CMS Component

Properties   Methods   Events   Config Settings   Errors  

The CMS component is used to digitally sign, encrypt, verify, and decrypt data.

Syntax

nsoftware.IPWorksEncrypt.Cms

Remarks

The CMS component implements the Cryptographic Message Syntax and allow for various cryptographic operations to be performed on data including:

• Sign
• VerifySignature
• Encrypt
• Decrypt
• SignAndEncrypt
• DecryptAndVerifySignature

The component can generate and consume message in a variety of formats including PEM, DER (Binary), and SMIME. The EncryptionAlgorithm and SignatureHashAlgorithm are fully configurable and support a variety of industry standard encryption and hash algorithms.

The component supports additional functionality such as Compression, OAEP, and PSS. The GetRecipientInfo and GetSignerCertInfo methods as well as the RecipientInfo and SignerCertInfo events allow for a dynamic and flexible approach to message processing. Certificate may be loaded ahead of time or as-needed from the events.

Signing Notes

OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. IncludeCertificates specifies whether the public certificate is included in the signed message. Additional settings allow further configuration. The following properties are applicable when calling this method:

• Certificates (required)
• DetachedSignature
• EnableCompression
• GenerateSignatureTimestamp
• IncludeCertificates
• OutputFormat
• SignatureHashAlgorithm
• UsePSS

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Sign and Verify a message Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - DER Output Format Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.OutputFormat = "DER"; cms.Sign(); byte[] signedMessage = cms.OutputMessageB; //Binary output cms = new Cms(); cms.InputMessageB = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - Detached Signature Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.DetachedSignature = true; cms.Sign(); string signature = cms.OutputMessage; cms = new Cms(); cms.InputMessage = "My Data"; cms.DetachedSignatureData = signature; cms.DetachedSignature = true; cms.VerifySignature(); Sign and Verify a message - Multiple Signatures Cms cms = new Cms(); cms.InputMessage = "My Data"; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test2.pfx", "password2", "*")); cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - No Included Certificate Cms cms = new Cms(); cms.InputMessage = "My Data"; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.IncludeCertificates = CmsIncludeCertificates.icsNone; cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.OnSignerCertInfo += (s, e) => { Console.WriteLine(e.Issuer); Console.WriteLine(e.SerialNumber); if (e.Issuer == "CN=100") //Identify the certificate to load based on event params { //Load the correct signer certificate. cms.SignerCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); } }; cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage;

Encryption Notes

OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. Additional settings allow further configuration. The following properties are applicable when calling this method:

• RecipientCerts (required)
• EncryptionAlgorithm
• OutputFormat
• UseOAEP

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Encrypt and Decrypt a message Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt a message - DER Output Format Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.OutputFormat = "DER"; cms.Encrypt(); byte[] encryptedMessage = cms.OutputMessageB; //Binary output cms = new Cms(); cms.InputMessageB = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt - Multiple Recipients Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test2.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt - Get Recipient Info Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; //If the recipient certificate is not known ahead of time the GetRecipientInfo method may be called //to find information about the certificate. cms = new Cms(); cms.InputMessage = encryptedMessage; cms.OnRecipientInfo += (s, e) => { Console.WriteLine(e.SerialNumber); Console.WriteLine(e.Issuer); if (e.Issuer == "CN=100") //Identify the certificate to load based on event params { cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); } }; cms.GetRecipientInfo(); cms.Decrypt(); string plaintextMessage = cms.OutputMessage;

Signature Verification Notes

In order to perform signature verification the public signer's certificate must be present or explicitly specified. In many cases the certificate itself is included in the input message and a certificate does not need to explicitly be set. If a certificate does need to be set for signature verification the certificate may be specified by calling AddRecipientCert or setting RecipientCerts.

When this method is called the SignerCertInfo event fires once for each signature on the message. This event provides details about the signer certificate, as well as the signer certificate itself (if present). The information provided via SignerCertInfo may be used to load an appropriate certificate for verification from within the event. If the CertEncoded parameter of SignerCertInfo is populated the certificate required for verification is already present in the message.

The following property are applicable when calling this method:

• DetachedSignature
• DetachedSignatureData
• EnableCompression
• SignerCerts

If the input message is a detached signature, the original data that was signed must be specified in DetachedSignatureData. In addition the DetachedSignature property must be set to True to instruct the component to treat the input message as a detached signature.

If the input message is compressed EnableCompression must be set to True before calling this method.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Sign and Verify a message Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - DER Output Format Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.OutputFormat = "DER"; cms.Sign(); byte[] signedMessage = cms.OutputMessageB; //Binary output cms = new Cms(); cms.InputMessageB = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - Detached Signature Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.DetachedSignature = true; cms.Sign(); string signature = cms.OutputMessage; cms = new Cms(); cms.InputMessage = "My Data"; cms.DetachedSignatureData = signature; cms.DetachedSignature = true; cms.VerifySignature(); Sign and Verify a message - Multiple Signatures Cms cms = new Cms(); cms.InputMessage = "My Data"; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test2.pfx", "password2", "*")); cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - No Included Certificate Cms cms = new Cms(); cms.InputMessage = "My Data"; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.IncludeCertificates = CmsIncludeCertificates.icsNone; cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.OnSignerCertInfo += (s, e) => { Console.WriteLine(e.Issuer); Console.WriteLine(e.SerialNumber); if (e.Issuer == "CN=100") //Identify the certificate to load based on event params { //Load the correct signer certificate. cms.SignerCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); } }; cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage;

Decryption Notes

Decrypt decrypts the input data with the specified certificate. Certificates are specified by calling AddCertificate or setting the Certificates property.

If the certificate used to encrypt the message is not known ahead of time GetRecipientInfo may be called prior to calling Decrypt to obtain information about the recipient (the entity the for which the message was encrypted). If GetRecipientInfo is called, the RecipientInfo event is fired with information about the recipient which may be used to load an appropriate decryption certificate.

The following properties are applicable when calling this method:

• Certificates (Required)

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Encrypt and Decrypt a message Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt a message - DER Output Format Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.OutputFormat = "DER"; cms.Encrypt(); byte[] encryptedMessage = cms.OutputMessageB; //Binary output cms = new Cms(); cms.InputMessageB = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt - Multiple Recipients Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test2.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt - Get Recipient Info Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; //If the recipient certificate is not known ahead of time the GetRecipientInfo method may be called //to find information about the certificate. cms = new Cms(); cms.InputMessage = encryptedMessage; cms.OnRecipientInfo += (s, e) => { Console.WriteLine(e.SerialNumber); Console.WriteLine(e.Issuer); if (e.Issuer == "CN=100") //Identify the certificate to load based on event params { cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); } }; cms.GetRecipientInfo(); cms.Decrypt(); string plaintextMessage = cms.OutputMessage;

Property List

The following is the full list of the properties of the component with short descriptions. Click on the links for further details.

Method List

The following is the full list of the methods of the component with short descriptions. Click on the links for further details.

Event List

The following is the full list of the events fired by the component with short descriptions. Click on the links for further details.

Config Settings

The following is a list of config settings for the component with short descriptions. Click on the links for further details.

Certificates Property (CMS Component)

A collection of certificates used for signing and decryption.

Syntax

• C#
• VB.NET

public CertificateList Certificates { get; }

Public Property Certificates As CertificateList

Remarks

This property hold a collection of certificates used when Sign is called. The input message will be signed with each certificate specified in this property. AddCertificate may also be used to add a certificate to this collection.

The certificate(s) specified here are also used to decrypt the message when Decrypt is called.

DetachedSignature Property (CMS Component)

Specifies whether to include a detached signature when signing a message.

Syntax

• C#
• VB.NET

public bool DetachedSignature { get; set; }

Public Property DetachedSignature As Boolean

Default Value

False

Remarks

This property specifies whether the Sign operation products a message that includes both a signature and the message data, or just a signature.

When set to False default the output message holds the data and signature in one CMS message. This may be passed in its entirety to the receiving party for signature verification.

When set to True the output message holds only a signature in the CMS message. Both the original input data and the signature in the output message produced by the Sign operation must be passed to the receiving party for signature verification.

DetachedSignatureData Property (CMS Component)

The detached signature.

Syntax

• C#
• VB.NET

public string DetachedSignatureData { get; set; }
public byte[] DetachedSignatureDataB { get; set; }

Public Property DetachedSignatureData As String
Public Property DetachedSignatureDataB As Byte()

Default Value

""

Remarks

This setting is used to specify the detached signature before calling VerifySignature. The message data should be specified normally and this property should be set to the detached signature data. This may be set to the PEM, DER, or SMIME encoded signature message.

EnableCompression Property (CMS Component)

Specifies whether to compress the message.

Syntax

• C#
• VB.NET

public bool EnableCompression { get; set; }

Public Property EnableCompression As Boolean

Default Value

False

Remarks

This property specifies whether the input data will be compressed during the signing process.

If set to True the data will be compressed. If set to False (default) the data will not be compressed.

When compression is enabled the input will first be signed, and then compressed. To compress the data before signing set CompressBeforeSign.

EncryptionAlgorithm Property (CMS Component)

The algorithm used for encryption.

Syntax

• C#
• VB.NET

public string EncryptionAlgorithm { get; set; }

Public Property EncryptionAlgorithm As String

Default Value

"3DES"

Remarks

This property specifies the encryption algorithm used when Encrypt is called.

This may be the name of the algorithm, or the corresponding OID of the algorithm. The default value is 3DES. Possible values are:

• "3DES"
• "DES"
• "RC2CBC40"
• "RC2CBC64"
• "RC2CBC128" or "RC2"
• "AESCBC128" or "AES"
• "AESCBC192"
• "AESCBC256"
• "AESGCM128" or "AESGCM"
• "AESGCM192"
• "AESGCM256"

IncludeCertificates Property (CMS Component)

Specifies whether to include the signer's certificate with the signed message.

Syntax

• C#
• VB.NET

public CmsIncludeCertificates IncludeCertificates { get; set; }

enum CmsIncludeCertificates {
  icsNone,
  icsSignerCerts,
  icsSignerCertsAndChain
}

Public Property IncludeCertificates As CmsIncludeCertificates

Enum CmsIncludeCertificates
  icsNone
  icsSignerCerts
  icsSignerCertsAndChain
End Enum

Default Value

1

Remarks

This setting specifies which certificates (if any) are included in the signed message. By default the public certificate of the certificate used to sign the message is included. This allows the receiving party to verify the signature without any additional knowledge. If this is set to icsNone the recipient must obtain and specify the public certificate to be used for signature verification. Possible values are:

InputFile Property (CMS Component)

The file to process.

Syntax

• C#
• VB.NET

public string InputFile { get; set; }

Public Property InputFile As String

Default Value

""

Remarks

This property specifies the file to be processed. Set this property to the full or relative path to the file which will be processed.

Encrypt and/or Sign

When encrypting or signing this may be set to a file containing content that will be encrypted and/or signed.

Decrypt and/or Verify

When decrypting or verifying a signature this may be set to a file containing the PEM, DER, or SMIME encoded message.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

InputMessage Property (CMS Component)

The message to process.

Syntax

• C#
• VB.NET

public string InputMessage { get; set; }
public byte[] InputMessageB { get; set; }

Public Property InputMessage As String
Public Property InputMessageB As Byte()

Default Value

""

Remarks

This property specifies the message to be processed.

Encrypt and/or Sign

When encrypting or signing this may be set to the content that will be encrypted and/or signed.

Decrypt and/or Verify

When decrypting or verifying a signature this may be set to the PEM, DER, or SMIME encoded message.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

OutputFile Property (CMS Component)

The output file.

Syntax

• C#
• VB.NET

public string OutputFile { get; set; }

Public Property OutputFile As String

Default Value

""

Remarks

This property specifies the file to which the output will be written. This may be set to an absolute or relative path.

Encrypt and/or Sign

When encrypting or signing this specifies a file where the message will be written.

Decrypt and/or Verify

When decrypting or verifying a signature this specifies a file where the decrypted/verified content will be written.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

OutputFormat Property (CMS Component)

Specifies the output format.

Syntax

• C#
• VB.NET

public string OutputFormat { get; set; }

Public Property OutputFormat As String

Default Value

"PEM"

Remarks

This property specifies the format of the output message created when calling Sign, Encrypt, or SignAndEncrypt.

The various formats allow for easier transport of the signed or encrypted message, as well as interoperability with other utilities.

Possible values are:

-----BEGIN CMS-----
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABGFD
b250ZW50LVR5cGU6IHRleHQvcGxhaW47IGNoYXJzZXQ9Imlzby04ODU5LTEiDQpDb250ZW50LVRy
...
mlJLPoCw5pf3Cjae56oXs29IZMcDXKersNjFGYSaG0o9k3lAcj9llLFh54Xr1ljx7K0VpVvlrmgu
kNHAf7cUvvilW/KrDa+T2n+sOFAAAAAAAAA=
-----END CMS-----

Mime-Version: 1.0
Content-Type: application/pkcs7-mime; smime-type=signed-data; name="smime.p7m"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7m"

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABGFD
b250ZW50LVR5cGU6IHRleHQvcGxhaW47IGNoYXJzZXQ9Imlzby04ODU5LTEiDQpDb250ZW50LVRy
...
Mpc/PtPNeHA3CCFGRFnHju/yb9CsQWpgf8TTWytjP7O1hFUecW0yiuGSDeeNlQ4ZcX0TOm6haRMT
lqYIrHUNMn4tYaREevNBL9CQB8MAAAAAAAA=

OutputMessage Property (CMS Component)

The output message after processing.

Syntax

• C#
• VB.NET

public string OutputMessage { get; }
public byte[] OutputMessageB { get; }

Public ReadOnly Property OutputMessage As String
Public ReadOnly Property OutputMessageB As Byte()

Default Value

""

Remarks

This property will be populated with the output of the operation if OutputFile and SetOutputStream are not set.

Encrypt and/or Sign

When encrypting or signing this will hold the fully encoded message.

Decrypt and/or Verify

When decrypting or verifying a signature this will hold the decrypted/verified content.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

This property is read-only.

RecipientCerts Property (CMS Component)

The collection of recipient certificates.

Syntax

• C#
• VB.NET

public CertificateList RecipientCerts { get; }

Public Property RecipientCerts As CertificateList

Remarks

This property is used to specify one or more public certificate used to encrypt the message. The certificates should be the public certificate of the recipient who will decrypt the message. The certificate(s) must be set before calling Encrypt or SignAndEncrypt methods.

This property is not available at design time.

SignatureHashAlgorithm Property (CMS Component)

The signature hash algorithm used during signing.

Syntax

• C#
• VB.NET

public string SignatureHashAlgorithm { get; set; }

Public Property SignatureHashAlgorithm As String

Default Value

"SHA256"

Remarks

This property specifies the signature hash algorithm used when Sign is called.

When Sign is called the input data is first hashed with the algorithm specified by this property to produce a message digest. The computed digest is then digitally signed with the certificates specified in Certificates.

The value specified here may be the name of the algorithm or the corresponding OID. Possible values are:

• "SHA-256" (default)
• "SHA-384"
• "SHA-512"
• "SHA-224"
• "SHA1"
• "MD5"

SignerCerts Property (CMS Component)

The collection of signer certificates.

Syntax

• C#
• VB.NET

public CertificateList SignerCerts { get; }

Public Property SignerCerts As CertificateList

Remarks

This property is used to specify one or more public certificate used to verify the message. The certificates should be the public certificate of the recipient who will verify the message.

This property is only required if a certificate is not included in the signed message. The SignerCertInfo event fires during verification with information about the signer certificate. This property may be populated from within the SignerCertInfo.

This property will also be populated after VerifySignature or DecryptAndVerifySignature is called with the certificate(s) present within the signed message (if any).

This property is not available at design time.

UseOAEP Property (CMS Component)

This property specifies whether or not to use Optimal Asymmetric Encryption Padding (OAEP).

Syntax

• C#
• VB.NET

public bool UseOAEP { get; set; }

Public Property UseOAEP As Boolean

Default Value

False

Remarks

This property specifies whether or not to use Optimal Asymmetric Encryption Padding (OAEP). By default, this value is False and the component will use PKCS1.

To specify nondefault OAEP options, please see OAEPRSAHashAlgorithm, OAEPMGF1HashAlgorithm, and OAEPParams

UsePSS Property (CMS Component)

Whether to use RSA-PSS during signing and verification.

Syntax

• C#
• VB.NET

public bool UsePSS { get; set; }

Public Property UsePSS As Boolean

Default Value

False

Remarks

This property specifies whether RSA-PSS will be used when signing and verifying messages. The default value is False.

AddCertificate Method (CMS Component)

Used to add certificates for signing.

Syntax

• C#
• VB.NET

public void AddCertificate(int certStoreType, string certStore, string certStorePassword, string certSubject);

Async Version
public async Task AddCertificate(int certStoreType, string certStore, string certStorePassword, string certSubject);
public async Task AddCertificate(int certStoreType, string certStore, string certStorePassword, string certSubject, CancellationToken cancellationToken);

Public Sub AddCertificate(ByVal CertStoreType As Integer, ByVal CertStore As String, ByVal CertStorePassword As String, ByVal CertSubject As String)

Async Version
Public Sub AddCertificate(ByVal CertStoreType As Integer, ByVal CertStore As String, ByVal CertStorePassword As String, ByVal CertSubject As String) As Task
Public Sub AddCertificate(ByVal CertStoreType As Integer, ByVal CertStore As String, ByVal CertStorePassword As String, ByVal CertSubject As String, cancellationToken As CancellationToken) As Task

Remarks

This method adds a signing certificate. Signing certificates may be added using this method or by adding a certificate directly to Certificates.

The added certificate(s) will be used to sign the message when Sign is called.

CertStoreType specifies the type of certificate store. The component supports both public and private keys in a variety of formats. When the cstAuto value is used, the component will automatically determine the type. This field can take one of the following values:

CertStore specifies the path to the certificate file. If the CertStoreType is a blob, this specifies the certificate content. See Certificates for details.

CertStorePassword is the password for the certificate (if any).

CertSubject specified the subject of the certificate to load. The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

AddRecipientCert Method (CMS Component)

Used to add recipient certificates used to encrypt messages.

Syntax

• C#
• VB.NET

public void AddRecipientCert(byte[] certEncoded);

Async Version
public async Task AddRecipientCert(byte[] certEncoded);
public async Task AddRecipientCert(byte[] certEncoded, CancellationToken cancellationToken);

Public Sub AddRecipientCert(ByVal CertEncoded As String)

Async Version
Public Sub AddRecipientCert(ByVal CertEncoded As String) As Task
Public Sub AddRecipientCert(ByVal CertEncoded As String, cancellationToken As CancellationToken) As Task

Remarks

This method adds a public certificate used when Encrypt is called. Public certificates of recipients may be added using this method or by adding a certificate directly to the RecipientCerts property.

CertEncoded must contain the PEM or Base64 encoded public certificate.

Config Method (CMS Component)

Sets or retrieves a configuration setting.

Syntax

• C#
• VB.NET

public string Config(string configurationString);

Async Version
public async Task<string> Config(string configurationString);
public async Task<string> Config(string configurationString, CancellationToken cancellationToken);

Public Function Config(ByVal ConfigurationString As String) As String

Async Version
Public Function Config(ByVal ConfigurationString As String) As Task(Of String)
Public Function Config(ByVal ConfigurationString As String, cancellationToken As CancellationToken) As Task(Of String)

Remarks

Config is a generic method available in every component. It is used to set and retrieve configuration settings for the component.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the component, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

Decrypt Method (CMS Component)

Decrypts the current message.

Syntax

• C#
• VB.NET

public void Decrypt();

Async Version
public async Task Decrypt();
public async Task Decrypt(CancellationToken cancellationToken);

Public Sub Decrypt()

Async Version
Public Sub Decrypt() As Task
Public Sub Decrypt(cancellationToken As CancellationToken) As Task

Remarks

Decrypt decrypts the input data with the specified certificate. Certificates are specified by calling AddCertificate or setting the Certificates property.

If the certificate used to encrypt the message is not known ahead of time GetRecipientInfo may be called prior to calling Decrypt to obtain information about the recipient (the entity the for which the message was encrypted). If GetRecipientInfo is called, the RecipientInfo event is fired with information about the recipient which may be used to load an appropriate decryption certificate.

The following properties are applicable when calling this method:

• Certificates (Required)

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Encrypt and Decrypt a message Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt a message - DER Output Format Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.OutputFormat = "DER"; cms.Encrypt(); byte[] encryptedMessage = cms.OutputMessageB; //Binary output cms = new Cms(); cms.InputMessageB = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt - Multiple Recipients Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test2.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt - Get Recipient Info Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; //If the recipient certificate is not known ahead of time the GetRecipientInfo method may be called //to find information about the certificate. cms = new Cms(); cms.InputMessage = encryptedMessage; cms.OnRecipientInfo += (s, e) => { Console.WriteLine(e.SerialNumber); Console.WriteLine(e.Issuer); if (e.Issuer == "CN=100") //Identify the certificate to load based on event params { cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); } }; cms.GetRecipientInfo(); cms.Decrypt(); string plaintextMessage = cms.OutputMessage;

DecryptAndVerifySignature Method (CMS Component)

Decrypts and verifies the signature of the current message.

Syntax

• C#
• VB.NET

public void DecryptAndVerifySignature();

Async Version
public async Task DecryptAndVerifySignature();
public async Task DecryptAndVerifySignature(CancellationToken cancellationToken);

Public Sub DecryptAndVerifySignature()

Async Version
Public Sub DecryptAndVerifySignature() As Task
Public Sub DecryptAndVerifySignature(cancellationToken As CancellationToken) As Task

Remarks

This method decrypts the input data and verifies the signature. Decryption certificates are specified by calling AddCertificate or setting the Certificates property. Certificates used to verify the signature will be taken from the message itself if included, or from the SignerCerts property.

If the certificate used to encrypt the message is not known ahead of time GetRecipientInfo may be called prior to calling Decrypt to obtain information about the recipient (the entity the for which the message was encrypted). If GetRecipientInfo is called, the RecipientInfo event is fired with information about the recipient which may be used to load an appropriate decryption certificate.

In order to perform signature verification the public signer's certificate must be present or explicitly specified. In many cases the certificate itself is included in the input message and a certificate does not need to explicitly be set. If a certificate does need to be set for signature verification the certificate may be specified by calling AddRecipientCert or setting RecipientCerts.

When this method is called the SignerCertInfo event fires once for each signature on the message. This event provides details about the signer certificate, as well as the signer certificate itself (if present). The information provided via SignerCertInfo may be used to load an appropriate certificate for verification from within the event. If the CertEncoded parameter of SignerCertInfo is populated the certificate required for verification is already present in the message.

The following properties are applicable when calling this method:

• Certificates (Required)
• DetachedSignature
• DetachedSignatureData
• EnableCompression
• SignerCerts

If the input message is a detached signature, the original data that was signed must be specified in DetachedSignatureData. In addition the DetachedSignature property must be set to True to instruct the component to treat the input message as a detached signature.

If the input message is compressed EnableCompression must be set to True before calling this method.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Encrypt Method (CMS Component)

Encrypts the current message.

Syntax

• C#
• VB.NET

public void Encrypt();

Async Version
public async Task Encrypt();
public async Task Encrypt(CancellationToken cancellationToken);

Public Sub Encrypt()

Async Version
Public Sub Encrypt() As Task
Public Sub Encrypt(cancellationToken As CancellationToken) As Task

Remarks

Encrypt encrypts the input data with the the specified certificate(s). Certificates are specified by calling AddRecipientCert or setting the RecipientCerts property.

OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. Additional settings allow further configuration. The following properties are applicable when calling this method:

• RecipientCerts (required)
• EncryptionAlgorithm
• OutputFormat
• UseOAEP

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Encrypt and Decrypt a message Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt a message - DER Output Format Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.OutputFormat = "DER"; cms.Encrypt(); byte[] encryptedMessage = cms.OutputMessageB; //Binary output cms = new Cms(); cms.InputMessageB = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt - Multiple Recipients Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test2.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = encryptedMessage; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Decrypt(); string plaintextMessage = cms.OutputMessage; Encrypt and Decrypt - Get Recipient Info Cms cms = new Cms(); cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); cms.InputMessage = "My Data"; cms.Encrypt(); string encryptedMessage = cms.OutputMessage; //If the recipient certificate is not known ahead of time the GetRecipientInfo method may be called //to find information about the certificate. cms = new Cms(); cms.InputMessage = encryptedMessage; cms.OnRecipientInfo += (s, e) => { Console.WriteLine(e.SerialNumber); Console.WriteLine(e.Issuer); if (e.Issuer == "CN=100") //Identify the certificate to load based on event params { cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); } }; cms.GetRecipientInfo(); cms.Decrypt(); string plaintextMessage = cms.OutputMessage;

GetRecipientInfo Method (CMS Component)

Gets the recipient certificate information for an encrypted message.

Syntax

• C#
• VB.NET

public void GetRecipientInfo();

Async Version
public async Task GetRecipientInfo();
public async Task GetRecipientInfo(CancellationToken cancellationToken);

Public Sub GetRecipientInfo()

Async Version
Public Sub GetRecipientInfo() As Task
Public Sub GetRecipientInfo(cancellationToken As CancellationToken) As Task

Remarks

This method retrieves information about the recipient(s) of the encrypted message. This may be called prior to calling Decrypt to determine which certificate should be loaded for decryption.

When this method is called the RecipientInfo event fires once for each recipient found within the message. Use the parameters of the RecipientInfo to determine which certificate to specify via AddCertificate or Certificates before calling Decrypt.

GetSignerCertInfo Method (CMS Component)

This method gets the signature information for an signed message.

Syntax

• C#
• VB.NET

public void GetSignerCertInfo();

Async Version
public async Task GetSignerCertInfo();
public async Task GetSignerCertInfo(CancellationToken cancellationToken);

Public Sub GetSignerCertInfo()

Async Version
Public Sub GetSignerCertInfo() As Task
Public Sub GetSignerCertInfo(cancellationToken As CancellationToken) As Task

Remarks

This method retrieves information about the certificate used to sign the message. This may be called before calling VerifySignature to determine which certificate should be loaded for verification.

When this method is called, the SignerCertInfo event fires once for each signer of the message. Use the parameters of the SignerCertInfo to determine which certificate to specify before calling VerifySignature.

Note: Use of this method is optional. If no certificate is specified before calling VerifySignature, the component will fire the SignerCertInfo and a certificate may be loaded from within the event at that time (if necessary).

Reset Method (CMS Component)

This method resets the component properties.

Syntax

• C#
• VB.NET

public void Reset();

Async Version
public async Task Reset();
public async Task Reset(CancellationToken cancellationToken);

Public Sub Reset()

Async Version
Public Sub Reset() As Task
Public Sub Reset(cancellationToken As CancellationToken) As Task

Remarks

This method resets the values of all message and certificate properties. It is an easy way to reset the component properties before starting to populate with new values.

SetInputStream Method (CMS Component)

Sets the stream from which the component will read data to encode or decode.

Syntax

• C#
• VB.NET

public void SetInputStream(System.IO.Stream inputStream);

Async Version
public async Task SetInputStream(System.IO.Stream inputStream);
public async Task SetInputStream(System.IO.Stream inputStream, CancellationToken cancellationToken);

Public Sub SetInputStream(ByVal InputStream As System.IO.Stream)

Async Version
Public Sub SetInputStream(ByVal InputStream As System.IO.Stream) As Task
Public Sub SetInputStream(ByVal InputStream As System.IO.Stream, cancellationToken As CancellationToken) As Task

Remarks

This method sets the stream from which the component will read data to process.

Encrypt or Sign

When encrypting or signing this may be set to a stream with the content that will be encrypted and/or signed.

Decrypt or Verify

When decrypting or verifying a signature this may be set to a stream with the encrypted or signed message.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

SetOutputStream Method (CMS Component)

Sets the stream to which the component will read data to encode or decode.

Syntax

• C#
• VB.NET

public void SetOutputStream(System.IO.Stream outputStream);

Async Version
public async Task SetOutputStream(System.IO.Stream outputStream);
public async Task SetOutputStream(System.IO.Stream outputStream, CancellationToken cancellationToken);

Public Sub SetOutputStream(ByVal OutputStream As System.IO.Stream)

Async Version
Public Sub SetOutputStream(ByVal OutputStream As System.IO.Stream) As Task
Public Sub SetOutputStream(ByVal OutputStream As System.IO.Stream, cancellationToken As CancellationToken) As Task

Remarks

This method sets the stream to which the component will write processed data.

Encrypt or Sign

When encrypting or signing this may be set to a stream where the signed/encrypted data will be written.

Decrypt or Verify

When decrypting or verifying a signature this may be set to a stream where the decrypted/verified data will be written.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Sign Method (CMS Component)

Signs the current message.

Syntax

• C#
• VB.NET

public void Sign();

Async Version
public async Task Sign();
public async Task Sign(CancellationToken cancellationToken);

Public Sub Sign()

Async Version
Public Sub Sign() As Task
Public Sub Sign(cancellationToken As CancellationToken) As Task

Remarks

Sign digitally signs the input data with the the specified certificate(s). Certificates are specified by calling AddCertificate or setting the Certificates property.

OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. IncludeCertificates specifies whether the public certificate is included in the signed message. Additional settings allow further configuration. The following properties are applicable when calling this method:

• Certificates (required)
• DetachedSignature
• EnableCompression
• GenerateSignatureTimestamp
• IncludeCertificates
• OutputFormat
• SignatureHashAlgorithm
• UsePSS

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Sign and Verify a message Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - DER Output Format Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.OutputFormat = "DER"; cms.Sign(); byte[] signedMessage = cms.OutputMessageB; //Binary output cms = new Cms(); cms.InputMessageB = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - Detached Signature Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.DetachedSignature = true; cms.Sign(); string signature = cms.OutputMessage; cms = new Cms(); cms.InputMessage = "My Data"; cms.DetachedSignatureData = signature; cms.DetachedSignature = true; cms.VerifySignature(); Sign and Verify a message - Multiple Signatures Cms cms = new Cms(); cms.InputMessage = "My Data"; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test2.pfx", "password2", "*")); cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - No Included Certificate Cms cms = new Cms(); cms.InputMessage = "My Data"; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.IncludeCertificates = CmsIncludeCertificates.icsNone; cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.OnSignerCertInfo += (s, e) => { Console.WriteLine(e.Issuer); Console.WriteLine(e.SerialNumber); if (e.Issuer == "CN=100") //Identify the certificate to load based on event params { //Load the correct signer certificate. cms.SignerCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); } }; cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage;

SignAndEncrypt Method (CMS Component)

Signs and encrypts the current message.

Syntax

• C#
• VB.NET

public void SignAndEncrypt();

Async Version
public async Task SignAndEncrypt();
public async Task SignAndEncrypt(CancellationToken cancellationToken);

Public Sub SignAndEncrypt()

Async Version
Public Sub SignAndEncrypt() As Task
Public Sub SignAndEncrypt(cancellationToken As CancellationToken) As Task

Remarks

This method signs encrypts the input data with the the specified certificate(s). Encryption certificates are specified by calling AddRecipientCert or setting the RecipientCerts property. Signing certificates are set via the Certificates property.

OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. Additional settings allow further configuration. IncludeCertificates specifies whether the public certificate is included in the signed message. The following properties are applicable when calling this method:

• Certificates (required)
• RecipientCerts (required)
• DetachedSignature
• EnableCompression
• EncryptionAlgorithm
• GenerateSignatureTimestamp
• IncludeCertificates
• OutputFormat
• SignatureHashAlgorithm
• UseOAEP
• UsePSS

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

VerifySignature Method (CMS Component)

Verifies the signature of the current message.

Syntax

• C#
• VB.NET

public void VerifySignature();

Async Version
public async Task VerifySignature();
public async Task VerifySignature(CancellationToken cancellationToken);

Public Sub VerifySignature()

Async Version
Public Sub VerifySignature() As Task
Public Sub VerifySignature(cancellationToken As CancellationToken) As Task

Remarks

VerifySignature verifies the signature of the input message.

In order to perform signature verification the public signer's certificate must be present or explicitly specified. In many cases the certificate itself is included in the input message and a certificate does not need to explicitly be set. If a certificate does need to be set for signature verification the certificate may be specified by calling AddRecipientCert or setting RecipientCerts.

When this method is called the SignerCertInfo event fires once for each signature on the message. This event provides details about the signer certificate, as well as the signer certificate itself (if present). The information provided via SignerCertInfo may be used to load an appropriate certificate for verification from within the event. If the CertEncoded parameter of SignerCertInfo is populated the certificate required for verification is already present in the message.

The following property are applicable when calling this method:

• DetachedSignature
• DetachedSignatureData
• EnableCompression
• SignerCerts

If the input message is a detached signature, the original data that was signed must be specified in DetachedSignatureData. In addition the DetachedSignature property must be set to True to instruct the component to treat the input message as a detached signature.

If the input message is compressed EnableCompression must be set to True before calling this method.

Input and Output Properties

The component will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

• SetInputStream
• InputFile
• InputMessage

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

• SetOutputStream
• OutputFile
• OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Sign and Verify a message Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - DER Output Format Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.OutputFormat = "DER"; cms.Sign(); byte[] signedMessage = cms.OutputMessageB; //Binary output cms = new Cms(); cms.InputMessageB = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - Detached Signature Cms cms = new Cms(); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.InputMessage = "My Data"; cms.DetachedSignature = true; cms.Sign(); string signature = cms.OutputMessage; cms = new Cms(); cms.InputMessage = "My Data"; cms.DetachedSignatureData = signature; cms.DetachedSignature = true; cms.VerifySignature(); Sign and Verify a message - Multiple Signatures Cms cms = new Cms(); cms.InputMessage = "My Data"; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test2.pfx", "password2", "*")); cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage; Sign and Verify a message - No Included Certificate Cms cms = new Cms(); cms.InputMessage = "My Data"; cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*")); cms.IncludeCertificates = CmsIncludeCertificates.icsNone; cms.Sign(); string signedMessage = cms.OutputMessage; cms = new Cms(); cms.OnSignerCertInfo += (s, e) => { Console.WriteLine(e.Issuer); Console.WriteLine(e.SerialNumber); if (e.Issuer == "CN=100") //Identify the certificate to load based on event params { //Load the correct signer certificate. cms.SignerCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*")); } }; cms.InputMessage = signedMessage; cms.VerifySignature(); string plaintextMessage = cms.OutputMessage;

Error Event (CMS Component)

Fired when information is available about errors during data delivery.

Syntax

• C#
• VB.NET

public event OnErrorHandler OnError;

public delegate void OnErrorHandler(object sender, CmsErrorEventArgs e);

public class CmsErrorEventArgs : EventArgs {
  public int ErrorCode { get; }
  public string Description { get; }
}

Public Event OnError As OnErrorHandler

Public Delegate Sub OnErrorHandler(sender As Object, e As CmsErrorEventArgs)

Public Class CmsErrorEventArgs Inherits EventArgs
  Public ReadOnly Property ErrorCode As Integer
  Public ReadOnly Property Description As String
End Class

Remarks

The Error event is fired in case of exceptional conditions during message processing. Normally the component throws an exception.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

Log Event (CMS Component)

Fires with log information during processing.

Syntax

• C#
• VB.NET

public event OnLogHandler OnLog;

public delegate void OnLogHandler(object sender, CmsLogEventArgs e);

public class CmsLogEventArgs : EventArgs {
  public int LogLevel { get; }
  public string Message { get; }
  public string LogType { get; }
}

Public Event OnLog As OnLogHandler

Public Delegate Sub OnLogHandler(sender As Object, e As CmsLogEventArgs)

Public Class CmsLogEventArgs Inherits EventArgs
  Public ReadOnly Property LogLevel As Integer
  Public ReadOnly Property Message As String
  Public ReadOnly Property LogType As String
End Class

Remarks

This event fires during processing with log information. The level of detail that is logged is controlled via the LogLevel.

LogLevel indicates the level of message. Possible values are:

LogMessage is the log entry.

LogType indicates the type of log. Possible values are:

• "INFO"
• "ENCRYPT"
• "COMPRESS"
• "SIGN"
• "DECRYPT"
• "DECOMPRESS"
• "VERIFY"
• "DEBUG"

RecipientInfo Event (CMS Component)

This event is fired for each recipient certificate of the encrypted message.

Syntax

• C#
• VB.NET

public event OnRecipientInfoHandler OnRecipientInfo;

public delegate void OnRecipientInfoHandler(object sender, CmsRecipientInfoEventArgs e);

public class CmsRecipientInfoEventArgs : EventArgs {
  public string Issuer { get; }
  public string SerialNumber { get; }
  public string SubjectKeyIdentifier { get; }
  public string EncryptionAlgorithm { get; }
}

Public Event OnRecipientInfo As OnRecipientInfoHandler

Public Delegate Sub OnRecipientInfoHandler(sender As Object, e As CmsRecipientInfoEventArgs)

Public Class CmsRecipientInfoEventArgs Inherits EventArgs
  Public ReadOnly Property Issuer As String
  Public ReadOnly Property SerialNumber As String
  Public ReadOnly Property SubjectKeyIdentifier As String
  Public ReadOnly Property EncryptionAlgorithm As String
End Class

Remarks

When GetRecipientInfo is called on a valid encrypted message, this event will fire once for each recipient certificate that the message has been encrypted for. This may be used to identify the certificate to load.

Issuer is the subject of the issuer certificate.

SerialNumber is the serial number of the encryption certificate.

SubjectKeyIdentifier is the X.509 subjectKeyIdentifier extension value of the certificate used to sign the message encoded as a hex string.

EncryptionAlgorithm is the encryption algorithm used to encrypt the message. Possible values are as follows:

• "3DES"
• "DES"
• "RC2CBC40"
• "RC2CBC64"
• "RC2CBC128" or "RC2"
• "AESCBC128" or "AES"
• "AESCBC192"
• "AESCBC256"
• "AESGCM128" or "AESGCM"
• "AESGCM192"
• "AESGCM256"

SignerCertInfo Event (CMS Component)

Fired during verification of the signed message.

Syntax

• C#
• VB.NET

public event OnSignerCertInfoHandler OnSignerCertInfo;

public delegate void OnSignerCertInfoHandler(object sender, CmsSignerCertInfoEventArgs e);

public class CmsSignerCertInfoEventArgs : EventArgs {
  public string Issuer { get; }
  public string SerialNumber { get; }
  public string SubjectKeyIdentifier { get; }
  public string CertEncoded { get; }
  public byte[] CertEncodedB { get; }
}

Public Event OnSignerCertInfo As OnSignerCertInfoHandler

Public Delegate Sub OnSignerCertInfoHandler(sender As Object, e As CmsSignerCertInfoEventArgs)

Public Class CmsSignerCertInfoEventArgs Inherits EventArgs
  Public ReadOnly Property Issuer As String
  Public ReadOnly Property SerialNumber As String
  Public ReadOnly Property SubjectKeyIdentifier As String
  Public ReadOnly Property CertEncoded As String
  Public ReadOnly Property CertEncodedB As Byte()
End Class

Remarks

During verification, this event will be raised while parsing the signer's certificate information. The parameters which are populated depends on the options used when the message was originally signed. This information may be used to select the correct certificate for SignerCerts in order to verify the signature. The following parameters may be populated.

Issuer specifies the subject of the issuer of the certificate used to sign the message.

SerialNumber is the serial number of the certificate used to sign the message.

SubjectKeyIdentifier is the X.509 subjectKeyIdentifier extension value of the certificate used to sign the message encoded as a hex string.

CertEncoded is the PEM (base64 encoded) public certificate needed to verify the signature. Note: when this value is present the component will automatically use this value to perform signature verification.

The SignerCerts property may be set from within this event. In this manner the decision of which signer certificate to load may be delayed until the parameters of this event are inspected and the correct certificate can be located and loaded.

Certificate Type

This is the digital certificate being used.

Remarks

This type describes the current digital certificate. The certificate may be a public or private key. The fields are used to identify or select certificates.

Fields

Constructors

• C#
• VB.NET

public Certificate();

Public Certificate()

Creates a Certificate instance whose properties can be set. This is useful for use with CERTMGR when generating new certificates.

• C#
• VB.NET

public Certificate(string certificateFile);

Public Certificate(ByVal CertificateFile As String)

Opens CertificateFile and reads out the contents as an X.509 public key.

• C#
• VB.NET

public Certificate(byte[] certificateData);

Public Certificate(ByVal CertificateData As Byte())

Parses CertificateData as an X.509 public key.

• C#
• VB.NET

public Certificate(CertStoreTypes certStoreType, string store, string storePassword, string subject);

Public Certificate(ByVal CertStoreType As CertStoreTypes, ByVal Store As String, ByVal StorePassword As String, ByVal Subject As String)

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store. After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN).

• C#
• VB.NET

public Certificate(CertStoreTypes certStoreType, string store, string storePassword, string subject, string configurationString);

Public Certificate(ByVal CertStoreType As CertStoreTypes, ByVal Store As String, ByVal StorePassword As String, ByVal Subject As String, ByVal ConfigurationString As String)

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store. ConfigurationString is a newline separated list of name-value pairs that may be used to modify the default behavior. Possible values include "PersistPFXKey", which shows whether or not the PFX key is persisted after performing operations with the private key. This correlates to the PKCS12_NO_PERSIST_KEY CryptoAPI option. The default value is True (the key is persisted). "Thumbprint" - an MD5, SHA-1, or SHA-256 thumbprint of the certificate to load. When specified, this value is used to select the certificate in the store. This is applicable to cstUser, cstMachine, cstPublicKeyFile, and cstPFXFile store types. "UseInternalSecurityAPI" shows whether the platform (default) or the internal security API is used when performing certificate-related operations. After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN).

• C#
• VB.NET

public Certificate(CertStoreTypes certStoreType, string store, string storePassword, byte[] encoded);

Public Certificate(ByVal CertStoreType As CertStoreTypes, ByVal Store As String, ByVal StorePassword As String, ByVal Encoded As Byte())

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store. After the store has been successfully opened, the component will load Encoded as an X.509 certificate and search the opened store for a corresponding private key.

• C#
• VB.NET

public Certificate(CertStoreTypes certStoreType, byte[] storeBlob, string storePassword, string subject);

Public Certificate(ByVal CertStoreType As CertStoreTypes, ByVal StoreBlob As Byte(), ByVal StorePassword As String, ByVal Subject As String)

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. StoreBlob is a string (binary- or Base64-encoded) containing the certificate data. StorePassword is the password used to protect the store. After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN).

• C#
• VB.NET

public Certificate(CertStoreTypes certStoreType, byte[] storeBlob, string storePassword, string subject, string configurationString);

Public Certificate(ByVal CertStoreType As CertStoreTypes, ByVal StoreBlob As Byte(), ByVal StorePassword As String, ByVal Subject As String, ByVal ConfigurationString As String)

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. StoreBlob is a string (binary- or Base64-encoded) containing the certificate data. StorePassword is the password used to protect the store. After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN).

• C#
• VB.NET

public Certificate(CertStoreTypes certStoreType, byte[] storeBlob, string storePassword, byte[] encoded);

Public Certificate(ByVal CertStoreType As CertStoreTypes, ByVal StoreBlob As Byte(), ByVal StorePassword As String, ByVal Encoded As Byte())

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. Store is a string (binary- or Base64-encoded) containing the certificate store. StorePassword is the password used to protect the store. After the store has been successfully opened, the component will load Encoded as an X.509 certificate and search the opened store for a corresponding private key.

Config Settings (CMS Component)

CMS Config Settings

Base Config Settings

Trappable Errors (CMS Component)

CMS Errors