@@ -1254,6 +1254,154 @@ contain certificates, CRLs, and much more. PKCS7 files commonly have a ``p7b``,
1254
1254
:returns bytes: The signed PKCS7 message.
1255
1255
1256
1256
1257
+ .. function :: pkcs7_verify_der(data, content, certificate, options)
1258
+
1259
+ .. versionadded :: 45.0.0
1260
+
1261
+ .. doctest ::
1262
+
1263
+ >>> from cryptography import x509
1264
+ >>> from cryptography.hazmat.primitives import hashes, serialization
1265
+ >>> from cryptography.hazmat.primitives.serialization import pkcs7
1266
+ >>> cert = x509.load_pem_x509_certificate(ca_cert)
1267
+ >>> key = serialization.load_pem_private_key(ca_key, None )
1268
+ >>> signed = pkcs7.PKCS7SignatureBuilder().set_data(
1269
+ ... b " data to sign"
1270
+ ... ).add_signer(
1271
+ ... cert, key, hashes.SHA256()
1272
+ ... ).sign(
1273
+ ... serialization.Encoding.DER , []
1274
+ ... )
1275
+ >>> pkcs7.pkcs7_verify_der(signed, None , cert, [])
1276
+
1277
+ Deserialize and verify a DER-encoded PKCS7 signed message. PKCS7 (or S/MIME) has multiple
1278
+ versions, but this supports a subset of :rfc: `5751 `, also known as S/MIME Version 3.2. If the
1279
+ verification succeeds, does not return anything. If the verification fails, raises an exception.
1280
+
1281
+ :param data: The data, encoded in DER format.
1282
+ :type data: bytes
1283
+
1284
+ :param content: if specified, the content to verify against the signed message. If the content
1285
+ is not specified, the function will look for the content in the signed message.
1286
+ :type data: bytes or None
1287
+
1288
+ :param certificate: A :class: `~cryptography.x509.Certificate ` to verify against the signed
1289
+ message.
1290
+
1291
+ :param options: A list of
1292
+ :class: `~cryptography.hazmat.primitives.serialization.pkcs7.PKCS7Options `. For
1293
+ this operation, no options are supported as of now.
1294
+
1295
+ :raises ValueError: If the recipient certificate does not match any of the signers in the
1296
+ PKCS7 data.
1297
+
1298
+ :raises ValueError: If no content is specified and no content is found in the PKCS7 data.
1299
+
1300
+ :raises ValueError: If the PKCS7 data is not of the signed data type.
1301
+
1302
+
1303
+ .. function :: pkcs7_verify_pem(data, content, certificate, options)
1304
+
1305
+ .. versionadded :: 45.0.0
1306
+
1307
+ .. doctest ::
1308
+
1309
+ >>> from cryptography import x509
1310
+ >>> from cryptography.hazmat.primitives import hashes, serialization
1311
+ >>> from cryptography.hazmat.primitives.serialization import pkcs7
1312
+ >>> cert = x509.load_pem_x509_certificate(ca_cert)
1313
+ >>> key = serialization.load_pem_private_key(ca_key, None )
1314
+ >>> signed = pkcs7.PKCS7SignatureBuilder().set_data(
1315
+ ... b " data to sign"
1316
+ ... ).add_signer(
1317
+ ... cert, key, hashes.SHA256()
1318
+ ... ).sign(
1319
+ ... serialization.Encoding.PEM , []
1320
+ ... )
1321
+ >>> pkcs7.pkcs7_verify_pem(signed, None , cert, [])
1322
+
1323
+ Deserialize and verify a PEM-encoded PKCS7 signed message. PKCS7 (or S/MIME) has multiple
1324
+ versions, but this supports a subset of :rfc: `5751 `, also known as S/MIME Version 3.2. If the
1325
+ verification succeeds, does not return anything. If the verification fails, raises an exception.
1326
+
1327
+ :param data: The data, encoded in PEM format.
1328
+ :type data: bytes
1329
+
1330
+ :param content: if specified, the content to verify against the signed message. If the content
1331
+ is not specified, the function will look for the content in the signed message.
1332
+ :type data: bytes or None
1333
+
1334
+ :param certificate: A :class: `~cryptography.x509.Certificate ` to verify against the signed
1335
+ message.
1336
+
1337
+ :param options: A list of
1338
+ :class: `~cryptography.hazmat.primitives.serialization.pkcs7.PKCS7Options `. For
1339
+ this operation, no options are supported as of now.
1340
+
1341
+ :raises ValueError: If the PEM data does not have the PKCS7 tag.
1342
+
1343
+ :raises ValueError: If the recipient certificate does not match any of the signers in the
1344
+ PKCS7 data.
1345
+
1346
+ :raises ValueError: If no content is specified and no content is found in the PKCS7 data.
1347
+
1348
+ :raises ValueError: If the PKCS7 data is not of the signed data type.
1349
+
1350
+
1351
+ .. function :: pkcs7_verify_smime(data, content, certificate, options)
1352
+
1353
+ .. versionadded :: 45.0.0
1354
+
1355
+ .. doctest ::
1356
+
1357
+ >>> from cryptography import x509
1358
+ >>> from cryptography.hazmat.primitives import hashes, serialization
1359
+ >>> from cryptography.hazmat.primitives.serialization import pkcs7
1360
+ >>> cert = x509.load_pem_x509_certificate(ca_cert)
1361
+ >>> key = serialization.load_pem_private_key(ca_key, None )
1362
+ >>> signed = pkcs7.PKCS7SignatureBuilder().set_data(
1363
+ ... b " data to sign"
1364
+ ... ).add_signer(
1365
+ ... cert, key, hashes.SHA256()
1366
+ ... ).sign(
1367
+ ... serialization.Encoding.SMIME , []
1368
+ ... )
1369
+ >>> pkcs7.pkcs7_verify_smime(signed, None , cert, [])
1370
+
1371
+ Verify a PKCS7 signed message stored in a MIME message, by reading it, extracting the content
1372
+ (if any) and signature, deserializing the signature and verifying it against the content. PKCS7
1373
+ (or S/MIME) has multiple versions, but this supports a subset of :rfc: `5751 `, also known as
1374
+ S/MIME Version 3.2. If the verification succeeds, does not return anything. If the verification
1375
+ fails, raises an exception.
1376
+
1377
+ :param data: The data, encoded in MIME format.
1378
+ :type data: bytes
1379
+
1380
+ :param content: if specified, the content to verify against the signed message. If the content
1381
+ is not specified, the function will look for the content in the MIME message and in the
1382
+ signature.
1383
+ :type data: bytes or None
1384
+
1385
+ :param certificate: A :class: `~cryptography.x509.Certificate ` to verify against the signed
1386
+ message.
1387
+
1388
+ :param options: A list of
1389
+ :class: `~cryptography.hazmat.primitives.serialization.pkcs7.PKCS7Options `. For
1390
+ this operation, no options are supported as of now.
1391
+
1392
+ :raises ValueError: If the MIME message is not a S/MIME signed message: content type is
1393
+ different than ``multipart/signed `` or ``application/pkcs7-mime ``.
1394
+
1395
+ :raises ValueError: If the MIME message is a malformed ``multipart/signed `` S/MIME message: not
1396
+ multipart, or multipart with more than 2 parts (content & signature).
1397
+
1398
+ :raises ValueError: If the recipient certificate does not match any of the signers in the
1399
+ PKCS7 data.
1400
+
1401
+ :raises ValueError: If no content is specified and no content is found in the PKCS7 data.
1402
+
1403
+ :raises ValueError: If the PKCS7 data is not of the signed data type.
1404
+
1257
1405
.. class :: PKCS7EnvelopeBuilder
1258
1406
1259
1407
The PKCS7 envelope builder can create encrypted S/MIME messages,
0 commit comments