CMS Class
Properties Methods Events Config Settings Errors
The CMS class is used to digitally sign, encrypt, verify, and decrypt data.
Syntax
CMS
Remarks
The CMS class implements the Cryptographic Message Syntax and allow for various cryptographic operations to be performed on data including:
The class can generate and consume message in a variety of formats including PEM, DER (Binary), and SMIME. The EncryptionAlgorithm and SignatureHashAlgorithm are fully configurable and support a variety of industry standard encryption and hash algorithms.
The class supports additional functionality such as Compression, OAEP, and PSS. The GetRecipientInfo and GetSignerCertInfo methods as well as the RecipientInfo and SignerCertInfo events allow for a dynamic and flexible approach to message processing. Certificate may be loaded ahead of time or as-needed from the events.
Signing Notes
Sign digitally signs the input data with the the specified certificate(s). Certificates are specified by calling AddCertificate or setting the Certificates property.OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. IncludeCertificates specifies whether the public certificate is included in the signed message. Additional settings allow further configuration. The following properties are applicable when calling this method:
- Certificates (required)
- DetachedSignature
- EnableCompression
- GenerateSignatureTimestamp
- IncludeCertificates
- OutputFormat
- SignatureHashAlgorithm
- UsePSS
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Sign and Verify a message
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - DER Output Format
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.OutputFormat = "DER";
cms.Sign();
byte[] signedMessage = cms.OutputMessageB; //Binary output
cms = new Cms();
cms.InputMessageB = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - Detached Signature
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.DetachedSignature = true;
cms.Sign();
string signature = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = "My Data";
cms.DetachedSignatureData = signature;
cms.DetachedSignature = true;
cms.VerifySignature();
Sign and Verify a message - Multiple Signatures
Cms cms = new Cms();
cms.InputMessage = "My Data";
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test2.pfx", "password2", "*"));
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - No Included Certificate
Cms cms = new Cms();
cms.InputMessage = "My Data";
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.IncludeCertificates = CmsIncludeCertificates.icsNone;
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.OnSignerCertInfo += (s, e) => {
Console.WriteLine(e.Issuer);
Console.WriteLine(e.SerialNumber);
if (e.Issuer == "CN=100") //Identify the certificate to load based on event params
{
//Load the correct signer certificate.
cms.SignerCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
}
};
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Encryption Notes
Encrypt encrypts the input data with the the specified certificate(s). Certificates are specified by calling AddRecipientCert or setting the RecipientCerts property.OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. Additional settings allow further configuration. The following properties are applicable when calling this method:
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Encrypt and Decrypt a message
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt a message - DER Output Format
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.OutputFormat = "DER";
cms.Encrypt();
byte[] encryptedMessage = cms.OutputMessageB; //Binary output
cms = new Cms();
cms.InputMessageB = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt - Multiple Recipients
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test2.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt - Get Recipient Info
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
//If the recipient certificate is not known ahead of time the GetRecipientInfo method may be called
//to find information about the certificate.
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.OnRecipientInfo += (s, e) => {
Console.WriteLine(e.SerialNumber);
Console.WriteLine(e.Issuer);
if (e.Issuer == "CN=100") //Identify the certificate to load based on event params
{
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
}
};
cms.GetRecipientInfo();
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Signature Verification Notes
VerifySignature verifies the signature of the input message.In order to perform signature verification the public signer's certificate must be present or explicitly specified. In many cases the certificate itself is included in the input message and a certificate does not need to explicitly be set. If a certificate does need to be set for signature verification the certificate may be specified by calling AddRecipientCert or setting RecipientCerts.
When this method is called the SignerCertInfo event fires once for each signature on the message. This event provides details about the signer certificate, as well as the signer certificate itself (if present). The information provided via SignerCertInfo may be used to load an appropriate certificate for verification from within the event. If the CertEncoded parameter of SignerCertInfo is populated the certificate required for verification is already present in the message.
The following property are applicable when calling this method:
If the input message is a detached signature, the original data that was signed must be specified in DetachedSignatureData. In addition the DetachedSignature property must be set to True to instruct the class to treat the input message as a detached signature.
If the input message is compressed EnableCompression must be set to True before calling this method.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Sign and Verify a message
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - DER Output Format
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.OutputFormat = "DER";
cms.Sign();
byte[] signedMessage = cms.OutputMessageB; //Binary output
cms = new Cms();
cms.InputMessageB = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - Detached Signature
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.DetachedSignature = true;
cms.Sign();
string signature = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = "My Data";
cms.DetachedSignatureData = signature;
cms.DetachedSignature = true;
cms.VerifySignature();
Sign and Verify a message - Multiple Signatures
Cms cms = new Cms();
cms.InputMessage = "My Data";
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test2.pfx", "password2", "*"));
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - No Included Certificate
Cms cms = new Cms();
cms.InputMessage = "My Data";
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.IncludeCertificates = CmsIncludeCertificates.icsNone;
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.OnSignerCertInfo += (s, e) => {
Console.WriteLine(e.Issuer);
Console.WriteLine(e.SerialNumber);
if (e.Issuer == "CN=100") //Identify the certificate to load based on event params
{
//Load the correct signer certificate.
cms.SignerCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
}
};
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Decryption Notes
Decrypt decrypts the input data with the specified certificate. Certificates are specified by calling AddCertificate or setting the Certificates property.
If the certificate used to encrypt the message is not known ahead of time GetRecipientInfo may be called prior to calling Decrypt to obtain information about the recipient (the entity the for which the message was encrypted). If GetRecipientInfo is called, the RecipientInfo event is fired with information about the recipient which may be used to load an appropriate decryption certificate.
The following properties are applicable when calling this method:
- Certificates (Required)
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Encrypt and Decrypt a message
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt a message - DER Output Format
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.OutputFormat = "DER";
cms.Encrypt();
byte[] encryptedMessage = cms.OutputMessageB; //Binary output
cms = new Cms();
cms.InputMessageB = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt - Multiple Recipients
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test2.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt - Get Recipient Info
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
//If the recipient certificate is not known ahead of time the GetRecipientInfo method may be called
//to find information about the certificate.
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.OnRecipientInfo += (s, e) => {
Console.WriteLine(e.SerialNumber);
Console.WriteLine(e.Issuer);
if (e.Issuer == "CN=100") //Identify the certificate to load based on event params
{
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
}
};
cms.GetRecipientInfo();
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
| Certificates | A collection of certificates used for signing and decryption. |
| DetachedSignature | Specifies whether to include a detached signature when signing a message. |
| DetachedSignatureData | The detached signature. |
| EnableCompression | Specifies whether to compress the message. |
| EncryptionAlgorithm | The algorithm used for encryption. |
| IncludeCertificates | Specifies whether to include the signer's certificate with the signed message. |
| InputFile | The file to process. |
| InputMessage | The message to process. |
| OutputFile | The output file. |
| OutputFormat | Specifies the output format. |
| OutputMessage | The output message after processing. |
| RecipientCerts | The collection of recipient certificates. |
| SignatureHashAlgorithm | The signature hash algorithm used during signing. |
| SignerCerts | The collection of signer certificates. |
| UseOAEP | This property specifies whether or not to use Optimal Asymmetric Encryption Padding (OAEP). |
| UsePSS | Whether to use RSA-PSS during signing and verification. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
| AddCertificate | Used to add certificates for signing. |
| AddRecipientCert | Used to add recipient certificates used to encrypt messages. |
| Config | Sets or retrieves a configuration setting. |
| Decrypt | Decrypts the current message. |
| DecryptAndVerifySignature | Decrypts and verifies the signature of the current message. |
| Encrypt | Encrypts the current message. |
| GetRecipientInfo | Gets the recipient certificate information for an encrypted message. |
| GetSignerCertInfo | This method gets the signature information for an signed message. |
| Reset | This method resets the class properties. |
| SetInputStream | Sets the stream from which the class will read data to encode or decode. |
| SetOutputStream | Sets the stream to which the class will read data to encode or decode. |
| Sign | Signs the current message. |
| SignAndEncrypt | Signs and encrypts the current message. |
| VerifySignature | Verifies the signature of the current message. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
| Error | Fired when information is available about errors during data delivery. |
| Log | Fires with log information during processing. |
| RecipientInfo | This event is fired for each recipient certificate of the encrypted message. |
| SignerCertInfo | Fired during verification of the signed message. |
Config Settings
The following is a list of config settings for the class with short descriptions. Click on the links for further details.
| CompressBeforeSign | Specifies whether to compress before signing. |
| ContentTypeOID | Specifies the oid for content type. |
| CSP | The Cryptographic Service Provider. |
| GenerateSignatureTimestamp | Whether to generate timestamps in signatures. |
| IncludeHeaders | Tells the class whether to include the headers when encoding the message. |
| IncludeInternalHeaders | Tells the class whether or not to include the internal headers when encoding the message. |
| InputContentTransferEncoding | Sets the Content-Transfer-Encoding for the signed message. |
| InputContentType | Sets the Content-Type for the signed message. |
| InputMessageHeaders | Message headers. |
| LogDirectory | The directory on disk where debug logs are written. |
| LogFileName | The base filename to use with LogDirectory. |
| LogLevel | The level of detail for log messages. |
| OAEPMGF1HashAlgorithm | The MGF1 hash algorithm used with OAEP. |
| OAEPParams | The hex encoded OAEP parameters. |
| OAEPRSAHashAlgorithm | The RSA hash algorithm used with OAEP. |
| OutputMessageHeaders | The SMIME headers of the output message. |
| RecipientInfoType | The type of signer information to include in the signed message. |
| SignatureTimestamp | The signature timestamp in the signed message. |
| SignerInfoType | The type of signer information to include in the signed message. |
| UseAlgorithmOIDs | Whether OIDs are used when providing information about the algorithms. |
| BuildInfo | Information about the product's build. |
| CodePage | The system code page used for Unicode to Multibyte translations. |
| LicenseInfo | Information about the current license. |
| MaskSensitiveData | Whether sensitive data is masked in log messages. |
| ProcessIdleEvents | Whether the class uses its internal event loop to process events when the main thread is idle. |
| SelectWaitMillis | The length of time in milliseconds the class will wait when DoEvents is called if there are no events to process. |
| UseFIPSCompliantAPI | Tells the class whether or not to use FIPS certified APIs. |
| UseInternalSecurityAPI | Whether or not to use the system security libraries or an internal implementation. |
Certificates Property (CMS Class)
A collection of certificates used for signing and decryption.
Syntax
IPWorksEncryptList<IPWorksEncryptCertificate>* GetCertificates(); int SetCertificates(IPWorksEncryptList<IPWorksEncryptCertificate>* val);
int ipworksencrypt_cms_getcertcount(void* lpObj);
int ipworksencrypt_cms_setcertcount(void* lpObj, int iCertCount);
char* ipworksencrypt_cms_getcerteffectivedate(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertexpirationdate(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertextendedkeyusage(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertfingerprint(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertfingerprintsha1(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertfingerprintsha256(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertissuer(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertprivatekey(void* lpObj, int certindex);
int ipworksencrypt_cms_getcertprivatekeyavailable(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertprivatekeycontainer(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertpublickey(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertpublickeyalgorithm(void* lpObj, int certindex);
int ipworksencrypt_cms_getcertpublickeylength(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertserialnumber(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertsignaturealgorithm(void* lpObj, int certindex);
int ipworksencrypt_cms_getcertstore(void* lpObj, int certindex, char** lpCertStore, int* lenCertStore);
int ipworksencrypt_cms_setcertstore(void* lpObj, int certindex, const char* lpCertStore, int lenCertStore);
char* ipworksencrypt_cms_getcertstorepassword(void* lpObj, int certindex);
int ipworksencrypt_cms_setcertstorepassword(void* lpObj, int certindex, const char* lpszCertStorePassword);
int ipworksencrypt_cms_getcertstoretype(void* lpObj, int certindex);
int ipworksencrypt_cms_setcertstoretype(void* lpObj, int certindex, int iCertStoreType);
char* ipworksencrypt_cms_getcertsubjectaltnames(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertthumbprintmd5(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertthumbprintsha1(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertthumbprintsha256(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertusage(void* lpObj, int certindex);
int ipworksencrypt_cms_getcertusageflags(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertversion(void* lpObj, int certindex);
char* ipworksencrypt_cms_getcertsubject(void* lpObj, int certindex);
int ipworksencrypt_cms_setcertsubject(void* lpObj, int certindex, const char* lpszCertSubject);
int ipworksencrypt_cms_getcertencoded(void* lpObj, int certindex, char** lpCertEncoded, int* lenCertEncoded);
int ipworksencrypt_cms_setcertencoded(void* lpObj, int certindex, const char* lpCertEncoded, int lenCertEncoded);
int GetCertCount();
int SetCertCount(int iCertCount); QString GetCertEffectiveDate(int iCertIndex); QString GetCertExpirationDate(int iCertIndex); QString GetCertExtendedKeyUsage(int iCertIndex); QString GetCertFingerprint(int iCertIndex); QString GetCertFingerprintSHA1(int iCertIndex); QString GetCertFingerprintSHA256(int iCertIndex); QString GetCertIssuer(int iCertIndex); QString GetCertPrivateKey(int iCertIndex); bool GetCertPrivateKeyAvailable(int iCertIndex); QString GetCertPrivateKeyContainer(int iCertIndex); QString GetCertPublicKey(int iCertIndex); QString GetCertPublicKeyAlgorithm(int iCertIndex); int GetCertPublicKeyLength(int iCertIndex); QString GetCertSerialNumber(int iCertIndex); QString GetCertSignatureAlgorithm(int iCertIndex); QByteArray GetCertStore(int iCertIndex);
int SetCertStore(int iCertIndex, QByteArray qbaCertStore); QString GetCertStorePassword(int iCertIndex);
int SetCertStorePassword(int iCertIndex, QString qsCertStorePassword); int GetCertStoreType(int iCertIndex);
int SetCertStoreType(int iCertIndex, int iCertStoreType); QString GetCertSubjectAltNames(int iCertIndex); QString GetCertThumbprintMD5(int iCertIndex); QString GetCertThumbprintSHA1(int iCertIndex); QString GetCertThumbprintSHA256(int iCertIndex); QString GetCertUsage(int iCertIndex); int GetCertUsageFlags(int iCertIndex); QString GetCertVersion(int iCertIndex); QString GetCertSubject(int iCertIndex);
int SetCertSubject(int iCertIndex, QString qsCertSubject); QByteArray GetCertEncoded(int iCertIndex);
int SetCertEncoded(int iCertIndex, QByteArray qbaCertEncoded);
Remarks
This property hold a collection of certificates used when Sign is called. The input message will be signed with each certificate specified in this property. AddCertificate may also be used to add a certificate to this collection.
The certificate(s) specified here are also used to decrypt the message when Decrypt is called.
Data Type
DetachedSignature Property (CMS Class)
Specifies whether to include a detached signature when signing a message.
Syntax
ANSI (Cross Platform) int GetDetachedSignature();
int SetDetachedSignature(int bDetachedSignature); Unicode (Windows) BOOL GetDetachedSignature();
INT SetDetachedSignature(BOOL bDetachedSignature);
int ipworksencrypt_cms_getdetachedsignature(void* lpObj);
int ipworksencrypt_cms_setdetachedsignature(void* lpObj, int bDetachedSignature);
bool GetDetachedSignature();
int SetDetachedSignature(bool bDetachedSignature);
Default Value
FALSE
Remarks
This property specifies whether the Sign operation products a message that includes both a signature and the message data, or just a signature.
When set to False default the output message holds the data and signature in one CMS message. This may be passed in its entirety to the receiving party for signature verification.
When set to True the output message holds only a signature in the CMS message. Both the original input data and the signature in the output message produced by the Sign operation must be passed to the receiving party for signature verification.
Data Type
Boolean
DetachedSignatureData Property (CMS Class)
The detached signature.
Syntax
ANSI (Cross Platform) int GetDetachedSignatureData(char* &lpDetachedSignatureData, int &lenDetachedSignatureData);
int SetDetachedSignatureData(const char* lpDetachedSignatureData, int lenDetachedSignatureData); Unicode (Windows) INT GetDetachedSignatureData(LPSTR &lpDetachedSignatureData, INT &lenDetachedSignatureData);
INT SetDetachedSignatureData(LPCSTR lpDetachedSignatureData, INT lenDetachedSignatureData);
int ipworksencrypt_cms_getdetachedsignaturedata(void* lpObj, char** lpDetachedSignatureData, int* lenDetachedSignatureData);
int ipworksencrypt_cms_setdetachedsignaturedata(void* lpObj, const char* lpDetachedSignatureData, int lenDetachedSignatureData);
QByteArray GetDetachedSignatureData();
int SetDetachedSignatureData(QByteArray qbaDetachedSignatureData);
Default Value
""
Remarks
This setting is used to specify the detached signature before calling VerifySignature. The message data should be specified normally and this property should be set to the detached signature data. This may be set to the PEM, DER, or SMIME encoded signature message.
Data Type
Binary String
EnableCompression Property (CMS Class)
Specifies whether to compress the message.
Syntax
ANSI (Cross Platform) int GetEnableCompression();
int SetEnableCompression(int bEnableCompression); Unicode (Windows) BOOL GetEnableCompression();
INT SetEnableCompression(BOOL bEnableCompression);
int ipworksencrypt_cms_getenablecompression(void* lpObj);
int ipworksencrypt_cms_setenablecompression(void* lpObj, int bEnableCompression);
bool GetEnableCompression();
int SetEnableCompression(bool bEnableCompression);
Default Value
FALSE
Remarks
This property specifies whether the input data will be compressed during the signing process.
If set to True the data will be compressed. If set to False (default) the data will not be compressed.
When compression is enabled the input will first be signed, and then compressed. To compress the data before signing set CompressBeforeSign.
Data Type
Boolean
EncryptionAlgorithm Property (CMS Class)
The algorithm used for encryption.
Syntax
ANSI (Cross Platform) char* GetEncryptionAlgorithm();
int SetEncryptionAlgorithm(const char* lpszEncryptionAlgorithm); Unicode (Windows) LPWSTR GetEncryptionAlgorithm();
INT SetEncryptionAlgorithm(LPCWSTR lpszEncryptionAlgorithm);
char* ipworksencrypt_cms_getencryptionalgorithm(void* lpObj);
int ipworksencrypt_cms_setencryptionalgorithm(void* lpObj, const char* lpszEncryptionAlgorithm);
QString GetEncryptionAlgorithm();
int SetEncryptionAlgorithm(QString qsEncryptionAlgorithm);
Default Value
"3DES"
Remarks
This property specifies the encryption algorithm used when Encrypt is called.
This may be the name of the algorithm, or the corresponding OID of the algorithm. The default value is 3DES. Possible values are:
- "3DES"
- "DES"
- "RC2CBC40"
- "RC2CBC64"
- "RC2CBC128" or "RC2"
- "AESCBC128" or "AES"
- "AESCBC192"
- "AESCBC256"
- "AESGCM128" or "AESGCM"
- "AESGCM192"
- "AESGCM256"
Data Type
String
IncludeCertificates Property (CMS Class)
Specifies whether to include the signer's certificate with the signed message.
Syntax
ANSI (Cross Platform) int GetIncludeCertificates();
int SetIncludeCertificates(int iIncludeCertificates); Unicode (Windows) INT GetIncludeCertificates();
INT SetIncludeCertificates(INT iIncludeCertificates);
Possible Values
ICS_NONE(0),
ICS_SIGNER_CERTS(1),
ICS_SIGNER_CERTS_AND_CHAIN(2)
int ipworksencrypt_cms_getincludecertificates(void* lpObj);
int ipworksencrypt_cms_setincludecertificates(void* lpObj, int iIncludeCertificates);
int GetIncludeCertificates();
int SetIncludeCertificates(int iIncludeCertificates);
Default Value
1
Remarks
This setting specifies which certificates (if any) are included in the signed message. By default the public certificate of the certificate used to sign the message is included. This allows the receiving party to verify the signature without any additional knowledge. If this is set to icsNone the recipient must obtain and specify the public certificate to be used for signature verification. Possible values are:
| Value | Description |
| 0 (icsNone) | No signer certificates are included. |
| 1 (icsSignerCerts - default) | The certificates specified in Certificates are included. |
| 2 (icsSignerCertsAndChain) | The certificates specified in Certificates and the full chain of each certificate are included. |
Data Type
Integer
InputFile Property (CMS Class)
The file to process.
Syntax
ANSI (Cross Platform) char* GetInputFile();
int SetInputFile(const char* lpszInputFile); Unicode (Windows) LPWSTR GetInputFile();
INT SetInputFile(LPCWSTR lpszInputFile);
char* ipworksencrypt_cms_getinputfile(void* lpObj);
int ipworksencrypt_cms_setinputfile(void* lpObj, const char* lpszInputFile);
QString GetInputFile();
int SetInputFile(QString qsInputFile);
Default Value
""
Remarks
This property specifies the file to be processed. Set this property to the full or relative path to the file which will be processed.
Encrypt and/or Sign
When encrypting or signing this may be set to a file containing content that will be encrypted and/or signed.
Decrypt and/or Verify
When decrypting or verifying a signature this may be set to a file containing the PEM, DER, or SMIME encoded message.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Data Type
String
InputMessage Property (CMS Class)
The message to process.
Syntax
ANSI (Cross Platform) int GetInputMessage(char* &lpInputMessage, int &lenInputMessage);
int SetInputMessage(const char* lpInputMessage, int lenInputMessage); Unicode (Windows) INT GetInputMessage(LPSTR &lpInputMessage, INT &lenInputMessage);
INT SetInputMessage(LPCSTR lpInputMessage, INT lenInputMessage);
int ipworksencrypt_cms_getinputmessage(void* lpObj, char** lpInputMessage, int* lenInputMessage);
int ipworksencrypt_cms_setinputmessage(void* lpObj, const char* lpInputMessage, int lenInputMessage);
QByteArray GetInputMessage();
int SetInputMessage(QByteArray qbaInputMessage);
Default Value
""
Remarks
This property specifies the message to be processed.
Encrypt and/or Sign
When encrypting or signing this may be set to the content that will be encrypted and/or signed.
Decrypt and/or Verify
When decrypting or verifying a signature this may be set to the PEM, DER, or SMIME encoded message.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Data Type
Binary String
OutputFile Property (CMS Class)
The output file.
Syntax
ANSI (Cross Platform) char* GetOutputFile();
int SetOutputFile(const char* lpszOutputFile); Unicode (Windows) LPWSTR GetOutputFile();
INT SetOutputFile(LPCWSTR lpszOutputFile);
char* ipworksencrypt_cms_getoutputfile(void* lpObj);
int ipworksencrypt_cms_setoutputfile(void* lpObj, const char* lpszOutputFile);
QString GetOutputFile();
int SetOutputFile(QString qsOutputFile);
Default Value
""
Remarks
This property specifies the file to which the output will be written. This may be set to an absolute or relative path.
Encrypt and/or Sign
When encrypting or signing this specifies a file where the message will be written.
Decrypt and/or Verify
When decrypting or verifying a signature this specifies a file where the decrypted/verified content will be written.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Data Type
String
OutputFormat Property (CMS Class)
Specifies the output format.
Syntax
ANSI (Cross Platform) char* GetOutputFormat();
int SetOutputFormat(const char* lpszOutputFormat); Unicode (Windows) LPWSTR GetOutputFormat();
INT SetOutputFormat(LPCWSTR lpszOutputFormat);
char* ipworksencrypt_cms_getoutputformat(void* lpObj);
int ipworksencrypt_cms_setoutputformat(void* lpObj, const char* lpszOutputFormat);
QString GetOutputFormat();
int SetOutputFormat(QString qsOutputFormat);
Default Value
"PEM"
Remarks
This property specifies the format of the output message created when calling Sign, Encrypt, or SignAndEncrypt.
The various formats allow for easier transport of the signed or encrypted message, as well as interoperability with other utilities.
Possible values are:
| Value | Description |
| PEM (default) | A PEM formatted message. For instance:
-----BEGIN CMS----- MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABGFD b250ZW50LVR5cGU6IHRleHQvcGxhaW47IGNoYXJzZXQ9Imlzby04ODU5LTEiDQpDb250ZW50LVRy ... mlJLPoCw5pf3Cjae56oXs29IZMcDXKersNjFGYSaG0o9k3lAcj9llLFh54Xr1ljx7K0VpVvlrmgu kNHAf7cUvvilW/KrDa+T2n+sOFAAAAAAAAA= -----END CMS----- |
| DER | The message is binary (raw bytes). |
| SMIME | The message is S/MIME encoded. For instance:
MIME-Version: 1.0 Content-Type: application/pkcs7-mime; smime-type=signed-data; name="smime.p7m" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7m" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABGFD b250ZW50LVR5cGU6IHRleHQvcGxhaW47IGNoYXJzZXQ9Imlzby04ODU5LTEiDQpDb250ZW50LVRy ... Mpc/PtPNeHA3CCFGRFnHju/yb9CsQWpgf8TTWytjP7O1hFUecW0yiuGSDeeNlQ4ZcX0TOm6haRMT lqYIrHUNMn4tYaREevNBL9CQB8MAAAAAAAA= |
Data Type
String
OutputMessage Property (CMS Class)
The output message after processing.
Syntax
ANSI (Cross Platform) int GetOutputMessage(char* &lpOutputMessage, int &lenOutputMessage); Unicode (Windows) INT GetOutputMessage(LPSTR &lpOutputMessage, INT &lenOutputMessage);
int ipworksencrypt_cms_getoutputmessage(void* lpObj, char** lpOutputMessage, int* lenOutputMessage);
QByteArray GetOutputMessage();
Default Value
""
Remarks
This property will be populated with the output of the operation if OutputFile is not set.
Encrypt and/or Sign
When encrypting or signing this will hold the fully encoded message.
Decrypt and/or Verify
When decrypting or verifying a signature this will hold the decrypted/verified content.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
This property is read-only.
Data Type
Binary String
RecipientCerts Property (CMS Class)
The collection of recipient certificates.
Syntax
IPWorksEncryptList<IPWorksEncryptCertificate>* GetRecipientCerts(); int SetRecipientCerts(IPWorksEncryptList<IPWorksEncryptCertificate>* val);
int ipworksencrypt_cms_getrecipientcertcount(void* lpObj);
int ipworksencrypt_cms_setrecipientcertcount(void* lpObj, int iRecipientCertCount);
char* ipworksencrypt_cms_getrecipientcerteffectivedate(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertexpirationdate(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertextendedkeyusage(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertfingerprint(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertfingerprintsha1(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertfingerprintsha256(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertissuer(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertprivatekey(void* lpObj, int recipientcertindex);
int ipworksencrypt_cms_getrecipientcertprivatekeyavailable(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertprivatekeycontainer(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertpublickey(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertpublickeyalgorithm(void* lpObj, int recipientcertindex);
int ipworksencrypt_cms_getrecipientcertpublickeylength(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertserialnumber(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertsignaturealgorithm(void* lpObj, int recipientcertindex);
int ipworksencrypt_cms_getrecipientcertstore(void* lpObj, int recipientcertindex, char** lpRecipientCertStore, int* lenRecipientCertStore);
int ipworksencrypt_cms_setrecipientcertstore(void* lpObj, int recipientcertindex, const char* lpRecipientCertStore, int lenRecipientCertStore);
char* ipworksencrypt_cms_getrecipientcertstorepassword(void* lpObj, int recipientcertindex);
int ipworksencrypt_cms_setrecipientcertstorepassword(void* lpObj, int recipientcertindex, const char* lpszRecipientCertStorePassword);
int ipworksencrypt_cms_getrecipientcertstoretype(void* lpObj, int recipientcertindex);
int ipworksencrypt_cms_setrecipientcertstoretype(void* lpObj, int recipientcertindex, int iRecipientCertStoreType);
char* ipworksencrypt_cms_getrecipientcertsubjectaltnames(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertthumbprintmd5(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertthumbprintsha1(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertthumbprintsha256(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertusage(void* lpObj, int recipientcertindex);
int ipworksencrypt_cms_getrecipientcertusageflags(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertversion(void* lpObj, int recipientcertindex);
char* ipworksencrypt_cms_getrecipientcertsubject(void* lpObj, int recipientcertindex);
int ipworksencrypt_cms_setrecipientcertsubject(void* lpObj, int recipientcertindex, const char* lpszRecipientCertSubject);
int ipworksencrypt_cms_getrecipientcertencoded(void* lpObj, int recipientcertindex, char** lpRecipientCertEncoded, int* lenRecipientCertEncoded);
int ipworksencrypt_cms_setrecipientcertencoded(void* lpObj, int recipientcertindex, const char* lpRecipientCertEncoded, int lenRecipientCertEncoded);
int GetRecipientCertCount();
int SetRecipientCertCount(int iRecipientCertCount); QString GetRecipientCertEffectiveDate(int iRecipientCertIndex); QString GetRecipientCertExpirationDate(int iRecipientCertIndex); QString GetRecipientCertExtendedKeyUsage(int iRecipientCertIndex); QString GetRecipientCertFingerprint(int iRecipientCertIndex); QString GetRecipientCertFingerprintSHA1(int iRecipientCertIndex); QString GetRecipientCertFingerprintSHA256(int iRecipientCertIndex); QString GetRecipientCertIssuer(int iRecipientCertIndex); QString GetRecipientCertPrivateKey(int iRecipientCertIndex); bool GetRecipientCertPrivateKeyAvailable(int iRecipientCertIndex); QString GetRecipientCertPrivateKeyContainer(int iRecipientCertIndex); QString GetRecipientCertPublicKey(int iRecipientCertIndex); QString GetRecipientCertPublicKeyAlgorithm(int iRecipientCertIndex); int GetRecipientCertPublicKeyLength(int iRecipientCertIndex); QString GetRecipientCertSerialNumber(int iRecipientCertIndex); QString GetRecipientCertSignatureAlgorithm(int iRecipientCertIndex); QByteArray GetRecipientCertStore(int iRecipientCertIndex);
int SetRecipientCertStore(int iRecipientCertIndex, QByteArray qbaRecipientCertStore); QString GetRecipientCertStorePassword(int iRecipientCertIndex);
int SetRecipientCertStorePassword(int iRecipientCertIndex, QString qsRecipientCertStorePassword); int GetRecipientCertStoreType(int iRecipientCertIndex);
int SetRecipientCertStoreType(int iRecipientCertIndex, int iRecipientCertStoreType); QString GetRecipientCertSubjectAltNames(int iRecipientCertIndex); QString GetRecipientCertThumbprintMD5(int iRecipientCertIndex); QString GetRecipientCertThumbprintSHA1(int iRecipientCertIndex); QString GetRecipientCertThumbprintSHA256(int iRecipientCertIndex); QString GetRecipientCertUsage(int iRecipientCertIndex); int GetRecipientCertUsageFlags(int iRecipientCertIndex); QString GetRecipientCertVersion(int iRecipientCertIndex); QString GetRecipientCertSubject(int iRecipientCertIndex);
int SetRecipientCertSubject(int iRecipientCertIndex, QString qsRecipientCertSubject); QByteArray GetRecipientCertEncoded(int iRecipientCertIndex);
int SetRecipientCertEncoded(int iRecipientCertIndex, QByteArray qbaRecipientCertEncoded);
Remarks
This property is used to specify one or more public certificate used to encrypt the message. The certificates should be the public certificate of the recipient who will decrypt the message. The certificate(s) must be set before calling Encrypt or SignAndEncrypt methods.
This property is not available at design time.
Data Type
SignatureHashAlgorithm Property (CMS Class)
The signature hash algorithm used during signing.
Syntax
ANSI (Cross Platform) char* GetSignatureHashAlgorithm();
int SetSignatureHashAlgorithm(const char* lpszSignatureHashAlgorithm); Unicode (Windows) LPWSTR GetSignatureHashAlgorithm();
INT SetSignatureHashAlgorithm(LPCWSTR lpszSignatureHashAlgorithm);
char* ipworksencrypt_cms_getsignaturehashalgorithm(void* lpObj);
int ipworksencrypt_cms_setsignaturehashalgorithm(void* lpObj, const char* lpszSignatureHashAlgorithm);
QString GetSignatureHashAlgorithm();
int SetSignatureHashAlgorithm(QString qsSignatureHashAlgorithm);
Default Value
"SHA256"
Remarks
This property specifies the signature hash algorithm used when Sign is called.
When Sign is called the input data is first hashed with the algorithm specified by this property to produce a message digest. The computed digest is then digitally signed with the certificates specified in Certificates.
The value specified here may be the name of the algorithm or the corresponding OID. Possible values are:
- "SHA-256" (default)
- "SHA-384"
- "SHA-512"
- "SHA-224"
- "SHA1"
- "MD5"
Data Type
String
SignerCerts Property (CMS Class)
The collection of signer certificates.
Syntax
IPWorksEncryptList<IPWorksEncryptCertificate>* GetSignerCerts(); int SetSignerCerts(IPWorksEncryptList<IPWorksEncryptCertificate>* val);
int ipworksencrypt_cms_getsignercertcount(void* lpObj);
int ipworksencrypt_cms_setsignercertcount(void* lpObj, int iSignerCertCount);
char* ipworksencrypt_cms_getsignercerteffectivedate(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertexpirationdate(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertextendedkeyusage(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertfingerprint(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertfingerprintsha1(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertfingerprintsha256(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertissuer(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertprivatekey(void* lpObj, int signercertindex);
int ipworksencrypt_cms_getsignercertprivatekeyavailable(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertprivatekeycontainer(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertpublickey(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertpublickeyalgorithm(void* lpObj, int signercertindex);
int ipworksencrypt_cms_getsignercertpublickeylength(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertserialnumber(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertsignaturealgorithm(void* lpObj, int signercertindex);
int ipworksencrypt_cms_getsignercertstore(void* lpObj, int signercertindex, char** lpSignerCertStore, int* lenSignerCertStore);
int ipworksencrypt_cms_setsignercertstore(void* lpObj, int signercertindex, const char* lpSignerCertStore, int lenSignerCertStore);
char* ipworksencrypt_cms_getsignercertstorepassword(void* lpObj, int signercertindex);
int ipworksencrypt_cms_setsignercertstorepassword(void* lpObj, int signercertindex, const char* lpszSignerCertStorePassword);
int ipworksencrypt_cms_getsignercertstoretype(void* lpObj, int signercertindex);
int ipworksencrypt_cms_setsignercertstoretype(void* lpObj, int signercertindex, int iSignerCertStoreType);
char* ipworksencrypt_cms_getsignercertsubjectaltnames(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertthumbprintmd5(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertthumbprintsha1(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertthumbprintsha256(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertusage(void* lpObj, int signercertindex);
int ipworksencrypt_cms_getsignercertusageflags(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertversion(void* lpObj, int signercertindex);
char* ipworksencrypt_cms_getsignercertsubject(void* lpObj, int signercertindex);
int ipworksencrypt_cms_setsignercertsubject(void* lpObj, int signercertindex, const char* lpszSignerCertSubject);
int ipworksencrypt_cms_getsignercertencoded(void* lpObj, int signercertindex, char** lpSignerCertEncoded, int* lenSignerCertEncoded);
int ipworksencrypt_cms_setsignercertencoded(void* lpObj, int signercertindex, const char* lpSignerCertEncoded, int lenSignerCertEncoded);
int GetSignerCertCount();
int SetSignerCertCount(int iSignerCertCount); QString GetSignerCertEffectiveDate(int iSignerCertIndex); QString GetSignerCertExpirationDate(int iSignerCertIndex); QString GetSignerCertExtendedKeyUsage(int iSignerCertIndex); QString GetSignerCertFingerprint(int iSignerCertIndex); QString GetSignerCertFingerprintSHA1(int iSignerCertIndex); QString GetSignerCertFingerprintSHA256(int iSignerCertIndex); QString GetSignerCertIssuer(int iSignerCertIndex); QString GetSignerCertPrivateKey(int iSignerCertIndex); bool GetSignerCertPrivateKeyAvailable(int iSignerCertIndex); QString GetSignerCertPrivateKeyContainer(int iSignerCertIndex); QString GetSignerCertPublicKey(int iSignerCertIndex); QString GetSignerCertPublicKeyAlgorithm(int iSignerCertIndex); int GetSignerCertPublicKeyLength(int iSignerCertIndex); QString GetSignerCertSerialNumber(int iSignerCertIndex); QString GetSignerCertSignatureAlgorithm(int iSignerCertIndex); QByteArray GetSignerCertStore(int iSignerCertIndex);
int SetSignerCertStore(int iSignerCertIndex, QByteArray qbaSignerCertStore); QString GetSignerCertStorePassword(int iSignerCertIndex);
int SetSignerCertStorePassword(int iSignerCertIndex, QString qsSignerCertStorePassword); int GetSignerCertStoreType(int iSignerCertIndex);
int SetSignerCertStoreType(int iSignerCertIndex, int iSignerCertStoreType); QString GetSignerCertSubjectAltNames(int iSignerCertIndex); QString GetSignerCertThumbprintMD5(int iSignerCertIndex); QString GetSignerCertThumbprintSHA1(int iSignerCertIndex); QString GetSignerCertThumbprintSHA256(int iSignerCertIndex); QString GetSignerCertUsage(int iSignerCertIndex); int GetSignerCertUsageFlags(int iSignerCertIndex); QString GetSignerCertVersion(int iSignerCertIndex); QString GetSignerCertSubject(int iSignerCertIndex);
int SetSignerCertSubject(int iSignerCertIndex, QString qsSignerCertSubject); QByteArray GetSignerCertEncoded(int iSignerCertIndex);
int SetSignerCertEncoded(int iSignerCertIndex, QByteArray qbaSignerCertEncoded);
Remarks
This property is used to specify one or more public certificate used to verify the message. The certificates should be the public certificate of the recipient who will verify the message.
This property is only required if a certificate is not included in the signed message. The SignerCertInfo event fires during verification with information about the signer certificate. This property may be populated from within the SignerCertInfo.
This property will also be populated after VerifySignature or DecryptAndVerifySignature is called with the certificate(s) present within the signed message (if any).
This property is not available at design time.
Data Type
UseOAEP Property (CMS Class)
This property specifies whether or not to use Optimal Asymmetric Encryption Padding (OAEP).
Syntax
ANSI (Cross Platform) int GetUseOAEP();
int SetUseOAEP(int bUseOAEP); Unicode (Windows) BOOL GetUseOAEP();
INT SetUseOAEP(BOOL bUseOAEP);
int ipworksencrypt_cms_getuseoaep(void* lpObj);
int ipworksencrypt_cms_setuseoaep(void* lpObj, int bUseOAEP);
bool GetUseOAEP();
int SetUseOAEP(bool bUseOAEP);
Default Value
FALSE
Remarks
This property specifies whether or not to use Optimal Asymmetric Encryption Padding (OAEP). By default, this value is False and the class will use PKCS1.
To specify nondefault OAEP options, please see OAEPRSAHashAlgorithm, OAEPMGF1HashAlgorithm, and OAEPParams
Data Type
Boolean
UsePSS Property (CMS Class)
Whether to use RSA-PSS during signing and verification.
Syntax
ANSI (Cross Platform) int GetUsePSS();
int SetUsePSS(int bUsePSS); Unicode (Windows) BOOL GetUsePSS();
INT SetUsePSS(BOOL bUsePSS);
int ipworksencrypt_cms_getusepss(void* lpObj);
int ipworksencrypt_cms_setusepss(void* lpObj, int bUsePSS);
bool GetUsePSS();
int SetUsePSS(bool bUsePSS);
Default Value
FALSE
Remarks
This property specifies whether RSA-PSS will be used when signing and verifying messages. The default value is False.
Data Type
Boolean
AddCertificate Method (CMS Class)
Used to add certificates for signing.
Syntax
ANSI (Cross Platform) int AddCertificate(int iCertStoreType, const char* lpszCertStore, const char* lpszCertStorePassword, const char* lpszCertSubject); Unicode (Windows) INT AddCertificate(INT iCertStoreType, LPCWSTR lpszCertStore, LPCWSTR lpszCertStorePassword, LPCWSTR lpszCertSubject);
int ipworksencrypt_cms_addcertificate(void* lpObj, int iCertStoreType, const char* lpszCertStore, const char* lpszCertStorePassword, const char* lpszCertSubject);
int AddCertificate(int iCertStoreType, const QString& qsCertStore, const QString& qsCertStorePassword, const QString& qsCertSubject);
Remarks
This method adds a signing certificate. Signing certificates may be added using this method or by adding a certificate directly to Certificates.
The added certificate(s) will be used to sign the message when Sign is called.
CertStoreType specifies the type of certificate store. The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This field can take one of the following values:
| 0 (cstUser - default) | For Windows, this specifies that the certificate store is a certificate store owned by the current user.
Note: This store type is not available in Java. |
| 1 (cstMachine) | For Windows, this specifies that the certificate store is a machine store.
Note: This store type is not available in Java. |
| 2 (cstPFXFile) | The certificate store is the name of a PFX (PKCS#12) file containing certificates. |
| 3 (cstPFXBlob) | The certificate store is a string (binary or Base64-encoded) representing a certificate store in PFX (PKCS#12) format. |
| 4 (cstJKSFile) | The certificate store is the name of a Java Key Store (JKS) file containing certificates.
Note: This store type is only available in Java. |
| 5 (cstJKSBlob) | The certificate store is a string (binary or Base64-encoded) representing a certificate store in Java Key Store (JKS) format.
Note: This store type is only available in Java. |
| 6 (cstPEMKeyFile) | The certificate store is the name of a PEM-encoded file that contains a private key and an optional certificate. |
| 7 (cstPEMKeyBlob) | The certificate store is a string (binary or Base64-encoded) that contains a private key and an optional certificate. |
| 8 (cstPublicKeyFile) | The certificate store is the name of a file that contains a PEM- or DER-encoded public key certificate. |
| 9 (cstPublicKeyBlob) | The certificate store is a string (binary or Base64-encoded) that contains a PEM- or DER-encoded public key certificate. |
| 10 (cstSSHPublicKeyBlob) | The certificate store is a string (binary or Base64-encoded) that contains an SSH-style public key. |
| 11 (cstP7BFile) | The certificate store is the name of a PKCS#7 file containing certificates. |
| 12 (cstP7BBlob) | The certificate store is a string (binary) representing a certificate store in PKCS#7 format. |
| 13 (cstSSHPublicKeyFile) | The certificate store is the name of a file that contains an SSH-style public key. |
| 14 (cstPPKFile) | The certificate store is the name of a file that contains a PPK (PuTTY Private Key). |
| 15 (cstPPKBlob) | The certificate store is a string (binary) that contains a PPK (PuTTY Private Key). |
| 16 (cstXMLFile) | The certificate store is the name of a file that contains a certificate in XML format. |
| 17 (cstXMLBlob) | The certificate store is a string that contains a certificate in XML format. |
| 18 (cstJWKFile) | The certificate store is the name of a file that contains a JWK (JSON Web Key). |
| 19 (cstJWKBlob) | The certificate store is a string that contains a JWK (JSON Web Key). |
| 21 (cstBCFKSFile) | The certificate store is the name of a file that contains a BCFKS (Bouncy Castle FIPS Key Store).
Note: This store type is only available in Java and .NET. |
| 22 (cstBCFKSBlob) | The certificate store is a string (binary or Base64-encoded) representing a certificate store in BCFKS (Bouncy Castle FIPS Key Store) format.
Note: This store type is only available in Java and .NET. |
| 23 (cstPKCS11) | The certificate is present on a physical security key accessible via a PKCS#11 interface.
To use a security key, the necessary data must first be collected using the CertMgr class. The ListStoreCertificates method may be called after setting CertStoreType to cstPKCS11, CertStorePassword to the PIN, and CertStore to the full path of the PKCS#11 DLL. The certificate information returned in the CertList event's CertEncoded parameter may be saved for later use. When using a certificate, pass the previously saved security key information as the Store and set StorePassword to the PIN. Code Example. SSH Authentication with Security Key:
|
| 99 (cstAuto) | The store type is automatically detected from the input data. This setting may be used with both public and private keys and can detect any of the supported formats automatically. |
CertStore specifies the path to the certificate file. If the CertStoreType is a blob, this specifies the certificate content. See Certificates for details.
CertStorePassword is the password for the certificate (if any).
CertSubject specified the subject of the certificate to load. The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:
| Field | Meaning |
| CN | Common Name. This is commonly a hostname like www.server.com. |
| O | Organization |
| OU | Organizational Unit |
| L | Locality |
| S | State |
| C | Country |
| E | Email Address |
If a field value contains a comma, it must be quoted.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
AddRecipientCert Method (CMS Class)
Used to add recipient certificates used to encrypt messages.
Syntax
ANSI (Cross Platform) int AddRecipientCert(const char* lpCertEncoded, int lenCertEncoded); Unicode (Windows) INT AddRecipientCert(LPCSTR lpCertEncoded, INT lenCertEncoded);
int ipworksencrypt_cms_addrecipientcert(void* lpObj, const char* lpCertEncoded, int lenCertEncoded);
int AddRecipientCert(QByteArray qbaCertEncoded);
Remarks
This method adds a public certificate used when Encrypt is called. Public certificates of recipients may be added using this method or by adding a certificate directly to the RecipientCerts property.
CertEncoded must contain the PEM or Base64 encoded public certificate.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
Config Method (CMS Class)
Sets or retrieves a configuration setting.
Syntax
ANSI (Cross Platform) char* Config(const char* lpszConfigurationString); Unicode (Windows) LPWSTR Config(LPCWSTR lpszConfigurationString);
char* ipworksencrypt_cms_config(void* lpObj, const char* lpszConfigurationString);
QString Config(const QString& qsConfigurationString);
Remarks
Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.
These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.
To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).
To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.
Error Handling (C++)
This method returns a String value; after it returns, call the GetLastErrorCode() method to obtain its result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message.
Decrypt Method (CMS Class)
Decrypts the current message.
Syntax
ANSI (Cross Platform) int Decrypt(); Unicode (Windows) INT Decrypt();
int ipworksencrypt_cms_decrypt(void* lpObj);
int Decrypt();
Remarks
Decrypt decrypts the input data with the specified certificate. Certificates are specified by calling AddCertificate or setting the Certificates property.
If the certificate used to encrypt the message is not known ahead of time GetRecipientInfo may be called prior to calling Decrypt to obtain information about the recipient (the entity the for which the message was encrypted). If GetRecipientInfo is called, the RecipientInfo event is fired with information about the recipient which may be used to load an appropriate decryption certificate.
The following properties are applicable when calling this method:
- Certificates (Required)
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Encrypt and Decrypt a message
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt a message - DER Output Format
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.OutputFormat = "DER";
cms.Encrypt();
byte[] encryptedMessage = cms.OutputMessageB; //Binary output
cms = new Cms();
cms.InputMessageB = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt - Multiple Recipients
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test2.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt - Get Recipient Info
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
//If the recipient certificate is not known ahead of time the GetRecipientInfo method may be called
//to find information about the certificate.
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.OnRecipientInfo += (s, e) => {
Console.WriteLine(e.SerialNumber);
Console.WriteLine(e.Issuer);
if (e.Issuer == "CN=100") //Identify the certificate to load based on event params
{
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
}
};
cms.GetRecipientInfo();
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
DecryptAndVerifySignature Method (CMS Class)
Decrypts and verifies the signature of the current message.
Syntax
ANSI (Cross Platform) int DecryptAndVerifySignature(); Unicode (Windows) INT DecryptAndVerifySignature();
int ipworksencrypt_cms_decryptandverifysignature(void* lpObj);
int DecryptAndVerifySignature();
Remarks
This method decrypts the input data and verifies the signature. Decryption certificates are specified by calling AddCertificate or setting the Certificates property. Certificates used to verify the signature will be taken from the message itself if included, or from the SignerCerts property.
If the certificate used to encrypt the message is not known ahead of time GetRecipientInfo may be called prior to calling Decrypt to obtain information about the recipient (the entity the for which the message was encrypted). If GetRecipientInfo is called, the RecipientInfo event is fired with information about the recipient which may be used to load an appropriate decryption certificate.
In order to perform signature verification the public signer's certificate must be present or explicitly specified. In many cases the certificate itself is included in the input message and a certificate does not need to explicitly be set. If a certificate does need to be set for signature verification the certificate may be specified by calling AddRecipientCert or setting RecipientCerts.
When this method is called the SignerCertInfo event fires once for each signature on the message. This event provides details about the signer certificate, as well as the signer certificate itself (if present). The information provided via SignerCertInfo may be used to load an appropriate certificate for verification from within the event. If the CertEncoded parameter of SignerCertInfo is populated the certificate required for verification is already present in the message.
The following properties are applicable when calling this method:
If the input message is a detached signature, the original data that was signed must be specified in DetachedSignatureData. In addition the DetachedSignature property must be set to True to instruct the class to treat the input message as a detached signature.
If the input message is compressed EnableCompression must be set to True before calling this method.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
Encrypt Method (CMS Class)
Encrypts the current message.
Syntax
ANSI (Cross Platform) int Encrypt(); Unicode (Windows) INT Encrypt();
int ipworksencrypt_cms_encrypt(void* lpObj);
int Encrypt();
Remarks
Encrypt encrypts the input data with the the specified certificate(s). Certificates are specified by calling AddRecipientCert or setting the RecipientCerts property.
OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. Additional settings allow further configuration. The following properties are applicable when calling this method:
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Encrypt and Decrypt a message
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt a message - DER Output Format
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.OutputFormat = "DER";
cms.Encrypt();
byte[] encryptedMessage = cms.OutputMessageB; //Binary output
cms = new Cms();
cms.InputMessageB = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt - Multiple Recipients
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test2.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Encrypt and Decrypt - Get Recipient Info
Cms cms = new Cms();
cms.RecipientCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
cms.InputMessage = "My Data";
cms.Encrypt();
string encryptedMessage = cms.OutputMessage;
//If the recipient certificate is not known ahead of time the GetRecipientInfo method may be called
//to find information about the certificate.
cms = new Cms();
cms.InputMessage = encryptedMessage;
cms.OnRecipientInfo += (s, e) => {
Console.WriteLine(e.SerialNumber);
Console.WriteLine(e.Issuer);
if (e.Issuer == "CN=100") //Identify the certificate to load based on event params
{
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
}
};
cms.GetRecipientInfo();
cms.Decrypt();
string plaintextMessage = cms.OutputMessage;
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
GetRecipientInfo Method (CMS Class)
Gets the recipient certificate information for an encrypted message.
Syntax
ANSI (Cross Platform) int GetRecipientInfo(); Unicode (Windows) INT GetRecipientInfo();
int ipworksencrypt_cms_getrecipientinfo(void* lpObj);
int GetRecipientInfo();
Remarks
This method retrieves information about the recipient(s) of the encrypted message. This may be called prior to calling Decrypt to determine which certificate should be loaded for decryption.
When this method is called the RecipientInfo event fires once for each recipient found within the message. Use the parameters of the RecipientInfo to determine which certificate to specify via AddCertificate or Certificates before calling Decrypt.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
GetSignerCertInfo Method (CMS Class)
This method gets the signature information for an signed message.
Syntax
ANSI (Cross Platform) int GetSignerCertInfo(); Unicode (Windows) INT GetSignerCertInfo();
int ipworksencrypt_cms_getsignercertinfo(void* lpObj);
int GetSignerCertInfo();
Remarks
This method retrieves information about the certificate used to sign the message. This may be called before calling VerifySignature to determine which certificate should be loaded for verification.
When this method is called, the SignerCertInfo event fires once for each signer of the message. Use the parameters of the SignerCertInfo to determine which certificate to specify before calling VerifySignature.
Note: Use of this method is optional. If no certificate is specified before calling VerifySignature, the class will fire the SignerCertInfo and a certificate may be loaded from within the event at that time (if necessary).
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
Reset Method (CMS Class)
This method resets the class properties.
Syntax
ANSI (Cross Platform) int Reset(); Unicode (Windows) INT Reset();
int ipworksencrypt_cms_reset(void* lpObj);
int Reset();
Remarks
This method resets the values of all message and certificate properties. It is an easy way to reset the class properties before starting to populate with new values.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
SetInputStream Method (CMS Class)
Sets the stream from which the class will read data to encode or decode.
Syntax
ANSI (Cross Platform) int SetInputStream(IPWorksEncryptStream* sInputStream); Unicode (Windows) INT SetInputStream(IPWorksEncryptStream* sInputStream);
int ipworksencrypt_cms_setinputstream(void* lpObj, IPWorksEncryptStream* sInputStream);
int SetInputStream(IPWorksEncryptStream* sInputStream);
Remarks
This method sets the stream from which the class will read data to process.
Encrypt or Sign
When encrypting or signing this may be set to a stream with the content that will be encrypted and/or signed.
Decrypt or Verify
When decrypting or verifying a signature this may be set to a stream with the encrypted or signed message.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
SetOutputStream Method (CMS Class)
Sets the stream to which the class will read data to encode or decode.
Syntax
ANSI (Cross Platform) int SetOutputStream(IPWorksEncryptStream* sOutputStream); Unicode (Windows) INT SetOutputStream(IPWorksEncryptStream* sOutputStream);
int ipworksencrypt_cms_setoutputstream(void* lpObj, IPWorksEncryptStream* sOutputStream);
int SetOutputStream(IPWorksEncryptStream* sOutputStream);
Remarks
This method sets the stream to which the class will write processed data.
Encrypt or Sign
When encrypting or signing this may be set to a stream where the signed/encrypted data will be written.
Decrypt or Verify
When decrypting or verifying a signature this may be set to a stream where the decrypted/verified data will be written.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
Sign Method (CMS Class)
Signs the current message.
Syntax
ANSI (Cross Platform) int Sign(); Unicode (Windows) INT Sign();
int ipworksencrypt_cms_sign(void* lpObj);
int Sign();
Remarks
Sign digitally signs the input data with the the specified certificate(s). Certificates are specified by calling AddCertificate or setting the Certificates property.
OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. IncludeCertificates specifies whether the public certificate is included in the signed message. Additional settings allow further configuration. The following properties are applicable when calling this method:
- Certificates (required)
- DetachedSignature
- EnableCompression
- GenerateSignatureTimestamp
- IncludeCertificates
- OutputFormat
- SignatureHashAlgorithm
- UsePSS
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Sign and Verify a message
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - DER Output Format
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.OutputFormat = "DER";
cms.Sign();
byte[] signedMessage = cms.OutputMessageB; //Binary output
cms = new Cms();
cms.InputMessageB = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - Detached Signature
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.DetachedSignature = true;
cms.Sign();
string signature = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = "My Data";
cms.DetachedSignatureData = signature;
cms.DetachedSignature = true;
cms.VerifySignature();
Sign and Verify a message - Multiple Signatures
Cms cms = new Cms();
cms.InputMessage = "My Data";
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test2.pfx", "password2", "*"));
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - No Included Certificate
Cms cms = new Cms();
cms.InputMessage = "My Data";
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.IncludeCertificates = CmsIncludeCertificates.icsNone;
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.OnSignerCertInfo += (s, e) => {
Console.WriteLine(e.Issuer);
Console.WriteLine(e.SerialNumber);
if (e.Issuer == "CN=100") //Identify the certificate to load based on event params
{
//Load the correct signer certificate.
cms.SignerCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
}
};
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
SignAndEncrypt Method (CMS Class)
Signs and encrypts the current message.
Syntax
ANSI (Cross Platform) int SignAndEncrypt(); Unicode (Windows) INT SignAndEncrypt();
int ipworksencrypt_cms_signandencrypt(void* lpObj);
int SignAndEncrypt();
Remarks
This method signs encrypts the input data with the the specified certificate(s). Encryption certificates are specified by calling AddRecipientCert or setting the RecipientCerts property. Signing certificates are set via the Certificates property.
OutputFormat specifies the encoding of the output message. Valid values are PEM, DER, and SMIME. Additional settings allow further configuration. IncludeCertificates specifies whether the public certificate is included in the signed message. The following properties are applicable when calling this method:
- Certificates (required)
- RecipientCerts (required)
- DetachedSignature
- EnableCompression
- EncryptionAlgorithm
- GenerateSignatureTimestamp
- IncludeCertificates
- OutputFormat
- SignatureHashAlgorithm
- UseOAEP
- UsePSS
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
VerifySignature Method (CMS Class)
Verifies the signature of the current message.
Syntax
ANSI (Cross Platform) int VerifySignature(); Unicode (Windows) INT VerifySignature();
int ipworksencrypt_cms_verifysignature(void* lpObj);
int VerifySignature();
Remarks
VerifySignature verifies the signature of the input message.
In order to perform signature verification the public signer's certificate must be present or explicitly specified. In many cases the certificate itself is included in the input message and a certificate does not need to explicitly be set. If a certificate does need to be set for signature verification the certificate may be specified by calling AddRecipientCert or setting RecipientCerts.
When this method is called the SignerCertInfo event fires once for each signature on the message. This event provides details about the signer certificate, as well as the signer certificate itself (if present). The information provided via SignerCertInfo may be used to load an appropriate certificate for verification from within the event. If the CertEncoded parameter of SignerCertInfo is populated the certificate required for verification is already present in the message.
The following property are applicable when calling this method:
If the input message is a detached signature, the original data that was signed must be specified in DetachedSignatureData. In addition the DetachedSignature property must be set to True to instruct the class to treat the input message as a detached signature.
If the input message is compressed EnableCompression must be set to True before calling this method.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found, the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams, you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Sign and Verify a message
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - DER Output Format
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.OutputFormat = "DER";
cms.Sign();
byte[] signedMessage = cms.OutputMessageB; //Binary output
cms = new Cms();
cms.InputMessageB = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - Detached Signature
Cms cms = new Cms();
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.InputMessage = "My Data";
cms.DetachedSignature = true;
cms.Sign();
string signature = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = "My Data";
cms.DetachedSignatureData = signature;
cms.DetachedSignature = true;
cms.VerifySignature();
Sign and Verify a message - Multiple Signatures
Cms cms = new Cms();
cms.InputMessage = "My Data";
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test2.pfx", "password2", "*"));
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Sign and Verify a message - No Included Certificate
Cms cms = new Cms();
cms.InputMessage = "My Data";
cms.Certificates.Add(new Certificate(CertStoreTypes.cstPFXFile, @"C:\temp\test.pfx", "password", "*"));
cms.IncludeCertificates = CmsIncludeCertificates.icsNone;
cms.Sign();
string signedMessage = cms.OutputMessage;
cms = new Cms();
cms.OnSignerCertInfo += (s, e) => {
Console.WriteLine(e.Issuer);
Console.WriteLine(e.SerialNumber);
if (e.Issuer == "CN=100") //Identify the certificate to load based on event params
{
//Load the correct signer certificate.
cms.SignerCerts.Add(new Certificate(CertStoreTypes.cstPublicKeyFile, @"C:\temp\test.cer", "", "*"));
}
};
cms.InputMessage = signedMessage;
cms.VerifySignature();
string plaintextMessage = cms.OutputMessage;
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
Error Event (CMS Class)
Fired when information is available about errors during data delivery.
Syntax
ANSI (Cross Platform) virtual int FireError(CMSErrorEventParams *e);
typedef struct {
int ErrorCode;
const char *Description; int reserved; } CMSErrorEventParams;
Unicode (Windows) virtual INT FireError(CMSErrorEventParams *e);
typedef struct {
INT ErrorCode;
LPCWSTR Description; INT reserved; } CMSErrorEventParams;
#define EID_CMS_ERROR 1 virtual INT IPWORKSENCRYPT_CALL FireError(INT &iErrorCode, LPSTR &lpszDescription);
class CMSErrorEventParams {
public:
int ErrorCode();
const QString &Description();
int EventRetVal();
void SetEventRetVal(int iRetVal);
};
// To handle, connect one or more slots to this signal.
void Error(CMSErrorEventParams *e);
// Or, subclass CMS and override this emitter function.
virtual int FireError(CMSErrorEventParams *e) {...}
Remarks
The Error event is fired in case of exceptional conditions during message processing. Normally the class fails with an error.
The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.
Log Event (CMS Class)
Fires with log information during processing.
Syntax
ANSI (Cross Platform) virtual int FireLog(CMSLogEventParams *e);
typedef struct {
int LogLevel;
const char *Message;
const char *LogType; int reserved; } CMSLogEventParams;
Unicode (Windows) virtual INT FireLog(CMSLogEventParams *e);
typedef struct {
INT LogLevel;
LPCWSTR Message;
LPCWSTR LogType; INT reserved; } CMSLogEventParams;
#define EID_CMS_LOG 2 virtual INT IPWORKSENCRYPT_CALL FireLog(INT &iLogLevel, LPSTR &lpszMessage, LPSTR &lpszLogType);
class CMSLogEventParams {
public:
int LogLevel();
const QString &Message();
const QString &LogType();
int EventRetVal();
void SetEventRetVal(int iRetVal);
};
// To handle, connect one or more slots to this signal.
void Log(CMSLogEventParams *e);
// Or, subclass CMS and override this emitter function.
virtual int FireLog(CMSLogEventParams *e) {...}
Remarks
This event fires during processing with log information. The level of detail that is logged is controlled via the LogLevel.
LogLevel indicates the level of message. Possible values are:
| 0 (None) | No events are logged. |
| 1 (Info - default) | Informational events are logged. |
| 2 (Verbose) | Detailed data is logged. |
| 3 (Debug) | Debug data is logged. |
LogMessage is the log entry.
LogType indicates the type of log. Possible values are:
- "INFO"
- "ENCRYPT"
- "COMPRESS"
- "SIGN"
- "DECRYPT"
- "DECOMPRESS"
- "VERIFY"
- "DEBUG"
RecipientInfo Event (CMS Class)
This event is fired for each recipient certificate of the encrypted message.
Syntax
ANSI (Cross Platform) virtual int FireRecipientInfo(CMSRecipientInfoEventParams *e);
typedef struct {
const char *Issuer;
const char *SerialNumber;
const char *SubjectKeyIdentifier;
const char *EncryptionAlgorithm; int reserved; } CMSRecipientInfoEventParams;
Unicode (Windows) virtual INT FireRecipientInfo(CMSRecipientInfoEventParams *e);
typedef struct {
LPCWSTR Issuer;
LPCWSTR SerialNumber;
LPCWSTR SubjectKeyIdentifier;
LPCWSTR EncryptionAlgorithm; INT reserved; } CMSRecipientInfoEventParams;
#define EID_CMS_RECIPIENTINFO 3 virtual INT IPWORKSENCRYPT_CALL FireRecipientInfo(LPSTR &lpszIssuer, LPSTR &lpszSerialNumber, LPSTR &lpszSubjectKeyIdentifier, LPSTR &lpszEncryptionAlgorithm);
class CMSRecipientInfoEventParams {
public:
const QString &Issuer();
const QString &SerialNumber();
const QString &SubjectKeyIdentifier();
const QString &EncryptionAlgorithm();
int EventRetVal();
void SetEventRetVal(int iRetVal);
};
// To handle, connect one or more slots to this signal.
void RecipientInfo(CMSRecipientInfoEventParams *e);
// Or, subclass CMS and override this emitter function.
virtual int FireRecipientInfo(CMSRecipientInfoEventParams *e) {...}
Remarks
When GetRecipientInfo is called on a valid encrypted message, this event will fire once for each recipient certificate that the message has been encrypted for. This may be used to identify the certificate to load.
Issuer is the subject of the issuer certificate.
SerialNumber is the serial number of the encryption certificate.
SubjectKeyIdentifier is the X.509 subjectKeyIdentifier extension value of the certificate used to sign the message encoded as a hex string.
EncryptionAlgorithm is the encryption algorithm used to encrypt the message. Possible values are as follows:
- "3DES"
- "DES"
- "RC2CBC40"
- "RC2CBC64"
- "RC2CBC128" or "RC2"
- "AESCBC128" or "AES"
- "AESCBC192"
- "AESCBC256"
- "AESGCM128" or "AESGCM"
- "AESGCM192"
- "AESGCM256"
SignerCertInfo Event (CMS Class)
Fired during verification of the signed message.
Syntax
ANSI (Cross Platform) virtual int FireSignerCertInfo(CMSSignerCertInfoEventParams *e);
typedef struct {
const char *Issuer;
const char *SerialNumber;
const char *SubjectKeyIdentifier;
const char *CertEncoded; int lenCertEncoded; int reserved; } CMSSignerCertInfoEventParams;
Unicode (Windows) virtual INT FireSignerCertInfo(CMSSignerCertInfoEventParams *e);
typedef struct {
LPCWSTR Issuer;
LPCWSTR SerialNumber;
LPCWSTR SubjectKeyIdentifier;
LPCSTR CertEncoded; INT lenCertEncoded; INT reserved; } CMSSignerCertInfoEventParams;
#define EID_CMS_SIGNERCERTINFO 4 virtual INT IPWORKSENCRYPT_CALL FireSignerCertInfo(LPSTR &lpszIssuer, LPSTR &lpszSerialNumber, LPSTR &lpszSubjectKeyIdentifier, LPSTR &lpCertEncoded, INT &lenCertEncoded);
class CMSSignerCertInfoEventParams {
public:
const QString &Issuer();
const QString &SerialNumber();
const QString &SubjectKeyIdentifier();
const QByteArray &CertEncoded();
int EventRetVal();
void SetEventRetVal(int iRetVal);
};
// To handle, connect one or more slots to this signal.
void SignerCertInfo(CMSSignerCertInfoEventParams *e);
// Or, subclass CMS and override this emitter function.
virtual int FireSignerCertInfo(CMSSignerCertInfoEventParams *e) {...}
Remarks
During verification, this event will be raised while parsing the signer's certificate information. The parameters which are populated depends on the options used when the message was originally signed. This information may be used to select the correct certificate for SignerCerts in order to verify the signature. The following parameters may be populated.
Issuer specifies the subject of the issuer of the certificate used to sign the message.
SerialNumber is the serial number of the certificate used to sign the message.
SubjectKeyIdentifier is the X.509 subjectKeyIdentifier extension value of the certificate used to sign the message encoded as a hex string.
CertEncoded is the PEM (base64 encoded) public certificate needed to verify the signature. Note: when this value is present the class will automatically use this value to perform signature verification.
The SignerCerts property may be set from within this event. In this manner the decision of which signer certificate to load may be delayed until the parameters of this event are inspected and the correct certificate can be located and loaded.
Certificate Type
This is the digital certificate being used.
Syntax
IPWorksEncryptCertificate (declared in ipworksencrypt.h)
Remarks
This type describes the current digital certificate. The certificate may be a public or private key. The fields are used to identify or select certificates.
Fields
EffectiveDate
char* (read-only)
Default Value: ""
The date on which this certificate becomes valid. Before this date, it is not valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:
23-Jan-2000 15:00:00.
ExpirationDate
char* (read-only)
Default Value: ""
The date on which the certificate expires. After this date, the certificate will no longer be valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:
23-Jan-2001 15:00:00.
ExtendedKeyUsage
char* (read-only)
Default Value: ""
A comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).
Fingerprint
char* (read-only)
Default Value: ""
The hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.
The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02
FingerprintSHA1
char* (read-only)
Default Value: ""
The hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.
The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84
FingerprintSHA256
char* (read-only)
Default Value: ""
The hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.
The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53
Issuer
char* (read-only)
Default Value: ""
The issuer of the certificate. This field contains a string representation of the name of the issuing authority for the certificate.
PrivateKey
char* (read-only)
Default Value: ""
The private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.
Note: The PrivateKey may be available but not exportable. In this case, PrivateKey returns an empty string.
PrivateKeyAvailable
int (read-only)
Default Value: FALSE
Whether a PrivateKey is available for the selected certificate. If PrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).
PrivateKeyContainer
char* (read-only)
Default Value: ""
The name of the PrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.
PublicKey
char* (read-only)
Default Value: ""
The public key of the certificate. The key is provided as PEM/Base64-encoded data.
PublicKeyAlgorithm
char* (read-only)
Default Value: ""
The textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.
PublicKeyLength
int (read-only)
Default Value: 0
The length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.
SerialNumber
char* (read-only)
Default Value: ""
The serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.
SignatureAlgorithm
char* (read-only)
Default Value: ""
The text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.
Store
char*
Default Value: "MY"
The name of the certificate store for the client certificate.
The StoreType field denotes the type of the certificate store specified by Store. If the store is password-protected, specify the password in StorePassword.
Store is used in conjunction with the Subject field to specify client certificates. If Store has a value, and Subject or Encoded is set, a search for a certificate is initiated. Please see the Subject field for details.
Designations of certificate stores are platform dependent.
The following designations are the most common User and Machine certificate stores in Windows:
| MY | A certificate store holding personal certificates with their associated private keys. |
| CA | Certifying authority certificates. |
| ROOT | Root certificates. |
When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).
StorePassword
char*
Default Value: ""
If the type of certificate store requires a password, this field is used to specify the password needed to open the certificate store.
StoreType
int
Default Value: 0
The type of certificate store for this certificate.
The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This field can take one of the following values:
| 0 (cstUser - default) | For Windows, this specifies that the certificate store is a certificate store owned by the current user.
Note: This store type is not available in Java. |
| 1 (cstMachine) | For Windows, this specifies that the certificate store is a machine store.
Note: This store type is not available in Java. |
| 2 (cstPFXFile) | The certificate store is the name of a PFX (PKCS#12) file containing certificates. |
| 3 (cstPFXBlob) | The certificate store is a string (binary or Base64-encoded) representing a certificate store in PFX (PKCS#12) format. |
| 4 (cstJKSFile) | The certificate store is the name of a Java Key Store (JKS) file containing certificates.
Note: This store type is only available in Java. |
| 5 (cstJKSBlob) | The certificate store is a string (binary or Base64-encoded) representing a certificate store in Java Key Store (JKS) format.
Note: This store type is only available in Java. |
| 6 (cstPEMKeyFile) | The certificate store is the name of a PEM-encoded file that contains a private key and an optional certificate. |
| 7 (cstPEMKeyBlob) | The certificate store is a string (binary or Base64-encoded) that contains a private key and an optional certificate. |
| 8 (cstPublicKeyFile) | The certificate store is the name of a file that contains a PEM- or DER-encoded public key certificate. |
| 9 (cstPublicKeyBlob) | The certificate store is a string (binary or Base64-encoded) that contains a PEM- or DER-encoded public key certificate. |
| 10 (cstSSHPublicKeyBlob) | The certificate store is a string (binary or Base64-encoded) that contains an SSH-style public key. |
| 11 (cstP7BFile) | The certificate store is the name of a PKCS#7 file containing certificates. |
| 12 (cstP7BBlob) | The certificate store is a string (binary) representing a certificate store in PKCS#7 format. |
| 13 (cstSSHPublicKeyFile) | The certificate store is the name of a file that contains an SSH-style public key. |
| 14 (cstPPKFile) | The certificate store is the name of a file that contains a PPK (PuTTY Private Key). |
| 15 (cstPPKBlob) | The certificate store is a string (binary) that contains a PPK (PuTTY Private Key). |
| 16 (cstXMLFile) | The certificate store is the name of a file that contains a certificate in XML format. |
| 17 (cstXMLBlob) | The certificate store is a string that contains a certificate in XML format. |
| 18 (cstJWKFile) | The certificate store is the name of a file that contains a JWK (JSON Web Key). |
| 19 (cstJWKBlob) | The certificate store is a string that contains a JWK (JSON Web Key). |
| 21 (cstBCFKSFile) | The certificate store is the name of a file that contains a BCFKS (Bouncy Castle FIPS Key Store).
Note: This store type is only available in Java and .NET. |
| 22 (cstBCFKSBlob) | The certificate store is a string (binary or Base64-encoded) representing a certificate store in BCFKS (Bouncy Castle FIPS Key Store) format.
Note: This store type is only available in Java and .NET. |
| 23 (cstPKCS11) | The certificate is present on a physical security key accessible via a PKCS#11 interface.
To use a security key, the necessary data must first be collected using the CertMgr class. The ListStoreCertificates method may be called after setting CertStoreType to cstPKCS11, CertStorePassword to the PIN, and CertStore to the full path of the PKCS#11 DLL. The certificate information returned in the CertList event's CertEncoded parameter may be saved for later use. When using a certificate, pass the previously saved security key information as the Store and set StorePassword to the PIN. Code Example. SSH Authentication with Security Key:
|
| 99 (cstAuto) | The store type is automatically detected from the input data. This setting may be used with both public and private keys and can detect any of the supported formats automatically. |
SubjectAltNames
char* (read-only)
Default Value: ""
Comma-separated lists of alternative subject names for the certificate.
ThumbprintMD5
char* (read-only)
Default Value: ""
The MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.
ThumbprintSHA1
char* (read-only)
Default Value: ""
The SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.
ThumbprintSHA256
char* (read-only)
Default Value: ""
The SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.
Usage
char* (read-only)
Default Value: ""
The text description of UsageFlags.
This value will be one or more of the following strings and will be separated by commas:
- Digital Signature
- Non-Repudiation
- Key Encipherment
- Data Encipherment
- Key Agreement
- Certificate Signing
- CRL Signing
- Encipher Only
If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.
UsageFlags
int (read-only)
Default Value: 0
The flags that show intended use for the certificate. The value of UsageFlags is a combination of the following flags:
| 0x80 | Digital Signature |
| 0x40 | Non-Repudiation |
| 0x20 | Key Encipherment |
| 0x10 | Data Encipherment |
| 0x08 | Key Agreement |
| 0x04 | Certificate Signing |
| 0x02 | CRL Signing |
| 0x01 | Encipher Only |
Please see the Usage field for a text representation of UsageFlags.
This functionality currently is not available when the provider is OpenSSL.
Version
char* (read-only)
Default Value: ""
The certificate's version number. The possible values are the strings "V1", "V2", and "V3".
Subject
char*
Default Value: ""
The subject of the certificate used for client authentication.
This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.
If a matching certificate is found, the field is set to the full subject of the matching certificate.
If an exact match is not found, the store is searched for subjects containing the value of the property.
If a match is still not found, the property is set to an empty string, and no certificate is selected.
The special value "*" picks a random certificate in the certificate store.
The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:
| Field | Meaning |
| CN | Common Name. This is commonly a hostname like www.server.com. |
| O | Organization |
| OU | Organizational Unit |
| L | Locality |
| S | State |
| C | Country |
| E | Email Address |
If a field value contains a comma, it must be quoted.
Encoded
char*
Default Value: ""
The certificate (PEM/Base64 encoded). This field is used to assign a specific certificate. The Store and Subject fields also may be used to specify a certificate.
When Encoded is set, a search is initiated in the current Store for the private key of the certificate. If the key is found, Subject is updated to reflect the full subject of the selected certificate; otherwise, Subject is set to an empty string.
Constructors
Certificate()
Creates a instance whose properties can be set. This is useful for use with when generating new certificates.
Certificate(const char* lpEncoded, int lenEncoded)
Parses Encoded as an X.509 public key.
Certificate(int iStoreType, const char* lpStore, int lenStore, const char* lpszStorePassword, const char* lpszSubject)
StoreType identifies the type of certificate store to use. See for descriptions of the different certificate stores. Store is a byte array containing the certificate data. StorePassword is the password used to protect the store.
After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN). The Subject parameter can also take an MD5, SHA-1, or SHA-256 thumbprint of the certificate to load in a "Thumbprint=value" format.
IPWorksEncryptList Type
Syntax
IPWorksEncryptList<T> (declared in ipworksencrypt.h)
Remarks
IPWorksEncryptList is a generic class that is used to hold a collection of objects of type T, where T is one of the custom types supported by the CMS class.
Methods | |
| GetCount |
This method returns the current size of the collection.
int GetCount() {}
|
| SetCount |
This method sets the size of the collection. This method returns 0 if setting the size was successful; or -1 if the collection is ReadOnly. When adding additional objects to a collection call this method to specify the new size. Increasing the size of the collection preserves existing objects in the collection.
int SetCount(int count) {}
|
| Get |
This method gets the item at the specified position. The index parameter specifies the index of the item in the collection. This method returns NULL if an invalid index is specified.
T* Get(int index) {}
|
| Set |
This method sets the item at the specified position. The index parameter specifies the index of the item in the collection that is being set. This method returns -1 if an invalid index is specified. Note: Objects created using the new operator must be freed using the delete operator; they will not be automatically freed by the class.
T* Set(int index, T* value) {}
|
IPWorksEncryptStream Type
Syntax
IPWorksEncryptStream (declared in ipworksencrypt.h)
Remarks
The CMS class includes one or more API members that take a stream object as a parameter. To use such API members, create a concrete class that implements the IPWorksEncryptStream interface and pass the CMS class an instance of that concrete class.
When implementing the IPWorksEncryptStream interface's properties and methods, they must behave as described below. If the concrete class's implementation does not behave as expected, undefined behavior may occur.
Properties | |
| CanRead |
Whether the stream supports reading.
bool CanRead() { return true; }
|
| CanSeek |
Whether the stream supports seeking.
bool CanSeek() { return true; }
|
| CanWrite |
Whether the stream supports writing.
bool CanWrite() { return true; }
|
| Length |
Gets the length of the stream, in bytes.
int64 GetLength() = 0; |
Methods | |
| Close |
Closes the stream, releasing all resources currently allocated for it.
void Close() {}
This method is called automatically when an IPWorksEncryptStream object is deleted. |
| Flush |
Forces all data held by the stream's buffers to be written out to storage.
int Flush() { return 0; }
Must return 0 if flushing is successful; or -1 if an error occurs or the stream is closed. If the stream does not support writing, this method must do nothing and return 0. |
| Read |
Reads a sequence of bytes from the stream and advances the current position within the stream by the number of bytes read.
int Read(void* buffer, int count) = 0; Buffer specifies the buffer to populate with data from the stream. Count specifies the number of bytes that should be read from the stream. Must return the total number of bytes read into Buffer; this may be less than Count if that many bytes are not currently available, or 0 if the end of the stream has been reached. Must return -1 if an error occurs, if reading is not supported, or if the stream is closed. |
| Seek |
Sets the current position within the stream based on a particular point of origin.
int64 Seek(int64 offset, int seekOrigin) = 0; Offset specifies the offset in the stream to seek to, relative to SeekOrigin. Valid values for SeekOrigin are:
Must return the new position within the stream; or -1 if an error occurs, if seeking is not supported, or if the stream is closed (however, see note below). If -1 is returned, the current position within the stream must remain unchanged. Note: If the stream is not closed, it must always be possible to call this method with an Offset of 0 and a SeekOrigin of 1 to obtain the current position within the stream, even if seeking is not otherwise supported. |
| Write |
Writes a sequence of bytes to the stream and advances the current position within the stream by the number of bytes written.
int Write(const void* buffer, int count) = 0; Buffer specifies the buffer with data to write to the stream. Count specifies the number of bytes that should be written to the stream. Must return the total number of bytes written to the stream; this may be less than Count if that many bytes could not be written. Must return -1 if an error occurs, if writing is not supported, or if the stream is closed. |
Config Settings (CMS Class)
The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.CMS Config Settings
The default value is 1.2.840.113549.1.7.1 which is the OID for id-data.
NOTE: This config may only be used when the UseCryptoAPI is true.
The default value is True.
The default value for IncludeHeaders is true.
Note: This setting is only applicable to when OutputFormat is set to SMIME.
When set to False, only the message will be processed, MIME part headers will not be generated or stripped.
The default value for IncludeInternalHeaders is False.
Note: This setting is only applicable to when OutputFormat is set to SMIME.
If no value is specified and a value cannot be automatically determined the default value 7bit will be used.
Note: This setting is only applicable when OutputFormat is set to SMIME and when calling Sign or SignAndEncrypt and DetachedSignature is True.
If no value is specified and a value cannot be automatically determined the default value text/plain; charset="iso-8859-1" will be used.
Note: This setting is only applicable when OutputFormat is set to SMIME and when calling Sign or SignAndEncrypt and DetachedSignature is True.
| 0 (None) | No events are logged. |
| 1 (Info - default) | Informational events are logged. |
| 2 (Verbose) | Detailed data is logged. |
| 3 (Debug) | Debug data is logged. |
- "SHA1"
- "SHA224"
- "SHA256" (default)
- "SHA384"
- "SHA512"
- "RIPEMD160"
- "MD2"
- "MD5"
- "MD5SHA1"
Note: This setting is not applicable when UseFIPSCompliantAPI is set to true or when the private key of the signing certificate is not exportable since the underlying system implementation does not support separate OAEPRSAHashAlgorithm and OAEPMGF1HashAlgorithm values. In this case the OAEPRSAHashAlgorithm is also used for MGF1.
- "SHA1"
- "SHA224"
- "SHA256" (default)
- "SHA384"
- "SHA512"
- "RIPEMD160"
- "MD2"
- "MD5"
- "MD5SHA1"
- 0 (issuerAndSerialNumber - default)
- 1 (subjectKeyIdentifier)
Note: When subjectKeyIdentifier is selected, the recipient's encryption certificate must contain the subjectKeyIdentifier extension.
- 0 (issuerAndSerialNumber - default)
- 1 (subjectKeyIdentifier)
Note: When subjectKeyIdentifier is selected, the signing certificate must contain the subjectKeyIdentifier extension.
The default value is False, and the name of the algorithm is used. Set this to True to use the object identifiers instead.
Base Config Settings
The following is a list of valid code page identifiers:
| Identifier | Name |
| 037 | IBM EBCDIC - U.S./Canada |
| 437 | OEM - United States |
| 500 | IBM EBCDIC - International |
| 708 | Arabic - ASMO 708 |
| 709 | Arabic - ASMO 449+, BCON V4 |
| 710 | Arabic - Transparent Arabic |
| 720 | Arabic - Transparent ASMO |
| 737 | OEM - Greek (formerly 437G) |
| 775 | OEM - Baltic |
| 850 | OEM - Multilingual Latin I |
| 852 | OEM - Latin II |
| 855 | OEM - Cyrillic (primarily Russian) |
| 857 | OEM - Turkish |
| 858 | OEM - Multilingual Latin I + Euro symbol |
| 860 | OEM - Portuguese |
| 861 | OEM - Icelandic |
| 862 | OEM - Hebrew |
| 863 | OEM - Canadian-French |
| 864 | OEM - Arabic |
| 865 | OEM - Nordic |
| 866 | OEM - Russian |
| 869 | OEM - Modern Greek |
| 870 | IBM EBCDIC - Multilingual/ROECE (Latin-2) |
| 874 | ANSI/OEM - Thai (same as 28605, ISO 8859-15) |
| 875 | IBM EBCDIC - Modern Greek |
| 932 | ANSI/OEM - Japanese, Shift-JIS |
| 936 | ANSI/OEM - Simplified Chinese (PRC, Singapore) |
| 949 | ANSI/OEM - Korean (Unified Hangul Code) |
| 950 | ANSI/OEM - Traditional Chinese (Taiwan; Hong Kong SAR, PRC) |
| 1026 | IBM EBCDIC - Turkish (Latin-5) |
| 1047 | IBM EBCDIC - Latin 1/Open System |
| 1140 | IBM EBCDIC - U.S./Canada (037 + Euro symbol) |
| 1141 | IBM EBCDIC - Germany (20273 + Euro symbol) |
| 1142 | IBM EBCDIC - Denmark/Norway (20277 + Euro symbol) |
| 1143 | IBM EBCDIC - Finland/Sweden (20278 + Euro symbol) |
| 1144 | IBM EBCDIC - Italy (20280 + Euro symbol) |
| 1145 | IBM EBCDIC - Latin America/Spain (20284 + Euro symbol) |
| 1146 | IBM EBCDIC - United Kingdom (20285 + Euro symbol) |
| 1147 | IBM EBCDIC - France (20297 + Euro symbol) |
| 1148 | IBM EBCDIC - International (500 + Euro symbol) |
| 1149 | IBM EBCDIC - Icelandic (20871 + Euro symbol) |
| 1200 | Unicode UCS-2 Little-Endian (BMP of ISO 10646) |
| 1201 | Unicode UCS-2 Big-Endian |
| 1250 | ANSI - Central European |
| 1251 | ANSI - Cyrillic |
| 1252 | ANSI - Latin I |
| 1253 | ANSI - Greek |
| 1254 | ANSI - Turkish |
| 1255 | ANSI - Hebrew |
| 1256 | ANSI - Arabic |
| 1257 | ANSI - Baltic |
| 1258 | ANSI/OEM - Vietnamese |
| 1361 | Korean (Johab) |
| 10000 | MAC - Roman |
| 10001 | MAC - Japanese |
| 10002 | MAC - Traditional Chinese (Big5) |
| 10003 | MAC - Korean |
| 10004 | MAC - Arabic |
| 10005 | MAC - Hebrew |
| 10006 | MAC - Greek I |
| 10007 | MAC - Cyrillic |
| 10008 | MAC - Simplified Chinese (GB 2312) |
| 10010 | MAC - Romania |
| 10017 | MAC - Ukraine |
| 10021 | MAC - Thai |
| 10029 | MAC - Latin II |
| 10079 | MAC - Icelandic |
| 10081 | MAC - Turkish |
| 10082 | MAC - Croatia |
| 12000 | Unicode UCS-4 Little-Endian |
| 12001 | Unicode UCS-4 Big-Endian |
| 20000 | CNS - Taiwan |
| 20001 | TCA - Taiwan |
| 20002 | Eten - Taiwan |
| 20003 | IBM5550 - Taiwan |
| 20004 | TeleText - Taiwan |
| 20005 | Wang - Taiwan |
| 20105 | IA5 IRV International Alphabet No. 5 (7-bit) |
| 20106 | IA5 German (7-bit) |
| 20107 | IA5 Swedish (7-bit) |
| 20108 | IA5 Norwegian (7-bit) |
| 20127 | US-ASCII (7-bit) |
| 20261 | T.61 |
| 20269 | ISO 6937 Non-Spacing Accent |
| 20273 | IBM EBCDIC - Germany |
| 20277 | IBM EBCDIC - Denmark/Norway |
| 20278 | IBM EBCDIC - Finland/Sweden |
| 20280 | IBM EBCDIC - Italy |
| 20284 | IBM EBCDIC - Latin America/Spain |
| 20285 | IBM EBCDIC - United Kingdom |
| 20290 | IBM EBCDIC - Japanese Katakana Extended |
| 20297 | IBM EBCDIC - France |
| 20420 | IBM EBCDIC - Arabic |
| 20423 | IBM EBCDIC - Greek |
| 20424 | IBM EBCDIC - Hebrew |
| 20833 | IBM EBCDIC - Korean Extended |
| 20838 | IBM EBCDIC - Thai |
| 20866 | Russian - KOI8-R |
| 20871 | IBM EBCDIC - Icelandic |
| 20880 | IBM EBCDIC - Cyrillic (Russian) |
| 20905 | IBM EBCDIC - Turkish |
| 20924 | IBM EBCDIC - Latin-1/Open System (1047 + Euro symbol) |
| 20932 | JIS X 0208-1990 & 0121-1990 |
| 20936 | Simplified Chinese (GB2312) |
| 21025 | IBM EBCDIC - Cyrillic (Serbian, Bulgarian) |
| 21027 | Extended Alpha Lowercase |
| 21866 | Ukrainian (KOI8-U) |
| 28591 | ISO 8859-1 Latin I |
| 28592 | ISO 8859-2 Central Europe |
| 28593 | ISO 8859-3 Latin 3 |
| 28594 | ISO 8859-4 Baltic |
| 28595 | ISO 8859-5 Cyrillic |
| 28596 | ISO 8859-6 Arabic |
| 28597 | ISO 8859-7 Greek |
| 28598 | ISO 8859-8 Hebrew |
| 28599 | ISO 8859-9 Latin 5 |
| 28605 | ISO 8859-15 Latin 9 |
| 29001 | Europa 3 |
| 38598 | ISO 8859-8 Hebrew |
| 50220 | ISO 2022 Japanese with no halfwidth Katakana |
| 50221 | ISO 2022 Japanese with halfwidth Katakana |
| 50222 | ISO 2022 Japanese JIS X 0201-1989 |
| 50225 | ISO 2022 Korean |
| 50227 | ISO 2022 Simplified Chinese |
| 50229 | ISO 2022 Traditional Chinese |
| 50930 | Japanese (Katakana) Extended |
| 50931 | US/Canada and Japanese |
| 50933 | Korean Extended and Korean |
| 50935 | Simplified Chinese Extended and Simplified Chinese |
| 50936 | Simplified Chinese |
| 50937 | US/Canada and Traditional Chinese |
| 50939 | Japanese (Latin) Extended and Japanese |
| 51932 | EUC - Japanese |
| 51936 | EUC - Simplified Chinese |
| 51949 | EUC - Korean |
| 51950 | EUC - Traditional Chinese |
| 52936 | HZ-GB2312 Simplified Chinese |
| 54936 | Windows XP: GB18030 Simplified Chinese (4 Byte) |
| 57002 | ISCII Devanagari |
| 57003 | ISCII Bengali |
| 57004 | ISCII Tamil |
| 57005 | ISCII Telugu |
| 57006 | ISCII Assamese |
| 57007 | ISCII Oriya |
| 57008 | ISCII Kannada |
| 57009 | ISCII Malayalam |
| 57010 | ISCII Gujarati |
| 57011 | ISCII Punjabi |
| 65000 | Unicode UTF-7 |
| 65001 | Unicode UTF-8 |
| Identifier | Name |
| 1 | ASCII |
| 2 | NEXTSTEP |
| 3 | JapaneseEUC |
| 4 | UTF8 |
| 5 | ISOLatin1 |
| 6 | Symbol |
| 7 | NonLossyASCII |
| 8 | ShiftJIS |
| 9 | ISOLatin2 |
| 10 | Unicode |
| 11 | WindowsCP1251 |
| 12 | WindowsCP1252 |
| 13 | WindowsCP1253 |
| 14 | WindowsCP1254 |
| 15 | WindowsCP1250 |
| 21 | ISO2022JP |
| 30 | MacOSRoman |
| 10 | UTF16String |
| 0x90000100 | UTF16BigEndian |
| 0x94000100 | UTF16LittleEndian |
| 0x8c000100 | UTF32String |
| 0x98000100 | UTF32BigEndian |
| 0x9c000100 | UTF32LittleEndian |
| 65536 | Proprietary |
- Product: The product the license is for.
- Product Key: The key the license was generated from.
- License Source: Where the license was found (e.g., RuntimeLicense, License File).
- License Type: The type of license installed (e.g., Royalty Free, Single Server).
- Last Valid Build: The last valid build number for which the license will work.
This setting only works on these classes: AS3Receiver, AS3Sender, Atom, Client(3DS), FTP, FTPServer, IMAP, OFTPClient, SSHClient, SCP, Server(3DS), Sexec, SFTP, SFTPServer, SSHServer, TCPClient, TCPServer.
On Linux, the C++ edition requires installation of the FIPS-enabled OpenSSL library. The OpenSSL FIPS provider version must be at least 3.0.0. For additional information and instructions regarding the installation and activation of the FIPS-enabled OpenSSL library, please refer to the following link: https://github.com/openssl/openssl/blob/master/README-FIPS.md
To ensure the class utilizes the FIPS-enabled OpenSSL library, the obfuscated source code should first be compiled with OpenSSL enabled, as described in the Supported Platforms section. Additionally, the FIPS module should be enabled and active. If the obfuscated source code is not compiled as mentioned, or the FIPS module is inactive, the class will throw an appropriate error assuming FIPS mode is enabled.
FIPS mode can be enabled by setting the UseFIPSCompliantAPI configuration setting to true. This is a static setting that applies to all instances of all classes of the toolkit within the process. It is recommended to enable or disable this setting once before the component has been used to establish a connection. Enabling FIPS while an instance of the component is active and connected may result in unexpected behavior.
For more details, please see the FIPS 140-2 Compliance article.
Note: This setting is applicable only on Windows.
Note: Enabling FIPS compliance requires a special license; please contact sales@nsoftware.com for details.
Setting this configuration setting to true tells the class to use the internal implementation instead of using the system security libraries.
On Windows, this setting is set to false by default. On Linux/macOS, this setting is set to true by default.
To use the system security libraries for Linux, OpenSSL support must be enabled. For more information on how to enable OpenSSL, please refer to the OpenSSL Notes section.
Trappable Errors (CMS Class)
Error Handling (C++)
Call the GetLastErrorCode() method to obtain the last called method's result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. Known error codes are listed below. If an error occurs, the GetLastError() method can be called to retrieve the associated error message.
CMS Errors
| 10191 | Invalid index (RecipientIndex). |
| 10192 | Message decoding error (code). |
| 10193 | Unexpected message type. |
| 10194 | Unsupported hashing/signing algorithm. |
| 10195 | The message does not have any signers. |
| 10196 | The message signature could not be verified. |
| 10197 | Could not locate a suitable decryption certificate. |
| 10198 | The signer certificate could not be found. |
| 10199 | No signing certificate was supplied for signing the message. |
| 10201 | The specified certificate was not the one required. |
| 10202 | The specified certificate could not be found. |
| 10221 | Could not acquire CSP. |
| 10222 | Type validation error. |
| 10223 | Unsupported key size. |
| 10224 | Unrecognized Content-Type object identifier. |
| 10225 | Unrecognized public key format. |
| 10226 | No choices specified. |
| 10228 | Must specify output stream. |
| 10280 | Invalid part index. |
| 10281 | Unknown MIME type. |
| 10283 | No MIME-boundary found. |
| 10280 | Error decoding certificate. |