The output from CSSM_SignData is not asn1 encoded. You would have to do
that yourself. The data is ready to be put into an asn1 encoding however.
You didn't mention what you are passing for the algorithm argument to
CreateSignatureContext. I would assume you are using
CSSM_ALGID_SHA1WithRSA?
Since you are going to need to use the private key to sign with, you must
get credentials and pass them to CreateSignatureContext. Use something like
this:
SecKeyRef pk = [self getPrivateKey];
rv = SecKeyGetCredentials(pk, CSSM_ACL_AUTHORIZATION_SIGN,
kSecCredentialTypeDefault, outCreds);
getPrivateKey just gets the certificate's private key ref.
Paul Nelson
Thursby Software Systems, Inc.
> From: Cole Barnes <email@hidden>
> Date: Thu, 11 May 2006 12:01:38 -0500
> To: Apple CDSA <email@hidden>
> Subject: digital signatures
>
> I'm writing a program to generate digital signatures. As a
> requirement, the end product MUST be a PKCS7 signature. So, I have a
> few questions.
>
> 1:) What little documentation I've found has pointed me toward using
> the CSSM APIs. For example, the CSSM_CSP_CreateSignatureContext and
> CSSM_SignData functions used to generate a signature. This procedure
> will return a raw signature, but because of requirements I need a
> PKCS7 signature. Are there any higher level calls or any built-in
> APIs for generating P7 signatures? Or will I need to use that raw
> signature and construct a P7 myself?
>
> 2:) When I use the method above, I get a
> CSSMERR_CSP_OPERATION_AUTH_DENIED (0x80010820) error when trying to
> use private keys from my keychain. My best guess is that this is
> caused by the fact that I'm passing in NULL for the
> CSSM_ACCESS_CREDENTIALS parameter in CSSM_CSP_CreateSignatureContext.
> Do I need to build this credential structure myself or is it returned
> by some function that I'm not aware of?
>
> I haven't found much *useful* documentation on this subject, so if any
> of you can point me in the right direction, I would be eternally
> greatful.
>
> -Thanks
> Cole
> _______________________________________________
> Do not post admin requests to the list. They will be ignored.
> Apple-cdsa mailing list (email@hidden)
> Help/Unsubscribe/Update your Subscription:
> http://lists.apple.com/mailman/options/apple-cdsa/email@hidden
>
> This email sent to email@hidden
>
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Apple-cdsa mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/apple-cdsa/email@hidden
This email sent to email@hidden
