RE: PKCS_7_ASN_ENCODING on Windows CE 5.0

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Thanks for the response.

This tells that PKCS7 certificates can be installed on Windows CE 5.0.

My question is at the API level.

Do the certificate APIs on Windows CE support PKCS_7_ASN_ENCODING ?
--
sjain06


"Bryan" wrote:

Does this help:

http://msdn2.microsoft.com/en-us/library/ms883689.aspx

"sjain06" wrote:

Hi,

I am working on the Crypto API on Windows CE 5.0 platform.
I have a data file and a seperate .sig file containing its digital signature
and two certificates that chain to the root certificate. This .sig file is of
the pkc7 format.

I am trying to validate the data file is signed by that digital signature as
a first step. Ultimately, I have to validate that the digital signature
chains to the root
certificate that I have in a 3rd file.

I am trying to use CryptVerifySignature for validating the digital signature.

Here is what I have done so far:

1) CryptAcquireContext
2) CryptCreateHash
3) Read in the data file and add data to the hash object using CryptHashData.
4) From the .sig file, extract the digital signature and the first
certificate that contains the public key.

It is done in the following way:

HCRYPTMSG hMsg;

hMsg = CryptMsgOpenToDecode(
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, // Encoding type
0, // Flags
0,
0,
NULL, // Recipient information
NULL))

//Read in the .sig file and pass a pointer to the buffer below.
CryptMsgUpdate(
hMsg, // Handle to the message
pbSignature, // Pointer to the encoded BLOB
cbEncodedBlob, // Size of the encoded BLOB
TRUE)

//Extract the digital signature from the encoded blob
CryptMsgGetParam(
hMsg, // Handle to the message
CMSG_ENCRYPTED_DIGEST, // Parameter type
0, // Index
pDigitalSig // Address for returned
// information
&dwDigSigSize)

//Extract the first certificate from the encoded blob
CryptMsgGetParam(
hMsg, // Handle to the message
CMSG_CERT_PARAM, // Parameter type
0, // Index
pFirstCert, // Address for returned
// information
&dwFirstCertSize))

CERT_INFO * pFirstCertStruct = (CERT_INFO *) pFirstCert;

5) Now, I have a pointer to the certificate. I have to create a handle to
the public key using CryptImportKey.

When I try get the public key of this certificate from pFirstCertStruct, it
seems to be uninitialized.
Do I have to create a certificate context using the certificate and then
extract the public key from it to be passed to CryptImportKey?

For creating the certificate context, I have to pass the encoding type to
it. In my case, the encoding is PKCS_7_ASN_ENCODING.
However, the documentation for the certificate APIs on Windows CE 5.0
suggests that currently, only X509_ASN_ENCODING is used. A call to
CertCreateCertificateContext with PKCS_7_ASN_ENCODING returned NULL.

Is there any other way this can be achieved in Windows CE 5.0?

I am also looking at using the "CryptMsgControl" API alternatively for
validating the signature.
Do I need to create the certificate context before passing in the CERT_INFO
pointer to CryptMsgControl API also?

--
sjain06
.

Relevant Pages

  • Manual selection of a certificate from the certificate store?
    ... Windows XP contain an API that pops ... up a window allowing the user to manually select a certificate from the ... I cannot accomplish same in Windows 2000. ... doo do doo do doo do do doo. ...
    (microsoft.public.win2000.security)
  • Re: Certificate Import Wizard - API?
    ... but there is a PFX Import API that does not open the wizard. ... user assign a server certificate. ... Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers. ...
    (microsoft.public.platformsdk.security)
  • Re: The OpenSSL API
    ... The SSL protocol takes care of the low level details. ... gory details because he needs to make sure the certificate the client ... and you'll see no simple API ... OpenSSL can't know what my certificate validation rules are. ...
    (comp.os.linux.networking)
  • RE: Adding a publisher to the trusted publishers w/o UI
    ... Just to say that adding a certificate to the root store using the API ... CertAddEncodedCertificateToStore will also show a warning UI. ...
    (microsoft.public.platformsdk.security)
  • Re: API for exprot certificate?
    ... But PFXExportCertStoreEx/PFXImportCertStore is not ... is there any other API for this ... >export/import certificates and, if available, their ... we can use certificate export wizard to ...
    (microsoft.public.platformsdk.security)