/
►
RFC 4134
Network Working Group P. Hoffman, Ed.
Request for Comments:
4134 Internet Mail Consortium
Category: Informational July 2005
Examples of S/MIME Messages
Status of This Memo This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice Copyright (C) The Internet Society (2005).
Abstract This document gives examples of message bodies formatted using
S/MIME. Specifically, it has examples of Cryptographic Message
Syntax (CMS) objects and S/MIME messages (including the MIME
formatting). It includes examples of many common CMS formats. The
purpose of this document is to help increase interoperability for
S/MIME and other protocols that rely on CMS.
Table of Contents 1. Introduction ................................................ 3
2. Constants Used in the Examples .............................. 3
2.1. Content of Documents .................................. 4
2.2. Private Keys .......................................... 4
2.3. Certificates .......................................... 13
2.4. CRLs .................................................. 33
3. Trivial Examples ............................................ 39
3.1. ContentInfo with Data Type, BER ....................... 39
3.2. ContentInfo with Data Type, DER ....................... 39
4. Signed-data ................................................. 39
4.1. Basic Signed Content, DSS ............................. 39
4.2. Basic Signed Content, RSA ............................. 44
4.3. Basic Signed Content, Detached Content ................ 49
4.4. Fancier Signed Content ................................ 53
4.5. All RSA Signed Message ................................ 68
4.6. Multiple Signers ...................................... 75
4.7. Signing Using SKI ..................................... 83
4.8. S/MIME multipart/signed Message ....................... 87
4.9. S/MIME application/pkcs7-mime Signed Message .......... 88
4.10. SignedData with Attributes ............................ 89
4.11. SignedData with Certificates Only ..................... 101
5. Enveloped-data .............................................. 109
5.1. Basic Encrypted Content, TripleDES and RSA ............ 109
5.2. Basic Encrypted Content, RC2/128 and RSA .............. 110
5.3. S/MIME application/pkcs7-mime Encrypted Message ....... 112
6. Digested-data ............................................... 112
7. Encrypted-data .............................................. 113
7.1. Simple EncryptedData .................................. 113
7.2. EncryptedData with Unprotected Attributes ............. 114
8. Security Considerations ..................................... 115
9. References .................................................. 115
9.1. Normative References .................................. 115
9.2. Informative References ................................ 115
A. Binaries of the Examples .................................... 116
A.1. How the Binaries and Extractor Works .................. 116
A.2. Example Extraction Program ............................ 116
B. Examples in Order of Appearance ............................. 118
C. Acknowledgements ............................................ 135
1. Introduction The examples in this document show the structure and format of CMS
message bodies, as described in [CMS]. They are useful to
implementors who use protocols that rely on CMS, such as the S/MIME
message format protocol. There are also examples of simple S/MIME
messages [SMIME-MSG] (including the MIME headers).
Every example in this document has been checked by two different
implementors. This strongly indicates (but does not assure) that the
examples are correct. All CMS implementors must read the CMS
document carefully before implementing from it. No one should use
the examples in this document as stand-alone explanations of how to
create CMS message bodies.
This document explicitly does not attempt to cover many PKIX [PKIX]
examples. Documents with examples of that format may be forthcoming.
Also, note that [DVCS], which covers PKIX Data Validation and
Certification Server Protocols, has examples of formats for its
protocol.
The examples shown here were created and validated by many different
people over a long period of time. Because of this, some of the
dates used in the examples are many years in the past. This, plus
the fact that some of the certificates in the examples have very long
lifespans, may cause problems in some test situations.
2. Constants Used in the Examples This section defines the data used in the rest of the document. The
names of the constants indicate their use. For example,
AlicePrivDSSSign is the private part of Alice's DSS signing key.
- Alice is the creator of the message bodies in this document.
- Bob is the recipient of the messages.
- Carl is a CA.
- Diane sometimes gets involved with these folks.
- Erica also sometimes gets involved.
2.1. Content of Documents ExContent is the following sentence:
This is some sample content.
That is, it is the string of characters starting with "T" up to and
including the ".".
The hex for ExContent is
5468 6973 2069 7320 736f 6d65 2073 616d 706c 6520 636f 6e74 656e 742e The MD5 hash of ExContent is
9898 cac8 fab7 691f f89d c207 24e7 4a04 The SHA-1 hash of ExContent is
406a ec08 5279 ba6e 1602 2d9e 0629 c022 9687 dd48
2.2. Private Keys The following private keys are needed to create the samples. To find
the public keys, see the certificates in the next section.
AlicePrivDSSSign =
0 30 331: SEQUENCE {
4 02 1: INTEGER 0
7 30 299: SEQUENCE {
11 06 7: OBJECT IDENTIFIER dsa (1 2 840 10040 4 1)
: (ANSI X9.57 algorithm)
20 30 286: SEQUENCE {
24 02 129: INTEGER
: 00 81 8D CD ED 83 EA 0A 9E 39 3E C2
: 48 28 A3 E4 47 93 DD 0E D7 A8 0E EC
: 53 C5 AB 84 08 4F FF 94 E1 73 48 7E
: 0C D6 F3 44 48 D1 FE 9F AF A4 A1 89
: 2F E1 D9 30 C8 36 DE 3F 9B BF B7 4C
: DC 5F 69 8A E4 75 D0 37 0C 91 08 95
: 9B DE A7 5E F9 FC F4 9F 2F DD 43 A8
: 8B 54 F1 3F B0 07 08 47 4D 5D 88 C3
: C3 B5 B3 E3 55 08 75 D5 39 76 10 C4
: 78 BD FF 9D B0 84 97 37 F2 E4 51 1B
: B5 E4 09 96 5C F3 7E 5B DB
156 02 21: INTEGER
: 00 E2 47 A6 1A 45 66 B8 13 C6 DA 8F
: B8 37 21 2B 62 8B F7 93 CD
179 02 128: INTEGER
: 26 38 D0 14 89 32 AA 39 FB 3E 6D D9
: 4B 59 6A 4C 76 23 39 04 02 35 5C F2
: CB 1A 30 C3 1E 50 5D DD 9B 59 E2 CD
: AA 05 3D 58 C0 7B A2 36 B8 6E 07 AF
: 7D 8A 42 25 A7 F4 75 CF 4A 08 5E 4B
: 3E 90 F8 6D EA 9C C9 21 8A 3B 76 14
: E9 CE 2E 5D A3 07 CD 23 85 B8 2F 30
: 01 7C 6D 49 89 11 89 36 44 BD F8 C8
: 95 4A 53 56 B5 E2 F9 73 EC 1A 61 36
: 1F 11 7F C2 BD ED D1 50 FF 98 74 C2
: D1 81 4A 60 39 BA 36 39
: }
: }
310 04 23: OCTET STRING, encapsulates {
312 02 21: INTEGER
: 00 BB 44 46 D1 A5 C9 46 07 2E D0 FE
: 7A D6 92 07 F0 9A 85 89 3F
: }
: }
AlicePrivRSASign =
0 30 630: SEQUENCE {
4 02 1: INTEGER 0
7 30 13: SEQUENCE {
9 06 9: OBJECT IDENTIFIER
: rsaEncryption (1 2 840 113549 1 1 1)
: (PKCS #1)
20 05 0: NULL
: }
22 04 608: OCTET STRING, encapsulates {
26 30 604: SEQUENCE {
30 02 1: INTEGER 0
33 02 129: INTEGER
: 00 E0 89 73 39 8D D8 F5 F5 E8 87 76
: 39 7F 4E B0 05 BB 53 83 DE 0F B7 AB
: DC 7D C7 75 29 0D 05 2E 6D 12 DF A6
: 86 26 D4 D2 6F AA 58 29 FC 97 EC FA
: 82 51 0F 30 80 BE B1 50 9E 46 44 F1
: 2C BB D8 32 CF C6 68 6F 07 D9 B0 60
: AC BE EE 34 09 6A 13 F5 F7 05 05 93
: DF 5E BA 35 56 D9 61 FF 19 7F C9 81
: E6 F8 6C EA 87 40 70 EF AC 6D 2C 74
: 9F 2D FA 55 3A B9 99 77 02 A6 48 52
: 8C 4E F3 57 38 57 74 57 5F
165 02 3: INTEGER 65537
170 02 128: INTEGER
: 00 A4 03 C3 27 47 76 34 34 6C A6 86
BobPrivRSAEncrypt =
0 30 645: SEQUENCE {
4 02 1: INTEGER 0
7 30 13: SEQUENCE {
9 06 9: OBJECT IDENTIFIER
: rsaEncryption (1 2 840 113549 1 1 1)
: (PKCS #1)
20 05 0: NULL
: }
22 04 608: OCTET STRING, encapsulates {
26 30 604: SEQUENCE {
30 02 1: INTEGER 0
33 02 129: INTEGER
: 00 A9 E1 67 98 3F 39 D5 5F F2 A0 93
: 41 5E A6 79 89 85 C8 35 5D 9A 91 5B
: FB 1D 01 DA 19 70 26 17 0F BD A5 22
: D0 35 85 6D 7A 98 66 14 41 5C CF B7
: B7 08 3B 09 C9 91 B8 19 69 37 6D F9
: 65 1E 7B D9 A9 33 24 A3 7F 3B BB AF
: 46 01 86 36 34 32 CB 07 03 59 52 FC
: 85 8B 31 04 B8 CC 18 08 14 48 E6 4F
: 1C FB 5D 60 C4 E0 5C 1F 53 D3 7F 53
: D8 69 01 F1 05 F8 7A 70 D1 BE 83 C6
: 5F 38 CF 1C 2C AA 6A A7 EB
165 02 3: INTEGER 65537
170 02 128: INTEGER
: 67 CD 48 4C 9A 0D 8F 98 C2 1B 65 FF
: 22 83 9C 6D F0 A6 06 1D BC ED A7 03
: 88 94 F2 1C 6B 0F 8B 35 DE 0E 82 78
: 30 CB E7 BA 6A 56 AD 77 C6 EB 51 79
: 70 79 0A A0 F4 FE 45 E0 A9 B2 F4 19
: DA 87 98 D6 30 84 74 E4 FC 59 6C C1
: C6 77 DC A9 91 D0 7C 30 A0 A2 C5 08
: 5E 21 71 43 FC 0D 07 3D F0 FA 6D 14
: 9E 4E 63 F0 17 58 79 1C 4B 98 1C 3D
: 3D B0 1B DF FA 25 3B A3 C0 2C 98 05
: F6 10 09 D8 87 DB 03 19
301 02 65: INTEGER
: 00 D0 C3 22 C6 DE A2 99 18 76 8F 8D
: BC A6 75 D6 66 3F D4 8D 45 52 8C 76
: F5 72 C4 EB F0 46 9A F1 3E 5C AA 55
: 0B 9B DA DD 6B 6D F8 FC 3B 3C 08 43
: 93 B5 5B FE CE EA FD 68 84 23 62 AF
: F3 31 C2 B9 E5
368 02 65: INTEGER
: 00 D0 51 FC 1E 22 B7 5B ED B5 8E 01
: C8 D7 AB F2 58 D4 F7 82 94 F3 53 A8
: 19 45 CB 66 CA 28 19 5F E2 10 2B F3
: 92 0D 8D 44 3F 77 1D FF 96 23 44 08
: D4 0B 70 C9 1A AF E9 90 94 F2 B0 D5
: 5F 4F 19 85 50 A1 90 91 AE BD 05 76
: 52 B3 22 D8 A8 7C 8E 54 7F 00 72 4F
: 36 75 68 73 B5
368 02 65: INTEGER
: 00 E1 D2 E7 11 57 06 AE 72 95 22 16
: AA 02 B4 5A ED 4E 9D 82 11 4F 96 3C
: 86 C9 10 8D 56 7B 31 75 79 69 E7 75
: 68 38 00 4B 2E D2 26 32 DD B1 E2 E0
: 2C 54 80 0A 75 BA D1 66 96 1B B0 0E
: A0 7E D2 BB 91
435 02 65: INTEGER
: 00 AF B6 BC DB 22 73 43 41 EC B4 B5
: 67 A9 A1 99 FC EF D2 8E FD 1D FB E5
: 29 8B FE 0A DF D4 C8 5E 57 25 0A 5D
: 2B D4 09 A0 56 5B C5 B1 62 FC 20 BE
: 08 2D E3 07 B5 A1 E7 B3 FF C4 C0 A5
: 5F AC 12 5C A9
502 02 65: INTEGER
: 00 B9 98 41 FC 08 50 1F 73 60 8A 01
: A2 7C 52 8A 20 5A EA 2C 89 D9 A5 19
: DD 94 C6 1B C3 25 C0 82 51 E4 EE 2B
: 9A 19 DC 73 ED E9 1D 27 D4 F8 6C 03
: DD AB 1D 08 7B B5 AC 7F E9 82 9B F1
: 89 8A 71 DB 61
569 02 64: INTEGER
: 01 07 21 97 5F 7A 60 A8 FD 5A 5C 07
: DF A8 DE F7 E2 B1 34 7D FC EB 91 BD
: B0 73 74 C8 C4 BE 3F 58 45 30 06 90
: B3 AC 69 CC B3 F7 3F 7C AC C7 B8 1B
: 65 A1 16 39 39 B0 E3 74 7D CF CD C5
: AC 6C BF E5
: }
: }
: }
2.3. Certificates AliceDSSSignByCarlNoInherit =
0 30 732: SEQUENCE {
4 30 667: SEQUENCE {
8 A0 3: [0] {
10 02 1: INTEGER 2
: }
13 02 2: INTEGER 200
17 30 9: SEQUENCE {
19 06 7: OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
: 42 CA 0F 13 07 92 09 1B E0 6F B0 91
: 18 F6 BF 4A FB CC 63 79 FB 81 BF DD
: 97 C7 90 6B CB 0A 37 2B 41 6A 03 98
: C5 1B 3E 32 C8 45 2B 86 01 9C 1C E2
: 36 EF 16 C1 1A 92 B8 BE 62 FB 53 3E
: 49 47 0B C4 B9 E4 2B 58 A6 06 83 F0
: B2 A7 BB 85 7E D5 C6 DA CE 9C 7B 31
: 72 D7 A2 EA 41 AB 6A C0 DD 1F B9 14
: 44 18 CF 84 57 66 E8 C5 E6 B8 DC 2D
: B3 1F 1B 28 43 36 75 7A
: }
CarlDSSCRLForAll =
0 30 216: SEQUENCE {
3 30 153: SEQUENCE {
6 30 9: SEQUENCE {
8 06 7: OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
: (ANSI X9.57 algorithm)
: }
17 30 18: SEQUENCE {
19 31 16: SET {
21 30 14: SEQUENCE {
23 06 3: OBJECT IDENTIFIER commonName (2 5 4 3)
: (X.520 id-at (2 5 4))
28 13 7: PrintableString 'CarlDSS'
: }
: }
: }
37 17 13: UTCTime '990827070000Z'
52 30 105: SEQUENCE {
54 30 19: SEQUENCE {
56 02 2: INTEGER 200
60 17 13: UTCTime '990822070000Z'
: }
75 30 19: SEQUENCE {
77 02 2: INTEGER 201
81 17 13: UTCTime '990822070000Z'
: }
96 30 19: SEQUENCE {
98 02 2: INTEGER 211
102 17 13: UTCTime '990822070000Z'
: }
117 30 19: SEQUENCE {
119 02 2: INTEGER 210
123 17 13: UTCTime '990822070000Z'
: }
: F6 5E 84 E7 F8 B9 5A C9 18 C2 0E B8
: A0 96 BE 81 3A 80 6D C9
: }
3. Trivial Examples This section covers examples of small CMS types.
3.1. ContentInfo with Data Type, BER The object is a ContentInfo containing a Data object in BER format
that is ExContent.
0 30 NDEF: SEQUENCE {
2 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
13 A0 NDEF: [0] {
15 24 NDEF: OCTET STRING {
17 04 4: OCTET STRING 'This'
23 04 24: OCTET STRING ' is some sample content.'
: }
: }
: }
3.2. ContentInfo with Data Type, DER The object is a ContentInfo containing a Data object in DER format
that is ExContent.
0 30 43: SEQUENCE {
2 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
13 A0 30: [0] {
15 04 28: OCTET STRING 'This is some sample content.'
: }
: }
4. Signed-data
4.1. Basic Signed Content, DSS A SignedData with no attribute certificates, signed by Alice using
DSS, just her certificate (not Carl's root cert), no CRL. The
message is ExContent, and is included in the eContent. There are no
signed or unsigned attributes.
851 02 2: INTEGER 200
: }
855 30 7: SEQUENCE {
857 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
: }
864 30 9: SEQUENCE {
866 06 7: OBJECT IDENTIFIER
: dsaWithSha1 (1 2 840 10040 4 3)
: (ANSI X9.57 algorithm)
: }
875 04 46: OCTET STRING, encapsulates {
877 30 44: SEQUENCE {
879 02 20: INTEGER
: 09 91 FE EB D2 69 F5 18 B7 D7 CD 55
: F4 81 EA 2A 42 6A AD 03
901 02 20: INTEGER
: 3A 07 CC C3 21 BE E1 1A 4B 7F 3E B5
: 0D DB BA 1C EA BC CD 89
: }
: }
: }
: }
: }
: }
: }
4.2. Basic Signed Content, RSA Same as 4.1, except using RSA signatures. A SignedData with no
attribute certificates, signed by Alice using RSA, just her
certificate (not Carl's root cert), no CRL. The message is
ExContent, and is included in the eContent. There are no signed or
unsigned attributes.
0 30 850: SEQUENCE {
4 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
: (PKCS #7)
15 A0 835: [0] {
19 30 831: SEQUENCE {
23 02 1: INTEGER 1
26 31 11: SET {
28 30 9: SEQUENCE {
30 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
37 05 0: NULL
: }
: }
: }
: }
: }
4.3. Basic Signed Content, Detached Content Same as 4.1, except with no eContent. A SignedData with no attribute
certificates, signed by Alice using DSS, just her certificate (not
Carl's root cert), no CRL. The message is ExContent, but the
eContent is not included. There are no signed or unsigned
attributes.
0 30 887: SEQUENCE {
4 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
: (PKCS #7)
15 A0 872: [0] {
19 30 868: SEQUENCE {
23 02 1: INTEGER 1
26 31 9: SET {
28 30 7: SEQUENCE {
30 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
: }
: }
37 30 11: SEQUENCE {
39 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
: }
50 A0 736: [0] {
54 30 732: SEQUENCE {
58 30 667: SEQUENCE {
62 A0 3: [0] {
64 02 1: INTEGER 2
: }
67 02 2: INTEGER 200
71 30 9: SEQUENCE {
73 06 7: OBJECT IDENTIFIER
: dsaWithSha1 (1 2 840 10040 4 3)
: (ANSI X9.57 algorithm)
: }
82 30 18: SEQUENCE {
84 31 16: SET {
86 30 14: SEQUENCE {
88 06 3: OBJECT IDENTIFIER
: commonName (2 5 4 3)
: (X.520 id-at (2 5 4))
93 13 7: PrintableString 'CarlDSS'
: }
801 31 16: SET {
803 30 14: SEQUENCE {
805 06 3: OBJECT IDENTIFIER
: commonName (2 5 4 3)
: (X.520 id-at (2 5 4))
810 13 7: PrintableString 'CarlDSS'
: }
: }
: }
819 02 2: INTEGER 200
: }
823 30 7: SEQUENCE {
825 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
: }
832 30 9: SEQUENCE {
834 06 7: OBJECT IDENTIFIER
: dsaWithSha1 (1 2 840 10040 4 3)
: (ANSI X9.57 algorithm)
: }
843 04 46: OCTET STRING, encapsulates {
845 30 44: SEQUENCE {
847 02 20: INTEGER
: 06 FB C7 2A 24 D5 34 89 F7 8B B5 FD
: 73 24 A5 86 C8 0F 5A 6C
869 02 20: INTEGER
: 66 69 19 BC 68 58 D1 8D B1 9D 52 3F
: DA 14 88 0D FD C9 A1 B8
: }
: }
: }
: }
: }
: }
: }
4.4. Fancier Signed Content Same as 4.1, but includes Carl's root cert, Carl's CRL, some signed
and unsigned attributes (Countersignature by Diane). A SignedData
with no attribute certificates, signed by Alice using DSS, her
certificate and Carl's root cert, Carl's DSS CRL. The message is
ExContent, and is included in the eContent. The signed attributes
are Content Type, Message Digest and Signing Time; the unsigned
attributes are content hint and counter signature. The message
includes also Alice's RSA certificate.
: }
4.5. All RSA Signed Message Same as 4.2, but includes Carl's RSA root cert (but no CRL). A
SignedData with no attribute certificates, signed by Alice using RSA,
her certificate and Carl's root cert, no CRL. The message is
ExContent, and is included in the eContent. There are no signed or
unsigned attributes.
0 30 NDEF: SEQUENCE {
2 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
: (PKCS #7)
13 A0 NDEF: [0] {
15 30 NDEF: SEQUENCE {
17 02 1: INTEGER 1
20 31 11: SET {
22 30 9: SEQUENCE {
24 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
31 05 0: NULL
: }
: }
33 30 NDEF: SEQUENCE {
35 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
46 A0 NDEF: [0] {
48 24 NDEF: OCTET STRING {
50 04 4: OCTET STRING 'This'
56 04 24: OCTET STRING ' is some sample content.'
: }
: }
: }
88 A0 NDEF: [0] {
90 30 491: SEQUENCE {
94 30 340: SEQUENCE {
98 A0 3: [0] {
100 02 1: INTEGER 2
: }
103 02 16: INTEGER
: 46 34 6B C7 80 00 56 BC 11 D3 6E 2E
: 9F F2 50 20
121 30 13: SEQUENCE {
123 06 9: OBJECT IDENTIFIER
: sha1withRSAEncryption
: (1 2 840 113549 1 1 5)
: (PKCS #1)
134 05 0: NULL
: }
: }
: }
: }
: }
4.6. Multiple Signers Similar to 4.1, but the message is also signed by Diane. Two
signerInfos (one for Alice, one for Diane) with no attribute
certificates, each signed using DSS, Alice's and Diane's certificate
(not Carl's root cert), no CRL. The message is ExContent, and is
included in the eContent. There are no signed or unsigned
attributes.
0 30 1463: SEQUENCE {
4 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
: (PKCS #7)
15 A0 1448: [0] {
19 30 1444: SEQUENCE {
23 02 1: INTEGER 1
26 31 9: SET {
28 30 7: SEQUENCE {
30 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
: }
: }
37 30 43: SEQUENCE {
39 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
50 A0 30: [0] {
52 04 28: OCTET STRING 'This is some sample content.'
: }
: }
82 A0 1180: [0] {
86 30 440: SEQUENCE {
90 30 375: SEQUENCE {
94 A0 3: [0] {
96 02 1: INTEGER 2
: }
99 02 2: INTEGER 210
103 30 9: SEQUENCE {
105 06 7: OBJECT IDENTIFIER
: dsaWithSha1 (1 2 840 10040 4 3)
: (ANSI X9.57 algorithm)
: }
114 30 18: SEQUENCE {
116 31 16: SET {
: 15 FF 81 4D 8C AD 80 4E 9B 35 58 04
: 37 6E 63 6E E9 5B 83 FA
1445 02 20: INTEGER
: 06 7E 58 4E 2B 31 84 41 ED 49 79 38
: 3E 77 D2 A6 8C 75 08 21
: }
: }
: }
: }
: }
: }
: }
4.7. Signing Using SKI Same as 4.1, but the signature uses the SKI instead of the
issuer/serial number in the cert. A SignedData with no attribute
certificates, signed by Alice using DSS, just her certificate (not
Carl's root cert), identified by the SKI, no CRL. The message is
ExContent, and is included in the eContent. There are no signed or
unsigned attributes.
0 30 915: SEQUENCE {
4 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
: (PKCS #7)
15 A0 900: [0] {
19 30 896: SEQUENCE {
23 02 1: INTEGER 3
26 31 9: SET {
28 30 7: SEQUENCE {
30 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
: }
: }
37 30 43: SEQUENCE {
39 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
50 A0 30: [0] {
52 04 28: OCTET STRING 'This is some sample content.'
: }
: }
82 A0 736: [0] {
86 30 732: SEQUENCE {
90 30 667: SEQUENCE {
94 A0 3: [0] {
96 02 1: INTEGER 2
: }
99 02 2: INTEGER 200
: 83 6A B5 3D 67 6B BF 45
799 02 21: INTEGER
: 00 9F 61 53 52 54 0B 5C B2 DD DA E7
: 76 1D E2 10 52 5B 43 5E BD
: }
: }
: }
: }
822 31 95: SET {
824 30 93: SEQUENCE {
826 02 1: INTEGER 3
829 80 20: [0]
: BE 6C A1 B3 E3 C1 F7 ED 43 70 A4 CE
: 13 01 E2 FD E3 97 FE CD
851 30 7: SEQUENCE {
853 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
: }
860 30 9: SEQUENCE {
862 06 7: OBJECT IDENTIFIER dsa (1 2 840 10040 4 1)
: (ANSI X9.57 algorithm)
: }
871 04 46: OCTET STRING, encapsulates {
873 30 44: SEQUENCE {
875 02 20: INTEGER
: 6D 8E 5A CD 28 A0 1F D9 86 AD 7A E9
: DF AC D7 BE EC BE 3F F8
897 02 20: INTEGER
: 7C 8A 06 1E FC A4 41 35 7E F7 24 14
: FD 3D C0 56 B7 05 27 D5
: }
: }
: }
: }
: }
: }
: }
4.8. S/MIME multipart/signed Message A full S/MIME message, including MIME, that includes the body part
from 4.3 and the body containing the content of the message.
MIME-Version: 1.0
To: User2@examples.com
From: aliceDss@examples.com
Subject: Example 4.8
Message-Id: <020906002550300.249@examples.com>
Date: Fri, 06 Sep 2002 00:25:21 -0300
Content-Type: multipart/signed;
micalg=SHA1;
boundary="----=_NextBoundry____Fri,_06_Sep_2002_00:25:21";
protocol="application/pkcs7-signature"
This is a multi-part message in MIME format.
------=_NextBoundry____Fri,_06_Sep_2002_00:25:21
This is some sample content.
------=_NextBoundry____Fri,_06_Sep_2002_00:25:21
Content-Type: application/pkcs7-signature; name=smime.p7s
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=smime.p7s
MIIDdwYJKoZIhvcNAQcCoIIDaDCCA2QCAQExCTAHBgUrDgMCGjALBgkqhkiG9w0BBwGgggL
gMIIC3DCCApugAwIBAgICAMgwCQYHKoZIzjgEAzASMRAwDgYDVQQDEwdDYXJsRFNTMB4XDT
k5MDgxNzAxMTA0OVoXDTM5MTIzMTIzNTk1OVowEzERMA8GA1UEAxMIQWxpY2VEU1MwggG2M
IIBKwYHKoZIzjgEATCCAR4CgYEAgY3N7YPqCp45PsJIKKPkR5PdDteoDuxTxauECE//lOFz
SH4M1vNESNH+n6+koYkv4dkwyDbeP5u/t0zcX2mK5HXQNwyRCJWb3qde+fz0ny/dQ6iLVPE
/sAcIR01diMPDtbPjVQh11Tl2EMR4vf+dsISXN/LkURu15AmWXPN+W9sCFQDiR6YaRWa4E8
baj7g3IStii/eTzQKBgCY40BSJMqo5+z5t2UtZakx2IzkEAjVc8ssaMMMeUF3dm1nizaoFP
VjAe6I2uG4Hr32KQiWn9HXPSgheSz6Q+G3qnMkhijt2FOnOLl2jB80jhbgvMAF8bUmJEYk2
RL34yJVKU1a14vlz7BphNh8Rf8K97dFQ/5h0wtGBSmA5ujY5A4GEAAKBgFzjuVp1FJYLqXr
d4z+p7Kxe3L23ExE0phaJKBEj2TSGZ3V1ExI9Q1tv5VG/+onyohs+JH09B41bY8i7RaWgSu
OF1s4GgD/oI34a8iSrUxq4Jw0e7wi/ZhSAXGKsZfoVi/G7NNTSljf2YUeyxDKE8H5BQP1Gp
2NOM/Kl4vTyg+W4o4GBMH8wDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwHwYDVR0j
BBgwFoAUcEQ+gi5vh95K03XjPSC8QyuT8R8wHQYDVR0OBBYEFL5sobPjwfftQ3CkzhMB4v3
jl/7NMB8GA1UdEQQYMBaBFEFsaWNlRFNTQGV4YW1wbGUuY29tMAkGByqGSM44BAMDMAAwLQ
IUVQykGR9CK4lxIjONg2q1PWdrv0UCFQCfYVNSVAtcst3a53Yd4hBSW0NevTFjMGECAQEwG
DASMRAwDgYDVQQDEwdDYXJsRFNTAgIAyDAHBgUrDgMCGjAJBgcqhkjOOAQDBC4wLAIUM/mG
f6gkgp9Z0XtRdGimJeB/BxUCFGFFJqwYRt1WYcIOQoGiaowqGzVI
------=_NextBoundry____Fri,_06_Sep_2002_00:25:21--
4.9. S/MIME application/pkcs7-mime Signed Message A full S/MIME message, including the MIME parts.
MIME-Version: 1.0
To: User2@examples.com
From: aliceDss@examples.com
Subject: Example 4.9
Message-Id: <021031164540300.304@examples.com>
Date: Thu, 31 Oct 2002 16:45:14 -0300
Content-Type: application/pkcs7-mime; smime-type=signed-data;
name=smime.p7m
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=smime.p7m
MIIDmQYJKoZIhvcNAQcCoIIDijCCA4YCAQExCTAHBgUrDgMCGjAtBgkqhkiG9w0BBwGgIAQ
eDQpUaGlzIGlzIHNvbWUgc2FtcGxlIGNvbnRlbnQuoIIC4DCCAtwwggKboAMCAQICAgDIMA
kGByqGSM44BAMwEjEQMA4GA1UEAxMHQ2FybERTUzAeFw05OTA4MTcwMTEwNDlaFw0zOTEyM
zEyMzU5NTlaMBMxETAPBgNVBAMTCEFsaWNlRFNTMIIBtjCCASsGByqGSM44BAEwggEeAoGB
AIGNze2D6gqeOT7CSCij5EeT3Q7XqA7sU8WrhAhP/5Thc0h+DNbzREjR/p+vpKGJL+HZMMg
23j+bv7dM3F9piuR10DcMkQiVm96nXvn89J8v3UOoi1TxP7AHCEdNXYjDw7Wz41UIddU5dh
DEeL3/nbCElzfy5FEbteQJllzzflvbAhUA4kemGkVmuBPG2o+4NyErYov3k80CgYAmONAUi
TKqOfs+bdlLWWpMdiM5BAI1XPLLGjDDHlBd3ZtZ4s2qBT1YwHuiNrhuB699ikIlp/R1z0oI
Xks+kPht6pzJIYo7dhTpzi5dowfNI4W4LzABfG1JiRGJNkS9+MiVSlNWteL5c+waYTYfEX/
Cve3RUP+YdMLRgUpgObo2OQOBhAACgYBc47ladRSWC6l63eM/qeysXty9txMRNKYWiSgRI9
k0hmd1dRMSPUNbb+VRv/qJ8qIbPiR9PQeNW2PIu0WloErjhdbOBoA/6CN+GvIkq1MauCcNH
u8Iv2YUgFxirGX6FYvxuzTU0pY39mFHssQyhPB+QUD9RqdjTjPypeL08oPluKOBgTB/MAwG
A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgbAMB8GA1UdIwQYMBaAFHBEPoIub4feStN14z0
gvEMrk/EfMB0GA1UdDgQWBBS+bKGz48H37UNwpM4TAeL945f+zTAfBgNVHREEGDAWgRRBbG
ljZURTU0BleGFtcGxlLmNvbTAJBgcqhkjOOAQDAzAAMC0CFFUMpBkfQiuJcSIzjYNqtT1na
79FAhUAn2FTUlQLXLLd2ud2HeIQUltDXr0xYzBhAgEBMBgwEjEQMA4GA1UEAxMHQ2FybERT
UwICAMgwBwYFKw4DAhowCQYHKoZIzjgEAwQuMCwCFD1cSW6LIUFzeXle3YI5SKSBer/sAhQ
mCq7s/CTFHOEjgASeUjbMpx5g6A==
4.10. SignedData with Attributes A SignedData message with the following list of signedAttributes:
-unknown OID
-contentHints
-smimeCapablilties
-securityLabel
-ContentReference
-smimeEncryptKeyPreference
-mlExpansionHistory
-EquivalentLabel
0 30 2047: SEQUENCE {
4 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
: (PKCS #7)
15 A0 2032: [0] {
19 30 2028: SEQUENCE {
23 02 1: INTEGER 1
26 31 9: SET {
28 30 7: SEQUENCE {
30 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
: }
: }
37 30 43: SEQUENCE {
2029 02 20: INTEGER
: 63 96 A2 14 8B CF 57 DE B0 48 5F 6C
: 64 DD 84 04 49 5F 1C CA
: }
: }
: }
: }
: }
: }
: }
4.11. SignedData with Certificates Only CA SignedData message with no content or signature, containing only
Alices's and Carl's certificates.
0 30 1672: SEQUENCE {
4 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
: (PKCS #7)
15 A0 1657: [0] {
19 30 1653: SEQUENCE {
23 02 1: INTEGER 1
26 31 0: SET {}
28 30 11: SEQUENCE {
30 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
: }
41 A0 1407: [0] {
45 30 667: SEQUENCE {
49 30 602: SEQUENCE {
53 A0 3: [0] {
55 02 1: INTEGER 2
: }
58 02 1: INTEGER 1
61 30 9: SEQUENCE {
63 06 7: OBJECT IDENTIFIER
: dsaWithSha1 (1 2 840 10040 4 3)
: (ANSI X9.57 algorithm)
: }
72 30 18: SEQUENCE {
74 31 16: SET {
76 30 14: SEQUENCE {
78 06 3: OBJECT IDENTIFIER
: commonName (2 5 4 3)
: (X.520 id-at (2 5 4))
83 13 7: PrintableString 'CarlDSS'
: }
: }
: }
: }
5. Enveloped-data
5.1. Basic Encrypted Content, TripleDES and RSA An EnvelopedData from Alice to Bob of ExContent using TripleDES for
encrypting and RSA for key management. Does not have an
OriginatorInfo.
0 30 286: SEQUENCE {
4 06 9: OBJECT IDENTIFIER
: envelopedData (1 2 840 113549 1 7 3)
: (PKCS #7)
15 A0 271: [0] {
19 30 267: SEQUENCE {
23 02 1: INTEGER 0
26 31 192: SET {
29 30 189: SEQUENCE {
32 02 1: INTEGER 0
35 30 38: SEQUENCE {
37 30 18: SEQUENCE {
39 31 16: SET {
41 30 14: SEQUENCE {
43 06 3: OBJECT IDENTIFIER
: commonName (2 5 4 3)
: (X.520 id-at (2 5 4))
48 13 7: PrintableString 'CarlRSA'
: }
: }
: }
57 02 16: INTEGER
: 46 34 6B C7 80 00 56 BC 11 D3 6E 2E
: CD 5D 71 D0
: }
75 30 13: SEQUENCE {
77 06 9: OBJECT IDENTIFIER
: rsaEncryption (1 2 840 113549 1 1 1)
: (PKCS #1)
88 05 0: NULL
: }
90 04 128: OCTET STRING
: 0B 71 0D E6 71 88 88 98 B6 96 C1 8F
: 70 FD A2 27 DE DA E1 EF 24 6C A4 33
: DF AC E0 E9 9D A2 D3 2C 7A CD 80 B8
: 99 9E E6 5F B1 41 B3 72 16 83 E7 FA
: 2A 00 8B C7 73 35 78 26 D6 C7 CF 8C
: 0C 56 DB A5 76 9D 08 38 0E F3 F9 D4
: 91 43 58 78 DC 49 B6 EC EE 6C 68 33
: A3 21 1D F0 28 78 1F F7 5D F6 07 73
: 4D DF AD 69 31 20 4B 48 A9 75 22 6E
: 36 79 15 63 8F CC EB 9D A3 28 A1 D1
: 2C 57 F4 DA 1A 2C 75 1F
: }
: }
221 30 67: SEQUENCE {
223 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
234 30 20: SEQUENCE {
236 06 8: OBJECT IDENTIFIER
: des-EDE3-CBC (1 2 840 113549 3 7)
: (RSADSI encryptionAlgorithm
: (1 2 840 113549 3))
246 04 8: OCTET STRING
: 2D 68 C5 E9 47 06 51 35
: }
256 80 32: [0]
: 0E C8 92 7F C6 7D 3F 8D CB AD 8E 0E
: C5 49 3A EB 47 2E D6 55 DE 09 21 4E
: 48 EA 4E 27 B1 6E 57 25
: }
: }
: }
: }
5.2. Basic Encrypted Content, RC2/128 and RSA Same as 5.1, except using RC2/128 for encryption and RSA for key
management. An EnvelopedData from Alice to Bob of ExContent using
RC2/40 for encrypting and RSA for key management. Does not have an
OriginatorInfo or any attributes.
0 30 291: SEQUENCE {
4 06 9: OBJECT IDENTIFIER
: envelopedData (1 2 840 113549 1 7 3)
: (PKCS #7)
15 A0 276: [0] {
19 30 272: SEQUENCE {
23 02 1: INTEGER 0
26 31 192: SET {
29 30 189: SEQUENCE {
32 02 1: INTEGER 0
35 30 38: SEQUENCE {
37 30 18: SEQUENCE {
39 31 16: SET {
: 43 56 00 9B 40 8C 38 5D
: }
: }
: }
: }
5.3. S/MIME application/pkcs7-mime Encrypted Message A full S/MIME message, including MIME, that includes the body part
from 5.1.
MIME-Version: 1.0
Message-Id: <00103112005203.00349@amyemily.ig.com>
Date: Tue, 31 Oct 2000 12:00:52 -0600 (Central Standard Time)
From: User1
To: User2
Subject: Example 5.3
Content-Type: application/pkcs7-mime;
name=smime.p7m;
smime-type=enveloped-data
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=smime.p7m
MIIBHgYJKoZIhvcNAQcDoIIBDzCCAQsCAQAxgcAwgb0CAQAwJjASMRAwDgYDVQQDEwdDYXJ
sUlNBAhBGNGvHgABWvBHTbi7NXXHQMA0GCSqGSIb3DQEBAQUABIGAC3EN5nGIiJi2lsGPcP
2iJ97a4e8kbKQz36zg6Z2i0yx6zYC4mZ7mX7FBs3IWg+f6KgCLx3M1eCbWx8+MDFbbpXadC
DgO8/nUkUNYeNxJtuzubGgzoyEd8Ch4H/dd9gdzTd+taTEgS0ipdSJuNnkVY4/M652jKKHR
LFf02hosdR8wQwYJKoZIhvcNAQcBMBQGCCqGSIb3DQMHBAgtaMXpRwZRNYAgDsiSf8Z9P43
LrY4OxUk660cu1lXeCSFOSOpOJ7FuVyU=
6. Digested-data A DigestedData from Alice to Bob of ExContent using SHA-1.
0 30 94: SEQUENCE {
2 06 9: OBJECT IDENTIFIER digestedData (1 2 840 113549 1 7 5)
: (PKCS #7)
13 A0 81: [0] {
15 30 79: SEQUENCE {
17 02 1: INTEGER 0
20 30 7: SEQUENCE {
22 06 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
: (OIW)
: }
29 30 43: SEQUENCE {
31 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
42 A0 30: [0] {
44 04 28: OCTET STRING 'This is some sample content.'
: }
: }
74 04 20: OCTET STRING
: 40 6A EC 08 52 79 BA 6E 16 02 2D 9E
: 06 29 C0 22 96 87 DD 48
: }
: }
: }
7. Encrypted-data
7.1. Simple EncryptedData An EncryptedData from Alice to Bob of ExContent with no attributes.
0 30 87: SEQUENCE {
2 06 9: OBJECT IDENTIFIER
: encryptedData (1 2 840 113549 1 7 6)
: (PKCS #7)
13 A0 74: [0] {
15 30 72: SEQUENCE {
17 02 1: INTEGER 0
20 30 67: SEQUENCE {
22 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
33 30 20: SEQUENCE {
35 06 8: OBJECT IDENTIFIER
: des-EDE3-CBC (1 2 840 113549 3 7)
: (RSADSI encryptionAlgorithm
: (1 2 840 113549 3))
45 04 8: OCTET STRING
: B3 6B 6B FB 62 31 08 4E
: }
55 80 32: [0]
: FA FC ED DB 3F 18 17 1D 38 89 11 EA
: 34 D6 20 DB F4 C3 D9 58 15 EF 93 3B
: 9A F5 D7 04 F6 B5 70 E2
: }
: }
: }
: }
The TripleDES key is:
73 7c 79 1f 25 ea d0 e0 46 29 25 43 52 f7 dc 62
7.2. EncryptedData with Unprotected Attributes An EncryptedData from Alice to Bob of ExContent with unprotected
attributes.
0 30 149: SEQUENCE {
3 06 9: OBJECT IDENTIFIER
: encryptedData (1 2 840 113549 1 7 6)
: (PKCS #7)
14 A0 135: [0] {
17 30 132: SEQUENCE {
20 02 1: INTEGER 2
23 30 67: SEQUENCE {
25 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
: (PKCS #7)
36 30 20: SEQUENCE {
38 06 8: OBJECT IDENTIFIER
: des-EDE3-CBC (1 2 840 113549 3 7)
: (RSADSI encryptionAlgorithm
: (1 2 840 113549 3))
48 04 8: OCTET STRING
: 07 27 20 85 90 9E B0 7E
: }
58 80 32: [0]
: D2 20 8F 67 48 8A CB 41 E4 22 68 5D
: BE 77 05 52 26 ED E3 01 BD 00 91 58
: A7 35 6E BC 4B A2 07 33
: }
92 A1 58: [1] {
94 30 56: SEQUENCE {
96 06 3: OBJECT IDENTIFIER '1 2 5555'
101 31 49: SET {
103 04 47: OCTET STRING
: 'This is a test General ASN Attribut'
: 'e, number 1.'
: }
: }
: }
: }
: }
: }
8. Security Considerations Because this document shows examples of S/MIME and CMS messages, this
document also inherits all of the security considerations from
[SMIME-MSG] and [CMS].
The Perl script in
Appendix A writes to the user's local hard drive.
A malicious attacker could modify the Perl script in this document.
Be sure to read the Perl code carefully before executing it.
9. References
9.1. Normative References [CMS] Housley, R., "Cryptographic Message Syntax (CMS)",
RFC 3852 , July 2004.
[PKIX] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
X.509 Public Key Infrastructure Certificate and
Certificate Revocation List (CRL) Profile",
RFC 3280 ,
April 2002.
[SMIME-MSG] Ramsdell, B., "Secure/Multipurpose Internet Mail
Extensions (S/MIME) Version 3.1 Message Specification",
RFC 3851 , July 2004.
9.2. Informative References [DVCS] Adams, C., Sylvester, P., Zolotarev, M., and R.
Zuccherato, "Internet X.509 Public Key Infrastructure
Data Validation and Certification Server Protocols",
RFC 3029 , February 2001.
A. Binaries of the Examples This section contains the binaries of the examples shown in the rest
of the document. The binaries are stored in a modified Base64
format. There is a Perl program that, when run over the contents of
this document, will extract the following binaries and write them out
to disk. The program requires Perl.
A.1. How the Binaries and Extractor Works The program in the next section looks for lines that begin with a '|'
character (or some whitespace followed by a '|'), ignoring all other
lines. If the line begins with '|', the second character tells what
kind of line it is:
A line that begins with |* is a comment
A line that begins with |> gives the name of a new file to start
A line that begins with |< tells to end the file (and checks the
file name for sanity)
A line that begins with |anythingelse is a Base64 line
The program writes out a series of files, so you should run this in
an empty directory. The program will overwrite files (if it can),
but won't delete other files already in the directory.
Run this program with this document as the standard input, such as:
./extractsample.pl <draft-ietf-smime-examples
If you want to extract without the program, copy all the lines
between the "|>" and "|<" markers, remove any page breaks, and remove
the "|" in the first column of each line. The result is a valid
Base64 blob that can be processed by any Base64 decoder.
A.2. Example Extraction Program#!/usr/bin/perl
# CMS Samples extraction program. v 1.1
# Get all the input as an array of lines
@AllIn = (); while (<STDIN>) { push(@AllIn, $_) }
$Base64Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqr' .
'stuvwxyz0123456789+/=';
$LineCount = 0; $CurrFile = '';
foreach $Line (@AllIn) {
# Don't output anything, just fill the left of $LeftOver
$LeftOver = $ThisVal * 4;
$NextPos = 6;
} elsif ($NextPos == 2) {
# Add $ThisVal to $LeftOver, output, and reset
$OutString .= chr($LeftOver + $ThisVal);
$LeftOver = 0;
$NextPos = 0;
} elsif ($NextPos == 4) {
# Add upper 4 bits of $ThisVal to $LeftOver and output
$Upper4 = ($ThisVal & 60);
$OutString .= chr($LeftOver + ($Upper4/4));
$LeftOver = (($ThisVal - $Upper4) * 64);
$NextPos = 2;
} elsif ($NextPos == 6) {
# Add upper 2 bits of $ThisVal to $LeftOver and output
$Upper2 = ($ThisVal & 48);
$OutString .= chr($LeftOver + ($Upper2/16));
$LeftOver = (($ThisVal - $Upper2) * 16);
$NextPos = 4;
} else { die "\$NextPos has an illegal value: $NextPos." }
}
}
B. Examples in Order of AppearanceFrom
Section 2.1 ***ExContent.bin***
|*
Section 2.1 |>ExContent.bin
|VGhpcyBpcyBzb21lIHNhbXBsZSBjb250ZW50Lg==
|<ExContent.bin
From
Section 2.2 ***AlicePrivDSSSign.pri***
|* Example AlicePrivDSSSign.pri
|>AlicePrivDSSSign.pri
|MIIBSwIBADCCASsGByqGSM44BAEwggEeAoGBAIGNze2D6gqeOT7CSCij5EeT3Q7XqA7sU8
|WrhAhP/5Thc0h+DNbzREjR/p+vpKGJL+HZMMg23j+bv7dM3F9piuR10DcMkQiVm96nXvn8
|9J8v3UOoi1TxP7AHCEdNXYjDw7Wz41UIddU5dhDEeL3/nbCElzfy5FEbteQJllzzflvbAh
|UA4kemGkVmuBPG2o+4NyErYov3k80CgYAmONAUiTKqOfs+bdlLWWpMdiM5BAI1XPLLGjDD
|HlBd3ZtZ4s2qBT1YwHuiNrhuB699ikIlp/R1z0oIXks+kPht6pzJIYo7dhTpzi5dowfNI4
|W4LzABfG1JiRGJNkS9+MiVSlNWteL5c+waYTYfEX/Cve3RUP+YdMLRgUpgObo2OQQXAhUA
|u0RG0aXJRgcu0P561pIH8JqFiT8=
|<AlicePrivDSSSign.pri
***AlicePrivRSASign.pri***
|* Example AlicePrivRSASign.pri
|>AlicePrivRSASign.pri
|MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAOCJczmN2PX16Id2OX9OsA
|W7U4PeD7er3H3HdSkNBS5tEt+mhibU0m+qWCn8l+z6glEPMIC+sVCeRkTxLLvYMs/GaG8H
|2bBgrL7uNAlqE/X3BQWT3166NVbZYf8Zf8mB5vhs6odAcO+sbSx0ny36VTq5mXcCpkhSjE
|7zVzhXdFdfAgMBAAECgYAApAPDJ0d2NDRspoa1eUkBSy6K0shissfXSAlqi5H3NvJ11ujN
|FZBgJzFHNWRNlc1nY860n1asLzduHO4Ovygt9DmQbzTYbghb1WVq2EHzE9ctOV7+M8v/Ke
|QDCz0Foo+38Y6idjeweVfTLyvehwYifQRmXskbr4saw+yRRKt/IQJBAPbW4CIhTF8KcP8n
|/OWzUGqd5Q+1hZbGQPqoCrSbmwxVwgEd+TeCihTI8pMOks2lZiG5PNIGv7RVMcncrcqYLd
|ECQQDo3rARJQnSAlEB3oromFD1d3dhpEWTawhVlnNd9MhbEpMic4t/03B/9aSqu3T9PCJq
|2jiRKoZbbBTorkye+o4vAkEAl0zwh5sXf+4bgxsUtgtqkF+GJ1Hht6B/9eSI41m5+R6b0y
|l3OCJI1yKxJZi6PVlTt/oeILLIURYjdZNR56vN8QJALPAkW/qgzYUi6tBuT/pszSHTyOTx
|hERIZHPXKY9+RozsFd7kUbOU5yyZLVVleyTqo2IfPmxNZ0ERO+G+6YMCgwJAWIjZoVA4hG
|qrA7y730v0nG+4tCol+/bkBS9u4oiJIW9LJZ7Qq1CTyr9AcewhJcV/+wLpIZa4M83ixpXu
|b41fKA==
|<AlicePrivRSASign.pri
***BobPrivRSAEncrypt.pri***
|* Example BobPrivRSAEncrypt.pri
|>BobPrivRSAEncrypt.pri
|MIIChQIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAKnhZ5g/OdVf8qCTQV6meY
|mFyDVdmpFb+x0B2hlwJhcPvaUi0DWFbXqYZhRBXM+3twg7CcmRuBlpN235ZR572akzJKN/
|O7uvRgGGNjQyywcDWVL8hYsxBLjMGAgUSOZPHPtdYMTgXB9T039T2GkB8QX4enDRvoPGXz
|jPHCyqaqfrAgMBAAECgYBnzUhMmg2PmMIbZf8ig5xt8KYGHbztpwOIlPIcaw+LNd4Ogngw
|y+e6alatd8brUXlweQqg9P5F4Kmy9Bnah5jWMIR05PxZbMHGd9ypkdB8MKCixQheIXFD/A
|0HPfD6bRSeTmPwF1h5HEuYHD09sBvf+iU7o8AsmAX2EAnYh9sDGQJBANDDIsbeopkYdo+N
|vKZ11mY/1I1FUox29XLE6/BGmvE+XKpVC5va3Wtt+Pw7PAhDk7Vb/s7q/WiEI2Kv8zHCue
|UCQQDQUfweIrdb7bWOAcjXq/JY1PeClPNTqBlFy2bKKBlf4hAr84/sajB0+E0R9KfEILVH
|IdxJAfkKICnwJAiEYH2PAkA0umTJSChXdNdVUN5qSO8bKlocSHseIVnDYDubl6nA7xhmqU
|5iUjiEzuUJiEiUacUgFJlaV/4jbOSnI3vQgLeFAkEAni+zN5r7CwZdV+EJBqRd2ZCWBgVf
|JAZAcpw6iIWchw+dYhKIFmioNRobQ+g4wJhprwMKSDIETukPj3d9NDAlBwJAVxhn1grSta
|vCunrnVNqcBU+B1O8BiR4yPWnLMcRSyFRVJQA7HCp8JlDV6abXd8vPFfXuC9WN7rOvTKF8
|Y0ZB9qANMAsGA1UdDzEEAwIAEA==
|<BobPrivRSAEncrypt.pri
***CarlPrivDSSSign.pri***
|* Example CarlPrivDSSSign.pri
|>CarlPrivDSSSign.pri
|MIIBSgIBADCCASsGByqGSM44BAEwggEeAoGBALZJGD6KRMEpcZRMAcQSwXp5y1RNqx6B+8
|ZMsw6UCQbrAdSxyHFLx0XAUCVdnPza5G3T4oZIhIJ9uhWVShb2Ru3d9pjSu36KCoq6Fnu5
|UAFIk4vrJRVRl1Xcj1MOEKlQ/HC3zTBU/dreqKoitaGvi8wCiOeLcF+5reEI1G0pLdbpAh
|UA3cEv31POCzRgdz4CpL+KXZi5ENUCgYAM7lebS73atgdqdDdPVX+d7bxhDetGWTxWCytb
|UCQQDh0ucRVwaucpUiFqoCtFrtTp2CEU+WPIbJEI1WezF1eWnndWg4AEsu0iYy3bHi4CxU
|gAp1utFmlhuwDqB+0ruRAkEAr7a82yJzQ0HstLVnqaGZ/O/Sjv0d++Upi/4K39TIXlclCl
|0r1AmgVlvFsWL8IL4ILeMHtaHns//EwKVfrBJcqQJBALmYQfwIUB9zYIoBonxSiiBa6iyJ
|2aUZ3ZTGG8MlwIJR5O4rmhncc+3pHSfU+GwD3asdCHu1rH/pgpvxiYpx22ECQAEHIZdfem
|Co/VpcB9+o3vfisTR9/OuRvbBzdMjEvj9YRTAGkLOsacyz9z98rMe4G2WhFjk5sON0fc/N
|xaxsv+U=
|<DianePrivRSASignEncrypt.pri
From
Section 2.3 ***AliceDSSSignByCarlNoInherit.cer***
|* Example AliceDSSSignByCarlNoInherit.cer
|>AliceDSSSignByCarlNoInherit.cer
|MIIC3DCCApugAwIBAgICAMgwCQYHKoZIzjgEAzASMRAwDgYDVQQDEwdDYXJsRFNTMB4XDT
|k5MDgxNzAxMTA0OVoXDTM5MTIzMTIzNTk1OVowEzERMA8GA1UEAxMIQWxpY2VEU1MwggG2
|MIIBKwYHKoZIzjgEATCCAR4CgYEAgY3N7YPqCp45PsJIKKPkR5PdDteoDuxTxauECE//lO
|FzSH4M1vNESNH+n6+koYkv4dkwyDbeP5u/t0zcX2mK5HXQNwyRCJWb3qde+fz0ny/dQ6iL
|VPE/sAcIR01diMPDtbPjVQh11Tl2EMR4vf+dsISXN/LkURu15AmWXPN+W9sCFQDiR6YaRW
|a4E8baj7g3IStii/eTzQKBgCY40BSJMqo5+z5t2UtZakx2IzkEAjVc8ssaMMMeUF3dm1ni
|zaoFPVjAe6I2uG4Hr32KQiWn9HXPSgheSz6Q+G3qnMkhijt2FOnOLl2jB80jhbgvMAF8bU
|mJEYk2RL34yJVKU1a14vlz7BphNh8Rf8K97dFQ/5h0wtGBSmA5ujY5A4GEAAKBgFzjuVp1
|FJYLqXrd4z+p7Kxe3L23ExE0phaJKBEj2TSGZ3V1ExI9Q1tv5VG/+onyohs+JH09B41bY8
|i7RaWgSuOF1s4GgD/oI34a8iSrUxq4Jw0e7wi/ZhSAXGKsZfoVi/G7NNTSljf2YUeyxDKE
|8H5BQP1Gp2NOM/Kl4vTyg+W4o4GBMH8wDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBs
|AwHwYDVR0jBBgwFoAUcEQ+gi5vh95K03XjPSC8QyuT8R8wHQYDVR0OBBYEFL5sobPjwfft
|Q3CkzhMB4v3jl/7NMB8GA1UdEQQYMBaBFEFsaWNlRFNTQGV4YW1wbGUuY29tMAkGByqGSM
|44BAMDMAAwLQIUVQykGR9CK4lxIjONg2q1PWdrv0UCFQCfYVNSVAtcst3a53Yd4hBSW0Ne
|vQ==
|<AliceDSSSignByCarlNoInherit.cer
***AliceRSASignByCarl.cer***
|* Example AliceRSASignByCarl.cer
|>AliceRSASignByCarl.cer
|MIICLDCCAZWgAwIBAgIQRjRrx4AAVrwR024uxBCzsDANBgkqhkiG9w0BAQUFADASMRAwDg
|YDVQQDEwdDYXJsUlNBMB4XDTk5MDkxOTAxMDg0N1oXDTM5MTIzMTIzNTk1OVowEzERMA8G
|A1UEAxMIQWxpY2VSU0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOCJczmN2PX16I
|d2OX9OsAW7U4PeD7er3H3HdSkNBS5tEt+mhibU0m+qWCn8l+z6glEPMIC+sVCeRkTxLLvY
|Ms/GaG8H2bBgrL7uNAlqE/X3BQWT3166NVbZYf8Zf8mB5vhs6odAcO+sbSx0ny36VTq5mX
|cCpkhSjE7zVzhXdFdfAgMBAAGjgYEwfzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIG
|wDAfBgNVHSMEGDAWgBTp4JAnrHggeprTTPJCN04irp44uzAdBgNVHQ4EFgQUd9K00bdMio
|qjzkWdzuw8oDrj/1AwHwYDVR0RBBgwFoEUQWxpY2VSU0FAZXhhbXBsZS5jb20wDQYJKoZI
|hvcNAQEFBQADgYEAPnBHqEjME1iPylFxa042GF0EfoCxjU3MyqOPzH1WyLzPbrMcWakgqg
|WBqE4lradwFHUv9ceb0Q7pY9Jkt8ZmbnMhVN/0uiVdfUnTlGsiNnRzuErsL2Tt0z3Sp0LF
|6DeKtNufZ+S9n/n+dO/q+e5jatg/SyUJtdgadq7rm9tJsCI=
|<AliceRSASignByCarl.cer
|P+MLuGGlpJs85p6cVJq2ldbabDu1LUU1nUkBdvq5uTH5+WsSU6D1FGCbfco+8lNrsDdvre
|Z019v6WuoUQWNdzb7IDsHaao1TNBgC
|<CarlRSASelf.cer
***DianeDSSSignByCarlInherit.cer***
|* Example DianeDSSSignByCarlInherit.cer
|>DianeDSSSignByCarlInherit.cer
|MIIBuDCCAXegAwIBAgICANIwCQYHKoZIzjgEAzASMRAwDgYDVQQDEwdDYXJsRFNTMB4XDT
|k5MDgxNzAyMDgxMFoXDTM5MTIzMTIzNTk1OVowEzERMA8GA1UEAxMIRGlhbmVEU1MwgZMw
|CQYHKoZIzjgEAQOBhQACgYEAoAAXeCzufoFTLi5hCA+hm1FSGtpZqHMvEiW2CMvK7ypEdo
|pSCeq9BSLVD/b9RtevmTgJDhPLTyzdHDT3HL8l/yPTO1nngpc3vjEk2BjI80k5W7fi5Sd+
|/IxFclt+Po9oTd1GeiK+jv/M2jkpoznln0PpVcnXW6aBZ8zAqs0uxSOjgYEwfzAMBgNVHR
|MBAf8EAjAAMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBRwRD6CLm+H3krTdeM9ILxD
|K5PxHzAdBgNVHQ4EFgQUZDCZfVzcRQuZOlIvFr9YUN3OKxgwHwYDVR0RBBgwFoEURGlhbm
|VEU1NAZXhhbXBsZS5jb20wCQYHKoZIzjgEAwMwADAtAhUAoRr4Fw4+XaiM9LZVMx5L4yys
|uV8CFChLEEVY0hydVTUUGJGyPznftW7T
|<DianeDSSSignByCarlInherit.cer
***DianeRSASignByCarl.cer***
|* Example DianeRSASignByCarl.cer
|>DianeRSASignByCarl.cer
|MIICLDCCAZWgAwIBAgIQRjRrx4AAVrwR024u1ZowkDANBgkqhkiG9w0BAQUFADASMRAwDg
|YDVQQDEwdDYXJsUlNBMB4XDTk5MDgxOTA3MDAwMFoXDTM5MTIzMTIzNTk1OVowEzERMA8G
|A1UEAxMIRGlhbmVSU0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANb9uMBwxkwl7O
|rP6ny7omL68OYyOlP/sZJaF/Qg4ZkkggrQ9nz7RMqLJwbxfiYDqXadz+ygLHCW8oNC9tS3
|KAq7+L9KTBk/B9ugwWAet35n996xw2BJrEXX+MbvCDchk0fu8HM1crACxPMRw15H5Qq3g/
|HbdGlki0QdlV3NKMCFAgMBAAGjgYEwfzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF
|4DAfBgNVHSMEGDAWgBTp4JAnrHggeprTTPJCN04irp44uzAdBgNVHQ4EFgQUjPPLdQ6NMf
|bUKdpEknW4/u1POQwwHwYDVR0RBBgwFoEURGlhbmVSU0FAZXhhbXBsZS5jb20wDQYJKoZI
|hvcNAQEFBQADgYEAfaYstXhC1nnzMf72QsoPEweSCRvgb7CRGPa/SvvMY3n7gb/dl8eQa8
|sKNytBagOYxRs+MshFK4YBnBziNu8WwRqSuL5i+1M+SUcLxLnkK1imBoPwsqe7hX7VxtrO
|nHsxctei6kGrasDdH7kURBjPhFdm6MXmuNwtsx8bKEM2dXo=
|<DianeRSASignByCarl.cer
From
Section 2.4 ***CarlDSSCRLForAll.crl***
|* Example CarlDSSCRLForAll.crl
|>CarlDSSCRLForAll.crl
|MIHYMIGZMAkGByqGSM44BAMwEjEQMA4GA1UEAxMHQ2FybERTUxcNOTkwODI3MDcwMDAwWj
|BpMBMCAgDIFw05OTA4MjIwNzAwMDBaMBMCAgDJFw05OTA4MjIwNzAwMDBaMBMCAgDTFw05
|OTA4MjIwNzAwMDBaMBMCAgDSFw05OTA4MjIwNzAwMDBaMBMCAgDUFw05OTA4MjQwNzAwMD
|BaMAkGByqGSM44BAMDLwAwLAIUfmVSdjP+NHMX0feW+aDU2G1cfT0CFAJ6W7fVWxjBz4fv
|ftok8yqDnDWh
|<CarlDSSCRLForAll.crl
***7.1.bin***
|* Example 7.1.bin
|>7.1.bin
|MFcGCSqGSIb3DQEHBqBKMEgCAQAwQwYJKoZIhvcNAQcBMBQGCCqGSIb3DQMHBAiza2v7Yj
|EIToAg+vzt2z8YFx04iRHqNNYg2/TD2VgV75M7mvXXBPa1cOI=
|<7.1.bin
***7.2.bin***
|* Example 7.2.bin
|>7.2.bin
|MIGVBgkqhkiG9w0BBwaggYcwgYQCAQIwQwYJKoZIhvcNAQcBMBQGCCqGSIb3DQMHBAgHJy
|CFkJ6wfoAg0iCPZ0iKy0HkImhdvncFUibt4wG9AJFYpzVuvEuiBzOhOjA4BgMqqzMxMQQv
|VGhpcyBpcyBhIHRlc3QgR2VuZXJhbCBBU04gQXR0cmlidXRlLCBudW1iZXIgMS4=
|<7.2.bin
C. Acknowledgements Blake Ramsdell, Jim Schaad, and John Pawling contributed the vast
majority of the examples in this document, and/or correct examples
during the early versions of this document. Additional examples came
from many people, including Rob Colestock and Paul Hoffman.
Additional testing came from Holger Ebel and Russ Housley.
The examples are displayed with a modified version of Peter Gutmann's
"dumpasn1" program. Peter and Jim Schaad and Blake Ramsdell have
been updating the program based on input from the process of writing
this draft.
Editor's Address Paul Hoffman
Internet Mail Consortium
127 Segre Place
Santa Cruz, CA 95060 USA
EMail: phoffman@imc.org
Full Copyright Statement Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr .
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at ietf-
ipr@ietf.org.
Acknowledgement Funding for the RFC Editor function is currently provided by the
Internet Society.