How to verify detached PKCS7 signature with signtool

0

We have a file, say, scup.jpg, that we want to sign and (later) verify with signtool.

For embedded content we execute

signtool.exe sign /p7 .\ /p7ce embedded /p7co 1.2.840.113549.1.7.2 /a /f .\pfx.p12 /p "somepass" .\scup.jpg

and it produces a file named scup.jpg.p7 that is verifiable with the folowing command:

signtool.exe verify /p7 scup2.jpg.p7

but what we need is not an embedded data, but rather a detached signature, so we change the signing command to

signtool.exe sign /p7 .\ /p7ce DetachedSignedData /p7co 1.2.840.113549.1.7.2 /a /f .\pfx.p12 /p "somepass" .\scup.jpg

and produce a detached signature file also named scup2.jpg.p7, but no matter what command options we try to verify the signature, signtool gives us errors, like tis one:

SignTool Error: CryptVerifyMessageSignature returned error: 0x8009310B
        ASN1 bad tag value met.
SignTool Error: File not valid: scup.jpg.p7

Number of errors: 1

What do we do wrong and is it at all possible to verify a detached signature with signtool? I know I could use openssl or progarmming tools/API, but for the moment I need clarity regarding signtool itelf.

cryptography
digital-signature
asked on Stack Overflow Oct 19, 2017 by Roman Kuznetsov • edited Oct 21, 2017 by Maarten Bodewes

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0