PKCS#7中的ContentInfo解释

ContentInfo解释

ContentInfo ::= SEQUENCE {
  contentType ContentType,
  content
    [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL }

ContentType ::= OBJECT IDENTIFIER

ContentType是一OID，目前定义了7种：

1. pkcs-7：OBJECT IDENTIFIER ::=  { iso(1) member-body(2) US(840) rsadsi(113549)   pkcs(1) 7 }

2a 86 48 86 f7 0d 01 07

1. data OBJECT IDENTIFIER ::= { pkcs-7 1 }

2a 86 48 86 f7 0d 01 07 01

（3）signedData OBJECT IDENTIFIER ::= { pkcs-7 2 }

2a 86 48 86 f7 0d 01 07 02

（4）envelopedData OBJECT IDENTIFIER ::= { pkcs-7 3 }
   2a 86 48 86 f7 0d 01 07 03

（5）signedAndEnvelopedData OBJECT IDENTIFIER ::=
  { pkcs-7 4 }

   2a 86 48 86 f7 0d 01 07 04

（6）digestedData OBJECT IDENTIFIER ::= { pkcs-7 5 }

   2a 86 48 86 f7 0d 01 07 05

（7）encryptedData OBJECT IDENTIFIER ::= { pkcs-7 6 }

2a 86 48 86 f7 0d 01 07 06

例子：

certchain.spc

//最外层 或内层（ 信封）

ContentInfo ::= SEQUENCE {

  contentType ContentType,

  content    [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL

}

ContentType ::= OBJECT IDENTIFIER

SignedData ::= SEQUENCE {

  [01]version Version,                           //1

  [02]digestAlgorithms DigestAlgorithmIdentifiers,  //SET OF DigestAlgorithmIdentifier

  [03]contentInfo ContentInfo,                    //content

  [04]certificates                                    //[a0] 证书 a0 xx Certificate

          [0] IMPLICIT ExtendedCertificatesAndCertificates

       OPTIONAL,

  [05]crls

    [1] IMPLICIT CertificateRevocationLists OPTIONAL, //免

  [06]signerInfos SignerInfos                     //SET OF SignerInfo

}

ExtendedCertificatesAndCertificates ::={

  SET OF ExtendedCertificateOrCertificate

}

ExtendedCertificateOrCertificate ::= CHOICE {30

  certificate Certificate, -- X.509

  extendedCertificate [0] IMPLICIT ExtendedCertificate (pkcs#6)

}

30 82 05 34 (总包长)

 06 09 2a 86 48 86 f7 0d 01 07 02

      签名数据ContentType

      pkcs7_signed ={ 9, "\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"};

 a0 82 05 25 (到最后的总长)content    [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL （注意这里的数据类型必须与上面的一致）

  30 82 05 21

   [01]02 01 01 //Version

   [02]31 00 //SET OF DigestAlgorithmIdentifier

   [03]30 0b //ContentInfo

   06 09 2a 86 48 86 f7 0d 01 07 01 pkcs7_data ={ 9, "\x2A\x86\x48\x86\xF7\x0D\x01\x07\x01"}

   [04]a0 82 05 09  //最后的31 00 与之并列

          30 82 01 c3  //一份根证书

            。。。。。。

              30 82 03 3e //子CA证书

               

   [05]crls无 OPTION

   [06]31 00

  

netscape_cert_type  

  06 09 60 86 48 01 86 f8 42 01 01

  04 04

   03 02

    01 06   ==>SSL CA , SMIME CA(06)

   

basicConstraints

55 1d 13

 04 08

  30 06

   01 01 ff (ca certificate)02 01 0a 证书路经长度为10