Dear all,
I am trying to understand why the same code for the Alpine email program
behave differently when compiling it with two different versions of
Openssl. I have tried many variations of the official code, to no avail.
Maybe here someone can point me in the right direction.
The git repository for the code is located at
https://repo.or.cz/alpine.git
The code that creates detached signatures is in the file pith/smime.c. The
flow more or less goes as follows
flags = PKCS7_DETACHED | PKCS7_PARTIAL;
if((p7 = PKCS7_sign(NULL, NULL, chain, in, flags)) != NULL
&& PKCS7_sign_add_signer(p7, pcert->cert, pcert->key, md, flags))
PKCS7_final(p7, in, flags);
i2d_PKCS7_bio(out, p7);
(void) BIO_flush(out);
The "in" and "out" BIOs are memory buffers. The out BIO is internally
base64 encoded and attached.
Does anyone here see why a code like this would succeed in creating valid
signed messages when the same code in Alpine is built with version OpenSSL
1.1.0i-fips 14 Aug 2018, but not with OpenSSL 1.1.1g 21 Apr 2020 (and I
believe with any of the versions 1.1.1 series).
The exact details of the code are in the repository (address above) in the
file pith/smime.c, starting around line 3766.
Thank you for any insights.
--
Eduardo
