributeValue(value=eContentType), |
| 1762 | ], |
no outgoing calls
no test coverage detected
searching dependent graphs…