On Thu, May 23, 2013, Phillip Hellewell wrote: > Attached is a really old (circa 2000) file called "ieexcep.cat". Windows > recognizes it as a "Security Catalog Information". It is a weird file > because it is like a mix of a cert chain (.p7b) and a signature (.p7s). > > The d2i_PKCS7_bio() succeeds on it, but d2i_CMS_bio() does not. This is > the only file I have that PKCS7 will parse but not CMS. > > Is there a specific reason why CMS cannot / should not work on this file? > Is it safe to say that although it is valid PKCS7, it is not valid CMS, or > is it not really a valid PKCS7 either? > > The reason I bring all this up is I was hoping to refactor all my code to > use CMS instead of PKCS7; I would rather not have to do both (i.e., try > CMS, then try PKCS7 if CMS doesn't work). >
This an incompatibility between CMS and PKCS#7 where the encapsulated type is not data. Under PKCS#7 the type appears in encoded form, under CMS the encoding is embedded in the content octets of an OCTET STRING. This is very rarely encountered in practice. The only time I've ever come across it is in Windows authenticode signatures. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
