Subject: [Tools-discuss] Internet Draft Signatures

From: Lars Eggert <[email-masked]>
Date: Wed, 8 Dec 2010 16:46:37 +0200

Hi,

http://www.ietf.org/id-info/idsignatures.html

has these instructions to verify the p7s signatures:

openssl cms -verify -CAfile comodo.pem -content <id-file-name> -inform DER \
   -in <sig-file-name> -out /dev/null

However, openssl does not have a "cms" command on either Mac, FreeBSD or Ubuntu Linux?

Lars

---

From: SM <[email-masked]>
Date: Wed, 08 Dec 2010 07:28:35 -0800

Hi Lars,
>However, openssl does not have a "cms" command on either Mac, 

Support for CMS was added in version 1.0.0.

Regards,
-sm

---

From: Lars Eggert <[email-masked]>
Date: Wed, 8 Dec 2010 21:25:36 +0200

> Support for CMS was added in version 1.0.0.

Ah, good to know. Still, why didn't we use something that had a bit wider tools support? I mean, I tried the most recent versions of MacOS, FreeBSD and Ubuntu, and none of them can be used to verify this out of the box?

Lars

---

From: SM <[email-masked]>
Date: Wed, 08 Dec 2010 15:30:21 -0800

Hi Lars,
At 11:25 08-12-10, Lars Eggert wrote:
>Ah, good to know. Still, why didn't we use something that had a bit 
>wider tools support? I mean, I tried the most recent versions of 
>MacOS, FreeBSD and Ubuntu, and none of them can be used to verify 
>this out of the box?

FreeBSD 8.1 has OpenSSL 0.9.8n.  Version 1.0.0 is in ports.

CMS is a Full Standard (STD 70).  RFC 5485 specifies the conventions 
for digital signatures on Internet-Drafts.

It would have been better to use something that had a bit of wider 
tools support.  Hopefully, the vendors will catch up soon.

Regards,
-sm