verify singed data (with pkcs7 standard) #6413
Description
Hi everyone!
I have a message that i signed with pkcs7/cms format.
i read in Doc and i used:
from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.serialization import pkcs7
cert = x509.load_pem_x509_certificate(ca_cert)
key = serialization.load_pem_private_key(ca_key, None)
options = [pkcs7.PKCS7Options.DetachedSignature]
pkcs7.PKCS7SignatureBuilder().set_data(
b"data to sign"
).add_signer(
cert, key, hashes.SHA256()
).sign(
serialization.Encoding.DER, options
)
b'...'
i created .cms file and i can parse it by openssl command line.
Now, i want to verify the signature. i extract the signature from the cms file (by asn1crypyo lib)
i saw this:
public_key = private_key.public_key()
public_key.verify(
signature,
message,
padding.PSS(
mgf=padding.MGF1(hashes.SHA256()),
salt_length=padding.PSS.MAX_LENGTH
),
hashes.SHA256()
)
but i cant verify .. thow exception that the signature is invalid..
i succeed to run opemssl command:
"openssl cms -verify -inform DER -in file.cms -content text.txt -certfile file.cert.pem -noverify"
someone can help me how to verify this?