cmssign 0.0.4

Tool for cms signature

Introduce

This tool is used sign file with Cryptographic Message Syntax. And add a Timestamp Reply to the cms file optionally.

Installation

To install using pip,:

python -m pip install --upgrade pip
python -m pip install cmssign

This tool depend on cryptographic and asn1crypto

Notice

The version 0.0.1 have some bug, it should not be used.

History

• 0.0.3 support normal rsa signature

• 0.0.4 add support for RSASSA-PSS signature, but need java because openssl not support pss padding for timestamp signature

Use with GUI

cmssignui

Use within Command line

cmssign sign

Usage: cmssign sign [-h] --cafile CAFILE --cakey CAKEY [--tsca TSACA] [--tskey TSAKEY] --in INFILE [--out OUTFILE]

      -h, --help            show this help message and exit
      --signer CAFILE       signer certificate file, DER format
      --key CAKEY           signer private key
      --signerCA SIGNERCA   CA of signer, DER format
      --signerCRL SIGNERCRL
                            CRL of signer, DER format
      --rootCRL ROOTCRL     CRL of root CA, DER format
      --tssigner TSSIGNER   timestamp signer certificate, DER format
      --tskey TSKEY         timestamp signer private key, DER format
      --tsCA TSCA           CA of timestamp signer, DER format
      --timestamp TIMESTAMP
                            timestamp. use system time if not set. format must be
                            '20220101123000' yyyyMMDDHHMMSS
      --in INFILE           file to sign
      --out OUTFILE         output file, not implement yet, output file will be INFILE.p7s

If the tssigner and tskey is set correctly, the timestamp reply will be add to the unsigned attributes section at the end of the cms file

cmssign combine

This command will add the timestamp reply to the unsigned attributes section at the end of the cms file

Usage: cmssign combine [-h] --cmsfile CMSFILE --tsfile TSFILE --out OUTFILE

--cmsfile

cms file

--tsfile

timestamp reply file

--out

specific the file to save the output

Example:

// Sign file with timestamp
cmssign sign --signer rootCA.crt --key rootCA.pem --tssigner tsa.crt --tskey tsa.pem --in file_go_sign

// sign with certificates and crls
cmssign sign --signer sign.crt --key sign_pri.pem  --signerCRL cacrl.crl --rootCRL rootcrl.crl --tssigner tsa.crt --tskey tsa.pem --tsCA ca.crt --in rootCA.crt

The certificate only support DER format

Reference

• Cryptographic Message Syntax https://www.rfc-editor.org/rfc/rfc5652.html

• Time-Stamp Protocol https://www.rfc-editor.org/rfc/rfc3161.txt