parsing PKCS#7 returnedy by ICertAdmin2::GetArchivedKey in .NET -- dotnet security

dotnet security : parsing PKCS#7 returnedy by ICertAdmin2::GetArchivedKey in .NET

Sengul Vurgun
7/9/2004 1:47:42 PM

I am trying to parse the PKCS#7 package returned by
ICertAdmin2::GetArchivedKey method of certadm.dll in .NET using runtime
callable wrappers. I tried using CAPICOM's SignedDataClass but I couldn't
get it working. When I try to access the certificates, I get "Message has
not been signed" error. Do you know how to (or have example code to) parse
PKCS#7 .NET?

Thanks.

Joe Kaplan (MVP - ADSI)
7/9/2004 9:33:01 PM

Mitch has a cool sample doing p/invoke to the crypto API in C# that shows
how to get the certs and authenticated attributes on a PKCS#7 Signed Data
message here:

http://www.jensign.com/JavaScience/dotnet/AuthAttr/index.html

This should be much easier in future versions of the Framework.

Joe K.

[quoted text, click to view]

Nicole
7/12/2004 3:56:32 AM

Thanks for the link. Now I can see the certificates but I can't seem to get
to the private key. MS documentation says key archival blob should have the
following format. I don't know how Crypto API works. Which field should I
look into to get the private key ?

The recovery blob consists of wrapping the encrypted PKCS#7 in the database
in another (signed) PKCS#7 to allow a number of certificates to be included
in the recovery blob. The returned certificates include the full chain of
the user certificate being recovered, the chain of the signing CA
certificate (which may differ from the CA certificate under which the user
certificate was issued), and the KRA certificates to which the key was
encrypted. The szOID_ARCHIVED_KEY_CERT_HASH(1.3.6.1.4.1.311.21.16) is an
attribute containing the SHA-1 hash of the cert for the key being recovered,
attached as an authenticated attribute to the CA signature of the recovery
blob.

Thanks.

[quoted text, click to view]

Joe Kaplan (MVP - ADSI)
7/12/2004 1:56:44 PM

I followed up with someone else on this via email, but here was my response:

--------------
I'm not sure I can help you with this. I'm not really a big PKCS#7 expert,
so I'm not sure what I would expect to see here. Normally you wouldn't have
a private key in a signed data blob, but just an encrypted hash value that
you decrypt with the public key from the enclosed signing cert. If the
private key is in the underlying data that was signed, that would be oqaque
to the signed data message.

I'd suggest posting your question back to the newsgroup directly. Also, you
might try contact Mitch Gallant directly or through the newsgroup as he is
the true expert in crypto API and .NET integration. That was his sample you
were using there.

HTH,

Joe

[quoted text, click to view]

Michel Gallant
7/12/2004 9:50:10 PM

It sounds like the recovery blob is simply a pkcs#7 signature (with lots of
certs) wrapping an encrypted PKCS#7 data blob which *could* be a simple
EnvelopedData blob (where the archived key blob is encrypted with a random,
symmetric key, and that symmetric key is then encrypteded with public RSA key
of KRA). Not sure if that is what is meant by:
"An archived key is encrypted in a PKCS #7 to the key recovery agent certificate .."
You could try retrieving the signed content, and check if the content blob is then
an EnvelopedData type.
There might be other possibilities.
Also, it isn't clear if the unencrypted keyblob is actually the usual CryptoAPI
PRIVATEKEYBLOB. Maybe some MS folks can help clarify their documentation :-)

Cheers,
- Mitch Gallant

[quoted text, click to view]

Michel Gallant
7/12/2004 10:02:55 PM

see also this recent thread:
http://groups.google.com/groups?th=3aa721bfa6cae922
- Mitch

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about dotnet security

home · blog · groups

Questions? Comments? Contact the dn