Sign the XML content with PKCS7 signer in CPI

former_member814241 · ‎2023 Mar 16

Hi,

I have the scenario that I need to Sign the complete XML message using PKCS7 Standard algorithm with attachment mode and the signed content should be converted to base 64.

I tried using the scenario in the iflow in CPI, but i did not get the correct ouput. Kindly help me with the scenario.

Regards,

Nisha.

former_member814241 · ‎2023 Apr 06

Hi Carlos,

Thank you for your information. But this blog says the input is encrypted and they are going to decrypt. But I am getting the input as XML and I need to sgin the whole xml messages.Kindly help me with that.

Regards,

Nisha.

CarlosRoggan · ‎2023 Mar 22

Hello Nisha,

If I understand correctly:
- you have a message with xml content
- you want to create a digital signature and place it into the xml content

Right?
As far as I know, this is not compliant with the PKCS#7 or CMS standard, where the content and the security artifacts are stored in a CMS-structure.
Which would mean that the PKCS#7/CMS Signer in CPI cannot help you here.

You would need to implement it yourself in a groovy script.

There was a similar requirement in the past and Sunny created a blog post:
https://blogs.sap.com/2018/12/24/how-to-encryptdecrypt-xml-payload-with-aes256-cbc-and-rsa-algorithm...

Does that help?

Kind Regards,
Carlos

former_member814241 · ‎2023 Mar 20

The above one is the required output.

Regards,

Nisha.

CarlosRoggan · ‎2023 Mar 16

Hello Nisha,

thank you for the description of a scenario that might become interesting.

From what I see in the screenshots, you're referring with "attachment mode" to the normal signedData structure where the content is present (not the "external Signature" case, where the content is sent elsewhere)
As such, the signer creates a digital signature and packs it together with the plaintext content into a cms structure with binary data. This can be encoded to base64.

For me that looks correct, wrt spec: https://www.rfc-editor.org/rfc/rfc5652

Could you please kindly clarify, what would be the expected correct output?

Kind Regards,
Carlos

CarlosRoggan · ‎2023 Mar 16

Hello Nisha,

thank you for the description of a scenario that might become interesting.

From what I see in the screenshots, you're referring with "attachment mode" to the normal signedData structure where the content is present (not the "external Signature" case, where the content is sent elsewhere)
As such, the signer creates a digital signature and packs it together with the plaintext content into a cms structure with binary data. This can be encoded to base64.

For me that looks correct, wrt spec: https://www.rfc-editor.org/rfc/rfc5652

Could you please kindly clarify, what would be the expected correct output?

Kind Regards,
Carlos

Sign the XML content with PKCS7 signer in CPI

Know the answer?

Need more details?

Accepted Solutions (0)

Answers (5)

Answers (5)