Here is a dump of my CMS encrypted message.
===================
CMS_ContentInfo:.
contentType: pkcs7-envelopedData (1.2.840.113549.1.7.3)
d.envelopedData:.
version: 2
originatorInfo: <ABSENT>
recipientInfos:
d.kari:.
version: 3
d.originatorKey:.
algorithm:.
algorithm: id-ecPublicKey (1.2.840.10045.2.1)
parameter: <ABSENT>
publicKey: (0 unused bits)
0000 - 04 89 ee 81 d8 05 30 2d-4e 3a a3 33 dd 8b ......0-N:.3..
000e - c5 7d 56 79 02 2b 16 7a-f5 4c 20 3f 18 ed .}Vy.+.z.L ?..
001c - 92 ba 81 98 88 f8 7a 6c-41 ba 8e bb c0 a5 ......zlA.....
002a - 41 c4 2a fe 36 31 5c f3-92 9c b5 ad 79 a9 A.*.61\.....y.
0038 - 9c 4c 75 69 23 9d a1 5b-ef .Lui#..[.
ukm: <ABSENT>
keyEncryptionAlgorithm:.
algorithm: dhSinglePass-stdDH-sha256kdf-scheme (1.3.132.1.11.1)
parameter: SEQUENCE:
recipientEncryptedKeys:
d.rKeyId:.
subjectKeyIdentifier:.
0000 - 82 46 4f ae b4 cb 84 7b-f4 70 68 6f d0 .FO....{.pho.
000d - 24 e7 15 8c 34 f3 c4 $...4..
date: <ABSENT>
other: <ABSENT>
encryptedKey:.
0000 - f9 b1 b1 28 2a 0c ea e5-eb 3b 0f 22 a5 f4 ...(*....;."..
000e - 51 8e 22 a3 76 4f fe 01-6f 26 37 b5 24 1c Q.".vO..o&7.$.
001c - 20 ba 9f 1a 11 92 25 a5-e4 4e 79 6f .....%..Nyo
encryptedContentInfo:.
contentType: pkcs7-data (1.2.840.113549.1.7.1)
contentEncryptionAlgorithm:.
algorithm: aes-256-cbc (2.16.840.1.101.3.4.1.42)
parameter: OCTET STRING:
0000 - c4 12 53 6c 1f 04 ee 3a-2f 19 43 6f 87 0c af ..Sl...:/.Co...
000f - 9b .
encryptedContent:.
0000 - 9f 18 ea 29 08 26 f5 8c-7c 69 ae 23 f2 ca 95 ...).&..|i.#...
000f - 76 v
unprotectedAttrs:
<EMPTY>
========
As you can see it has reference to one recipient, identified by his
subjectKeyIdentifier. By some reason
RecipientInfos/d.kari/d.originatorKey also includes full public key
from recipient's certificate. Questions:
1. Why is it required?
2. Is it possible to omit it since it is superfluous (IMHO) ?
3. https://github.com/openssl/openssl/blob/master/crypto/cms/cms_kari.c#L386
(and RFC) say that there could be either key, subjectandserial or
subjectkeyidentifier. So, how to set it using command line openssl
application ?
--
Segmentation fault
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
