diff options
| author | FdaSilvaYY <fdasilvayy@gmail.com> | 2019-06-12 19:52:39 +0200 |
|---|---|---|
| committer | Tomas Mraz <tmraz@fedoraproject.org> | 2020-05-27 13:16:30 +0200 |
| commit | 9e3c510bde91350c5a40b7ba4e9e0945895e9368 (patch) | |
| tree | 1720a2cfea2ffded3a4e374e2c6e110f2499dbc4 /doc | |
| parent | f7f53d7d61bba235b8babf4cf580114d74183e3e (diff) | |
crypto/cms: add CAdES-BES signed attributes validation
for signing certificate V2 and signing certificate extensions.
CAdES: lowercase name for now internal methods.
crypto/cms: generated file changes.
Add some CHANGES entries.
[extended tests]
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/8098)
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/man1/openssl-cms.pod.in | 10 | ||||
| -rw-r--r-- | doc/man3/CMS_verify.pod | 10 |
2 files changed, 13 insertions, 7 deletions
diff --git a/doc/man1/openssl-cms.pod.in b/doc/man1/openssl-cms.pod.in index 375d358703..5ef1219a2e 100644 --- a/doc/man1/openssl-cms.pod.in +++ b/doc/man1/openssl-cms.pod.in @@ -569,7 +569,8 @@ Message-digest of the eContent OCTET STRING within encapContentInfo being signed =item * -An ESS signing-certificate or ESS signing-certificate-v2 attribute, as defined in Enhanced Security Services (ESS), RFC 2634 and RFC 5035. +An ESS signing-certificate or ESS signing-certificate-v2 attribute, as defined +in Enhanced Security Services (ESS), RFC 2634 and RFC 5035. An ESS signing-certificate attribute only allows for the use of SHA-1 as a digest algorithm. An ESS signing-certificate-v2 attribute allows for the use of any digest algorithm. @@ -577,9 +578,10 @@ An ESS signing-certificate-v2 attribute allows for the use of any digest algorit The digital signature value computed on the user data and, when present, on the signed attributes. -Note that currently the B<-cades> option applies only to the B<-sign> operation and is ignored during -the B<-verify> operation, i.e. the signing certification is not checked during the verification process. -This feature might be added in a future version. +NOTE that the B<-cades> option applies to the B<-sign> or B<-verify> operations. +With this option, the B<-verify> operation also checks that the signing-certificates +attribute is present, and its value matches the verification trust chain built +during the verification process. =back diff --git a/doc/man3/CMS_verify.pod b/doc/man3/CMS_verify.pod index 159c378b0e..ed289b1aff 100644 --- a/doc/man3/CMS_verify.pod +++ b/doc/man3/CMS_verify.pod @@ -66,10 +66,14 @@ from the content. If the content is not of type B<text/plain> then an error is returned. If B<CMS_NO_SIGNER_CERT_VERIFY> is set the signing certificates are not -verified. +verified, unless CMS_CADES flag is also set. If B<CMS_NO_ATTR_VERIFY> is set the signed attributes signature is not -verified. +verified, unless CMS_CADES flag is also set. + +If B<CMS_CADES> is set, each signer certificate is checked against the +"ESS signing-certificate" extension added in the signed attributes of the +signature. If B<CMS_NO_CONTENT_VERIFY> is set then the content digest is not checked. @@ -122,7 +126,7 @@ L<ERR_get_error(3)>, L<CMS_sign(3)> =head1 COPYRIGHT -Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy |