How to create a PKCS7 signedData structure with openssl or any other library with a signature on a smart card?

Question

I need to create a PKCS7 signed structure with a signature made on a smart card. This is almost what the PKCS7_sign function opens, other than signing. Perhaps someone can advise something for this question, that is, how to do it using openssl or any other cross-platform c / C ++ library. Regarding openssl, it seems that the PKCS7_PARTIAL or PKCS7_STREAM flags of the PKCS7_sign function may be useful. If I use any of these flags, I can get an almost complete PKCS7 structure. In this case, the structure is filled, except that it does not contain “data” and “sign”. Therefore, I only need to add these elements. But I did not find a way to do this. Somebody knows?

Answer 1

Usually you do not want (or are technically blocked) to retrieve the private key from the smart card. Since this is a kind of smart card point, it is a bit cryptographic memory and a connected processor that never disclose your private key.

So, instead, you need to ask the chip card to make a nice signing for you.

OpenSSL can do this, but you need to know how to talk to the chip card. This is usually done using the "engine". Most often, pkcs # 11 # 15 is used for this - along with a driver for chip cards (readers).

Usually you need to get the slot and key identifiers:

# Extracting slot, auth ids and key id for later use/reference # set `pkcs11-tool --module /usr/lib/opensc-pkcs11.so --list-slots | grep Slot | grep SCM` SLOT=$2 set `pkcs15-tool --list-keys | grep ID` AID=$4 KID=$7 

Then you can do "things" on the map:

 /usr/bin/openssl << EOM engine dynamic -pre SO_PATH:/Library/OpenSC/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:opensc-pkcs11.so XXX -engine pkcs11 -b-key slot_$SLOT-id_$KID -keyform engine .... EOM 

One such thing might be signing pkcs7. From the code - pretty much do the same thing. I usually use the app / util stuf application from the openssl it apps directory to make life a little easier.