<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Bonjour Stephan,</div>
<br class="">
<div apple-content-edited="true" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class=""><br class="">
</div>
</div>
</div>
<div>
<blockquote type="cite" class="">
<div class="">Le 9 févr. 2016 à 12:29, Stephan Mühlstrasser <<a href="mailto:stm@pdflib.com" class="">stm@pdflib.com</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">Am 09.02.16 um 11:53 schrieb Erwann Abalea:<br class="">
<blockquote type="cite" class="">Bonjour,<br class="">
<br class="">
<blockquote type="cite" class="">Le 9 févr. 2016 à 10:15, Stephan Mühlstrasser <<a href="mailto:stm@pdflib.com" class="">stm@pdflib.com</a><br class="">
<<a href="mailto:stm@pdflib.com" class="">mailto:stm@pdflib.com</a>>> a écrit :<br class="">
...<br class="">
<br class="">
SET {<br class="">
[1] {<br class="">
SEQUENCE {<br class="">
INTEGER 3<br class="">
…<br class="">
</blockquote>
<br class="">
This is the expression of an EXPLICIT tag.<br class="">
<br class="">
<blockquote type="cite" class="">I can match this to the following rules in RFC 5652:<br class="">
<br class="">
RecipientInfos ::= SET SIZE (1..MAX) OF RecipientInfo<br class="">
<br class="">
RecipientInfo ::= CHOICE {<br class="">
ktri KeyTransRecipientInfo,<br class="">
kari [1] KeyAgreeRecipientInfo,<br class="">
kekri [2] KEKRecipientInfo,<br class="">
pwri [3] PasswordRecipientinfo,<br class="">
ori [4] OtherRecipientInfo }<br class="">
<br class="">
KeyAgreeRecipientInfo ::= SEQUENCE {<br class="">
version CMSVersion, -- always set to 3<br class="">
originator [0] EXPLICIT OriginatorIdentifierOrKey,<br class="">
ukm [1] EXPLICIT UserKeyingMaterial OPTIONAL,<br class="">
keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,<br class="">
recipientEncryptedKeys RecipientEncryptedKeys }<br class="">
</blockquote>
<br class="">
See RFC5652 section 12.1.<br class="">
These data types are defined in a module with IMPLICIT TAGS (it was<br class="">
changed between PKCS#7v1.5 and RFC2630), so kari, kekri, pwri, and ori<br class="">
elements are associated to an IMPLICIT tag.<br class="">
<br class="">
Additional definition to read the dump.<br class="">
<br class="">
OriginatorIdentifierOrKey ::= CHOICE {<br class="">
issuerAndSerialNumber IssuerAndSerialNumber,<br class="">
subjectKeyIdentifier [0] SubjectKeyIdentifier,<br class="">
originatorKey [1] OriginatorPublicKey }<br class="">
<br class="">
OriginatorPublicKey ::= SEQUENCE {<br class="">
algorithm AlgorithmIdentifier,<br class="">
publicKey BIT STRING }<br class="">
<br class="">
<br class="">
<blockquote type="cite" class="">If I dump a CMS object that was created with OpenSSL's CMS tool with<br class="">
the same certificate as the problematic one, the structure of the<br class="">
RecipientInfos object looks like this:<br class="">
<br class="">
SET {<br class="">
[1] {<br class="">
INTEGER 3<br class="">
…<br class="">
</blockquote>
<br class="">
<blockquote type="cite" class="">So the "SEQUENCE" element of the KeyAgreeRecipientInfo is not present<br class="">
here.<br class="">
</blockquote>
<br class="">
This is the correct behavior of an IMPLICIT tag.<br class="">
</blockquote>
<br class="">
many thanks for the analysis! One follow-up question:<br class="">
<br class="">
I can also not decrypt the recipient.bin file with the "openssl smime" command. Do I understand it correctly then that the input file is neither a correct PKCS#7 file nor a correct CMS file?<br class="">
</div>
</blockquote>
</div>
<br class="">
<div class="">PKCS#7 and CMS are pretty much interchangeable.</div>
<div class="">Here, your file is strictly not a PKCS#7v1.5, because in this version, RecipientInfo wasn’t a CHOICE (see RFC2315 to see PKCS#7v1.5 definitions).</div>
<div class=""><br class="">
</div>
<div class="">How did you generate this structure? Adobe Acrobat?</div>
</body>
</html>