Using the Signature Verification Tool

This document describes how to use the evaluation release of the Signature Verification Tool to verify a digital signature generated by the JavaScript method crypto.signText. The Signature Verification Tool is a simple command-line utility that unpacks a base-64-encoded PKCS #7 signed object and verifies the digital signature using standard cryptographic techniques. The Signature Verification Tool can also display the contents of the signed object.

For more information about Netscape form-signing technology, see Netscape Form Signing.

WARNING: Use the Signature Verification Tool at your own risk for evaluation and demonstration purposes only. DO NOT USE THE TOOL FOR PRODUCTION SOFTWARE, because it is currently NOT SUPPORTED. Netscape plans to make signature verification capabilities available in future Netscape products. Therefore, Netscape is interested in your email feedback about the Signature Verification Tool. In addition to suggestions for fixes and enhancements, please let us know the type of applications you are building and the operating system, Internet servers, and development tools you are using. Each message will be reviewed, and we may follow up for further information where required, but we regret that we cannot respond to every message. You may wish to use the DevEdge Security Newsgroup for member-to-member assistance.

Syntax

To run the Signature Verification Tool, type

signVer options

where options can be any sequence of the options listed in the section that follows.

Options

The options available for the Signature Verification Tool are divided into three groups:

File assignments: -i, -d, -s, -o, -D

Signature verification: -v, -V

Signature contents: -A, -C num, -C certNum, -C certNum,field1,...,fieldN, -S all, -S num, -S signerNum, -S signerNum,field1,...,fieldN

These options are defined as follows:

-i sign|data
Assigns stdin to signature or data.

-d dataFileName
Specifies the name of an input file containing data.

-s signatureFileName
Specifies the name of an input file containing a digital signature.

-o outputFileName
Specifies the name of an output file, the default stdout.

-D certDataBaseDir
Specifies the name of the certificate database directory.

-v
Verifies the signed object and displays the result.

-V
Verifies the signed object and displays the result and the reason for failure.

-A
Displays all information from the PKCS #7 signed object.

-C all
Displays all information from all certificates.

-C num
Displays the number of certificates.

-C certNum
Displays all information from the certNum certificate in the PKCS #7 signed object.

-C certNum, field1,...,fieldN
Displays information about specified fields from the certNum certificate in the PKCS #7 signed object.

-S all
Displays the signer information list from the PKCS #7 signed object.

-S num
Display the number of signer information blocks in the PKCS #7 signed object.

-S signerNum
Displays all information from the signerNum signer information block in the PKCS #7 signed object.

-S signerNum, field1,...,fieldN
Displays information about specified fields from the signerNum signer information block in the PKCS #7 signed object.

Important Currently only the i, d, s, o, D, v, V, and A options are fully implemented.

Signed Object Field Names

Values of the signed object fields are displayed in the form fieldName = value, using C-like conventions. Brackets are used to iterate through table elements, and dots are used to define subfields. For example,

pkcs7.digestAlgorithmListLength=1

means that PKCS #7 has one digest algorithm, and

pkcs7.digestAlgorithm[0]=SHA-1

specifies its name as SHA-1.

The following field name is used to display signature verification information:

signatureValid=yes|no[:reason]

Here are some examples of field names and values for a typical signed object returned by the crytpo.signText method:

Field name	Field value
`pkcs7.contentInfo`	`PKCS #7 Signed Data`
`pkcs7.version`	`1 (0x1)`
`pkcs7.digestAlgorithmListLength`	`1`
`pkcs7.digestAlgorithm[0]`	`SHA-1`
`pkcs7.contentInformation`	`PKCS #7 Data`
`pkcs7.data`	`<no content>`
`pkcs7.certificateListLength`	`2`
`certificate[`n`].data.version`	`3 (0x2)`
`certificate[`n`].data.serialNumber`	`192 (0xc0)`
`certificate[`n`].data.signatureAlgorithm`	`PKCS #1 MD5 With RSA Encryption`
`certificate[`n`].data.issuerName`	`CN=FooDept Certificate Server, OU=FooDept., O=MyCo, C=US`
`certificate[`n`].data.validity.notBefore`	`Sat Dec 06 23:03:57 1997`
`certificate[`n`].data.validity.notAfter`	`Thu Jun 04 23:03:57 1998`
`certificate[`n`].data.subject`	`E=jdoe@mycompany.com, CN=Jane Doe, UID=jdoe, C=US`
`certificate[`n`].data.subjectPublicKeyInfo. publicKeyAlgorithm`	`PKCS #1 RSA Encryption`
`certificate[`n`].data.subjectPublicKeyInfo. rsaPublicKey.modulus`	`00:d3:aa:53:2f:3f:6b:55:07:b3:bd:6c:14 :8e:21:03:d1:8b:e6:dc:f1:1f:91:f5:17:c 4:76:94:42:d0:a1:4b:42:ed:1b:68:2e:b2: 29:1a:a5:9f:8a:96:21:d9:09:7a:94:45:70 :9f:f5:b4:86:1d:7b:81:df:3f:3b:eb:08:3 2:d7`
`certificate[`n`].data.subjectPublicKeyInfo. rsaPublicKey.exponent`	`65537 (0x10001)`
`certificate[`n`].data.signedExtensions.name`	`Certificate Type`
`certificate[`n`].data.signedExtensions.data`	`03:02:00:b0`
`certificate[`n`].data.signedExtensions.name`	`Certificate Authority Key Identifier`
`certificate[`n`].data.signedExtensions.data`	`30:16:80:14:97:b1:6d:b2:b6:02:16:54:0c :97:d7:e3:32:6d:cb:9c:df:ee:de:80`
`certificate[`n`].signatureAlgorithm`	`PKCS #1 MD5 With RSA Encryption`
`certificate[`n`].signature`	`14:49:b8:a4:2c:44:8e:4b:19:17:b6:e1:cc :a4:25:4e:4b:85:fa:8c:5b:3f:67:5f:8b:2 9:8c:15:f7:58:51:f7:fd:00:c0:c9:ba:7a: a9:07:82:19:35:8c:10:08:c2:8a:bd:bc:c0 :6e:75:b5:b1:7b:6d:43:03:56:92:aa:91:1 a:51:e9:4e:93:bc:08:41:1d:52:92:5c:b8: e7:4c:01:d8:ac:39:b5:37:b6:1d:5f:78:ef :90:f3:66:17:21:b9:64:bf:41:dd:05:4e:a d:79:48:33:08:0b:ea:4c:f9:e9:16:62:ba: 1d:ae:61:8c:1e:75:00:1a:c5:b1:45:08:76 :ef`
`signerInformation[`n`].version`	`1 (0x1)`
`signerInformation[`n`].issuerName`	`CN=FooDept Certificate Server, OU=FooDept., O=MyCo, C=US`
`signerInformation[`n`].serialNumber`	`192 (0xc0)`
`signerInformation[`n`].digestAlgorithm`	`SHA-1`
`signerInformation[`n`].authenticatedAttributes`	`4`
`signerInformation[`n`].attribute[0].type`	`PKCS #9 Content Type`
`signerInformation[`n`].attribute[0].value[0]`	`PKCS #7 Data`
`signerInformation[`n`].attribute[1].type`	`PKCS #9 Signing Time`
`signerInformation[`n`].attribute[1].value[0]`	`Fri Dec 12 03:42:56 1997`
`signerInformation[`n`].attribute[2].type`	`PKCS #9 S/MIME Capabilities`
`signerInformation[`n`].attribute[2].value[0]`	`(encoded)30:0f:30:0d:06:08:2a:86:48:86 :f7:0d:03:02:02:01:28`
`signerInformation[`n`].attribute[3].type`	`PKCS #9 Message Digest`
`signerInformation[`n`].attribute[3].value[0]`	`4b:11:47:a1:a0:eb:d7:4b:09:37:16:10:6a :75:54:4d:5b:71:a1:7a`
`signerInformation[`n`].digestEncryptionAlgorithm`	`PKCS #1 RSA Encryption`
`signerInformation[`n`].encryptedDigest`	`cd:7e:7e:2f:20:50:5a:55:26:ae:60:cd:6c :40:b9:d3:a5:a4:c5:53:2d:71:6a:16:74:7 5:1d:bb:5a:e2:bc:79:d5:48:3e:25:9d:8f: 58:3c:71:a8:90:79:b2:47:62:e3:ec:82:06 :bb:f0:42:ad:8a:c5:03:64:71:ea:6c:42:e b`

Examples

Last Updated: 07/09/98 10:44:56

Any sample code included above is provided for your use on an "AS IS" basis, under the Netscape License Agreement - Terms of Use

`-i sign\|data`	Assigns `stdin` to signature or data.
`-d` dataFileName	Specifies the name of an input file containing data.
`-s` signatureFileName	Specifies the name of an input file containing a digital signature.
`-o` outputFileName	Specifies the name of an output file, the default `stdout.`
`-D` certDataBaseDir	Specifies the name of the certificate database directory.
`-v`	Verifies the signed object and displays the result.
`-V`	Verifies the signed object and displays the result and the reason for failure.
`-A`	Displays all information from the PKCS #7 signed object.
`-C all`	Displays all information from all certificates.
`-C num`	Displays the number of certificates.
`-C certNum`	Displays all information from the `certNum` certificate in the PKCS #7 signed object.
`-C certNum,` field1`,...,`fieldN	Displays information about specified fields from the `certNum` certificate in the PKCS #7 signed object.
`-S all`	Displays the signer information list from the PKCS #7 signed object.
`-S num`	Display the number of signer information blocks in the PKCS #7 signed object.
`-S signerNum`	Displays all information from the `signerNum` signer information block in the PKCS #7 signed object.
`-S signerNum,` field1`,...,`fieldN	Displays information about specified fields from the `signerNum` signer information block in the PKCS #7 signed object.