Hi! Yeah an old mail from your but let me explain the problem:
On Tue, 1 Oct 2024 17:40, Albrecht Dreß said:
> I stumbled over a S/MIME signed message where gpgsm seems to be unable
> to extract the signers and to verify the signature. Using the
> attached signature blob and a dummy “message” part, gpgsm says just
>
> <snip>
> $ gpgsm --debug-level basic --verify SIG.bin dummy.txt
> gpgsm: enabled debug flags: ipc
> gpgsm: enabled compatibility flags:
> gpgsm: detached signature
> secmem usage: 0/16384 bytes in 0 blocks
> </snip>
This signature is a certificate-only message:
$ ~/b/libksba/tests/t-cms-parser SIG.bin
*** checking `SIG.bin' ***
identified as: signed data
stop reason: 2
ContentType: 1.2.840.113549.1.7.2
stop reason: 3
EncapsulatedContentType: 1.2.840.113549.1.7.1
DigestAlgorithms: 2.16.840.1.101.3.4.2.1
Detached signature
stop reason: 6
this is a certs-only message
*** all checks done
This is a dump of your signature
0 1294: SEQUENCE {
4 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
15 1279: [0] {
19 1275: SEQUENCE {
23 1: INTEGER 1
26 15: SET {
28 13: SEQUENCE {
30 9: OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
41 0: NULL
: }
: }
43 11: SEQUENCE {
45 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: }
56 869: [0] {
60 865: SEQUENCE {
64 457: SEQUENCE {
68 3: [0] {
70 1: INTEGER 2
: }
[...]
And here is a proper detached signature:
0 NDEF: SEQUENCE {
2 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
17 1: INTEGER 1
20 13: SET {
22 11: SEQUENCE {
24 9: OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
: }
: }
35 11: SEQUENCE {
37 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: }
48 8613: [0] {
52 1965: SEQUENCE {
56 1429: SEQUENCE {
60 3: [0] {
62 1: INTEGER 2
: }
[...]
Your signature is missing the part of the signature which is in the
proper signature from offset 17..47. Instead it starts off directly
with the list of certificates indicated by a context tag 0 at offset 15
which starts in the proper signature at offset 35
What we should do is to print a message that this is a cert-only
signature in the same way the LibKSBA test tool does it.
Shalom-Salam,
Werner
--
The pioneers of a warless world are the youth that
refuse military service. - A. Einstein
openpgp-digital-signature.asc
Description: PGP signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org https://lists.gnupg.org/mailman/listinfo/gnupg-users
