Skip to content

Conversation

@neubaner
Copy link

@neubaner neubaner commented Mar 6, 2019

Problem

If one is doing an detached signing, buffering the whole data to sign it is really inconvenient.

Solution

My approach here is to allow a user-definied message digest, so you can code something like this:

const hash = crypto.createHash('sha512');
  
stream.on('data', chunk => hash.update(chunk));
stream.on('end', () => {
  const messageDigest = forge.util.createBuffer(hash.digest().toString('binary'));
  const p7 = pkcs7.createSignedData();
  
  p7.addSigner({
    key: privateKey,
    certificate: certificate,
    digestAlgorithm: forge.pki.oids.sha512,
    authenticatedAttributes: [{
      type: forge.pki.oids.contentType,
      value: forge.pki.oids.data
    },{
      type: forge.pki.oids.signingTime,
      value: new Date()
    },{
      type: forge.pki.oids.messageDigest,
      value: messageDigest
    }]
  });
  p7.sign({ detached: true });
});

Maybe a better way to solve this is by allowing p7.content to be able to receive a data stream, but for now this seems to solve the problem quite well.

@Simolation
Copy link

Is it possible to merge this PR, as this would be really useful for my use case?

@nanndoj
Copy link

nanndoj commented Apr 23, 2022

@davidlehn Any drawback to this approach? I am glad to help this PR to get merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants