cmssign

Introduce

This tool is used sign file with Cryptographic Message Syntax. And add a Timestamp Reply to the cms file optionally.

Installation

To install using pip,::

python -m pip install --upgrade pip
python -m pip install cmssign

This tool depend on cryptographic and asn1crypto

Notice

The version 0.0.1 have some bug, it should not be used.

History

• 0.0.3 support normal rsa signature

• 0.0.4 add support for RSASSA-PSS signature, but need java because openssl not support pss padding for timestamp signature

Use with GUI

.. code-block:: sh

cmssignui

Use within Command line

cmssign sign

.. code-block:: sh

    Usage: cmssign sign [-h] --cafile CAFILE --cakey CAKEY [--tsca TSACA] [--tskey TSAKEY] --in INFILE [--out OUTFILE]

          -h, --help            show this help message and exit
          --signer CAFILE       signer certificate file, DER format
          --key CAKEY           signer private key
          --signerCA SIGNERCA   CA of signer, DER format
          --signerCRL SIGNERCRL
                                CRL of signer, DER format
          --rootCRL ROOTCRL     CRL of root CA, DER format
          --tssigner TSSIGNER   timestamp signer certificate, DER format
          --tskey TSKEY         timestamp signer private key, DER format
          --tsCA TSCA           CA of timestamp signer, DER format
          --timestamp TIMESTAMP
                                timestamp. use system time if not set. format must be
                                '20220101123000' yyyyMMDDHHMMSS
          --in INFILE           file to sign
          --out OUTFILE         output file, not implement yet, output file will be INFILE.p7s


If the tssigner and tskey is set correctly, the timestamp reply will be add to the unsigned attributes section at the end of the cms file

cmssign combine

This command will add the timestamp reply to the unsigned attributes section at the end of the cms file

.. code-block:: sh

Usage: cmssign combine [-h] --cmsfile CMSFILE --tsfile TSFILE --out OUTFILE

--cmsfile cms file

--tsfile timestamp reply file

--out specific the file to save the output

Example:

.. code-block:: sh

    // Sign file with timestamp
    cmssign sign --signer rootCA.crt --key rootCA.pem --tssigner tsa.crt --tskey tsa.pem --in file_go_sign

    // sign with certificates and crls
    cmssign sign --signer sign.crt --key sign_pri.pem  --signerCRL cacrl.crl --rootCRL rootcrl.crl --tssigner tsa.crt --tskey tsa.pem --tsCA ca.crt --in rootCA.crt

The certificate  only support DER format


Reference
=========

* Cryptographic Message Syntax https://www.rfc-editor.org/rfc/rfc5652.html
* Time-Stamp Protocol https://www.rfc-editor.org/rfc/rfc3161.txt